Why is privacy so hard? (cacm.acm.org)

We should tax data.

Hear me out. Google, Meta, etc. offer "free" services to a significant portion of the world's population. This isn't charitable work. They do this for data that makes them money. Lots of money. Data has real monetary value, but governments don't treat it as such. Few, if any, jurisdictions view data exports as taxable. It's simply not tracked. If data collection isn't tracked, how can one realistically enforce privacy standards?

If we tax data, then we'll have an incentive to track how data is being used and corporations will suddenly have a direct financial interest in not just casually collecting data if they don't need to. Such taxes should be gauged to be tolerable for Google and Meta, but high enough to make companies who make their money via other avenues (e.g. Smart TV sellers) to take a pass on data collection.

The article is exploring a broad topic but one area that seems to be overlooked is governments making privacy illegal or actively working to undermine it. The major privacy risk right now is things like social media age verification laws which, in principle, probably make pseudonymous sites like HN illegal or on the path to being illegal in many jurisdictions.

It is hard to maintain privacy when a law enforcement body insists that it isn't allowed. There are also indications that companies quickly become too enmeshed with intelligence services to be able to create properly private options even if tactically they might have an interest. Companies like Telegram stand out as looking difficult to run in practice because of the pressure from various snoops.

If it is legal to create private options then they will always exist because the people who care about specific aspects of privacy can self-serve.

Because there are numerous choke points where people need to use devices to do a thing and those devices can record you and the financial incentives for the companies that own these choke points is so great that they end up selling your data.

Even if Apple truly had perfect privacy you still need to use credit cards, bank accounts, insurance, cell towers, drive a car, etc.

I think that’s the underlying reason why privacy is so hard.

A lot of value is left on the table because informed people don't give up data.

If simple regulation existed - say, "no one can use data for any purpose the user did not explicitly consent to, including product improvements AND including on-selling", that suddenly turns giving up data into a legally-binding, two-party transaction.

There'd be an explosion of really cool uses of data as a result of the trust that'd engender.

But today's status quo is lucrative - so here we stay.

One thing interesting about the Church is that Kings, Inquisitors, Revolutionaries, Govts etc have all tried to break the seal of confession for thousands od years now. The Church has some how managed to defend it by saying we believe path to repair/forgiveness involves creating and maintaining space where people can confess their sins. If a priest shares those sins with the state, everyone looses trust in the system and therefore breaking the seal over any sin is equal to dismantling the institution itself. This argument is literally the same structure used to defend attorney client confidentiality, psychiatrist patient confidentiality, corporations(telcos, email providers, platforms) from handing all data to the state. But for all those cases the state has manahed to add huge amount of expceptions which it has not been aable to do with the Church. So the Churchs defense of the seal almost since 1215 has stood on a Belief. A story literally. That privacy is requires for repair.

Everyone else just hasnt come up with a good enough story.

Secondly what is stored in the head of a priest is usually forgotten cuz human memory is flaky and no one is writing anything down in a central db. So every now and then a state attack on the seal work but the everything then reliea on how reliable the memory of a single priest is. Its like a terrible distributed atorage system that is constantly forgetting things. Notice this is literally what large platforms have now built to defend privacy. Its called data minimization and costs a huge amount that they constantly cry about.

So its really funny how the church just stumbled into a solution that is cheap and hard to attack.

IMO it's not that it's hard but that nobody makes money from it the way they do from the panopticon so listed factors 4 and 8 have outsize influence.

Very nice summary and we are definitely at an inflection point on privacy. The incentives are misaligned, and the temptation of free digital services cause users to overlook the very real cost of their privacy.

Privacy is hard because it’s not merely a technical problem. It’s applied to individuals by systems that most individuals have very limited influence into—and those that _do_ have influence often stand to benefit from eroding the privacy of others.

If you want privacy, shut down your windows

And spend money on products you can install locally that do not connect to the web. Free products will always abuse your privacy

My thought was to write legislation that gives 20% of my generated ad revenue to me the customer as legal tender (no store credit, coupons) then have the government tax that income.

1. government gets new income source.

2. government is invested in making sure they are not getting short changed.

3. failure to pay me is fraud.

4. When you pay me now I know your crap is spying.

5. Government taxes almost never go down, with this system it going down will immediately be visible to consumers who will balk.

Problems: ad revenue is the new shrink-flation without it prices will rise. companies will fight this tooth and nail, but voters get "free" money.

Privacy is only hard because comoanies are not telling/asking tgeir customers before sharing their data.

A way to solve this problem would be to create a portal where customer data is stored in control of the customer. Companies are only allowed to tell each other about customers, not even which data they hold.

And then each data request goes directly through the customers.

Then customers can decide who to share data with. And then those customers will be happy with their choices.

Because good privacy is not profitable.

The lack of privacy is due to a lack of regulation and funding of regulatory agencies. It happens precisely because the US is very adverse to adding new privacy laws or enforcing the ones on the books (you need to fund federal regulators if you want them to regulate).

Frankly, I think a large reason it goes unaddressed is because governments love to invade privacy just as much as advertisers do. Adding new laws to curtail consumer products from spying also means the likes of the NSA, FBI, or local law enforcement can't also tap into that spying machine. They want google to log everything you do because they are all to happy to use those logs.

Privacy isn't the problem. The problem has been the sea of bad actors trying to undermine it. That's the problem. Stop them, don't put the responsibility on the consumer to claw that privacy back.

Personal privacy is, and has always been, the job and responsibility of the individual. You can be as private or as public as you allow yourself to be through your own practices. Nobody can give you privacy, you must take it, which requires work and sacrifices that most people are simply unwilling to make, that's why nothing has changed. If it's privacy you want, stop being so public. Avoid surveillance. It's not easy but it's also not impossible, you have to actually value your privacy enough to do the work of establishing it. Good luck.