Consumer Protection Law Commons^™

Restricting Data Flows Is A Sign Of Weakness, Nikolas Guggenberger

Seattle University Law Review

There has been a seismic shift in American attitudes toward the free flow of data across borders.  In less than a decade, the United States has transitioned from condemning barriers to digital trade to constructing a digital fortress of its own. It passed legislation requiring TikTok’s parent company to divest its U.S. operations or face a nationwide ban affecting 170 million U.S. users, citing national security concerns about its ties to China and the potential for data surveillance and content manipulation. Upon legal challenge by TikTok on First Amendment grounds, the Supreme Court affirmed the ban’s constitutionality. Recent federal legislation …

Data Rights For Workers, Pauline Kim, Rachel Leavitt

Scholarship@WashULaw

Workers are subject to immense amounts of data collection on the job, and the algorithmic management tools built with that data can produce negative effects, including deskilling jobs, unstable work hours, reduced wages, and dangerous and degrading working conditions. Workers thus have significant interests how their data are collected and used, and yet they have been excluded from nearly all the recently enacted or proposed data protection laws. Their exclusion stems from data protection’s roots in privacy law and theory, which primarily focused on consumers as data subjects. Current data protection laws, even if expanded to cover workers, would provide …

How Ftc Data Security Cases Inform The Development Of Legally Accountable Software, Jeff Kosseff, Ellis Fenske, Christopher Brown, Daniel S. Roche

Fordham Intellectual Property, Media and Entertainment Law Journal

Over the past two decades, the Federal Trade Commission has brought dozens of enforcement actions against companies for failing to adequately secure customers’ personal information. The actions typically result in a consent decree, in which the company agrees to improve its data security practices and provide the FTC with oversight of those improvements. When the FTC first brought data security cases, its orders generally required the companies to adopt “reasonable” data security programs. But a 2018 Eleventh Circuit opinion, LabMD v. FTC, requires the orders to contain far more specific data security requirements. In this Article, we conduct an in-depth …

The Gamification Of Banking, Colleen Baker, Christopher K. Odinet

Faculty Scholarship

Gamification is coming to banking. This phenomenon is already gain-ing ground in advertising, healthcare, manufacturing, and, more recently, with the GameStop and AMC meme stock saga in securities trading. The idea behind gamification is to make transactions seem fun, playful, and even casino-like in order to elicit habit-forming, addictive-like effects with consumers. This Article argues that the rise of financial technology (“fintech”) firms and their ever-growing business relationships with incumbent financial institutions has created the necessary conditions for gamification to take hold in the banking sector. In order to explore this observation, we undertake a study of current examples of …

Data Advantage And Merger Review: Can Entrenchment Theory Reform Antitrust Enforcement?, Shin-Ru Cheng

Seattle University Law Review

A merger involving giant digital companies is likely to dampen competition, as it allows those companies to combine and control data access, enabling them to entrench their dominant positions in relevant markets and extend those positions into related markets. While competition law in many jurisdictions aims to prohibit mergers that may substantially lessen competition or create a monopoly, arguably the review of digital mergers is failing because antitrust agencies lack an effective approach to identify data-generated anticompetitive harms. This Article demonstrates that entrenchment theory, recently reintroduced in the 2023 U.S. Merger Guidelines, would help reform the process of antitrust enforcement. …

Consumer Agents, Rory Van Loo

Faculty Scholarship

In the twenty-first century economy, individuals need market help that they are not getting. The technology has long existed for a browser plug-in that would filter out toxic social media content or a virtual shopping assistant that would find and even purchase the best deals online without having to go to many different websites and product pages. Yet tech platforms have used lawsuits and data control to stifle such tools. The lack of digital helpers has potentially profound consequences. Social media use is linked to alarming increases in teenage depression and anxiety. Businesses’ ability to manipulate consumers into paying higher …

Wearable Ai, Bystander Notice, And The Question Of Privacy Frictions, Zahra Takhshid

Sturm College of Law: Faculty Scholarship

With the rapid advancement of Artificial Intelligence (“AI”) technology and the widespread availability of large language models (“LLMs”), wearable AI devices and designs for new hardware have surged like never before. While wearable AI was traditionally marketed for health and fitness purposes, many of the emerging products are multifunctional. These features can jeopardize the privacy of bystanders in addition to the consumers. Product designers are thus facing a dilemma: ensuring third-party privacy or guaranteeing convenience and a user-friendly design. This Article argues for mandating “privacy frictions” to function as both bystander notice and consent for wearable AI devices with audiovisual …

Against Engagement, Neil M. Richards, Woodrow Hartzog

Scholarship@WashULaw

In this Article, we focus on a key dimension of commercial surveillance by data-intensive digital platforms that is too often treated as a supporting cast member instead of a star of the show: the concept of engagement. Engagement is, simply put, a measure of time, attention, and other interactions with a service. The economic logic of engagement is simple: more engagement equals more ads watched equals more revenue. Engagement is a lucrative digital business model, but it is problematic in several ways that lurk beneath the happy sloganeering of a “free” internet.

Our goal in this Article is to isolate …

Children's Digital Privacy And The Case Against Parental Consent, Zahra Takhshid

Sturm College of Law: Faculty Scholarship

Children’s engagement with the internet has exploded. From education to social media, companies have offered products and services that --far from being mere distractions for children -- have increasingly become necessities. This necessity is most keenly felt in the EdTech world. As companies rely on the verifiable parental consent required by the Children’s Online Privacy Protection Act (“COPPA”) to collect and use minors’ data, reviewing boilerplate waivers of liability and consent forms for children’s online activities have thus become part of parenting. This article argues that under the common law tradition of protecting the best interest of the child, when …

“Statistics Are Human Beings With The Tears Wiped Away”: Utilizing Data To Develop Strategies To Reduce The Number Of Native Americans Who Go Missing, Lori Mcpherson, Sarah Blazucki

Seattle University Law Review

On New Year’s Eve night, 2019, sixteen-year-old Selena Shelley Faye Not Afraid attended a party in Billings, Montana, about fifty miles west of her home in Hardin, Montana, near the Crow Reservation. A junior at the local high school, she was active in her community. The party carried over until the next day, and she caught a ride back toward home with friends in a van the following afternoon. When the van stopped at an interstate rest stop, Selena got out but never made it back to the van. The friends reported her missing to the police and indicated they …

Passcodes, Protection, And Legal Practicality: The Necessity Of A Digital Fifth Amendment, Ethan Swierczewski

Catholic University Journal of Law and Technology

No abstract provided.

Illusory Privacy, Thomas Haley

Indiana Law Journal

For decades, regulators, consumer advocates, and privacy theorists have grappled with one of privacy’s most important questions: how to protect private information that consumers unwittingly give away with the click of an “I accept” button. Reform efforts remain mired in a morass of text, focusing on the increasing volume and complexity of firms’ terms of service and privacy policies. This Article moves beyond such existing approaches. By analyzing terms of service and privacy policies from hundreds of top websites—which this Article calls “platform terms”—this Article demonstrates that the prevailing “notice and consent” paradigm of privacy regulation cannot provide meaningful protection. …

The Surprising Virtues Of Data Loyalty, Neil M. Richards, Woodrow Hartzog

Scholarship@WashULaw

Lawmakers in the United States and Europe are seriously considering imposing duties of data loyalty that implement ideas from privacy law scholarship, but critics claim such duties are unnecessary, unworkable, overly individualistic, and indeterminately vague. This paper takes those criticisms seriously, and its analysis of them reveals that duties of data loyalty have surprising virtues. Loyalty, it turns out, can support collective well-being by embracing privacy’s relational turn; it can be a powerful state of mind for reenergizing privacy reform; it prioritizes human values rather than potentially empty formalism; and it offers solutions that are flexible and clear rather than …

Taking It With You: Platform Barriers To Entry And The Limits Of Data Portability, Gabriel Nicholas

Michigan Technology Law Review

Policymakers are faced with a vexing problem: how to increase competition in a tech sector dominated by a few giants. One answer proposed and adopted by regulators in the United States and abroad is to require large platforms to allow consumers to move their data from one platform to another, an approach known as data portability. Facebook, Google, Apple, and other major tech companies have enthusiastically supported data portability through their own technical and political initiatives. Today, data portability has taken hold as one of the go-to solutions to address the tech industry’s competition concerns.

This Article argues that despite …

Algorithms In Business, Merchant-Consumer Interactions, & Regulation, Tabrez Y. Ebrahim

Faculty Scholarship

The shift towards the use of algorithms in business has transformed merchant–consumer interactions. Products and services are increasingly tailored for consumers through algorithms that collect and analyze vast amounts of data from interconnected devices, digital platforms, and social networks. While traditionally merchants and marketeers have utilized market segmentation, customer demographic profiles, and statistical approaches, the exponential increase in consumer data and computing power enables them to develop and implement algorithmic techniques that change consumer markets and society as a whole. Algorithms enable targeting of consumers more effectively, in real-time, and with high predictive accuracy in pricing and profiling strategies. In …

A General Defense Of Information Fiduciaries, Andrew F. Tuch

Scholarship@WashULaw

Countless high-profile abuses of user data by leading technology companies have raised a basic question: should firms that traffic in user data be held legally responsible to their users as “information fiduciaries”? Privacy legislation to impose fiduciary-like duties of care, confidentiality, and loyalty on data collectors enjoys bipartisan support but faces strong opposition from scholars. First, critics argue that the information fiduciary concept flies in the face of fundamental corporate law principles that require firms to prioritize shareholder interests over those of users. Second, it is said that the overwhelming self-interest of digital companies makes fiduciary loyalty impossible as a …

A Duty Of Loyalty For Privacy Law, Neil M. Richards, Woodrow Hartzog

Scholarship@WashULaw

Data privacy law fails to stop companies from engaging in self-serving, opportunistic behavior at the expense of those who trust them with their data. This is a problem. Modern tech companies are so entrenched in our lives and have so much control over what we see and click that the self-dealing exploitation of people has become a major element of the internet’s business model.

Academics and policymakers have recently proposed a possible solution: require those entrusted with people’s data and online experiences to be loyal to those who trust them. But many have concerns about a duty of loyalty. What, …

Forging A Path Towards Meaningful Digital Privacy: Data Monetization And The Ccpa, Rebecca Harris

Loyola of Los Angeles Law Review

The California Consumer Privacy Act (CCPA) was passed in response to a number of newsworthy data breaches with widespread impacts, and which revealed how little digital privacy consumers actually have. Despite the large market for consumer data, individual consumers generally do not earn money when their personal data are sold. Further, consumers have very little control over who collects their data, what information is collected, and with whom it is shared. To place control back in the hands of the consumer, affirmative consent should be required to collect and sell consumer’s data, and consumers should have the ability to sell …

Symposium: The California Consumer Privacy Act, Margot Kaminski, Jacob Snow, Felix Wu, Justin Hughes

Loyola of Los Angeles Law Review

Loyola of Los Angeles Law Review is pleased to publish the third “symposium discussion” series in which leading experts are invited to engage in an evening symposium on a new or emerging area of law. The subject of our second evening symposium was the California Consumer Privacy Act (CCPA), a statute signed into state law by then- Governor Jerry Brown on June 28, 2018 and effective as of January 1, 2020.

As with most new law, there are many unsettled issues, disagreements about the likely impact of the law, and much to be developed as regulations are established and the …

Untangling The Privacy Law Web: Why The California Consumer Privacy Act Furthers The Need For Federal Preemptive Legislation, Jordan Yallen

Loyola of Los Angeles Law Review

No abstract provided.

Saving America’S Privacy Rights: Why Carpenter V. United States Was Wrongly Decided And Why Courts Should Be Promoting Legislative Reform Rather Than Extending Existing Privacy Jurisprudence, David Stone

St. Mary's Law Journal

Privacy rights are under assault, but the Supreme Court’s judicial intervention into the issue, starting with Katz v. United States and leading to the Carpenter v. United States decision has created an inconsistent, piecemeal common law of privacy that forestalls a systematic public policy resolution by Congress and the states. In order to reach a satisfactory and longlasting resolution of the problem consistent with separation of powers principles, the states should consider a constitutional amendment that reduces the danger of pervasive technologyaided surveillance and monitoring, together with a series of statutes addressing each new issue posed by technological change as …

Data-Informed Duties In Ai Development, Frank A. Pasquale

Faculty Scholarship

Law should help direct—and not merely constrain—the development of artificial intelligence (AI). One path to influence is the development of standards of care both supplemented and informed by rigorous regulatory guidance. Such standards are particularly important given the potential for inaccurate and inappropriate data to contaminate machine learning. Firms relying on faulty data can be required to compensate those harmed by that data use—and should be subject to punitive damages when such use is repeated or willful. Regulatory standards for data collection, analysis, use, and stewardship can inform and complement generalist judges. Such regulation will not only provide guidance to …

Behavioral Finance Symposium Summary Paper, Michael S. Barr, Annabel Jouard, Andrew Norwich, Josh Wright, Katy Davis

Other Publications

On September 14-15, 2017, the University of Michigan’s Center on Finance, Law, and Policy and behavioral science research and design lab ideas42 brought together influential leaders from academia, government, nonprofits and the financial sector for a two-day symposium on behavioral finance. Behavioral finance is the study of how behavioral biases and tendencies affect financial decisions, and in turn how those impact financial markets.

Who Are The Real Cyberbullies: Hackers Or The Ftc? The Fairness Of The Ftc’S Authority In The Data Security Context, Jaclyn K. Haughom

Catholic University Law Review

As technology continues to be an integral part of daily life, there lies an ever-increasing threat of the personally identifiable information of consumers being lost, stolen, or accessed without authorization. The Federal Trade Commission (FTC) is the U.S. government’s primary consumer protection agency and the country’s lead enforcer against companies subject to data breaches. Although the FTC lacks explicit statutory authority to enforce against data breaches, the Commission has successfully relied on Section 5 of the FTC Act (FTCA) to exercise its consumer protection power in the data security context. However, as the FTC continues to take action against businesses …

Peeling Back The Student Privacy Pledge, Alexi Pfeffer-Gillett

Scholarly Articles

Education software is a multi-billion dollar industry that is rapidly growing. The federal government has encouraged this growth through a series of initiatives that reward schools for tracking and aggregating student data. Amid this increasingly digitized education landscape, parents and educators have begun to raise concerns about the scope and security of student data collection.

Industry players, rather than policymakers, have so far led efforts to protect student data. Central to these efforts is the Student Privacy Pledge, a set of standards that providers of digital education services have voluntarily adopted. By many accounts, the Pledge has been a success. …

The Skeleton Of A Data Breach: The Ethical And Legal Concerns, Hilary G. Buttrick, Jason Davidson, Richard J. Mcgowan

Richmond Journal of Law & Technology

After over thirty data breaches spanning the third and fourth quarter of 2012, Forbes magazine labeled the summer of 2012 as “The Summer of the Data Breach.” Four years later, businesses across multiple industries have suffered brand-image damage and paid millions of dollars in remedial expenses; we are living in the era of the mega breach. In 2014, companies such as Target, Home Depot, JP Morgan Chase, Anthem, Sony, UPS, Jimmy John’s, Kmart, Neiman Marcus, Community Health Systems, and the White House suffered data breaches. The Home Depot breach alone resulted in the loss of “56 million credit card accounts,” …

Giving Consumers A Leg To Stand On: Finding Plaintiffs A Legislative Solution To The Barrier From Federal Courts In Data Security Breach Suits, Patricia Cave

Catholic University Law Review

No abstract provided.

Three Paradoxes Of Big Data, Neil M. Richards, Jonathan H. King

Scholarship@WashULaw

Big data is all the rage. Its proponents tout the use of sophisticated analytics to mine large data sets for insight as the solution to many of our society’s problems. These big data evangelists insist that data-driven decision making can now give us better predictions in areas ranging from college admissions to dating to hiring to medicine to national security and crime prevention. But much of the rhetoric of big data contains no meaningful analysis of its potential perils, only the promise. We don’t deny that big data holds substantial potential for the future, and that large dataset analysis has …

Illuminating Secrecy: A New Economic Analysis Of Confidential Settlements, Scott A. Moss

Michigan Law Review

Even the most hotly contested lawsuits typically end in a confidential settlement forbidding the parties from disclosing their allegations, evidence, or settlement amount. Confidentiality draws fierce criticism for harming third parties by concealing serious misdeeds like discrimination, pollution, defective manufacturing, and sexual abuse. Others defend confidentiality as a mutually beneficial pay-for-silence bargain that facilitates settlement, serves judicial economy, and prevents frivolous copycat lawsuits. This debate is based in economic logic, yet most analyses have been surprisingly shallow as to how confidentiality affects incentives to settle. Depicting a more nuanced, complex reality of litigation and settlement, this Article reaches several conclusions …

Material Vulnerabilities: Data Privacy, Corporate Information Security And Securities Regulation, Andrea M. Matwyshyn

ExpressO

This article undertakes a normative and empirical legal inquiry into the manner information security vulnerabilities are being addressed through law and in the marketplace. Specifically, this article questions the current legislative paradigm for information security regulation by presenting a critique grounded in information security and cryptography theory. Consequently, this article advocates shifting our regulatory approach to a process-based security paradigm that focuses on improving security of our system as a whole. Finally, this article argues that in order to accomplish this shift with least disruption to current legal and economic processes, expanding an existing set of well-functioning legal structures is …