Privacy Law Commons^™

Virtual Harm, Real Consequences: Constitutional Justifications For Criminalizing Ai-Generated Child Pornography, Adam Abdin

FIU Law Review

Advances in artificial intelligence (AI) have enabled the creation of hyper-realistic child sexual abuse images without any real child involved. These AI-generated depictions pose a unique challenge: they replicate the most pernicious form of pornography—child pornography—while potentially being claimed as “speech” immune from regulation. This paper argues that it is both constitutionally permissible and morally imperative to criminalize AI-generated child pornography. This article presents two doctrinal pathways to justify a ban. First, such content can be treated as unprotected speech under existing First Amendment exceptions. Courts have long held that child pornography and obscenity lie outside First Amendment protection, and …

Beyond Digital Pessimism: How A Focus On Trust Can Enhance Eu Digital Law, Neil Richards, Woodrow Hartzog, Claire Boine, Lea Despotis

Faculty Scholarship

Lawmakers looking to foster technological innovation on the European market are adopting laws they hope will promote consumer trust in digital products. Their strategy can be broken down into three components. First, they aim to empower consumers to choose how much data they want to share with companies through an express consent framework. Second, they seek to avoid harms from digital products through product safety law such as adapting the Product Safety Regulation to digital products or adopting the AI Act. Third, they endeavor to prevent manipulation of consumers through digital means.

In this essay, we argue that while laudable, …

Against Ai Half Measures, Woodrow Hartzog, Neil Richards, Ryan Durrie, Jordan Francis

Faculty Scholarship

So far, U.S. consumer protection policy for artificial intelligence (AI) accountability has largely consisted of industry-led approaches such as encouraging transparency, mitigating bias, promoting principles of ethics, and empowering people. These approaches are vital, but they are only half measures. To bring AI within the rule of law, lawmakers must start drawing substantive lines.

In this Article, we identify four AI regulatory approaches to consumer, data, and democratic harms as half measures. First, transparency does not produce accountability on its own. Second, while mitigating bias in AI systems is critical, even unbiased systems are a threat to the vulnerable. Third, …

The Hypocrisy Of Data Governance, Zubair Shafiq, Olivia Figueira, Athina Markopoulou, Woodrow Hartzog, Michael Lavine

Faculty Scholarship

“Data governance” is an empty term, like a Rorschach inkblot just waiting to be filled with meaning. Tech companies take advantage of this ambiguity to craft narratives about their data-governance capabilities to fit their audience and purpose. On one hand, tech companies brag about their data-governance capabilities when it fits their business model (for example, to advertisers) and public image (for example, to their customers). On the other hand, tech companies claim that meaningful data governance is challenging or impossible when accountability is demanded.

In this Article, we argue that tech companies systematically misrepresent or selectively ignore their data-governance capabilities. …

Privacy’S Autonomy Thicket: Disentangling Choice, Consent And Control, Jordan Francis, Woodrow Hartzog, Neil Richards

Faculty Scholarship

When it comes to talking about autonomy, privacy law could use a little clarity. Its discourse uses terms like “choice,” “consent,” and “control” to evoke autonomy, but these terms are too rarely defined and too often used interchangeably, even though they can mean very different things. The three terms have become entangled in a way that has become confusing and counterproductive. We call this problem “privacy’s autonomy thicket,” and it matters because it encourages talking past each other in policy debates, enabling the redefinition of these terms in misleading ways that produce weak and disempowering “notice and choice” regimes.

In …

Corporate Law's Duty Of Data Loyalty, Andy Serwin, Neil Richards, Woodrow Hartzog, Ryan Durrie

Faculty Scholarship

Privacy law used to be a relatively tidy field, involving a few interesting but discrete topics like press disclosures of private facts, wiretapping, and the processing of personal data by internet companies. But as the digital revolution continues to disrupt area after area of human activity and software “is eating the world,” the core concerns of privacy law such as “when is it appropriate to process personal data?” have similarly entered field after field. Today, most fields of law, including discrimination law, antitrust, and international law, have found it necessary to reckon with the questions of informational harm and power …

Reconstruction Of Competition Law: Preventing Monopolization Through Data Exploitation In E-Commerce, Diana Fitriana

Indonesia Law Review

Tujuan penelitian ini adalah menganalisis nilai big data dan implikasinya terhadap monopoli usaha, mengkaji perbandingan hukum persaingan usaha dan mengkaji kelemahan hukum persaingan usaha Indonesia, serta menganalisis rekonstruksi hukum Undang-Undang Larangan Monopoli dan Persaingan Usaha Tidak Sehat di masa mendatang. Penelitian ini menggunakan penelitian yuridis normatif (doktrinal) dengan pendekatan perundang-undangan dan konseptual dengan teknik pengumpulan data melalui kajian pustaka, analisis isi, dan studi kasus. Data tersebut kemudian dianalisis secara kualitatif untuk menghasilkan informasi yang komprehensif dan menarik simpulan yang relevan. Big data memiliki kapasitas untuk memicu perilaku monopoli karena mencerminkan permintaan pasar konsumen. Namun, regulasi persaingan di Indonesia kurang dalam …

Tracking In The Fast Lane: Are License Plate Readers An Invasion Of Privacy?, Lorelai Kline, Madelyn Paul, Catherine Scott, Tessa Mullinix

Student Scholar Symposium

The increasing deployment of Automated License Plate Readers (ALPRs) by law enforcement agencies has sparked significant debate regarding the balance between public safety and individual privacy rights in the digital age. This research investigates whether the use of LPRs constitutes an invasion of privacy, examining the tension between law enforcement's legitimate need for surveillance tools and citizens' constitutional rights to privacy.

This research examines court decisions and legal articles to understand how LPRs affect privacy rights. By looking at important cases like Carpenter v. United States and reviewing what legal experts have written, we can better understand when and how …

Platforms, Privacy, And Power: Examining Predictors Of Online Intimate Information Disclosure And Expression, Alexis Shore Ingber, Danielle Keats Citron, Jonathon W. Penney

Articles & Book Chapters

When intimate privacy is violated, self- and relational development is impaired to the detriment of individuals and society. Despite these costs, there is a lack of systematic empirical and theoretical study of intimate privacy and efforts to protect it. This research helps fill this void through two complementary studies. Through a longitudinal experimental design, results from Study 1 highlight that partner trust and response-efficacy were not only positively predictive of online intimate disclosure, but also strengthened following knowledge of intimate privacy protections. In Study 2, we find individuals are more likely to engage in public-facing online sexual expression if the …

San Mateo County’S Digital Jail Mail Sparks Reckoning Over Private Data, Juan A. Lasso

Capstones

This capstone examines privacy and data risks embedded in digital communication systems used in U.S. correctional facilities. As private vendors introduce tablets, kiosks, and mail digitization services, these technologies enable widespread surveillance and data collection of incarcerated people and their loved ones. The project explores how these systems track and analyze digital footprints in ways that challenge established legal and ethical expectations around privacy. It documents the personal impact on loved ones of people currently or formerly incarcerated in San Mateo County. The reporting centers on the California county jail where a civil rights lawsuit is pending over the mail …

School And District Leaders’ Understanding Of Technology Organizations’ Cyber Business Practices, Jayejaye Johnson

Journal of Educational Research and Practice

Educational technology (EdTech) interoperability throughout cyberspace provides the financial opportunity to collect and sell student privacy information in digital learning environments, challenging school leaders to govern schools and keep children safe. School leaders provide the resources, funding, planning, decision making, and administration for EdTech cybersecurity practices and policies, yet little is known about what public school leaders understand. A quantitative study was designed using primary data collected from an online survey. Four research questions guided this study: What are the differences in cybersecurity practices and policy response scores (1) between male and female school leaders; (2) among leaders with different …

Impact Of The 23andme Bankruptcy On Preserving The Public Benefit Of Scientific Data, Jonathan E. Lotempio Jr., Chistopher R. Donohue, Jonatahan D. Moreno, Ana Santos Rutschman, Joshua Sarnoff, Michael S. Sinha, Thomas Stoeger, Jorge L. Contreras

Faculty Publications

The bankruptcy of 23andMe was an inflection point for the direct-to-consumer genetics market. Although the privacy of consumer data has been highlighted by many as a concern, we discuss another key tension in this case: the corporate enclosure of scientific data that has considerable potential value for biomedical research and public health.

Eyes Everywhere: Unpacking The Digital Surveillance State In Mexico And The Legal Blind Spots, Danielle Mena

University of Miami Inter-American Law Review

This article examines the rise of digital surveillance in Mexico and its implications for privacy, human rights, and democratic governance. Despite constitutional and legislative protections guaranteeing personal privacy and freedom of expression, Mexico has developed one of the most extensive surveillance systems in the Americas. Through tools such as Pegasus spyware and the C5 urban surveillance network, government agencies have expanded their monitoring capabilities, often under the guise of national security. However, the misuse of these technologies against journalists, activists, and political dissidents reveals legal and institutional deficiencies. The article analyzes the evolution of Mexico’s digital surveillance infrastructure, identifies the …

Excessive Data Collection In An Ecosystem As An Exploitative And Exclusionary Abuse: A Critical Analysis Of The Cci’S Order Against Whatsapp’S Privacy Policy And Its Impact On The Digital Advertising Market, Reuben Philip Abraham Mr.

Yearbook of Antitrust and Regulatory Studies

The interface between privacy and competition law has been a complicated topic in the past decade. The Facebook case by the German competition authority, the Bundeskartellamt (BK) was the first landmark case to investigate an exploitative abuse in this interface. The WhatsApp’s 2021 privacy policy update prompted the Competition Commission of India (CCI) to initiate a suo moto investigation against WhatsApp/Meta regarding the anti-competitive effects of imposing a ‘take-it or leave-it’ agreement on consumers.

In the WhatsApp case, the CCI has pushed the boundaries further in this interface by investigating exclusionary abuses regarding excessive data collection in an ecosystem. This …

Shielding Freedoms: State Noncooperation In Hunts For Evidence And People, Mary D. Fan

Washington Law Review

The nation is fracturing into a patchwork of rights and punishment. What some states and localities safeguard as rights, other jurisdictions are criminalizing and punishing. As the divides in rights and punishment deepen, some states are becoming sanctuaries for freedoms penalized elsewhere and enacting shield laws prohibiting cooperation with criminalization and punishment states. A prime example is shield laws protecting people seeking to exercise reproductive rights or obtain gender-affirming care. Major jurisdictions for healthcare and technology-related businesses, such as Washington, California, New York, and Massachusetts, have enacted shield laws that prohibit law enforcement and companies from complying with subpoenas seeking …

Enabling Injustice: Slapps, Democratic Values, And The Price Of Truth, Costantino Grasso

Buffalo Law Review

Conventional analysis of Strategic Lawsuits Against Public Participation (SLAPPs) often focuses on the promise of recent procedural reforms, including recent U.S. state-level reforms, the 2024 E.U. Anti-SLAPP Directive, the U.K. government’s 2025 SLAPP Bill, and related measures in the Economic Crime and Corporate Transparency Act. This Article argues that these legislative responses, introduced amid growing international concern, still leave structural vulnerabilities, have limited focus, and do not address the deep-seated inadequacies of substantive law that allow powerful actors to chill public-interest speech through abusive lawfare.

Adopting an interdisciplinary “new legal realist” approach, this Article decodes the anatomy of this modern …

Presumed Guilt: Epistemic Closure In Pregnancy Prosecutions, M. Eve Hanan

Buffalo Law Review

Criminal law and reproductive justice scholars are calling attention to the increase in prosecutions for pregnancy outcomes in the United States. Trace amounts of controlled substances in newborns are prosecuted as child abuse. Miscarriages are prosecuted as illegal abortions or homicides. This area of criminal law existed side-by-side with Roe v. Wade for late-term pregnancy outcomes. The Dobbs decision has further emboldened these prosecutions by removing the protections of the Due Process Clause from the pre-viability phase of the pregnancy.

Using a case study of a woman who was pressured to plead guilty to manslaughter and sentenced to eight years …

Tapping Out Of The Wiretap: Whether Consumers Have A Reasonable Expectation Of Privacy Against Internet Tracking Technology, Ashley Faranesh

Brooklyn Journal of Corporate, Financial & Commercial Law

The California Invasion of Privacy Act (CIPA), a statute born in an era of rotary phones and analog surveillance, is now at the heart of a legal crisis over internet tracking and privacy. Plaintiffs have increasingly weaponized the CIPA against online businesses that use standard Web-tracking tools, triggering a wave of litigation that stretches the statute far beyond its intended purpose. This Note argues that such application misreads the legislative intent behind the CIPA and risks destablizing core structures of the internet economy and financially crippling online businesses. Courts applying literal interpretations are undermining the CIPA’s purpose by conflating commonplace …

Frankenstein Sinatra: The Argument For A Federal Postmortem Right Of Publicity In The Ai-Era, Ian Samide

Brooklyn Journal of Corporate, Financial & Commercial Law

Artificial Intelligence has fundamentally revolutionized the way media is generated and presents new and unique threats to the right of publicity. By enabling users to create high-quality, realistic deep fakes of individuals’ voices, images, or likenesses, Artificial Intelligence has created novel risks to the right of publicity. Additionally, right of publicity is currently governed by state law. This system is proving to be flawed in the internet age, as content is rarely confined to a single jurisdiction, resulting in unpredictability and juridical disputes. This note argues that a federal right of publicity is necessary to regulate Artificial Intelligence effectively and …

Between Sovereignty And Commons: Legal Frameworks For Digital Data Governance In India, Anushka Sachan

Journal of Law and Public Policy

This legislative note critically examines the Indian Digital Personal Data Protection (DPDP) Act, 2023, with a focus on its provisions that imply data sovereignty and their implications for the governance of digital commons. Drawing on the seminal works on data commons, the note explores the conceptual and practical tensions between centralised data sovereignty, participatory, and decentralised models of data stewardship. While data sovereignty is often justified on grounds of national security and control, it may inadvertently hinder the development of inclusive and accountable frameworks for managing data as a public good.

Fred H. Cate Appointed To 23andme Research Institute Privacy Advisory Board, Maurer School Of Law - Indiana University

Keep Up With the Latest News from the Law School (blog)

Indiana University Maurer School of Law Distinguished Professor Fred H. Cate, one of the nation’s foremost authorities on information privacy and security law, has been appointed as an inaugural member to the newly formed Privacy Advisory Board of the 23andMe Research Institute, a leading nonprofit medical research organization focused on advancing genetic and health discoveries.

The appointment cements the Law School’s position as a global leader at the intersection of law, data governance, and privacy.

Face Card Declined: The Deepfake Threat To Biometric Security In Financial Systems, Hazel Fernandez

Washington and Lee Law Review Online

Once limited to entertainment and disinformation, deepfakes are now extending into the financial sector, where voice and facial impersonations exploit biometric authentication systems to facilitate fraudulent transactions. This evolution exposes gaps in existing legal and regulatory frameworks, raising critical questions about consumer protection and institutional safeguards. This Note argues for a reconceptualization of deepfake harms as both a privacy and a financial security issue. It examines the illusion of consent generated by synthetic impersonation and insufficient statutory protections. The analysis examines the patchwork of federal, state, and international laws governing data privacy and artificial media, highlighting the gaps that allow …

The Search Of A Search: Moderating Reverse Internet Keyword Warrants, Tui Rademaker

Northwestern University Law Review

Statistics show that Americans consistently turn to Google and other search engines to answer their most personal and private concerns, yet a new investigative tool risks law enforcement having vast discretion in the access of this data. With a keyword warrant, law enforcement can request from a search engine provider (usually Google) a list of probative search queries that users made over a specified time period. Such warrants are beginning to face legal challenges, and so far, courts seem reluctant to recognize the constitutional implications—instead leaving law enforcement with greater potential discretion over their use.

This Note assesses the constitutionality …

Investigating The Relationship Between Noun Classes And Plant Folk Taxonomy In Chasu Language Of Kilimanjaro Region In Tanzania, Peter Rabson Mziray

Journal of Humanities and Social Sciences

The current study investigates the relationship between noun classes and plant folk taxonomy in Chasu (G 22). The study focuses on two objectives: the first objective is to describe the plant folk taxonomy in Chasu and the second objective is to determine the relationship between noun classes and plant folk taxonomy in Chasu. Data were collected from rural villages in Same and Mwanga districts by using free listing, field interviews (jungle-walk-and-identify), and written texts containing Chasu plant names. The findings reveal that Chasu folk taxonomy reflects different ethnobotanical categories; including a unique beginner which is mmea/mimea ‘plant(s)’, and three life …

On Non-Conventional Marks And Chatgpt Evidence: A Case Comment On Christian Louboutin Sas V The Shoe Boutique (2023), Rahul Hemrajani

Indian Journal of Law and Technology

No abstract provided.

Data As Policy, Janet Freilich, W. Nicholson Price Ii

Faculty Scholarship

A large literature on regulation highlights the many different methods of policy-making: command-and-control rulemaking, informational disclosures, tort liability, taxes, and more. But the literature overlooks a powerful method to achieve policy objectives: data. The state can provide (or suppress) data as a regulatory tool to solve policy problems. For administrations with expansive views of government’s purpose, government-provided data can serve as infrastructure for innovation and push innovation in socially desirable directions; for administrations with deregulatory ambitions, suppressing or choosing not to collect data can reduce regulatory power or serve as a back-door mechanism to subvert statutory or common law rules. …

Living Property, Joseph William Singer

Seattle University Law Review

The Supreme Court has increasingly defined property rights that are per se exempt from regulation in the absence of compensation, most recently in Cedar Point Nursery v. Hassid (2021) and Tyler v. Hennepin County (2023). The Court claims that it can identify property rights that are categorically protected from regulation by reference to history, tradition, and precedent. Yet this approach is oddly ahistorical; it is inconsistent with the fact that property law changed dramatically over U.S. history, as well as varying tremendously among the states. It is also inconsistent with the historical context of the Founding era. At that time, …

Table Of Contents

Seattle University Law Review

Table of Contents

The Roots Of Credit Inequality, Andrea Freeman

Seattle University Law Review

Debt oppression began before the United States became a country. Settlers enslaved Africans and Indigenous people, treating them as property that they could buy and sell for their economic and personal benefit. When enslavement became illegal, new economic systems and laws that included sharecropping, Black Codes, and Jim Crow kept Black people in servitude. Laws that prohibited enslaved people from owning property or selling goods to white people evolved into restrictions on Black people’s occupations and market participation, both formal and informal. When Black entrepreneurs overcame these obstacles and built wealth within Black business enclaves, white people enforced their racist …

“A Plain Denial”: Reclaiming Equal Protection In American Juvenile Law, Addie C. Rolnick, David S. Tanenhaus, Justin Iverson, Danielle L. Silvestri

Seattle University Law Review

Juvenile courts are based on the premise that children are different from adults and should therefore be treated differently. Children may be treated more informally by courts, punished for different purposes, and brought before the court for different behaviors. Since In re Gault, the Supreme Court has been clear that there are limits to how different juvenile courts can be. Juveniles are entitled to many of the same procedural protections as adult criminal defendants, although the Court has preserved some procedural differences where it has determined that their benefit is outweighed by the need to preserve the informality, flexibility, …