If someone publishes a link between my address and my name, or my address and an online handle of mine or something, in order to remove that link I would have to prove that I am the person with that name at that address, or that I am the person with that online handle or whatever, but there's no fundamental reason I would have to further identify myself in any way. There's no conflict between anonymity and control here. Their having that information about me has hurt my anonymity, but controlling that information in no way further hurts my anonymity.
The possibility of corporations being anonymous is not an example of a tradeoff between anonymity and control either. If the operator of a company had the option of being anonymous, that would be giving them more control over information about them. More control = the option of more anonymity, because there's no tradeoff or conflict, they're two aspects of the same thing.
I feel like I'm missing something fundamental with your point, because this sounds to me like you're saying the same thing I'm saying, and then coming to a different conclusion. How would you prove that you were the owner of a name and address without revealing additional information about yourself?
The best way I can think of is to use a trusted third-party for verification. For example, send a censored utility bill that's in your name. But this still seems to me like it's a compromise -- it means that 3rd party needs to know your name/location, and it means you need to reveal your relationship with the third party.
Is there another strategy I'm not familiar with? I suppose in some cases, like with a government ID, your relationship with the third party wouldn't be new information. But it seems like a stretch to say that a government database of names and addresses wouldn't impact anonymity.
> The possibility of corporations being anonymous is not an example of a tradeoff between anonymity and control either.
If a website operator is anonymous, how are you going to contact them and require them to take down your information? If they refuse, or if you get their website removed and they just keep buying and posting it on new domains, how are you going to stop them from doing that?
I'll fully admit I've been talking a lot about theoretical extremes, but this particular problem isn't theoretical at all. Onion sites are already a thing, and it is notoriously difficult to get illegal information removed from the dark web because the site owners, site visitors, and even server locations are anonymized.
Tor makes it easy for me to stay anonymous, but it seems to me like Tor makes it very hard for me to control my data.
Theoretically, there could be a system where, if the publisher of a name+address gets an anonymous request to remove that information, then they have to mail a letter with a nonce to that address, and then if they get a followup request with that nonce, then they have to comply and remove it.
In practice, a system involving third-parties such as a lawyer or government agency is more likely, I'm just proving my point that there's nothing fundamental that requires compromising anonymity.
It's also worth noting that if a client is known to their lawyer but unknown to anyone else, it's pretty widely accepted to describe that client as anonymous, even if they're not technically anonymous in the ultimate, purist sense.
If a website operator is anonymous, how are you going to contact them and require them to take down your information? [What] if they refuse?"
First of all, that's not a conflict or tradeoff between my ability to anonymously use services and my control over my data.
And the obvious solution, which is the one we have, is that to run a website, someone has to give up a little anonymity and be subject to laws. But there's no fundamental reason people can't anonymously use services and maintain control over their data.
> As for the use of photos of me that are owned by other people, I'm pretty certain that neither CCPA nor GDPR cover those.
You're talking about specific laws, and I'm talking about general principles. The dichotomy I'm supposing is between complete anonymity and complete ownership over my own data. Owning data means being able to restrict how other people use it.
No expects to be unidentifiable in a photo where their face is visible. But if I own my face, I expect to be able to issue a takedown request to sites who post images of my face without my permission. If I genuinely own my address, or my contacts, and a third-party site makes them publicly available, I should be able to do something about that, the same way that I would be able to restrict them from distributing a piece of IP I owned.
CCPA and GDPR don't cover individuals, just companies. This is a compromise, because it's just not feasible right now to have a version of GDPR that covers what ordinary citizens share. But there's nothing special about companies. If I'm committed to a world where I own my data, I don't want my rights to vanish just because the information was posted on a blog instead of Facebook.
And that's where you start to see this conflict -- because in order to maintain control over data, you have to, well... maintain control over data. You have to know who's posting it and who it belongs to. People who advocate primarily for anonymity are opposed to that kind of world. Their extremes look different.
In the real world, most people will be somewhere in the middle. They'll lean towards data ownership on some things, and anonymity on others. For example, I doubt that many people on HN believe that companies should be able to operate anonymously. Even though anonymity/ownership is not a binary choice, different people are going to be lean towards different sides of the continuum, and that's where you see these conflicts.