Silicon Valley

The U.S. is at the forefront of turning consumer data into revenue. When it comes to privacy laws and punishment for breaches, it’s bringing up the rear

Austin Carr

Opponents of government regulation have a few standard refrains. For years, one of the most common has been that public officials shouldn’t pick winners and losers, meaning they shouldn’t use state power to reward favored companies or industries and punish others. In good faith, the line articulates a reasonable concern about facilitating corruption and choking off competition. It tends, however, to be deployed by complainants who were perfectly comfortable being among the winners until they suddenly drew greater scrutiny. Frequent foes of winner- and loserpicking include oil and gas companies, health insurers, megabanks, and now Silicon Valley’s biggest internet companies, which are starting to face consequences for frequent breaches of their eyebrow-raisingly massive data hoards.

After two years under a much harsher spotlight than they were used to, the internet companies acknowledge that some sort of new oversight is due. But, they say, let’s not get carried away here and change the ways the Valley does business. The government must avoid “picking winners or losers,” says Michael Beckerman, chief executive officer of the Internet Association, a Washington lobbying group representing Facebook, Google, Twitter, and most other major tech platforms. It’s wrong, he says, for lawmakers to punish his clients for mining data for profit, because pretty much every consumer-facing company now makes money from data in one way or another. “If you compare Facebook or Twitter to a car rental agency or your grocery store, or a data broker or a credit-reporting agency, our companies are a lot more transparent,” he says.

Unlike Facebook and Twitter, of course, Hertz and Kroger don’t know everything about you, nor have they proven so hackable. Since September alone, hackers broke into 30 million profiles on Facebook, its largest breach ever, harvesting email addresses, phone numbers, and search histories. Twitter Inc. disclosed that a platform bug may have allowed third-party developers access to the private messages of several million users. And Google parent Alphabet Inc., it was discovered, had attempted to cover up a data leak on its Google+ social network that affected about a half-million accounts. For people affected by such incidents, there’s little to no recourse and few answers about what’s to stop similar breaches of personal data in the future.