> Again, if I designed my site to use a websocket instead of event handlers - the result is the same. Are we proposing we outlaw this?

yes?

I can stab my knife into flesh all day, if that flesh is another human being it turns out it's outlawed.

There is no requirement that the law be applied consistently for some action. Insider Trading doesn't imply all trading is illegal. Being able to pop off fireworks doesn't imply doing so anywhere is legal.

That would then be the first law of it's kind, to mandate how a website is to operate on a technical level.

Even the existing ADA laws do not specify technical details (which is why they are abused in frivolous lawsuits to often).

The opposite actually, if the law says you cannot murder, it doesn't become legal because you used a hammer instead of a gun.

Your question is essentially "well what if I use a knife, because knives can be used for skinning, which is a legitimate use!".

It doesn't work that way.

Like I said, that would be the first law of it's kind. We have zero laws that specify how a website is operated on the technical level. Or how it's engineered or designed. Nothing exists that is comparable to what is being proposed.

That's true, I think the point is that such laws need to start getting created because the compute and personal device issue is legitimately different.

The problem with this, is the technology evolves far quicker than our laws do. The ADA law is a glaring example of this, unfortunately.

Apparently if you outlaw murder, the fact that people are constantly creating new ways to murder makes it confusing as to whether or not murder is outlawed.

No, because murder is still illegal.

In a technical setting, we can't even reliably describe how things will operate 5 years from now. Imagine a law that specified how frames were to operate... and now no one uses frames.

Just imagine a law that says "no tracking". What is tracking? How is it done? How do we know it when we see it? All of this must be defined... and these definitions are fuzzy and change rapidly.

The ADA law specifically says you must make your website accessible... but fails to specify what accessible even means in a modern setting. That's the pitfalls of trying to regulate how things are designed in a technical setting. Perhaps it's possible, but I have not yet seen a good law that made an attempt.

Docker is 9 years old, try again.

No, actually, don't. I reject everything about your premise.

"What even IS ACCESSIBILITY, OMG, you can't explain that!?!?!".

I mean ... maybe YOU can't, but plenty of people can.

No, nobody can. Not even the folks that wrote the law. Not even the folks that enforce the law (DOJ) (referencing the ADA law in regards to websites). You can go look for yourself... it's created an entire cottage industry of would-be vexatious litigants, if any of the suits actually went to court.

So no, it is not easy to define or describe. There is an incredible amount of detail that must be hammered out to make it easy for everyone to become compliant.

We can also reference the EU's GDPR, or California's CCPA/CPRA. All of which are struggling to actually clearly define what they mean. What is an essential cookie? What does it mean to sell someone's personal data? Neither are what you might actually believe...

You can reject it all you want, but that does not change the reality I'm afraid.

What you're describing is called interpretation of the law, and weirdly enough, legal systems have been doing that for the better part of 600 years.

> It's very common to log when a button is clicked. Which means we can already reconstruct a user's session because we know what coordinates buttons have. We might miss out on the random movements and such, but that might not be a big deal if we also log the timestamp when a button was clicked.

The point I was making above was that there's a difference between purely client-side events like mouse movements and keystrokes and server-side events like button clicks and page requests. This may be a trivial difference for most websites, but I have an expectation of privacy around client-side events. Collecting them without the user's consent violates that regardless of the technical mechanism of implementation of that collection.

> Your car collects huge amounts of data about your driving habits. A Tesla, for example, might auto-report that data, but your "dumb" car also provides that data to an ODBII reader. In fact, that was the premise for those Progressive (I think) Car Insurance things they wanted you to plug into your car to "prove" you were a safe driver.

Right, and the difference is that the data provided through the OBD port requires me to physically plug something in and upload it elsewhere. I have control over that data. This is different from these websites that are collecting data like my mouse movements and immediately sending it off without notification or consent.