A California ballot initiative aims to limit targeting of advertising based on "sensitive" personal information.

I think it will do some good — but there are ways to game the new requirement about personal data. Users could tell companies not to use the sensitive data, if they find which companies to give this instruction to. But companies can use observed behavior as approximate proxies for the personal data. Facebook and others can tell with high probability whether someone is gay, or what per religion is, by what perse visits and searches for. However, those proxy data are not, in fact, part of the sensitive personal data.

In addition, this requirement is vulnerable to the manufacture of consent(*): "to use our service, which everyone believes one cannot live without, you must consent to our using your sensitive personal data for advertising."

What we really need is anonymity in searching and paying on the internet.

Senator Sherrod Brown has proposed a strong internet privacy law that would make some real difference. His proposed law would limit the collection of data. He has grasped the issue of the manufacturing of consent.

Whether it would fully address the problem depends on details that I have not seen. It would prohibit selling personal data; would it prohibit selling the service of selecting people based on their personal data, which is what Facebook actually does? The California ballot initiative does that.

He talks of allowing collection of data that is "necessary" for the service that is offered, but that rule has strong interpretations and weak interpretations.

Nonetheless, Senator Brown has advanced the discussion considerably. He rejects the supposed imperative to keep nasty businesses going.

* It amuses me no end to repurpose this term, which Chomsky coined for one nasty practice, to describe another nasty practice.