Thread · 3 tweets · 25 Nov 2020

I’m suggesting that the GDPR should be enforced! Specifically, on two points. 1: a strong standard of consent for controller to controller data exchange. It should be rare, nearly impossible, to have a third-party data controller. G (and others) can collect, but for the 1P only.

2: by enforcing purpose limitation. G (and others) can still collect on their own property, but cannot use across products in their offering. Eg. Android’s constant location monitoring can’t be used for ads. Gmail data can’t be used to recommend flights in Search, etc.

This is actually nothing outrageous — it’s pretty much how it’s supposed to work!