A Massachusetts court ruled this week that obtaining real-time cell phone location data requires a warrant.
Utah has passed a law that goes into effect next month that goes further. Police in Utah will need a warrant to obtain location data or to search someone’s electronic files. (Surely electronic files are the contemporary equivalent of one’s “papers” under the Fourth Amendment.)
Vermont passed the nation’s first data broker law. It requires data brokers to register with the state and to implement security measures, but as far as I have read it doesn’t put much restriction what they can do.
Texas law expands HIPAA‘s notation of a “covered entity” so that it applies to basically anyone handling PHI (protected health information).
California’s CCPA law goes into effect on January 1, 2020. In some ways it’s analogous to GDPR. It will be interesting to see what the law ultimately means in practice. It’s expected that the state legislature will amend the law, and we’ll have to wait on precedents to find out in detail what the law prohibits and allows.
Update: Nevada passed a CCPA-like law May 23, 2019 which takes effect October 1, 2019, i.e. before the CCPA.
Update: Maine passed a bill May 30, 2019 that prohibits ISPs from selling browsing data without consent.
Even when all communications are encrypted, the available meta-data is vast.
I selected a router specifically designed for traffic analysis, and I leak tremendous amounts of information.
Right now, all I can do is frequently randomize my MAC addresses and kill my DHCP leases well before expiration, in the hope of mildly obscuring the origin of my leakage.