There is a tentative bipartisan deal for a US internet data protection law.

It is encouraging that the proposed deal requires companies to minimize the data they collect, but I expect that "reasonably necessary" will be a weak criterion, as it is in Europe. Will this prohibit parking lots from collecting the license plate number of each car parked there — or photographing them all and storing the photos? If not, it is inadequate.

I fear that companies will continue demanding that customers identify themselves. In the absence of an anonymous payment system, they can argue that this is "necessary". But that means that the system is not safe — not for whistleblowers, and not for people traveling for an abortion.

If that is what happens, I will continue to reject these dis-services absolutely, as I have done for many years.

Meanwhile, no company whatsoever should be allowed to require a customer to use arbitration rather than the courts. All customers, regardless of age, must be free to join class-action lawsuits against abusive practices that arguably violate whatever privacy laws apply.

Despite those grave flaws, this bill would be a significant step forward. However, since this will pre-empt many kinds state laws, it will block all further progress on privacy rules in the US. Given that, I conclude we should oppose it.