Should Companies Be Banned From Selling Your Personal Data?

• Data brokers compile profiles on virtually every American adult — including location history, purchase behavior, health conditions inferred from search history, political affiliation, and financial stress indicators — and sell them without consent. This data is used to price insurance, target political advertising, screen employment applications, and set bail recommendations. The downstream harms are concrete and well-documented; the individual whose data was sold has no recourse.
• The European Union's GDPR, in force since 2018, prohibits data collection and sale without affirmative consent and has not destroyed the European internet economy. EU companies have adapted to consent requirements; compliance costs are real but manageable. The claim that privacy protection is economically ruinous is a lobbying argument by the data broker industry, not an empirical finding.
• Health and location data sold without consent has been used to track abortion patients, identify people attending political protests, and profile members of religious minorities. These are not hypothetical harms: the Senate Intelligence Committee documented in 2024 that US data brokers sold location data from mobile phones near sensitive federal facilities to foreign intelligence services. A ban addresses a genuine national security risk, not just individual privacy.

Debater: To be announced

• Targeted advertising built on data sales funds Google Search, Gmail, Facebook, and thousands of other free services used by billions of people daily. An opt-in consent requirement — which most users never grant for services they don't pay attention to — would collapse the ad-supported internet and push these services to subscription models that lower-income users cannot afford. GDPR has created exactly this bifurcation in Europe.
• The GDPR has not produced the privacy utopia its advocates promised: compliance consent banners are universally clicked through without reading; large tech companies have more resources to navigate compliance than smaller competitors; and data brokers continue to operate through legal gray zones. What GDPR has done is raise compliance costs for small businesses and entrench incumbents who can afford legal teams. A US equivalent would produce the same result.
• Americans already have meaningful tools to limit data collection: browser privacy settings, VPNs, opt-out registries, and state laws in California, Virginia, and 12 other states. A federal data-sale ban is a blunt instrument that ignores the diversity of uses — fraud prevention, public health research, supply chain analytics — that rely on aggregated data and would be swept up in a broadly worded prohibition.

Debater: To be announced