Privacy Legislation and an Independent Internet
I recently read an article by David Schmudde calling for greater consumer privacy protection through legislation. I'm sympathetic to the concern here, it's hard not to be worried about data privacy issues in the current climate. But there were two parts of the article that really stuck out to me:
What remains explicitly clear is the fact that folks are not gathering in the digital equivalent of parks and town squares, they are gathering in online centers of commerce. Our digital public spaces, often called “platforms,” are really purpose-built shopping malls.
and
a more equitable, privacy-respecting internet will require provisions for substantive governance outside of commercial interests
There are two visions Schmudde puts forth of "a better internet". One is a non-commercial (and I think necessarily, smaller, independent) internet, and the other is a defense of consumer privacy rights1. I don't think either of these things are wrong or undesirable, but in my experience there is, in practice, a tension between these ideals that has to be considered when we think about legislation. Concisely: privacy legislation tends to increase the barrier to entry for non-commercial players, more of the former means less of the latter.
This is a view informed primarily by personal experience. I've been involved as a developer and admin in building two small internet communities, a web forum that traces its lineage back to a dialup BBS and a language learning community2. Together, over their lifespans, these communities have probably been home to a few thousand people. These communities are, to me at least, the "digital equivalent of parks and town squares". Small communities where people know each other and the object of both projects is to facilitate human communication.
Over the years I've come to know a few other website operators in a similar space. The consensus is that it’s a bleak "market" to be in. User acquisition basically doesn't happen. The historical sources of user inflow to forums (chiefly search results) is a trickle and we consistently bleed users to subreddits, facebook groups, the figurative “shopping malls” of the internet. Word of mouth is really the only thing that works, but if you run e.g. an audiophile forum where most your users are there because the people physically around them just really don't care that much, then word of mouth is only worth so much.
Anyway, all this to say, among people in the niche, independent, town-square like community space, I don’t think lack of government regulation is really perceived by anyone as the issue. It probably is an issue at some level, as a consumer I do appreciate privacy legislation, but as a keeper of the commons it doesn't help me keep my community alive and it causes all sorts of headaches that sometimes border on existential threats. Commercial tech companies may not like privacy legislation but they are wholly equipped to deal with it. GDPR compliance probably cost Google a pretty penny, but if anyone can take that hit it's a company with a trillion dollar market cap that needs to be compliant to continue milking the cash cow. When you’re some guy who runs a thing because you want people you've been talking to for years to have a place that isn't facebook you're probably not excited to field the legal questions that come along with GDPR compliance. I've seen real communities die because the guy that's been thanklessly keeping the servers running for a decade got one more letter threatening legal action and it just didn't seem worth it anymore.
As a sidebar: the infamous DMCA is the butt of a lot of jokes but you know what actually makes my life easier as an independent service provider? The safe harbor system. Like sure, I don't love getting a takedown notice, but give a clear way to let users and copyright holders duke it out without creating a "some guy posted a shitty camcorder recording of the latest transformers movie on my Buffy fansite and now WB is killing my site and suing me into the ground personally" kind of situation. The DMCA involves a lot more than the safe harbor provisions, but that part of it is actually great! It protects independent service providers in a way that doesn't require massive investment in policing and prevention, at least the notice/takedown process isn't purely shafting users to protect rights holders because it does provide for counter notices.
And this isn't to say privacy legislation is categorically bad. Protecting consumers is a worthy goal. But serious regulation does happen at the expense of those regulated, and independent and especially non-commercial service providers tend to be the ones that can't survive that3. The only legislation that's reasonably going to help those of us in the mom and pop internet category would be trust busting the corps that have siphoned off the userbase of the independent internet. Breakup FB marketplace and craigslist prospers (god bless craigslist, that's the internet I want to live in). If reddit went away a lot of small communities would be hurt, but they'd also re-learn how to self organize. But of course that's never going to happen.
So I don't know what the path to a less commercial internet is. But I do know that without careful consideration of the impact of privacy regulation on independent service providers, we're pushing people out of the parks and into the shopping malls of the internet.
The focus of Schmudde's article is actually largely around different visions of what "privacy rights" means, which is an interesting topic. But for our purposes, the moral genealogy of privacy rights isn't terribly important. I'll be treating the "data-as-property" and "data-as-self" views collectively, because what they tend to look like in a legislative context are largely the same.↩︎
The latter is, admittedly, a product. Participation is free but we offer some extra bells and whistles (e.g. on-site image hosting) if you pay. The former doesn't generate any revenue and is offered as a service to a community I've been a part of for many years.↩︎
It's also worth considering that data privacy is an issue that is at least exasperated if not created by massive commercial service providers. I can't do anything with my users data (other than sell it) to make a buck. I guess I could advertise sick Buffy merch on my Buffy fansite, but I don't need to spy on users to know that's what I should be pitching them. It's only when you have a massive horizontal infrastructure that fusing your uber eats order history with your apple watch water intake data to try and sell you insulin before you know you have diabetes starts to make sense.↩︎