There’s no need to start from scratch. In 2012, President Barack Obama proposed a privacy bill of rights that included many ideas for giving people more control over their information, making data collection more transparent and putting limits on what business can do with the information they collect. The bill of rights fizzled out when Congress showed little appetite for it. But the European Union has used a similar approach in developing its General Data Protection Regulation, which goes into effect on May 25.

The new European rules are not perfect — they include the so-called right to be forgotten, which allows people to ask companies to delete personal information that they no longer wish to share. That could be implemented in ways that limit free speech. But the Europeans have made progress toward addressing some of the problems that have recently been highlighted in the United States. For instance, their laws require companies to seek consent before collecting sensitive personal information, to make the request understandable, and to give users an easy way to opt in to sharing such data, rather than forcing them to opt out if they don’t want to be tracked. Further, companies that want to collect data about Europeans will have to be upfront about how they use personal data, and they cannot collect more information than they need to provide the services they are offering. The Obama bill of rights included a similar concept, saying that personal information should only be used in “ways that are consistent with the context in which consumers provide the data.”