News Article · gemini-3-8-flash

"The Illusion of Protection: Digital Privacy Laws and the Modern Web" BRUSSELS - The GDPR created a standard for protecting users’ personal data, giving people more control over their privacy. However, laws similar to the GDPR have failed to put restrictions on certain legal loopholes and instead focus on broad strokes that fail to accurately address issues related to technology and personal privacy. Two years after the GDPR was introduced, politicians in other countries including California created similar privacy laws to address data collection. Although the CCPA also uses the veneer of protecting people’s privacy, the law fails to address issues pertaining to pervasive surveillance by technology companies, especially among kids. Current laws resort to the “notice and consent” standard. The ineffectiveness of requiring users to consent to thousands of privacy policies before using a website has resulted in “consent fatigue.” A study conducted by the University of Oxford showed that the average person is indifferent to legal terms and will accept any legal language in order to use a website. Consequently, the legal standard of “informed consent” has lost its meaning. Privacy laws continue to rely on 20th-century notions of personal information. Laws are slow to adapt to new methods of data collection, and currently focus on traditional identifiers such as name and date of birth. Modern data brokers and collectors use a range of diverse and mundane data points to build profiles. These profiles, known as behavioral dossiers, can be used to reveal the true identity of an individual, with a very high degree of accuracy. New types of artificial intelligence collect and absorb data in ways that are unregulated and unconstrained. The approaches are legal, and have changed the framework and scope of privacy and regulation. These new AI systems fit into a legal and regulatory gray area. Privacy and data protection authorities are vastly under-resourced. Currently, large fines, while headline grabbing, are viewed by large tech companies as a routine cost of doing business. “We are using 20th century legal means to regulate 21st century behavior,” says Vance. “Being ‘for’ a privacy law doesn’t mean being ‘against’ behavioral advertising.” While legislatures around the world are busy revising privacy and data protection laws, the sentiment of the tech and legal communities is aligning. New and revised privacy laws will have little to no effect on emerging privacy threats unless the focus shifts from individual control to ab initio bans.

BRUSSELS, When the European Union enacted its landmark digital privacy law six years ago, many hoped it would rein in Big Tech’s unchecked collection of personal information. Others followed suit. Since the EU’s General Data Protection Regulation went into effect, privacy frameworks have proliferated in regions ranging from California to New Delhi. Today, however, privacy laws appear toothless. “We are using 20th-century legal concepts to regulate 21st-century predictive behavioral engineering,” said Open Tech Institute digital ethics researcher Elena Vance. First, existing privacy regulations rely on a notice and consent model. If websites want to harvest users’ data, they must explain what information they’ll gather and get users’ approval. This is why internet-goers must click Accept when they visit a website and get pelted with a cookie banner. But such prompts have done little to give internet-goers power over their own data: A University of Oxford study found that more than 80% of users accept them without a second thought just to access content. Many suffer from consent fatigue. Second, privacy laws don’t keep up with technology. For instance, many regulations center on companies hoarding users’ Personally Identifiable Information without permission, which might include things like your name, email address or Social Security number. But tech companies don’t need your PII to build richly detailed profiles of you and sell them to the highest bidder. Through a process called algorithmic fingerprinting, they can aggregate data points that aren’t individually identifying — think geolocation data, your phone’s battery level, how quickly you type — and use them to deanonymize you with as much as 99% accuracy. Passing a law that restricts direct data collection does nothing to stop inferential profiling. Likewise, although the explosion of generative AI tools constitutes an obvious privacy threat because they’re built on top of billions of webpages they’ve been trained on, few would characterize AI training data scraping as a violation of any particular user’s privacy. Once your digital footprint gets baked into an algorithm, there’s no pulling it back out. Finally, privacy laws are difficult to enforce. National Data Protection Authorities are significantly underfunded and struggle to keep up with trillion-dollar tech companies that can afford deep-pocketed legal teams to fight them. Meanwhile, even hefty fines barely register as operating costs for Big Tech. For these reasons, the consensus among technologists is it’s past time to pivot from consent-based privacy laws that place the burden of action on individual users to laws that prohibit certain kinds of data-guzzling business practices.

**Digital Privacy Laws Can Not Keep Up With The Evolution of the Internet. ** When the EU released their privacy law back in 2018 it was called a game changer. People believed this new digital privacy law would help take Big Tech down a peg and prevent them from harvesting peoples data. After 6 years and many countries copying our ways and implementing there own digital privacy law. There have been studies shown that these privacy laws cannot protect us in todays day and age of technology. Digital Privacy Laws have prevented companies from collecting your personal information without your knowledge and permission. But what most don't know is that companies have found new ways to collect data that aren't covered under these new laws. Many believe that these privacy laws haven't done enough because they only state that your information can be collected with "Notice and Consent". Many digital privacy advocates are claiming that because of all of the pop ups telling you about these laws we are no longer informed and just click away. One study has stated that 80% of internet users will agree to these policies in order to browse the internet. Not only are we not informed about these policies we also are collecting more data than ever. Companies now know that they can track and gather a persons personal identifiable information with the use of technology. They don't even need to know your name or other forms of Personally Identifiable Information (PII). There have been recent studies shown that brokers can determine who you are by looking at data such as your battery percentage and location throughout the day. With a accuracy rate of 99%. As we continue to learn more about how A.I works and is constantly taking data from the internet. We will see more digital privacy problems. Companies have been able to collect data on us that was once thought impossible without using PII. Privacy laws will continue to fail if we don't find new ways to enforce our digital privacy laws. As many of our national Digital Protection Agencies don't have enough money or lawyers to go against these Billion dollar corporations. Some may say well there are huge fines put on companies, but again those fines are a drop in the bucket for companies that make billions of dollars. "Elena Vance" researcher of digital privacy believes that we are trying to use laws from the past to control technology that is controlling people's future actions. She goes on to state that we need to find better ways to stop companies from gathering our information. There are laws being drafted all over the world to fix this issue. But as of right now no laws have been passed that will stop companies from collecting data that is used to create a profile on your behavior and actions.

**The Illusion of Protection: Why Digital Privacy Laws Are Failing the Modern Web** **Digital Rights Watchers Say Existing Privacy Laws Don’t Adequately Deal With Reality of Modern Technology** Unlike previous illegal ways of collecting data online by large corporations, current privacy laws ban explicit, unauthorized data collection but are unable to stop more advanced ways of online tracking currently used by corporations. There’s a bigger issue with the current system of privacy laws, though: the ‘notice and consent’ model, which was established decades ago and has had the effect of creating ‘consent fatigue’ — the bulk of online tracking is enabled through terms and conditions that users don’t read, and which most users click through to access a website. New research from the University of Oxford suggests that in excess of 80% of online tracking is accepted by users simply in order to access a web page online. The notice and consent model is thus failing to ensure the protection of individuals’ privacy online. Data brokerages, however, are operating outside of current Privacy Legislation in order to create highly detailed user profiles using an aggregation of non-sensitive data points that would normally not be considered PII, such as a user’s battery levels, their typing speed and even their location-based data from daily activities across the globe. Profiles can then be used to deanonymize users with up to 99% accuracy. But it is above all the rapid development of generative AI models that has uncovered a huge chasm between current laws and their practical application. These models are training on billions of web pages, sometimes illegally scraped from the web, in many places without a specific instance of privacy violation having occurred. In this way huge amounts of digital footprints of individuals are permanently absorbed by black boxes and processed for unknown purposes. The practical enforcement of data protection and privacy laws is even more infeasible today. National Data Protection Authorities (DPAs) have only limited financial means at their disposal. Mega-corporations from the trillion-dollar club can afford to reproduce fines of this kind as “business expenses”. This means they simply won’t be deterred from their notorious data exploitation strategies. "20th century law for 21st century predictive behavioral control" According to Elena Vance, a digital ethics researcher at the Open Tech Institute, while legislation that seeks to ban the collection of personal information is effective in respect of ‘direct’ data, it will have no bearing on ‘inferred’ information. Yet as more countries draft their own digital rights laws, most in the technology community concur that these laws will not bring about significant improvements to online privacy unless all digital business models are banned. In other words, online privacy will remain a purely legal fiction.

BRUSSELS — When the EU first enforced the Global Data Protection Regulation (GDPR) in 2018, it was seen as a victory for privacy rights; a measure that would finally put an end to Big Tech’s ability to vacuum up any trace of personal information they come across on their digital platforms. Six years later, as similar regulations are drafted in California and New Delhi, digital rights advocates are growing increasingly concerned that these measures go only skin-deep. While laws like the GDPR and California’s own CCPA have outlawed certain forms of data collection on private citizens, technology companies have since adapted by utilizing new methods of gathering personal information not covered by current legislation. The greatest flaw in the design of privacy laws is its dependence on the now antiquated system of “notice and consent.” Experts say that forcing users to accept a site’s terms of service via an obtrusive pop-up window has led to “consent fatigue,” with many simply giving permission for data collection in order to save time A recent study conducted by the University of Oxford found that over 80% of web surfers grant permission for tracking simply to avoid spending more time on a page. Many critics of the GDPR say that by requiring consent, governments have created a situation in which users are given “informed” choices, but in reality are making decisions based on what they think, rather than what they know. In its current form, U.S. privacy laws are written in such a way that protects citizens from having their personally identifiable information (PII) extracted without their knowledge This means that information like social security numbers or email addresses cannot be collected by third-party data brokers without the express permission of the consumer. Yet what data brokers and technology firms realize is that they do not need PII to identify you. By collecting seemingly innocuous information like how long you keep your phone charged for or where you go on an average day, they can combine this information into a profile that can identify you with a 99% degree of accuracy. With the rise of AI, this problem has only grown more pressing. AI programs are trained using information extracted from billions of pages of online content. To date, few privacy laws make distinguishing between extracting information for a specific purpose like medical research or advertising revenue; both are permanently etched in the neural network of the AI software There is also the issue of enforcement. When it comes to data privacy laws, national authorities tasked with ensuring corporations follow the rules are often outgunned by the sheer legal might of multinational conglomerates who can afford to hire any number of attorneys to stall investigations. Even when companies do get fined, the amount is often minuscule when seen in the context of corporate profits. "We are using 20th-century concepts to grapple with 21st-century issues." Says data privacy expert Elena Vance of the Open Tech Institute. "The GDPR may stop companies that outright sell your information, but not ones who use indirect means of identifying you." As legislators in countries around the world begin to draft proposed privacy laws, Vance and her colleagues believe that the best course of action is to move away from a system based on notice and consent and towards legislation that prohibits any and all data collection practices by business altogether.

A False Sense of Security: How Digital Privacy Regulations Are Letting Down the Modern Web BRUSSELS - The European Union's 2018 decision to introduce the General Data Protection Regulation (GDPR) was described as the shot heard 'round the world-a digital bill of rights that would rein in Big Tech's relentless appetite for personal data. But six years on, and amid a wave of new regulations emerging from California to New Delhi, digital rights advocates are warning that privacy laws are not fit-for-purpose. Est régles telles que le GDPR et la California Consumer Privacy Act (CCPA), interdisent évidemment la collecte de données en continu par de façon illégale. However, tech companies have simply moved on to more refined invasive practices that are more difficult to regulate. But the biggest problem with the law is its foundation: the regime of notice and consent. Echoing the tired critique that clicking open endless cookie popups is a license for "consent fatigue", a new report from the University of Oxford found that people are accepting tracking without actually understanding what they're clicking on, with some 80 percent recklessly accepting tracking conditions just to view a web page. Too, privacy policy requirements still cling to "Personally Identifiable Information" - PII data, such as a name or Social Security number or email address. But data brokers no longer require PII data to identify individuals. Using newfangled algorithmic fingerprinting, brokers assemble innocuous data points - battery levels, typing rhythms, daily geo pings - into behavioral profiles, deanonymizing users with near-perfect accuracy despite legal definitions of "personal data." The exponential growth of generative artificial intelligence has only expanded this divide. AI algorithms become trained on billions of public web pages, in a legal no-man's land where data scraping doesn't tend to fall under the heading of a deliberate privacy breach, even as these firms delete nothing from the cloud, only loading it into a mysterious black box. Enforcement tools hit a bottleneck as well. National DPAs have insufficient resources, and their power is no match for the billion-dollar big tech firms' tax havens. Large fines – made to stoke headlines – have become a cost of living for the biggest tech companies. "We're applying 20th-century legal principles to regulate 21st-century predictive behavioral engineering," says Elena Vance, a researcher in digital ethics at the Open Tech Institute. "Taking out a law that limits what data can be collected is not going to stop inferential profiling." As legislators around the globe try to craft new legislation, the Tech Collective's growing consensus is even more clear: Absent rules that move the responsibility from individual consent to outright bans on data-powered business models, digital privacy is just a legal mirage.

The Illusion of Protection: Why Digital Privacy Laws are Failing the Modern Web In 2018, the European Union put into law the General Data Protection Regulation (GDPR), celebrated as a landmark in the digital era: a bill of rights which would in principle stop Big Tech's insatiable hunger for personal information. Today, six years into the age of a growing number of regulatory regimes from California to New Delhi, some digital rights experts are raising the alarm: current privacy regulations don't begin to cope with the reality of present-day technology. Legislation such as the GDPR and the California Consumer Privacy Act (CCPA) has been successful in preventing the explicit and unauthorized data hoarding however technology companies have found ways of surveillance that are more subtle which fall through the net of existing laws. Current law most obviously falls short in its inability to modify the "notice and consent" approach. But critics have argued that the myriad cookie banners have merely led to “consent fatigue” and not actual consent. According to a recent study by Universities of Oxford and Leeds, more than 80% of the public uses the internet, and automatically approves the privacy terms for the trackers used for accessing web pages—a condition termed "informed consent," but which currently has little legal impact. Moreover, privacy regulations are stubbornly stuck in the world of “Personally Identifiable Information” (PII), such as names, Social Security numbers, email addresses and more. However, PII is no longer required for data brokers to identify people. But today, by using modern algorithms, brokers can overload dossiers of behaviour, through seemingly innocuous information including device battery levels, typing cadence, and daily geolocation ping. Such profiles can identify users with up to 99% accuracy, even though the definition of personal data itself is not in the statute books. This gap in regulation has grown since the swift surge in generative AI technologies. While permanently taking users' digital footprints, AI models may be intentionally trained with billions of public web pages and this is not always considered a sweeping privacy violation, existing in some kind of grey area. Bottlenecks in enforcement mechanisms are severe as well. National Data Protection Authorities (DPAs) have always been under-resourced and unable to keep pace with the legal resources tech giants bring to bear. Large fines may be splashy in the headlines, but they're commonplace as "indirect costs of doing business". “You can't apply the 20th century tools of the law to a 21st century approach to behaviour engineering,” says Elena Vance, a digital ethics researcher from Open Tech Institute. A law which limits direct data collection “plainly does not prevent inferential profiling”. When policymakers around the globe are trying to write new laws, the conclusion that technologists have reached is becoming more clear: if policy and law don't shift the burden from user consent to rules banning data-provided business models, then digital privacy will remain a fiction.

When the European Union passed the General Data Protection Regulation (GDPR) in 2018, it was hailed as a historic development – a “digital Bill of Rights” which would put significant constraints on big tech's insatiable hunger for personal data. But six years after GDPR took effect, there is growing alarm among digital rights advocates: existing privacy regulations are inherently unable to address the true nature of how we experience modern technology today. Whereas existing legislation such as the GDPR and CCPA successfully prohibited blatant, unapproved data hoarding; big tech has moved toward more complex methods of surveillance, which do not violate existing legislative standards. One major weakness of current law is its reliance on a “notice and consent” model. Advocates claim that requiring users to agree to endless banner messages has resulted in “consent fatigue,” instead of actually empowering them. A recent study conducted by the University of Oxford indicated that over 80% of Internet users mindlessly approve tracking agreements solely to be able to view website content. Therefore, the legal definition of “informed consent,” which requires knowledge of what you are consenting to, has lost virtually all of its effectiveness. Additionally, privacy regulations continue to be based upon the outdated principle of Personally Identifiable Information (“PII”) – information about people including name, social security number, etc. However, since data brokers no longer require PII to profile individuals, they use other means of identifying those who browse the Internet. By creating behavioral dossiers using a combination of device battery level, typing speed and daily GPS location tracking data (each piece of data individually appears harmless), data brokers have developed an ability to create accurate digital portraits of Internet users with an accuracy rate approaching 100%. This creates the paradoxical situation whereby these profiles provide complete anonymity to the users whose activities were tracked; thus allowing data brokers to disregard statutory provisions defining personally identifiable data. Modern Algorithmic fingerprinting further complicates the ability of lawmakers to develop effective regulatory policies. With billions of web pages being used to train Generative Artificial Intelligence models, AI models operate outside of traditional regulatory boundaries established by prior law regarding data scraping. AI models are capable of consuming the entire digital footprint of a user every time they access a new webpage. Finally, national DPAs lack sufficient funding to enforce compliance. National Data Protection Authorities ("DPAs") are severely under-funded compared to trillion dollar tech giants. While large fines may garner attention in news reports; they are generally viewed as merely another cost-of-doing-business by these corporations. We are using 20th century legal concepts to govern 21st Century Predictive Behavioral Engineering states Elena Vance, a digital ethics researcher at The Open Technology Institute. Passing a statute that prohibits the direct acquisition of a consumer's data provides no relief from an organization's ability to infer the same type of data through indirect profiling. It remains clear among technologists that unless individual user consent is replaced with strict prohibitions against data-based business practices, privacy protection will continue to exist primarily as a legal fiction.

Digital Privacy Laws Do Not Work On Today's Internet. BRUSSELS — When the European Union enacted the General Data Protection Regulation (GDPR) in 2018, it was praised as a turning point in history — a digital bill of rights that would fundamentally stop the massive consumption of personal data by Big Tech. However, six years later, and with more and more digital regulatory frameworks being implemented across the globe, from California to New Delhi, digital rights experts are sounding an alarm: existing privacy laws simply cannot adequately address the issues related to today's technology. While laws such as the European Union's General Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CCPA) were able to effectively prevent organizations from engaging in uninvited, illegal data collection; however, over time tech companies have developed other ways to conduct surveillance on individuals, and these are often not addressed by existing laws. A major drawback to existing laws is how they use the "notice and consent" model. Many critics believe that requiring users to click through countless cookie banner notifications creates "consent fatigue," not actual user control over their data. A recent research project conducted by the University of Oxford indicated that more than 80 percent of all internet users will blindly agree to be tracked just so they can view web pages; therefore, making the law's standard of "informed consent" completely ineffective. Additionally, privacy regulations have been stuck in the same place as far as what constitutes "Personally Identifiable Information" (PII); this includes items such as names, social security numbers, and email addresses. Data brokers do not require PII to identify users. They utilize modern algorithmic fingerprinting to collect and use seemingly harmless information (i.e. user's device battery level, typing speed, and GPS location) to create a profile of each user. Profiles allow brokers to de-anonymize users at 99 percent accuracy without utilizing the statutory definition of personal information. Generative artificial intelligence has dramatically increased the size of the regulatory gap. Generative artificial intelligence systems operate within a "gray zone" of law; they use billions of publicly accessible web pages to develop their systems. While data collection (scraping) is rarely considered a targeted violation of individual privacy, the generation of a digital footprint for each user is permanently embedded in black-box algorithms. There is an additional bottleneck that prevents effective enforcement of privacy regulations. The National Data Protection Authorities (DPAs) are consistently under-resourced and can be significantly overmatched in the legal battles they wage against large-scale tech companies with billion-dollar budgets. Although the headlines may highlight major fines, these fines are typically viewed as just another expense associated with operating a business. Elena Vance, a digital ethics researcher with the Open Tech Institute, states that "We're using 20th-century legal concepts to regulate 21st-century predictive behavioral engineering." Vance continues to say that "a law that would restrict direct data collection will have no effect on stopping inferential profiling." Technologists are becoming more united in their belief that unless there is a shift from the responsibility of each individual user giving consent, to a prohibition of businesses using data as a source of revenue, then digital privacy will be nothing but a legal myth.

**The Mirage of Security: Why Existing Digital Privacy Legislation Is Ineffective in the Modern Web** **BRUSSELS** — When the European Union approved the General Data Protection Regulation (GDPR) in 2018, it marked the landmark legislation that would finally put a stop to the rampant data hoarding practices of Big Tech companies. Now, with six years of experience, multiple copies of GDPR and similar laws implemented across the globe, digital rights experts ring the alarm bell: the existing legislative framework is simply incapable of regulating the modern technology. While GDPR and California Consumer Privacy Act (CCPA) effectively prohibited explicit data misuse, tech companies managed to change their tactics to adapt to the new regulations. First of all, current laws suffer greatly because of the "notice and consent" requirement. According to Elena Vance from the Open Tech Institute, making users tick countless boxes in cookie consent banners has led to so-called "consent fatigue" – people are accepting any and all terms in order to use websites without getting frustrated. In addition to that, privacy legislation is still centered around the concept of Personally Identifiable Information (PII): names, Social Security number, email addresses and other types of data that can directly link person to the data entry. However, today, data brokers no longer need PII. Using modern algorithmic fingerprinting, they can collect various data entries that seem harmless but when combined give the picture of the person – battery charge of the device, typing speed, geolocation pings, etc. Those behavioral profiles allow them to deanonymize users with up to 99% accuracy. Another aspect that widens the gap between law and technology is the development of generative artificial intelligence. AI uses the database that consists of billions of publicly available websites and operates in a legal limbo where data scraping is not considered targeted privacy violation but rather takes permanent user information out of context and puts it into a black box. Lastly, there is the problem of enforcing laws. National Data Protection Authorities are underfunded and unable to stand against trillion-dollar companies in legal battles. The fines that are imposed on the companies look big in the headlines but are treated by the latter as the regular cost of business. "We are trying to regulate 21st-century technology with the concepts developed in the 20th century," Elena Vance. "Restricting direct data collection does not do anything about the inferential profiling." Thus, as the lawmakers try to develop new legislation, the opinion of the technologist community becomes clearer and clearer: without the change in focus from user consent to prohibition of data business models, digital privacy remains legal fiction.

The False Promise of Protection: Digital Privacy Regulations and the State Street Mantra BRUSSELS — The European Union has long held itself to be a champion of privacy rights, and when it passed the General Data Protection Regulation (GDPR) in 2018 many saw it as a seminal moment: Digital bill of rights that might finally rein in Big Tech's indiscriminate hunger for individuals’information. Now, six years on, as new regulatory frameworks are rolled out globally—from California to New Delhi—digital rights experts sound a warning: existing privacy law is fundamentally poorly designed for the realities of contemporary technology. Although laws such as GDPR and California's Consumer Privacy Act (CCPA) have been effective in banning an explicit form of data hoarding, unregulated surveillance has now shifted to more advanced forms not easily describable by legal loopholes that technology firms exploit. One key limitation is the "notice and consent" model that governs a lot of current law. Instead of granting users greater powerful solutions, critics say the countless cookie banners on which we are forced to click represents a brainwashing – one level up from consent fatigue. A recent study from the University of Oxford concluded that more than 80 per cent of internet users accept tracking terms simply to be able to open web pages, making the legal standard of "informed consent" devoid of meaning. In addition, the stickiness of data protection laws to "Personally Identifiable Information" (PII)—country-specific information such as names, Social Security numbers or email addresses However, data brokers do not need PII any more to locate people. Armed with nothing more potent than the insight derived from modern algorithmic fingerprinting, brokers accumulate data points that may seem innocuous in isolation—device battery levels, typing cadence and daily pings to recommended locations all contribute to behavioral dossiers. These profiles are able to deanonymize users with up to 99% accuracy and circumvent statutory definitions of personally identifiable information altogether. This regulatory gap has been exacerbated by the unfortunate speed with which generative artificial intelligence has risen. AI models train on billions of public web pages, a legal gray area where few if any trends in data scraping can be described as a targeted assault on privacy principles, while permanently engraving users' digital footprints into black-box algorithms. But there are also severe bottlenecks when it comes to building effective enforcement mechanisms. National Data Protection Authorities (DPAs) are chronically under-funded and outgunned by the legal war chests of trillion-dollar tech behemoths. Big-ticket penalties, though splashy in headlines, are routinely written off as a simple "cost of doing business." Elena Vance, a digital ethics researcher at the Open Tech Institute, said: 'We are applying 20th-century legal definitions to regulate 21st-century predictive behavioral engineering.' "As long as inferential profiling is not severely limited, it does not help to pass laws that restrict direct data collection." As global lawmakers scramble to formulate updated frameworks, technologists are becoming nearly uniform in their evaluation: Unless the balance shifts from individualized consent over fixed data collection practices, to strict prohibitions on specific types of data-driven business models, digital privacy is once again nothing more than a legal fiction.

**“Digital privacy laws do not protect the user or empower people to do better.”** The European Union’s General Data Protection Regulation (GDPR) received a rapturous reception as a major milestone in 2018 – a digital bill of rights that would rein in Big Tech’s hunger for personal data. Six years on, as laws spring up from California to New Delhi, digital rights experts are sounding the alarm: existing privacy laws are not equipped to deal with the realities of the modern world. Statutes like the GDPR and California Consumer Privacy Act (CCPA) successfully banned unauthorized explicitly stating of gathering and hoarding data. However, the tech companies have moved on to steal data in much more sophisticated ways, that are allowed. At present, the “notice and consent” model is the most glaring limitation of current law. Critics have said that the requirement to click through numerous cookie banners has resulted in consent fatigue rather than real power. According to a recent analysis done by the University of Oxford, over 80% of web users accept the conditions of tracking just so they can access web pages. Consequently, this legal standard of “informed consent” is functionally meaningless. In addition, privacy laws continue to be shackled to the idea of “Personally Identifiable Information” (PII) names, Social Security numbers, email addresses, and more. But data brokers now do not need PII to recognize people. By today’s fingerprinting algorithms, brokers have started to compile what seem like innocent data points like battery level, typing pattern and average daily ping to a location, etc. These profiles can deanonymize users with a 99% accuracy rate, thus circumventing legal definitions of personal data altogether. The rapid growth of generative artificial intelligence has expanded this regulatory gulf. AI models ingest billions of public web pages to design their functioning. They often operate in a grey area of legality: data scraping is rarely classified as a targeted privacy infringement, but it permanently absorbs users’ footprints. This end up in black box models. The enforcement mechanisms also see bottlenecks. The DPAs of various nations are always chronically out of funds and outmatched against the legal war chests of trillion-dollar tech companies. Fines that may sound huge in the headlines are just “cost of doing business” for most. Elena Vance, a digital ethics researcher at the Open Tech Institute, says, “We’ve armed ourselves with 20th-century law concepts to regulate 21st-century predictive behavioral engineering.” "A law limiting direct data collection does not stop inferential profiling and its effects.". Technologists increasingly agree that global efforts to draft new regulations will continue to result in a legal fiction for digital privacy. Unless the burden of consent switches to strict prohibitions on data-enabled business models.

**The Illusion of Protection: Why Digital Privacy Laws Are Failing the Modern Web** **BRUSSELS** – The General Data Protection Regulation (GDPR), which the European Union introduced in 2018, was at the time seen as a landmark event, a digital bill of rights designed to put a major brake on Big Tech's insatiable desire for personal data. Now, six years on and with regulatory systems spreading out from California to New Delhi, digital rights experts are raising the alarm since current privacy laws are fundamentally not suited to deal with the facts of modern technology. Although laws such as the GDPR and the California Consumer Privacy Act (CCPA) have successfully prohibited explicit and unauthorized data hoarding, technology companies have instead turned to more advanced methods of surveillance which manage to pass through the legal loopholes. The biggest drawback of existing law is its use of the "notice and consent" approach. It has been claimed that making users have to click through long sequences of cookie banners has led to "consent fatigue" rather than true empowerment. A study carried out recently by the University of Oxford showed that more than 80% of internet users automatically agree to tracking terms just so that they can access web pages, which means that the legal requirement of "informed consent" is in effect meaningless. Moreover, privacy laws still stick to the idea of "Personally Identifiable Information" (PII)—that is, data such as names, Social Security numbers, or email addresses. However, data brokers do not need PII in order to identify people. By using modern algorithmic fingerprinting, they collect a number of apparently harmless data points—such as battery level on a device, the speed at which someone types, and the geolocation pings they send each day—to create behavioral dossiers. These profiles are able to deanonymize users with as much as 99% accuracy and thus avoid the legal definitions of personal data altogether. The quick development of generative artificial intelligence has increased this gap in regulation. To train their systems, AI models take in billions of web pages from the public, functioning in a legal gray area since data scraping is generally not regarded as a breach of privacy even though it permanently incorporates users' digital footprints into black-box algorithms. Enforcement mechanisms also suffer from serious bottlenecks. The national data protection authorities (DPAs) are chronically underfunded and unable to match the legal reserves of the huge tech companies worth trillions of dollars. Although large fines are striking in the headlines, they are normally treated as just 'a cost of doing business'. "Elena Vance, a digital ethics researcher at the Open Tech Institute, says that we are applying 20th-century legal concepts to the regulation of 21st-century predictive behavioral engineering," because a law which restricts direct data collection achieves nothing in preventing inferential profiling. As lawmakers around the world strive to draw up updated frameworks, technologists are becoming more unanimous in their view that digital privacy will continue to be nothing more than a legal fiction unless the responsibility is transferred from individual user consent to strict bans on data-driven business models.

**The False Sense of Security -- Digital Privacy Is Not Working** **BRUSSELS** — When the European Union passed the General Data Protection Regulation (GDPR) in 2018, it was touted as a turning point—an internet bill of rights that would rein in the tech industry’s insatiable quest for personal information. Now, six years later, as new regulations are coming out all over the planet, experts in digital rights say that existing laws have a serious flaw—they are not equipped to deal with novel technologies. Even if regulations such as GDPR or California Consumer Privacy Act (CCPA) succeed in banning obvious data misuse, new technology helps companies evade this to keep tracking people in new ways. The biggest flaw of the existing law is its reliance on the “notice and consent” system. Detractors argue that forcing users to agree to thousands of cookies leads to what they term “consent fatigue.” According to a recent study by the University of Oxford, about 80% of users click “Ok” to every tracking agreement just to be able to visit a website. Moreover, laws continue to be based on the antiquated idea of “Personally Identifiable Information” (PII)—such as, names, Social Security numbers, or email addresses. However, it is no longer possible for brokers to depend on PII to track people. Algorithms make it possible to locate individuals just using harmless data like battery levels of their devices and their typing speed. This way, it is possible to create a profile of a user that is able to identify him or her with over 99% accuracy. The fast rise of generative artificial intelligence has made this gap even wider. AI needs billions of webpages for training purposes, and whether it is legal in this case also remains unclear. There are also major problems with enforcement. The Data Protection Authority (DPA) has always been underfunded, and it does not have resources to fight the law industry of tech giants. The fines are significant, but tech companies view them just as part of their expenses. According to Elena Vance, digital ethics expert at the Open Tech Institute, “We are trying to apply 20th-century concepts in the 21st-century world of predictive engineering."