Internet Law Commons^™

On The Right To Obscurity, Woodrow Hartzog, Evan Selinger

Faculty Scholarship

Tragically, U.S. privacy law has neglected to address a significant dimension of privacy. While lawmakers and judges have routinely recognized intrusions into our secluded spaces and breaches of our confidentiality and secrecy, they have largely failed to protect our most common yet also our most underappreciated form of privacy: the practical obscurity that allows us to live freely and with dignity. Obscurity, which is the state of protection that arises when personal information is difficult for some people to obtain or correctly interpret, serves several vital interests: (1) it safeguards our ability to express ourselves without fear that everything we …

Obscurity And The Fallacy Of No Privacy In Public Information, Woodrow Hartzog

Faculty Scholarship

The main thesis of this chapter is that because there are so many different possible interpretations of ‘public information’, the concept cannot be used to justify data practices and surveillance without first articulating a more precise meaning that recognises what is at stake. By disposing of the myth that there is an objective and dispassionate concept of public information, judges and lawmakers can clear the way for information rules based on overt value choices. In short, if the concept of ‘public’ is going to shape people’s social and legal obligations, its meaning and neutrality should not be assumed.

My argument …

Gig Work At What Cost? Exploring Privacy Risks Of Gig Work Platform Participation In The U.S., Amogh Pradeep, Johanna Gunawan, Álvaro Feal, Woodrow Hartzog, David Choffnes

Faculty Scholarship

In recent years, "gig work" platforms have gained popularity as a way for individuals to earn money; as of 2021, 16% of Americans have at some point earned money from such platforms. Despite their popularity and their history of unfair data collection practices and worker safety, little is known about the data collected from workers (and users) by gig platforms and about the privacy dark pattern designs present in their apps.

This paper presents an empirical measurement of 16 gig work platforms' data practices in the U.S. We analyze what data is collected by these platforms, and how it is …

Consumer Agents, Rory Van Loo

Faculty Scholarship

In the twenty-first century economy, individuals need market help that they are not getting. The technology has long existed for a browser plug-in that would filter out toxic social media content or a virtual shopping assistant that would find and even purchase the best deals online without having to go to many different websites and product pages. Yet tech platforms have used lawsuits and data control to stifle such tools. The lack of digital helpers has potentially profound consequences. Social media use is linked to alarming increases in teenage depression and anxiety. Businesses’ ability to manipulate consumers into paying higher …

Foundations For Platform Liability, Kathryn E. Spier, Rory Van Loo

Faculty Scholarship

From spreading misinformation to selling deadly products, bad actors use technology platforms to their advantage while causing devastating harms to privacy, health, and even democracy. Despite their central role in enabling these bad actors, the platforms almost entirely escape liability. This legal immunity is purportedly grounded in economics. From the beginning, courts and legislatures feared that liability would chill innovation, growth, and user access. They also speculated that platforms have sufficient market incentives to voluntarily police bad actors, making liability unnecessary.

Whereas many scholars have argued that platform immunity is blind to justice, this Article shows that it is also …

Normalizing Facial Recognition Technology And The End Of Obscurity, Woodrow Hartzog, Evan Selinger, Judy Hyojoo Rhee

Faculty Scholarship

This article argues that facial recognition technology is the most dangerous surveillance tool ever invented. Given the unique threats this morally suspect tool poses to privacy, civil liberties, human flourishing, and democracy, the only appropriate response is a ban. To justify our position, we explain why facial recognition is distinctive among biometrics, clarify how even seemingly benign and positive uses of the technology can trigger dangerous normalization dynamics, and pinpoint why current United States laws (with reverberations in the EU’s AI Act) are designed to accelerate a slippery slope that makes mass surveillance nearly inevitable. Our most fundamental contribution lies …

The Great Scrape: The Clash Between Scraping And Privacy, Daniel J. Solove, Woodrow Hartzog

Faculty Scholarship

Artificial intelligence (AI) systems depend on massive quantities of data, often gathered by “scraping”—the automated extraction of large amounts of data from the internet. A great deal of scraped data contains people’s personal information. This personal data provides the grist for AI tools such as facial recognition, deep fakes, and generative AI. Although scraping enables web searching, archiving of records, and meaningful scientific research, scraping for AI can also be objectionable and even harmful to individuals and society.

Organizations are scraping at an escalating pace and scale, even though many privacy laws are seemingly incongruous with the practice. In this …

Understanding Dark Patterns In Home Iot Devices, Monica Kowalczyk, Johanna Gunawan, David Choffnes, Daniel J. Dubois, Woodrow Hartzog, Christo Wilson

Faculty Scholarship

Internet-of-Things (IoT) devices are ubiquitous, but little attention has been paid to how they may incorporate dark patterns despite consumer protections and privacy concerns arising from their unique access to intimate spaces and always-on capabilities. This paper conducts a systematic investigation of dark patterns in 57 popular, diverse smart home devices. We update manual interaction and annotation methods for the IoT context, then analyze dark pattern frequency across device types, manufacturers, and interaction modalities. We find that dark patterns are pervasive in IoT experiences, but manifest in diverse ways across device traits. Speakers, doorbells, and camera devices contain the most …

The New Pornography Wars, Julie A. Dahlstrom

Faculty Scholarship

The world’s largest online pornography conglomerate, MindGeek, has come under fire for the publishing of “rape videos,” child pornography, and nonconsensual pornography on its website, Pornhub. As in the “pornography wars” of the 1970s and 1980s, lawyers and activists have now turned to civil remedies and filed creative anti-trafficking lawsuits against MindGeek and third parties, like payment processing company, Visa. These lawsuits seek not only to achieve legal accountability for online sex trafficking but also to reframe a broader array of online harms as sex trafficking.

This Article explores what these new trafficking lawsuits mean for the future regulation of …

Comments Of The Cordell Institute For Policy In Medicine & Law At Washington University In St. Louis, Neil Richards, Woodrow Hartzog, Jordan Francis

Faculty Scholarship

The Federal Trade Commission—with its broad, independent grant of authority and statutory mandate to identify and prevent unfair and deceptive trade practices—is uniquely situated to prevent and remedy unfair and deceptive data privacy and data security practices. In an increasingly digitized world, data collection, processing, and transfer have become integral to market interactions. Our personal and commercial experiences are now mediated by powerful, information-intensive firms who hold the power to shape what consumers see, how they interact, which options are available to them, and how they make decisions. That power imbalance exposes consumers and leaves them all vulnerable. We all …

Legislating Data Loyalty, Woodrow Hartzog, Neil Richards

Faculty Scholarship

Lawmakers looking to embolden privacy law have begun to consider imposing duties of loyalty on organizations trusted with people’s data and online experiences. The idea behind loyalty is simple: organizations should not process data or design technologies that conflict with the best interests of trusting parties. But the logistics and implementation of data loyalty need to be developed if the concept is going to be capable of moving privacy law beyond its “notice and consent” roots to confront people’s vulnerabilities in their relationship with powerful data collectors.

In this short Essay, we propose a model for legislating data loyalty. Our …

A Comparative Study Of Dark Patterns Across Mobile And Web Modalities, Johanna Gunawan, Amogh Pradeep, David Choffnes, Woodrow Hartzog, Christo Wilson

Faculty Scholarship

Dark patterns are user interface elements that can influence a person's behavior against their intentions or best interests. Prior work identified these patterns in websites and mobile apps, but little is known about how the design of platforms might impact dark pattern manifestations and related human vulnerabilities. In this paper, we conduct a comparative study of mobile application, mobile browser, and web browser versions of 105 popular services to investigate variations in dark patterns across modalities. We perform manual tests, identify dark patterns in each service, and examine how they persist or differ by modality. Our findings show that while …

Cyber Mobs, Disinformation, And Death Videos: The Internet As It Is (And As It Should Be), Danielle K. Citron

Faculty Scholarship

Fiction and visual representations can alter our understanding of human experiences and struggles. They help us understand human frailties and suffering in a visceral way. Nick Drnaso’s graphic novel Sabrina does that in spades. In Sabrina, a woman is murdered by a misogynist, and a video of her execution is leaked. Conspiracy theorists deem her murder a hoax. A cyber mob smears the woman’s loved ones as crisis actors, posts death threats, and spreads their personal information. The attacks continue until a shooting massacre redirects the cyber mob’s wrath to other mourners. Sabrina captures the breathtaking velocity of disinformation online …

The Internet As A Speech Machine And Other Myths Confounding Section 230 Reform, Danielle K. Citron, Mary Anne Franks

Faculty Scholarship

A robust public debate is currently underway about the responsibility of online platforms. We have long called for this discussion, but only recently has it been seriously taken up by legislators and the public. The debate begins with a basic question: should platforms should be responsible for user-generated content? If so, under what circumstances? What exactly would such responsibility look like? Under consideration is Section 230 of the Communications Decency Act—a provision originally designed to encourage tech companies to clean up “offensive” online content. The public discourse around Section 230, however, is riddled with misconceptions. As an initial matter, many …

Deep Fakes: A Looming Challenge For Privacy, Democracy, And National Security, Robert Chesney, Danielle K. Citron

Faculty Scholarship

Harmful lies are nothing new. But the ability to distort reality has taken an exponential leap forward with “deep fake” technology. This capability makes it possible to create audio and video of real people saying and doing things they never said or did. Machine learning techniques are escalating the technology’s sophistication, making deep fakes ever more realistic and increasingly resistant to detection. Deep-fake technology has characteristics that enable rapid and widespread diffusion, putting it into the hands of both sophisticated and unsophisticated actors. While deep-fake technology will bring with it certain benefits, it also will introduce many harms. The marketplace …

Sexual Privacy, Danielle K. Citron

Faculty Scholarship

Those who wish to control, expose, and damage the identities of individuals routinely do so by invading their privacy. People are secretly recorded in bedrooms and public bathrooms and “up their skirts.” Such images are used to coerce people into sharing nude photographs and filming sex acts under the threat of public disclosure. People’s nude images are posted online without permission. Machine-learning technology is used to create digitally manipulated “deep fake” sex videos that swap people’s faces into pornography.

Each of these abuses is an invasion of sexual privacy—the behaviors, expectations, and choices that manage access to and information about …

When Law Frees Us To Speak, Danielle K. Citron, Jonathon W. Penney

Faculty Scholarship

A central aim of online abuse is to silence victims. That effort is as regrettable as it is successful. In the face of cyber harassment and sexual privacy invasions, women and marginalized groups retreat from online engagement. These documented chilling effects, however, are not inevitable. Beyond its deterrent function, law has an equally important expressive role. In this article, we highlight law’s capacity to shape social norms and behavior through education. We focus on a neglected dimension of law’s expressive role—its capacity to empower victims to express their truths and engage with others. Our argument is theoretical and empirical. We …

Intermediaries And Private Speech Regulation: A Transatlantic Dialogue - Workshop Report, Tiffany Li

Faculty Scholarship

The Wikimedia/Yale Law School Initiative on Intermediaries and Information (WIII) at Yale Law School has released a comprehensive report synthesizing key insights from intermediary liability and online speech and expression experts in Europe and the United States.

The report focuses on the critical but complicated issue of private speech regulation on the internet and the connections between platform liability laws and fundamental rights, including free expression. The report reflects discussions held at “Intermediaries & Private Speech Regulation: A Transatlantic Dialogue,” an invitation-only workshop convened by WIII, featuring leading internet law experts from the United States and Europe.

This report highlights …

The Problem Isn't Just Backpage: Revising Section 230 Immunity, Danielle K. Citron, Benjamin Wittes

Faculty Scholarship

Backpage is a classifieds hub that hosts “80 percent of the online advertising for illegal commercial sex in the United States.” This is not by happenstance but rather by design. Evidence suggests that the advertising hub selectively removed postings discouraging sex trafficking. The site also tailored its rules to protect the practice from detection, including allowing anonymized email and photographs stripped of metadata. Under the prevailing interpretation of 47 U.S.C. § 230 (“Section 230”) of the CDA, however, Backpage would be immune from liability connected to sex trafficking even though it proactively helped sex traffickers from getting caught. No matter …

Humans Forget, Machines Remember: Artificial Intelligence And The Right To Be Forgotten, Eduard Fosch Villaronga, Peter Kieseberg, Tiffany Li

Faculty Scholarship

To understand the Right to be Forgotten in context of artificial intelligence, it is necessary to first delve into an overview of the concepts of human and AI memory and forgetting. Our current law appears to treat human and machine memory alike – supporting a fictitious understanding of memory and forgetting that does not comport with reality. (Some authors have already highlighted the concerns on the perfect remembering.) This Article will examine the problem of AI memory and the Right to be Forgotten, using this example as a model for understanding the failures of current privacy law to reflect the …

Fighting Technology With Technology: Taking Aim At Electronic Sales Suppression, Richard Thompson Ainsworth, Robert Chicoine

Faculty Scholarship

Electronic sales suppression (ESS) is a fraud that has been a (prominent) feature of the North American retail business since at least 1996. The first EES case in the US dates from 1981. ESS is a global problem. Depending on the jurisdiction, and the research study consulted, ESS is estimated to be present in 34% (of Canadian), 50% (of German – two studies), and 70% (of Swedish and Slovenian) businesses. It may be the case today, that “you cannot leave home without” encountering (or participating in) ESS.

The most common types of sales suppression technology are Zappers and Phantomware programming. …

Risk And Anxiety: A Theory Of Data Breach Harms, Daniel Solove, Danielle K. Citron

Faculty Scholarship

In lawsuits about data breaches, the issue of harm has confounded courts. Harm is central to whether plaintiffs have standing to sue in federal court and whether their claims are viable. Plaintiffs have argued that data breaches create a risk of future injury from identity theft or fraud and that breaches cause them to experience anxiety about this risk. Courts have been reaching wildly inconsistent conclusions on the issue of harm, with most courts dismissing data breach lawsuits for failure to allege harm. A sound and principled approach to harm has yet to emerge, resulting in a lack of consensus …

Beyond Intermediary Liability: The Future Of Information Platforms - Workshop Report, Tiffany Li

Faculty Scholarship

On February 13, 2018, WIII hosted the workshop, “Beyond Intermediary Liability: The Future of Information Platforms.” Leading experts from industry, civil society, and academia convened at Yale Law School for a series of non-public, guided discussions. The roundtable of experts considered pressing questions related to intermediary liability and the rights, roles, and responsibilities of information platforms in society. Based on conversations from the workshop, WIII published a free, publicly available report detailing the most critical issues necessary for understanding the role of information platforms, such as Facebook and Google, in law and society today. The report highlights insights and questions …

Extremist Speech, Compelled Conformity, And Censorship Creep, Danielle K. Citron

Faculty Scholarship

Silicon Valley has long been viewed as a full-throated champion of First Amendment values. The dominant online platforms, however, have recently adopted speech policies and processes that depart from the U.S. model. In an agreement with the European Commission, tech companies have pledged to respond to reports of hate speech within twenty-four hours, a hasty process that may trade valuable expression for speedy results. Plans have been announced for an industry database that will allow the same companies to share hashed images of banned extremist content for review and removal elsewhere.

These changes are less the result of voluntary market …

Four Principles For Digital Expression (You Won't Believe #3!), Danielle K. Citron, Neil Richards

Faculty Scholarship

At the dawn of the Internet’s emergence, the Supreme Court rhapsodized about its potential as a tool for free expression and political liberation. In ACLU v. Reno (1997), the Supreme Court adopted a bold vision of Internet expression to strike down a federal law - the Communications Decency Act - that restricted digital expression to forms that were merely “decent.” Far more than the printing press, the Court explained, the mid-90s Internet enabled anyone to become a town crier. Communication no longer required the permission of powerful entities. With a network connection, the powerless had as much luck reaching a …

Twenty Years Of Web Scraping And The Computer Fraud And Abuse Act, Andrew Sellars

Faculty Scholarship

"Web scraping" is a ubiquitous technique for extracting data from the World Wide Web, done through a computer script that will send tailored queries to websites to retrieve specific pieces of content. The technique has proliferated under the ever-expanding shadow of the Computer Fraud and Abuse Act (CFAA), which, among other things, prohibits obtaining information from a computer by accessing the computer without authorization or exceeding one's authorized access.

Unsurprisingly, many litigants have now turned to the CFAA in attempt to police against unwanted web scraping. Yet despite the rise in both web scraping and lawsuits about web scraping, practical …

The Technology Requirements Of The First Electronic Monitoring Agreement In U.S. For Zappers, Richard Thompson Ainsworth, Robert Chicoine

Faculty Scholarship

On August 30, 2017, a plea was entered in the case of case of State of Washington v. Wong, Wash. Super. Ct., No. 16-1-00179-0, and as a result the first electronic monitoring agreement of sales transactions in the US (the “Monitoring Agreement”) was legislatively imposed on a retail business.

The Monitoring Agreement was negotiated between the State of Washington Department of Revenue (the “WA DOR”) and the taxpayer over a period of several months and is comprised of two parts: the basic agreement, which covered the obligations and rights of the parties, and an appendix, which defines the scope of …

Three Strikes For Copyright, Jessica Silbey

Faculty Scholarship

How should copyright law change to take account of the internet? Should copyright expand to plug the internet’s leakiness and protect content that the internet would otherwise make more freely available? Or, should copyright relax its strict liability regime given diverse and productive reuses in the internet age and the benefits networked diffusion provides users and second-generation creators? Answering these questions depends on what we think copyright is for and how it is used and confronted by creators and audiences. In a new article studying these questions in the very focused setting of Wikipedia articles about baseball and baseball players …

Data Collection And The Regulatory State, Ahmed Ghappour

Faculty Scholarship

The following remarks were given on January 27, 2017 during the Connecticut Law Review’s symposium, “Privacy, Security & Power: The State of Digital Surveillance.” Hillary Greene, the Zephaniah Swift Professor of Law at the University of Connecticut School of Law, offered introductory remarks and moderated the panel. The panel included Dr. Cooper, Associate Professor of Law and Director of the Program on Economics & Privacy at Antonin Scalia Law School at George Mason University, Professor Ghappour, Visiting Assistant Professor at UC Hastings College of the Law, Attorney Lieber, Senior Privacy Policy Counsel at Google, and Dr. Wu, Professor of Law …

Interpretation Catalysts In Cyberspace, Rebecca Ingber

Faculty Scholarship

The cybersphere offers a rich space from which to explore the development of international law in a compressed time frame. This piece examines the soft law process over the last decade of the two Tallinn Manuals – handbooks on the international law of cyber warfare and cyber operations – as a valuable lens through which to witness the effects of “interpretation catalysts” on the evolution of international law. In prior work, I identified the concept of interpretation catalysts – discrete triggers for legal interpretation – and their influence on the path that legal evolution takes, including by compelling a decision-making …