Consumer Protection Law Commons^™

Data Rights For Workers, Pauline Kim, Rachel Leavitt

Scholarship@WashULaw

Workers are subject to immense amounts of data collection on the job, and the algorithmic management tools built with that data can produce negative effects, including deskilling jobs, unstable work hours, reduced wages, and dangerous and degrading working conditions. Workers thus have significant interests how their data are collected and used, and yet they have been excluded from nearly all the recently enacted or proposed data protection laws. Their exclusion stems from data protection’s roots in privacy law and theory, which primarily focused on consumers as data subjects. Current data protection laws, even if expanded to cover workers, would provide …

Dark Patterns In The Opt-Out Process And Compliance With The California Consumer Privacy Act (Ccpa), Jens Frankenreiter, Van Hong Tran, Aarushi Mehrotra, Ranya Sharma, Marshini Chetty, Nick Feamster, Lior Strahilevitz

Scholarship@WashULaw

To protect consumer privacy, the California Consumer Privacy Act (CCPA) mandates that businesses provide consumers with a straightforward way to opt out of the sale and sharing of their personal information. However, the control that businesses enjoy over the opt-out process allows them to impose hurdles on consumers aiming to opt out, including by employing dark patterns. Motivated by the enactment of the California Privacy Rights Act (CPRA), which strengthens the CCPA and explicitly forbids certain dark patterns in the opt-out process, we investigate how dark patterns are used in opt-out processes and assess their compliance with CCPA regulations. Our …

Against Engagement, Neil M. Richards, Woodrow Hartzog

Scholarship@WashULaw

In this Article, we focus on a key dimension of commercial surveillance by data-intensive digital platforms that is too often treated as a supporting cast member instead of a star of the show: the concept of engagement. Engagement is, simply put, a measure of time, attention, and other interactions with a service. The economic logic of engagement is simple: more engagement equals more ads watched equals more revenue. Engagement is a lucrative digital business model, but it is problematic in several ways that lurk beneath the happy sloganeering of a “free” internet.

Our goal in this Article is to isolate …

Antitrust, Amazon, And Algorithmic Auditing, Jens Frankenreiter, Abhisek Dash, Abhijnan Chakraborty, Saptarshi Ghosh, Animesh Mukherjee, Stefan Bechtold, Krishna P. Gummadi

Scholarship@WashULaw

In digital markets, antitrust law and special regulations aim to ensure that markets remain competitive despite the dominating role that digital platforms play today in everyone's life. Unlike traditional markets, market participant behavior is easily observable in these markets. We present a series of empirical investigations into the extent to which Amazon engages in practices that are typically described as self-preferencing. We discuss how the computer science tools used in this paper can be used in a regulatory environment that is based on algorithmic auditing and requires regulating digital markets at scale.

Measuring Compliance With The California Consumer Privacy Act Over Space And Time, Jens Frankenreiter, Van Tran, Aarushi Mehrotra, Marshini Chetty, Nick Feamster, Lior Strahilevitz

Scholarship@WashULaw

The widespread sharing of consumers personal information with third parties raises significant privacy concerns. The California Consumer Privacy Act (CCPA) mandates that online businesses offer consumers the option to opt out of the sale and sharing of personal information. Our study automatically tracks the presence of the opt-out link longitudinally across multiple states after the California Privacy Rights Act (CPRA) went into effect. We categorize websites based on whether they are subject to CCPA and investigate cases of potential non-compliance. We find a number of websites that implement the opt-out link early and across all examined states but also find …

Contract-Wrapped Property, Danielle D'Onfro

Scholarship@WashULaw

For nearly two centuries, the law has allowed servitudes that “run with” real property while consistently refusing to permit servitudes attached to personal property. That is, owners of land can establish new, specific requirements for the property that bind all future owners—but owners of chattels cannot. In recent decades, however, firms have increasingly begun relying on contract provisions that purport to bind future owners of chattels. These developments began in the context of software licensing, but they have started to migrate to chattels not encumbered by software. Courts encountering these provisions have mostly missed their significance, focusing instead on questions …

Comments Of The Cordell Institute On Ai Accountability, Neil M. Richards, Woodrow Hartzog, Jordan Francis

Scholarship@WashULaw

These comments are a response to the National Telecommunications and Information Administration's 2023 request for comment on AI accountability (AI Accountability RFC, NTIA–2023–0005).

Responding to NTIA’s recent inquiry into AI assurance and accountability, we offer two main arguments regarding the importance of substantive legal protections. First, a myopic focus on concepts of transparency, bias mitigation, and ethics (for which procedural compliance efforts such as audits, assessments, and certifications are proxies) is insufficient when it comes to the design and implementation of accountable AI systems. We call rules built around transparency and bias mitigation “AI half-measures,” because they provide the appearance …

A Concrete Proposal For Data Loyalty, Neil M. Richards, Woodrow Hartzog, Jordan Francis

Scholarship@WashULaw

Congress and state legislators are finally experimenting with new privacy frameworks, rights, and duties to move past the thoroughly critiqued “notice and choice” model for data privacy. While many new privacy proposals seek a more fortified version of the fair information practices, some legislators have placed a duty of data loyalty at the heart of their proposed privacy bills. This is important because a duty of data loyalty has the potential to anchor American privacy law in a way analogous to how the European Union approach is grounded in fundamental rights of privacy and data protection.

Unfortunately, there remains some …

Understanding American Privacy, Neil M. Richards, Andrew B. Serwin, Tyler Blake

Scholarship@WashULaw

This Article is an explanation of some of the key features of American privacy law for a general audience. In particular, it tries to explain American privacy law against the critique that because the US currently lacks a European-style privacy law, the United States lacks much in the way of privacy law. We argue that the lack of a European-style data protection law in the United States is not the end of the analysis. This article therefore offers a basic roadmap to American privacy law for the uninitiated. In order to understand American privacy, we believe that it is important …

The Surprising Virtues Of Data Loyalty, Neil M. Richards, Woodrow Hartzog

Scholarship@WashULaw

Lawmakers in the United States and Europe are seriously considering imposing duties of data loyalty that implement ideas from privacy law scholarship, but critics claim such duties are unnecessary, unworkable, overly individualistic, and indeterminately vague. This paper takes those criticisms seriously, and its analysis of them reveals that duties of data loyalty have surprising virtues. Loyalty, it turns out, can support collective well-being by embracing privacy’s relational turn; it can be a powerful state of mind for reenergizing privacy reform; it prioritizes human values rather than potentially empty formalism; and it offers solutions that are flexible and clear rather than …

A General Defense Of Information Fiduciaries, Andrew F. Tuch

Scholarship@WashULaw

Countless high-profile abuses of user data by leading technology companies have raised a basic question: should firms that traffic in user data be held legally responsible to their users as “information fiduciaries”? Privacy legislation to impose fiduciary-like duties of care, confidentiality, and loyalty on data collectors enjoys bipartisan support but faces strong opposition from scholars. First, critics argue that the information fiduciary concept flies in the face of fundamental corporate law principles that require firms to prioritize shareholder interests over those of users. Second, it is said that the overwhelming self-interest of digital companies makes fiduciary loyalty impossible as a …

A Duty Of Loyalty For Privacy Law, Neil M. Richards, Woodrow Hartzog

Scholarship@WashULaw

Data privacy law fails to stop companies from engaging in self-serving, opportunistic behavior at the expense of those who trust them with their data. This is a problem. Modern tech companies are so entrenched in our lives and have so much control over what we see and click that the self-dealing exploitation of people has become a major element of the internet’s business model.

Academics and policymakers have recently proposed a possible solution: require those entrusted with people’s data and online experiences to be loyal to those who trust them. But many have concerns about a duty of loyalty. What, …

Error-Resilient Consumer Contracts, Danielle D'Onfro

Scholarship@WashULaw

When firms contracting with consumers make mistakes, people get hurt. Inaccurate billing, misapplied payments, and similar problems push lucky consumers into kafkaesqe customer-service queues and unlucky ones off the financial cliff. Despite significant regulatory interventions, firms contracting with consumers continue to struggle to accurately bill customers, update accounts, and process payments. Firms largely rely on technology, especially databases and software, to discharge these servicing obligations. This technology must accommodate firms’ innovations in their contracts, shifting regulations, and unpredictable consumer behavior. Given the complexity of servicing, the technology will inevitably produce mistakes even when firms invest in technology. When firms skimp …

Introduction: The Rise Of Fintech, Andrew F. Tuch

Scholarship@WashULaw

This foreword introduces "The Rise of Fintech," a series of essays published in a symposium issue of the Washington University Journal of Law & Policy. The contributions examine the structure of firms and markets, considering fintech activities occurring within existing firms and regulatory perimeters and activities that spill over the boundaries we currently take for granted. The contributors examine the emerging regulatory responses to fintech, taxonomizing them. They consider which regulatory approaches, or ecosystems, will best help fintech to develop. They examine how fintech applies to fundraising, examining initial coin offerings (ICOs) and equity crowdfunding, techniques that attract attention for …

Privacy's Constitutional Moment And The Limits Of Data Protection, Neil M. Richards, Woodrow Hartzog

Scholarship@WashULaw

America’s privacy bill has come due. Since the dawn of the Internet, Congress has repeatedly failed to build a robust identity for American privacy law. But now both California and the European Union have forced Congress’s hand by passing the California Consumer Privacy Act (CCPA) and the General Data Protection Regulation (GDPR). These data protection frameworks, structured around principles for Fair Information Processing called the “FIPs,” have industry and privacy advocates alike clamoring for a “U.S. GDPR.” States seemed poised to blanket the country with FIP-based laws if Congress fails to act. The United States is thus in the midst …

A Relational Turn For Data Protection?, Neil M. Richards, Woodrow Hartzog

Scholarship@WashULaw

While most approaches to privacy and data protection focus on the data, this paper explores an alternative approach that focuses on relationships. This means looking more closely at how the people who are exposing their information and the people that are inviting that disclosure relate to each other. It is concerned with what powerful parties owe to vulnerable parties–not just with their personal information, but with the things they see, the things they can click, and the decisions that are made about them. It’s less about the nature of data and more about the nature of power. And it can …

Smart Contracts And The Illusion Of Automated Enforcement, Danielle D'Onfro

Scholarship@WashULaw

This symposium essay explores the barriers to deploying smart contracts in the consumer finance space: the humans themselves, existing consumer protection laws, and the other businesses who have financial contracts with consumers but that cannot deploy smart contracts. These three barriers render perfectly automated enforcement all but impossible. Nevertheless, there may be room for modifiable smart contracts in the consumer financial space although these contracts may be only marginally more efficient than traditional contracts.

The Pathologies Of Digital Consent, Neil M. Richards, Woodrow Hartzog

Scholarship@WashULaw

Consent permeates both our law and our lives — especially in the digital context. Consent is the foundation of the relationships we have with search engines, social networks, commercial web sites, and any one of the dozens of other digitally mediated businesses we interact with regularly. We are frequently asked to consent to terms of service, privacy notices, the use of cookies, and so many other commercial practices. Consent is important, but it’s possible to have too much of a good thing. As a number of scholars have documented, while consent models permeate the digital consumer landscape, the practical conditions …

Trusting Big Data Research, Neil M. Richards, Woodrow Hartzog

Scholarship@WashULaw

Although it might puzzle or even infuriate data scientists, suspicion about big data is understandable. The concept doesn’t seem promising to most people. It seems scary. This is partly because big data research is shrouded in mystery. People are unsure about organizations’ motives and methods. What do companies think they know about us? Are they keeping their insights safe from hackers? Are they selling their insights to unscrupulous parties? Most importantly, do organizations use our personal information against us? Big data research will only overcome its suspicious reputation when people can trust it.

Some scholars and commentators have proposed review …

Taking Trust Seriously In Privacy Law, Neil M. Richards, Woodrow Hartzog

Scholarship@WashULaw

Trust is beautiful. The willingness to accept vulnerability to the actions of others is the essential ingredient for friendship, commerce, transportation, and virtually every other activity that involves other people. It allows us to build things, and it allows us to grow. Trust is everywhere, but particularly at the core of the information relationships that have come to characterize our modern, digital lives. Relationships between people and their ISPs, social networks, and hired professionals are typically understood in terms of privacy. But the way we have talked about privacy has a pessimism problem – privacy is conceptualized in negative terms, …

People Analytics And The Regulation Of Information Under The Fair Credit Reporting Act, Pauline Kim, Erika Hanson

Scholarship@WashULaw

People analytics — the use of big data and computer algorithms to make personnel decisions — has been drawing increasing public and scholarly scrutiny. Concerns have been raised that the data collection intrudes on individual privacy, and that algorithms can produce unfair or discriminatory results. This symposium contribution considers whether the Fair Credit Reporting Act’s regulation of consumer information used for employment purposes can respond these concerns. The FCRA establishes certain procedural requirements, and these can sometimes help individual workers challenge inaccurate information about them. However, the statute does little to curb intrusive data collection practices or to address the …

Information Privacy Law Scholars' Brief In Spokeo, Inc. V. Robins, Neil M. Richards, Julie E. Cohen, Chris Jay Hoofnagle, William Mcgeveran, Paul Ohm, Joel R. Reidenberg, David Thaw, Lauren E. Willis

Scholarship@WashULaw

This brief, submitted to the Supreme Court of the United States by 15 information privacy law scholars in the case of Spokeo, Inc. v. Robins (No 13-1339), argues that in enacting the Fair Credit Reporting Act (FCRA), Congress crafted a bargain between aggressive, secretive data-aggregating businesses and the public: if those businesses limited disclosures and made reasonable efforts to adhere to practices ensuring “maximum possible accuracy,” they would enjoy a safe harbor from litigation under many other state and federal theories. The FCRA’s consumer transparency requirements and remedial provisions were designed to encourage steady improvement in consumer reporting practices and …

Watching The Watchers, Neil M. Richards

Scholarship@WashULaw

In this essay from Wired Magazine (UK)'s special edition, The Wired World in 2014, Prof. Richards argues that sousveillance–watching the watchers–is an important development that will be on the rise in 2014.

Three Paradoxes Of Big Data, Neil M. Richards, Jonathan H. King

Scholarship@WashULaw

Big data is all the rage. Its proponents tout the use of sophisticated analytics to mine large data sets for insight as the solution to many of our society’s problems. These big data evangelists insist that data-driven decision making can now give us better predictions in areas ranging from college admissions to dating to hiring to medicine to national security and crime prevention. But much of the rhetoric of big data contains no meaningful analysis of its potential perils, only the promise. We don’t deny that big data holds substantial potential for the future, and that large dataset analysis has …

The Perils Of Social Reading, Neil M. Richards

Scholarship@WashULaw

Our law currently treats records of our reading habits under two contradictory rules: rules mandating confidentiality and rules permitting disclosure. Recently, the rise of the social Internet has created more of these records and more pressures on when and how they should be shared. Companies like Facebook, in collaboration with many newspapers, have ushered in the era of “social reading,” in which what we read may be “frictionlessly shared” with our friends and acquaintances. Disclosure and sharing are on the rise.

This Article sounds a cautionary note about social reading and frictionless sharing. Social reading might have some appeal, but …

Multidistrict Litigation: A Surprising Bonus For Pro Se Plaintiffs And A Possible Boon For Consumers, Danielle D'Onfro

Scholarship@WashULaw

Conventional wisdom says that pro se plaintiffs almost invariably fare worse than represented plaintiffs. However, there exists in federal court a procedural regime under which pro se plaintiffs effectively receive attorneys and therefore experience success rates similar to their represented peers: multidistrict litigation. Multidistrict litigation is a procedure for consolidating multiple federal civil cases sharing common questions of fact into a single proceeding in one federal district court for coordinated pre-trial proceedings and discovery. This paper takes an empirical look at all federal civil cases terminating between 2006 and 2008 to determine what effect multidistrict litigation has on case outcome …