Humbot vs Stealth Writer

Digital Privacy Laws Do Not Work On Today's Internet.

BRUSSELS — When the European Union enacted the General Data Protection Regulation (GDPR) in 2018, it was praised as a turning point in history — a digital bill of rights that would fundamentally stop the massive consumption of personal data by Big Tech. However, six years later, and with more and more digital regulatory frameworks being implemented across the globe, from California to New Delhi, digital rights experts are sounding an alarm: existing privacy laws simply cannot adequately address the issues related to today's technology.

While laws such as the European Union's General Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CCPA) were able to effectively prevent organizations from engaging in uninvited, illegal data collection; however, over time tech companies have developed other ways to conduct surveillance on individuals, and these are often not addressed by existing laws.

A major drawback to existing laws is how they use the "notice and consent" model. Many critics believe that requiring users to click through countless cookie banner notifications creates "consent fatigue," not actual user control over their data. A recent research project conducted by the University of Oxford indicated that more than 80 percent of all internet users will blindly agree to be tracked just so they can view web pages; therefore, making the law's standard of "informed consent" completely ineffective.

Additionally, privacy regulations have been stuck in the same place as far as what constitutes "Personally Identifiable Information" (PII); this includes items such as names, social security numbers, and email addresses. Data brokers do not require PII to identify users. They utilize modern algorithmic fingerprinting to collect and use seemingly harmless information (i.e. user's device battery level, typing speed, and GPS location) to create a profile of each user. Profiles allow brokers to de-anonymize users at 99 percent accuracy without utilizing the statutory definition of personal information.

Generative artificial intelligence has dramatically increased the size of the regulatory gap. Generative artificial intelligence systems operate within a "gray zone" of law; they use billions of publicly accessible web pages to develop their systems. While data collection (scraping) is rarely considered a targeted violation of individual privacy, the generation of a digital footprint for each user is permanently embedded in black-box algorithms.

There is an additional bottleneck that prevents effective enforcement of privacy regulations. The National Data Protection Authorities (DPAs) are consistently under-resourced and can be significantly overmatched in the legal battles they wage against large-scale tech companies with billion-dollar budgets. Although the headlines may highlight major fines, these fines are typically viewed as just another expense associated with operating a business.

Elena Vance, a digital ethics researcher with the Open Tech Institute, states that "We're using 20th-century legal concepts to regulate 21st-century predictive behavioral engineering." Vance continues to say that "a law that would restrict direct data collection will have no effect on stopping inferential profiling."

Technologists are becoming more united in their belief that unless there is a shift from the responsibility of each individual user giving consent, to a prohibition of businesses using data as a source of revenue, then digital privacy will be nothing but a legal myth.

The Illusion of Protection: Why Digital Privacy Laws are Failing the Modern Web

In 2018, the European Union put into law the General Data Protection Regulation (GDPR), celebrated as a landmark in the digital era: a bill of rights which would in principle stop Big Tech's insatiable hunger for personal information. Today, six years into the age of a growing number of regulatory regimes from California to New Delhi, some digital rights experts are raising the alarm: current privacy regulations don't begin to cope with the reality of present-day technology.

Legislation such as the GDPR and the California Consumer Privacy Act (CCPA) has been successful in preventing the explicit and unauthorized data hoarding however technology companies have found ways of surveillance that are more subtle which fall through the net of existing laws.

Current law most obviously falls short in its inability to modify the "notice and consent" approach. But critics have argued that the myriad cookie banners have merely led to “consent fatigue” and not actual consent. According to a recent study by Universities of Oxford and Leeds, more than 80% of the public uses the internet, and automatically approves the privacy terms for the trackers used for accessing web pages—a condition termed "informed consent," but which currently has little legal impact.

Moreover, privacy regulations are stubbornly stuck in the world of “Personally Identifiable Information” (PII), such as names, Social Security numbers, email addresses and more. However, PII is no longer required for data brokers to identify people. But today, by using modern algorithms, brokers can overload dossiers of behaviour, through seemingly innocuous information including device battery levels, typing cadence, and daily geolocation ping. Such profiles can identify users with up to 99% accuracy, even though the definition of personal data itself is not in the statute books.

This gap in regulation has grown since the swift surge in generative AI technologies. While permanently taking users' digital footprints, AI models may be intentionally trained with billions of public web pages and this is not always considered a sweeping privacy violation, existing in some kind of grey area.

Bottlenecks in enforcement mechanisms are severe as well. National Data Protection Authorities (DPAs) have always been under-resourced and unable to keep pace with the legal resources tech giants bring to bear. Large fines may be splashy in the headlines, but they're commonplace as "indirect costs of doing business".

“You can't apply the 20th century tools of the law to a 21st century approach to behaviour engineering,” says Elena Vance, a digital ethics researcher from Open Tech Institute. A law which limits direct data collection “plainly does not prevent inferential profiling”.

When policymakers around the globe are trying to write new laws, the conclusion that technologists have reached is becoming more clear: if policy and law don't shift the burden from user consent to rules banning data-provided business models, then digital privacy will remain a fiction.