Yo ho, yo ho, a data sale life for me

(point of order for RSS users: I am re-writing the script that makes the main RSS feed on this blog. Now the feed content gets pulled from the built pages instead of making separate RSS entries from the source files. I wanted a script that would make a feed from any directory with HTML files in it, and now I have one. You shouldn’t see anything different but if you do please either let me know or just come back to it later. Thank you.)

In the news: California’s attorney general issues largest CCPA fine to date. On the surface, this is a predictable compliance story. Disney pulled a classic CCPA/CPRA compliance mistake—treating Global Privacy Control and other required opt-outs as a front-end ticket, and not updating the customer records to make an opt-out take effect everywhere that the customer and the company interact. To quote the regs,

If a business collects personal information from consumers online, the business shall treat user-enabled global privacy controls, such as a browser plug-in or privacy setting, device setting, or other mechanism, that communicate or signal the consumer’s choice to opt-out of the sale of their personal information as a valid request submitted pursuant to Civil Code section 1798.120 for that browser or device, or, if known, for the consumer.

That means if Disney gets a GPC signal from a logged-in web user, that means a Do Not Sell or Share for that person, on all of the company’s sites, apps, CTV channels, theme parks, cruise ships, whatever. For a company with a lot of different products and services, that’s a big deal.

That’s not what’s in the news now, though. The new Final Judgment and Permanent Injunction covers taking one step toward compliance with the law. Lei He explains, in MAGIC MEETS COMPLIANCE: California AG Drops The Hammer On Disney, Securing The Largest CCPA Settlement Yet At $2.75 Million. The judgment applies to “DISNEY SERVICES” which is limited to “any website, application or online service…that COLLECT CONSUMER PERSONAL INFORMATION…” This is just about Internet stuff.

And Disney still has a bunch of customer interactions that aren’t covered. So we can expect more cases (from attorneys in private practice, too) over more of their lines of business. (Server-to-server tracking using event or conversions APIs, along with uploaded “custom audiences” are the obvious items to look for.)

Whistle while you work (on compliance tickets)

The most likely next step for Disney is the same one Sephora did after their settlement: hire a compliance project manager, who tends to be an expensive employee to have because anyone who is halfway decent at it will generate lots of lawyer billable hours and lots of to-do items for developers and IT staff. That would move Disney toward a different balance of “compliance taxes” with fines and settlements. Fines over compliance issues will still be a thing, because it’s not practical to keep all the compliance code and processes working at a manageable cost. If every compliance ticket is getting done, some revenue-positive work doesn’t get done.

But privacy fines are chump change, and Disney can afford to pay managers, developers, and lawyers. The real problem with the normal, compliance-tax-paying, way of doing things is that Disney would still be dumping their customer data to surveillance companies, where it gets used against them. Every dollar that a Disney customer loses to fraud, or wastes on deceptively sold goods, is a dollar they can’t spend at Disney.

Disney, as a company, has more common interests with its long-term fans than with the surveillance advertising business. They’re not the n^th fast fashion retailer on a fast-scrolling feed, they’re a destination. The surveillance advertising business needs Disney customer data more than Disney needs the surveillance advertising business. If Disney management wanted to think outside the box here, they could tell Big Tech, we’re on the customer’s side now. The new privacy policy is customer data flow is one way: inbound to Disney. And not only will we stop passing customer data, we’ll help our customers get protected from passing their info in other ways.

Yes, Disney would take a short-term hit to some lines of business by not “putting identifiers in the bidstream” (does anyone in adtech know how creepy this sounds?) but see the chart above. Intra-company synergy is valuable, paying a compliance tax for the right to burn your own assets and reputation is a dumb move.

(I’m probably going to post an update here in a little while when Disney has to do another privacy fine or settlement while continuing to have their work commoditized. The Surveillance Advertising Bro Code is still more powerful than corporate self-interest.) More: Triple taxation on surveillance marketing

Bonus links

Democratization of Danger: Preserving Liberty and Human Agency in the Age of Super-Empowered Individuals — OODAloop by David Bray. As we stand in 2026 and look toward the decade ahead, we are witnessing the rise of the super-empowered individual. This is a world where a hobbyist can weaponize a commercial drone, where accessible gene-editing tools can resurrect historical pathogens, or where coordinated attacks can cripple power grids. Personal robots, autonomous machines that can navigate our streets, enter our buildings, and interact with our physical world, are arriving rapidly and will amplify these risks even further.

Communities are not fungible by JA Westenberg. When a platform migrates its user base to a new architecture, the implicit promise is that the community will survive the move. When a city demolishes a public housing block and offers residents vouchers for market-rate apartments across town, the implicit promise is that they’ll rebuild what they had. These promises are always broken, and the people making them either don’t understand why, or they’re relying on the rest of us being too blind to see it.

Is NearlyFreeSpeech.NET anti-AI? It’s complicated. It’s certainly understandable why it might come across that way. We are, rather notoriously, anti-stupidity. And we’re anti-exploitation. And we’re not super fond of bullshit.

Have I hardened against LLMs? by Baldur Bjarnason. What’s hardened are my views on the tech industry, software, management, and influential members of the software developer ecosystem.

When AdTech Misrepresent Their Own A/B Tests by Florian Teschner. Treat platform “A/B tests” with skepticism: When Google or Meta say they’ll run an A/B test, assume it’s observational analysis unless they specifically confirm proper randomization. Don’t rely on these results for high-stakes decisions.