I didn't say that small business owners are lazy. They certainly aren't. I said that business practices where you are not getting consumers' consent post the law are lazy, and using old lists or buying lists that have no relation to your consumer base is a prohibitive practice, and that's what's lazy.
What should be the optimal environment, privacy versus business, is really at the base of your question, I think. The difficulty always faced when you're a legislator is trying to balance that public interest as expressed by different groups, and so business is quite right to say they want to just do business and we can trust them. The trouble is that we had 10 years of getting to this law, and it was pretty obvious you couldn't trust business because of the group send, if you will. There were so many businesses trying to reach people that the overall tsunami effect on consumers was just too much. When it gets malware and other bad payloads mixed in with unsolicited commercial messages, it's a stew that's just impossible for the consumer to manage at the consumer end.
I didn't mean to imply that commerce is bad, as I said. We think that, if consumers are in control, they'll receive the messages they want, they'll buy the products they want, and two years after a contract ends is a pretty long tail to be able to continue to try to entice that customer back to do business with you.