I agree with almost everything you wrote in your comment (including this quoted paragraph), but still maintain it is paramount that power be decentralized as much as possible. Similarly, that doesn't mean the only choices are between "power is completely decentralized such that no entity has greater power than any other" and "power lies solely within one central entity". Instead, the power of any government, corporation or organization should be kept bounded, with strict, irremovable limitations. The exact method to achieve this goal remains somewhat elusive, but I think the largest prosperity happens in those instances when it was achieved.

The trouble with solely relying on governments is scope creep. Seemingly inevitably the government eventually gravitates towards regulating more and more, until it is effectively prescribing an allowed list of algorithms, burdening the whole ecosystem in the process. You mention GDPR, but in order for the argument to stay balanced, in the same breath you should also mention Articles 11 and 13 of the EU Copyright Directive.

I also consider it essential for individuals to take matters into their own hands in some degree. They absolutely should develop tools and heuristics that help achieve the goals they want. Should some of the burden be taken away from the individual, by codifying tried and true principles into law? Of course!

As a closing thought, perhaps the model of the huge, centralized social network is ultimately a deeply flawed one and no amount of regulation can help it. Perhaps the end game is, once the average of all individual desires have been codified into law, that the traditional social network becomes economically non-viable. Centralizing all communication under a single large entity certainly sounds deeply wrong to me personally. And if it is so, the users will eventually realize this.

Except the government doesn't understand even the basics of how the internet works. And you want them to regulate the specifics of algorithms?

>That's essentially what GDPR is about. Instead of having to find out for yourself how your data is being used, the company needs to tell you. Instead of having to write a crawler yourself to get your data back out, the company has to provide it to you.

Here's an idea: DON'T GIVE OUT THE DATA IN THE FIRST PLACE. Ask for more controls over your data in browsers, because none of these rules are going to actually protect you. Yes, Google in Europe can't legally steal your data, but do you think a Chinese company cares? Of course not, because the EU does not have jurisdiction over them. All GDPR did was make European and above-the-board corporations and citizens worse off for some security theater, but they didn't actually deal with the problem.

GDPR has also made using the web frustrating due to every single website having a pop up now and some sites being outright blocked in the EU. GDPR is a terrible example of government intervention, because it shows that the people making decisions don't understand what they're making decisions about.

It’s very hard to “not give data out in the first place”. You don’t have to give it out, they’ll do anything they can to take it from you without asking.

I’ve recently had to email Airbnb to cancel my account becaue I don’t want to be tracked by Facebook and Airbnb put that tracking on every page logged in or not. Airbnb’s view is that I have to create a Facebook account and then set privacy settings there. They refuse to honour Do Not Track headers.

Airbnb won’t even let me login to delete my account. Instead I have email them and hope they’ll actually delete my data and account.

When you have companies making things as difficult as possible for users and using sophisticated tax avoidance to crush local competition on price you need legislation with teeth.