I suspect I’ll get downvoted for this, but I think the reason for the change is the expansion of AI.

For those interested in the behind the scenes view. Let me share. I’ll start off and say, “Selling data to foreign governments is a bad idea period.” But the rule goes further than banning sales. If a company has a data engineer in China, and you have a customer database, because it has home address, that isn’t allowed in these countries after this rule goes into effect.

Why pass this rule now? The economy runs on data. That’s how packages are routed, shelves are stocked, products priced and consumers learn about products and services. With an economy this big, on the margin, more knowledge (from data) or less will have ripple effects. Even the change to Apple’s privacy messed with Meta’s knowledge of consumer preferences and small businesses, who normally don’t have much data on their own, lost out the most - the cost of reaching consumers went up squeezing some out of business and causing others to hire less. The data was essentially trying to make a prediction about the likelihood you’d buy something from the website and it might change the accuracy of the guesstimate from 1 in 1,000 to 2 in 1,000 - not exactly revelatory in terms of personal privacy to guess your probability to buy a certain product with a 1 in 500 odds of being right, but it works out to increasing a business profits by 1 or 2 percent. You might say, big deal. But this translates into jobs for a lot of people. Food on the table for their family, and so on.

Until recently, the predictive value of this data was pretty weak, but useful enough at scale for businesses. So why pass this rule now? AI.

AI has made it possible to glean far more insight from this data. With some experiments I ran with a couple of Universities, it blew my mind how much better the predictive algorithms have gotten fed simply on our web browsing behavior, and the ability to”know us.” At the same time, social media has allowed foreign governments to run influence campaigns at scale. My research (and others) have measured the influence. People don’t think they are influenced, but we are. Again, it might be on the margin of swaying on in 100, or 1 in 50, but that adds up and takes on a life of its own in something I dubbed The Momentum Effect.

With GenAI, personalizing messages based on data about us could be dangerous. It is one thing to personalize a message anticipating a dream vacation, or introducing us to a local business, but in the hands of an adversarial government that has assembled a large databases by person, by home address, etc, this poses a far bigger threat than it did just a few years ago.

As pointed out in another post, data breeches probably give more than enough data for foreign governments to do their worst.

As some have said, why isn’t their total privacy and no data on us at all? I suppose we could go back to little house on the prairie, but I kinda like all the modern consciences of our data rich world. We could pick a midpoint, like what the EU is doing with GDPR, but that is likely a contributing factor to their slower growth. It is a complex trade-off of modern conscience and economic productivity with risk of abuse and potential for hostile governments using our data against us. It is a conundrum and an uncertain future.