The Washington State legislature is considering a consumer data privacy bill, Senate Bill 5062 (summary). While I was creating Simple Opt Out, I assumed that the CCPA made consumers opt-out of paid data sharing - not a business sharing data to target their own ads, but selling consumers’ personal data to unaffiliated third parties for compensation - due to an oversight. When the CCPA was in process, not everyone realized that retailers would sell their customers’ purchase history to anyone who would pay. It may not have stood out from targeted advertising and may have actually been an oversight.

Not for this Washington State bill. Turns out that many, if not all of this bill’s sponsors know that its default protection is incredibly weak. By now, legislators are aware that consumers’ data is sold to unaffiliated third parties - and that no consumer would opt in to that. They just don’t care or don’t care enough to do anything about it.

That’s why I sent this letter to the Washington State House of Representatives Civil Rights & Judiciary Committee and individual members. While Washington is probably stuck with this bill - and privacy for a vanishingly small number of residents - I hope my self-contained explanation helps another state or motivates a Washington State legislator to close the data sales loophole.

Here’s my letter.

Subject: SB 5062 - Please don’t let businesses sell my data unless I opt out

Dear Chair Hansen and Civil Rights & Judiciary committee members,

My comments are about requiring consumers to opt out of having their data sold to third parties for compensation, as SB 5062 currently does.

If you’ve purchased from Ace Hardware, Crate and Barrel, Home Depot, the Seattle Art Museum, or hundreds of other companies, they sell or trade your information - often including purchase history, contact information, and preferences - to third parties for a few extra cents of gain. Yes, completely unrelated companies know what you bought at many traditional and online retailers.

These businesses don’t do this in order to operate or market their business (as is the case with targeted advertising). Rather, this is turning the consumer into the product: selling customer information to completely unrelated businesses, merely because they’ll pay for it.

Reasonable people can debate the pros and cons of targeted advertising, but the practice I’m talking about, selling detailed data about customers to third parties, has no pros. It shouldn’t have ever been legal.

I know because I spent 100+ hours reading privacy policies, finding these practices, and creating a directory of opt-out instructions. My not-for-profit site, https://SimpleOptOut.com, has made it a bit easier for tens or hundreds of thousands of people to opt out of data sharing that they would never have opted in to.

I want the Washington legislature to make my Web site obsolete.

This bill begins with ”The legislature finds that the people of Washington regard their privacy as a fundamental right” … and.. then it disregards that statement by requiring Washingtonians to opt out of these sales. Has anyone on the committee actually tried to opt out of data sharing? I have. You’ll spend most of a day digging through privacy policies, calling phone numbers, filling out web forms, and printing and mailing letters. If you’re lucky, after doing that 30 or 40 or 50 times, you’ll cover about half of the businesses that sell your data. My Web site makes that easier, but not easy – and that’s only because I’ve tried to mitigate a problem that the legislature should solve.

Opting out of data sharing requires so much time that less than 1% of Washington residents will actually do it. Instead of 100% of Washington residents having this so-called “fundamental right,” this bill will provide it to less than 1%. And that 1% will be well-educated computer engineers and attorneys. This bill makes privacy contingent on resources, on privilege and for no commercial justification. Unlike advertising, this doesn’t help a business deliver or market their products.

Since literally zero Washingtonians would opt in to having businesses sell their personal information for extra revenue, forcing each of us to opt out with each business is nonsensical.

Imagine if, in order to have First Amendment protection for something you wrote, you needed to visit every web site which might publish it or have access to it, find their instructions for opting out of First Amendment violations, and follow them - which could take two minutes or twenty minutes each - and then hope the business actually processed your request.

Or, imagine if every time you moved, you needed to call or visit the new city, county, state, and federal police and fill out a “Fourth Amendment violation opt-out” form. This form requested that they not unreasonably search or seize your property. Oh, you didn’t spend the time to opt-out of Fourth Amendment violations? You must not mind them.

That’s how this bill handles unnecessary data sharing. The right to request that an entity not sell my personal information to third parties… that’s not privacy. Privacy is not needing to do that in the first place.

There’s a better way. Require residents to opt in to data sharing for compensation. If privacy is a fundamental right like this bill says, then privacy should be the default. Nobody needs to opt out of having their other rights violated, and we shouldn’t need to opt out of having our privacy violated, either.

Alternatively, if the bill is going to require opting out, then change the rest of the bill so it’s accurate. Instead of stating that privacy is a fundamental right, explain that privacy is a luxury that the legislature is offering to state’s most privileged and technically experienced residents. Explain that businesses can assume residents don’t deserve and shouldn’t receive privacy, unless and until each individual informs each business using whatever method the business prefers.

If you’re thinking, “Wow, that sounds terrible,” you’re right. It does, because it is. All I did is accurately describe the bill’s current treatment of selling data.

Businesses should be able to deliver the products and services that we depend on, and to market them effectively, but not to share or sell our personal information with unaffiliated third parties for compensation. Please change this bill to deliver privacy for 100% of Washingtonians, not less than 1% like it does now.

Thank you,

Troy