@suzannealdrich @paul_ipv6 @briankrebs There are several good state laws to copy, such as California's and Colorado's, and of course there's the GDPR. There was a decent Federal bill a few years ago but Pelosi killed it, because it preempted stronger state laws like California's. Industry, of course, doesn't want any of this. "Data is the new oil!" No (and I wish I'd thought up this line, and I don't know who did), it's the new plutonium—small amounts are very toxic, and too much concentrated in one place can have very bad consequences. But if there are going to be privacy laws, they want one law in the US, not 50. In the meantime, they're pushing (and drafting) weak state privacy laws, some of which have been enacted. Of course, I'll believe that things like the GDPR actually work when Facebook et al. have to pull out of the EU. I do, though, suspect that we're thinking about privacy regulation incorrectly. The paradigm of notice and consent is >50 years old and it doesn't work. My thoughts on that are at https://gwjolt.org/files/volume_1/GW_JOLT_1_1_Bellovin.pdf.