After years of inaction, Congress is finally coming to see that privacy on the Internet won't take care of itself. The mystery isn't that self-regulation failed; the mystery is why anyone thought it would succeed.
Data is money. It is a resource that the present architecture of the Net gives away for free. And just as the industrialists of the 19th century were not about to give up free air and water without legislative intervention (read: pollution laws), so too will Net commerce not relinquish free data in the name of something as obscure as privacy.
As a result, the pile of privacy bills on the floor of the 106th Congress is growing. In theory, that's a good thing. In reality, it is not. While the motivation behind this legislation is perfectly sound - that consumers should choose how their data is to be used - the actual technique imagined in these bills is just awful.
Clutter, not choice - that's the nature of Congress' current thinking. The bills would require that Web sites say more, and based on what they say, give consumers the right to choose. More words, more Web pages, more links to "privacy policies." The idea is to spew forth, imagining that intelligent choice will follow.
But more words are the last thing that privacy on the Net needs. For reading, even if fundamental, is fundamentally inefficient. It costs too much. No one has the time, or the patience, for the multithousand-word privacy policies posted on sites. And thus, if the choice is to read or waive, the rational thing for most to do is simply to waive.
The solution is to enable choice without words - to rely not on computers talking to humans, but on machines talking to machines. Rather than read a privacy policy each time I enter a new site, I should be able to tell my browser what my privacy preferences are, and then let it negotiate with the site. If the server didn't like my preferences, then the machines could work it out. And I, like a congressman or a rock star, could live in blissful ignorance as my agents waged war on my behalf. Privacy would be protected, in the sense that my choices would be respected, without the clutter of privacy posts everywhere I turned.
The beginning of a solution like this already exists: the World Wide Web Consortium's P3P privacy standard. While P3P has its problems, and has been hampered by yet another insane patent dispute, it has gotten an important push from Microsoft (MSFT), which has promised to incorporate P3P into Internet Explorer.
Good for Microsoft, for this would be good, if imperfect, code. It would facilitate a regime in which individuals could - and more importantly, would - negotiate which data to give up. It would allow people to think differently about what kinds of information they want to protect. And it would facilitate this negotiation in an efficient and effective manner - relegating to machines this tediously boring task and leaving users to do whatever they want on the Web (which, Congress might be surprised to learn, is not to read privacy policies).
But P3P - West Coast code - could be undermined by short-sighted East Coast code - laws that create incentives to adopt the old system of machine-to-human communication. For if sites knew that people would waive their privacy if it were protected only through words, but might actually protect their privacy if the computer were their agent, then the incentive would be for sites to adopt the less effective means. And if Congress granted safe harbor to this less effective means, then the improvements in P3P, or some other protocol for machine-to-machine negotiation, would have little effect on privacy on the Net.
Once the East Coast coders speak, the demand for this West Coast code disappears. Who needs a more sophisticated and subtle technology for giving consumers control over privacy when Congress has ratified a solution that is cheap, yet will do nothing to actually empower consumers?
The solution is not to do nothing. The solution is for Congress to legislate more strategically. Congress should recognize who owns this data: consumers. It should require that this data be taken only with consumer consent. And it should give safe harbor only to code that secures consent in an effective and efficient way. It should not give safe harbor to words.
The idea even has a slogan (slogans help in D.C.): Less clutter, more code.
Lawrence Lessig is Berkman Professor of Law at Harvard Law School.
