Your law as written would only cover company A doing the sale of data to B, but not the downstream intermediaries.
Alternatively, company A doesn't sell the raw data, and instead sells reports and anonymized data that can easily be joined with other datasets. As this is not a sale of "user data", but an aggregated, anonymous insight.
The data industry is full of scum - nothing less than scorched earth in advertisers and brokers is sufficient at this point.
Aggregation isn’t the real problem. Honestly it’s the crosstabs that are killing privacy. Remove the correlations, and no one gets hurt.
This would honestly still be a huge improvement imo, as even forcing data brokers to anonymize or aggregate the data, even if it is ultimately not actually providing privacy, is still a recognition of the problem over the current system in most states.
Enforcement.
I don't know the answer to this, but it would probably be a crisis of some sort, like cambridge analytica.
It's sort of amazing how far out of hand things have gotten, with phones, cars, televisions, and more collecting data and matching it with your "dossier(s) in the cloud"
The problem is people are stupid and uninformed about giving consent. You're the one trying to loophole around that.
If you actually want to regulate this the way you describe, you have to do it by removing peoples' right to give certain consents. For example, nobody may give consent for more than 6 months for the use or transfer of their data.
This is a big deal! You're removing a free mode of contracting. But if you think about it, we do it all the time. That it has a higher burden of proceeding around new technologies is a large reason why American (where we are careful about rulemaking) and Chinese (no rule of law) tech companies are ascendant. But at a certain point, the usual rulemaking frameworks may need to be applied.
Not really. People have a limited amount of time to deal with issues and aren't trained legally. This doesn't make them stupid. Their inability to suss out all possible downsides of a set of EULAs across various products for a service they're looking for isn't stupidity; it's just an inherently complex space that requires a lot of time and specialist knowledge.
This is one of the main ideas behind consumer law; certain contracts are inherently slanted towards those who draft the contract, therefore we remove some of their freedom to abuse consumers by placing limits on the clauses we're willing to enforce.
That lack of willingness to place restraints on these types of freedom has less to do with the inherent difficulty of restraining freedom of contract and has more to do with the fact that the harm is distributed diffusely amongst a massive swath of consumers, vs felt acutely by specific data aggregators so one side advocates far more for their position - even if that position is antisocial in nature.
> "Their inability to suss out all possible downsides of a set of EULAs..."
This is the part I quibble with, however. This assumes folks even read legal-speak. Privacy laws have undermined this by forcing more text and more "I see, I agree, go away" links/checkboxes/buttons in front of people. The problem isn't the EULAs, the problem is that no sane person can (or should) keep up with it.
Yes, sometimes people can be surprising. My wife has an awesome t-shirt from MailChimp from a not-so-hidden "if you read this, you get a free shirt!" clause she found in their legal stuff. But relative to the amount of cheap "consent" given, this is a huge outlier.
That said, I also have to give kudos to some of the lawyers I've worked with in the GDPR/CCPA/etc era. At least at the point of purchase, there was no better corporate consumer advocate of "boil it down to two or three crystal clear sentences and link to the details, which must cut to the chase" to be found.
They obviously don't, but you're missing a key idea; why aren't they?
You can't benefit from reading without expert knowledge, and the cost is a massive time-sink. Even lawyers, with experience reviewing these types of documents, take a substantial amount of time to get through them and note them up.
If EULAs said: "In exchange for this free Solitaire App, we're going to reserve the right to inform your insurance company about which doctors you visit and the government about which abortion providers your phone keeps going to" you'd obviously read it because you can understand what's going on and you'd understand the exchange in a reasonable time-frame.
This situation doesn't exist because people are stupid. People are smart, which is why they aren't wasting their time trying to go to law school each time they need software.
Every time a company wants to sell on your data, they have to email you and ask permission. Not responding to that message isn't consent.
Find a loophole in that.