Daniel Solove: consent vs. privacy

Well, Dan, thanks for joining me again.

Thanks for having me.

Pleasure.

And so you've been writing more, always very interesting, and connecting many dots.

And I want to start with the idea that notice and consent as a formula to bring privacy to people has failed.

And you did explain that it is good news that people start caring about privacy.

You wrote about that.

But if the burden is on people, it's not effective.

And why would you say that? What do you mean?

Well, in some ways, companies and the law have weaponized people's caring about their privacy to sell them a, quote, solution that is not really a solution, that actually creates an illusion that they're in control and that they have power when they don't.

And this is the notice and choice approach.

And it's the predominant approach to privacy in the United States.

And it has failed miserably.

This was an approach that emerged in the early days of the internet.

It's a warmed over version of self-regulation.

Companies put a notice about what they do with privacy.

And then people purportedly have a choice where they can either opt out of certain things or in some cases just take it or leave it.

But this really does not provide much control to people, didn't.

People have been very unhappy and concerned about privacy for a very long time.

This finally bubbled over into the passage of laws in almost half the states now.

Unfortunately, those laws have largely codified the notice and choice approached, but sprinkled on a little bit of GDPR dust.

And that's the General Data Protection Regulation from the EU.

It has more robust protections, still not perfect.

But so these laws throw in a bunch of things.

They give consumers some rights in their data, but largely are doing the same thing with notice and choice, which is putting a lot of the onus on consumers and relying heavily on getting some form of consumer consent.

Well, Dan, thanks for joining me again.

Thanks for having me.

Pleasure.

And so you've been writing more, always very interesting, and connecting many dots.

And I want to start with the idea that notice and consent as a formula to bring privacy to people has failed.

And you did explain that it is good news that people start caring about privacy.

You wrote about that.

But if the burden is on people, it's not effective.

And why would you say that? What do you mean?

Well, in some ways, companies and the law have weaponized people's caring about their privacy to sell them a, quote, solution that is not really a solution, that actually creates an illusion that they're in control and that they have power when they don't.

And this is the notice and choice approach.

And it's the predominant approach to privacy in the United States.

And it has failed miserably.

This was an approach that emerged in the early days of the internet.

It's a warmed over version of self-regulation.

Companies put a notice about what they do with privacy.

And then people purportedly have a choice where they can either opt out of certain things or in some cases just take it or leave it.

But this really does not provide much control to people, didn't.

People have been very unhappy and concerned about privacy for a very long time.

This finally bubbled over into the passage of laws in almost half the states now.

Unfortunately, those laws have largely codified the notice and choice approached, but sprinkled on a little bit of GDPR dust.

And that's the General Data Protection Regulation from the EU.

It has more robust protections, still not perfect.

But so these laws throw in a bunch of things.

They give consumers some rights in their data, but largely are doing the same thing with notice and choice, which is putting a lot of the onus on consumers and relying heavily on getting some form of consumer consent.