Why We Need a Global Digital Bill of Rights Now

You're not the product. You're the target.

Imagine if the building industry ran like the internet. Builders would pour slabs without soil tests, guess the reinforcement, and say: "We'll monitor performance and patch defects later."

By the time the cracks showed, they'd have moved on, and you'd get a voucher and an apology blog post. Move fast and break things. No one wants that house. We shouldn't accept that web.

The web isn't free. It's paid for with your data, your attention, and a running profile that guesses what you'll do next. That glossy productivity app or smart plug has a lovely interface on the front and data flowing out the back to partners, providers and brokers who are all "looking out for you".

A version of you exists online, built from every click, search, location check-in and app you use. You don't own that digital self. Corporations do.

A 2020 report by the Norwegian Consumer Council, Out of Control, found popular apps, including dating apps, passing personal data to large numbers of advertising and analytics companies, in some cases including sensitive details such as sexual orientation.

And it's used against you. Dynamic pricing means you might pay more for a flight or hotel because you searched for it before. Your data can feed decisions about your credit, your insurance premiums and the news you see. The "agreements" that allow this are designed to be unread, and they sit behind layers of legal and jurisdictional shields.

It's time to stop asking nicely for privacy and demand it as a right.

A global Digital Bill of Rights: a short, plain set of rules that returns control of our digital selves to us.

The checklist in one breath

No legal fog, no unfair terms, no "click to accept or get lost". Just bright lines everyone can understand and regulators can enforce:

Consent must be explicit. No trickery, no "opt out in 47 clicks", no "send a registered letter to an office open 10am to 2pm on a leap year".
No tracking by default.
Telemetry off unless you turn it on. If a company profits from your data, you get a real share. I'd argue 80/20 in your favour. It's your data.
Plain language terms, not legal sudoku.
No scraping from non-sanctioned sources, especially biometric, health and personal identification data.
Tax where users live, so value made from a local user base funds local services, including the mental health costs of apps designed to be addictive.
Real penalties, including handing back the profits from a breach and personal liability for directors in repeat or wilful cases.

Fines alone don't work against companies with turnovers bigger than the GDP of many countries. They treat fines as a cost of doing business. Real compliance needs individual accountability, just as company directors can already face jail for serious breaches of their duties.

💡

Real-time bidding (RTB) exposes people’s online activity and location hundreds of times per day. An ICCL report estimated 747 broadcasts per person per day in the US (and 376 in the EU), describing RTB as “the biggest data breach ever recorded

How the "free" bargain actually works

If you're not paying for the product, you are the product. Except it's not a bargain, and you never really agreed to it.

The bait: a shiny, useful, "free" tool. A social network, a productivity app, a smart home device.
The hook: once you rely on it, every click, scroll, pause and location is logged to build a detailed picture of your habits, preferences, fears and desires.
The sale: that picture is packaged and traded between data brokers, advertisers and other third parties in a market you never see.

They call it "data collection" and "personalised advertising". If someone photocopied your diary and sold the copies to strangers, you'd call it something else.

The most cynical part is what I call the productivity paintwork. Apps that help you manage your health, money, home or building project hold your most sensitive information. Your fitness app knows your health. Your budgeting app knows your financial stress. Your project app knows your budget and deadlines. That data can be used to sell to you, to price things against you, or be sold on to insurers and brokers.

From data to control

It's not "just ads". Your data is used to shape your behaviour, not only predict it:

Price discrimination: algorithms infer your income from your postcode, read urgency from your searches, even note the device you use, then show you a price. The same hotel room or the same pack of timber for your renovation can cost you more than the person next to you.
Engagement over information: your feeds and recommendations are tuned to keep you scrolling, not to inform you. That pushes people toward more extreme content and into filter bubbles.
The self-improvement trap: tools that promise to help you live better are often the hungriest collectors of all.

"Move fast and break things" has come to mean breaking us: our privacy, our trust and our communities.

Why "ask forgiveness later" is the business plan

Much of this is technically legal because the rules were written around the companies doing it. Getting caught is a minor cost. Here's how it works:

The illusion of consent. Terms and privacy policies are long and unreadable by design. One US study estimated it would take the average person 76 work days a year to read all the privacy policies they encounter. That isn't informed consent. It's a legal shield.
Unfair terms. In the US, forced arbitration clauses and class action bans block people from going to court. In Australia, unfair contract terms in standard form contracts can be struck out, and since November 2023 businesses can be penalised for including them. That's progress, but it relies on someone challenging the terms after the damage is done.
Fines as a business expense. A few million dollars against a company earning billions is a $10 parking ticket for a spot that earns you $10,000. Until penalties are large and executives are personally accountable, nothing changes.

In 2022 the Federal Court ordered Google to pay $60 million in a case brought by the ACCC for misleading Australians about the collection of their location data. A big number for you and me. For Google, a small fraction of its revenue.

Why we need a Digital Bill of Rights

Tinkering with privacy policies or voluntary codes is a band-aid on a broken leg.

Data rights are human rights. Our digital and physical lives can't be separated any more. Rights to privacy, autonomy and fair treatment don't stop when we go online.
Self-regulation has failed. Years of promises have delivered a steady stream of scandals and breaches. Nobody gives up their main revenue source voluntarily.
It's a global problem. A company can collect data from Australians, store it in a second country and operate under the laws of a third. National laws like Australia's Privacy Act are a start, but they're easy to route around. Australia's Privacy Act reforms passed in late 2024, including a new right to sue for serious invasions of privacy, show change is possible, but a global standard stops companies shopping for the weakest rules.
Simple beats complex. A company is either compliant or in breach. Clear rules help honest companies and make enforcement straightforward.

The Australian Human Rights Commission's 2021 Human Rights and Technology final report called for stronger legal protections, warning that technology is moving faster than the law that's meant to protect us.

What a Digital Bill of Rights must include

Opt-in only. Data collection, including background telemetry, is off by default until you explicitly say yes. No pre-ticked boxes.
The right to understand. Terms in plain English, with a one-line headline, a short summary, then the detail. If a reasonable person can't understand it in a minute, it isn't enforceable.
No manipulation. Dark patterns are banned. Saying no must be as easy as saying yes.

B. Transparency and fairness

Full disclosure of what's collected and who it's shared with, before you agree.
Data minimisation. Only collect what's needed for a clearly stated purpose. No hoarding "just in case".
A user dividend. If a company profits from your data after you opt in, you get a share, and the formula is disclosed upfront.
No secret scraping, especially of biometric and facial recognition data.

C. Ownership and agency

You buy it, you own it. Software, ebooks and smart devices you pay for can't be remotely disabled or locked behind a new subscription. The right to repair is fundamental.
Access, portability and deletion. Download your data in a usable format, take it elsewhere, and have it verifiably deleted. Fast, free and without hassle.
No retaliation for opting out or exercising your rights.
Independent audits of high-risk AI and data systems that make decisions about loans, jobs and more.

D. Safety and accountability

No cross-context use without fresh consent. Your fitness data isn't ad data.
Child-first design, with stricter defaults for services children use.
Security by default, with prompt, clear breach notification.
Pay your way. Revenue earned from Australians is taxed in Australia.
Automatic, serious penalties based on global revenue, so a breach is a catastrophic business decision, not a calculated risk.

Our rights can't just be implied. They must be enforced.

💡

The EU's General Data Protection Regulation (GDPR) includes principles like Data Minimisation and Purpose Limitation, proving that embedding these concepts into strong legal frameworks is possible. Its "right to data portability" also shows the technical feasibility of letting users control their data. (Source: GDPR.eu, Chapter 2, Article 5)

Closer to home: your data during a build

Building a home generates a mountain of personal data: identity documents, income and loan details, your address and floor plan, your selections and budget, site photos, and every email between you and your builder. It passes through builders, lenders, brokers, conveyancers, real estate platforms, finance apps and project portals.

A whole industry also sells property owners' details to agents and marketers for a monthly fee. Many of those platforms offer a "remove me" option, which tells you they hold your data without asking first. That puts the burden of protection on you.

Before you sign up for anything during your build, ask:

What personal information do you collect, and why do you need it?
Who do you share it with, including software platforms and marketing partners?
Where is it stored, and for how long after the job is finished?
Can I opt out of marketing and data sharing without losing service?
How will you tell me if there's a data breach?

Give copies of ID only where the law requires it, and ask how they'll be stored and destroyed.

This is the line to draw

We're at a crossroads. One path leads to more surveillance, powered by AI, where our digital selves are owned, sold and used against us. The other leads to technology that serves people.

The idea that we must trade privacy for convenience is a false choice.

Building codes didn't kill the construction industry. They made it safer and more reliable. A Digital Bill of Rights would do the same for the digital world: a solid foundation, so we build things that last instead of moving fast and breaking things.

The companies profiting from the current system won't change it voluntarily. So:

Demand more. Ask companies about their data practices, choose privacy-respecting tools, and use the rights you already have.
Support advocates such as Digital Rights Watch Australia.
Talk about it with family and friends.
Write to your MP. Ask what they're doing to strengthen privacy law and support international cooperation.

Without your data and your attention, these trillion-dollar empires don't exist. That's your power.

FAQ

What is a Digital Bill of Rights? A short, non-negotiable set of rules governing how companies collect, use and profit from personal data, designed to put control back with individuals.

Isn't that what the GDPR does? The EU's GDPR is a big step, and it shows principles like data minimisation and portability can work in law. But it's complex, regional and can be worked around. A Digital Bill of Rights aims to be simpler, global and harder to dodge.

Won't my favourite apps all become paid? Not necessarily. Some may offer subscriptions, others ads you opt into, perhaps with a share of the revenue. The point is choice and fairness.

How could it be enforced globally? With automatic penalties based on worldwide revenue, ignoring the rules becomes financially irrational wherever a company is based.

Does this go beyond social media? Yes: phone apps, browsers, smart home devices, banking, loyalty programs, and the software your builder or accountant uses.

Won't it stifle innovation? It redirects it. Instead of rewarding new ways to track people, it rewards products people trust.