There's no innovation quite like compliance-driven innovation! C'mon gang, let's get coding.
They were willing to pay a few hundred dollars every month just to be able to access up-to-date rules in one place.
I wonder how many of these compliance driven innovation opportunities (great term, btw) there are, thanks to bureaucracy.
Carl Malamud, an open access advocate (among other roles), has been championing the cause of open building codes for almost a decade.
Tons. I'd venture to say that the majority of B2B companies out there exist because they offer some form of assistance in dealing with compliance across the country/world. Even though we probably don't think of that as their primary service. Example: payroll services - the money transfers are the easy part, a company is really paying these services to do tax compliance.
One of the problems with starting a company like this is finding all of the niches that exist. You kind of have to have worked in a sector to learn what some of the pain points are that can be eliviated.
Tax filing, tiny house codes, building codes, customs fee at the borders…
What else?
Alas, the Venn diagram of domain knowledge (for any given niche) and any measure of competence developing products is tiny.
And the work just isn't interesting. A friend made good money writing property tax administration software for municipalities. Tried to recruit me for years. I helped on some stuff, enough to verify I wasn't well suited to that type of work. Older me could probably do it happily.
It's not all bad, Manufacturing compliance for Drugs for example, make sense.
Never the less, whether necessary (as in health) or primarily burdensome like SOX, they create tons and tons of high paying jobs. Small companies can't afford full timers so they make do with consultants who charge an arm and a leg.
SOX means well, but it's not going to stop the hanky-panky except for the inept. Is the cost of compliance worth the return on having less of incompetent fiscal malfeasance?
And this is why it's important for such legislation to apply to all citizens and permanent residents of the legislating juridiction, regardless of where they're physically or network-topologically located.
With Westphalian sovereigns (or gangs of such working together, like the EU), that’s possible in principle, because such entities can claim jurisdiction over anything anywhere; their sovereignty is unlimited, though their practical ability to enforce their laws may be more circumscribed.
For US states, however – “sovereign” though they may be – they cannot assert jurisdiction over commerce just because one of their citizens is involved, regardless of where they are physically located and where the other party is.
Well, a milder version anyways. Look-up is only country level, not state, and what changes is generally the pop-up rather than the privacy policy. But the tools are already in the marketplace.
When Ford motors started cars already existed, when Facebook started social networks already existed, when Google started search engines already existed, etc.
In my opinion, getting demotivated for not being the first or being “the one” that came up with the idea prevents way too many people from starting their own thing.
In the end, execution and adoption are what really matters. In general is better to copy something and improve on it than trying to invent something completely new.
But of course, most companies assume that the default configuration is compliant, since that's the entire point of the product, right? Companies think the product is a compliance solution itself and therefore compliance is purely an IT problem of deploying the software and legal doesn't need to be involved. But in fact the software is actually a platform for scaling and automating enforcement, and legal actually needs to be involved to figure out what compliance looks like.
There are several studies showing that a huge fraction of GDPR/ePD violations are actually a result of using consent-management software but leaving it in the default configuration.
And then there's what those platforms do, use every dark pattern possible to get the user to perform an action that they can interpret as consent.
Like, if you have a legitimate interest (you need my address to do deliveries to me), then you don't need consent.
But clearly there's no legitimate interest in this case, it's just a dark pattern to get more data.
I feel like the second option would be feasible if you could somehow get the major sites to agree they would pull the data each request rather than storing it in their databases.
You did remind me of Tim Berners-Lee's SOLID project, not that it's "storageless" really.
I think the GDPR comes closest to what I would want, with the requirement for explicit, informed, and freely given consent prior to any data collection that isn't strictly necessary for the site to function, and that access to the site can't be conditional on giving consent. What I'd want in addition is far stricter enforcement of it, such as heavy fines on every site that thinks a banner saying "Continued use of this site constitutes consent." is satisfies any of the conditions required.