TL;DR; – they prevent companies from denying services to people that use technology to block tracking and ads.
Maryland recently adopted the Maryland Online Data Privacy Act of 2024, available here: https://mgaleg.maryland.gov/2024RS/bills/sb/sb0541e.pdf It goes into effect in October of 2025. Does it increase Maryland consumer privacy rights? – yes (sort of). But it follows many other laws that really just do not address the key issue, and it perpetuates the privacy law and compliance cat-and-mouse game. That “game” is obtaining consent. To understand the cat-mouse, read the Sephora decision. Sure, there are other provisions like data minimization – but making a claim solely based on that would be hard. Claims are almost always based on failure to obtain consent. So, as long as a provider can comply with the consent rules, they are 90% of the way to the clear.
The advertising business, which has been around for centuries but really took off with the advent of radio and TV, thrived for 50+ years without tracking or massively collecting personal information on consumers. The Internet just acted as a giant enabling device – and all these privacy laws have really done virtually nothing to slow it down because of one word: consent. The new Maryland law does not really change this concept. To elaborate:
There are basically two types of services on the Internet – those that cost money (so called “paywalled services”), and so called “free” services – which are primarily the user-to-user social media sites. I say “so called” because they are not truly free – you are the product – these sites even expressly tell you – your personal data is productized. There are also some hybrid types – the best example are the hardware manufacturers like Roku and Smart TV makers, that you pay one time for the product, but the product then comes laden with data gathering, Personal Information collecting and selling software.
So what is the key legal change we need to really make privacy a right? Forcing any data collector to respect a consumer’s technological choice to block tracking and advertising. Period.
As it stands now, US privacy-consent law is mostly opt out, and when its opt in, the providers force you to agree – so it’s a Hobson’s choice – don’t use my service, or agree to use of your Personal Information.
In a truly free market competitive system this would work – because you could make a choice based on the service, and how much you valued your privacy (and if the laws and user interfaces were better, a knowing understanding of how they would use your Personal Information). However, our actual system is dominated by essentially only a few providers – Meta, X, Reddit, Google YouTube, TikTok and maybe one or two others. None of those providers give you a choice to not allow them to use and sell your Personal Information – because their service simply does not work if you do not consent. All this does is result in horrid user interfaces – pop up consents and re-confirmations with gibberish, unintelligible explanations of how they use your Personal Information. Try using a browser that technologically blocks those uses – many services just do not work at all.
While those observations are bad enough, the same happens on paid services – banks, hospitals, insurance companies, streaming providers (easily the worst) – services we pay for – many will not work at all if you block third party tracking on a browser.
So, is the new Maryland privacy law good? Apart from the fact it should have been enacted 10 years or more ago, I guess its a start, but its just the same can getting kicked down the road – its just a little harder to kick – but all of the service providers that rely on selling your Personal Information already have this figured out. The Genie is way too far out of the bottle to meaningfully fix our privacy systems in the US. Instead users have to suffer through horrible user interfaces and user experiences for sake of us “consenting” to who-knows-what they do with our Personal Information, just to connect to their friends and family on social media.
Effective advertising does not need all the personal data – in fact, artificial intelligence can now probably do a better job of just guessing your preferences based on whatever you are searching for, viewing or browsing on, without knowing one actual personal detail about you . . .
