Building Code for websites is something I would be willing to support, e.g. no plain-text password storage allowed.
User must rotate their password every 7 days or be locked out pending in-person approval. The software must enforce this restriction while allowing a two-hour grace period on days when daylight savings changes.
You: this is retarded and anti-security.
Them: the lawyers are on their way. Stay put.
I recently renovated a 1950s building, among other things I designed and wired a fire alarm system from scratch, and passed inspection on first attempt. The building code gave very valuable pointers: what kind of cables should I use, how zones should be wired, how many sensors I should have, how they should be placed, how long backup batteries should last, etc.
Some areas are okay. Others are not. The issue is not so much building codes, although there are definitely codes that e.g. push specific products from specific vendors and other shenanigans, but the approval process that gives the local authority unlimited time to mess with you for any reason.
There is, I think, a single US state that puts reasonable limits on project authorization, but I can't remember which it is.
All in all, doing anything with real property opens you up to just having your money taken by the government and lawyers while accomplishing nothing.
(It used to be possible, but they removed that API after Cambridge Analytica.)
I mean, there are obviously responsibilities that naturally come with having delegated that access. And word will get around. The first GDPR violations because some user delegated access to their account and the entity that was authorized slurped up all of that user's contacts' personally identifiable data without the contacts being notified, will undoubtedly set the tone. That's still likely a GDPR violation. This doesn't change any of that. The only thing that changes is that the consequences for the GDPR violations now fall on the entity that was authorized, or maybe on the user who authorized the entity? (Not sure which?) But it obviously would not fall on Twitter since it is only complying with the law.
It's important that legal and criminal liability is matched to authorization or delegation. In practice, it will be the threat of legal liability that ensures data security and data privacy, so that needs to follow delegation to ensure incentives are always aligned properly.
I don’t think that was the point of what the parent commenter was saying.
As I read it, they were talking not about liability but the likely negative side effect of having more people be conned out of their private data that will then be abused.
Who is liable is a secondary concern. The main problem is the fact that people’s private data end up in the wrong hands.
From my PoV, for my purposes, as a technically minded user I might agree.
But thinking about the numpty-on-the-street, this could be a privacy nightmare with people being easily conned into allowing a random application full unrestricted access to slurp their data. This can happen already, of course, but the provider could detect a remote API scraper and try to block it, and a user-local malware scanner can be trained spot a rogue browser extension that scrapes the UI, but if API access like that is mandated they'll have to provide the access and won't be able to tell the difference between that which the user requested and that which the user was conned into requesting.