Each state can choose to be as restrictive as they like in their laws, and each startup can chose to invest in compliance on a wide scale or in the narrow scale as they'd like.

It'd be nice if this was unified but it ain't because:

1. Tech companies lobby like hell at a national level

2. The national government is sort of broken right now

so that's how the cookie crumbles. The fact that a number of companies have skirted local regulations and abused data usage so much is why this is happening, so don't blame the victims of this activity that want sane privacy laws - blame the bad actors that have forced this issue to need to be dealt with.

> Each state can choose to be as restrictive as they like in their laws, and each startup can chose to invest in compliance on a wide scale or in the narrow scale as they'd like.

There's a special hell that exists where one state mandates records must be held for at least seven years and another mandates deletion at five. When the two states border one another and you may not have home addresses, how do you determine how to comply for a given user?

You're absolutely right, in every way, that tech companies have brought this regulatory backlash on themselves. Yet, it might still be worth considering the potential costs.

Pass a federal law that allows any American to choose the state jurisdiction they want their account managed under at sign up. Corporations can choose to incorporate in Delaware without any real presence, consumers should be able to pick and choose jurisdictions as well.

I wonder if California could just permit cases to be filed in it's courts regardless of residence or the locality of the disputed action so long as the defendant has a presence there.

In the bill:

1798.145. (a) The obligations imposed on businesses by this title shall not restrict a business’s ability to: (1) Comply with federal, state, or local laws.

Now I wonder what sort of dance would occur if, in your example, both states' laws had such a clause.

Is this a hypo or a real example?

As far as I know it's a hypothetical, but it is very much the kind of thing that could happen. Regulations don't always align across political borders, which means there's the possibility there being no way to comply with both.

This is what you call putting the cart before the horse.

I was just thinking of it as a good reason to encourage harmonization of regulation.

The gist of these laws are all the same. Just respect ALL users' data from the start, and you shouldn't have any difficulty with compliance.

Totally disagree. Complicate is not the same thing as following the spirit of the rules. Compliance is proving you followed the rules. Totally different. Also, you have to define what you mean by “respecting privacy”. Something that I do on my website, like basic retargeting marketing for abandoned shopping carts doesn’t feel to me like an invasion of privacy. To you, it might. The rules have to be defined clearly.

If you don't collect any information that's not essential to delivering content and services, there shouldn't be any problem.

If you have a shopping cart, you must collect billing and shipping information. But you don't need to use it for any other purpose.

> If you don't collect any information that's not essential to delivering content and services, there shouldn't be any problem.

That's pretty ambiguous. For example, I'm pretty sure everything Google does that can be considered against privacy can and is tied to the service they provide as features. The fact they keep a history of everywhere you went to can be used by users to recall the locations they've been too. That Google keeps one's contacts can be used in case you lose your phone and get a new one. That Google uploads your voice to their servers is to improve their speech recognition. All privacy violations can be made "essential" by tying it to a feature.

I don't use Google services at all, but Google still collects data about me. That's a serious problem.

That's really stretching the meaning of "essential to delivering content and services". If I search using Google, all I want is the results. If I have Gmail, all I want is an email account. Anything else is clearly extraneous.

Edit: And they can always offer more. With clear explanation of what information they'll need to retain. And users can either accept, or decline.

> If I search using Google, all I want is the results.

They also remember your searches to provide personalized results, and many people do like that.

> Anything else is clearly extraneous.

Isn't the point of a business to provide the best product or service they can (for the price they ask)? What's the point of a business that does the bare minimum? How are they supposed to compete?

In any case, the point is that it's not as clear cut to know what violates privacy and what doesn't. To tie it back to your original comment:

> The gist of these laws are all the same. Just respect ALL users' data from the start, and you shouldn't have any difficulty with compliance.

They aren't necessarily going to be the same. What is to respect all users' data? There's no concrete consensus on what violating privacy consists of. Is saving searches for personalized results consistent across personal devices violating privacy? Some will say yes, others will say no.

Also, if you err on the side of caution and avoid providing features, you're going to lose edge. It seems to me that it's very important to a business's survival to know where the borderline is.

That's why I would agree with rdlecler1 that

> a small startup needs to ensure they comply with hundreds of regulatory jurisdictions

if they want to have a chance for survival and peace of mind that they aren't even technically guilty of anything in any one jurisdiction even if in their own eyes they did everything to respect their users' data.

The internet probably wouldn't have gotten as big if it weren't for the fact that it's largely lawless. If every geographical region makes their own regulations, only big world corporations will be able to comply.

By your rule, companies should not engage in A/B testing to figure out how to make their sites easier to use. Because that involves tracking users for a purpose that is not actually essential to delivering content and services.

Does this outcome make sense to you?

(Disclaimer, I have worked in adtech a little bit, but I have worked a lot more with A/B testing.)

I suspect that A/B testing is doable without collecting user information. Except for the OS, of course. But certainly nothing that's not in server logs.

Do you have an error log on your web server? Does that only collect data that is essential or do you do something like log a referer or IP address or user id in hopes that it might be useful un debugging. Is there an access log? What happens if a user asks to delete their data. Do you go back and scrub all such logs? What about if you have a backend service that logs errors about what data it had problems accessing. Or an SQL server that logs bad queries?

It's not so straight forward as you make it seem.

I'm no expert. But typically, when installing web servers, I don't enable logging. I'm more familiar with the issue of logging by VPN services. And I've been assured, by someone who runs one, that logging isn't necessary. Everything can be done in real time, with any "logs" retained briefly in RAM.

I'm an expert. The correct answer is to not log any PII data. Logging obvious PII because it might be useful in some hypothetical future sounds like plain incompetence. If you really need to log PII, log it separately and set clear policies about how this data is stored, how it's replicated, who can access it. If you need to log some PII IDs in common logs, use some fuzzy hashing: good enough for logs, not good enough to restore the original PII.

Thank you.

PII that you don't need can become like radioactive waste. If it gets subpoenaed, and it comes out that you retained and produced it, your reputation may be hosed. But if there's nothing to produce, no problem.

That's actually not quite correct. If you're required by law to retain that PII, you'll be hosed if you can't produce it. But then, maybe you should be doing business in a different jurisdiction.

I'm thinking of Private Internet Access. To my knowledge, logs have been subpoenaed in two US criminal cases. And they just said that they didn't retain logs. But then, VPN services aren't required to retain logs in the US.

The IRS may see that differently.

Good point, perhaps. I'm not familiar with reporting requirements for online sales in business returns. I did manage a small restaurant at one point, and I don't recall that we had to track customer identity.

> Something that I do on my website, like basic retargeting marketing for abandoned shopping carts doesn’t feel to me like an invasion of privacy.

It sure does to me. So much so that if it happened to me, I'd be sure to never buy from that site again.

I'm with you.

I was on a web site with several items in the shopping cart. I went to the bathroom on my way into another room of the house to get my phone to make a payment on my credit card so I could make the purchase. When I got to my phone I already had one of those abandoned cart remarketing e-mails from the company.

I went back to my computer and closed the browser tab. No sale, creeps.

And what's to stop you from selling that data about what was in my shopping cart to a third party? Would you be compelled to notify me, or ask for my permission? After all, I agreed to share that with you in exchange for the product in the shopping cart. But I didn't agree to anything else.

It's not for the operator of a website to decide what is an invasion of _my_ privacy. It's for the consumer to decide. And that's precisely why we can't rely on website administrators, or the "recipients" of data to determine whether something is private.

I'm one of those website administrators who wholeheartedly welcomes something like GDPR here, even though it would make my job harder. But hey, that's fine. Putting privacy back in the hands of consumers is the right thing to do.

This is not true, unless by “respect” you mean “do not collect any at all”. I would argue that you could respect users’ data without implementing data takeout, for instance. I would also argue that cookies not used for tracking do not need disclosure for users to be respected

Anyway, the only companies that will end up being able to collect data at all are there very biggest ones. Everyone else will have to just fly under the radar or use some kind of SAAS solution to comply with the patchwork of regulation. Not sure that’s really the desired outcome

Many companies have to RADICALLY change their architectures just to support these laws. And often the costs will be enormous. How do you scan all the logs that might somehow have an association with the requesting user that are in cold storage and alter data on write only archived optical media? You have to make an entire copy of it with those data removed. It's not about just treating customers better. It's government dictating the technical architecture.

> Many companies have to RADICALLY change their architectures just to support these laws. And often the costs will be enormous.

Yep. And there's nothing wrong with that.

That they may suffer a large expense to correct years of misbehavior doesn't make me sympathetic to them.

>Many companies have to RADICALLY change their architectures just to support these laws. And often the costs will be enormous.

Bummer dude. As an engineer type, I say, bring it on. Hard for me to have much sympathy ZuckerBrin can't afford another island or whatever because they made unethical decisions in the past. And if companies blow up because of it: good, that's the idea. There needs to be consequences.

Facebook will be just fine and probably come out ahead. Same with google. They have the money and resource to comply. These kind of regulation that don't take reality into account when written are a god send to large corps.

> Many companies have to RADICALLY change their architectures just to support these laws. And often the costs will be enormous.

Boohoo and cry me a river. Good riddance. Other companies who take care of customer data from the start will take over.

> It's government dictating the technical architecture.

No, the government doesn’t dictate technical architecture. The government dictates: be careful with personal data.

Just a shameless plug here -- we've been building a super developer friendly product to allow your application to comply w/ these laws with minimal (and sometimes NO code changes). You can email me directly mahmoud - @ - verygoodsecurity.com (https://verygoodsecurity.com/) and I can show you how it works.

Our idea is that complying w/ data security & privacy laws should be a devops shift + costs to keep up w/ them shouldn't stop us, as developers, from keeping us just as productive in our application development lifecycle.

We're still trying to figure out the right pricing structure for smaller companies, so if you have any insight there, I'm very interested to hear it.

> Many companies have to RADICALLY change their architectures just to support these laws. And often the costs will be enormous.

This harkens back to the GDPR hysteria. And that was a storm in a teacup: most companies that took compliance seriously were able to get to a good place with a medium amount of engineering work, and didn't suffer financially overmuch. A few companies did go out of business or suffer significantly--and most of those were sketchy, data-abusive entities. In other words, it worked.

Bullshit. "Respect users data" means different, incompatible things to different people and in different circumstances. You can't "respect" all of them at the same time.

Take the data deletion requirement. I know of many instances where users have permanently lost absolutely critical data because of that provision (already found in other privacy laws). When a user (accidentally) indicates they want you to delete their content, the provider has to permanently delete it within a reasonable timeframe, including purge from all backups.

Most users don't give a flying f'ck about all this privacy BS, but they care very much about what happened to their Master's thesis. They want a company who will be able to rescue them from their own mistakes. They want dependability. But they get "privacy" instead, and their accidentally wishes that you purge all their stuff gets obeyed.

Maybe you call that progress. But it really sucks when you purchase vague hypothetical benefit at the cost of real-world misery.

> "Respect users data" means different, incompatible things to different people and in different circumstances.

I admit it was vague phrasing. All I mean by respect peoples' data is to recognize that people should own their own data. You should get explicit permission before collecting it, using it, selling it, etc. At any time it should be just as easy to remove the data as it was for you to collect it.

As for any data deletion, I think it makes sense to have a strong warning any time a company has files that the user themselves have uploaded. Perhaps even listing filenames and folders to remind users what's there.

If there was an easily defined definition of "respecting users data" the we wouldn't be in this situation. Plenty of people think putting a clause in the EULA that says user data can be monetized is being respectful of user data, but this is often prohibited by law. Plenty of people don't think having a tool to dump user data is necessary to respect user data.

> Plenty of people think putting a clause in the EULA that says user data can be monetized is being respectful of user data

Do they really believe that, though? I always thought they were just thinking it was just legal cover to allow them to do whatever they want with the data. Respect doesn't enter into it.

What's wrong with it? The End user license agreement is the document explicitly dedicated to explaining how the interaction between the user and the software will work. If a company explains how the data will be used and the user consents to that agreement what is the issue? I don't doubt that there are people that don't bother to read the EULA but thats a leading-a-horse-to-water situation.

I didn't say that there was something wrong with it, I said that it doesn't count as being respectful of user data.

That said, almost all EULAs and privacy statements I've ever read have not been forthcoming about the use of data. They usually state, in broad terms, that they'll share unspecified user data with mysterious "partners" for nonspecific reasons.

The GDPR is pretty bad for under 5 engineer startups. They can be very privacy respecting small businesses that charge for their product, like sql training courseware[0], and wouldn't mind clearing what little personal data they had on you (user server logs, billing info, etc).

But being privacy respecting and properly complying with GDPR with audit log systems, etc are 2 different things that require hiring 1 or 2 extra engineers or causing them to pause the companies roadmap as 1 or more people implement government bureaucracy infrastructure for half a year.

If they say it's easy and cheap, then they haven't actually tried to do it properly and are exposing themselves to multi-million dollar penalties.

[0] https://www.brentozar.com/archive/2017/12/gdpr-stopped-selli...

I've heard this line so many times, but there are vanishingly few examples of companies that really suffered for it ("just don't sell in Europe" implies, to me, that Europe wasn't valuable enough to you as a market to take the time engineering GDPR compliance--and that's just fine). The ones that did crash overwhelmingly seemed to be sketchy data brokers.

I think a bunch of them took the "if audited we will probably be screwed unless the enforcing body takes leniency on us" and just kept on going. It opens up everyone to another huge liability but that's business. DPOs only have so many staff to investigate complaints.

How is that different than, well -- anything? In the United States all 50 states can make their own laws; it's a fundamental part of our legal system.

As for every country making their own laws - well, yeah? That's what sovereignty is all about?

In cases where the Feds have decided there should be a uniform standard, states can’t make their own law. https://en.m.wikipedia.org/wiki/Federal_preemption

I don't think that works quite like you think it does. The Federal government generally does not restrict states from making stronger laws than the equivalent Federal law. Take the Federal minimum wage, for instance: they set one level, but states are free to set a higher minimum wage.

This case follows the same pattern: whatever meager privacy protections in place at the Federal level will continue to apply, but California law will take precedence in the case where it's stronger.

There are certainly exceptions, like how currently Trump and the EPA are attempting to disallow CA's higher vehicle emissions standards, but, again: exceptions. (In this case, the relevant law has specific language that makes the EPA the final authority on this sort of thing, and requires states to get waivers for going their own way. That's not a general, common thing, though.) And I expect that bit to be tied up in court for a while.

Actually, I think you're the one that's incorrect here. California can set a higher minimum wage because it's explicitly allowed to by 29 U.S. Code § 218.

https://www.law.cornell.edu/uscode/text/29/218

That's an exception that's written into the law, while federal preemption is the usual rule.

It depends on whether the federal government has decided to preempt or not.

In this case I don’t think there is a national privacy law that preempts CA, but companies are lobbying now for one to be created. I think it would be a good idea, a national sales tax and a national privacy law are a natural fit for the Internet age - needing to know different laws and regulations for 50 states is only going to hurt small businesses and startups.

FTA:

> Since the law passed, tech giants have pulled out their last card: pushing for an overarching federal bill.

> In doing so, the companies would be able to control their messaging through their extensive lobbying efforts, allowing them to push for a weaker statute that would nullify some of the provisions in California’s new privacy law

or, you could not start a business that requires you capture every single facet of a person's life as a data point.

But you'll start a business which captures some data, and you're on the hook for proving that everything captured is necessary and compliant in hundreds of jurisdictions.

You could start a different business instead.

No, a federal law that's as good as or better than CCPA would be great. But they know that's not what will happen.

And that's how privacy compliance as a service was born.

i hate this, but you're right. pointless regulations that lead to pointless jobs to oversee and sell compliance is such a net waste for society.

Unfortunately, you’re correct. Post GDPR I’ve been pitched many times by EU companies trying to be my representative for GDPR, so if that is any indication we’ll see a booming industry for that in the US as well...

Funny enough, the emails sent by these companies are not GDPR compliant and they’ve given me no indication as to how they gathered my info, nor do they give me an opt out.

I'm just going to ignore them all until my actual operating jurisdiction implements one, I'm not beholden to the laws of another country, let alone a specific state in it.

I’m not sure this is entirely true. Texas for example has some pretty big arms (long-arm statute) when conducting business in or with a resident or Texas business.

Maybe helpful - http://euro.ecom.cmu.edu/program/law/08-732/Jurisdiction/Lon...

I'm not even in their country, pretty sure I'm not going to get extradited for breaking the privacy laws of a jurisdiction in which I have no physical presence.

That's how it is with lots of things governed by laws though. Even murderers have to deal with a confusing patchwork of laws and penalties. "Do they have to prove premeditation in this state? Can the degree of the charge be changed at trial? Is there a death penalty?" It's getting so small-time murderers have to have a wall of law books just to do business!

"With great scale, comes great responsibility"

If your business is operating so close to the boundary of the law that you could be breaking it in some places but not others, then yea, you should be worried.

If your business operates well above board and is not doing anything close to what might be the danger zone, then you should have nothing to worry about.

It's always the folks walking right next to the cliff complaining about how complicated their path needs to be.

Essentially, yes. And don't forget all the other ones from other countries as well.

You could also not track or store PII.

Yeah... CCPA and GDPR have proved that large enterprises will do just fine, because Amazon can always afford enough lawyers to handle regulatory overhead and confusion across territories.

The startups end up either (1) ignoring the laws or (2) giving up.

Good job EU, if making the FAANGs the only companies with the clout to hold customer data or break into new markets was your primary goal.

GDPR is not a difficult law to comply with for an EU company, unless you're adtech.

We've already had this discussion.

We've already seen non-adtech companies simply shut down EU access if they don't have enough revenue. That's probably not a good thing.

I support the GDPR, but complying with it is far from simple and the jurisprudence is not yet clear.

> That's probably not a good thing.

That's debatable. I imagine that many EU residents who are tired of having their data collected and sold by US companies consider this to be a very good thing.

It also means that an EU-based company can come a long and fill the void left by the former incumbent that doesn't want to play ball, which is likely good for the EU's economy.

Maybe it's not good for the US company, or for the US economy, but the EU (in theory) exists to further the interests of EU citizens.

As a California resident, if the same happens with the CCPA, I will not shed a single tear.

> That's debatable. I imagine that many EU residents who are tired of having their data collected and sold by US companies consider this to be a very good thing.

Until that game you like simply shuts down in the EU. Or until that website you visit simply blocks all EU access.

Just because someone can't prove they comply with the GDPR doesn't automatically mean they aren't in compliance.

You've added a bunch of friction to the little guys in order to punish Google, who won't really notice. Maybe you agree with that, maybe you don't. But you have already made that trade whether you like it or not.

"We've already seen non-adtech companies simply shut down EU access if they don't have enough revenue. That's probably not a good thing." - Why not? I suspect we can live happily without them.

> That's probably not a good thing.

Why not? Serious question.

Our EU employees could not file expense reports for months, because our expense management software (FROSCH or something) could not figure out GDPR compliance.

Soooo I kinda suspect you're talking with absolutely no first-hand experience.

I’ve now been at three large multinational companies who have gone through GDPR process. It’s not easy or simple for an established company, but it’s not impossible.

Additionally:

- before GDPR most EU countries already had similar laws (e.g. data protection laws in Sweden). Sometimes for decades

- GDPR gave two years to become compliant

All in all everyone had two to twenty years to become compliant. Those who didn’t? I personally wouldn’t give two shits about them.

Your expense management software? Well, you company chose it. It looks like your company are responsible for making sure that the software you use is GDPR compliant. Someone at your company and at FROSCH screwed up and now you blame GDPR for the screw-up.

This is a terrible line of reasoning. GDPR came AFTER the expense software, so blaming the company for not forwardly thinking about an non-existant regulation is ridiculous.

You had two years. Plenty of time to figure this out.

Also: is this your line of reasoning? It’s really weak. To take it to extremes: “we’re still using asbestos and lead pipes because the legislation was nonexistent when we started using them”.

Just don't do stupid privacy violating shit and you'll be fine anywhere.

Collect no information. Share no information. You are good - everywhere. And that really ought to be the default behaviour..

I'm not sure how ecommerce works without some information from the user, such as what they're trying to purchase, the quantity, a shipping address, and some form of payment, most likely a credit card.

... and if you plan to handle this type of highly sensitive data, you should be prepared to provide some basic levels of compliance, including appropriate auditing of sensitive data along with informed consent from users.

How are you supposed to do any business over the internet without collecting information?

That is what they said about GDPR...

And what is your problem complying with that if you collect no information nor share any information?

The main issue is proving compliance. Any website could, in theory, be recording information that counts as "personal data" under GDPR and CCPA without the user realizing it. What happens if a user doesn't believe you when you say you don't store or share anything? How do you prove to a regulator that you actually don't?