Thread · 3 tweets · 14 May 2022

That is true, but enforcement strategy is part of regulatory design. You can't build law as a Platonic ideal and hope that when it comes into effect everyone will magically align to the intended outcomes. It interacts with reality.

The idea of consent is that you rely on the party that has an interest in doing it badly to do it well, knowing that it's a complex, nuanced HCI topic that people often fail at even when they're trying to do helpfully!

People tried asking the user for security purposes, a space in which the risks are vivid and relatively easy to explain to people. It failed spectacularly. Why would it work, even with good intent (that isn't there), for privacy which is harder to explain?