• We covered AI regulation around the world
• EU AI Act: World’s first comprehensive AI law with risk-based approach (banned, high-risk, limited, minimal risk tiers)
• US approach: Sectoral regulation with state-level initiatives
• China: State control over content with innovation goals; requires algorithm registration
• No global consensus yet, but convergence on key principles is likely
• Today: How does AI intersect with privacy?

Part 1: Privacy in the AI age

• Why AI makes privacy harder
• Data collection at unprecedented scale
• Inference and prediction of sensitive attributes

Part 2: Legal frameworks

• GDPR and data protection principles
• Rights of individuals
• US privacy landscape

Part 3: Technical approaches

• Differential privacy
• Federated learning
• Privacy-preserving machine learning

Part 4: Challenges and tensions

• AI as a force for good vs surveillance
• What can you do?

AI changes the privacy equation in several ways:

Scale of collection:

• Traditional surveillance was limited; AI-enabled collection is cheap, pervasive, and continuous
• Every interaction becomes a data point, creating “data exhaust” from ordinary activities

Inference capabilities:

• AI can predict sensitive information from seemingly innocuous data, e.g. shopping patterns reveal health conditions, typing speed reveals mood, social networks reveal politics
• Things you never disclosed can be inferred

Persistence:

• Data doesn’t decay; models trained today affect you forever and decisions follow you across contexts
• “Right to be forgotten” is technically hard

Research has shown AI can predict:

Famous example: Target and pregnancy

• Target’s marketing algorithm identified a pregnant teenager
• Sent baby product coupons to her home
• Her father found out before she told him
• The algorithm knew before her family did

LLMs have a training data problem:

• Trained on internet-scale data
• That data includes personal information
• Models can memorise and regurgitate training data
• Your name, address, phone number might be in there

Demonstrated attacks:

• Researchers extracted verbatim training data from GPT2
• Including names, phone numbers, email addresses
• Extraction attacks continue to improve

The consent problem:

• Most people don’t know what’s in training sets
• “Publicly available” ≠ “consented to AI training”

You have the right to:

Article 22: automated decisions

• You have the right not to be subject to purely automated decisions
• There must be human involvement in consequential decisions
• Exceptions exist for contracts and explicit consent

Purpose limitation vs model training:

• You gave data for one purpose
• Can it train a model for another?
• AI companies claim legitimate interest

Data minimisation vs big data:

• AI works better with more data
• GDPR says collect only what’s necessary
• What’s “necessary” for a foundation model?

Right to explanation vs black boxes:

• If an AI makes a decision about you, you can ask why
• But many AI systems can’t explain themselves

Right to erasure vs model training:

• Can you demand your data be removed from a trained model?
• “Unlearning” is technically very difficult

No comprehensive federal privacy law

Instead, a patchwork of sector-specific rules:

State laws filling the gap:

• California (CCPA/CPRA): Most comprehensive, GDPR-like rights
• Virginia, Colorado, Connecticut: Similar frameworks
• Illinois BIPA: Biometric data, with private right of action
• Many more states following, as we saw in previous lectures

Major fines (selected):

Patterns:

• Big tech companies are primary targets
• Data transfers, consent, children are focus areas
• Fines are getting larger
• Enforcement varies by country (Ireland is lax)

Differential privacy is a mathematical framework for privacy-preserving data analysis.

The core idea:

• Add carefully calibrated noise to data or results
• The noise makes it impossible to tell whether any individual was in the dataset
• But aggregate patterns remain visible

Formal guarantee:

• The output of an analysis is nearly the same whether or not any single individual is included
• An attacker learns almost nothing about any specific person
• Privacy loss is quantified by epsilon (ε)
• Trade-off: More noise = more privacy = less accuracy

Synthetic data is artificially generated data that preserves the statistical properties of real data without containing actual personal information.

How it works:

• Train a generative model on real data
• Model learns statistical patterns and correlations
• Generate new, fake data points that look real
• Train your AI on synthetic data instead

Privacy benefits and limitations:

• No real personal data in training pipeline
• Individuals can’t be identified from synthetic records
• Can share data freely for research and collaboration
• However, synthetic data may not capture rare cases well
• Risk of “overfitting” to original data (memorisation)

The promise:

• Disease prediction saves lives
• Personalised education helps students
• Recommendation systems save time
• Fraud detection protects consumers

The same system can be both good and bad:

• Health app: Helps you exercise OR enables insurance discrimination
• Location data: Optimises traffic OR tracks movements
• Facial recognition: Finds missing children OR enables authoritarian control
• Context and governance determine outcomes

Individual actions:

• Review privacy settings and use privacy-focused tools (Signal, DuckDuckGo, Firefox)
• Limit location sharing and use different email addresses for different services
• Exercise your rights (access, deletion requests) and be skeptical of “personalisation”

Limitations of individual action:

• Opting out often means losing service; privacy is collective, not just individual
• Your data can be inferred from others’ data, and power imbalance is structural

Collective action:

• Support privacy legislation and demand transparency from companies
• Support organisations fighting for privacy (EFF, EPIC, etc.)
• Choose services that respect privacy and vote for privacy-protecting candidates

What happened:

• Clearview AI scraped billions of photos from social media
• Built a facial recognition database without consent
• Sold access to law enforcement, corporations, wealthy individuals
• People never knew their faces were in the database

Privacy violations:

• No consent for data collection or use
• Violated terms of service of platforms
• GDPR fines: €20M in multiple EU countries
• Illinois BIPA: Multiple class action settlements
• UK, Australia, Canada: Ordered to delete data

AI and privacy

• AI enables collection at unprecedented scale
• Inference makes “non-sensitive” data sensitive
• Models can memorise and leak personal information

Legal frameworks

• GDPR: Comprehensive rights-based approach
• US: Patchwork of sectoral laws
• Tension between AI development and data protection

Technical approaches

• Differential privacy: Add noise, preserve patterns
• Federated learning: Train without centralising
• Synthetic data: Train on artificial data, protect originals
• All have trade-offs; none is a silver bullet

Tensions

• Same data enables benefits and surveillance
• Trade-off between utility and privacy exists but is overstated

Key insights

• Collection is the core problem
• Privacy is collective, not just individual
• Technical fixes don’t address power imbalances
• Context and governance determine outcomes