In the old days, when you trekked to a store to buy a book or magazine with cash, there was no permanent record of the purchase. But in the Internet age, with every book, magazine and DVD just a few clicks (and a credit card number) away, virtually anything you buy online is recorded — and sellers often keep the information permanently (or sell it to third parties). That's bad enough, but what if the government tried to get its hands on that personal data? In fact, the state of North Carolina has been trying to do just that. It's been on a disturbing campaign to force Amazon.com to give it detailed records on which First Amendment–protected products its residents have bought online. Last week, a federal court said no in an important win for online-privacy rights — but more remains to be done.
The court case stems from a war over sales taxes between North Carolina and Amazon. The North Carolina tax department says Amazon failed to collect sales taxes on about 50 million transactions with North Carolinians between 2003 and early 2010. As part of a tax audit, North Carolina asked the e-commerce giant to provide, for that time period, "all information for all sales to customers with a North Carolina shipping address."
Amazon partially complied, turning over a lot of records, but it held back data that would allow the state to connect individual customers with the specific items they purchased. North Carolina came back with a demand for more and different data, and Amazon sued in federal court in Washington State, arguing that the state's demands violate the First Amendment and privacy laws. The federal district court rightly ruled that North Carolina's actions violated the First Amendment as well as certain provisions of the Video Privacy Protection Act, the 1988 law that prevents unauthorized disclosure of video-sale records. The court warned that if North Carolina were able to get individualized information about Amazon customers, it would have a chilling effect on their decisions about what to buy.
After all, people purchase lots of things from Amazon that they may not want the government to know about. The American Civil Liberties Union (ACLU), which joined the lawsuit on behalf of individual Amazon customers, gave some examples: books that criticize the government or powerful elected officials; books that could reveal personal information about the buyer, with titles like Bipolar Disorder: A Guide for Patients and Families or Outing Yourself: How to Come Out as Lesbian or Gay to Your Family, Friends, and Coworkers; and products that may convey controversial or personal information about the buyer, such as Confederate flags, rainbow flags, condoms or sex toys.
One of the ACLU's anonymous clients — an atheist who happens to work with a lot of religious people — does not want Amazon to reveal that she bought the books God Is Not Great: How Religion Poisons Everything and The God Delusion. Another client does not want Amazon to reveal that it shipped her books that are critical of the President, including Obama Zombies: How the Liberal Machine Brainwashed My Generation.
The First Amendment protects Americans' rights to read what they wish — without the prying eyes of the government looking over their shoulder. The founders understood how important anonymity is to free speech: they wrote some of their most important essays arguing for ratification of the Constitution under the pseudonym Publius.
The Supreme Court has recognized the role that anonymity plays as a "shield from the tyranny of the majority." In Lamont v. Postmaster General, a case from 1965, the court struck down on First Amendment grounds a postal regulation that required recipients of "communist political propaganda" to file a request with the postmaster before it could be delivered.
The postal regulation challenged in Lamont feels archaic today. But North Carolina's attempt to strip away anonymity from Amazon customers contains precisely the same dangers. As Justice William O. Douglas observed in 1953, "If the lady from Toledo can be required to disclose what she read yesterday and what she will read tomorrow, fear will take the place of freedom in the libraries, bookstores, and homes of the land."
It is good that a federal court slapped down North Carolina last week, but it is not enough. The real problem is that online retailers are assembling so much data about people, without their active consent — and generally without their knowledge. If a bookstore insisted that you provide your name and address every time you bought a book or a magazine with cash, you would no doubt find it odd — and offensive. But that is precisely what online retailers do. As a result, they end up with vast stores of information about you — which the government may be able to get simply by asking for it with a subpoena.
To prevent that kind of governmental intrusion, Internet retailers should give customers more direct control over their personal data. At the end of every transaction, they should ask the user if they want a record kept — or if they want the information to be erased. They should give customers ongoing control over what data is stored about them — and let them delete whatever they want.
Internet companies are unlikely to do this voluntarily — this sort of marketing data is just too valuable. Which means that ultimately it's up to Congress to step in and pass strong consumer-privacy protections. There are many advantages to online shopping. Customers should be able to enjoy them without having to give up their privacy to private companies — or the government. It's too high a price to pay, no matter how tempting the bargains or discounts are.
Cohen, a lawyer, is a former TIME writer and a former member of the New York Times editorial board. Case Study, his legal column for TIME.com, appears every Wednesday.