> Once your revenue exceeds x million USD on ad supported services that are free for end users, you must offer the service also for money with reasonable margin on top of the actual production costs, with strong guarantees that the data of end user who has opted for paid service is kept private and not monetized anyhow

I like the size threshold but not the solution. Toying with business models should be a solution of last resort.

Simpler: for companies with more than X users or Y gross revenues, an American GDPR. Consumers get an absolute right to audit and delete their data. Explicit consent is required for each instance of third-party sharing. Companies are liable to their users for breaches, with a minimum amount directly claimable by users through an easily-accessibly regulator.

Why a size threshold? An American GDPR seems like a fine idea, especially if it’a similar enough to GDPR that complying with one gets the other for free.

Size threshold is presumably to allow small startups to grow and explore models without crushing compliance costs. That’s the kind of regulation that protects incumbents who can afford the lawyers and software tools to do compliance properly.

There tends to be an inverse relationship between regulation in a space and incumbents springing up, for better or for worse

There's a fine line between "grow and explore models without crushing compliance costs" and "break all the rules so you can outcompete established players". Hi, Uber!

Correctly handling user data is much cheaper if you bake it in from the start. The real costs are in figuring out how to follow GDPR when you already have private user data saved all over the place and suddenly need to be able to do things like permanently remove all identifiable information for a single user.

It isn't a huge loss if we no longer explore models that require violating privacy protections to get off the ground.

The overhead cost of compliance with something like GDPR would probably kill most small startups that had a data-backed business model.

There isn't really that much overhead, especially if you keep the GDPR in mind from the beginning. The big costs happen at older and larger companies that had very lax procedures before.

I bet it will not inhibit startups in the EU.

To some part I think the GDPR is intended to make it easier for startups in Europe to compete with US services on the EU market.

In recent times, being a privacy-aware service is a selling point and the EU services can easily advertise as being privacy-first to US citizens while US companies will have trouble doing so (considering SESTA/FOSTA and CLOUD act)

Do we want startups to have a "data-backed business model"?

Yeah we do. While I don't like Google tracking where I am from my cell phone when location-sharing is off, I love listening to music on Pandora and Spotify and I would never discover the new songs I do if there was no option to like or ban songs and evolve the station.

I don't see how either of those are "data-backed business models". Pandora/Spotify have a very clear draw for people which exists regardless of how much data they store on people. They absolutely can and do use data to _enhance_ their core offering, but if they stopped overnight it would not cripple their business immediately.

Both aslo offer a very clear service, (streaming music) and both only really collect data to improve your music experience.

Facebook seems to grab whatever it can, just to make money.

People that are willing to pay are your ad targets. Such a system devalues the rest of your base.

What about a syndicated network of N companies, each with X-1 users and Y-1 gross revenue? It sounds like what you're describing would be easy to game.

> What about a syndicated network of N companies, each with X-1 users and Y-1 gross revenue?

Size-dependent threshold exist across our tax and regulatory codes. Concepts like beneficial ownership [1] and affiliation [2], amongst others, address these issues.

[1] https://en.wikipedia.org/wiki/Beneficial_ownership

[2] https://www.investopedia.com/terms/a/affiliate.asp

I agree that I do not exactly like forcing business models to companies. But I think especially facebook and google are currently so difficult to avoid that their users should be given a fair choice on how to pay for their services, with money or with data.

2. would we an extremely bad law. Even if purely "social" factors will be worked out and we come up with a perfect definition of when and how this should apply — how the fuck do you mean to enforce it? It will make only more trouble and bureaucracy for tech people (I mean actual programmers) with no useful output. Because you cannot realistically enforce it. Data either belongs to somebody, or it doesn't. Either you come up with technological solution for keeping user data secure from anybody including youself (which would be equivalent to not storing it at all, and I'm not sure it's possible for every application), or you make it responsibility of some shady but "reputable" auditors to make sure there's no crime going on, which is a dead end, as even if there's no bribes and conspiracy (which there sure will be), it only passes the responsibility and assumes the end user "trusts" the regulator, the government — well, just "someone else". Which is just silly.

Same applies to 3. at some extent. Only 1. may be assumed reasonably (even though still not "easily", as in practice it will just produce more work for lawyers and accountants) transparent for the public.

The original comment said:

"[...] with strong guarantees that the data of end user who has opted for paid service is kept private and not monetized anyhow."

As an "actual programmer" myself, I don't see how that would be so burdensome to implement. The data is somehow segregated so that it's excluded from being sold to advertisers in any form. The user can have their data deleted permanently at any time.

It obviously wouldn't prevent someone from authorizing a 3rd party app to all of my Facebook data, but that is more about Facebook educating people about what they're consenting to rather than a philosophical debate about ownership of data.

> The data is somehow segregated so that it's excluded from being sold to advertisers in any form.

That doesn't mix with there being free users whose data is sold to advertisers, because it's the same data. You share your photo with another user who in turn shares it with another user etc. That's what a social network is.

So what happens when the vast majority of everything is shared with both types of users? If touching a free user means it can be subject to facial recognition and tagging and everything else for advertising then there is little point in paying. If touching a paid user means it can't then it destroys the revenue model for free users and the price of paying would be high enough to discourage everyone from doing it, because you're de facto paying for all the free users you share anything with.

> As an "actual programmer" myself, I don't see how that would be so burdensome to implement

Oh, but you will see, when your manager (who doesn't really understand the implications of various technical decisions, by the way) will order you to do something completely meaningless (in your opinion), because the regulatory documents (made by people who understand and care for the implications of technical decisions far, far less than your manager) say something meaningless, contradictory and hard to interpret in the first place. If you aren't familiar with such situation it's probably because you are not working in a regulated industry, not because these things "solve themselves" in practice. No, in practice they don't.

I'm not sure what you consider as "no useful output"? Is it the offering your services for a fee instead of ads or guaranteeing the privacy of your users' data?

Because to me, both are quite useful outputs. The first one is quite common practice, and for the second one there are other industries (e.g. financial, medical) from where we can see how this is actually already done in legislation and practice.

(I would think that majority of Google's and Facebook's technical challenges are because they want to utilize the customer data.)

There are tons of rules that are not immediately enforceable, but are still in place and make the society better. Make it illegal, find and punish people who don't follow the rules, and things will be better. Many people are not willing to do outrightly illegal stuff.

That's a curious opinion and I still am too see the facts to back it up with, perhaps you can provide it. Because, as a matter of fact, I've seen exactly the opposite: laws that are not enforceable are the worst laws ever, disasterous even. If they are not "important" in their consequences, they just leave the simple folks (small businesses, for example — and hurting small business is really unwise thing to do IMO) in the state of FUD, because it takes a professional cons-man (e.g. and experienced lawyer) to know how to deal with this bullshit — it puts "honest" people in uncomfortable position, while doing nothing to people who are used to operating in perpetual state of moral hazard, which means it is beneficial to people who are most likely to exploit the law (or its absence) to start with. If this law is more "important" and involves a lot of regulations it fuels corruption, because, again, it's beneficial for dishonest people — it's up to somebody's opinion if you are breaking the law, and opinions can be swayed with some money…

In the most general and seemingly "harmless" case these laws do exactly nothing: nobody is following them and nobody tries to punish people for not following them. This just makes the legal system more complicated (and — yes, there are plenty of such laws, and this is one of the reasons so many legal systems are shit) and provokes the disrespectful, hand-waving attitude towards the law, which isn't a good thing either.

no. 2 is guaranteed cost plus pricing. Quite a lot of fiascos built on that principle.

Regulation is harder than it seems. The legal system we use... it just doesn't really work that way. It doesn't fail just because of corruption and such. That said, here's one. Whatever they collect, users can elect to have a copy and easily with a 3rd party. At least that way we could watch them watching us.

I am confident that facebook makes much more money on the ads it shows me than what is any reasonable margin on the actual cost of serving me the pages and storing my status updates. So in this case this guaranteed cost plus is much less than what facebook currently does.

Some form of analytics that can report each downstream access.

Or just make the law so that the customers own their own private details, and not the company.

If the company wishes to use private data for anything else than providing service to the customer, it must ask for permission.

They can still pick ads based on the private data and personalise the user experience but they can not share or otherwise disclose it to anyone else.

On points 2 and 3, why limit this to companies with revenue exceeding x or y million USD?

I assume it is specifically to avoid killing startups in the crib.

If your business model requires that it should be killed in the crib

So current free to user companies just get to hold their market forever? Are you that happy with them?

To continue the analogy, they should be euthanized

Because it's the same principle we apply to other mass communication providers (i.e. telecom providers). Except there it's based on #users, not revenue.

To not create unnecessary barriers of entry.

#3 sounds like a cool idea, I think knowing how your data is being used is important and allows users to make more informed decisions about how they give their data away.

I think #2 is over-regulation, given #3 users can decide if they want to support the product or not by using it.

Also, if you deactivate your account companies should no longer be able to use your data.

I think we are currently beyond the point where most people actually can choose whether or not to use some services. So I think it would be appropriate to have the option to pay for these services while keeping the privacy.