Today, almost every aspect of our lives is in the hands of some third party somewhere. This challenges judgments about reasonable “expectations of privacy” that have been a major premise for defining the scope of U.S. privacy protection for over 100 years. But these judgments present binary choices under this analytic framework: if private information is somehow public or in the hands of a third party, people often are deemed to have no expectation of privacy. This is particularly true when it comes to government access to information—emails, for example, are nominally less protected under our laws once they have been stored 180 days or more, and articles and activities in plain sight are considered categorically available to government authorities. But the concept also gets applied to commercial data in terms and conditions of service and to the scraping of information on public websites.

So as the data universe keeps expanding, more and more of it falls outside the various specific laws on the books. This includes most of the data we generate through such widespread uses as web searches, social media, e-commerce, and smartphone apps. The changes are coming faster than legislation or regulatory rules can adapt, and they erase the sectoral boundaries (e.g., financial, medical) that have largely defined our current privacy laws. It makes little sense that protection of data should depend entirely on who happens to hold it. This arbitrariness will spread as more and more connected devices are embedded in everything from clothing to cars to home appliances to street furniture—the Internet of things.