Privacy Law Commons^™

Friend Or Tether: How Regulation Can Cut The Strings Of Manipulative Chatbots, Steve Hammerton

Student Journal of Information Privacy Law

In the time since AI chatbots and other LLMs became widely available to the public, there has been a pattern of deaths linked to interactions with this technology. While it was settled in early 2026, Garcia v. Character Technologies serves as a case study of how AI chatbots can negatively prey on vulnerable groups in the absence of interventions to mitigate harmful AI behaviors and tragic human outcomes. There is not a singular approach to regulating the harmful effects of predatory chatbots; however, this paper advocates for a harms-based regime influenced by protections in human-subject research. In a sense, AI …

Information Law Pluralism, Hannah Bloch-Wehba

Faculty Scholarship

Information-intensive activities are reshaping political, social, and economic institutions. As they respond to these shifts, legislators and regulators are embracing information as a regulatory device for tech. Far from limiting themselves to public disclosure, consumer notice, and other traditional mechanisms of fostering transparency and information flows, however, legislators are using other, more nuanced tools to incentivize regulated entities to obtain, generate, and share information.

This Article maps the landscape of the emerging information-based regimes for regulating tech and assesses their conceptual and practical implications. It canvasses an extensive set of recently enacted laws regulating the information economy and shows that, …

Data As Policy, Janet Freilich, W. Nicholson Price Ii

Faculty Scholarship

A large literature on regulation highlights the many different methods of policy-making: command-and-control rulemaking, informational disclosures, tort liability, taxes, and more. But the literature overlooks a powerful method to achieve policy objectives: data. The state can provide (or suppress) data as a regulatory tool to solve policy problems. For administrations with expansive views of government’s purpose, government-provided data can serve as infrastructure for innovation and push innovation in socially desirable directions; for administrations with deregulatory ambitions, suppressing or choosing not to collect data can reduce regulatory power or serve as a back-door mechanism to subvert statutory or common law rules. …

From ‘Gig Work’ To Algorithmically Mediated Work: Shifting The Focus To Technological Control In Work Regulation, Jasoon Chelat

Indian Journal of Law and Technology

Platform-based work is finding a place in legislative instruments in India in recent years, under the Code on Social Security, 2020, as well as state-level legislations. In this paper, I argue that these efforts to extend protections to gig or platform work are limited in their understanding of the way work is shaped by digital technologies both within and outside of platforms. Platform-based work regulation seems to have skipped a step: the regulatory discourse has moved on to a welfare-focused model present in informal work, without examining existing jurisprudence on worker rights relevant to digitally mediated work. These legislative instruments …

Deepfakes And Shallow Laws: Regulating Distorted Narratives In The Political Cyberspace, Shimona Mohan, Sarthak Wadhwa

Indian Journal of Law and Technology

With a sizable section of the global population witnessing electoral churn, protests, and resistance movements in the past couple of years, this is clearly a watershed moment for modern democracies vis-à-vis technological advancements. Electoral canvassing in these democracies has expanded its footprint in the digital space, be it through social media or navigating the general contours of anonymity, engagement, and misinformation that govern our online worlds. In this context, the advent of deepfakes in the recent past, and the exponential evolution of the technology both for outreach and disruption, has invited acute regulatory attention and intervention. However, traditional policy design …

Moral Panic Or Public Health Crisis? Lessons From Drugs And Gambling For “Addictive” Design, Matthew B. Lawrence, Haomin (Kevin) Yan

Seattle University Law Review

Alcohol, automobiles, guns, lottery, loot boxes, meat, music, opioid painkillers, processed foods, prop bets, slot machines, television, tobacco, violent video games. Over the last century each of these has been subject to concerns—some might even say “moral panics”—from parents and policymakers about avoidable harms to kids and adults. In some cases we look back with the benefit of hindsight and dismiss those concerns as naïve or moralistic. In others we look back at them as justified or as having come too late to check an expanding industry before it did unfathomable harm while growing so powerful that it became all …

Let The Sunshine In: Crafting Constitutional Transparency Regulations For Content Moderation, Caitlin Ring Carlson

Seattle University Law Review

In response to public concern about the impact of social media, legislators in some U.S. states have developed laws to regulate the process of content moderation. Many include mandatory transparency and disclosure requirements, some of which courts have already deemed an unconstitutional infringement on social media platforms’ right to free expression. This article explores the parameters for crafting constitutional social media transparency regulations using existing U.S. media policy and insights from recent legal challenges. The resulting analysis identifies content neutral transparency requirements that mandate the disclosure of purely factual, non-controversial information as those most likely to withstand judicial scrutiny. Specifically, …

This Is Not A Game: The Addictive Allure Of Digital Companions, Nizan Geslevich Packin, Karni Chagal-Feferkorn

Seattle University Law Review

Artificial Intelligence (AI) agents have become an inescapable part of modern childhood, reshaping education, leisure activities, entertainment, and social interaction. From AI-powered tutors that adapt to individual learning styles to emotionally responsive chatbots that simulate human companionship, these systems promise unprecedented personalization, cognitive stimulation, and social support. However, these benefits mask significant risks that remain unregulated and inadequately addressed.

Although adults are also susceptible to forming deep emotional bonds with AI companions—often trusting them as if they possessed genuine understanding and empathy—children are particularly vulnerable. Their misplaced trust can more severely distort social development, weaken critical thinking, and foster unhealthy …

Does Climate Disclosure Work To Reduce Greenhouse Gas Emissions? Emerging Evidence Suggests Cautious Optimism, Cynthia A. Williams

Seattle University Law Review

Significant regulatory resources have been spent developing global, voluntary climate and sustainability disclosure standards, such as the TCFD, TNRD, and ISSB’s Sustainability and Climate Disclosure standards, or domestically required disclosures, such as in the EU and in the U.S. Thus, it is important to evaluate whether this disclosure, particularly voluntary, qualitative disclosure, will have the power to shift the allocation of capital, will have a significant effect on the management of climate risk within firms, and ultimately will reduce climate change risk and biodiversity loss.

In this Article, several interrelated questions will be discussed. First, what does the empirical evidence …

The Impact Of Artificial Intelligence On Copyright Infringement Liability, Sarah M. Rizzo

Touro Law Review

Although the rise of artificial intelligence platforms has been promoted as a solution to many of our problems, it is important to address the possible issues this new technology may be creating. With artificial intelligence evolving at such a rapid rate, questions arise as to how to effectively regulate and control this technology. Specifically, in the realm of intellectual property, how will copyright protection be ensured and how will liability for copyright infringement be apportioned with the expanding use of artificial intelligence? Users of artificial intelligence platforms should be able to employ such artificial intelligence products freely and confidently without …

Ban Cookie Banners: A Case Study In Tech Regulation, Kate Klonick

Faculty Publications

Few experiences on the modern internet are as universally reviled as the cookie banner. They clutter websites with pop-ups, interrupt user flow, make information harder to access, and demand repetitive, meaningless clicks. What was once heralded as a tool to advance individual autonomy and privacy has, in practice, become a daily annoyance that breeds cynicism with the very concept of consent itself. Cookie banners do not empower; they weary. They do not inform; they obscure. They do not prevent surveillance; they normalize it.

The tragedy of the cookie banner is that it embodies the best intentions but worst solutionism of …

Ai Ethics, Law, And Policy, Pauline Kim, Ryan Durrie

Scholarship@WashULaw

AI technologies promise many benefits, but they can also have significant negative impacts on human health, safety, well-being, and fundamental rights. This chapter explores the different governance tools that have been considered for guiding developments in AI in socially beneficial ways, examining the relevance of ethics, law, and policy. Each of these approaches offer tools to address these concerns; however, each has limitations, and none provides a complete solution in itself. Statements of ethical principles can articulate high-level values and goals to guide behavior but are usually quite vague and difficult to operationalize. They also lack any enforcement mechanism. In …

The False Choice Between Digital Regulation And Innovation, Anu Bradford

Northwestern University Law Review

This Article challenges the common view that more stringent regulation of the digital economy inevitably compromises innovation and undermines technological progress. This view, vigorously advocated by the tech industry, has shaped the public discourse in the United States, where the country’s thriving tech economy is often associated with a staunch commitment to free markets. U.S. lawmakers have also traditionally embraced this perspective, which explains their hesitancy to regulate the tech industry to date. The European Union has chosen another path, regulating the digital economy with stringent data privacy, antitrust, content moderation, and other digital regulations designed to shape the evolution …

Fitting A Block Into A Sphere Mold: The Inadequacy Of Current Data Privacy Regulations In Protecting Data Privacy Within The Blockchain Space, Jenny Yang

Washington and Lee Journal of Civil Rights and Social Justice

Despite global imposition of data privacy laws and regulations, data privacy is a nonexistent luxury amongst the data-charged world we live in. Data privacy has long been established as a fundamental right. Entities have successfully established robust methodologies around existing data privacy laws and regulations to utilize past consumer behavior to predict, impact and manipulate current and future consumer behaviors. This phenomenon has been commonly coined as “corporate surveillance.” Emerging spaces arising through technological developments have greater access into consumer data to impact economic choices. Specifically, the blockchain space, through its unique open-source and permanent traits, has been able to …

Administrative Regulation Of Programmatic Policing: Why "Leaders Of A Beautiful Struggle" Is Both Right And Wrong, Christopher Slobogin

Vanderbilt Law School Faculty Publications

In Leaders of a Beautiful Struggle v. Baltimore Police Department, the Fourth Circuit Court of Appeals held that Aerial Investigation Research (AIR), Baltimore's aerial surveillance program, violated the Fourth Amendment because it was not authorized by a warrant. AIR was constitutionaly problematic, but not for the reason given by the Fourth Circuit. AIR, like many other technologically-enhanced policing programs that rely on closed-circuit television (CCTV), automated license plate readers and the like, involves the collection and retention of information about huge numbers ofpeople. Because individualized suspicion does not exist with respect to any of these people's information, an individual-specific warrant …

Establishing The Legal Framework To Regulate Quantum Computing Technology, Kaya Derose

Catholic University Journal of Law and Technology

No abstract provided.

On Facial Recognition, Regulation, And "Data Necropolitics", Antonio Pele, Caitlin Mulholland

Indiana Journal of Global Legal Studies

This paper argues for actual and legal regulation of artificial intelligence (AI) and facial recognition. These new technologies represent great opportunities to improve the welfare of societies. However, some of their uses can also enhance discrimination and, eventually, lead to violence. From a comparative approach (examining the European Union and Brazil), we address the current and future aspects of facial regulation, AI, and personal data. This paper shows that regulation is relevant to protect the rule of law, free markets, and individual freedoms. It also examines the looming risks unfolding from the unregulated uses of new technologies. Our concept of …

A Scientific Approach To Tech Accountability, David Choffnes, Woodrow Hartzog, Scott Jordan, Athina Markopoulou, Zubair Shafiq

Faculty Scholarship

The Federal Trade Commission can only do so much to hold tech companies accountable. Enforcement agencies and the people they protect need help. One problem is that the inner workings of large organizations and complex algorithmically driven systems remain obscure and opaque while their privacy representations are voluminous and vague. In this Essay, we propose a scientific approach to tech accountability, where academic researchers can play a larger role in privacy policy. This approach involves surfacing a company’s privacy representations and statements, as well as measuring the actual behavior of their systems with respect to algorithms, user interfaces, and data …

The Three Laws: The Chinese Communist Party Throws Down The Data Regulation Gauntlet, William Chaskes

Washington and Lee Law Review

Criticism of the Chinese Communist Party (CCP) runs a wide gamut. Accusations of human rights abuses, intellectual property theft, authoritarian domestic policies, disrespecting sovereign borders, and propaganda campaigns all have one common factor: the CCP’s desire to control information. Controlling information means controlling data. Lurking beneath the People’s Republic of China’s (PRC) tumultuous relationship with the rest of the world is the fight between nations to control their citizens’ data while also keeping it out of the hands of adversaries. The CCP’s Three Laws are its newest weapon in this data war.

One byproduct of the CCP’s emphasis on controlling …

Small Business Cybersecurity: A Loophole To Consumer Data, Matthew R. Espinosa

The Scholar: St. Mary's Law Review on Race and Social Justice

Small businesses and small minority owned businesses are vital to our nation’s economy; therefore legislation, regulation, and policy has been created in order to assist them in overcoming their economic stability issues and ensure they continue to serve the communities that rely on them. However, there is not a focus on regulating nor assisting small businesses to ensure their cybersecurity standards are up to par despite them increasingly becoming a victim of cyberattacks that yield high consequences. The external oversight and assistance is necessary for small businesses due to their lack of knowledge in implementing effective cybersecurity policies, the fiscal …

Data Privacy Issues In West Virginia And Beyond: A Comprehensive Overview, Jena Martin

Consumer Law Scholarship

This white paper was commissioned by the Center for Consumer Law and Education, a joint initiative launched by West Virginia University and Marshall University to “coordinate the development of consumer law, policy, and education research to support and serve consumers.”

As such, this paper has a dual purpose. First, it provides a comprehensive overview of the many different legal issues that affect data privacy concerns (both nationally and in West Virginia). Second, it documents and discusses the result of a survey and specific focus groups that were undertaken throughout the fall of 2019 into January 2020 where individuals within the …

Seeing (Platforms) Like A State: Digital Legibility And Lessons For Platform Governance, Neil Chilson

Catholic University Journal of Law and Technology

The growing backlash against Big Tech companies is a symptom of digital technology increasing the world’s legibility. James C. Scott’s book, Seeing Like a State: How Certain Schemes to Improve the Human Condition Have Failed, explores how past governments responded to increased legibility – for good and for ill. This article shows how Scott’s historical lessons can guide governments and tech platforms as they seek to improve the human condition online.

Regulating Data Breaches: A Data Superfund Statute, Kyle Mckibbin

Vanderbilt Journal of Entertainment & Technology Law

Collecting and processing large amounts of personal data has become a fundamental feature of the modern economy. Personal data, combined with good data analytics, are valuable to businesses as they can provide highly detailed information about individual preferences and behaviors. This data collection can also be valuable to the consumer as it generates innovative products and digital platforms. The era of big data promises great rewards, but it is not without its costs. Data breaches, or the release of personal data into unwanted hands, are pervasive and increasingly massive in scale. Despite the personal privacy harm caused by data breaches, …

Protecting Research Data Of Publicly Revealing Participants, Ellen Clayton, B. A. Malin, Kyle J. Mckibbin

Vanderbilt Law School Faculty Publications

Biomedical researchers collect large amounts of personal data about individuals, which are frequently shared with repositories and an array of users. Typically, research data holders implement measures to protect participants’ identities and unique attributes from unauthorized disclosure. These measures, however, can be less effective if people disclose their participation in a research study, which they may do for many reasons. Even so, the people who provide these data for research often understandably expect that their privacy will be protected. We discuss the particular challenges posed by self-disclosure and identify various steps that researchers should take to protect data in these …

Emerging Technology & Regulation Panel Transcript, Bill Goodwin, Ryan Hagemann, Brooks Rainwater, Caleb Watney

Pepperdine Law Review

No abstract provided.

American Privacy Law At The Dawn Of A New Decade (And The Ccpa And Covid-19): Overview And Practitioner Critique, Kimberly Dempsey Booher, Martin B. Robins

Marquette Intellectual Property Law Review

No abstract provided.

The Missing Regulatory State: Monitoring Businesses In An Age Of Surveillance, Rory Van Loo

Faculty Scholarship

An irony of the information age is that the companies responsible for the most extensive surveillance of individuals in history—large platforms such as Amazon, Facebook, and Google—have themselves remained unusually shielded from being monitored by government regulators. But the legal literature on state information acquisition is dominated by the privacy problems of excess collection from individuals, not businesses. There has been little sustained attention to the problem of insufficient information collection from businesses. This Article articulates the administrative state’s normative framework for monitoring businesses and shows how that framework is increasingly in tension with privacy concerns. One emerging complication is …

The Gdpr: It Came, We Saw, But Did It Conquer?, Leila Javanshir

Seattle University Law Review

On February 1, 2019, the Seattle University Law Review held its annual symposium at the Seattle University School of Law. Each year, the Law Review hosts its symposium on a topic that is timely and meaningful. This year, privacy and data security professionals from around the globe gathered to discuss the current and future effects of the General Data Protection Regulation (GDPR) that was implemented on May 25, 2018. The articles and essays that follow this Foreword are the product of this year’s symposium.

Confiding In Con Men: U.S. Privacy Law, The Gdpr, And Information Fiduciaries, Lindsey Barrett

Seattle University Law Review

In scope, ambition, and animating philosophy, U.S. privacy law and Europe’s General Data Protection Regulation are almost diametric opposites. The GDPR’s ambitious individual rights, significant prohibitions, substantive enforcement regime, and broad applicability contrast vividly with a scattershot U.S. regime that generally prioritizes facilitating commerce over protecting individuals, and which has created perverse incentives for industry through anemic enforcement of the few meaningful limitations that do exist. A privacy law that characterizes data collectors as information fiduciaries could coalesce with the commercial focus of U.S. law, while emulating the GDPR’s laudable normative objectives and fortifying U.S. consumer privacy law with a …

Privacy Statements Under The Gdpr, Mike Hintze

Seattle University Law Review

The need to include specific types of information in a privacy statement is a GDPR compliance obligation that does not get as much attention as some other GDPR requirements. Perhaps that is because privacy statements have been much maligned in recent years. They are too long and full of legalese. Nobody reads them. They are part of a notice and consent approach to privacy that puts an unrealistic burden on consumers to make informed choices. But despite these well-known criticisms, the GDPR doubles down on privacy statements. In fact, gauging by the roughly fourfold increase in privacy statement requirements compared …