12:00 pm –
12:05 pm

WELCOME REMARKS

Matthew Reisman, Vice President for U.S. Policy, Future of Privacy Forum

12:05 pm –
12:20 pm

AI As Normal Technology

We articulate a vision of Artificial Intelligence (AI) as normal technology. To view AI as normal is not to understate its impact—even transformative, general-purpose technologies such as electricity and the internet are “normal” in this conception. This frame stands in contrast to both utopian and dystopian visions that treat AI as a separate species or a highly autonomous, potentially superintelligent entity. The statement “AI is normal technology” is three things: a description of current AI, a prediction about its foreseeable future, and, most importantly, a prescription for how society should treat it. It rejects technological determinism and emphasizes the role of institutions in shaping AI’s trajectory, guided by continuity between the past and the future.

Capability gains do not dictate the speed of adoption

We make a critical distinction between AI methods, AI applications, and AI adoption, as these three phenomena occur at vastly different timescales. While technical advances in AI methods have been rapid, transformative economic and societal impacts are likely to be slow, unfolding over decades. In safety-critical areas, such as medical devices or criminal risk prediction, AI diffusion lags decades behind innovation. When models are complex and less intelligible, it is difficult to anticipate all possible deployment conditions, necessitating stringent testing and validation that act as inherent speed limits.

Furthermore, the speed of technology adoption is constrained by the requirement for organizational and institutional change. Much like the electrification of factories, which took nearly forty years to show substantial productivity gains, AI requires the redesign of entire workflows and organizations. Benchmarks frequently mismeasure real-world utility by focusing on self-contained skills rather than the complex, contextual judgment required in professional practice. Consequently, economic impacts are likely to be gradual, with human labor remaining essential as automation redefines, rather than eliminates, economically valuable tasks.

Against superintelligence

The reliance on the slippery concepts of “intelligence” and “superintelligence” has clouded the ability to reason clearly about advanced AI. By shifting focus from intelligence to power—the ability to modify one’s environment—it becomes clear that humans have always used technology to increase their capabilities. In this view, the “control problem” is a tractable engineering challenge rather than a fight against a “galaxy brain in a box.”

As AI becomes more advanced, control will remain primarily in the hands of people and organizations. A greater proportion of human jobs will involve AI control, encompassing monitoring, auditing, and task specification. This transformation mirrors the Industrial Revolution’s shift from manual labor to the management of automated assembly lines. Market forces will likely drive this trend, as poorly controlled AI is too error-prone to be commercially viable, but regulation must bolster these forces when needed.

Risks associated with AI—including accidents, misuse, and systemic disruptions—are best addressed through downstream defenses. Model alignment doesn’t work—attempting to create a model that cannot be misused is akin to trying to build a computer that cannot be used for harmful purposes. Instead, defenses must focus on the attack surfaces where malicious actors actually deploy AI, such as strengthening cybersecurity infrastructure and biosecurity screening.

Policy implications: resilience over nonproliferation

Policymakers face the challenge of making decisions under deep uncertainty. We advocate for resilience as the overarching approach to catastrophic risks. Resilience consists of taking actions before harm occurs—such as improving technical capacity, ensuring transparency, and fostering open-source competition—to limit damage when shocks do occur.

Conversely, nonproliferation policies that seek to limit access to AI capabilities are likely to be counterproductive. Such measures are difficult to enforce, create dangerous single points of failure, and increase market concentration. Instead, policy should prioritize reducing uncertainty through evidence-seeking measures such monitoring AI failures in the wild. Finally, the normal technology frame suggests that realizing the benefits of AI is not automatic and cannot be left to the private sector alone. It will require experimentation, institutional reform, diffusion-enabling regulation, investing in the complements of automation, and strengthening social safety nets.

Presenting Author

• Arvind Narayanan, Princeton University

Discussant

• TBA

12:20 pm –
12:35 pm

AI and Doctrinal Collapse

Artificial intelligence runs on data. But the two legal regimes that govern data—information privacy law and copyright law—are under pressure. Formally, each regime demands different things. Functionally, the boundaries between them are blurring, and their distinct rules and logics are becoming illegible.

This Article identifies this phenomenon, which I call “inter-regime doctrinal collapse,” and exposes the individual and institutional consequences. Through analysis of pending litigation, discovery disputes, and licensing agreements, this Article exposes two dominant exploitation tactics enabled by collapse: Companies “buy” data through business-to-business deals that sidestep individual privacy interests, or “ask” users for broad consent through privacy policies and terms of service that leverage notice-and choice frameworks. Left unchecked, the data acquisition status quo favors established corporate players and impedes law’s ability to constrain the arbitrary exercise of private power.

Doctrinal collapse poses a fundamental challenge to the rule of law. When a leading AI developer can simultaneously argue that data is public enough to scrape—diffusing privacy and copyright controversies—and private enough to keep secret—avoiding disclosure or oversight of its training data—something has gone seriously awry with how law constrains power. To manage these costs and preserve space for salutary innovation, we need a law of collapse. This Article offers institutional responses, drawn from conflict of laws and legal pluralism, to create one.

Presenting Author

• Alicia Solow-Niederman, George Washington University Law School

Discussant

• TBA

12:35 pm –
12:50 pm

AI Agents and Memory: Privacy and Power in the Model Context Protocol (MCP) Era

This policy brief examines how AI agents — autonomous systems that use the Model Context Protocol (MCP) to connect across applications – will reshape the boundaries of privacy, security, and governance. By standardizing how AI systems access external tools and retain memory across sessions, MCP allows personal data, context, and identity to move fluidly across digital environments. This interoperability delivers powerful opportunities, but also undermines traditional privacy safeguards built around app-specific data silos. Frameworks such as COPPA, GDPR, and the FTC Act rely on principles of consent, purpose limitation, and minimization — assumptions that break down when agents autonomously share and retain information across multiple services.

This article argues that policymakers and privacy regulators must treat orchestration protocols like MCP as emerging data infrastructure and develop governance standards that ensure privacy resilience at the systems level. Key priorities include interoperable memory dashboards, scoped permissions, cryptographically signed audit trails, and strong portability and deletion rights to prevent user data from becoming locked within proprietary ecosystems. By updating privacy law and technical standards to address persistent, crosscontext memory, regulators can ensure that AI agents remain transparent, accountable, and aligned with user consent in a rapidly converging digital ecosystem.

Presenting Authors

• Prem Trivedi, Open Technology Institute (New America)
• Matt Steinberg, Knight-Georgetown Institute

Discussant

• TBA

12:50 pm –
1:05 pm

Beyond Algorithmic Disgorgement: Remedying Algorithmic Harms

AI regulations are popping up around the world, and they mostly involve ex-ante risk assessment and mitigating those risks. But even with careful risk assessment, harms inevitably occur. This leads to algorithmic remedies: what to do once algorithmic harms occur, especially when traditional remedies are ineffective. What makes a particular algorithmic remedy appropriate for a given algorithmic harm?

I explore this question through case study of a prominent algorithmic remedy: algorithmic disgorgement—destruction of models tainted by illegality. Since the FTC first used it in 2019, it has garnered significant attention, and other enforcers and litigants around the country and the world have started to invoke it. Alongside its increasing popularity came a significant expansion in scope. Initially, the FTC invoked it in cases where data was allegedly collected unlawfully and ordered deletion of models created using such data. The remedy’s scope has since expanded; regulators and litigants now invoke it against AI whose use, not creation, causes harm. It has become a remedy many turn to for all things algorithmic.

I examine this remedy with a critical eye, concluding that though it looms large, it is often inappropriate. Algorithmic disgorgement has evolved into two distinct remedies. Data-based algorithmic disgorgement seeks to remedy harms committed during a model’s creation; use-based algorithmic disgorgement seeks to remedy harms caused by a model’s use. These two remedies aim to vindicate different principles underlying traditional remedies: data-based algorithmic disgorgement follows the disgorgement principle underlying remedies like monetary disgorgement and the exclusionary rule, while use-based algorithmic disgorgement follows the consumer protection principle underlying remedies like product recall. However, they often fail to live up to the principles. AI systems exist in the context of the algorithmic supply chain; they are controlled by many hands, and seemingly unrelated entities are connected to each other in complicated ways through complex data flows. The realities of algorithmic supply chain means that algorithmic disgorgement is often a bad fit for the harm at issue and causes undesirable effects throughout the algorithmic supply chain, imposing burden on innocent parties while not imposing cost on the blameworthy; ultimately, algorithmic disgorgement undermines the principles it seeks to promote.

From this analysis, I derive considerations for determining whether an algorithmic remedy is appropriate—the responsiveness of the remedy to the harm and the full impact of the remedy throughout the supply chain—and underscore the need for a diversity of algorithmic remedies.

Presenting Author

• Christina Lee, George Washington University Law School

Discussant

• TBA

1:05 pm –
1:05 pm

CLOSING REMARKS

Justine Gluck, AI Policy Analyst, Future of Privacy Forum

12:00 pm –
12:05 pm

WELCOME REMARKS

Matthew Reisman, Vice President for U.S. Policy, Future of Privacy Forum

12:05 pm –
12:20 pm

Can Consumers Protect Themselves Against Privacy Dark Patterns? 

Dark patterns have emerged in the last few years as a major target of legislators and regulators. Dark patterns are online interfaces that manipulate, confuse, or trick consumers into purchasing goods or services that they do not want, or into surrendering personal information that they would prefer to keep private. As new laws and regulations to restrict dark patterns have emerged, skeptics have countered that motivated consumers can and will protect themselves against these manipulative interfaces, making government intervention unnecessary. !is debate occurs alongside active legislative and regulatory discussion about whether to prohibit dark patterns in newly enacted comprehensive consumer privacy laws. Our interdisciplinary paper provides experimental evidence showing that consumer self-help is unlikely to fix the dark patterns problem. Several common dark patterns (obstruction, interface interference, preselection, and confusion), which we integrated into the privacy settings for a video-streaming website, remain strikingly effective at manipulating consumers into surrendering private information even when consumers were charged with maximizing their privacy protections and understood that objective. We also provide the first published evidence of the independent potency of “nagging” dark patterns, which pester consumers into agreeing to an undesirable term. These findings strengthen the case for legislation and regulation to address dark patterns. Our paper also highlights the broad popularity of a feature of the recent California Consumer Privacy Act (CCPA), which gives consumers the ability to opt-out of the sale or sharing of their personal information with third parties. As long as consumers see the Do Not Sell option, a super-majority of them will exercise their rights, and a substantial minority will even overcome dark patterns in order to do so.

Presenting Author

• Matthew B. Kugler, Northwestern Pritzker School of Law

Discussant

• TBA

12:20 pm –
12:35 pm

How the Legal Basis for AI Training Is Framed in Data Protection Guidelines (Link Forthcoming)

• This paper investigates how the legal basis for AI training is framed within data protection guidelines and regulatory interventions, drawing on a comparative analysis of approaches taken by authorities across multiple jurisdictions.

• Focusing on the EU’s General Data Protection Regulation (GDPR) and analogous data protection frameworks globally, the study systematically maps guidance, statements, and actions to identify areas of convergence and divergence in the conceptualisation and operationalisation of lawful grounds for personal data processing—particularly legitimate interest and consent—in the context of AI model development.

• The analysis reveals a trend toward converging on the recognition of legitimate interest as the predominant legal basis for AI training. However, this convergence is largely superficial, as guidelines rarely resolve deeper procedural and substantive ambiguities, and enforcement interventions often default to minimal safeguards. This disconnect between regulatory rhetoric and practical compliance leaves significant gaps in protection and operational clarity for data controllers, calling into question the reliability and legitimacy of the existing framework for lawful AI training. It warns that, without clearer operational standards and more coherent cross-border enforcement, there is a risk that legal bases such as legitimate interest will serve as little more than formalities.

• Reflecting on these findings, the paper explores the prospects and limitations for achieving greater alignment or harmonisation at the global level. Specifically, it reflects on pathways for global AI governance, emphasising that the progress would benefit from distinguishing issues amendable to international convergence from those that require context-sensitive, locally adaptive solutions. It considers how regulators, practitioners, civil society activists, and scholars might leverage these insights to prioritise evidence-based avenues rather than seeking uniformity at conceptual level for its own sake, with the ultimate goal of advancing both principled and practical frameworks for lawful AI training across diverse legal landscapes.

Presenting Authors

• Wenlong Li, Zhejiang University
• Yueming Zhang, University of International Business and Economics

Discussant

• TBA

12:35 pm –
12:50 pm

De-Identification Guidelines for Structured Data (Information and Privacy Commissioner of Ontario)

(Abstract Forthcoming)

Presenting Authors

• Dr. Khaled El Emam, University of Ottawa
• Christopher Parsons, IPC of Ontario

Discussant

• TBA

12:50 pm –
12:55 pm

CLOSING REMARKS

Justine Gluck, AI Policy Analyst, Future of Privacy Forum