Comment by JumpCrisscross | Hacker News Reader

Comment by JumpCrisscross | Hacker News Reader

"Massachusetts lawmakers are weighing a near total ban on buying and selling of location data drawn from consumers’ mobile devices in the state, in what would be a first-in-the-nation effort to rein in a billion-dollar industry.

The legislature held a hearing last month on a bill called the Location Shield Act, a sweeping proposal that would sharply curtail the practice of collecting and selling location data drawn from mobile phones in Massachusetts. The proposal would also institute a warrant requirement for law-enforcement access to location data, banning data brokers from providing location information about state residents without court authorization in most circumstances.

...

No state has gone so far as to completely ban the sale of location data on residents. The most common approach in other states is to require digital services and data brokers to obtain clear consent from consumers to collect data and put some restrictions on transfer and sale."

> obtain clear consent

In other words bury an acceptance in the ToS nobody reads anyway.

> bury an acceptance in the ToS nobody reads anyway

This is the benefit of incrementalism in policy making. We tried clear consent, and it was buried. Now the case is stronger for a ban.

Yep, policymaking is largely a process that has something in common with erosion. You want a statue of David, the other guy wants a statue of Michelangelo, and each of you has influence over what the temperature of the rain is. Eventually you both end up with a statue of shredder from ninja turtles and somehow the guy whose land the statue is on is now a billionaire.

I think consent has proven to be a flawed mechanism on its own. GDPR’s requirements around legitimate/required processing show a way forward.

1. A site can’t require me to consent to unnecessary permissions just to use the site.

2. I can always revoke/delete my data grants and that must be transitive (the site has to delete all downstream data it shared with subprocessors, and have contractual guarantees that they can honor that before sharing any data with them).

I have to disagree with your comment regarding the GDPR. I like the concept, but the legalities could have been better. I do hope a treaty can be struck between the EU and the US, however.

This may be difficult to do at the state or local level since most wireless is regulated by the FCC.

Why? Pass a law with sufficient penalties (say, $10K) and include lawyer fees. This'll result in a cottage industry in any state. Enough civil litigation and companies will finally decide it's not worth it and MA billing zip codes will be excluded from sale of location data. This has worked in other industries.

Radio (including cell phones) has been regulated at the Federal level for almost 100 years. It is likely any state law would not hold up ... civil or criminal. Additionally the FCC and NTIA would likely challenge an attempt by a state to regulate anything to do with radio.

which is exactly how it has to be! I can't imagine a world where 50 states have 50 different sets of wireless bands, regulations, etc. It would be impossible.

MA has a Commonwealth-specific DNC registry and the AG has successfully taken action against cell phone solicitations under the relevant statute. Just because radio is regulated by the Federal government doesn't mean that states have no sovereignty over commerce that happens within their jurisdiction.

We're not talking about regulating or auctioning spectrum. We're talking commerce.

Hmm, so if it passes. Travel to Massachusets, get a compliant device and.. profit?

I suspect it'll be compliant carriers, not compliant devices.

And your carrier will know when you're in a jurisdiction they need to care about.

the US constitution contains an Interstate Commerce clause, which bars individual states from interfering/obstructing interstate commerce. Does banning the sale of location data in Massachusetts do anything?

Are they being barred from collection/sale in other states?

Did this argument go anywhere with regards to say animal welfare laws and out of state farmers?

if vendors from outside states follow the rules for what can be sold in CA, then they can sell in CA also; CA can't favor its own farmers. Also CA can't control what those same producers sell outside of CA, but they can control any production within the state.

The only other aspect I think has to do with whether federal FDA and Agriculture regulations take any precedence over CA, but that's not interstate commerce.

Short version: no. Since Wickard v Filburn, the interstate commerce clause has been a blank cheque for the federal government to regulate anything at all as it pleases, as the case allows regulation of goods down to the level of things that are made on and will never leave an individual's property.

Long version: probably. Allowing the sale of location data would be deeply unpopular among the general public. Under stare decisis, the federal government would have a good chance at beating the state in a court case, but it would still be a risk- why risk the power for an unpopular case?

See also: marijuana legalization and immigration. Arizona tried codifying the federal statutes on immigration into its own state laws- not superceding, just mirroring. The federal government took them to court and won. OTOH, marijuana is also distinctly within the federal government's purview, and Wickard would apply very easily to pot laws as well... And yet, they have done nothing at all, likely because pot is too popular to risk a court case (or an election, I suppose).

How does this square with broad reaching commerce-regulating state laws like the CCPA or CEQA? Also, for federal supremacy/the Commerce clause to apply to something like this, doesn't the Federal government first have to have legislated in this area?

The reason this is tricky is that Wickard v Filburn is just a terrible, terrible decision. It massively expanded what the federal government can do, without a bright line of any sort to limit it.

These things, imho, are rightfully within the purview of the states to implement. However, should the federal government declare there is a national interest (justification) for national regulation, then per court precedent it would compel the state to change. I do not believe there is any sort of jurisprudence for "grandfathering in" existing state laws. Just as prosecutors have discretion over what cases they actually prosecute, the government may choose to look the other way when state laws overlap the feds jurisdiction.

If they tried, though, the state would still have the recourse of attempting to go before the supreme court, which would involve upending existing precedent. I suspect the current court would be about as favorable towards limiting the interstate powers clause as it gets, but it isn't a given by any means.

> I suspect the current court would be about as favorable towards limiting the interstate powers clause as it gets

Current court will end up on the side of business. guaranteed!

> Short version: NO[?] Since Wickard v Filburn, the interstate commerce clause has been a blank cheque for the federal government to regulate anything at all as it pleases

but it's not a blank check for the state of Massachusetts to regulate anything outside of Massachusetts, so you 1000% failed to address the question I raised. (1000% because you wrote a lot while not addressing the question about Massachusetts law being effective in this case where there is no countervailing US law)

I see- I didn't realize the opening bit of your question was a non-sequitur.

Yes, Massachusetts may enforce the law within its own borders. Companies which buy or sell location data may not operate in Massachusetts without risking enforcement actions. If someone with a company's app travels through MA, their location data may likely still be sold if the company itself is not registered at all in MA.

HOWEVER, the law must also survive the inevitable federal court challenge when a company headquartered in another state, but with some small operating presence in MA, falls under some enforcement action... rendering the original question entirely moot, as I suspect there are no shortage of companies who would challenge the law.

in this case it's your non sequitur which is non sequitur. Mine was the basis of my question.

Reply on news.ycombinator.com