Comments on Privacy

Today, all privacy regulations around the world are based on the 50-year-old paradigm of notice and consent. It no longer works. The systems we deal with—web pages with their multiple levels of advertising, the Internet of Things, and more—are too complex; consumers have no idea what sites they are contacting nor what their privacy policies are. Privacy harms are not well-defined, especially under U.S. law. Furthermore, their privacy policies are ambiguous and confusing. Use controls—the ability for users to control how their data is used, rather than who can collect it—are more promising but pose their own challenges. I recommend research on a new privacy paradigm, and give suggestions on interim changes to today's privacy regulations until there is something new.