Privacy Law Commons^™

On The Right To Obscurity, Woodrow Hartzog, Evan Selinger

Faculty Scholarship

Tragically, U.S. privacy law has neglected to address a significant dimension of privacy. While lawmakers and judges have routinely recognized intrusions into our secluded spaces and breaches of our confidentiality and secrecy, they have largely failed to protect our most common yet also our most underappreciated form of privacy: the practical obscurity that allows us to live freely and with dignity. Obscurity, which is the state of protection that arises when personal information is difficult for some people to obtain or correctly interpret, serves several vital interests: (1) it safeguards our ability to express ourselves without fear that everything we …

On Predicting And Stopping Dystopia, Evan Selinger, Woodrow Hartzog

Faculty Scholarship

Is it reasonable to be dystopian about how the future will likely unfold? We think so. For some time, we have been arguing that facial recognition technology is a perfect tool of oppression, and that its pernicious affordances are leading society down a slippery slope toward the evisceration of privacy by obscurity. This is a soft form of “determinism”—the notion that while technology is not an unstoppable force and the future is not preordained, there nevertheless are identifiable factors, such as the invitingness of affordances, human nature, and incentives that drive technology in certain directions and make some social outcomes …

Beyond Digital Pessimism: How A Focus On Trust Can Enhance Eu Digital Law, Neil Richards, Woodrow Hartzog, Claire Boine, Lea Despotis

Faculty Scholarship

Lawmakers looking to foster technological innovation on the European market are adopting laws they hope will promote consumer trust in digital products. Their strategy can be broken down into three components. First, they aim to empower consumers to choose how much data they want to share with companies through an express consent framework. Second, they seek to avoid harms from digital products through product safety law such as adapting the Product Safety Regulation to digital products or adopting the AI Act. Third, they endeavor to prevent manipulation of consumers through digital means.

In this essay, we argue that while laudable, …

Against Ai Half Measures, Woodrow Hartzog, Neil Richards, Ryan Durrie, Jordan Francis

Faculty Scholarship

So far, U.S. consumer protection policy for artificial intelligence (AI) accountability has largely consisted of industry-led approaches such as encouraging transparency, mitigating bias, promoting principles of ethics, and empowering people. These approaches are vital, but they are only half measures. To bring AI within the rule of law, lawmakers must start drawing substantive lines.

In this Article, we identify four AI regulatory approaches to consumer, data, and democratic harms as half measures. First, transparency does not produce accountability on its own. Second, while mitigating bias in AI systems is critical, even unbiased systems are a threat to the vulnerable. Third, …

The Hypocrisy Of Data Governance, Zubair Shafiq, Olivia Figueira, Athina Markopoulou, Woodrow Hartzog, Michael Lavine

Faculty Scholarship

“Data governance” is an empty term, like a Rorschach inkblot just waiting to be filled with meaning. Tech companies take advantage of this ambiguity to craft narratives about their data-governance capabilities to fit their audience and purpose. On one hand, tech companies brag about their data-governance capabilities when it fits their business model (for example, to advertisers) and public image (for example, to their customers). On the other hand, tech companies claim that meaningful data governance is challenging or impossible when accountability is demanded.

In this Article, we argue that tech companies systematically misrepresent or selectively ignore their data-governance capabilities. …

Privacy’S Autonomy Thicket: Disentangling Choice, Consent And Control, Jordan Francis, Woodrow Hartzog, Neil Richards

Faculty Scholarship

When it comes to talking about autonomy, privacy law could use a little clarity. Its discourse uses terms like “choice,” “consent,” and “control” to evoke autonomy, but these terms are too rarely defined and too often used interchangeably, even though they can mean very different things. The three terms have become entangled in a way that has become confusing and counterproductive. We call this problem “privacy’s autonomy thicket,” and it matters because it encourages talking past each other in policy debates, enabling the redefinition of these terms in misleading ways that produce weak and disempowering “notice and choice” regimes.

In …

Corporate Law's Duty Of Data Loyalty, Andy Serwin, Neil Richards, Woodrow Hartzog, Ryan Durrie

Faculty Scholarship

Privacy law used to be a relatively tidy field, involving a few interesting but discrete topics like press disclosures of private facts, wiretapping, and the processing of personal data by internet companies. But as the digital revolution continues to disrupt area after area of human activity and software “is eating the world,” the core concerns of privacy law such as “when is it appropriate to process personal data?” have similarly entered field after field. Today, most fields of law, including discrimination law, antitrust, and international law, have found it necessary to reckon with the questions of informational harm and power …

Data As Policy, Janet Freilich, W. Nicholson Price Ii

Faculty Scholarship

A large literature on regulation highlights the many different methods of policy-making: command-and-control rulemaking, informational disclosures, tort liability, taxes, and more. But the literature overlooks a powerful method to achieve policy objectives: data. The state can provide (or suppress) data as a regulatory tool to solve policy problems. For administrations with expansive views of government’s purpose, government-provided data can serve as infrastructure for innovation and push innovation in socially desirable directions; for administrations with deregulatory ambitions, suppressing or choosing not to collect data can reduce regulatory power or serve as a back-door mechanism to subvert statutory or common law rules. …

Gig Work At What Cost? Exploring Privacy Risks Of Gig Work Platform Participation In The U.S., Amogh Pradeep, Johanna Gunawan, Álvaro Feal, Woodrow Hartzog, David Choffnes

Faculty Scholarship

In recent years, "gig work" platforms have gained popularity as a way for individuals to earn money; as of 2021, 16% of Americans have at some point earned money from such platforms. Despite their popularity and their history of unfair data collection practices and worker safety, little is known about the data collected from workers (and users) by gig platforms and about the privacy dark pattern designs present in their apps.

This paper presents an empirical measurement of 16 gig work platforms' data practices in the U.S. We analyze what data is collected by these platforms, and how it is …

Normalizing Facial Recognition Technology And The End Of Obscurity, Woodrow Hartzog, Evan Selinger, Judy Hyojoo Rhee

Faculty Scholarship

This article argues that facial recognition technology is the most dangerous surveillance tool ever invented. Given the unique threats this morally suspect tool poses to privacy, civil liberties, human flourishing, and democracy, the only appropriate response is a ban. To justify our position, we explain why facial recognition is distinctive among biometrics, clarify how even seemingly benign and positive uses of the technology can trigger dangerous normalization dynamics, and pinpoint why current United States laws (with reverberations in the EU’s AI Act) are designed to accelerate a slippery slope that makes mass surveillance nearly inevitable. Our most fundamental contribution lies …

The Great Scrape: The Clash Between Scraping And Privacy, Daniel J. Solove, Woodrow Hartzog

Faculty Scholarship

Artificial intelligence (AI) systems depend on massive quantities of data, often gathered by “scraping”—the automated extraction of large amounts of data from the internet. A great deal of scraped data contains people’s personal information. This personal data provides the grist for AI tools such as facial recognition, deep fakes, and generative AI. Although scraping enables web searching, archiving of records, and meaningful scientific research, scraping for AI can also be objectionable and even harmful to individuals and society.

Organizations are scraping at an escalating pace and scale, even though many privacy laws are seemingly incongruous with the practice. In this …

Privacy Nicks: How The Law Normalizes Surveillance, Woodrow N. Hartzog, Evan Selinger, Johanna Gunawan

Faculty Scholarship

Privacy law is failing to protect individuals from being watched and exposed, despite stronger surveillance and data protection rules. The problem is that our rules look to social norms to set thresholds for privacy violations, but people can get used to being observed. In this article, we argue that by ignoring de minimis privacy encroachments, the law is complicit in normalizing surveillance. Privacy law helps acclimate people to being watched by ignoring smaller, more frequent, and more mundane privacy diminutions. We call these reductions “privacy nicks,” like the proverbial “thousand cuts” that lead to death.
/="/">
/="/">Privacy nicks come …

Against Engagement, Neil Richards, Woodrow Hartzog

Faculty Scholarship

In this Article, we focus on a key dimension of commercial surveillance by data-intensive digital platforms that is too often treated as a supporting cast member instead of a star of the show: the concept of engagement. Engagement is, simply put, a measure of time, attention, and other interactions with a service. The economic logic of engagement is simple: more engagement equals more ads watched equals more revenue. Engagement is a lucrative digital business model, but it is problematic in several ways that lurk beneath the happy sloganeering of a “free” internet

Our goal in this Article is to isolate …

Kafka In The Age Of Ai And The Futility Of Privacy As Control, Daniel Solove, Woodrow Hartzog

Faculty Scholarship

Despite writing more than a century ago, Franz Kafka captured the core problem of digital technologies—how individuals are rendered powerless and vulnerable. Over the past fifty years, and especially in the twenty-first century, privacy laws have been sprouting up around the world. These laws are often based heavily on an Individual Control Model that aims to empower individuals with rights to help them control the collection, use, and disclosure of their data.

In this Article, we argue that although Kafka starkly shows us the plight of the disempowered individual, his work also paradoxically suggests that empowering the individual isn’t the …

Two Ai Truths And A Lie, Woodrow Hartzog

Faculty Scholarship

Industry will take everything it can in developing Artificial Intelligence (AI) systems. We will get used to it. This will be done for our benefit. Two of these things are true and one of them is a lie. It is critical that lawmakers identify them correctly. In this Essay, I argue that no matter how AI systems develop, if lawmakers do not address the dynamics of dangerous extraction, harmful normalization, and adversarial self-dealing, then AI systems will likely be used to do more harm than good.

Given these inevitabilities, lawmakers will need to change their usual approach to regulating technology. …

Brief Of Amici Curiae Privacy And First Amendment Law Professors In Support Of Defendant-Appellant And Reversal, G. S. Hans, Hannah Bloch-Wehba, Danielle K. Citron, Julie E. Cohen, Mary Anne Franks, Woodrow Hartzog, Margot E. Kaminski, Gregory P. Magarian, Frank Pasquale, Neil Richards, Daniel J. Solove

Faculty Scholarship

STATEMENT OF INTEREST: Amici curiae are law professors and scholars of data privacy, constitutional law, and the First Amendment. Amici write to provide the court with scholarly expertise on the complexities of data privacy law and its intersection with the First Amendment. Amici have collectively written scores of academic articles and multiple books on data privacy, technology, the First Amendment, and constitutional challenges to state and federal privacy regulation.

Amici submit this brief pursuant to Fed. Rule App. P. 29(a) and do not repeat arguments made by the parties. No party’s counsel authored this brief, or any part of …

Continuous Reproductive Surveillance, Michael Ulrich, Leah R. Fowler

Faculty Scholarship

The Dobbs opinion emphasizes that the state’s interest in the fetus extends to “all stages of development.” This essay briefly explores whether state legislators, agencies, and courts could use the “all stages of development” language to expand reproductive surveillance by using novel developments in consumer health technologies to augment those efforts.

National Telecommunications And Information Administration: Comments From Researchers At Boston University And The University Of Chicago, Ran Canetti, Aloni Cohen, Chris Conley, Mark Crovella, Stacey Dogan, Marco Gaboardi, Woodrow Hartzog, Rory Van Loo, Christopher Robertson, Katharine B. Silbaugh

Faculty Scholarship

These comments were composed by an interdisciplinary group of legal, computer science, and data science faculty and researchers at Boston University and the University of Chicago. This group collaborates on research projects that grapple with the legal, policy, and ethical implications of the use of algorithms and digital innovation in general, and more specifically regarding the use of online platforms, machine learning algorithms for classification, prediction, and decision making, and generative AI. Specific areas of expertise include the functionality and impact of recommendation systems; the development of Privacy Enhancing Technologies (PETs) and their relationship to privacy and data security laws; …

Femtechnodystopia, Leah R. Fowler, Michael Ulrich

Faculty Scholarship

Reproductive rights, as we have long understood them, are dead. But at the same time history seems to be moving backward, technology moves relentlessly forward. Femtech products, a category of consumer technology addressing an array of “female” health needs, seem poised to fill gaps created by states and stakeholders eager to limit birth control and abortion access and increase pregnancy surveillance and fetal rights. Period and fertility tracking applications could supplement or replace other contraception. Early digital alerts to missed periods can improve the chances of obtaining a legal abortion in states with ever-shrinking windows of availability or prompt behavioral …

Understanding Dark Patterns In Home Iot Devices, Monica Kowalczyk, Johanna Gunawan, David Choffnes, Daniel J. Dubois, Woodrow Hartzog, Christo Wilson

Faculty Scholarship

Internet-of-Things (IoT) devices are ubiquitous, but little attention has been paid to how they may incorporate dark patterns despite consumer protections and privacy concerns arising from their unique access to intimate spaces and always-on capabilities. This paper conducts a systematic investigation of dark patterns in 57 popular, diverse smart home devices. We update manual interaction and annotation methods for the IoT context, then analyze dark pattern frequency across device types, manufacturers, and interaction modalities. We find that dark patterns are pervasive in IoT experiences, but manifest in diverse ways across device traits. Speakers, doorbells, and camera devices contain the most …

A Scientific Approach To Tech Accountability, David Choffnes, Woodrow Hartzog, Scott Jordan, Athina Markopoulou, Zubair Shafiq

Faculty Scholarship

The Federal Trade Commission can only do so much to hold tech companies accountable. Enforcement agencies and the people they protect need help. One problem is that the inner workings of large organizations and complex algorithmically driven systems remain obscure and opaque while their privacy representations are voluminous and vague. In this Essay, we propose a scientific approach to tech accountability, where academic researchers can play a larger role in privacy policy. This approach involves surfacing a company’s privacy representations and statements, as well as measuring the actual behavior of their systems with respect to algorithms, user interfaces, and data …

A Concrete Proposal For Data Loyalty, Neil Richards, Woodrow Hartzog, Jordan Francis

Faculty Scholarship

Congress and state legislators are finally experimenting with new privacy frameworks, rights, and duties to move past the thoroughly critiqued “notice and choice” model for data privacy. While many new privacy proposals seek a more fortified version of the fair information practices, some legislators have placed a duty of data loyalty at the heart of their proposed privacy bills. This is important because a duty of data loyalty has the potential to anchor American privacy law in a way analogous to how the European Union approach is grounded in fundamental rights of privacy and data protection.

Unfortunately, there remains some …

Four Privacy Stories And Two Hard Cases, A Comment On Skinner-Thompson's Privacy At The Margins, Jessica Silbey

Faculty Scholarship

Scott Skinner-Thompson's new book, Privacy at the Margins, is what I would call a "fourth-generation" study of privacy law. Privacy's contours and justifications have been debated over the course of the twentieth century, first to establish it as a matter deserving legal protection (roughly the first half of the twentieth century), ² then to iterate its various common law and constitutional variations (starting in the 1960s), ³ and since the computer and internet revolution of the 1990s, to reevaluate privacy's growing importance but waning presence in the digitally-networked age.⁴ The third-generation of privacy scholarship has been a fast-growing area …

Pov: What Rights Could Unravel Next, In Light Of Draft Opinion By Scotus Overturning Roe V. Wade, Robert L. Tsai

Shorter Faculty Works

Beyond what Alito’s draft opinion in Dobbs v. Jackson Women’s Health Organization portends for the future of abortion rights is the striking method of analysis he employs in the reported draft. Despite his many efforts to reassure that the opinion “does not undermine” other constitutional rights “in any way,” it actually outlines a roadmap for the withdrawal of other cherished constitutional rights.

Is The End Of Roe V. Wade Near? Leaked Scotus Brief Says Yes, Nicole Huberfeld, Linda C. Mcclain

Shorter Faculty Works

Protesters on both sides of the abortion debate descended on the US Supreme Court Monday night and into Tuesday after a leaked secret draft of a US Supreme Court opinion indicated that a majority of justices support overturning Roe v. Wade, after almost 50 years of legalized abortion rights in America. If finalized, possibly as soon as this summer, the bombshell could trigger a cultural tsunami across American life, forcing some women to travel to another state for an abortion and putting the divisive issue at the heart of the fall midterm elections.

Privacy Pretexts, Rory Van Loo

Faculty Scholarship

Data privacy’s ethos lies in protecting the individual from institutions. Increasingly, however, institutions are deploying privacy arguments in ways that harm individuals. Platforms like Amazon, Facebook, and Google wall off information from competitors in the name of privacy. Financial institutions under investigation justify withholding files from the Consumer Financial Protection Bureau by saying they must protect sensitive customer data. In these and other ways, the private sector is exploiting privacy to avoid competition and accountability. This Article highlights the breadth of privacy pretexts and uncovers their moral structure. Like most pretexts, there is an element of truth to the claims. …

Legislating Data Loyalty, Woodrow Hartzog, Neil Richards

Faculty Scholarship

Lawmakers looking to embolden privacy law have begun to consider imposing duties of loyalty on organizations trusted with people’s data and online experiences. The idea behind loyalty is simple: organizations should not process data or design technologies that conflict with the best interests of trusting parties. But the logistics and implementation of data loyalty need to be developed if the concept is going to be capable of moving privacy law beyond its “notice and consent” roots to confront people’s vulnerabilities in their relationship with powerful data collectors.

In this short Essay, we propose a model for legislating data loyalty. Our …

The Surprising Virtues Of Data Loyalty, Woodrow Hartzog, Neil M. Richards

Faculty Scholarship

Lawmakers in the United States and Europe are seriously considering imposing duties of data loyalty that implement ideas from privacy law scholarship, but critics claim such duties are unnecessary, unworkable, overly individualistic, and indeterminately vague. This paper takes those criticisms seriously, and its analysis of them reveals that duties of data loyalty have surprising virtues. Loyalty, it turns out, can support collective well-being by embracing privacy’s relational turn; it can be a powerful state of mind for reenergizing privacy reform; it prioritizes human values rather than potentially empty formalism; and it offers solutions that are flexible and clear rather than …

A Comparative Study Of Dark Patterns Across Mobile And Web Modalities, Johanna Gunawan, Amogh Pradeep, David Choffnes, Woodrow Hartzog, Christo Wilson

Faculty Scholarship

Dark patterns are user interface elements that can influence a person's behavior against their intentions or best interests. Prior work identified these patterns in websites and mobile apps, but little is known about how the design of platforms might impact dark pattern manifestations and related human vulnerabilities. In this paper, we conduct a comparative study of mobile application, mobile browser, and web browser versions of 105 popular services to investigate variations in dark patterns across modalities. We perform manual tests, identify dark patterns in each service, and examine how they persist or differ by modality. Our findings show that while …

A Duty Of Loyalty For Privacy Law, Neil M. Richards, Woodrow Hartzog

Faculty Scholarship

Data privacy law fails to stop companies from engaging in self-serving, opportunistic behavior at the expense of those who trust them with their data. This is a problem. Modern tech companies are so entrenched in our lives and have so much control over what we see and click that the self-dealing exploitation of people has become a major element of the internet’s business model.

Academics and policymakers have recently proposed a possible solution: require those entrusted with people’s data and online experiences to be loyal to those who trust them. But many have concerns about a duty of loyalty. What, …