1863 Leadership · Issue Paper No. 6
What You Like Belongs to You
A consumer bill of rights for personal data — enforced by the person it belongs to, and by no new agency.
Abstract
A record of what you looked at, how long you paused, and what you almost bought is your property, and no one asked you before taking it. This paper proposes a consumer bill of rights in personal data: consent before a company profiles you, no penalty for declining, disclosure of who owns what you are reading and who paid for it, and the right to take your own data with you or delete it. The rights belong to the individual and are enforced by the individual, in court, with no agency and no appropriation — because an agency with authority over what companies may show people is an agency with leverage over speech. We set out the constitutional objections at full strength, including a Supreme Court decision striking down the precise consent design we recommend, and the risk that the rule consolidates the very firms it is aimed at.
Key findings
- When Apple required applications to ask before tracking users across other companies' services, opt-in rates settled around 25 percent, and researchers measured roughly a 55 percent decline in the United States tracking rate. Same practice, same convenience — only the default changed.1
- Roughly twenty states already grant consumers a right to opt out of profiling and targeted advertising. The legal architecture exists; what is at issue is which way the switch points when nobody has touched it.2
- In Sorrell v. IMS Health (2011) the Supreme Court struck down a state law requiring opt-in consent before certain data could be used for marketing, holding that information is speech and that the law was content- and speaker-based. That is the design this paper recommends, and we say so.3
- In Moody v. NetChoice (2024) the Court held that a platform's selection, ordering, and ranking of content is protected expression, including when performed by algorithm — and that government may not prevail by asserting an interest in improving the marketplace of ideas.4
- An Illinois biometric privacy statute with per-violation statutory damages produced class actions settling in the hundreds of millions. A private right of action carelessly drawn produces litigation rather than compliance.5
Section 1The question before us
You looked at a pair of boots once. For the next three weeks the boots follow you — into the newspaper you read at breakfast, the weather site you check before leaving, the video your daughter sent you. Nobody finds this remarkable anymore. It is worth asking what changed hands to make it possible.
What changed hands was a record of your conduct. Not your name and address, which you may have given deliberately, but the accumulated evidence of what you looked at, how long you paused on it, what you scrolled past, what you almost bought and did not, and what you searched for at eleven o'clock at night. From that record a company assembled a description of you — your income bracket, your politics, your health worries, whether your marriage is in trouble, and whether you are the kind of person who can be moved.
Nobody asked you. The record of your own behavior was assembled and put to work without your ever being offered the chance to decline.
This paper argues that the record is yours. Not because surveillance is sinister or advertising is wicked — a great deal of personalized advertising is useful, and a person who wants it should have it. But because a thing made out of your conduct belongs to you, and a company that wants to use it should have to ask.
1.2 Our own share of the failure
We clicked accept. Every one of us, hundreds of times, on documents we did not read and would not have understood, in exchange for services we wanted and did not want to pay for. Nobody was defrauded. We were offered a trade we did not examine and we took it, and the fact that the terms were unreadable does not entirely excuse the fact that we never tried.
There is a further share belonging to those who share this paper's convictions. For twenty years the standard answer on our side of the argument has been that this is simply the price of a free service, that consumers who dislike it may go elsewhere, and that a market has spoken. That answer was too easy. A market transaction requires that both parties know what is being exchanged, and in this one the thing being exchanged was never named, never priced, and never disclosed in terms a customer could evaluate. Defending that as free exchange was not rigor. It was a reflex.
A person who believes in property rights should be the first to notice when a valuable thing is taken without a bargain, not the last.
Section 2What was actually taken
Two things are commonly confused and the distinction runs through this entire paper.
The first is the relationship you entered. The hardware store you have bought from for six years knows what you bought. Your bank knows your balance. Your doctor knows your history. You gave each of them that information on purpose, in exchange for something, and each of them holds it under rules you can identify.
The second is the observation of a stranger. A company you have no relationship with watched you move across the internet, recorded it, matched it against records purchased from other companies you also have no relationship with, and assembled a portrait it then sold access to. You did not enter this. You were not told it was happening in any form you could act on. And the portrait is frequently more revealing than anything you would tell a friend, because it is built from what you did rather than from what you would admit.
Every proposal in this paper reaches the second and leaves the first alone. That line matters practically as well as morally: a rule that severed a merchant from his own customer list would fall hardest on the smallest businesses, which have nothing else.
Section 3Reform I: Consent before profiling
No company should build a profile of an individual from observation of his conduct, or use such a profile to decide what he is shown, unless he has affirmatively agreed. The default is off. The request must be a plain question asked once, in a specified form, answerable in one action, and the answer must persist.
This applies to all companies above a size threshold, to all content, and to every subject matter equally. It draws no distinction between political material and any other kind, and that generality is deliberate. A rule that singled out political content would require some official to decide what counts as political, and this paper proposes no such office.
3.1 Why the default decides the outcome
In April 2021 Apple began requiring applications to ask permission before tracking users across other companies' services. Nothing else changed — same practice, same convenience, same people, one additional question. Opt-in rates began near 16 percent and settled around 25 percent, and researchers measured roughly a 55 percent decline in the United States tracking rate.1
Three-quarters of people, asked plainly, said no. That is the strongest available evidence that the present arrangement does not reflect what customers want. It also tells you something a supporter of this reform should admit plainly: an opt-in default is not a neutral choice architecture. It is close to a prohibition with a courtesy prompt, and anyone who argues otherwise is not being straight.
We think that is defensible, because the thing being prohibited is the use of someone's property without asking, and the prohibition lifts the moment he says yes. But the reader should weigh the reform for what it is rather than for how modestly it can be described.
3.2 The line between a platform and a merchant
The rule reaches a company's observation of people it has no relationship with. It does not reach a business's records of its own customers' dealings with it.
A local retailer keeps his customer list, his purchase history, his email file. What he loses is the ability to buy access to a profile that someone else assembled by watching you elsewhere. That is a real loss and customer acquisition will get more expensive — Section 8.4 states that objection at length — but it preserves the asset that small businesses actually own while reaching the practice this paper is about.
Section 4Reform II: No penalty for declining
A company may not degrade the service, withhold features, delay access, or charge more because a customer declined to be profiled. Same product, same price, whichever he chooses.
Without this provision the first reform is decorative. A consent request that may be re-asked daily, or that disables half the product when refused, or that carries a surcharge, is not a choice. It is a toll booth with a sign on it.
Europe has had this argument already. When a large platform offered users a binary of consent or payment, the European Data Protection Board's 2024 opinion held that large platforms generally may not reduce the choice to those two options and that a free, less-personalized alternative should exist.6 European data law is not American law and we cite it only as the nearest working precedent.
We should be honest that this is the provision most vulnerable to the charge that government is prescribing a business model. Our answer is narrow: the rule does not say how a company must make money. It says a company may not price the exercise of a right differently from its waiver. Advertising remains lawful, and advertising sold against content rather than against people remains entirely available.
Section 5Reform III: The right to know
Four disclosures, none of which requires anyone to judge whether anything is true.
Who owns this, and what else do they own. The ownership of a publication or platform should be a matter of public record, along with the other significant holdings of its owners, and disclosed on material touching those holdings. A reader is entitled to know when the company reporting on an industry is owned by someone with a position in it.
Who paid for this. Paid placement, sponsored content, and any payment by a government to a commentator or influencer should be disclosed on the item itself. Covert payment for favorable commentary has a documented American history and it should be visible when it happens.
Is this news or opinion. By the publisher's own label, with liability for misrepresenting it — not by anyone else's assessment. A publisher may call a piece whatever he likes. He may not call an advocacy piece a news report and be immune from having said so.
Did a machine make this. Synthetic audio, video, and imagery presented as a record of real events should be labeled as generated.
A fifth, smaller right belongs with these: when material a person has already read is later altered, the alteration should be visible. Correction is a virtue. Silent revision is not.
Section 6Reform IV: Access, portability, and deletion
A person should be able to see what a company holds about him, take a usable copy of it elsewhere, and require its deletion.
This is the least novel proposal in the paper. Roughly twenty states already provide some version of it, and it is standard in most developed countries.2 We include it because a right to consent is thin without a right to inspect what was collected before anyone asked, and because portability is the provision that turns a captive user into a customer who can leave.
Portability deserves particular emphasis from anyone who prefers competition to regulation. A person who can take his own data to a rival is a person the incumbent must keep by being better. That is a market remedy, and it is available now.
Section 7Enforcement without a regulator
These rights belong to the individual and should be enforced by the individual, in court. No agency, no rulemaking, no appropriation, no annual renewal.
That choice is the point rather than a detail. An agency empowered to police what companies may show people is an agency with leverage over speech, and whoever holds that leverage will eventually be somebody the reader did not vote for. A right enforced by its owner creates no such office.
But a private right of action drawn carelessly produces a litigation industry rather than compliance, and there is an American example. An Illinois biometric privacy statute with per-violation statutory damages generated class actions settling in the hundreds of millions of dollars, which is what happens when a damages claim can be multiplied across a class of millions.5
The object here is a switch everybody flips, not a decade of class actions. Three design choices produce that result.
A bright-line specification for the consent request — its timing, wording, and format set out in the statute. Ambiguity is what feeds litigation. If there is nothing to argue about, there is nothing to sue over.
Mandatory notice and cure — thirty to sixty days for a company to fix a violation before any suit may be filed. A company that complies when told never reaches court.
Injunctive relief and attorney's fees, and no per-violation statutory damages. This is the load-bearing one. A consumer gets a real remedy and a court order that binds. A lawyer gets no reason to assemble a class of forty million people, because there is no pot at the end of it.
Section 8 · The strongest case against
8.1 The Supreme Court struck down the design we are proposing
This objection is first because it is the most serious and because a reader should not have to discover it elsewhere.
In Sorrell v. IMS Health the Court struck down a Vermont statute requiring physicians to opt in before their prescribing data could be used for marketing. It rejected the argument that personal information is a mere commodity, holding instead that information is speech, and it found the law content- and speaker-based because it targeted particular marketers. It also indicated that an opt-in requirement burdens more speech than an opt-out would.3
Two features of our proposal are drawn against that holding. It is general — every company above a threshold, every subject matter, no favored or disfavored speaker — which is precisely what Vermont's law was not. And its rationale is the individual's interest in his own conduct, not any judgment about which messages are good for people to receive.
That may not be enough. A reader who concludes that Sorrell forecloses an opt-in default has read the case correctly, and the honest response is that an opt-out default with a conspicuous, one-action, persistent choice would achieve a substantial part of the object at materially lower legal risk. We prefer opt-in and we would accept opt-out rather than nothing.
8.2 Ranking content is protected editorial judgment
In Moody v. NetChoice the Court held that a platform's selection, ordering, and ranking of third-party content is expressive activity protected by the First Amendment, including when carried out by algorithm, and that government may not prevail merely by asserting an interest in improving or better balancing the marketplace of ideas.4
Our proposal is drafted to regulate the input rather than the output. It does not tell any company how to rank anything. It says a company may not use a particular person's personal data to do the ranking without that person's permission, leaving it free to sort by recency, popularity, subject, or its own editorial judgment.
We think that distinction holds. We also think a court could reasonably find that at some point a rule about which inputs may inform a ranking becomes a rule about the ranking. That is a genuine risk and not a technicality.
8.3 Free services may become paid ones
If personalized advertising funds a service and most users decline it, the service must run less profitable advertising or charge. Contextual advertising — sold against the content rather than against the person — is viable and was the entire industry within living memory, but it earns less. Some services will get worse and some will cost money.
That cost falls hardest on people with the least, which is a real objection and not one we can dissolve. Our answer is that a bargain nobody was offered is not made acceptable by being cheap, and that a customer who wants personalization can have it by saying so. A reader may weigh that trade differently.
8.4 This may entrench the largest firms
When Apple made cross-app tracking opt-in, the clearest beneficiaries were the largest platforms. A company with an enormous first-party relationship absorbs the loss of purchased profiles; a small advertiser who depended on those profiles to find customers cannot. Apple's own advertising business grew.
So a rule aimed at checking the giants may consolidate them. This is the same pattern this organization has identified elsewhere — a restriction on one channel enlarging a worse one — and having named it there we are obliged to name it here. The platform-and-merchant line in Section 3.2 mitigates it and does not eliminate it.
8.5 A private right of action can become an industry
The Illinois experience is the warning. Plaintiffs' firms respond to incentives as reliably as anyone else, and a statute that makes suing profitable will produce suits whether or not consumers are being harmed.
The design in Section 7 is built to prevent that, and we would rather lose the deterrent value of large damages than create the litigation. A reader who thinks injunctive relief alone is too weak to compel compliance from a trillion-dollar company has identified the trade we made, and it is a fair thing to disagree about.
8.6 Defining the covered company is not simple
A threshold set by users or revenue is mechanical and content-blind, which is why we prefer it to any definition turning on what a company publishes. But thresholds create cliffs, invite structuring, and will catch some firms that should not be caught while missing others that should.
8.7 What we concede, and what we do not
We concede that the Supreme Court has struck down an opt-in consent requirement and that our preferred default is the exposed one. We concede that a rule about permitted inputs may be characterized as a rule about protected output. We concede that some free services will become worse or cost money, and that the burden falls unevenly. We concede that the reform may strengthen the largest firms relative to the smallest. We concede that a private right of action is a dangerous instrument even when carefully drawn.
We do not concede that the present arrangement is the result of a bargain. Nobody was offered terms he could evaluate, nobody was told what the thing was worth, and a transaction with those features would not be defended as a free exchange in any other industry in the country.
Section 9What we are not claiming
We are not claiming this will improve American political discourse, and that is not its purpose. It is possible that people shown less personalized material would encounter a wider range of it, and possible that they would not. We have no evidence either way, we make no such argument, and nothing in this proposal turns on it. The case here is about property and consent, and it would be the same case if every profile in America were used exclusively to sell shoes.
We say that plainly for a reason. A rule aimed at what people should see is a rule about speech, and it belongs to a category of proposal this organization opposes. A rule about who owns a record of your conduct is not.
We are not claiming that personalized advertising is harmful or that people who want it are foolish. Many customers will opt in, and they should be able to.
And we are not claiming this is a small change. It would reduce the revenue of some of the largest companies in the world, raise costs for advertisers, and make some free things cost money. We think the trade is right. We do not think it is free.
Section 10The argument you can carry
The paper compressed to what a person can remember and repeat.
And the one that is ours rather than theirs. We clicked accept, hundreds of times, on documents we did not read. Nobody defrauded us. We were offered a trade we never examined, and those of us who argue for property rights for a living should have been the first to notice, not the last.
Section 11Conclusion
There is a version of this argument that asks the government to decide what people ought to see, and this paper is not it. Nothing proposed here touches what any company may publish, rank, promote, or refuse. No official judges any content. No agency is created, no money is appropriated, and no one acquires a lever over speech that a future administration could turn on somebody.
What is proposed is older and simpler than any of that. A thing made out of your conduct belongs to you. A company that wants it should ask, should take no for an answer without penalty, should tell you who it is and who paid it, and should give the thing back when you ask for it.
That is not a novel theory of the internet. It is the ordinary law of property and consent, applied to the most valuable unowned asset of the present century, and enforced by the person it belongs to rather than by anybody's regulator.
Notes
- Apple App Tracking Transparency, introduced with iOS 14.5 in April 2021. Opt-in rates of roughly 16 percent at launch rising to about 25 percent by mid-2022 are reported by Adjust and by Flurry Analytics; the approximately 55 percent decline in the United States tracking rate is drawn from academic analysis summarized in trade coverage. These are industry-collected measurements rather than official statistics, and the text characterizes them as approximate for that reason.
- Roughly twenty states have enacted comprehensive consumer data privacy statutes granting rights of access, deletion, portability, and opt-out of profiling and targeted advertising, beginning with the California Consumer Privacy Act, Cal. Civ. Code §§ 1798.100 et seq. The number changes every legislative session; verify the current count before publication.
- Sorrell v. IMS Health Inc., 564 U.S. 552 (2011). The Court struck down a Vermont statute restricting the use of prescriber-identifying information for marketing, holding the restriction content- and speaker-based and rejecting the argument that data is a commodity outside First Amendment protection. For the argument that consumer-empowering opt-out regimes survive the decision, see Bastian Shah, "Commercial Free Speech Constraints on Data Privacy Statutes After Sorrell v. IMS Health," Columbia Journal of Law & Social Problems, jlsp.law.columbia.edu. This case runs against our own Section 3 and we have set it out at full strength in Section 8.1.
- Moody v. NetChoice, LLC, 603 U.S. 707 (2024), supremecourt.gov. The three principles identified for lower courts appear in the majority opinion, including that government may not prevail by asserting an interest in improving or better balancing the marketplace of ideas. See also Miami Herald Publishing Co. v. Tornillo, 418 U.S. 241 (1974).
- Illinois Biometric Information Privacy Act, 740 ILCS 14, which provides a private right of action with statutory damages per violation and has produced class-action settlements in the hundreds of millions of dollars. Cited here as a caution about enforcement design rather than as an argument against private enforcement.
- European Data Protection Board, Opinion 08/2024 on the validity of consent in the context of consent-or-pay models deployed by large online platforms. European data protection law is not American law and is cited here only as the nearest working precedent for a non-discrimination requirement.
A note on the author
Issue papers are published under the name of 1863 Leadership rather than an individual byline. Where this paper speaks in the first person, the author is its founder, who served in the United States Marine Corps as a cryptologic Arabic linguist and spent fourteen years building and operating a multi-unit restaurant enterprise.
A note on sources
The legal claims in this paper rest on the Supreme Court's own opinions, and the two decisions that cut hardest against our proposal — Sorrell and Moody — are cited in the key findings rather than buried in the counter-case, because a reader deciding whether to support a reform is entitled to meet its strongest opponent early. Where a figure comes from industry measurement rather than official statistics, as with the tracking rates in note 1, the note says so and the text calls the number approximate.
Recommended citation
1863 Leadership. "What You Like Belongs to You." Issue Paper No. 6.
September 2026. 1863leadership.org
Corrections: None to date. Errors of fact are corrected on this page within one business day of notice, with a dated note describing the change.
Download the full paper or the two-page brief