Law Commons^™

Privacy Nicks: How The Law Normalizes Surveillance, Woodrow Hartzog, Evan Selinger, Johanna Gunawan

Faculty Scholarship

Privacy law is failing to protect individuals from being watched and exposed, despite stronger surveillance and data protection rules. The problem is that our rules look to social norms to set thresholds for privacy violations, but people can get used to being observed. In this article, we argue that by ignoring de minimis privacy encroachments, the law is complicit in normalizing surveillance. Privacy law helps acclimate people to being watched by ignoring smaller, more frequent, and more mundane privacy diminutions. We call these reductions “privacy nicks,” like the proverbial “thousand cuts” that lead to death.

Privacy nicks come from the …

Brief Of Amici Curiae Privacy And First Amendment Law Professors In Support Of Defendant-Appellant And Reversal, G. S. Hans, Hannah Bloch-Wehba, Danielle K. Citron, Julie E. Cohen, Mary Anne Franks, Woodrow Hartzog, Margot E. Kaminski, Gregory P. Magarian, Frank Pasquale, Neil Richards, Daniel J. Solove

Faculty Scholarship

STATEMENT OF INTEREST: Amici curiae are law professors and scholars of data privacy, constitutional law, and the First Amendment. Amici write to provide the court with scholarly expertise on the complexities of data privacy law and its intersection with the First Amendment. Amici have collectively written scores of academic articles and multiple books on data privacy, technology, the First Amendment, and constitutional challenges to state and federal privacy regulation.

Amici submit this brief pursuant to Fed. Rule App. P. 29(a) and do not repeat arguments made by the parties. No party’s counsel authored this brief, or any part of …

Continuous Reproductive Surveillance, Michael Ulrich, Leah R. Fowler

Faculty Scholarship

The Dobbs opinion emphasizes that the state’s interest in the fetus extends to “all stages of development.” This essay briefly explores whether state legislators, agencies, and courts could use the “all stages of development” language to expand reproductive surveillance by using novel developments in consumer health technologies to augment those efforts.

National Telecommunications And Information Administration: Comments From Researchers At Boston University And The University Of Chicago, Ran Canetti, Aloni Cohen, Chris Conley, Mark Crovella, Stacey Dogan, Marco Gaboardi, Woodrow Hartzog, Rory Van Loo, Christopher Robertson, Katharine B. Silbaugh

Faculty Scholarship

These comments were composed by an interdisciplinary group of legal, computer science, and data science faculty and researchers at Boston University and the University of Chicago. This group collaborates on research projects that grapple with the legal, policy, and ethical implications of the use of algorithms and digital innovation in general, and more specifically regarding the use of online platforms, machine learning algorithms for classification, prediction, and decision making, and generative AI. Specific areas of expertise include the functionality and impact of recommendation systems; the development of Privacy Enhancing Technologies (PETs) and their relationship to privacy and data security laws; …

Femtechnodystopia, Leah R. Fowler, Michael Ulrich

Faculty Scholarship

Reproductive rights, as we have long understood them, are dead. But at the same time history seems to be moving backward, technology moves relentlessly forward. Femtech products, a category of consumer technology addressing an array of “female” health needs, seem poised to fill gaps created by states and stakeholders eager to limit birth control and abortion access and increase pregnancy surveillance and fetal rights. Period and fertility tracking applications could supplement or replace other contraception. Early digital alerts to missed periods can improve the chances of obtaining a legal abortion in states with ever-shrinking windows of availability or prompt behavioral …

Four Privacy Stories And Two Hard Cases, A Comment On Skinner-Thompson's Privacy At The Margins, Jessica Silbey

Faculty Scholarship

Scott Skinner-Thompson's new book, Privacy at the Margins, is what I would call a "fourth-generation" study of privacy law. Privacy's contours and justifications have been debated over the course of the twentieth century, first to establish it as a matter deserving legal protection (roughly the first half of the twentieth century), ² then to iterate its various common law and constitutional variations (starting in the 1960s), ³ and since the computer and internet revolution of the 1990s, to reevaluate privacy's growing importance but waning presence in the digitally-networked age.⁴ The third-generation of privacy scholarship has been a fast-growing area …

Pov: What Rights Could Unravel Next, In Light Of Draft Opinion By Scotus Overturning Roe V. Wade, Robert L. Tsai

Shorter Faculty Works

Beyond what Alito’s draft opinion in Dobbs v. Jackson Women’s Health Organization portends for the future of abortion rights is the striking method of analysis he employs in the reported draft. Despite his many efforts to reassure that the opinion “does not undermine” other constitutional rights “in any way,” it actually outlines a roadmap for the withdrawal of other cherished constitutional rights.

Is The End Of Roe V. Wade Near? Leaked Scotus Brief Says Yes, Nicole Huberfeld, Linda C. Mcclain

Shorter Faculty Works

Protesters on both sides of the abortion debate descended on the US Supreme Court Monday night and into Tuesday after a leaked secret draft of a US Supreme Court opinion indicated that a majority of justices support overturning Roe v. Wade, after almost 50 years of legalized abortion rights in America. If finalized, possibly as soon as this summer, the bombshell could trigger a cultural tsunami across American life, forcing some women to travel to another state for an abortion and putting the divisive issue at the heart of the fall midterm elections.

The Surprising Virtues Of Data Loyalty, Woodrow Hartzog, Neil M. Richards

Faculty Scholarship

Lawmakers in the United States and Europe are seriously considering imposing duties of data loyalty that implement ideas from privacy law scholarship, but critics claim such duties are unnecessary, unworkable, overly individualistic, and indeterminately vague. This paper takes those criticisms seriously, and its analysis of them reveals that duties of data loyalty have surprising virtues. Loyalty, it turns out, can support collective well-being by embracing privacy’s relational turn; it can be a powerful state of mind for reenergizing privacy reform; it prioritizes human values rather than potentially empty formalism; and it offers solutions that are flexible and clear rather than …

Privacy Pretexts, Rory Van Loo

Faculty Scholarship

Data privacy’s ethos lies in protecting the individual from institutions. Increasingly, however, institutions are deploying privacy arguments in ways that harm individuals. Platforms like Amazon, Facebook, and Google wall off information from competitors in the name of privacy. Financial institutions under investigation justify withholding files from the Consumer Financial Protection Bureau by saying they must protect sensitive customer data. In these and other ways, the private sector is exploiting privacy to avoid competition and accountability. This Article highlights the breadth of privacy pretexts and uncovers their moral structure. Like most pretexts, there is an element of truth to the claims. …

Legislating Data Loyalty, Woodrow Hartzog, Neil Richards

Faculty Scholarship

Lawmakers looking to embolden privacy law have begun to consider imposing duties of loyalty on organizations trusted with people’s data and online experiences. The idea behind loyalty is simple: organizations should not process data or design technologies that conflict with the best interests of trusting parties. But the logistics and implementation of data loyalty need to be developed if the concept is going to be capable of moving privacy law beyond its “notice and consent” roots to confront people’s vulnerabilities in their relationship with powerful data collectors.

In this short Essay, we propose a model for legislating data loyalty. Our …

A Duty Of Loyalty For Privacy Law, Neil M. Richards, Woodrow Hartzog

Faculty Scholarship

Data privacy law fails to stop companies from engaging in self-serving, opportunistic behavior at the expense of those who trust them with their data. This is a problem. Modern tech companies are so entrenched in our lives and have so much control over what we see and click that the self-dealing exploitation of people has become a major element of the internet’s business model.

Academics and policymakers have recently proposed a possible solution: require those entrusted with people’s data and online experiences to be loyal to those who trust them. But many have concerns about a duty of loyalty. What, …

What Is Privacy? That’S The Wrong Question, Woodrow Hartzog

Faculty Scholarship

Privacy has never had a precise meaning. But in the early 1900s, the concept took on new life as a term of art in legal frameworks. The result has been a bit of a mess, as no singular definition has been adequate for all purposes. Daniel Solove, perhaps the most influential privacy scholar of our day, wrote at the turn of the millennium that privacy was “a concept in disarray.”

In this short essay reflecting upon Solove’s impact on the modern study of information privacy, I argue that the chaos and futility of competing conceptualizations of privacy is why Solove’s …

The Case Of The Nosy Neighbors, Johanna Gunawan, Woodrow Hartzog

Faculty Scholarship

Inspired by companies like Clearview AI, Nextdoor, and Amazon, this case study asks students to assume the role of a high-ranking ethics-focused employee at a (fictional) neighborhood-focused social media company. It involves challenging ethical questions around how social media services and surveillance tools are built and used, and the complicated relationship between companies, their users, and law enforcement authorities. Students should pay particular attention to the values implicated by certain design decisions, and the competing incentives for corporations that might complicate the picture for ethical decision making.

The Covid-19 Pandemic And The Technology Trust Gap, Johanna Gunawan, David Choffnes, Woodrow Hartzog, Christo Wilson

Faculty Scholarship

Industry and government tried to use information technologies to respond to the COVID-19 pandemic, but using the internet as a tool for disease surveillance, public health messaging, and testing logistics turned out to be a disappointment. Why weren’t these efforts more effective? This Essay argues that industry and government efforts to leverage technology were doomed to fail because tech platforms have failed over the past few decades to make their tools trustworthy, and lawmakers have done little to hold these companies accountable. People cannot trust the interfaces they interact with, the devices they use, and the systems that power tech …

Privacy In Pandemic: Law, Technology, And Public Health In The Covid-19 Crisis, Tiffany Li

Faculty Scholarship

The COVID-19 pandemic has caused millions of deaths and disastrous consequences around the world, with lasting repercussions for every field of law, including privacy and technology. The unique characteristics of this pandemic have precipitated an increase in use of new technologies, including remote communications platforms, healthcare robots, and medical AI. Public and private actors are using new technologies, like heat sensing, and technologically-influenced programs, like contact tracing, alike in response, leading to a rise in government and corporate surveillance in sectors like healthcare, employment, education, and commerce. Advocates have raised the alarm for privacy and civil liberties violations, but the …

A New Compact For Sexual Privacy, Danielle K. Citron

Faculty Scholarship

Intimate life is under constant surveillance. Firms track people’s periods, hot flashes, abortions, sexual assaults, sex toy use, sexual fantasies, and nude photos. Individuals hardly appreciate the extent of the monitoring, and even if they did, little can be done to curtail it. What is big business for firms is a big risk for individuals. The handling of intimate data undermines the values that sexual privacy secures—autonomy, dignity, intimacy, and equality. It can imperil people’s job, housing, insurance, and other crucial opportunities. More often, women and minorities shoulder a disproportionate amount of the burden.

Privacy law is failing us. Our …

Privacy's Constitutional Moment And The Limits Of Data Protection, Woodrow Hartzog, Neil M. Richards

Faculty Scholarship

America’s privacy bill has come due. Since the dawn of the Internet, Congress has repeatedly failed to build a robust identity for American privacy law. But now both California and the European Union have forced Congress’s hand by passing the California Consumer Privacy Act (CCPA) and the General Data Protection Regulation (GDPR). These data protection frameworks, structured around principles for Fair Information Processing called the “FIPs,” have industry and privacy advocates alike clamoring for a “U.S. GDPR.” States seemed poised to blanket the country with FIP-based laws if Congress fails to act. The United States is thus in the midst …

Gdpr And The Importance Of Data To Ai Startups, James Bessen, Stephen Michael Impink, Lydia Reichensperger, Robert Seamans

Faculty Scholarship

What is the impact of the European Union’s General Data Protection Regime (“GDPR”) and data regulation on AI startups? How important is data to AI product development? We study these questions using unique survey data of commercial AI startups. AI startups rely on data for their product development. Given the scale and scope of their business models, these startups are particularly susceptible to policy changes impacting data collection, storage and use. We find that training data and frequent model refreshes are particularly important for AI startups that rely on neural nets and ensemble learning algorithms. We also find that firms …

Cyber Mobs, Disinformation, And Death Videos: The Internet As It Is (And As It Should Be), Danielle K. Citron

Faculty Scholarship

Fiction and visual representations can alter our understanding of human experiences and struggles. They help us understand human frailties and suffering in a visceral way. Nick Drnaso’s graphic novel Sabrina does that in spades. In Sabrina, a woman is murdered by a misogynist, and a video of her execution is leaked. Conspiracy theorists deem her murder a hoax. A cyber mob smears the woman’s loved ones as crisis actors, posts death threats, and spreads their personal information. The attacks continue until a shooting massacre redirects the cyber mob’s wrath to other mourners. Sabrina captures the breathtaking velocity of disinformation online …

The Internet As A Speech Machine And Other Myths Confounding Section 230 Reform, Danielle K. Citron, Mary Anne Franks

Faculty Scholarship

A robust public debate is currently underway about the responsibility of online platforms. We have long called for this discussion, but only recently has it been seriously taken up by legislators and the public. The debate begins with a basic question: should platforms should be responsible for user-generated content? If so, under what circumstances? What exactly would such responsibility look like? Under consideration is Section 230 of the Communications Decency Act—a provision originally designed to encourage tech companies to clean up “offensive” online content. The public discourse around Section 230, however, is riddled with misconceptions. As an initial matter, many …

Deep Fakes: A Looming Challenge For Privacy, Democracy, And National Security, Danielle K. Citron, Robert Chesney

Faculty Scholarship

Harmful lies are nothing new. But the ability to distort reality has taken an exponential leap forward with “deep fake” technology. This capability makes it possible to create audio and video of real people saying and doing things they never said or did. Machine learning techniques are escalating the technology’s sophistication, making deep fakes ever more realistic and increasingly resistant to detection. Deep-fake technology has characteristics that enable rapid and widespread diffusion, putting it into the hands of both sophisticated and unsophisticated actors. While deep-fake technology will bring with it certain benefits, it also will introduce many harms. The marketplace …

Why Sexual Privacy Matters For Trust, Danielle K. Citron

Faculty Scholarship

Every generation’s intimates have their preferred modes of self-disclosure. Not long ago, intimate partners exchanged love letters and mixed tapes. They spent hours on the phone. Today, they text their innermost thoughts, beliefs, and wishes, sometimes with nude photos attached. They engage in sexually-explicit activity via FaceTime and SnapChat.

Now, as then, the success and integrity of intimate relationships depends upon sexual privacy. Intimate relationships develop as partners grow to trust one another to treat their nakedness, deepest secrets, and sexual desires as they hope rather than as they fear. Handling partners’ personal information with discretion lays the foundation for …

The Missing Regulatory State: Monitoring Businesses In An Age Of Surveillance, Rory Van Loo

Faculty Scholarship

An irony of the information age is that the companies responsible for the most extensive surveillance of individuals in history—large platforms such as Amazon, Facebook, and Google—have themselves remained unusually shielded from being monitored by government regulators. But the legal literature on state information acquisition is dominated by the privacy problems of excess collection from individuals, not businesses. There has been little sustained attention to the problem of insufficient information collection from businesses. This Article articulates the administrative state’s normative framework for monitoring businesses and shows how that framework is increasingly in tension with privacy concerns. One emerging complication is …

When Law Frees Us To Speak, Danielle K. Citron, Jonathon Penney

Faculty Scholarship

A central aim of online abuse is to silence victims. That effort is as regrettable as it is successful. In the face of cyber harassment and sexual privacy invasions, women and marginalized groups retreat from online engagement. These documented chilling effects, however, are not inevitable. Beyond its deterrent function, law has an equally important expressive role. In this article, we highlight law’s capacity to shape social norms and behavior through education. We focus on a neglected dimension of law’s expressive role—its capacity to empower victims to express their truths and engage with others. Our argument is theoretical and empirical. We …

Sexual Privacy, Danielle K. Citron

Faculty Scholarship

Those who wish to control, expose, and damage the identities of individuals routinely do so by invading their privacy. People are secretly recorded in bedrooms and public bathrooms and “up their skirts.” Such images are used to coerce people into sharing nude photographs and filming sex acts under the threat of public disclosure. People’s nude images are posted online without permission. Machine-learning technology is used to create digitally manipulated “deep fake” sex videos that swap people’s faces into pornography.

Each of these abuses is an invasion of sexual privacy—the behaviors, expectations, and choices that manage access to and information about …

The Public Information Fallacy, Woodrow Hartzog

Faculty Scholarship

The concept of privacy in “public” information or acts is a perennial topic for debate. It has given privacy law fits. People struggle to reconcile the notion of protecting information that has been made public with traditional accounts of privacy. As a result, successfully labeling information as public often functions as a permission slip for surveillance and personal data practices. It has also given birth to a significant and persistent misconception — that public information is an established and objective concept.

In this article, I argue that the “no privacy in public” justification is misguided because nobody knows what “public” …

The Pathologies Of Digital Consent, Neil M. Richards, Woodrow Hartzog

Faculty Scholarship

Consent permeates both our law and our lives — especially in the digital context. Consent is the foundation of the relationships we have with search engines, social networks, commercial web sites, and any one of the dozens of other digitally mediated businesses we interact with regularly. We are frequently asked to consent to terms of service, privacy notices, the use of cookies, and so many other commercial practices. Consent is important, but it’s possible to have too much of a good thing. As a number of scholars have documented, while consent models permeate the digital consumer landscape, the practical conditions …

The Inconsentability Of Facial Surveillance, Evan Selinger, Woodrow Hartzog

Faculty Scholarship

Governments and companies often use consent to justify the use of facial recognition technologies for surveillance. Many proposals for regulating facial recognition technology incorporate consent rules as a way to protect those faces that are being tagged and tracked. But consent is a broken regulatory mechanism for facial surveillance. The individual risks of facial surveillance are impossibly opaque, and our collective autonomy and obscurity interests aren’t captured or served by individual decisions.

In this article, we argue that facial recognition technologies have a massive and likely fatal consent problem. We reconstruct some of Nancy Kim’s fundamental claims in Consentability: Consent …

Byrd V United States: Unauthorized Drivers Of Rental Cars Have Fourth Amendment Rights? Not As Evident As It Seems, Tracey Maclin

Faculty Scholarship

No discerning student of the Supreme Court would contend that Justice Anthony Kennedy broadly interpreted the Fourth Amendment during his thirty years on the Court. His majority opinions in Maryland v. King, Drayton v. United States and his willingness to join the three key sections of Justice Scalia’s opinion in Hudson v. Maryland, which held that suppression is never a remedy for knock-and-announce violations, are just a few examples of Justice Kennedy’s narrow view of the Fourth Amendment.

In light of his previous votes in search and seizure cases, surprisingly Justice Kennedy, in what would be his final Fourth Amendment …