Digital media firms have long argued against privacy regulation asserting that regulators don’t understand the ways they work, that digital firms have strong incentives to protect the privacy of users, and that the firms do so through self-regulation. Unfortunately, for years we have witnessed major digital players continually apologizing for their lapses in protecting the privacy of their customers, often violating their own policies and promises, and for not ensuring that others with whom they do business protect the privacy of the data they access and use. There has been a constant failure to put their customers’ privacy interests first and digital companies have dismissed criticism and call for regulation as misguided or perilous. The regulations that have appeared, such as the European Union's General Data Protection Regulation (GDPR), have improved transparency and the abilities to control how some of their personal information is used, but is doing little to control the ma...