C2 Chris Bell
Chris Bell
2026-07-08 · 11 min ·
cite 
@misc{bell2026current,
  author       = {Bell, Chris},
  title        = {{Current Legal Rationale can't Scale against Privacy}},
  year         = {2026},
  howpublished = {\url{https://cbell.dev/writing/current-legal-rationale-cant-scale-against-privacy/}},
  url          = {https://cbell.dev/writing/current-legal-rationale-cant-scale-against-privacy/},
  note         = {ORCID: 0009-0006-3476-8618}
}
ORCID 0009-0006-3476-8618
· thoughts working-draft

Current Legal Rationale can't Scale against Privacy

We behave differently when we feel observed. We self-censor in private if we feel that we may be watched, and the direction of this self-censor is always with respect to what our beliefs about the potential observer are. For example, if the theoretic observer is the government, our self-censor would skew in the government's favor. If the theoretic observer was our employer, then we might not complain about a company policy pushed forward by someone who refuses the advice of othersThe strategists who can’t appraise LLM use2026-07-01 · thoughtsIn my commentary, ‘strategist’ refers to the people who make widespread and direction-driving decisions on beh…← 1 link here. Behavior modification is the effect of feeling observed, regardless of the observer. If it was our spouse, we might try to act in a way that is only pleasing to them11Depending on your marriage, of coursewhile neglecting our own needs. The depth of the observation is important, as your unobserved self has its existence bounded strictly by your ability to maintain your privacy.1Depending on your marriage, of course

For a moment, consider what the information landscape of the world looked like 40 years ago. By information landscape, I don't mean IT infrastructure, I mean quite literally the information that was possible to gain at that point in time. If I wanted to know about a person's habits and daily routine, the resource to information cost was so high that, short of stalking or hiring someone to do so, I'd have no way of doing so. In addition, I can't ask about the history if it was never gathered in the first place, so I can only ever observe prospective data. Even for a government, the amount of information you could've gained on a person was limited by the fog of the past and, if I wanted to know about multiple people, the high marginal cost floor per person.

The Government & You

The government is fundamentally made up of other people, and a person's willingness to be observed by another shouldn't be exceeded without good reason.

The government has an interest in controlling what its citizenry believes ought to be. In doing so, those in the government would be able to solidify their position and segment themselves from the people they govern. The easiest way to control a populace's ethic is to prevent certain ideas from developing and spreading, and the threat of being observed creates the self-censorship mechanism to prevent most of the populace from engaging with it. The idea that the government in power would dislike those beliefs is stifling enough for many people. The fourth amendment frees its citizenry from the self-censorship that would otherwise prevent them from forming their thoughts about what ought to be true.

This information cost regime had persisted since the constitution was drafted;22And, for all of history up until recently the right to privacy was thought up at a time when getting private information about a person was a physically invasive and expensive procedure. The government has a tradeoff between intensive surveillance and cost. Because the methods of surveillance were much more apparent than they are now, the individual could learn about the observation and be able to challenge it.2And, for all of history up until recently

Our legal system and its laws still assume the information cost hasn't changed. In one way, this belief is codified in definitions of conduct, like stalking: a discrete endeavor which has a 1 to 1 relationship between stalker and target. In another way, this belief is implicit in adjudication. What does it mean for a person in public to have no reasonable expectation of privacy? If a person enters a store, this person is aware that everyone around them and everyone who they come in contact with along the way are aware of their travel and actions during this period. I don't believe that person ever assumes that this knowledge has been recorded and can be known in perpetuity by someone who was never present at the event.

While each individual instance of record keeping may have few implications on its own, a dossier emerges in their aggregate. If a single individual had decided to generate this dossier on someone, we'd consider this person to be actively surveilling an individual and that their target's privacy was being invaded. So, at some point, we slide into gathering enough information about a person to have seriously invaded their privacy.

But jurisprudence has often taken the all or nothing approach: if you have no reasonable expectation of privacy in public, then the law suggests that you effectively are consenting to explicit broadcasting of your information to anyone about everything that happens while you don't have that expectation.

The government's willingness to reduce the scope of what we'd consider private was codified in two Supreme Court decisions: the first being United States v. Miller (1976), where the court claimed that bank records are not subject to the 4th amendment protections; the second being Smith v. Maryland (1979), where the court ruled that the use of a pen register33Which is simply a tool that records all numbers dialed from a telephone line. This is what we could call 'metadata' in modern communications. is not a search because the phone company would have had access to the information. Together, these rulings constitute the Third Party Doctrine, which is essentially the idea that we as citizens have no expectation of privacy on information we hand over to a third party. This opens up the door to the government being able to get the information from a company without a warrant.3Which is simply a tool that records all numbers dialed from a telephone line. This is what we could call 'metadata' in modern communications.

The courts have only begun to realize the impacts of the surveillance age as recently as 2012 with United States v. Jones. The case introduced the "Mosaic Theory" of the fourth amendment as a legal framework to help examine and describe the situation where a group of actions taken by the government which individually would be fine, but together would constitute a search.44This is similar to the 'emergent dossier' I've begun to describe, in which an invasive description of a person can arise from the aggregate of seemingly innocuous observations.4This is similar to the 'emergent dossier' I've begun to describe, in which an invasive description of a person can arise from the aggregate of seemingly innocuous observations.

The result of this abuse of the fourth amendment is the continued chilling of our willingness to exercise the first.

Companies & You

In the non-government context, I believe most consumers assume that some arbitrary amount of data is being collected by companies.55A tragic learned helplessness of the masses However, I believe that the extent to which companies collect data, and just what can emerge from aggregated data, is not well understood at the time a person is requesting some service engaged in data collection. The lawyers at companies that surveil their customers66Which is so many companies at this point that it has become tragic. have seen this tension, which is why they add liability disclaimers to their terms and conditions for their broadcasting of this data. These T&Cs are long, difficult to decipher, non-negotiable contracts where the parties involved do not have a meeting of minds and consent is limited to a button press.77Which is another thought for me to write a lot more about... these contracts are silly and just how they have been binding still baffles me.5A tragic learned helplessness of the masses6Which is so many companies at this point that it has become tragic.7Which is another thought for me to write a lot more about... these contracts are silly and just how they have been binding still baffles me.

In addition, the very nature of how a person would learn about a problem protects these companies, as a person only becomes aware of the emergent dossier once their data is public. This is usually after a data leak or a news report indicating that the company shared information it held with a third party. Thus, there is no recourse which could restore their privacy, and the liability waiver they "agreed to" leaves them violated and unable to hold those gathering the information to account.

To further counter this pushback, the current public relations narrative is for a surveillance agent to point out that they are, in fact, collecting information.88And then make a long list of the things they collect The unspoken part is that the emergent dossier is still not something explicitly 'gathered' per se, as there is no point in this information gathering procedure that would constitute the dossier's generation. Even still, if the data is shared and combined with other sources, none of the individual parties would have had enough to generate the aggregated result that the combining party would have.8And then make a long list of the things they collect

Distributing both the liability and the generation of the product across multiple entities defeats legal frameworks designed to restrict single actor behavior. Thus, no company in the chain could be treated individually at fault.

As a fun example, think of:

  • the information Google may have about your travel,
  • the purchases information Amazon and Walmart have that is tied to your payment cards,
  • the list of people you know with respect to Facebook and LinkedIn, and
  • the list of sites you've visited using your ISP.

Now, imagine an entity purchasing access to these datasets. That entity has such a rich description of your past that would have constituted an extreme invasion of your privacy just two decades ago. The laws we have don't scale and no single entity could be held at fault for generating the resulting dataset.

One might then say, "Ok, but you've elected99As if competitors exist for these which don't surveil you and as if these services are simply recreational and elective in nature. Sure. to use these services." To that end, consider a different scenario:9As if competitors exist for these which don't surveil you and as if these services are simply recreational and elective in nature. Sure.

  • You rent an apartment, and the apartment uses third1010PetScreening is a company which charges the tenant for checking a pet's paperwork and letting the landlord know it checks out. As a result, there is now a company who has, quite literally, amassed a database of email addresses and common security question answers (what is your pet's name?) into a single place. Outside of the annoyance data wise, this is a cybersecurity risk that renters at some apartments must accept. party1111PolicyValidator is a service which checks renter's insurance policies on behalf of the apartment complex. In their terms and conditions, which you have to agree to if you wish to lease (or renew your lease), they require that the user waives the company of any liability involved with the data's collection, retention, or disclosure. Which is funny, given that this explicitly includes liability from accuracy as well (so, hopefully everything is correct!). services to gather renter information and screen you,
    • each of which has a data liability waiver in their terms and conditions, and
    • if you don't agree to it you can't sign your lease.
    • Also, all of the apartments near you use some form of the same system to do this, and all of their data has been shared to the same third party to set and fix prices1212The justice department filed suit in 2024 against RealPage, a company that has been accused of anti-competitive prices to fix apartment rents above a certain price by the apartment management companies themselves using RealPage to set the prices.12The justice department filed suit in 2024 against RealPage, a company that has been accused of anti-competitive prices to fix apartment rents above a certain price by the apartment management companies themselves using RealPage to set the prices.
    10PetScreening is a company which charges the tenant for checking a pet's paperwork and letting the landlord know it checks out. As a result, there is now a company who has, quite literally, amassed a database of email addresses and common security question answers (what is your pet's name?) into a single place. Outside of the annoyance data wise, this is a cybersecurity risk that renters at some apartments must accept.11PolicyValidator is a service which checks renter's insurance policies on behalf of the apartment complex. In their terms and conditions, which you have to agree to if you wish to lease (or renew your lease), they require that the user waives the company of any liability involved with the data's collection, retention, or disclosure. Which is funny, given that this explicitly includes liability from accuracy as well (so, hopefully everything is correct!).
  • When driving on the road, surveillance companies like Flock use automatic license plate readers to record precise timestamps of you passing their field of view if you pass any of their cameras.
    • These cameras are watching much more than license plates1313This article by 404media.co points out that sales employees at Flock have accessed the video feed of cameras installed in a bunch of places that have nothing to do with traffic, to include "a children's gymnastic room, a playground, a school, a Jewish community center, and a pool." 404 has done quite a bit of the reporting on this company, which I encourage you to look more into. and include any movement that occurs in its field of view.13This article by 404media.co points out that sales employees at Flock have accessed the video feed of cameras installed in a bunch of places that have nothing to do with traffic, to include "a children's gymnastic room, a playground, a school, a Jewish community center, and a pool." 404 has done quite a bit of the reporting on this company, which I encourage you to look more into.
    • What is even sadder is that your city council or state has decided that this was a good idea, and almost all sales discussions are behind closed doors. Thus, the contract has been signed by the time people find out.
  • Even when your car is not in motion, a company1414And another from 404media.co BusPatrol, a company that has sold their cameras to school districts to help supposedly deter people passing a bus with the stop-arm out, has plans to collect data of any car it sees on route. This is a repurposing of these cameras which was never advertised to the school districts. Now, anyone who drives past a bus or lives/works by a bus route will have their car tracked, without any say in the matter. has begun to use the cameras on school buses to record license plates and timestamp cars that are nearby.14And another from 404media.co BusPatrol, a company that has sold their cameras to school districts to help supposedly deter people passing a bus with the stop-arm out, has plans to collect data of any car it sees on route. This is a repurposing of these cameras which was never advertised to the school districts. Now, anyone who drives past a bus or lives/works by a bus route will have their car tracked, without any say in the matter.
  • If your neighbors have doorbell cameras like Ring or Blink, your home departure and return times are now being recorded,1515Another one from 404media, where they examined Ring (Amazon's consumer surveillance company) and how pervasive its scope has become. along with traits about guests.15Another one from 404media, where they examined Ring (Amazon's consumer surveillance company) and how pervasive its scope has become.
  • Storefronts are beginning to use centralized facial recognition surveillance companies,1616Avigilon is a company that provides this 'service' and maintains a database for comparison. Having a closed circuit video surveillance in your store to hold evidence about actions in your store is wildly different from letting a company identify and log people who walk by your store (let alone inside). effectively tying a cash purchase to your face, so cash isn't private anymore.16Avigilon is a company that provides this 'service' and maintains a database for comparison. Having a closed circuit video surveillance in your store to hold evidence about actions in your store is wildly different from letting a company identify and log people who walk by your store (let alone inside).
  • Most forms of employment require access to the internet to apply, which then requires use of one of the previously described 'elective' services for email.

Now, we have many situations in which you as a person aren't asking for any additional services in exchange for your data. You are simply trying to live without giving more out than you'd like, and still you're tracked.

And who gets access to this data? Anyone with money. This is where an article on data brokers would be useful, if I ever get around to writing one up I'll update this article with a link. Otherwise, 404media has an article from 2024 that talks about a data surveillance tool sold by TransUnion to get you started on some of what is sold and how poorly protected these aggregated data sets are.

The Government + Companies & You

The company-government relationship introduces a new dynamic to the mix. If the government is purchasing the information from companies, then there is no need to compel a company if they are selling the information. This is one of the primary reasons a company like Flock has appeared: to sell information about the citizens of a town to the police department.

A company like Flock can sell its service to anyone who wants 'safety,' and then sell police access to the database. This type of data resale, happening at a larger scale, is an effective way for the government, or anyone with the resources for that matter, to curtail any expectation of privacy. Allowing companies to make us engage in this obligatory exhibitionism so that they can sell tickets to the government strikes me as being so against any ideal of American civic ethic, while also being so stereotypically American, that it is exhausting.

I don't know how to tie these thoughts together. And I've noticed that I'm hesitating as try to draft the tie; I feel like I'm being watched while drafting.