Private Law Theory

ABSTRACT
The normative framework that presently governs website privacy practices did not originate in any single international instrument or coordinated global legislative initiative. Rather, it comprises a constellation of interlocking obligations — prior consent to non-essential tracking, transparent privacy notices, identification of the controller, enforceable rights of access and erasure, breach notification duties, purpose-limited retention, safeguards for cross-border transfers, and claims to extraterritorial application — that have coalesced through a combination of technical self-regulation, national constitutional traditions, and successive waves of legislative diffusion.

Their origins are mixed: some evolved as internal practices of the internet itself (operator identification through WHOIS, privacy notices through industry self-regulation such as TRUSTe and BBBOnline, security contacts through RFC conventions, and cookie consent mechanisms through early browser implementations), while others originated as national or subnational legislation grounded in constitutional protections of individual rights and were subsequently adopted across jurisdictions through legal transplants and convergence around shared constitutional values. Over two decades, these internet-level norms — regardless of their origin — were adopted into national legislation across more than thirty jurisdictions, producing an unusual case of bottom-up international legal unification. This article traces that trajectory by surveying the EU, UK, Switzerland, US, Canada, Brazil, South Korea, and India — across three operational dimensions: consent models, enforcement and penalties, and the combined problem of territorial scope and cross-border transfers. It documents a substantial common core and identifies three bounded areas of genuine divergence. It then argues that because several of these norms have infrastructural or operational roots, and because others can be translated into implementation-layer commitments, their implementation can be shifted from the current site-by-site model — which empirical research shows to be ineffective and burdensome — to the level of internet infrastructure itself: a single contractual disclosure at the point of internet access for users, and a set of commitments verified at the point of domain registration for operators. This does not make access providers or domain registrars substantive privacy regulators; it treats them only as infrastructure points at which standardized operator commitments can be recorded and made visible. For purposes of institutional redesign, the article distinguishes seven implementation-layer norms: consent to non-essential tracking, accurate operator/contact information, privacy notice, rights-response workflow, breach-notification capacity, retention limits/deletion routines, and transfer safeguards together with extraterritorial acknowledgment. Six of these seven implementation-layer norms — accurate operator/contact information, privacy notice, rights-response workflow, breach-notification capacity, retention limits/deletion routines, and transfer safeguards together with extraterritorial acknowledgment — do not depend on an individualised act of user consent and can be relocated to the infrastructure layer without change to their content. The seventh implementation-layer norm — consent to non-essential tracking — is different in kind: empirical evidence shows that the current per-site consent mechanism often fails to generate meaningful user choice, and this article argues for replacing it, not merely relocating it, with a single honest disclosure at the point of infrastructure access.

Osovsky, Maxim, Common Privacy Norms for Websites: Origins, Convergence, and Institutional Redesign (August 23, 2026).