Privacy Law Pro and Con on Website Data

Laws are increasingly requiring privacy restrictions on websites and their owners. In some ways, these are good ideas.

Norms

Most people object to being too closely followed by strangers (never mind enemies), and our ancestors living in caves likely felt the same way. The modern practice of doxing women who speak out is an example of frightening intrusions into privacy punctuated by death threats. Some nations in the 20^th century kept such close tabs on most of their citizens that descendants have fought back against modern surveillance by governments. Some governments continue the practice now and people elsewhere object.

Yet vast amounts of information are available just because we make it available. We did that when we lived in treetops. All that’s different today is the efficiency with which it’s collected by almost everyone who wants to, separated into tiny units as they like, distributed to whomever they wish, and used in a myriad of ways without notice to the subjects, some of it probably not accurately. But, while this may be a change mainly in efficiency and not in substance, the efficiency may qualitatively change people’s lives in fabulous, amusing, dismaying, or even horrible directions.

If a Neanderthal swung a rock at another rock just a single time a hundred feet away, maybe we blinked and went back to sleep. Now, if ten thousand people swing rocks at rocks just a hundred feet away all night, maybe we can’t sleep, and have a hard time functioning the next day, maybe failing to notice the tiger staring at us until the tiger’s jaws clamp into our face. Same rocks. Different effects. Astoundingly different.

One of us may accidentally learn something private about someone else. We may not tell them. We might part ways without ever breathing a word and we may lose contact so we can’t exploit the information even if we want to. That’s the nice side.

The Darker Reality

We don’t have to be so benign.

We all have economic needs, so we may go into business or work for someone else’s business. We need to succeed against competitors. To do that, we need an edge, something no one else has. Maybe it’s proximity; that’s how small grocery stores charging higher prices for less choice of products can succeed: they’re next to their customers, while the competition is farther away. But whatever edge you have, your competitors likely have one, so you need one.

To build that edge, we need information about many people, repeat customers, potential customers, suppliers, financiers, governments, competitors, and neighbors. The big picture helps, but it’s not enough. We need details.

We’ve always needed details. We needed them when we were gatherer-hunters and got together with other people to search for food, because we needed to know who’d come with us, how far they’d come, and how good they were at plucking and capturing, so we could pick fruit and choose prey within range and fill our families’ bellies.

This principle didn’t change after we began with agriculture and switched from barter to money. A couple of thousand years ago, we’d likely have been selling farm products. Obviously, we’d need to know what people were willing to eat. But if we knew what they’d love to devour every day, we’d sell that and pull in a lot more money. So we’d have to find that out. If we didn’t, someone else might have, and then our own bushels would rot. So, we needed to understand our customers and serve them well.

This principle still hasn’t changed.

A modern high-technology website may earn money with clickable advertising. Plenty of ads run every day, but most people resist ads and only a small percentage of viewers will buy even from a well-designed, well-positioned, and well-timed ad. Success is hard to come by. So an ad and the people behind it have a heavy burden: They have to try harder.

Google collects a phenomenal amount of data on millions of Web users. It also supplies many ads on behalf of advertisers. Hundreds of other companies also supply ads. An ad supplier wants its advertisers to be happy so they’ll stay, and they don’t like websites that force or even trick people into clicking ads. So clicking and buying are voluntary and the need is for potential customers for someone’s products.

The potential customers will be in the audience for the website. They’ll join the audience if the content is compelling enough, so the website’s creator has to understand which people (not just how many) will likely want to see the content. That understanding requires studying people and collecting information about them.

If you want to write a website that’s all about Iotrochota intermedia, yours may be the only website entirely specialized in the subject, so it could be relatively easy to figure out who’ll be interested, and you won’t need much data about them. Maybe no data. But if you want to write about everything on Earth, you’ll face a lot more competition, so you’ll have to figure out who’s not being served well elsewhere and how to identify those people so they’ll come to your new site. You’ll need a flood of details about them.

After you attract the visitors and hold onto enough of them, they’ll attract some advertisers willing to pay your bills. The advertisers will want to know your audience’s buying characteristics. If those characteristics are good enough, they’ll advertise. When the ads work, what you get paid will finance your developing and presenting more content people want (not to mention profit). Both you as the content creator and your advertisers do best if you intimately know your audiences.

You’re continually having to learn the details of what your audience likes, doesn’t like, and screams about. Someone said that people say they like their coffee black when really they buy it milky; you want not only the details people want to tell you, you want honest details that tend to be withheld. You also want to know about impulse buyers who don’t think at survey time that they’d ever buy what they really do buy. You also want to know about people who don’t answer questions but are on the verge of spending.

When you get valuable details and take advantage of them, you make a living. If you don’t collect the details, you make less money and maybe take a loss. But if you do collect the details you want and use them well, you make a better website, and people like that, maybe learning something they’ll build on, and if your advertisers collect the details they want and use them well, they get better products into people’s hands for acceptable prices, and people like that, maybe having something they’ll build on, all in exchange for having less privacy.

Implicating Privacy and Finding Remedies

This creates a conflict about privacy. We want privacy for ourselves, but we want to X-ray other people. They want privacy for themselves, but they want to X-ray someone else. And when that happens, they often X-ray you and me.

In that context, laws have recently been enacted to favor personal privacy in the commercial realm. They add to older laws on other areas of privacy, such as privacy for our government records, privacy against people who want to open our windows and look inside our homes, and privacy for health records even against noncommercial use. The new laws have gotten a lot of attention lately, and have given people a lot of hope for the protection of themselves through the obscuring of their personal information. A popular demand is being fulfilled.

Perhaps relatively few people act to enforce their privacy by exercising rights under these laws. Most people may just be happy that the channels exist without using them. We’ll see over time. If exercises of rights block relatively few records, then compliance may cost little, the issue will go away, confidence in businesses that use big data will go up, and the laws will benefit both commerce and the public.

But if rights are exercised by many people and if that’s enough to weaken the tailoring of ads to people most likely to be interested, anyone seeking to sell to the public will try unenthusiastically to live with this; or will try to get around the laws.

Opposition to Privacy

I’m not a lawyer, but I see that businesses will have five or six potent arguments on their side.

Revelations Freely Pour Forth

People are voluntarily providing much of the information others are consuming, although often not realizing it. They’re not being compelled by force of law to provide most of the information. They’re voting with their fingertips. They’re behaving in public, behaving well, badly, and usually indifferently, but still publicly.

They’re either making the information public or they’re giving it to the other people who are then using it as if public, including by sharing it with further others with notice (via privacy policies and general reputation) of the possibility of that sharing.

They’re trading their own information for benefits. A dating app provides access to potential dating partners and may collect knowledge about dating preferences. Other ways of meeting possible dates have existed for millenia, but many people like this new way, so they tell about themselves and the app provider remembers what they say.

Right to Opinion

People have a First Amendment Constitutional right to form and communicate opinions. If I see you wearing a red coat and I think you like red coats, I have a right to tell the public, including sellers of red coats, for free or a fee, that in my opinion you like red coats. That’s not the commercial use of a likeness, which is illegal in some places without the subject person’s consent. The opinion about you is mine and doesn’t need your consent.

My right to opine includes my right to infer. Maybe I learn that you like Picasso’s art. Maybe, as a result, I infer that you like green apple pie. It doesn’t matter if I’m right or wrong. I’m entitled to my inference and I can tell a baker that you’d be a good customer for green apple pie. It’s my First Amendment right to infer and to talk about it.

At the same time, a baker has a First Amendment right to tell you about their pies that they think you might like. If anyone would have the right through government to force me to delete my record of my opinion, then they can silence me regarding my view of you and red coats, Picasso’s work, and pies and that would violate my First Amendment right. It would be a violation of my right even if I am factually wrong in my opinion, for example if your coat was really white and someone spilled gallons of red paint on it a few minutes ago and I was confused; my right to my opinion about you even if I am factually wrong is untouched.

Google lets some people delete information about themselves that Google stores. That doesn’t mean everyone has to offer to erase records, and I don’t have to.

I’m glad that the Washington Post, CBS, and Aviation Week & Space Technology can be journalistic media without having to delete most kinds of information about the people on whom they report.

Right to Read

Intended recipients generally have a First Amendment right to consume content that’s under First Amendment protection for creators of the content. (Procunier v. Martinez, 416 U.S. 396 (U.S. Supreme Court (1974)), at 408–409 (prisoner correspondence) (8 Justices agreed and none disputed the point) (I don’t know the present state of U.S. law on point).)

If, under the First Amendment, the government must not prevent people from publishing most expressions (like books), but the government can prevent people from reading them, putting a few exceptions aside, the First Amendment clause would be meaningless and useless. Books and data sets likely have the same protection.

Laws Don’t Apply

The laws don’t always apply.

For many websites, there may be no legal requirement for a privacy policy. Even if there is a privacy policy, it may not be binding. Generally, a policy is not a law, not even as a contract. Often, the content of the privacy policy, even if a website user is required to agree to it, does not make it binding; in my observation, only a few websites have legally binding terms of use that incorporate the privacy policy into what is binding. Many privacy policies permit the website owners to amend them without prior notice to users.

On the other hand, in the U.S., law on advertising may apply. If a website is in interstate or foreign commerce, its privacy policy may come under the Federal statute at 15 U.S.C. 45(a)(1, 3–4) if the policy constitutes advertising even though only on the applicable website and the policy is misleading or deceptive. For most other websites, those in intrastate commerce, State laws may apply on similar grounds.

California’s law doesn’t apply to most people outside of California. California’s law applies to a business “that does business in the State of California” and meets other criteria; if an out-of-state business has a business agreement with someone in California, where that agreement was made may make the difference.

The European Union’s law doesn’t apply to most people outside of the European Union. While the EU has claimed worldwide jurisdiction for the General Data Protection Regulation, legally that’s an overclaim.

Jurisdiction is limited to those people who have sufficient nexus with California or the European Union, respectively. Consider an analogy. Congress might wish to pass a law governing Saudi Arabia, but Saudi Arabia has nothing to worry about. Congress could pass a law with a message or a law governing the U.S. relationship with Saudi Arabia, but the message can legally be ignored and the relationship includes something in the U.S. and that’s why it can be regulated by Congress.

Likewise, a website outside of California and of the European Union is generally not under California’s or the EU’s control. The fact that someone in California or in the EU can see the website is no different than, say, someone in Cuba seeing a large billboard in Key West, Florida, that said to overthrow Fidel Castro (in his heyday). Cuba could not effectively outlaw the billboard that was in the U.S., because Cuba had no right to regulate Florida. Cuba could build a wall on the Cuban coastline and could domestically outlaw overthrowing Castro, but couldn’t touch the billboard that’s outside Cuba.

The nexus may not have to be much. For example, Google has offices and, likely, servers in the EU, so, if Google in the U.S. supplies my U.S. website with ads, Google may have enough nexus for EU jurisdiction over my websites, even if I don’t use any of Google’s European offices or servers.

But I can avoid having even that nexus, so I can be beyond legal reach of the EU or California. My Web hoster is not over there, I’m not a citizen of any European nation or of California (yes, people are citizens of states), and I don’t have, for instance, an office or a house in Europe or California, so the EU and California don’t have personal jurisdiction over me and my websites. (I have intellectual property and that’s likely recognizable in the EU and California, but I didn’t register it there, so that’s also probably not enough for the nexus.) When Google’s AdSense terms required adherence to the EU’s GDPR, since there’s no way to agree to GDPR jurisdiction without thereby agreeing to EU jurisdiction and I don’t know the laws of about 28 nations nor could I afford to go to a foreign court to enforce my rights in those countries, I cut off AdSense, so that the EU has no right to regulate how I manage my websites.

Imagine if about 190 nations and 50 states could tell everyone worldwide to do their bidding. Our lives would collapse into unaffordable and unfathonable messes. No attorney could even know all of that law, never mind advise me on it. If each of 190 nations could annually tax me 1% of my income, I could be required to pay 190% of my income, nearly double my gross, perhaps every year for the rest of my life. (Maybe I’d be expected to rob a bank and live on rainwater in the streets.) If three nations subpoenaed me to appear at the same time and they didn’t cooperate, and I showed up at only one, I could be shot by two.

Fortunately, the law is neater than that. Someone who is entirely within Massachusetts does not have to obey Afghanistan’s laws. I can benefit from laws over me, like the First Amendment, even if other nations and states wish otherwise. Where I am, I can collect data and do with it whatever the U.S. and certain states say I can, and California is not one of them.

Extralegal Models Relieve Pressure

If website owners believe the laws have benefits as models, they can emulate them without coming under the legal jurisdiction of the laws. For example, they can institute policies similar to those of the laws, but without coming under the laws. That way, the laws would not govern the websites in question.

Expense

The laws add costs. In my case, hosting for GDPR compliance would cost me more. Whether this is a substantial difference for many websites in complying with any such privacy law, I don’t know.

A Pro-Privacy Pro-Business Argument

On the other side is this: If privacy law restricts what data all businesses can collect, a business will be less informed about people, but so will its competitors. They’ll all be on the same level. Total sales may not be as high because their offerings will be less well matched and other kinds of businesses will rise to fill vacuums, but the head-to-head competition will be essentially the same.

Prospects

Both California and the EU have been attractive homes for websites that collect and use big data for ad sales, so they may not care to move out of the jurisdictions, but may prefer to have the concerning laws weakened by amendments or underenforced. So both sides may face each other again.