Privacy regulation is hard. It involves making choices about the delicate balance between security and convenience that will be codified into law. But in the current technology and business environment there is no clear consensus about where those lines should be drawn, beyond obvious cases of misappropriation and abuse. What precisely constitutes personal information? What legal protections should be available to data collected from users, particularly abstracted or aggregated information? And in what contexts should those protections apply?

Informed people can disagree in good faith about these issues, and the stakes are high. The collection, use, and analysis of personal data is central to the business models of many services we rely on every day, including some of the most highly-valued companies in the world. Often those services are provided for free (or apparently free) because those companies are permitted to collect and commercialize our personal information in some form. Getting the balance wrong—especially in a legal or regulatory framework—comes with major implications.

And if this were not enough, any legal regime seeking to address privacy in the online world is faced a familiar problem: Technology moves fast, and the law generally has to play catch-up. In the privacy context, the creation of entirely new kinds of data, and the ability to collect and analyze that material on a massive scale, have created new issues for privacy regulation. Information that would once have been considered anonymous may be more appropriately regulated as personal information. For example, if Facebook records a user login in midtown Manhattan, that information may not seem especially "private." But aggregating that seemingly innocuous data-point with the vast trove of other "anonymous" information collected by Facebook may enable the creation of a profile that identifies the user with pinpoint accuracy and poses privacy concerns, especially when that profile is shared with third parties who could use it to identify specific users and their preferences.