Brendan Eich Writes to the US Senate: We Need a GDPR for the United States

The practical effect of GDPR seems to me that I have to click away about half a dozen consent popups every day. Sometimes a cookie warning in addition to that.<p>If I use Private Browsing (to protect my privacy) I am punished with more popups. If I open a website within a browser shell on mobile that doesn&#x27;t have my cookies (some kind of webview of an app), I am punished with more popups.<p>Am I expected to look at every one of those dialogs and figure out what I have to click to &quot;customize&quot; my tracking?<p>Then there are the technical problems; one of those consent &quot;solutions&quot; that you see around actually shows a spinner while your &quot;preferences are being saved&quot;. Sometimes it never closes.<p>I am frankly already so tired of this that I don&#x27;t even care to look which of the buttons says &quot;Agree&quot; and which one says &quot;Refuse&quot;. I just click on whatever I see. I know for certain that for less experienced users (my parents), every additional button to click is just another hindrance to achieving what they need to do. The thought &quot;what if I click the wrong thing&quot; is a permanent companion of their computer use.<p>These are very real, very concrete negative effects of GDPR. Is there something that we gained to make me feel better next time I am annoyed with all the popups?

Somehow, I feel like the old, unregulated internet was better. I wonder if that is just nostalgia or there is something to it.<p>With an unregulated internet, any internet user has to take care of their own privacy and anonymity. Barriers for entry for new websites and services are very low. Data breaches and abuses of data can lead to users being concerned about giving their data to tech monopolies, which can enable competition.<p>Regulations like GDPR arguably make users complacent and lowers their guard, as well as strengthens the tech monopolies by adding to their moats. Would Facebook have been able to displace Myspace in the current environment? Or Google displace Yahoo?<p>The internet was doing fine for decades with minimal involvement from governments - why change things?

It&#x27;s funny, I was listening to the Hanselminutes, and in a recent episode, his guest (a lawyer) was underlining that the US partially created the current situation where current its companies are at loss in front of GDPR: by refusing to take the lead on data privacy issues, the US didn&#x27;t have a framework for privacy laws, and couldn&#x27;t negotiate a convergence of laws with the EU (I&#x27;m paraphrasing).<p><a href="https:&#x2F;&#x2F;www.hanselminutes.com&#x2F;647&#x2F;how-gdpr-is-affecting-the-american-legal-system-with-gary-nissenbaum" rel="nofollow">https:&#x2F;&#x2F;www.hanselminutes.com&#x2F;647&#x2F;how-gdpr-is-affecting-the-...</a>

I would prefer starting small and cautiously scaling up. “If you lose my data, you are strictly liable” is a good start because it lets case law work through the holes. (It also causes companies to see personal data as an asset <i>and</i> a liability, not just the former.)<p>Full-blown GDPR is overkill. It makes more sense to wait a few years and see if the situation in Europe evolves differently from the U.S. I personally believe the law fails to incentivise the sort of behaviour it aspires to, but that’s merely a hunch—better to wait until we have data.

1) I don&#x27;t agree. I prefer to have GDPR in Europe, no GDPR in the USA, and see which turns out to be better for human rights. I suspect that GDPR will very soon start to be used by corrupt politicians and other criminals who want &quot;to be forgotten&quot; for their misdeeds (ie, censor us when we want to remind the public).<p>2) I can&#x27;t help but notice that GDPR is a great idea for Brave &#x2F; BAT. And look: I&#x27;m long on BAT (I&#x27;m not wealthy enough to be a whale or anything, but I bought a small amount in the very early days). But this seems self-interested to me, rather than an assessment of the proper course for American politics.<p>Eich admits this in part, of course, saying early in the letter that &quot;I view the General Data Protection Regulation (GDPR) as a great leveller. The GDPR establishes the conditions that can allow young, innovative companies like Brave to flourish.&quot;<p>But he also says &quot;The enormous growth of ad-blocking by people across the globe (to 615 million active devices by late 2017) proves the terrible cost of inadequately regulating the tracking-based advertising system.&quot;<p>Does it? It seems to me that people are working to find ways to improve their lives, and that they&#x27;ll keep doing so to the shegrin of the internet behemoths absent any &quot;regulation&quot;. In other words, the state is not needed to make this phenomenon regular - it&#x27;s already quite regular and becoming moreso.<p>Let Brave and Chrome fight it out and the best (not the most politically expedient) one win. For now, I&#x27;m using Firefox.

If legislation is really required, and I&#x27;m not convinced it is, can we start small? This stuff never gets rolled back and tech companies&#x27; use of personal data is the new terrorism.<p>Again I&#x27;ll take none, but if this ridiculous fervor that&#x27;s been built requires something, how about not-tech-specific rules around data sharing transparency? Just require details on what&#x27;s shared and with whom for those seeking it (ideally companies publish it to prevent requiring individual request&#x2F;response scaling issues, but their choice). You&#x27;re gonna find most people don&#x27;t care anyways, so they shouldn&#x27;t be burdened with more hardline privacy requirements. Just increase the visibility for now.<p>And please please learn from EU mistakes and establish enforcement mechanisms. Don&#x27;t just make exorbitant ceilings and move on. Have a framework to punish violators, and again start with small legislation until it can be shown enforcement occurs and is working.<p>Having said all that, can we just start with pro-privacy PSAs, education, targeted advertisement awareness, punitive measures for breaches, and relaxation of legislation preventing me from scraping&#x2F;manipulating&#x2F;proxying these sites however I want? If we all have to hire lawyers and&#x2F;or compliance assistance, then the first step is too large. We can make our way towards delete-all-my-data-on-request laws later. Not sure what made this an emergency (actually I do know based on media and political driven fervor, but that will be best studied through the lens of history). But all these tech people, OP and commenters here especially, don&#x27;t speak for many people who accept the current state or reasonably understand heavy-handed government regulations on the internet bring more bad than good.<p>And for goodness sake, don&#x27;t use the domain of your should-be-neutral software to make a political post. You aren&#x27;t gonna feel any pain now because you are in the same line with other popular pitchfork wielders, but your political leanings have bit you before, why would you associate your company with them?

It&#x27;s somewhat amusing watching the overt rhetoric of advocating for data privacy enforced by governments when the majority of even technical people understand covert exploitation that is happening by said governments (and leaked to n number of 3rd parties [non govs, ngos, even the public occasionally via incompetence&#x2F;leaks&#x2F;hacks, etc] around the world on an increasing basis), which has the dual benefits of making the uniformed or willful ignorant feel good without actually changing the state of things.

I don&#x27;t want it to end up in annoying dialog boxes and degraded UX on every website like it currently is in Europe.

Gdpr makes using websites a terrible user experience with the million cookie prompts. My parents will click on anything to make popups go away. Please no.

This is so misguided. GDPR is a disaster and only entrenches large companies.

The GDPR is mostly good. The right to find out and delete the data is excellent. The bad thing is the constant consent popups which have become synonymous with the GDPR.<p>Obviously there are also still a lot of sites that try to wiggle around the GDPR by saying &quot;By entering the site you agree to X&quot;, a practice that should soon be found to be in violation of the regulation. If that is allowed, the regulation for storage&#x2F;processing becomes almost pointless.<p>That data collection should be opt <i>in</i> if it isn&#x27;t an essential function of the app&#x2F;site&#x2F;service.

I am sick and tired of auto playing videos, popups etc. It is not GDPRs fault, media companies are milking us. Yesterday I got to an article that was covered with overlays and popups. You couldn&#x27;t even see the title. I realized, I didn&#x27;t care that badly to read it anyway and abandoned it.<p>Strangely, we are still enduring this terrrible UX experience, mostly because we don&#x27;t have good alternatives or those that exist, are not known. I think we should spend time creating those and discovering and promoting healthier information sources.

<i>&quot;Right to be forgotten&quot;</i> is a core tenant of GDPR. It&#x27;d be interesting to see if the U.S. would enforce the hard delete of social media profiles upon opting out.

Something to torpedo tech everywhere. Yay!

Really strange that the Brave website of all places includes a Javascript that hijacks your native scroll. Why is that smooth scroll library so popular? It&#x27;s really obnoxious.

No we don’t. There’s no privacy problem that needs solving.<p>Brendan Eich is seeking protection for his failing business from the government. He wants to use the force of law to make his browser more competitive.<p>I’ve got a better idea: let’s make JavaScript illegal. That’ll hurt the advertising industry too!

Data protection we do need indeed, but the EU is the last entity I want to be emulating on internet laws, except maybe China.