> This makes a lot of sense

I don't think it does, because it is completely unverifiable. It's like allowing people to buy drugs, but not to use them.

I'm not worried about people collecting IPs, I'm worried about people who collect IPs being able to send those IPs out and get them associated with names, and send those names out and be supplied with dossiers.

When they start putting collecting IPs in the same bag as the rest of this, it's because they're just trying to legitimize this entire process. Collecting dossiers becomes traffic shaping, and of course people should be allowed to traffic shape - you could be getting DDOSed by terrorists!

edit: I'm not sure this comment was quite clear - it's 1) the selling of private, incidentally collected information by service providers, and 2) the accumulation, buying, and selling of dossiers on normal people whom one has no business relationship that is the problem. IPs are just temporary identifiers, unless you can resolve them through what are essentially civilian intelligence organizations.

Having someone else pick up (IE buy) your prescription is legal and commonplace for obvious reasons. https://legalclarity.org/can-someone-else-pick-up-my-prescri...

Thus I’m regularly allowed to buy drugs I’m not legally allowed to use. “Using a prescription medication that was not prescribed to you is illegal under both federal and state laws.” https://legalclarity.org/is-it-illegal-to-use-someone-elses-...

Don't the industry-imposed rules for handling credit cards work that way (restricting use of data you already have) though?

Like, I thought a big part of why some stores do loyalty cards is because they enable tracking things that they'd get their credit card privileges revoked if they tracked that way.

>It's like allowing people to buy drugs, but not to use them.

Well, since you mention it: I have prescription drugs that I am allowed to buy, but I am NOT allowed to abuse them. I must take exactly 1 each day.

> 1) the selling of private, incidentally collected information by service providers, and 2) the accumulation, buying, and selling of dossiers on normal people whom one has no business relationship that is the problem.

But this is exactly what is covered - incidentally collected information cannot be used for other purposes. That's rather the point - you must collect things for a specific use case and you can't use it without permission for other cases.

> I don't think it does, because it is completely unverifiable.

It's no less verifiable than "don't collect the data", and hiding it requires increasingly larger conspiracies the larger organisation you are looking at. People are capable of committing crimes though, sure.