Data Rights and Regulation

Data sovereignty is not only a personal practice — it is also a political and legal project. The rights you can exercise over your data are not natural facts; they are legal constructions, shaped by lobbying, legislative battles, court decisions, and regulatory choices. Understanding the current landscape of data rights means understanding what rights exist, who has them, where enforcement is effective, and where the current legal framework fails to match the scale of the problem. It also means understanding what meaningful reform would look like — because the current rules are not the ceiling of what is possible.

The GDPR: The World's Most Influential Privacy Law

The General Data Protection Regulation, which took effect in the European Union in May 2018, is the most comprehensive privacy law currently in force anywhere in the world. Its influence extends beyond Europe: because global companies cannot easily maintain separate data practices for European and non-European users, GDPR has de facto raised privacy standards worldwide and become the reference point for privacy legislation in dozens of countries. GDPR establishes six lawful bases for processing personal data. The most significant for consumer applications are consent (the data subject has freely given, specific, informed consent), legitimate interest (the controller has a genuine interest that is not overridden by the individual's rights), and contract necessity (processing is necessary to fulfill a contract with the data subject). Consent under GDPR must be granular, revocable, and as easy to withdraw as to give — which rules out many common dark patterns like pre-checked consent boxes. GDPR grants individuals eight specific rights: The right to be informed — to know what data is collected and how it is used, in plain language. The right of access — to obtain a copy of all personal data a controller holds about you. The right to rectification — to correct inaccurate data. The right to erasure (the 'right to be forgotten') — to request deletion of personal data in specified circumstances. The right to restrict processing — to limit how data is used while a dispute is resolved. The right to data portability — to receive your data in a machine-readable format and transfer it to another service. The right to object — to opt out of processing based on legitimate interest, especially for direct marketing. Rights related to automated decision-making — to obtain human review of consequential automated decisions and to not be subject to solely automated decisions that significantly affect you. Enforcement is by national Data Protection Authorities (DPAs). Fines can reach 4% of global annual turnover or 20 million euros, whichever is larger — a significant deterrent for large companies. The EU has issued multi-billion-euro fines against Google, Meta, and Amazon under the GDPR.

US Privacy Law: Sectoral, Fragmented, and Weaker

The United States has no comprehensive federal privacy law equivalent to the GDPR. Instead, US privacy protection is a patchwork of sector-specific laws and state-level legislation. Federal sectoral laws include: HIPAA, which protects health information held by covered healthcare entities (but not health apps or wearables); FERPA, which protects student education records; COPPA, which restricts data collection on children under 13; and FCRA, which governs credit reporting data. Each law covers a specific domain; vast swaths of personal data fall through the gaps between them. The most significant state law is the California Consumer Privacy Act (CCPA), strengthened by the California Privacy Rights Act (CPRA). CCPA gives California residents rights to know what data businesses collect, to opt out of its sale, to request deletion, and to be free from discrimination for exercising these rights. Because California's economy is the size of a major country's, CCPA has had significant national effects — many companies extend CCPA rights to all US users rather than maintain California-specific processes. A growing number of states have passed their own comprehensive privacy laws: Virginia, Colorado, Connecticut, Texas, Florida, and others. These laws vary in scope, enforcement mechanisms, and the specific rights they confer. The fragmentation creates compliance complexity for companies and uncertainty for individuals about what rights they have. The absence of a federal private right of action — the ability of individual citizens to sue companies for privacy violations without waiting for a regulator — is a significant gap. Most US privacy enforcement is regulatory, slow, and under-resourced.

Where the Current Framework Falls Short

Even the GDPR, the strongest current framework, has significant gaps and enforcement limitations. Consent theater. The GDPR requires freely given consent, but the consent experience most users encounter is a cookie banner designed by the company's legal team to nudge acceptance. Research consistently shows that banner design — placement of decline buttons, use of color to highlight accept, default-checked boxes, required clicking through multiple screens to opt out — dramatically affects consent rates. Formally legal consent obtained through psychological design is not meaningfully free. The notice-and-choice model's failure. The dominant legal framework assumes that if companies disclose their practices and users choose to accept, the exchange is voluntary and fair. But privacy policies are unreadable — research has estimated that reading every privacy policy a person encounters in a year would take 76 full work days — and users have no meaningful ability to negotiate terms. The conditions for genuine informed consent are not present in most data collection contexts. Enforcement resources. DPAs are dramatically underfunded relative to the companies they regulate. A small national DPA overseeing a trillion-dollar company with hundreds of privacy lawyers has limited capacity to investigate complex data practices. Borderless data flows. Data crosses jurisdictions instantly. A company incorporated in one country can process data from another in servers in a third. Jurisdictional mismatches create enforcement gaps that well-resourced companies exploit through legal entity structuring. What meaningful reform would add: a private right of action enabling individuals to sue without waiting for regulators; data minimization as a legal default rather than a voluntary practice; prohibition of certain uses of data (inferred sensitive attributes used in consequential decisions) rather than merely disclosure requirements; algorithmic impact assessments before high-stakes systems are deployed; and adequately funded enforcement at national and international levels.