By Tim Sparapani

A big part of the appeal of the World Wide Web has always been the first two words — “world” and “wide.” The internet represents an almost utopian ideal of a place where people around the globe can come together to share new ideas, create new products and even argue.

But as a privacy advocate, I fear we are rapidly hurtling toward the worst of all future states for the internet: one in which your present location dictates how much online privacy or free speech you enjoy. The current trend of carving up the country, and the globe, into an inconsistent patchwork of privacy and online speech laws benefits few and leaves too many exposed.

I’m a frequent traveler to California, and Assemblymember Ed Chau’s bill to mandate baseline privacy protections for consumers’ data got me thinking about the sorry state of privacy rights and the mistaken direction we are headed. If you are lucky enough to live in a state like California that favors privacy rights, you know that the region also favors policies that support innovation and places few limits on speech online.

But, since most of the world doesn’t live in such a digital utopia as California, many are likely to live, work and spend most of their time in a place that provides, at best, only moderate protections, while limiting what people can see, read or say online.

In the U.S., my fellow privacy advocates are seeking local regulations in reaction to failures at the federal level to enact wise data privacy and online speech policies. But Asm. Chau’s well-intentioned pro-privacy proposal is, unfortunately, only a bandage. It saps energy for the enactment of strong, nationwide policies to protect the privacy of consumers’ data — something we should all favor.

If the bill is enacted, when I visit California the ISPs I’ll encounter will protect my data more rigidly than those I use when I visit family in Wisconsin or am at my home in Washington, D.C. That leaves me less protected everywhere else and gives Californians an inflated sense of security while potentially leaving them exposed when they leave the state. That makes little sense. While I applaud California’s tradition of progressive privacy leadership, I deplore the fact that we don’t have basic privacy nationwide. For example, last year New Mexico became the 48th state to enact basic consumer protections for data breaches that leak consumers’ private data. But what about the residents of Alabama and South Dakota, or all of us when we visit those states for business or pleasure?

The danger of well-intentioned efforts that impose policy restrictions on the structure and content of the internet is real. While these proposals are laudable, personal privacy rights shouldn’t change from state to state. When Californians move around the country for work, to visit family or for vacation, they shouldn’t limit their travel based on states where they can privately and safely transmit medical or financial information, for example.

The same principle should hold true for Californians’ ability to access content or speak online as they travel the world. Restrictions in places like Turkey, Saudi Arabia, China and even across the European Union mangle the internet and make a mockery of the phrase “World Wide Web.”

Don’t mistake my message — I’m not saying we should get rid of all regulations. Instead, wise policies for the internet age — the kind that made California a beacon of innovation — should favor national and global norms that protect data while encouraging free speech. Consumers shouldn’t be left to fend for themselves under the lowest common denominator of protections. Instead, meaningful privacy protections need to be baked into national law.

If anything, the legislation should include more rigorous, broader privacy protections. The legislation should apply to offline businesses as well, instead of singling out ISPs, as retailers routinely obtain similarly sensitive information. The legislation should mandate that an ISP continue protections for Californian customers no matter where they travel to when using the same ISP, so that privacy protections would follow Californians across state lines at least some of the time. It should explicitly prohibit ISPs from obtaining roughly equivalent information about their customers by buying it from other companies that have it.

Most importantly, we need to give the Federal Trade Commission and the Office of the Attorney General of California the resources they need to protect consumer privacy both off- and online. We need robust enforcement of existing privacy laws coupled with a push for strong, nationwide protections.

The real danger in the internet age is states and countries erecting barriers that turn the web into a series of fiefdoms with different rules.

California can lead by example by promoting regulations that are robust and nationwide or global. But by enacting well-intentioned limitations on privacy, it gives encouragement to other well-intentioned rules. It prevents U.S. companies from arguing that rules on the web should be universal. After all, the rules in China to limit Chinese people’s access to the internet in the name of promoting security are also well-intentioned. The same is true for calls from French and Belgian national security agencies to force back doors in encrypted software and to limit speech in the name of potentially preventing radicalization. These types of regulations are always justifiable, but they turn the World Wide Web into a broken map full of unknown consequences.

That’s a destination that none of us wants to visit.

Tim Sparapani is Senior Policy Fellow at CALinnovates, a non-partisan technology advocacy coalition of tech companies, founders, funders and nonprofits.

By Mike Montgomery

Sometimes a good idea can come with unintended consequences. Take. for example, Assembly Bill 375, which is working its way through the California Legislature in the last few weeks of the session.

The bill, introduced by Assemblymember Ed Chau, D-Monterey Park, is well intentioned. It aims to limit how internet service providers (also known as ISPs) can use people’s personal data. Consumers would have to give opt-in consent before the ISPs could anonymize their data and then use it to learn about trends in the marketplace or TV viewing patterns.

But here’s the problem. If the Chau bill passes, it sets different standards in California than it does in other states. And implementing a different set of rules for Californians won’t create better online privacy for consumers. If anything, it will give residents in California a false sense of security.

The rules the state Legislature is proposing only apply to ISPs. This piecemeal approach means a website or app that you use frequently or only once can still collect, share and sell your data. Those ads you see after searching for a pair of shoes or a vacation destination online? Well that information is still being tracked by sites and vendors that would not be impacted by this bill.

A patchwork of regulations creates confusion for consumers, 94 percent of whom say they want their online data subject to a consistent set of privacy rules that apply to all reaches of the internet, according to data submitted to the Federal Communications Commission (FCC).

Inconsistent rules create confusion for consumers as well as entrepreneurs building internet companies in California and elsewhere. The startup community, which provides immense value to our state, would prefer to focus on consistent regulations when building and growing their platforms, not whether or not they are abiding by regulations that change from state to state.

That’s why CALinnovates continues to call for a single, federal policy to protect internet privacy across the country with one set of rules for innovators to follow and consumers to understand.

There is some good news, though. Not only does the Federal Trade Commission (FTC) still have oversight of privacy rules, but Californians are already protected by our “Little FTC Act,” which allows California’s attorney general to enforce federal privacy regulations. Additionally, there are numerous federal laws protecting sensitive consumer information around things like children’s data as well as financial and health-care information.

By enacting this legislation, California also risks its position as a progressive policy leader by setting restrictions on internet companies that don’t exist in other states. The law sends a message that our state is more interested in passing laws opposing the current presidential administration than in passing laws that protect consumers and create conditions for an ongoing virtuous cycle of investment, competition and job creation.

Privacy is essential. That’s why it needs to be tackled in a comprehensive manner by Congress. We need consistent regulations around privacy that apply to everyone, and across the entire internet ecosystem, no matter what state they live in or what their business model says about data collection and use.

Mike Montgomery is executive director of CALinnovates, a non-partisan technology advocacy coalition of tech companies, founders, funders and nonprofits.

This piece was originally published in LA Daily News.

By Tim Sparapani

By Tim Sparapani

The dispute between Samsung and Apple over allegations that Samsung stole Apple’s mobile phone design is like a piece of gum that you’ve been chewing for way too long. It’s time to spit it out.

There’s an enormous amount at stake for innovators in this fight over mobile phone sales, and as I’ve written many times before, this case truly matters. How, or if, damages are ever calculated for Samsung’s infringement of Apple’s rounded-corner phone design will set precedent that will influence Silicon Valley for years to come.

There’s also a real risk that if the outcome establishes the wrong formulation for calculating patent design damages, it will create a new type of design patent troll —essentially law firms that will sue companies to attempt to extort settlements from them based on allegations that they have infringing product designs.

As a reminder, here’s how we got to the point where a federal court has been told to determine anew potential damages for alleged design patent infringement. Last year, the U.S. Supreme Court decisively reset the rules of design patent cases to prevent them from spinning out of control. The court rejected Apple’s position that it was entitled to the full cost of each iPhone that wasn’t purchased because a consumer had instead opted for the infringing Samsung phone.

If the court had ruled in favor of Apple’s position, Samsung would potentially have been on the hook for an estimated $1 billion. But the court decided (to Silicon Valley’s delight) that this “total profits” damages theory was erroneous because software-powered hardware is routinely filled with hundreds if not thousands of other patented inventions that give those products their value.

While the Supreme Court wisely struck down this total profits standard, it left the job half done by tossing the case back to a lower federal court to determine the appropriate damages. That’s why the upcoming decision from the Federal District Court for the Northern District of California will establish precedent around what portion of a product is attributable to its design as opposed to its functionality.

Drawing that line is easy with something like a shovel, which is a relatively simple tool. It’s much harder to do with a complicated piece of technology like a drone, an autonomous vehicle or a smartphone. The court will need to craft a smart rule that divvies up the pie so future judges and juries can determine damages when these cases invariably come up again.

Full disclosure here: As I’ve written before, I’m an unequivocal Apple fan boy. Since the U.S. Supreme Court’s ruling, my family has bought two more iPhones, and I’m writing this piece on my new Mac. I love the design, durability and functionality of Apple’s products. Simply put, though, the risk to innovators is too high if Apple is allowed to recoup the lion’s share of its alleged losses because a lower court elevates the concept of design over product functionality.

The court’s determination will go beyond the question of how much Samsung has to pay Apple. It will lay the groundwork for rules about how we properly compensate the designers who produce iconic, paradigm-shifting product designs, particularly when those designs are only a portion of the usefulness of the product they are part of. The decision will tell us a lot about where the value lies in any new piece of technology. That’s going to be an important factor in ensuring all innovators in Silicon Valley, including coders and designers, prosper.

The longer this case drags on, the more these questions go unanswered and the more difficult it is for people who might be working on ground-breaking products to move forward.

This piece was originally published in Forbes.

By Tim Sparapani

There are a few things that are constant in this world: death, taxes, and the fact that every new administration rethinks regulations.

That can be a big problem, especially when it comes to consumer privacy rights. The rules that govern how companies collect, use and share consumers’ data shouldn’t ebb and flow like the tides. They should be cemented in place to give companies and consumers desperately needed assurance that the landscape won’t keep changing.

For years, privacy advocates like me have pushed for protections on consumer data collected on and offline. We urged that the U.S. Federal Trade Commission (FTC) be given additional resources to focus specifically on the misuse of consumer data collected offline and merged with online data.

Unfortunately, the FTC’s wings were clipped when another federal agency, the Federal Communications Commission, expanded its previously narrow privacy authority. While that might sound like something privacy advocates would applaud, it’s a move that’s only muddied the waters and, arguably, reduced protections for consumers’ online privacy.

The U.S. Federal Communications Commission’s (FCC) self-approved expansion of authority actually displaced the FTC entirely. FTC staff had consistently policed online privacy with an impressive level of authority and competency.

That not only left consumers’ privacy in limbo, it pushed innovators and startups into a chaotic, unpredictable regulatory landscape for all online products and services that make use of consumer data.

The confusion that resulted from this was compounded by the election. Before the FCC could even hire privacy experts or prepare policy pronouncements, a new commission was ready to walk through the door. That’s why it is long past time for Congress to impose some order on the privacy landscape. One easy thing Congress can do is return the FTC to its place as the top privacy cop on the internet beat.

Keep Reading

This piece was originally published in The Hill