There are not enough qualified, genuinely independent auditors to review every company that trips an automatic trigger. Demand would spike, prices would follow, and the cost lands on users through higher prices or on startups through another compliance bill they cannot afford. The biggest firms would simply buy up audit capacity, recreating the cozy auditor-client relationship the proposal claims to fix. Meanwhile the actual harm, data already sold to brokers, cannot be unaudited; you cannot unring that bell, as the deletion and ban remedies in the Outlogic settlement implicitly admitted. Spend the money on banning the sale of precise location data outright. An audit industry is a jobs program, not a privacy fix.
Should location privacy violations trigger automatic independent audits?
One AGAINST case in this debate
Discussion (4)
Strongly disagree that audits are the answer at all. You cannot audit back data that was already sold to brokers. Ban the sale of precise location data outright and the audit question becomes moot.
An outright ban sounds clean but would kill legitimate uses like fraud detection and emergency services. Audits at least distinguish good handling from bad, which a blanket ban never does.
The auditor shortage is a genuine bottleneck. We already see it in financial audits, where a handful of firms dominate. Mandate audits for every location violation and you create a seller's market that big tech will simply buy up.
Shortages get solved by demand. A guaranteed market for independent auditors would train and certify thousands of them within a few years. That is how every compliance industry was born.