,
9 tweets,
2 min read
Read on Twitter
NYT identifies a real problem—online privacy is governed by nominal consent that is rarely informed—but, as usual with arguments of this form, leaps way too quickly from “the consent model is problematic” to “statutory baselines will be better.” nytimes.com/2019/02/02/opi…
Substituting statutory baselines for contract can work tolerably well when the problems with informed consent are matched by relatively straightforward & uniform consumer preferences. Almost nobody *wants* to buy an exploding toaster. But privacy’s not really like that.
For one, as the NYT accidentally illustrates, the information problem can cut both ways. Users may be horrified to learn Spotify has “access” to their Facebook messages… but less so once the nature & purpose of the access is explained. newsroom.fb.com/news/2018/12/f…
The trouble is there’s no way to make it suitably difficult to accidentally consent to data uses you don’t want without simultaneously adding a lot of friction to the uses people would consent to.
And if you can isolate the exploding toaster cases—the stuff vanishingly few reasonable people want to consent to—that’s fine. There are probably a handful of those in privacy space. It’s a lot trickier if preferences vary a lot & the rationale for the data use is complicated.
GDPR finesses this—or rather, sweeps the mess under the carpet—by having an apparent high-friction default with a “necessary to provide the service” carve out. I predict this will end up leaving a lot of people dissatisfied in both directions.
For some values of “necessary” and “service,” companies will be collecting data some users thought they had to specifically consent to in triplicate signed in blood. For others (“necessary for this to be economically viable” doesn’t count!) they’ll friction useful services away.
Or rather, friction away small players & make Facebook/Google consent monopolists, since the extra friction is epsilon when you already command that much eyeball time & can leverage consent across multiple services.
TL;DR: The “click to accept terms” model is, indeed, sort of a sham. The consent involved is not particularly informed or meaningful in most cases. But that’s because there’s an actual hard problem there, and it’s not clear statutory solutions solve it better.
