It’s a premise of arguments for privacy legislation that such legislation would protect hapless consumers against the depredations of “Big Tech.” There’s more to the story.

In Europe, often characterized as “ahead” of the United States thanks to the General Data Protection Regulation (GDPR), privacy enforcements fall with notable regularity on the little guy. In a recent law review article, University of Washington School of Law Professor Mary D. Fan highlights the consistency with which privacy enforcement actions are directed at relatively weak parties, particularly minority small businesspeople.