Privacy Law Commons^™

On The Right To Obscurity, Woodrow Hartzog, Evan Selinger

Faculty Scholarship

Tragically, U.S. privacy law has neglected to address a significant dimension of privacy. While lawmakers and judges have routinely recognized intrusions into our secluded spaces and breaches of our confidentiality and secrecy, they have largely failed to protect our most common yet also our most underappreciated form of privacy: the practical obscurity that allows us to live freely and with dignity. Obscurity, which is the state of protection that arises when personal information is difficult for some people to obtain or correctly interpret, serves several vital interests: (1) it safeguards our ability to express ourselves without fear that everything we …

On Predicting And Stopping Dystopia, Evan Selinger, Woodrow Hartzog

Faculty Scholarship

Is it reasonable to be dystopian about how the future will likely unfold? We think so. For some time, we have been arguing that facial recognition technology is a perfect tool of oppression, and that its pernicious affordances are leading society down a slippery slope toward the evisceration of privacy by obscurity. This is a soft form of “determinism”—the notion that while technology is not an unstoppable force and the future is not preordained, there nevertheless are identifiable factors, such as the invitingness of affordances, human nature, and incentives that drive technology in certain directions and make some social outcomes …

Legislatively Erased: The Failure Of Privacy Legislation To Protect People Connected To The Criminal Legal System, Chaz Arnett, Kate Weisburd

Faculty Scholarship

No abstract provided.

Obituary For The Birth Certificate, Malinda L. Seymore

Faculty Scholarship

Have birth certificates outlived their usefulness? Birth certificates establish an individual’s name, identity, age, race, sex and gender, parental authority, and citizenship. In addition, the information collected at the time of birth and reflected on a long-form birth certificate provides data for public health policy, population statistics, internal migration, government planning, and resource allocation. Birth certificates are also the all-access pass to American life, necessary for many functions of modern life: registering a child in school, signing a child up for soccer, getting a driver’s license and passport, enlisting in the military, and applying for government benefits. All of this, …

Information Law Pluralism, Hannah Bloch-Wehba

Faculty Scholarship

Information-intensive activities are reshaping political, social, and economic institutions. As they respond to these shifts, legislators and regulators are embracing information as a regulatory device for tech. Far from limiting themselves to public disclosure, consumer notice, and other traditional mechanisms of fostering transparency and information flows, however, legislators are using other, more nuanced tools to incentivize regulated entities to obtain, generate, and share information.

This Article maps the landscape of the emerging information-based regimes for regulating tech and assesses their conceptual and practical implications. It canvasses an extensive set of recently enacted laws regulating the information economy and shows that, …

Beyond Digital Pessimism: How A Focus On Trust Can Enhance Eu Digital Law, Neil Richards, Woodrow Hartzog, Claire Boine, Lea Despotis

Faculty Scholarship

Lawmakers looking to foster technological innovation on the European market are adopting laws they hope will promote consumer trust in digital products. Their strategy can be broken down into three components. First, they aim to empower consumers to choose how much data they want to share with companies through an express consent framework. Second, they seek to avoid harms from digital products through product safety law such as adapting the Product Safety Regulation to digital products or adopting the AI Act. Third, they endeavor to prevent manipulation of consumers through digital means.

In this essay, we argue that while laudable, …

Against Ai Half Measures, Woodrow Hartzog, Neil Richards, Ryan Durrie, Jordan Francis

Faculty Scholarship

So far, U.S. consumer protection policy for artificial intelligence (AI) accountability has largely consisted of industry-led approaches such as encouraging transparency, mitigating bias, promoting principles of ethics, and empowering people. These approaches are vital, but they are only half measures. To bring AI within the rule of law, lawmakers must start drawing substantive lines.

In this Article, we identify four AI regulatory approaches to consumer, data, and democratic harms as half measures. First, transparency does not produce accountability on its own. Second, while mitigating bias in AI systems is critical, even unbiased systems are a threat to the vulnerable. Third, …

The Hypocrisy Of Data Governance, Zubair Shafiq, Olivia Figueira, Athina Markopoulou, Woodrow Hartzog, Michael Lavine

Faculty Scholarship

“Data governance” is an empty term, like a Rorschach inkblot just waiting to be filled with meaning. Tech companies take advantage of this ambiguity to craft narratives about their data-governance capabilities to fit their audience and purpose. On one hand, tech companies brag about their data-governance capabilities when it fits their business model (for example, to advertisers) and public image (for example, to their customers). On the other hand, tech companies claim that meaningful data governance is challenging or impossible when accountability is demanded.

In this Article, we argue that tech companies systematically misrepresent or selectively ignore their data-governance capabilities. …

Privacy’S Autonomy Thicket: Disentangling Choice, Consent And Control, Jordan Francis, Woodrow Hartzog, Neil Richards

Faculty Scholarship

When it comes to talking about autonomy, privacy law could use a little clarity. Its discourse uses terms like “choice,” “consent,” and “control” to evoke autonomy, but these terms are too rarely defined and too often used interchangeably, even though they can mean very different things. The three terms have become entangled in a way that has become confusing and counterproductive. We call this problem “privacy’s autonomy thicket,” and it matters because it encourages talking past each other in policy debates, enabling the redefinition of these terms in misleading ways that produce weak and disempowering “notice and choice” regimes.

In …

Corporate Law's Duty Of Data Loyalty, Andy Serwin, Neil Richards, Woodrow Hartzog, Ryan Durrie

Faculty Scholarship

Privacy law used to be a relatively tidy field, involving a few interesting but discrete topics like press disclosures of private facts, wiretapping, and the processing of personal data by internet companies. But as the digital revolution continues to disrupt area after area of human activity and software “is eating the world,” the core concerns of privacy law such as “when is it appropriate to process personal data?” have similarly entered field after field. Today, most fields of law, including discrimination law, antitrust, and international law, have found it necessary to reckon with the questions of informational harm and power …

Data As Policy, Janet Freilich, W. Nicholson Price Ii

Faculty Scholarship

A large literature on regulation highlights the many different methods of policy-making: command-and-control rulemaking, informational disclosures, tort liability, taxes, and more. But the literature overlooks a powerful method to achieve policy objectives: data. The state can provide (or suppress) data as a regulatory tool to solve policy problems. For administrations with expansive views of government’s purpose, government-provided data can serve as infrastructure for innovation and push innovation in socially desirable directions; for administrations with deregulatory ambitions, suppressing or choosing not to collect data can reduce regulatory power or serve as a back-door mechanism to subvert statutory or common law rules. …

Die Wirkliche Gefahr Liegt In Der Erosion Der Autonomie: Ein E-Mail-Interview Über Kognitive Freiheit Und Die Problematische Nutzung Neuronaler Daten, Nita Farahany, James Kennaway, Bernd Bösel

Faculty Scholarship

In this interview, James Kennaway and Bernd Bösel talk to Nita Farahany about significant themes related to the idea of mind control, as discussed in her book "The Battle for Your Brain" (2023). The book outlines the risks that neurotechnology poses to "cognitive freedom". EEG and EMG data are increasingly used in consumer products, raising concerns about potential misuse. Companies and governments could exploit cognitive biometric data for manipulation or control. Farahany calls for clear legal protections and highlights differences between U.S. and European regulations. She warns of neurotechnological warfare and advocates for global bans. While full mind control remains …

Gig Work At What Cost? Exploring Privacy Risks Of Gig Work Platform Participation In The U.S., Amogh Pradeep, Johanna Gunawan, Álvaro Feal, Woodrow Hartzog, David Choffnes

Faculty Scholarship

In recent years, "gig work" platforms have gained popularity as a way for individuals to earn money; as of 2021, 16% of Americans have at some point earned money from such platforms. Despite their popularity and their history of unfair data collection practices and worker safety, little is known about the data collected from workers (and users) by gig platforms and about the privacy dark pattern designs present in their apps.

This paper presents an empirical measurement of 16 gig work platforms' data practices in the U.S. We analyze what data is collected by these platforms, and how it is …

Normalizing Facial Recognition Technology And The End Of Obscurity, Woodrow Hartzog, Evan Selinger, Judy Hyojoo Rhee

Faculty Scholarship

This article argues that facial recognition technology is the most dangerous surveillance tool ever invented. Given the unique threats this morally suspect tool poses to privacy, civil liberties, human flourishing, and democracy, the only appropriate response is a ban. To justify our position, we explain why facial recognition is distinctive among biometrics, clarify how even seemingly benign and positive uses of the technology can trigger dangerous normalization dynamics, and pinpoint why current United States laws (with reverberations in the EU’s AI Act) are designed to accelerate a slippery slope that makes mass surveillance nearly inevitable. Our most fundamental contribution lies …

The Great Scrape: The Clash Between Scraping And Privacy, Daniel J. Solove, Woodrow Hartzog

Faculty Scholarship

Artificial intelligence (AI) systems depend on massive quantities of data, often gathered by “scraping”—the automated extraction of large amounts of data from the internet. A great deal of scraped data contains people’s personal information. This personal data provides the grist for AI tools such as facial recognition, deep fakes, and generative AI. Although scraping enables web searching, archiving of records, and meaningful scientific research, scraping for AI can also be objectionable and even harmful to individuals and society.

Organizations are scraping at an escalating pace and scale, even though many privacy laws are seemingly incongruous with the practice. In this …

Ai Regulation Has Its Own Alignment Problem: The Technical And Institutional Feasibility Of Disclosure, Registration, Licensing, And Auditing, Neel Guha, Christie M. Lawrence, Lindsey A. Gailmard, Kit T. Rodolfa, Faiz Surani, Rishi Bommasani, Inioluwa Deborah Raji, Mariano-Florentino Cuéllar, Colleen Honigsberg, Percy Liang, Daniel E. Ho

Faculty Scholarship

Calls for regulating artificial intelligence (“AI”) are widespread, but there remains little consensus on both the specific harms that regulation can and should address and the appropriate regulatory actions to take. Computer scientists propose technical solutions that may be infeasible or illegal; lawyers propose regulation that may be technically impossible; and commentators propose policies that may backfire. AI regulation, in that sense, has its own alignment problem, in which proposed interventions are often misaligned with societal values.This Article assesses the alignment and technical and institutional feasibility of four dominant proposals for AI regulation in the United States: disclosure, registration, licensing, …

Juror Privacy Via Anonymity, Jayne S. Ressler

Faculty Scholarship

No abstract provided.

False Start On Nil: Public And Private Law Should Treat College Athletes Like Any Other Student, Jodi Balsam

Faculty Scholarship

No abstract provided.

“Can I Have It Non-Personalised?” An Empirical Investigation Of Consumer Willingness To Share Data For Personalized Services And Ads, Monika Leszczynska, Daria Baltag

Faculty Scholarship

European regulators, courts, and scholars are currently debating the legality of data processing for personalization purposes. Should businesses require separate consent for processing user data for personalized advertising, especially when offering free services reliant on such ads for revenue? Or is general consent for the contract enough, given personalized advertising’s role in fulfilling contractual obligations? This study investigates whether these legal distinctions reflect differences in people’s willingness to share data with businesses for personalization. Are consumers less willing to share their data for personalized advertising than for personalized services that they clearly contracted for? Does that change if the service …

The Automated Fourth Amendment, Maneka Sinha

Faculty Scholarship

Courts routinely defer to police officer judgments in reasonable suspicion and probable cause determinations. Increasingly, though, police officers outsource these threshold judgments to new forms of technology that purport to predict and detect crime and identify those responsible. These policing technologies automate core police determinations about whether crime is occurring and who is responsible. Criminal procedure doctrine has failed to insist on some level of scrutiny of—or skepticism about—the reliability of this technology. Through an original study analyzing numerous state and federal court opinions, this Article exposes the implications of law enforcement’s reliance on these practices given the weighty interests …

Crowdsourcing Surveillance, Chaz Arnett

Faculty Scholarship

In Unreasonable: Black Lives, Police Power, and the Fourth Amendment, Devon W. Carbado illuminates how both the spectacular and quotidian forms of racialized terror, brutality, and surveillance—characteristic of enslavement—have shaped the construction of our constitutional order. He argues that the combined social normalization and legal naturalization of racial hierarchy paved the way for the development of slave patrols and other early iterations of policing where incredible acts of violence against Black bodies were made ordinary and essential. He explains how this legacy continues today with Fourth Amendment jurisprudence not simply failing to protect rights but rather licensing police violence …

Everybody Wants To Rule The World: Central Bank Digital Currencies In The Era Of Decoupling The World’S Two Largest Economies, James M. Cooper

Faculty Scholarship

Some 130 central banks around the world are experimenting with various levels of a central bank digital currency (“CBDC”), a digitized form of a sovereign-backed, national currency that is a liability of that country’s central bank. Unlike fiat currency, CBDCs are trackable and potentially subject to interference and even freezing by government authorities. CBDCs will affect citizens’ control over commerce, payments, and savings, and impact their privacy rights. The Chinese government has piloted, refined, and rolled out its own CBDC called the Digital Currency/Electronic Payment initiative (“DC/EP”), also known as the digital yuan or e-CNY. The Chinese government is far …

Beyond Neural Data: Cognitive Biometrics And Mental Privacy, Patrick Magee, Marcello Ienca, Nita Farahany

Faculty Scholarship

Innovations in wearable technology and artificial intelligence have enabled consumer devices to process and transmit data about human mental states (cognitive, affective, and conative) through what this paper refers to as ‘‘cognitive biometrics.’’ Devices such as brain-computer interfaces, extended reality headsets, and fitness wearables offer significant benefits in health, wellness, and entertainment through the collection and processing and cognitive biometric data. However, they also pose unique risks to mental privacy due to their ability to infer sensitive information about individuals. This paper challenges the current approach to protecting individuals through legal protections for ‘‘neural data’’ and advocates for a more …

U.S. Public Perceptions Of The Sensitivity Of Brain Data, Shenyang Huang, Umika Paul, Shikhar Gupta, Karan Desai, Melinda Guo, Jennifer Jung, Beatrice Capestany, William D. Krenzer, Dylan Stonecipher, Nita A. Farahany

Faculty Scholarship

As we approach an era of potentially widespread consumer neurotechnology, scholars and organizations worldwide have started to raise concerns about the data privacy issues these devices will present. Notably absent in these discussions is empirical evidence about how the public perceives that same information. This article presents the results of a nationwide survey on public perceptions of brain data, to inform discussions of law and policy regarding brain data governance. The survey reveals that the public may perceive certain brain data as less sensitive than other ‘private’ information, like social security numbers, but more sensitive than some ‘public’ information, like …

Privacy Nicks: How The Law Normalizes Surveillance, Woodrow N. Hartzog, Evan Selinger, Johanna Gunawan

Faculty Scholarship

Privacy law is failing to protect individuals from being watched and exposed, despite stronger surveillance and data protection rules. The problem is that our rules look to social norms to set thresholds for privacy violations, but people can get used to being observed. In this article, we argue that by ignoring de minimis privacy encroachments, the law is complicit in normalizing surveillance. Privacy law helps acclimate people to being watched by ignoring smaller, more frequent, and more mundane privacy diminutions. We call these reductions “privacy nicks,” like the proverbial “thousand cuts” that lead to death.
/="/">
/="/">Privacy nicks come …

Against Engagement, Neil Richards, Woodrow Hartzog

Faculty Scholarship

In this Article, we focus on a key dimension of commercial surveillance by data-intensive digital platforms that is too often treated as a supporting cast member instead of a star of the show: the concept of engagement. Engagement is, simply put, a measure of time, attention, and other interactions with a service. The economic logic of engagement is simple: more engagement equals more ads watched equals more revenue. Engagement is a lucrative digital business model, but it is problematic in several ways that lurk beneath the happy sloganeering of a “free” internet

Our goal in this Article is to isolate …

Kafka In The Age Of Ai And The Futility Of Privacy As Control, Daniel Solove, Woodrow Hartzog

Faculty Scholarship

Despite writing more than a century ago, Franz Kafka captured the core problem of digital technologies—how individuals are rendered powerless and vulnerable. Over the past fifty years, and especially in the twenty-first century, privacy laws have been sprouting up around the world. These laws are often based heavily on an Individual Control Model that aims to empower individuals with rights to help them control the collection, use, and disclosure of their data.

In this Article, we argue that although Kafka starkly shows us the plight of the disempowered individual, his work also paradoxically suggests that empowering the individual isn’t the …

Two Ai Truths And A Lie, Woodrow Hartzog

Faculty Scholarship

Industry will take everything it can in developing Artificial Intelligence (AI) systems. We will get used to it. This will be done for our benefit. Two of these things are true and one of them is a lie. It is critical that lawmakers identify them correctly. In this Essay, I argue that no matter how AI systems develop, if lawmakers do not address the dynamics of dangerous extraction, harmful normalization, and adversarial self-dealing, then AI systems will likely be used to do more harm than good.

Given these inevitabilities, lawmakers will need to change their usual approach to regulating technology. …

Brief Of Amici Curiae Privacy And First Amendment Law Professors In Support Of Defendant-Appellant And Reversal, G. S. Hans, Hannah Bloch-Wehba, Danielle K. Citron, Julie E. Cohen, Mary Anne Franks, Woodrow Hartzog, Margot E. Kaminski, Gregory P. Magarian, Frank Pasquale, Neil Richards, Daniel J. Solove

Faculty Scholarship

STATEMENT OF INTEREST: Amici curiae are law professors and scholars of data privacy, constitutional law, and the First Amendment. Amici write to provide the court with scholarly expertise on the complexities of data privacy law and its intersection with the First Amendment. Amici have collectively written scores of academic articles and multiple books on data privacy, technology, the First Amendment, and constitutional challenges to state and federal privacy regulation.

Amici submit this brief pursuant to Fed. Rule App. P. 29(a) and do not repeat arguments made by the parties. No party’s counsel authored this brief, or any part of …

Continuous Reproductive Surveillance, Michael Ulrich, Leah R. Fowler

Faculty Scholarship

The Dobbs opinion emphasizes that the state’s interest in the fetus extends to “all stages of development.” This essay briefly explores whether state legislators, agencies, and courts could use the “all stages of development” language to expand reproductive surveillance by using novel developments in consumer health technologies to augment those efforts.