It should be illegal to collect and permanently store most kinds of behavioral data.

In the United States, they warn us the world will end if someone tries to regulate the Internet. It's good regulation, not lack of regulation, that kept the web healthy.

Here's one idea for where to begin:

1. Limit what kind of behavioral data websites can store. When I say behavioral data, I mean the kinds of things computers notice about you in passing—your search history, what you click on, what cell tower you're using.

2. Limit how long they can keep it. Maybe three months, six months, three years. I don't really care, as long as it's not fifty years, or forever. Make the time scale for deleting behavioral data similar to the half-life of a typical Internet business.

3. Limit what they can share with third parties. This limit should also apply in the event of bankruptcy, or acquisition. Make people's data non-transferable without their consent.

4. Enforce the right to download. If a website collects information about me, I should be allowed to see it.

5. Enforce the right to delete. I should be able to delete my account and leave no trace in your system.

6. Make the protections apply to everyone, not just people in the same jurisdiction as the regulated site. It shouldn't matter what country someone is visiting your site from. Keep it a world-wide web.