Undetectable.ai vs Walter Writes

**The Illusion of Protection: Why Digital Privacy Laws Are Failing the Modern Web**

**Digital Rights Watchers Say Existing Privacy Laws Don’t Adequately Deal With Reality of Modern Technology**

Unlike previous illegal ways of collecting data online by large corporations, current privacy laws ban explicit, unauthorized data collection but are unable to stop more advanced ways of online tracking currently used by corporations.

There’s a bigger issue with the current system of privacy laws, though: the ‘notice and consent’ model, which was established decades ago and has had the effect of creating ‘consent fatigue’ — the bulk of online tracking is enabled through terms and conditions that users don’t read, and which most users click through to access a website. New research from the University of Oxford suggests that in excess of 80% of online tracking is accepted by users simply in order to access a web page online. The notice and consent model is thus failing to ensure the protection of individuals’ privacy online.

Data brokerages, however, are operating outside of current Privacy Legislation in order to create highly detailed user profiles using an aggregation of non-sensitive data points that would normally not be considered PII, such as a user’s battery levels, their typing speed and even their location-based data from daily activities across the globe. Profiles can then be used to deanonymize users with up to 99% accuracy.

But it is above all the rapid development of generative AI models that has uncovered a huge chasm between current laws and their practical application. These models are training on billions of web pages, sometimes illegally scraped from the web, in many places without a specific instance of privacy violation having occurred. In this way huge amounts of digital footprints of individuals are permanently absorbed by black boxes and processed for unknown purposes.

The practical enforcement of data protection and privacy laws is even more infeasible today. National Data Protection Authorities (DPAs) have only limited financial means at their disposal. Mega-corporations from the trillion-dollar club can afford to reproduce fines of this kind as “business expenses”. This means they simply won’t be deterred from their notorious data exploitation strategies.

"20th century law for 21st century predictive behavioral control" According to Elena Vance, a digital ethics researcher at the Open Tech Institute, while legislation that seeks to ban the collection of personal information is effective in respect of ‘direct’ data, it will have no bearing on ‘inferred’ information.

Yet as more countries draft their own digital rights laws, most in the technology community concur that these laws will not bring about significant improvements to online privacy unless all digital business models are banned. In other words, online privacy will remain a purely legal fiction.

When the European Union passed the General Data Protection Regulation (GDPR) in 2018, it was hailed as a historic development – a “digital Bill of Rights” which would put significant constraints on big tech's insatiable hunger for personal data. But six years after GDPR took effect, there is growing alarm among digital rights advocates: existing privacy regulations are inherently unable to address the true nature of how we experience modern technology today.

Whereas existing legislation such as the GDPR and CCPA successfully prohibited blatant, unapproved data hoarding; big tech has moved toward more complex methods of surveillance, which do not violate existing legislative standards.

One major weakness of current law is its reliance on a “notice and consent” model. Advocates claim that requiring users to agree to endless banner messages has resulted in “consent fatigue,” instead of actually empowering them. A recent study conducted by the University of Oxford indicated that over 80% of Internet users mindlessly approve tracking agreements solely to be able to view website content. Therefore, the legal definition of “informed consent,” which requires knowledge of what you are consenting to, has lost virtually all of its effectiveness.

Additionally, privacy regulations continue to be based upon the outdated principle of Personally Identifiable Information (“PII”) – information about people including name, social security number, etc. However, since data brokers no longer require PII to profile individuals, they use other means of identifying those who browse the Internet. By creating behavioral dossiers using a combination of device battery level, typing speed and daily GPS location tracking data (each piece of data individually appears harmless), data brokers have developed an ability to create accurate digital portraits of Internet users with an accuracy rate approaching 100%. This creates the paradoxical situation whereby these profiles provide complete anonymity to the users whose activities were tracked; thus allowing data brokers to disregard statutory provisions defining personally identifiable data.

Modern Algorithmic fingerprinting further complicates the ability of lawmakers to develop effective regulatory policies. With billions of web pages being used to train Generative Artificial Intelligence models, AI models operate outside of traditional regulatory boundaries established by prior law regarding data scraping. AI models are capable of consuming the entire digital footprint of a user every time they access a new webpage.

Finally, national DPAs lack sufficient funding to enforce compliance. National Data Protection Authorities ("DPAs") are severely under-funded compared to trillion dollar tech giants. While large fines may garner attention in news reports; they are generally viewed as merely another cost-of-doing-business by these corporations.

We are using 20th century legal concepts to govern 21st Century Predictive Behavioral Engineering states Elena Vance, a digital ethics researcher at The Open Technology Institute. Passing a statute that prohibits the direct acquisition of a consumer's data provides no relief from an organization's ability to infer the same type of data through indirect profiling.

It remains clear among technologists that unless individual user consent is replaced with strict prohibitions against data-based business practices, privacy protection will continue to exist primarily as a legal fiction.