The law needs to be changed to create a real regime of regulatory and court enforcement against companies violating such anti-tracking and anonymity rules protecting consumers. Up to now the courts have largely failed to recognize a private harm from disclosure of user data to third parties,[i] arguing that since consumers can’t show economic losses from the sale of their data, they can’t seek damages. Possibly as the economic harms of behavioral targeting by online advertisers has become a bit more understood, there have been a few glimmers of movement in the courts, such as a recent 9th Circuit Court of Appeals decision allowed a lawsuit against Facebook to proceed since consumers could have suffered damages due to “losing the sales value of that information” and by its general dissemination.[ii] Still, new laws or regulations need to make clear that violation of laws protecting user data create a private right of action by users with clear default economic damages for violations.
There is actually a fairly objective criterion to measure harm to consumers from loss of privacy, even if measurement is not simple. Jaron Lanier framed this as the data platforms should only make money on the value-added that they bring to data collection, but should not be making any money from actually having the data in the first place, since that value should have gone to the individuals associated with the data.