Author: Jeff Cassman

Yesterday, a district court judge in California enjoined enforcement of the state’s Age-Appropriate Design Code, or AADC, based on a dangerously overbroad reading of the First Amendment. The case, brought by big tech advocacy group Netchoice, threatens the viability of existing and future privacy legislation, including efforts to minimize the amount of information tech companies collect and use for targeted advertising and surveillance. EPIC submitted an amicus brief alongside others seeking to defend the law.

The AADC is different than other kids safety laws being challenged across the country. While other laws seek to block kids (and adults) from accessing certain types of content, the AADC requires companies that collect and use kids’ data to assess how their use of data can harm kids. These kinds of assessments are common corporate accountability measures that are found both in non-privacy laws in the United States and privacy laws around the world. The law also includes basic data protection and transparency requirements found in many current and proposed privacy laws in the United States.

The constitution does not make privacy protections impossible, but the court’s decision could do just that. The arguments advanced by Netchoice and adopted by the district court go against the entire premise of internet governance and would tie the hands of lawmakers and regulators at the exact moment when their work is desperately needed to rein in the unchecked power of tech companies. This dangerously overbroad view of the First Amendment also threatens the validity of privacy laws already on the books. But freedom to speak is not freedom to siphon data from unsuspecting internet users and use it against them. We reject Netchoice’s view that the First Amendment is a tool for the preservation and expansion of corporate power and will continue to support the fight to protect the AADC in the Ninth Circuit.

In comments to the Department of Justice and Federal Trade Commission, EPIC encouraged the agencies to include data protection and consumer privacy as factors in the newest Merger Guidelines. The DOJ and FTC recently sought public input on their draft Merger Guidelines, which will supersede existing guidelines to better reflect market realities in the modern economy. EPIC’s comments explain that, in our data-driven economy, businesses’ mass accumulation of personal data can have anticompetitive effects that further undermine consumer privacy and data security. Mergers frequently involve the consolidation of data sets, which “can entrench a firm’s dominant market position, raise barriers to entry for new and smaller firms, and exacerbate the effects of harmful consumer data practices.” To promote competition and protect consumer privacy, EPIC urged the DOJ and FTC require that data consolidation and consumer privacy be considered in the review of future mergers.

For more than twenty years, EPIC has encouraged the FTC to weigh consumer privacy in the merger review process between companies that engage in data collection. EPIC has continued to argue that acquisitions by these types of dominant firms can lead to a reduction in both competition and privacy protection.

Today, EPIC published a new report detailing the risks of AI systems purchased and used by state governments. Across the country, state and local agencies are outsourcing important government decisions to private companies and their AI tools—all without meaningful public input or oversight. These systems assign children to schools, inform medical decisions about patients, impact policing decisions about where to patrol and whom to target, determine who receives public benefits, and more. And they are all developed and operated by private companies like Deloitte, Thomson Reuters, and LexisNexis.

EPIC’s report, Outsourced & Automated: How AI Companies Have Taken Over Government Decision-Making, builds on two years of research into state AI procurement and includes insights gleaned from 621 different contracts. Part One of the report describes the various risks that private AI systems pose when used for government decision-making, including data privacy risks, issues involving AI bias and reliability, and undermining government accountability. Part Two traces the AI vendor landscape across the country, highlighting three procurement processes that vendors can use to embed their AI systems within state agencies and ten vendors that take the lion’s share of state AI funding. Part Three proposes four paths forward, including AI audits, stronger contract language, more options for legal recourse, and reprioritizing non-AI government decision-making.

Generating Harms: Generative AI’s Impact & Paths Forward is part of EPIC’s AI & Human Rights Project, which advocates for transparent, equitable, and accountable AI regulations. For more information on EPIC’s report, visit EPIC’s dedicated webpage.

The Justice Department filing claims that Twitter was in “privacy compliance chaos” after Musk took over, according to John Davisson, director of litigation at the nonprofit Electronic Privacy Information Center (EPIC). “Responsible officials exited the company, security controls were abandoned, products were introduced or radically altered with no attention paid to user privacy,” Davisson said. “Musk’s erratic decision-making repeatedly put the privacy of users at risk and clearly violated the 2022 consent decree.” 

If the government finds that Twitter violated the consent decree, it has a few options, Davisson and McGee told Quartz. It can negotiate a third consent decree and levy an even bigger civil penalty than the $150 million Twitter agreed to pay in 2022, it can sue Twitter and hash it out in court if the company won’t agree to settle, it could impose an independent monitor to oversee Twitter’s compliance, or it could limit the ways Twitter makes money off of user data. 

Read more here.

The Electronic Privacy Information Center, a Washington, D.C., nonprofit focused on bolstering the right to privacy, defines data brokers as companies that collect and categorize personal information, usually to build profiles on millions of Americans that the companies can then rent, sell or use to provide services. The data they collect, per EPIC, can include: “names, addresses, telephone numbers, email addresses, gender, age, marital status, children, education, profession, income, political preferences, and cars and real estate owned.” 

That’s not to mention “information on an individual’s purchases, where they shop, and how they pay for their purchases,” plus “health information, the sites we visit online, and the advertisements we click on. And thanks to the proliferation of smartphones and wearables, data brokers collect and sell real-time location data.” 

Privacy advocates have warned for years that location and seemingly non-specific personal data — often collected by advertisers and amassed and sold by brokers — can be used to identify individuals. They also charge that the data often isn’t well secured and that the brokers aren’t covered by laws that require the clear consent of the person being tracked. They’ve argued for both legal and technical protections so that consumers can push back. 

Read more here.