A more effective approach: government. California's SB 362 creates a single opt out starting 1 Jan 2026, audit obligations (mandatory 3rd party every 3 years w/ submission of failures to the CPPA, California's privacy enforcement agency), etc. Plus the potential of a $200 per day per request fine for failing to act on opt outs.
https://www.skadden.com/insights/publications/2023/12/califo...
[0] https://globalprivacycontrol.org/ [1] https://redcloveradvisors.com/2023/02/21/what-is-global-priv... [2] https://oag.ca.gov/news/press-releases/attorney-general-bont...
That said, the compensation scheme as proposed would likely need government mandate, and I am all for a solution that lies halfway between the public, markets and government.
This is true of any regulation, and its sort of a tired trope.
We don't make CP legal simply because its currently being pushed to regions with less regulation. Adding a higher barrier to entry and more difficult operations does reduce the amount out there, and while there would absolutely still be data brokers moving to deregulated regions, this imposes a significant cost and obstacle so that there would a much smaller market of availability and also a clear signal for companies wanting to do business with these brokers that they risk their own legitimate business by engaging with them.
opt-in, like the GDPR does is an even better approach, imo.
No. A single opt-out run by the state, similar to the do not call list, but (at least claimed) with real enforcement by an agency dedicated to the enforcement of privacy laws constructed and funded via proposition.