Technology

Companies often tout their compliance with industry standards — I&m sure you&ve seen the logos, stamps and &Privacy Shield Compliant& declarations. As we, and the FTC, were reminded a few months ago, that label does not mean that the criteria was met initially, much less years later when finally subjected to government review.

Alastair Mactaggart — an activist who helped promote the California Consumer Privacy Act (CCPA) — has threatened a ballot initiative allowing companies to voluntarily certify compliance with CCPA 2.0 to the still-unformed agency. While that kind of advertising seems like a no-brainer for companies looking to stay competitive in a market that values privacy and security, is it actually? Business considerations aside, is there a moral obligation to comply with all existing privacy laws, and is a company unethical for relying on exemptions from such laws?

I reject the notion that compliance with the law and morality are the same thing — or that one denotes the other. In reality, ita nuanced decision based on cost, client base, risk tolerance and other factors. Moreover, giving voluntary compliance the appearance of additional trust or altruism is actually harmful to consumers because our current system does not permit effective or timely oversight and the type of remedies available after the fact do not address the actual harms suffered.

Itnot unethical to rely on an exemption

Compliance is not tied to morality.

At its heart is a cost analysis, and a nuanced analysis at that. Privacy laws — as much as legislators want to believe otherwise — are not black and white in their implementation. Not all unregulated data collection is nefarious and not all companies that comply (voluntarily or otherwise) are purely altruistic. While penalties have a financial cost, data collection is a revenue source for many because of the knowledge and insights gained from large stores of varied data — and other companies& need to access that data.

They balance the cost of building compliant systems and processes and amending existing agreements with often thousands of service providers with the loss of business of not being able to provide those services to consumers covered by those laws.

There is also the matter ofapplicable laws. Complying with a law may interfere or lessen the protections offered by the laws you follow that make you exempt in the first place, for instance, where one law prohibits you from sharing certain information for security purposes and another would require you to disclose it and make both the data and the person less secure.

Strict compliance also allows companies to rest on their laurels while taking advantage of a privacy-first reputation. The law is the minimum standard, while ethics are meant to prescribe the maximum. Complying, even with an inapplicable law, is quite literally the least the company can do. It also then puts them in a position to not make additional choices or innovate because they have already done more than what is expected. This is particularly true with technology-based laws, where legislation often lags behind the industry and its capabilities.

Moreover, who decides what is ethical varies by time, culture and power dynamics. Complying with the strict letter of a law meant to cover everyone does not take into account that companies in different industries use data differently. Companies are trying to fit into a framework without even answering the question of which framework they should voluntarily comply with. I can hear you now: &Thateasy! The one with the highest/strongest/strictest standard for collection.& These are all adjectives that get thrown around when talking about a federal privacy law. However, &highest,& &most,& and &strongest,& are all subjective and do not live in a vacuum, especially if states start coming out with their own patchwork of privacy laws.

I&m sure there are people that say that Massachusetts — which prohibits a company from providing any details to an impacted consumer — offers the &most& consumer protection, while there is a camp that believes providing as much detailed information as possible — like California and its sample template — provides the &most& protection. Who is right? This does not even take into account that data collection can happen across multiple states. In those instances, which law would cover that individual?

Government agencies can&t currently provide sufficient oversight

Slapping a certification onto your website that you know you don&t meet has been treated as an unfair and deceptive practice by the FTC. However,the FTCgenerally does not have fining authority on a first-time violation. And while it can force companies to compensate consumers, damages can be very difficult to calculate. Unfortunately, damages for privacy violations are even harder to prove in court; funds that are obtained go disproportionately to counsel, with each individual receiving a de minimis payout, if they even make it to court. The Supreme Court has indicated through their holdings in Clapper v. Amnesty Intern., USA. 133 S. Ct. 1138 (2013), andSpokeo, Inc. v. Robins,136 S. Ct. 1540 (2016), that damages like the potential of fraud or ramifications form data loss or misuse are too speculative to have standing to maintain a lawsuit.

This puts the FTC in a weaker negotiating position to get results with as few resources expended as possible, particularly as the FTC can only do so much — it has limited jurisdiction and no control over banks or nonprofits. To echo Commissioner Noah Phillips, this won&t change without a federal privacy law that sets clear limits on data use and damages and gives the FTC greater power to enforce these limits in litigation.

Finally, in addition to these legal constraints, the FTC is understaffed in privacy, with approximately40 full-time staff members dedicated to protecting the privacy of more than 320 million Americans. To adequately police privacy, the FTC needs more lawyers, more investigators, more technologists and state-of-the-art tech tools. Otherwise, it will continue to fund certain investigations at the cost of understaffing others.

Outsourcing oversight to a private company may not fare any better — for the simple fact that such certification will come at a high price (especially in the beginning), leaving medium and small-sized businesses at a competitive disadvantage. Further, unlike a companyprivacy professionals and legal team, a certification firm is more likely to look to compliance with the letter of the law — putting form over substance — instead of addressing the nuances of any particular business& data use models.

Existing remedies don&t address consumer harms

Say an agency does come down with an enforcement action, the types of penalty powers that those agencies have currently do not adequately address the consumer harm. That is largely because compliance with a privacy legislation is not an on-off switch and the current regime is focused more on financial restitution. Even where there are prescribed actions to come into compliance with the law, that compliance takes years and does not address the ramifications of historic non-compliant data use.

Take CNILformal notice against Vectuary for failing to collect informed, affirmative consent. Vectuary collected geolocation data from mobile app users to provide marketing services to retailers using a consent management platform that it developed implementing the IAB (a self-regulating association) Transparency and Consent Framework. This notice warrants particular attention because Vectuary was following an established trade association guideline, and yet its consent was deemed invalid.

As a result, CNIL put Vectuary on notice to cease processing data this way and to delete data collected during that period. And while this can be counted as a victory because the decision forced the company to rebuild their systems — how many companies would have the budget to do this, if they didn&t have the resources to comply in the first place? Further, this will take time, so what happens to their business model in the meantime? Can they continue to be non-compliant, in theory until the agency-set deadline for compliance is met? Even if the underlying data is deleted — none of the parties they shared the data with or the inferences they built on it were impacted.

The water is even murkier when you&re examining remedies for false Privacy Shield self-certification. A Privacy Shield logo on a companysite essentially says that the company believes that its cross-border data transfers are adequately secured and the transfers are limited to parties the company believes has responsible data practices. So if a company is found to have falsely made those underlying representations (or failed to comply with another requirement), they would have to stop conducting those transfers and if that is part of how their services are provided, do they just have to stop providing those services to their customers immediately?

It seems in practice that choosing not to comply with an otherwise inapplicable law is not a matter of not caring about your customers or about moral failings, it is quite literally just ¬ how anything works,& nor is there any added consumer benefit in trying to — and isn&t that what counts in the end — consumers?

Opinions expressed in this article are those of the author and not of her firm, investors, clients or others.

Now that the final technology IPOs of 2019 have touched down, ita good time to start looking back at what happened during the year. We&re hunting for trends as the clock winds down. Hereone thatobvious: Hardware startups are still struggling.

Itcliché to note in startupland that hardware is hard. Everyone knows it. Making hardware is difficult by itself, but as all tech hardware requires software, hardware shops wind up needing wider domain expertise than pure-software startups. And thathard.

But even if a nuts-and-bolts tech company hits scale, it seems difficult to keep that momentum up.

This year we saw Peloton, a hybrid hardware and digital services company, go public and struggle. Despite a recent public market resurgence, the company is slipping back toward its IPO price. Today its equity is trading down about 6% to around $30 per share. The companyIPO price of $29 is uncomfortably close to its current value.

2019IPO crop also included EHang, a late entry to the market (more here on its debut) that quickly began to lose altitude after it started to float. EHang traded up today, but the firm is still worth less than its IPO valuation, a reduced figure that was dinged during the China-based drone companymarch toward the public markets.

So, Peloton is about flat and EHang is down. Thatnot a great mix of results for a yearIPO class of hardware companies. Looking back in time, things don&t get much better.

NIO, a China-based electric car company (despite making this thing of beauty), has deleted about two-thirds of its value since its late-2018 U.S.-listed IPO. After going public at $6.25, shares of NIO are worth just $2.70 today.

Sonos also went public in the United States in 2018. It traded above its IPO price of $15 at first. Then it fell under $10 per share as 2018 came to a close. The smart speaker and stereo company spent 2019 recovering. Itnow worth its IPO price again, closing trading today worth about $14.80 per share.

If you go back to 2017, however, Roku has kicked ass. After pricing at $14 per share, the TV hardware and digital services firm is trading for $137 per share, a nearly 10x gain. But Roku was moving away from hardware at the time of its IPO, making it a somewhat poor example. Hardware revenues for Roku were just 31% of revenue in its most recent quarter, for example. That figure was 42% in the year-ago quarter. It will continue to fall.

We don&t need to go over what happened to Fitbit and GoPro, I don&t think.

Hardware can make a lot of money. Samsung and Apple make oceans of money from their hardware. Microsoft has managed to make Surface into a real business, with billions of dollars in yearly revenue. Amazon has a big hardware business with both consumer reading gadgets and consumer surveillance devices. Even Google is taking its new phone seriously enough to buy out a chunk of the NBAad slots (I think itthis one), according to my extensive in-market testing. Facebook is the laggard of the group.

But for smaller hardware companies going public, unless I&m missing a number of recent of IPOs — and I don&t think that I am — ita tough world out there.

F5 got an expensive holiday present today, snagging startup Shape Security for approximately $1 billion.

What the networking company gets with a shiny red ribbon is a security product that helps stop automated attacks like credential stuffing. In an article earlier this year, Shape CTO Shuman Ghosemajumder explained what the company does:

We&re an enterprise-focused company that protects the majority of large U.S. banks, the majority of the largest airlines, similar kinds of profiles with major retailers, hotel chains, government agencies and so on. We specifically protect them against automated fraud and abuse on their consumer-facing applications — their websites and their mobile apps.

F5 president and CEO François Locoh-Donou sees a way to protect his customers in a comprehensive way. &With Shape, we will deliver end-to-end application protection, which means revenue generating, brand-anchoring applications are protected from the point at which they are created through to the point where consumers interact with them—from code to customer,& Locoh-Donou said in a statement.

As for Shape, CEO Derek Smith said that it wasn&t a huge coincidence that F5 was the buyer, given his company was seeing F5 consistently in its customers. Now they can work together as a single platform.

Shape launched in 2011 and raised $183 million, according to Crunchbase data. Investors included Kleiner Perkins, Tomorrow Partners, Norwest Venture Partners, Baseline Ventures and C5 Capital. In its most recent round in September, the company raised $51 million on a valuation of $1 billion.

F5 has been in a spending mood this year. It also acquired NGINX in March for $670 million. NGINX is the commercial company behind the open-source web server of the same name. Itworth noting that prior to that, F5 had not made an acquisition since 2014.

It was a big year in security M-A. Consider that in June, four security companies sold in one three-day period. That included Insight Partners buying Recorded Future for $780 million and FireEye buying Verodin for $250 million. Palo Alto Networks bought two companies in the period: Twistlock for $400 million and PureSec for between $60 and $70 million.

This deal is expected to close in mid-2020, and is of course, subject to standard regulatory approval. Upon closing ShapeSmith will join the F5 management team and Shape employees will be folded into F5. The company will remain in its Santa Clara headquarters.