Privacy Law Commons^™

Beyond Digital Pessimism: How A Focus On Trust Can Enhance Eu Digital Law, Neil M. Richards, Woodrow Hartzog, Claire Boine, Lea Despotis

Scholarship@WashULaw

Lawmakers looking to foster technological innovation on the European market are adopting laws they hope will promote consumer trust in digital products. Their strategy can be broken down into three components. First, they aim to empower consumers to choose how much data they want to share with companies through an express consent framework. Second, they seek to avoid harms from digital products through product safety law such as adapting the Product Safety Regulation to digital products or adopting the AI Act. Third, they endeavor to prevent manipulation of consumers through digital means.

In this essay, we argue that while laudable, …

From Privacy To The Data Economy: The Ftc’S Reframing Of Its Regulatory Priorities, Maria P. Angel

Scholarly Works

This Article argues that the Federal Trade Commission’s turn to “commercial surveillance” reflects a strategic shift away from traditional privacy frameworks toward addressing structural power dynamics in the data economy. Drawing on an analysis of 112 FTC documents, it identifies three core commitments: tackling systemic harms, adopting a political economy lens, and constraining corporate power. The Article contends that this reframing is both necessary in the AI age and should influence the future of privacy regulation in the United States, even amid efforts to limit the FTC’s authority.

A Proposed Tort To Address The Negligent Enablement Of Cloud Data Breaches, Michael L. Rustad

American University Business Law Review

[INTRODUCTION] The term “cloud computing” means the remote storage of software applications, tools, and data accessed through the internet. Cloud customers enter into subscription agreements with providers who give 24/7, on-demand, as-needed access to software, storage, and networking services owned and managed by providers through a web browser. “Many businesses are transitioning to the cloud for data storage, remote work, and collaboration.” Cloud providers operate their software as a software-as-a-service (“SaaS”) model, under which customers pay a subscription fee to access the software. Netflix and Amazon Prime Video are examples of subscription services that deliver television programs and videos through …

The Growing Divide: The Video Privacy Protection Act’S Inconsistent Subscriber Standard And The Need For Reform, Andrea Pacheco

American University Business Law Review

The Video Privacy Protection Act of 1988 (“VPPA”) has been brought into the twenty-first century due to a series of class action lawsuits surrounding consumer privacy rights in an increasingly digital world. A circuit split has emerged among the federal appellate courts on the meaning of the word “subscriber” under the VPPA and whether the statute’s protections should extend to casual users of goods and services provided by videotape service providers. The outcome of this debate carries significant implications for consumer privacy and business compliance obligations due to the escalation of business practices involving the collection of consumer data and …

Inside, Outside, And In Between: Black Homeplace As A Blueprint For Privacy Law, Nina-Simone Edwards

Library Scholarship

This essay reimagines the meaning of home and privacy for Black Americans by interrogating the legal and technological systems that routinely collapse the sanctity of the homeplace. Using the no-knock warrant as a central case study, this essay illustrates how state-sanctioned intrusions transform a space of rest, memory, and self-making into a site of violence. Although Fourth Amendment doctrine purports to guard against unreasonable searches, its prevailing binary framework–distinguishing only between “inside” and “outside” the home–renders Black domestic spaces uniquely vulnerable. Drawing from Critical Race Theory, particularly its social construction thesis, this essay shows how race, law, and technology co-produce …

Forget Me Not? Machine Unlearning’S Implications For Privacy Law, Jevan Hutson, Cedric Whitney, Jay T. Conrad

Articles

Generative AI systems are increasingly relied on and are already actively reshaping how we think about privacy and data protection law. Models ingest and process vast amounts of personal and sensitive data, challenging assurances of compliance with legal frameworks like the General Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CCPA) with increasing intensity. Machine unlearning is an emerging tool in practitioners’ attempts to address these challenges: the act of selectively removing or suppressing specific data, such as personal data that a data subject requests be deleted, from AI models as means of complying with legal obligations or …

No Justice Without Transparency: The Case For A Broad Presumption Of Public Access To Court Documents, Taylor Quimby

FIU Law Review

This Comment argues that a broad presumption of public access to court  documents is essential to preserving the legitimacy and constitutional values  of the American legal system. Although the principle of public access is  rooted in common law and constitutional tradition, individual states differ in  how they approach transparency in the context of court documents. These  jurisdictional inconsistencies continue to gain significance, as the digital age  has completely transformed the way people consume information. The  increasing digitization of court records has heightened the need for consistent  and constitutionally grounded standards that preserve transparency while  adequately protecting legitimate privacy interests. Florida’s …

Owning Data: Semantic Control As Inaccess To Information, Zvikomborero Chadambuka

FIU Law Review

This Article discusses the impacts of the introduction of a data ownership scheme on access to information. It does so with reference to the distinction between data, defined as some representation of information by a specific medium (the syntactic level), and the information itself (the semantic level). With respect to data, it then looks at the difference between standard property rights and intellectual property (IP) rights, similarly assessing impacts on access to information. Private control at the semantic level is bad policy as it effects particularly serious limitations, relative to private control at the syntactic level, on the availability of …

Let’S Talk About The Biological Reality Of Sex, Baby, John Parsi

FIU Law Review

Sex is at the very core of individual identity. It affects the conception of the self and the way others view the individual. Every day, one’s sex may open and close doors, access to communities, and opportunities. Laws that define sex may affirm scientific knowledge and protect people, or threaten to unravel the facts and the reality of sex. A deep unmooring of sex is underway, and this Article aims to halt it. On day one of the current presidential term, January 20, 2025, President Trump signed an Executive Order on “Defending Women from Gender Ideology Extremism and Restoring Biological …

When Convenience Compromises Rights: How The European Union And Washington State Confront Facial Recognition Risks, Debora Rodriguez Lugo

FIU Law Review

As facial recognition technology (FRT) becomes increasingly embedded in policing, concerns and controversies over the lack of consent, misidentification, and mass surveillance grow. This Comment compares how the European Union (EU) and Washington State (Washington) regulate law enforcement’s use of FRT to mitigate risks to individual rights. The EU governs FRT use through a robust legal framework, including the General Data Protection Regulation (GDPR), the Law Enforcement Directive (LED), and the Artificial Intelligence Act (AI Act), which offer protections against these risks. In contrast, Washington’s pioneering statute, Wash. Rev. Code section 43.386, promotes transparency and limits the use of FRT. …

Virtual Harm, Real Consequences: Constitutional Justifications For Criminalizing Ai-Generated Child Pornography, Adam Abdin

FIU Law Review

Advances in artificial intelligence (AI) have enabled the creation of hyper-realistic child sexual abuse images without any real child involved. These AI-generated depictions pose a unique challenge: they replicate the most pernicious form of pornography—child pornography—while potentially being claimed as “speech” immune from regulation. This paper argues that it is both constitutionally permissible and morally imperative to criminalize AI-generated child pornography. This article presents two doctrinal pathways to justify a ban. First, such content can be treated as unprotected speech under existing First Amendment exceptions. Courts have long held that child pornography and obscenity lie outside First Amendment protection, and …

Beyond Digital Pessimism: How A Focus On Trust Can Enhance Eu Digital Law, Neil Richards, Woodrow Hartzog, Claire Boine, Lea Despotis

Faculty Scholarship

Lawmakers looking to foster technological innovation on the European market are adopting laws they hope will promote consumer trust in digital products. Their strategy can be broken down into three components. First, they aim to empower consumers to choose how much data they want to share with companies through an express consent framework. Second, they seek to avoid harms from digital products through product safety law such as adapting the Product Safety Regulation to digital products or adopting the AI Act. Third, they endeavor to prevent manipulation of consumers through digital means.

In this essay, we argue that while laudable, …

Against Ai Half Measures, Woodrow Hartzog, Neil Richards, Ryan Durrie, Jordan Francis

Faculty Scholarship

So far, U.S. consumer protection policy for artificial intelligence (AI) accountability has largely consisted of industry-led approaches such as encouraging transparency, mitigating bias, promoting principles of ethics, and empowering people. These approaches are vital, but they are only half measures. To bring AI within the rule of law, lawmakers must start drawing substantive lines.

In this Article, we identify four AI regulatory approaches to consumer, data, and democratic harms as half measures. First, transparency does not produce accountability on its own. Second, while mitigating bias in AI systems is critical, even unbiased systems are a threat to the vulnerable. Third, …

The Hypocrisy Of Data Governance, Zubair Shafiq, Olivia Figueira, Athina Markopoulou, Woodrow Hartzog, Michael Lavine

Faculty Scholarship

“Data governance” is an empty term, like a Rorschach inkblot just waiting to be filled with meaning. Tech companies take advantage of this ambiguity to craft narratives about their data-governance capabilities to fit their audience and purpose. On one hand, tech companies brag about their data-governance capabilities when it fits their business model (for example, to advertisers) and public image (for example, to their customers). On the other hand, tech companies claim that meaningful data governance is challenging or impossible when accountability is demanded.

In this Article, we argue that tech companies systematically misrepresent or selectively ignore their data-governance capabilities. …

Privacy’S Autonomy Thicket: Disentangling Choice, Consent And Control, Jordan Francis, Woodrow Hartzog, Neil Richards

Faculty Scholarship

When it comes to talking about autonomy, privacy law could use a little clarity. Its discourse uses terms like “choice,” “consent,” and “control” to evoke autonomy, but these terms are too rarely defined and too often used interchangeably, even though they can mean very different things. The three terms have become entangled in a way that has become confusing and counterproductive. We call this problem “privacy’s autonomy thicket,” and it matters because it encourages talking past each other in policy debates, enabling the redefinition of these terms in misleading ways that produce weak and disempowering “notice and choice” regimes.

In …

Corporate Law's Duty Of Data Loyalty, Andy Serwin, Neil Richards, Woodrow Hartzog, Ryan Durrie

Faculty Scholarship

Privacy law used to be a relatively tidy field, involving a few interesting but discrete topics like press disclosures of private facts, wiretapping, and the processing of personal data by internet companies. But as the digital revolution continues to disrupt area after area of human activity and software “is eating the world,” the core concerns of privacy law such as “when is it appropriate to process personal data?” have similarly entered field after field. Today, most fields of law, including discrimination law, antitrust, and international law, have found it necessary to reckon with the questions of informational harm and power …

Reconstruction Of Competition Law: Preventing Monopolization Through Data Exploitation In E-Commerce, Diana Fitriana

Indonesia Law Review

Tujuan penelitian ini adalah menganalisis nilai big data dan implikasinya terhadap monopoli usaha, mengkaji perbandingan hukum persaingan usaha dan mengkaji kelemahan hukum persaingan usaha Indonesia, serta menganalisis rekonstruksi hukum Undang-Undang Larangan Monopoli dan Persaingan Usaha Tidak Sehat di masa mendatang. Penelitian ini menggunakan penelitian yuridis normatif (doktrinal) dengan pendekatan perundang-undangan dan konseptual dengan teknik pengumpulan data melalui kajian pustaka, analisis isi, dan studi kasus. Data tersebut kemudian dianalisis secara kualitatif untuk menghasilkan informasi yang komprehensif dan menarik simpulan yang relevan. Big data memiliki kapasitas untuk memicu perilaku monopoli karena mencerminkan permintaan pasar konsumen. Namun, regulasi persaingan di Indonesia kurang dalam …

Tracking In The Fast Lane: Are License Plate Readers An Invasion Of Privacy?, Lorelai Kline, Madelyn Paul, Catherine Scott, Tessa Mullinix

Student Scholar Symposium

The increasing deployment of Automated License Plate Readers (ALPRs) by law enforcement agencies has sparked significant debate regarding the balance between public safety and individual privacy rights in the digital age. This research investigates whether the use of LPRs constitutes an invasion of privacy, examining the tension between law enforcement's legitimate need for surveillance tools and citizens' constitutional rights to privacy.

This research examines court decisions and legal articles to understand how LPRs affect privacy rights. By looking at important cases like Carpenter v. United States and reviewing what legal experts have written, we can better understand when and how …

Platforms, Privacy, And Power: Examining Predictors Of Online Intimate Information Disclosure And Expression, Alexis Shore Ingber, Danielle Keats Citron, Jonathon W. Penney

Articles & Book Chapters

When intimate privacy is violated, self- and relational development is impaired to the detriment of individuals and society. Despite these costs, there is a lack of systematic empirical and theoretical study of intimate privacy and efforts to protect it. This research helps fill this void through two complementary studies. Through a longitudinal experimental design, results from Study 1 highlight that partner trust and response-efficacy were not only positively predictive of online intimate disclosure, but also strengthened following knowledge of intimate privacy protections. In Study 2, we find individuals are more likely to engage in public-facing online sexual expression if the …

San Mateo County’S Digital Jail Mail Sparks Reckoning Over Private Data, Juan A. Lasso

Capstones

This capstone examines privacy and data risks embedded in digital communication systems used in U.S. correctional facilities. As private vendors introduce tablets, kiosks, and mail digitization services, these technologies enable widespread surveillance and data collection of incarcerated people and their loved ones. The project explores how these systems track and analyze digital footprints in ways that challenge established legal and ethical expectations around privacy. It documents the personal impact on loved ones of people currently or formerly incarcerated in San Mateo County. The reporting centers on the California county jail where a civil rights lawsuit is pending over the mail …