In recent weeks, California legislators have shown renewed interest in redrafting online privacy regulations, leading to the introduction of over a dozen bills and the creation of a Select Committee on Privacy to help “update California privacy from the brick and mortar world.” Most efforts have been focused on AB1291 -- the Right to Know Act. While supporters of this two-year bill -- including EFF and the ACLU -- claim it offers more transparency and much needed updates to privacy laws, there are almost no additional protections to users, and the bill imposes significant hardship on startups.
As we spend more time on the internet, conducting more of the business of our lives, online privacy has rightfully come to the forefront of efforts by government regulators and advocacy organizations. Regulations are necessary to protect children, prevent abusive marketing, and allow consumers to make informed choices about the products they use. Unfortunately, Right to Know does none of that.
This bill offers few, if any, improvements to the existing “Shine the Light” law, which already requires businesses to provide information to consumers about direct disclosures of personal information to third parties. At the heart of Right to Know is a new requirement that businesses make all “reasonably available” user data available upon request -- thousands and thousands of pages of it. This ‘give us everything’ mentality might feel right from an intuitive perspective, but it does not improve transparency (what does “reasonably available” even mean?), and it makes data more costly.
For a small startup, this bill is like a regulatory DDoS attack -- there just aren’t enough resources to hunt down all the data about users, especially when you consider the ever-changing nature of databases in growing companies. The beauty of startups is that we collect every piece of information until we can determine what is useful, allowing us to innovate and improve products along the way.
As more consumer-facing services live online, there is a continued need for trust between users and service providers. Startups -- the pioneers of the next great technologies -- need to foster that trust, but giving users thousands of pages of data will not do much to help consumers make informed choices. Right to Know, though well intentioned, will not help consumers make smarter decisions about products, but it could stifle the innovation of startups.
