Silicon Valley is terrified of California’s privacy law

> The physical establishment rule was the only sound approach.

The only reason that rule exists is because enforcement was much more difficult when your target doesn't have a physical establishment within your own borders. If you can enforce it for foreign entities (via some kind of side leverage, like a trade treaty, threat of sanctions, etc.), then, at face value, you should: why should the law behave differently based on physical presence? You yourself point out that things are different in the Internet age; that includes the acknowledgement that commerce can now trivially cross borders without having to have satellite offices everywhere.

I mean, that's exactly what's going on. You can choose to follow State Y's laws when serving customers in State Y, or you can choose to not serve customers in State Y. But if you choose to not follow State Y's laws while serving customers in State Y, then State Y can use whatever leverage they can get their hands on to keep you out of State Y. That's State Y flexing their own sovereignty when it comes to protecting their citizens, which is the flipside of your argument about your state protecting you.

If I have interesting ideas, I could write a book and sell it in every country of the world. Then this product would be taxed and would need to respect the publication-related laws of that country. On the other hand, if someone reads my book and then travels across the country to hold free seminaries to teach my ideas to the masses, it is not reasonable to try to tax this value transfer, but this is exactly what governments have decided to do.

You see: values vs principles. We can have values but we need to articulate sound principles to give life to these values. What you describe are values.

And what I contend is that we already had sound principles, principles developed across decades and even centuries. The physican establishment rule is the only sound and workable principle.

What we have now is a mess encouraging anti-democratic dynamics (centralization, fingerprinting, and ironically data collection since you need to know more about consumers to know how to apply the laws), in addition preventing innovation and making business difficult.

All of this while for every non-taxed value under traditional principles, a taxable value is actually created... but for some reason nobody is interested in investigating this correlation... for example, the person holding seminaries pays a tax on the room he rents for the seminary. But government prefer to go hard on their propaganda.

If a country wants to tax the books royalty, it should focus on upping its game to attract intellectuals instead of hacking together unsustainable notions to tax "learning".

Similar things could be said for advertising company. When an advertiser advertises in a country, it is by definition to sell a product that most of the time will be taxed into the country (and even if it doesn't, this value transfer will at the 2nd or 3rd degree lead to an activity that can be taxed).

This is why principles based on physical presence and not abstract fictions are not only sufficient and sound but they are also fair. The same is true for privacy, which are after all transactions of their own kind. If you want to regulate data, make sure people use services based in your country by creating the proper environment instead of hacking together extraterritorial laws based on wacky principles.

Just compare these new frameworks, with the readability of the physical establishment principles, that been able to accomodate even the most complex business models for centuries.

Principles should be a foundation, not something you throw out of the window as soon as you start losing to avoid confronting your difficult challenges at the cost of creating an international mess. Digital is not complex, and does not require complex regulations. Trying not to adapt to the world and not to confront your true problems is the only that is complex.

The problem with the physical establishment rule is that it leaves the end user with no leverage to actually protect themselves or their data.

The EU and California taking a stance that you must obey their data handling rules in order to do business there is a direct result of the lack of a robust system between states and nations to give users the ability to control their own data when the company's physical establishment is in a different legal system. This approach is the most immediately practical one: I vote for the politician who is willing to enact laws that actually have teeth to regulate the use of my data.

The industry has certainly shown a lack of desire to put teeth into any sort of self-regulation. I worked in ad tech - that industry standard body (the IAB) pretended to care at best, and actively lobbied to erode privacy rights most of the time. Real privacy enforcement mechanisms that actually respected users only started to show up once the GDPR boogeyman showed up.

At the time when we were generally happy with the physical establishment rule, the set of problems we were dealing with was very different. We were more worried about individual freedom in terms of access to services and communications, not individual freedom in terms of safety from bad actors.