StealthGPT vs WriteHuman

BRUSSELS, When the European Union enacted its landmark digital privacy law six years ago, many hoped it would rein in Big Tech’s unchecked collection of personal information.

Others followed suit. Since the EU’s General Data Protection Regulation went into effect, privacy frameworks have proliferated in regions ranging from California to New Delhi.

Today, however, privacy laws appear toothless.

“We are using 20th-century legal concepts to regulate 21st-century predictive behavioral engineering,” said Open Tech Institute digital ethics researcher Elena Vance.

First, existing privacy regulations rely on a notice and consent model. If websites want to harvest users’ data, they must explain what information they’ll gather and get users’ approval. This is why internet-goers must click Accept when they visit a website and get pelted with a cookie banner. But such prompts have done little to give internet-goers power over their own data: A University of Oxford study found that more than 80% of users accept them without a second thought just to access content. Many suffer from consent fatigue.

Second, privacy laws don’t keep up with technology. For instance, many regulations center on companies hoarding users’ Personally Identifiable Information without permission, which might include things like your name, email address or Social Security number. But tech companies don’t need your PII to build richly detailed profiles of you and sell them to the highest bidder. Through a process called algorithmic fingerprinting, they can aggregate data points that aren’t individually identifying — think geolocation data, your phone’s battery level, how quickly you type — and use them to deanonymize you with as much as 99% accuracy. Passing a law that restricts direct data collection does nothing to stop inferential profiling.

Likewise, although the explosion of generative AI tools constitutes an obvious privacy threat because they’re built on top of billions of webpages they’ve been trained on, few would characterize AI training data scraping as a violation of any particular user’s privacy. Once your digital footprint gets baked into an algorithm, there’s no pulling it back out.

Finally, privacy laws are difficult to enforce. National Data Protection Authorities are significantly underfunded and struggle to keep up with trillion-dollar tech companies that can afford deep-pocketed legal teams to fight them. Meanwhile, even hefty fines barely register as operating costs for Big Tech.

For these reasons, the consensus among technologists is it’s past time to pivot from consent-based privacy laws that place the burden of action on individual users to laws that prohibit certain kinds of data-guzzling business practices.

"The Illusion of Protection: Digital Privacy Laws and the Modern Web"

BRUSSELS - The GDPR created a standard for protecting users’ personal data, giving people more control over their privacy. However, laws similar to the GDPR have failed to put restrictions on certain legal loopholes and instead focus on broad strokes that fail to accurately address issues related to technology and personal privacy.

Two years after the GDPR was introduced, politicians in other countries including California created similar privacy laws to address data collection. Although the CCPA also uses the veneer of protecting people’s privacy, the law fails to address issues pertaining to pervasive surveillance by technology companies, especially among kids.

Current laws resort to the “notice and consent” standard. The ineffectiveness of requiring users to consent to thousands of privacy policies before using a website has resulted in “consent fatigue.” A study conducted by the University of Oxford showed that the average person is indifferent to legal terms and will accept any legal language in order to use a website. Consequently, the legal standard of “informed consent” has lost its meaning.

Privacy laws continue to rely on 20th-century notions of personal information. Laws are slow to adapt to new methods of data collection, and currently focus on traditional identifiers such as name and date of birth. Modern data brokers and collectors use a range of diverse and mundane data points to build profiles. These profiles, known as behavioral dossiers, can be used to reveal the true identity of an individual, with a very high degree of accuracy.

New types of artificial intelligence collect and absorb data in ways that are unregulated and unconstrained. The approaches are legal, and have changed the framework and scope of privacy and regulation. These new AI systems fit into a legal and regulatory gray area.

Privacy and data protection authorities are vastly under-resourced. Currently, large fines, while headline grabbing, are viewed by large tech companies as a routine cost of doing business.

“We are using 20th century legal means to regulate 21st century behavior,” says Vance. “Being ‘for’ a privacy law doesn’t mean being ‘against’ behavioral advertising.”

While legislatures around the world are busy revising privacy and data protection laws, the sentiment of the tech and legal communities is aligning. New and revised privacy laws will have little to no effect on emerging privacy threats unless the focus shifts from individual control to ab initio bans.