> For example, GDPR cookie popups seem to have had that negative effect.

Yes, but I don't think it's limited to "visibly" negative user experiences. Not being able to sign a document in the browser using an HSM-backed hardware key because vendors won't add that functionality because some nut on the mailing list is concerned about "supercookies" also is, arguably, harmful to users because it deprives them of stronger security applications (that might also lead to a stronger tracking resistance stance nonetheless by nature of the ability to sign and encrypt messages at the application level) in pursuit of a fuzzy goal of never letting anybody have a stable identifier, ever. That seems, in the very least assuming the supercookie concern is legitimate and not a vendor play at retaining platform control, something that can only be decided individually by the user and not the browser vendor.

Another example is TLS 1.3. In order to have better privacy against unfriendly networks encrypted SNI pretty much kills content filtering at the last mile network level (can still do it on device, which is Apple's solution). This might be a great win for Joe who wants to browse Ashley Madison at the coffee shop away form prying eyes. But it's not great for parents who depend on content filtering solutions to help keep their kids safe on the internet. So, who really, is a technology like that harming?

> To dodge the risk of opening a can-o-worms I don't have time for on a Monday morning I'll just say watch for the chapter "Harms" in Ethics for Hackers when it's out, or ping me a PM if you fancy being a proofreader for that chapter.

I emailed you via book2021@.

This, though, is really the crux of it for me (sorry I rambled about a bunch of peripheral things). It seems that ethically the idea of "remembering a customer to draw inferences about how they'd behave" is rather natural to how humans operate. Historically, I can't even tell you I don't want you to do that because how I conduct myself in public is, well, public. So on the individual scale I think a lot of literature needs to be developed around building an understanding of what exactly is wrong, regarding profiling in public, to do without a person's consent. Is it wrong to write down someone's name, for instance? Is it harmful to be so good at profiling someone based on immediately available information that you might learn some things about someone even they didn't really care to discover? It certainly seems invasive from a user perspective but then again so would a good shaman, psychic, magician, or psychologist who build careers on playing the statics and profiling games. In short, I totally agree that these things are very often unwanted. But I don't think I've made the jump to them being broadly ethically harmful on an individual level, yet.

At scale is where I see these problems becoming much more obviously harmful. If you can track an entire population you might also have the tools to influence an that population. If you're influencing them in a harmful way then that probably constitutes as ethically harmful. Perhaps we need to figure out how to limit or separate these powers at a global level. Maybe tracking firms should not be allow to sell information to political organizations? Maybe they should all just be shut down?

Anyway if you get time to further develop that point I'm all ears as ethics, especially in computer science is fascinating.