Privacy Law Commons^™

On The Right To Obscurity, Woodrow Hartzog, Evan Selinger

Faculty Scholarship

Tragically, U.S. privacy law has neglected to address a significant dimension of privacy. While lawmakers and judges have routinely recognized intrusions into our secluded spaces and breaches of our confidentiality and secrecy, they have largely failed to protect our most common yet also our most underappreciated form of privacy: the practical obscurity that allows us to live freely and with dignity. Obscurity, which is the state of protection that arises when personal information is difficult for some people to obtain or correctly interpret, serves several vital interests: (1) it safeguards our ability to express ourselves without fear that everything we …

The Privacy Law Jigsaw: Piecing Together Legal Compliance When Pieces Don’T Fit, Roy Wyman, Wesley Mcculloch

Vanderbilt Journal of Entertainment & Technology Law

Over the past six years the United States has shifted from a relatively stable and laissez-faire privacy regime, anchored by a few, sector-specific federal statutes such as the Health Insurance Portability and Accountability Act, to an increasingly fragmented landscape dominated by numerous state-level consumer privacy laws. While these laws share commonalities, they also vary in important ways. This Article analyzes that patchwork legal regime and its impact on businesses through four points of friction: (i) statutory applicability and thresholds; (ii) notice-and-choice requirements; (iii) individual data-management rights; and (iv) controller–processor contracting obligations. This Article further explores how modern service-delivery models, especially …

From Privacy To The Data Economy: The Ftc’S Reframing Of Its Regulatory Priorities, Maria P. Angel

Scholarly Works

This Article argues that the Federal Trade Commission’s turn to “commercial surveillance” reflects a strategic shift away from traditional privacy frameworks toward addressing structural power dynamics in the data economy. Drawing on an analysis of 112 FTC documents, it identifies three core commitments: tackling systemic harms, adopting a political economy lens, and constraining corporate power. The Article contends that this reframing is both necessary in the AI age and should influence the future of privacy regulation in the United States, even amid efforts to limit the FTC’s authority.

The Growing Divide: The Video Privacy Protection Act’S Inconsistent Subscriber Standard And The Need For Reform, Andrea Pacheco

American University Business Law Review

The Video Privacy Protection Act of 1988 (“VPPA”) has been brought into the twenty-first century due to a series of class action lawsuits surrounding consumer privacy rights in an increasingly digital world. A circuit split has emerged among the federal appellate courts on the meaning of the word “subscriber” under the VPPA and whether the statute’s protections should extend to casual users of goods and services provided by videotape service providers. The outcome of this debate carries significant implications for consumer privacy and business compliance obligations due to the escalation of business practices involving the collection of consumer data and …

Privacy’S Autonomy Thicket: Disentangling Choice, Consent And Control, Jordan Francis, Woodrow Hartzog, Neil Richards

Faculty Scholarship

When it comes to talking about autonomy, privacy law could use a little clarity. Its discourse uses terms like “choice,” “consent,” and “control” to evoke autonomy, but these terms are too rarely defined and too often used interchangeably, even though they can mean very different things. The three terms have become entangled in a way that has become confusing and counterproductive. We call this problem “privacy’s autonomy thicket,” and it matters because it encourages talking past each other in policy debates, enabling the redefinition of these terms in misleading ways that produce weak and disempowering “notice and choice” regimes.

In …

The Search Of A Search: Moderating Reverse Internet Keyword Warrants, Tui Rademaker

Northwestern University Law Review

Statistics show that Americans consistently turn to Google and other search engines to answer their most personal and private concerns, yet a new investigative tool risks law enforcement having vast discretion in the access of this data. With a keyword warrant, law enforcement can request from a search engine provider (usually Google) a list of probative search queries that users made over a specified time period. Such warrants are beginning to face legal challenges, and so far, courts seem reluctant to recognize the constitutional implications—instead leaving law enforcement with greater potential discretion over their use.

This Note assesses the constitutionality …

Losing The Big Picture: An Argument For Preserving Irpa Rights For Emotional Damages, Stephen Luke Winbery

Chicago-Kent Law Review

No abstract provided.

Can Ai, As Such, Invade Your Privacy? An Experimental Study Of The Social Element Of Surveillance, Aileen Nielsen

Indiana Law Journal

The increasing use of AI rather than human surveillance puts pressure on two long-used cultural and (sometimes) legal distinctions: as between human and machine observers and as between content and metadata. Machines do more and more watching through advancing technology, rendering AI a plausible replacement for humans in surveillance tasks. Further, machines can commit to surveil only certain forms of information in a way that humans cannot, rendering the distinction between content and metadata increasingly relevant too for crafting privacy law and policy. Yet despite the increasing importance of these distinctions, their legal importance remains in four key domains of …

What Copyright Can't Do, Blake E. Reid

Pepperdine Law Review

Copyright has become a powerful regulatory regime for modern American life. Copyrighted works, including text, images, video, sounds, music, and software, coupled with routine, frictionless copying, form a large part of the information, cultural and social context, and infrastructure of our increasingly digital society. Copyright law’s powerful remedies are now positioned to intervene in a wide range of everyday activities. As a result, scholars, policymakers, and advocates have increasingly called for modifying and applying U.S. copyright law to solve a wide range of public policy problems, from vindicating disability rights to protecting privacy to promoting competition among wireless carriers. But …

Adopting Permissioned Blockchain Models To Enhance Consumer Protection And Comply With Consumer Protection Laws, Erika Buenrostro

Featured Student Work

Blockchain technology enables decentralized, peer-to-peer transactions and data management, offering transparency while raising data privacy and consumer protection concerns. As the current administration promotes blockchain adoption, including cryptocurrency, more users and businesses will likely integrate the technology. This thesis provides a framework to help businesses adopt blockchain while ensuring compliance with the California Consumer Privacy Act (CCPA). To prevent data mishandling and legal penalties, consumers and businesses must stay informed about the risks and evolving state privacy laws.

A CCPA-compliant approach retains blockchain’s benefits through a permissioned model, storing only non-personal (neutral) data on-chain while keeping personal information off-chain in …

The Power Of Procedure: Uncovering The Gap In U.S. Privacy Rights, Bernard Chao, Mandi Abbott

Pepperdine Law Review

As Congress faces increasing pressure to adopt comprehensive privacy legislation, this Article seeks to contribute to the ongoing discussions by exploring critical procedural deficiencies in U.S. privacy laws and their implications for domestic privacy rights and international data flows. This Article makes several key contributions to the field. First, it uses a comparative law perspective to highlight the lack of robust procedural rights and remedies in U.S. privacy law. Second, while many have questioned whether the Court of Jus tice for the European Union will strike down the latest U.S.-EU Data Privacy Framework (the primary mechanism for allowing the transatlantic …

Home—The Final Frontier: Why Privacy Means Protecting Workers' Rights To Time And Space, Joshua Fairfield, Amanda Reilly

Scholarly Articles

This article critiques the failure of current privacy frameworks to protect workers—especially teleworkers—from the growing encroachment of employer surveillance into their homes. It argues that prevailing privacy regimes, including notice-and-choice models and the GDPR, inadequately address the systemic power asymmetries in the employment relationship, often enabling rather than restricting invasive monitoring. Drawing from labor law traditions, the authors propose a rights-centered framework that views time and space as essential for human dignity and autonomy. They call for a non-negotiable floor of protections, including surveillance-free periods, bans on data commodification, and the establishment of an enforcement inspectorate. By reframing privacy not …

The Evolution Of Surveillance And The Decline Of Privacy, Alan J. Geyer

Honors Undergraduate Theses

This study directly examines how surveillance law and technology have evolved in the United States and how privacy rights have declined correspondingly. The study specifically focuses on how advancements in surveillance technology have overstepped the boundaries of Fourth Amendment protections and analyzes whether these provisions are adequate for protecting citizens in the modern technological era. The study explores newly employed methods of technological surveillance, such as facial recognition, data collection, and automated license plate readers. It focuses on how government surveillance programs have reshaped legal and ethical understandings of privacy. The changes in surveillance and technology have been analyzed by …

Impacted Stakeholder Participation In Ai And Data Governance, Margot Kaminski, Gianclaudio Malgieri

Publications

Privacy law has long centered on the individual. But we observe a meaningful shift toward group harm and rights. There is growing recognition that data-driven practices, including the development and use of artificial intelligence (AI) systems, affect not just atomized individuals but also their neighborhoods and communities, including and especially situationally vulnerable and historically marginalized groups.

This Article explores a recent shift in both data privacy law and the newly developing law of AI: a turn towards stakeholder participation in the governance of AI and data systems, specifically by impacted groups often though not always representing historically marginalized communities. In …

Centering The Vulnerable Through Data Protection, Scott Skinner-Thompson

Publications

No abstract provided.

The Great Scrape: The Clash Between Scraping And Privacy, Daniel J. Solove, Woodrow Hartzog

Faculty Scholarship

Artificial intelligence (AI) systems depend on massive quantities of data, often gathered by “scraping”—the automated extraction of large amounts of data from the internet. A great deal of scraped data contains people’s personal information. This personal data provides the grist for AI tools such as facial recognition, deep fakes, and generative AI. Although scraping enables web searching, archiving of records, and meaningful scientific research, scraping for AI can also be objectionable and even harmful to individuals and society.

Organizations are scraping at an escalating pace and scale, even though many privacy laws are seemingly incongruous with the practice. In this …

Ai Regulation Has Its Own Alignment Problem: The Technical And Institutional Feasibility Of Disclosure, Registration, Licensing, And Auditing, Neel Guha, Christie M. Lawrence, Lindsey A. Gailmard, Kit T. Rodolfa, Faiz Surani, Rishi Bommasani, Inioluwa Deborah Raji, Mariano-Florentino Cuéllar, Colleen Honigsberg, Percy Liang, Daniel E. Ho

Faculty Scholarship

Calls for regulating artificial intelligence (“AI”) are widespread, but there remains little consensus on both the specific harms that regulation can and should address and the appropriate regulatory actions to take. Computer scientists propose technical solutions that may be infeasible or illegal; lawyers propose regulation that may be technically impossible; and commentators propose policies that may backfire. AI regulation, in that sense, has its own alignment problem, in which proposed interventions are often misaligned with societal values.This Article assesses the alignment and technical and institutional feasibility of four dominant proposals for AI regulation in the United States: disclosure, registration, licensing, …

Chilling Victims’ Rights: The Supreme Court Creates A “Pride Of Place” For True Threats, Ana Maria Matovic

Dickinson Law Review (2017-Present)

Living in the Information Age means that information is literally always at our fingertips. This also means that keeping tabs on one another is as easy as a tap on a screen. The effortless ability to follow another’s life on the internet has led to a sinister phenomenon: cyberstalking. Prosecuting cyberstalking cases poses complex constitutional challenges. Specifically, prosecuting these cases may clash with a perpetrator’s First Amendment right to free speech. However, the First Amendment does not protect all categories of speech. One of those unprotected categories is the category of “true threats.” If a perpetrator’s conduct constitutes a “true …

The Outer Limits Of Digital Privacy Protections: A Review Of The Privacy Fallacy, Michael Conklin

Dickinson Law Review (2017-Present)

No abstract provided.

The Privacy Fallacy: Harm And Power In The Information Economy By Ignacio Cofone, Christopher D'Souza

Canadian Journal of Law and Technology

‘‘Our privacy is besieged by tech companies,”1 laments Ignacio Cofone, Law Professor and privacy aficionado, in The Privacy Fallacy: Harm and Power in the Information Economy. In an enlightening yet harrowing discourse, Cofone draws on insights from behavioural science, sociology, and economics2 to argue that the widespread consent-based model of privacy is not only outdated, but untenable given modern data practices.3 Further, Cofone acknowledges the increasing use of Artificial Intelligence (AI) in data processing, leading to novel challenges for the safeguarding of personal information.4 Thus, The Privacy Fallacy is more than just about privacy law’s shortcomings; it also raises questions …

Implementing Information Fiduciaries, Samuel E. Marticke

Georgia State University Law Review

This Note discusses the information fiduciary model, proposed by Jack Balkin, where fiduciary duties would be imposed on data collectors and analyzes how such a model could come to pass in the United States.

Secrecy On Steroids: How Overzealous State Confidentiality Laws Expose Leakers And Whistleblowers To Retaliatory Prosecution, Frank D. Lomonte, Anne Marie Tamburro

University of Miami Law Review

It is well-documented that the federal government has a secrecy problem. Thousands of times a year, inconsequential documents are needlessly stamped “classified,” which can mean prison for anyone who leaks them. But the addiction to secrecy doesn’t stop with the Pentagon. State public-records statutes are riddled with their own local version of “classified information” that puts people at risk of prosecution even for well-intentioned whistleblowing.

The problem is particularly acute in Florida, where one of the state’s highest-ranking elected officials spent almost two years as the target of a criminal investigation for releasing records about an unresolved sexual harassment complaint …

Techno-Legal Solutionism: Regulating Children's Online Safety In The United States, Maria P. Angel, Danah Boyd

Scholarly Works

Convinced that social media is directly harming children, policymakers have started to introduce legislation that requires technology companies to be safe by design through “duty of care” provisions. Unlike regulations that focus on product safety, these bills incorporate technosolutionist logics into regulation by presuming that technology companies can remedy complex harms like mental health duress and bullying if their products were only designed better. In this paper, we unpack the theory of change at the center of the “duty of care” included in the “Kids Online Safety Act” (KOSA). We argue that techno-legal solutionism is both ineffective as a framework …

Data Is What Data Does: Regulating Based On Harm And Risk Instead Of Sensitive Data, Daniel J. Solove

Northwestern University Law Review

Heightened protection for sensitive data is becoming quite trendy in privacy laws around the world. Originating in European Union (EU) data protection law and included in the EU’s General Data Protection Regulation, sensitive data singles out certain categories of personal data for extra protection. Commonly recognized special categories of sensitive data include racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, health, sexual orientation and sex life, and biometric and genetic data.

Although heightened protection for sensitive data appropriately recognizes that not all situations involving personal data should be protected uniformly, the sensitive data approach is …

The Trade Origins Of Privacy Law, Anupam Chander

Indiana Law Journal

The desire for trade propelled the growth of data privacy law across the world. Countries with strong privacy laws sought to ensure that their citizens’ privacy would not be compromised when their data traveled to other countries. Even before this vaunted Brussels Effect pushed privacy law across the world through the enticement of trade with the European Union, Brussels had to erect privacy law within the Union itself. And as the Union itself expanded, privacy law was a critical condition for accession.

But this coupling of privacy and trade leaves a puzzle: how did the U.S. avoid a comprehensive privacy …

Coping With Coppa: Exploring Alternatives To The Children's Online Privacy Protection Act, Andrew Parra

Indiana Journal of Law and Social Equality

The Children’s Online Privacy Protection Act of 1998 (COPPA) stands as one of the greatest protectors of children’s privacy for nearly twenty-five years. However, COPPA has struggled to keep pace with technological changes during this time, and the COVID-19 pandemic highlighted the shortcomings of COPPA regulations as children were forced to spend increased amounts of time in digital spaces. As the Federal Trade Commission (FTC) is set to make changes to COPPA, it is necessary to consider what changes would be most beneficial to protect children. This paper will explore the current regulatory framework, its strengths and weaknesses, and then …

Privacy's Algorithmic Turn, Maria P. Angel

Scholarly Works

As algorithms have taken over contemporary society, a portion of American privacy law scholars has gradually transformed information privacy into a post- algorithmic concept. Besides enabling individuals to protect their autonomy and attain certain collective benefits, these scholars now expect information privacy to act as the government's tool to protect society against data extraction and its consequent power asymmetries. This Article presents evidence of this transfor- mation-here referred to as "privacy's algorithmic turn"-, identifying its two main features: (1) a change in what is usually considered privacy harms, and (2) a transformation of the tools proposed to protect privacy. Additionally, …

The New Eu-Us Data Protection Framework's Implications For Healthcare, Charlotte A. Tschider, Marcelo Corrales Compagnucci, Timo Minssen

Faculty Publications & Other Works

In July 2023, the United States and the European Union introduced the Data Privacy Framework (DPF), introducing the third generation of cross-border data transfer agreements constituting adequacy with respect to personal data transfers under the General Data Protection Regulation (GDPR) between the European Union (EU) and the US. This framework may be used in cross-border healthcare and research relationships, which are highly desirable and increasingly essential to innovative health technology development and health services deployment. A reliable model meeting EU adequacy requirements could enhance the transfer of patient and research participant data. While the DPF might present a familiar terrain …

Privacy Law’S Role In An Information Economy, Sari Mazzurco

Faculty Journal Articles and Book Chapters

What do we lose when we lose our privacy? A slew of recently enacted state laws suggest that the loss of privacy is merely a loss of individual choice in the market exchange of services for personal information. This Article argues that a loss of privacy risks something greater: the collapse of complex and fluid social identity. Without privacy, individuals cannot nurture their own senses of self because they are no longer free to try on different social roles across diverse relationships. Pervasive, private data collection threatens multifaceted selfhood by eliminating the boundaries that make social roles distinct and hindering …

Getting Real About Protecting Privacy, Scott Skinner-Thompson

Publications

No abstract provided.