Page 16 – Future of Privacy Forum

Reflections on California’s Age-Appropriate Design Code in Advance of Oral Arguments

Co-authored with Isaiah Hinton, Policy Intern for the Youth and Education Team

Update: On Wednesday, July 17th, the U.S. 9th Circuit Court of Appeals heard oral arguments for an appeal of the District Court’s preliminary injunction of the California Age-Appropriate Design Code Act (AADC). Judges Milan Smith Jr., Mark Bennett, and Anthony Johnstone appeared interested in questions about severability and implications of the recent NetChoice/CCIA v. Moody decision on this case. The panel seemed skeptical of the State’s argument that the California AADC does not regulate content, particularly through the DPIA provisions concerning whether the design of a service could expose children to “harmful, or potentially harmful content” or lead to children “experiencing or being targeted by harmful, or potentially harmful, contacts.” While NetChoice conceded that they did not challenge four provisions, including those regarding geolocation information, NetChoice argued that the entirety of the law must be struck because the DPIA requirements are unconstitutional and interrelated to the rest of the law. However, it was noted that severability is a state issue, while the First Amendment’s constitutionality is a federal question and the idea of certifying the question to the California Supreme Court was raised.

The California AADC was the first of its kind in the U.S. and marked a significant development in youth privacy policy debates by mandating privacy by design and default for children under 18. Ahead of the oral arguments, this blog post provides an overview of how the California AADC’s enactment and subsequent constitutional challenge continue to impact the regulation of young people’s online experiences in the U.S.

The Enactment

California lawmakers modeled the AADC after the United Kingdom’s Age-Appropriate Design Code (UK AADC) and aimed to regulate the collection, processing, storage, and transfer of children’s data. The California law’s scope extended beyond the existing framework under the federal Children’s Online Privacy Protection Act (COPPA) by covering more online services and expanding protections to all individuals under 18. The California AADC included provisions from the UK AADC that were novel to U.S. law such as mandating the implementation of age estimation techniques if an online product, service, or feature was “likely to be accessed by children” and configuring default privacy settings to a “high level of privacy.” The California law was intended to address genuine privacy and safety risks faced by young people online and sparked renewed interest in seeking policy solutions, leading to an influx in state laws and enforcement actions. The law’s novel approach also raised concerns about not only the practicality of the law’s provisions but also their constitutionality.

Read our Analysis of The California Age-Appropriate Design Code and a Comparative Analysis of the California and UK Age-Appropriate Design Codes on our website.

The Timeline of Events:

The California AADC was introduced in the California Assembly as AB 2273 in February 2022, passed the legislature, and was signed by Governor Newsom in September 2022. The law’s intended enforcement date was July 1, 2024.
NetChoice, a trade association, filed a complaint in the U.S. District Court on December 14, 2022, alleging that the California AADC is unconstitutional, opening NetChoice v. Bonta.
NetChoice filed for a preliminary injunction in February 2023, which District Court Judge Beth Labson Freeman granted in September of that same year.
The following month, October 2023, California Attorney General Rob Bonta filed to appeal the preliminary injunction with the U.S. Court of Appeals.

The Enjoinment

The United States District Court for the Northern District of California issued a preliminary injunction, preventing enforcement of the California AADC pending a ruling on the case’s merits based on the Court’s view that NetChoice is likely to succeed on its claim that the law violates the First Amendment. In granting the injunction, the Court considered NetChoice’s allegation that most of the California AADC is an unlawful prior restraint on protected speech. The Court was concerned by many of the law’s provisions and assessed concerns with:

Provisions that required estimating user age; conducting data protection impact assessments (DPIA); configuring high default privacy settings; using age-appropriate language for policies and privacy information; enforcing published terms, policies, and community standards; and restricting the collecting, selling, sharing, and retaining of children’s personal information.
Provisions that prohibited using children’s personal information in a knowingly harmful way; profiling children by default; using a child’s personal information for any reason other than for which it was collected; and using “dark patterns” to encourage children to provide excessive personal information or to forgo privacy protections.

The Court acknowledged that the State has a substantial interest in protecting minors, but found that NetChoice would likely succeed on claims that the law is unconstitutionally vague and that California struggled to satisfy the other aspects of intermediate scrutiny.

Three Main Takeaways:

The California AADC Highlighted Existing Discussions About How to Protect Youth Privacy and Safety and Has Been Influential in Other States.

Most experts agree that there are concerns about young people’s privacy and safety online, but there are uncertainties about who should address these concerns and how. There is growing interest from policymakers in new regulation that provides privacy and safety protections for minors beyond COPPA’s parental consent framework and for minors over the age of 12. Even in states that did not copy it exactly, concepts from it have appeared in other state laws. This increasingly diverse patchwork of state laws complicates compliance. Some examples of concepts from the California AADC that appear in other state bills include:

Knowledge Standards: State legislation has gone beyond COPPA’s “directed to children” or “actual knowledge” standard. Recent U.S. laws include novel language such as “likely to be accessed by a child” that may be vague and difficult to interpret.
Age Appropriateness: Legislators continue to draft provisions modeled from the AADC that require “age-appropriate” standards, ask businesses to consider the “best interest of the children,” or evaluate whether features may be “harmful” to young people. However, these terms are largely undefined in the U.S. and without additional research and guidance, pose a significant barrier to understanding how to interpret these online protections.
Age Assurance Technologies: Legislators have proposed the need for using technology to either infer or verify a user’s age before allowing them to use certain services, including in some states social media or adult content.

You can read more about the knowledge standards of currently enacted laws in our blog and accompanying resource. You can also read about using a risk-based approach that balances privacy and equity in our age assurance infographic and accompanying blog.

The California AADC’s Enactment, and Its Enjoinment, Influenced Subsequent Regulation.

Several states followed California’s lead by introducing copycats or variants of the AADC, and one even became law. The Maryland legislature made an effort to remove the vulnerabilities of California’s AADC when writing their version and also passed a comprehensive privacy law during the same legislative session. See FPF’s blog on the Maryland AADC, our chart comparing it to the California AADC, and our blog on Maryland’s Online Data Privacy Act.

The District Court’s finding that the California AADC provisions are likely to be unconstitutional may have caused some legislators to hesitate to propose AADC-style bills or to diverge in ways that would address some of the litigation’s concerns. Here are two examples of laws that diverged from the AADC style.

Connecticut Data Privacy Act (CTDPA) – Read FPF’s blog about the law and our chart comparing it to the California AADC.
Florida Digital Bill of Rights (SB 262) – Read FPF’s blog about the law and chart comparing it to the California AADC.

Despite these proactive changes by state legislatures, the implications of a final constitutionality ruling are unclear. NetChoice v. Bonta raises questions about the constitutionality of laws with similar provisions. Even laws beyond youth privacy contain provisions like purpose limitations, dark pattern prohibitions, or age assurance requirements. If the District Court’s ruling stands, future legislation will need to be more narrowly tailored to specific harms and aims of the law.

The California AADC is now one of Several Youth Privacy and Safety Laws Facing Constitutional Challenges.

The outcomes of these cases will impact how youth privacy legislation is written, implemented, and enforced. The constitutional challenges to the California AADC address common youth privacy provisions such as data use and minimization, transparency, DPIAs, age assurance, and parental consent. Some of the laws at issue would effectively ban people under the age of 18 from using certain online services, while others could effectively require the age estimation of all users. While youth privacy and safety legislation proliferated in the states following the California AADC, many of those enacted have been constitutionally challenged. See FPF’s Overview of Contested Youth Privacy & Safety Provisions in Pending State Law Litigation.

Since the UK and California AADCs’ enactments, conversations have been happening around the world on how to best protect youth privacy and safety online through regulation. These efforts, like youth provisions in India’s DPDPA, are not subject to the same First Amendment concerns raised by NetChoice, and these laws are moving forward without facing the same challenges in court. These court decisions could greatly impact how kids and teens use the internet in the U.S. and may lead to a completely different online experience for children in America than those abroad.

Conclusion

The passing of California’s Age-Appropriate Design Code was a catalyst for conversations in America around protecting kids and teens online. As more states introduce and adopt youth privacy and safety laws, legislators and companies will continue to look to existing regulations for guidance on drafting and complying with new laws. The oral arguments in NetChoice v. Bonta will provide insight into what youth privacy and safety provisions are most constitutionally problematic for legislation and regulation and will help shape future youth privacy and safety policymaking.

Additional FPF Resources

For more on recent federal enforcement actions, read FPF’s blog, Top Six Major Privacy Enforcement Trends: A U.S. Legislation Retrospective, and our policy brief, Youth Privacy in Immersive Technologies: Regulatory Guidance, Lessons Learned, and Remaining Uncertainties.
Read our comments to the National Telecommunications and Information Administration (NTIA) in response to their request for comment on Kids Online Health and Safety.
Our report, The State of Play: Is Verifiable Parental Consent Fit for Purpose?, and infographic detail the effectiveness of the verifiable parental consent requirement under COPPA.

NEW FPF REPORT: Confidential Computing and Privacy: Policy Implications of Trusted Execution Environments

Written by Judy Wang, FPF Communications Intern

Today, the Future of Privacy Forum (FPF) published a paper on confidential computing, a privacy-enhancing technology (PET) that marks a significant shift in the trustworthiness and verifiability of data processing for the use cases it supports, including training and use of AI models.

Confidential computing leverages two key technologies: trusted execution environments and attestation services. The technology allows organizations to restrict access to personal information, intellectual property, or sensitive or high-risk data through a secure hardware-based enclave or “trusted execution environment” (TEE). Economic sectors that have led the way in adopting confidential computing include financial services, healthcare, and advertising. As manufacturers continue to develop confidential computing technologies, policymakers and practitioners should consider a range of data protection implications discussed in the paper.

The paper, titled “Confidential Computing And Privacy: Policy Implications Of Trusted Execution Environments,” expands upon the following categories:

What is Confidential Computing?
Emerging Sector Applications
Policy Considerations

In Policy Considerations, the paper explores some of the novel implications of this technology for data protection policy, including how it may impact issues like transparency, legal questions related to “de-identification,” “sale,” and “sharing” of data, cross-border data transfers, and data localization. Ultimately, the usefulness, scale of impact, and regulatory compliance benefits of confidential computing depend on the specific configuration and management of the TEE and attestation service.

Download the paper here for a more detailed discussion of confidential computing and how it differs from other PETs, as well as an in-depth analysis of its sectoral applications and policy considerations.

Interested in learning more about PETs? Read about FPF’s recently launched PETs Research Coordination Network (RCN), supported by grants from the U.S. National Science Foundation (NSF) and U.S. Department of Energy (DoE). This project will analyze and promote the trustworthy adoption of PETs in the context of artificial intelligence (AI) and other technologies, directed by the Biden-Harris Administration’s Executive Order on AI.

FPF will also participate in the PETs Summit during Personal Data Protection Commission Singapore’s (PDPC) Personal Data Protection Week, during which the new report will be distributed. FPF’s Vice President for Artificial Intelligence and head of FPF’s Center for AI, Anne J. Flanagan, will be speaking on the panel “Architecting real world new products and solutions with PETs.” Managing Director for FPF Asia-Pacific Josh Lee Kok Thong will be chairing the roundtable “Unleashing The Data Economy: Identifying Challenges, Building Use Cases & How PETs Help Address Generative AI Concerns.” Learn more about the events and FPF’s involvement at the PDPC PETs Summit here.

A First for AI: A Close Look at The Colorado AI Act

Colorado made history on May 17, 2024 when Governor Polis signed into law the Colorado Artificial Intelligence Act (“CAIA”), the first law in the United States to comprehensively regulate the development and deployment of high-risk artificial intelligence (“AI”) systems. The law will come into effect on February 1, 2026, preceding the March, 2026 effective date of (most of) the European Union’s AI Act.

To help inform public understanding of the law, the Future of Privacy Forum released a Policy Brief summarizing and analyzing key CAIA elements, as well as identifying significant observations about the law.

In the Brief, FPF provides the following analysis and observations:

1. Broader Potential Scope of Regulated Entities: Unlike state data privacy laws, which typically apply to covered entities that meet certain thresholds, the CAIA applies to any person or entity that is a developer or deployer of a high-risk AI system. A high-risk AI system, under the Act, refers to AI systems that make or are a substantial factor in making consequential decisions, including any legal or material decision affecting an individual’s access to critical life opportunities such as education, employment, insurance, healthcare, and more. Additionally, one section of the law applies to any entity offering or deploying any consumer-facing AI system. Therefore, despite a detailed list of exclusions, including a narrow exemption for small deployers, the law has broad applicability to a variety of businesses and sectors in Colorado.

2. Role-Specific Obligations: The CAIA apportions role-specific obligations for deployers and developers, akin to controllers and processors under data privacy regimes. Deployers, who directly interact with consumers and control how the AI system is utilized, take on more responsibilities than developers, including the following:

Maintaining a Risk Management Policy & Program that governs their deployment of high-risk AI systems. It must be updated and reviewed regularly, specify the principles, processes, and personnel used to identify and mitigate algorithmic discrimination, and “be reasonable” in comparison to recognized frameworks such as the NIST Artificial Intelligence Risk Management Framework (NIST AI RMF).
Conduct Impact Assessments annually, which must include the system’s purpose and intended use cases, any known or reasonably foreseeable risks of algorithmic discrimination, risk mitigation steps taken, categories of data processed for system use, the system’s performance metrics, transparency measures, and a description of post-deployment monitoring.
Notifying Subjects about the use of high-risk AI systems, disclosing information about the system’s purpose and the data used to make decisions, and providing the relevant consumer rights (detailed below).
Publicly Disclosing on their websites the types of high-risk AI systems currently deployed, and how known or reasonably foreseeable risks of algorithmic discrimination are being managed.

Developers are primarily tasked with providing documentation to help deployers fulfill their duties. This includes high-level summaries of training data types, system limitations, purposes, performance evaluations, and risk mitigation measures for algorithmic discrimination. Additionally, developers must publicly disclose on their websites summaries of high-risk AI systems sold or shared and detail how they manage risks of algorithmic discrimination.

Both developers and deployers must notify the Attorney General of any discovered instances of algorithmic discrimination.

3. Duty of Care to Mitigate Algorithmic Discrimination: Developers and deployers are also subject to a duty to use “reasonable care” to protect consumers from “any known or reasonably foreseeable risks of algorithmic discrimination from use of the high-risk AI system.” In the Brief, FPF notes that the CAIA’s algorithmic discrimination provisions appear to cover both intentional discrimination and disparate impact. Developers and deployers maintain a rebuttable presumption of using reasonable care under this provision if they satisfy their role-specific obligations. In comparison with a blanket prohibition against algorithmic discrimination, as seen in other legislative proposals, the duty of care approach likely means that enforcers of the CAIA will assess developer and deployer actions using a proportionality test considering factors, circumstances, and industry standards, to determine whether they exercised reasonable care to prevent algorithmic discrimination.

4. Novel Consumer Rights: Like many proposals to regulate AI, the CAIA provides consumers rights to be notified about the use of high-risk AI systems used to make decisions about them and receive a statement that discloses the purpose of the system and nature of its consequential decision. Because Colorado consumers already maintain data privacy rights under their state privacy law, deployers must also inform consumers of their right to opt-out of profiling in furtherance of solely automated decisions under the Colorado Privacy Act.

The CAIA also creates novel consumer rights where a deployer used a high-risk AI system to reach a consequential decision that is adverse to an individual. In those scenarios, the deployer must provide the individual with an explanation of the reasons for the decision, an opportunity to correct any inaccurate personal data the system processed for the decision, and an opportunity to appeal the decision for human review. However, deployers may not be required to provide the right to appeal if it is not technically feasible or it is not in the best interest of the individual, such as where delay would threaten an individual’s health or safety.

5. Attorney General Authority: Though the CAIA does not create a private right of action, it grants the Colorado Attorney General significant authority to enforce the law and implement necessary regulations. If an enforcement action is brought by the Attorney General, a developer, deployer, or other person may assert an affirmative defense based on their compliance with the NIST AI RMF, another recognized national or international risk management framework, or any other risk management framework designated by the Attorney General. The Attorney General also has permissive rulemaking authority in a variety of other areas, such as documentation and requirements, requirements for developer and deployer notices and disclosures, and the content and requirements of the deployer’s impact assessments.

Lastly, though the enactment of the CAIA was informed by extensive stakeholder engagement efforts led by Colorado Senate Majority Leader Rodriguez and Connecticut Senator Maroney, FPF raises several questions and considerations about the implementation and enforcement of the CAIA in the Policy Brief, such as:

Metrics: Because the CAIA does not mandate the use of particular metrics to identify and measure algorithmic discrimination, developers and deployers will have flexibility to choose how to measure and test for bias. Are there metrics or testing that may be considered unreasonable or not pass muster?
Technical Feasibility: When would it not be “technically feasible” to provide a consumer a right to appeal an adverse decision? Are considerations of burden or lack of resources appropriate considerations? Is there or should there be a consumer right for when a deployer inappropriately denies a consumer’s right to appeal?
Enforcement: How will the law interact with existing civil rights statutes? Although CAIA does not include a private right of action, can an individual use information disclosed under this law as a basis to exercise their existing civil rights? Conversely, if an action is brought against an entity for algorithmic discrimination under existing civil rights law, could the defendant utilize information or standards compliance under the CAIA as a defense?

If the state legislature’s AI taskforce or the Attorney General does not address these questions in the next session, many of these issues may only be resolved through litigation.

Nonetheless, given concerns raised by the Governor, we may expect to see changes to the law that could alter the scope, substance, and allocation of responsibility. For now, though, the CAIA stands as it is currently written, and remains the first-in-the-nation law to regulate the AI industry, protect consumers, and mitigate the risks of algorithmic discrimination. FPF will continue to closely monitor updates and developments as they progress.

This blog post is for informational purposes only and should not be used or construed as legal advice.

FPF Launches Effort to Advance Privacy-Enhancing Technologies, Convenes Experts, and Meets With White House

FPF’s Research Coordination Network will support developing and deploying Privacy-Enhancing Technologies (PETs) for socially beneficial data sharing and analytics.

JULY 9, 2024 — Today, the Future of Privacy Forum (FPF) is launching the Privacy-Enhancing Technologies (PETs) Research Coordination Network (RCN) with a virtual convening of diverse experts alongside a high-level, in-person workshop with key stakeholders at the White House Eisenhower Executive Office Building. Supported by grants from the U.S. Department of Energy (DoE) and U.S. National Science Foundation (NSF), the project will analyze and promote the trustworthy adoption of PETs in the context of artificial intelligence (AI) and other key technologies.

FPF’s RCN will bring together a multi-stakeholder community of academic researchers, industry practitioners, policymakers, and others to identify key barriers to responsible use of PETs and opportunities for PETs to enable ethical data use and sharing. Some PETs offer new anonymization tools, while others enable collaborative analysis on privately-held datasets, allowing the use of data without the need to share or disclose the data itself. Given the wide range of use cases and applications for PETs, particularly in the field of AI, the RCN will hold regular meetings to promote ethical data use, encourage responsible scientific research and innovation, and ensure that individuals and society can benefit from data sharing and analytics. The RCN will also engage with FPF’s Global PETs Network in an effort to increase regulatory clarity regarding PETs.

Today’s virtual meeting will gather subject-matter experts to focus on the broad definitions of PETs, their risks and benefits, and policy work that could unlock their use in more contexts. Following the meeting, prominent researchers and industry leaders will join a Roundtable discussion with executive branch officials in the White House to discuss the intersection of PETs, AI, and data privacy.

“Today’s event officially kicks off FPF’s three-year project,” said John Verdi, FPF’s Senior Vice President for Policy, who serves as the project’s principal investigator. “We are thrilled to play an important role in this concerted effort to advance regulatory clarity regarding PETs, AI, and emerging technologies. The diversity of perspectives in the PETs Research Coordination Network will be key to its success in developing best practices and policy recommendations.”

Steering Committee Members include FPF CEO Jules Polonetsky and Senior Fellow Marjory Blumenthal, Caroline Louveaux from MasterCard, Margaret Hu from William and Mary Law School, Khaled El Emam from the University of Ottawa, and Annie Anton from Georgia Tech.

Learn more here.

In addition to the main expert group, FPF will convene a regulator sub-group focused specifically on legal and regulatory mechanisms supporting the development and use of PETs. More information is available here.

The Research Coordination Network (RCN) for Privacy-Preserving Data Sharing and Analytics is supported by the U.S. National Science Foundation under Award #2413978 and the U.S. Department of Energy, Office of Science under Award #DE-SC0024884.

###

About the Future of Privacy Forum (FPF)

The Future of Privacy Forum (FPF) is a global non-profit organization that brings together academics, civil society, government officials, and industry to evaluate the societal, policy, and legal implications of data use, identify the risks, and develop appropriate protections.

FPF believes technology and data can benefit society and improve lives if the right laws, policies, and rules are in place. FPF has offices in Washington D.C., Brussels, Singapore, and Tel Aviv. Learn more at fpf.org.

We’re in this Together: Expert Speakers Explore Topics Related to Protecting Privacy, Security, and Online Safety for Young People in Australia

On June 26, the Future of Privacy Forum (FPF) and the Australian Strategic Policy Institute (ASPI) co-hosted an online discussion on Privacy, Security, and Online Safety for Young People in Australia. The panel included welcoming remarks from John Verdi, FPF, and Bart Hogeveen, ASPI, and consisted of experts across all three disciplines, including:

Mike Bareja, Deputy Director of Cyber, Technology & Security, ASPI (moderator)
Peter Leonard, Principal and Director, Data Synergies
Lizzie O’Shea, Founder and Chair, Digital Rights Watch
Amber Hawkes, Principal, Online Safety & Digital Literacy, Pearl Consulting
Dr. Susanne Lloyd-Jones, Cyber Security CRC Post Doctoral Fellow at the UNSW Allens Hub for Technology, Law and Innovation
Hayden Wells – Detective Acting Superintendent, Australian Centre to Counter Child Exploitation (ACCCE)

The discussion came just days after Australia’s eSafety Commissioner published the final pending industry standards to govern the treatment of Child Sexual Exploitation Material (CSEM) as well as pro-terror material, crime and violence material, and drug-related material (collectively, “class 1A” and “class 1B” material). These final standards address Designated Internet Services and Relevant Electronic Services, joining six other codes covering other categories of services.

In October 2023, prior to the publication of the draft industry standards, FPF hosted a roundtable conversation with expert contributors from across Australia to explore potential benefits and risks that may arise with different approaches. The final Outcomes Report from that event highlighted key takeaways relevant to regulations in this area. The Office of the eSafety Commissioner will now look to industry codes for “class 1C” and “class 2” material, to cover online pornography and “other high-impact material.”

The Australian Parliament is also currently considering updates to the Privacy Act to govern how personal information may be processed. The updates, which are expected later this year, are likely to include proposed additional protections to apply only to children (defined as those who are under 18).

Speakers at the June 26 event engaged in an educational and far-ranging conversation that raised several important topics and themes. While the panelists discussed the need to ensure that any action in this area was appropriate to Australia’s unique culture and needs, many also recognized that the approaches being implemented in Australia are serving as the basis for countries around the world – including countries with fewer protections for individual rights.

Several speakers spoke to the importance of having inclusive conversations that break down the silos around related regulatory topics. As was noted, government and industry responses to questions around safety, security, and privacy often overlap and generally would benefit from greater collaboration, both in places where the proposed response to one interest may contravene another as well as in places where action taken in one area may compliment or benefit the work being done in another.

Many speakers referenced on-going discussions on encryption (i.e., technology applied to protect transactions from unwanted or unintended recipients) and indicated that it went to the heart of these three topics. While encryption, and specifically end-to-end encryption, may, in some cases, make obtaining specific content more difficult for investigators, it also is widely considered one of the most important methods for protecting communications and interactions in the digital world, providing increased privacy, security, and safety. In addition to encryption, speakers also discussed the impact that emerging technologies were having across each of these areas, from quantum cryptography and generative artificial intelligence, to immersive and “embodied” technologies, all of which may drive both significant benefits and risks for young people and may require nuanced, comprehensive responses.

Other topics emphasized the importance of providing tailored education and resources to everyone involved in responding to material that may create risks for young people, such as regulators, investigators, and civil society organizations as well as parents and children themselves. Speakers explained that resources must meet people, particularly young people, where they are. Regarding banning young people from social media, many speakers described how such action may be more likely to cause harm than provide benefit. They emphasized that young people need to build the necessary skills and resilience that are needed to interact in those spaces, and a ban would inhibit the ability to develop important skills. Speakers also discussed the critical importance of transparency and accountability, both for regulators and for industry.

You can watch the full discussion on FPF’s YouTube page. Please visit FPF’s website for more information on the work FPF is doing on children’s privacy and cybersecurity. FPF will be hosting additional in-person events drilling down into different topics in this space later this year in major Australian cities. These events will be open to the public – stay tuned for more information and subscribe to our newsletter to receive updates about the events, and stay informed about FPF APAC news and updates.

Chevron Decision Will Impact Privacy and AI Regulations

The Supreme Court has issued a 6-3 decision in two long-awaited cases – Loper Bright Enterprises v. Raimondo and Relentless, Inc. v. Department of Commerce – overturning the legal doctrine of “Chevron deference.” While the decision will impact a wide range of federal rules, it is particularly salient for ongoing privacy, data protection, and artificial intelligence regulations across the federal government.

As a resource, today, Future of Privacy Forum also releases for the public an Issue Brief: The Role of Chevron Deference in Federal Privacy Regulation (read it here). In this Issue Brief, we highlight the current role that agency deference plays in data protection, privacy, and AI-related efforts across the federal government. These include major ongoing efforts such as the FTC’s Commercial Surveillance and Data Security Rulemaking, updates to the Child Online Privacy Protection Act (COPPA), and inter-agency efforts to prevent the use of discriminatory automated systems in the housing market and workplace.

For the last forty years, the Chevron doctrine (Chevron v. NRDC) has provided an analytical framework for courts to use when examining agency interpretations of ambiguous or deferential statutes. In situations where a statute is ambiguous or provides direction for further agency interpretation, courts have deferred to federal agency expertise. This analytical framework is now overruled. The majority opinion calls the doctrine “fundamentally misguided” and “unworkable,” emphasizing the separation of powers and the unique role of judicial review. Specifically, the decision held that the doctrine is incongruous with Article III of the U.S. Constitution, which delegates statutory interpretation to courts, as well as with the Administrative Procedure Act (APA), which governs administrative processes and specifies that courts must decide “all relevant questions of law.”

In contrast, courts will now be expected to exercise independent legal judgment, even when the statutes are ambiguous or silent on an issue, without deferring to the agency’s interpretation in place of their own. Courts can still respect and be informed by agency expertise (a lower standard known as Skidmore deference).

In privacy and AI, fields in which technology and business practices are evolving rapidly, this decision is especially important. Statutes must contain enough flexibility to remain effective over time, and inevitable ambiguities are likely to arise. Notably, several Justices brought up AI during oral arguments, with Justice Kagan noting that AI was likely to be “the next big piece of legislation on the horizon,” and that “Congress can hardly see a week in the future with respect to this subject, let alone a year or a decade.” The dissenting opinion expresses these same reservations about long-term workability, emphasizing highly technical and expertise-driven statutory questions that occur and the potential that courts will be ill-equipped to address them (“A rule of judicial humility gives way to a rule of judicial hubris.”). Furthermore, as Congress grapples with passing a comprehensive privacy law, the decision adds a new challenge of ensuring flexible, future-proof language that simultaneously contains enough specificity to avoid as many ambiguities as possible – sure to be a unique challenge for technology regulation in years to come.

AI Forward: FPF’s Annual DC Privacy Forum Explores Intersection of Privacy and AI

The Future of Privacy Forum (FPF) hosted its inaugural DC Privacy Forum: AI Forward on Wednesday, June 5th. Industry experts, policymakers, civil society, and academics explored the intersection of data, privacy, and AI. In Washington, DC’s southwest Waterfront at the InterContinental, participants joined in person for a full-day program consisting of keynote panels, AI talks, and debates moderated and led by FPF experts.

AI and FPF Experts Take the Stage

Keynote Panels and AI Talks

FPF CEO Jules Polonetsky kicked off the day with welcoming remarks and announced the launch of FPF’s new Center for Artificial Intelligence, which is headed by Anne J. Flanagan, FPF’s VP for AI, and focuses on AI policy and governance. The Center is supported by a Leadership Council of experts from around the globe, consisting of members from industry, academia, civil society, and current and former policymakers.

FPF Board Chair Alan Raul joined the stage to give opening remarks and introduce keynote speaker, Adam Russell, AI Safety Institute Chief Vision Officer from NIST. Adam Russell presented an overview of how, why, and what the US AI Safety Institute aims to achieve in AI safety and to help build collective intelligence.

FPF’s Director of Youth and Education, David Sallay, kicked off the first AI Talk Session along with Colleen McClain, Research Associate from the PEW Research Center. Sallay discussed the recent FPF report, “Vetting Generative AI Tools for Use in Schools,” which offers a checklist designed specifically for K -12 schools, outlining key considerations when incorporating generative AI into a school or district’s edtech vetting checklist.

McClain presented a new PEW survey analysis on youth and AI that included thought-provoking views and experiences of teenagers aged 13-17 and their parents, as well as the views of K-12 teachers in the U.S. One key insight revealed that U.S. adults view privacy as a main concern when it comes to trusting–or not trusting–use of AI.

FPF’s Anne J. Flanagan moderated a keynote panel, “Risk Assessments: Up to the Task?” with Ed Britan, Senior Vice President, Global Privacy & Marketing Legal, Salesforce; Barbara Cosgrove, Vice President and Chief Privacy Officer, Workday; and Katherine Fick, Associate General Counsel, IBM. These leading privacy experts explored how companies can evaluate risk factors when it comes to developing or deploying AI. This included what can be learned from previous privacy risk assessments, advice for those daunted by regulations and standards, guidance for those who are new to AI governance, and what makes these AI assessments different from those that have come before.

Shifting into the afternoon, FPF Board Member Agnes Bundy Scanlan moderated the second AI Talk, “Is Algorithmic Fairness Even Possible?” with Professor of Computer Science at Princeton University, Arvind Narayanan. During his presentation, Prof. Narayanan argued that algorithmic fairness has not been particularly impactful, arguing that most AI products do not succeed, that broken AI perpetuates broken institutions, and added that fixing algorithms will not solve systematic problems in our society. He also gave recommendations for policymakers and regulators, such as establishing standards for efficacy and managing explanation and contestability.

Next, FPF’s Policy Council for Data, Mobility, and Location, Adonne Washington, led the panel, “AI & The Future of Work,” featuring Keith Sonderling, Commissioner, U.S. Equal Employment Opportunity Commission (EEOC), and Lael Bellamy, Partner at DLA Piper, on concerns of bias and discrimination, as well as the potential of AI-driven tools for fostering inclusive workplaces. Commissioner Sonderling argued that AI tech can help us make better and more transparent employment decisions; however, he stressed that AI must be used properly. Bellamy added that AI tools could reinforce society’s legacy of bias referencing tools like ChatGPT and how it formulates its information from public data like Reddit and Wikipedia, regurgitating skewed knowledge.

Global Convergence and Hyperlocal Regulation

FPF’s Tatiana Rice moderated “AI Legislation: States to the Rescue?” with Del. Michelle Maldonado, D-VA, 2024 Virginia House of Delegates Communications, Technology, and Innovation Committee, and Senator Robert Rodriguez, Majority Leader, Colorado General Assembly, where both discussed the importance of recent privacy laws that were passed in their respective states. “Technology moves at the speed of light, and legislation moves at the speed of molasses,” stated Del. Maldonado on AI governance. Senator Rodriguez discussed the Colorado AI Act (CAIA) and how looking at previous legislation, such as the Colorado Privacy Act (CPA), was a helpful component in writing new privacy bills.

FPF’s Senior Counsel for Global Privacy, Lee Matheson, then moderated “Global Convergence or Competition for Regulatory Leadership” with Anupam Chander, Scott K. Ginsburg Professor of Law and Technology, Georgetown University Law Center. Prof. Chander outlined the main areas of convergence on AI regulation globally.

FPF AI Debates

In one of the most energetic parts of the day, FPF’s Director for U.S. Legislation, Keir Lamont, kicked off the AI Debates, moderating the first session, “Resolved: Data minimization is compatible with the development of artificial intelligence,” featuring Omer Tene, Partner, Goodwin Procter LLP opposing the position and Samir Jain, Vice President of Policy, CDT, arguing in favor of the position.

Tene argued that data minimization is antithetical to the development of AI. The essence of AI is the ability to discover new trends and correlations, Tene argued, and by its definition, minimizing data is limiting AI’s intelligence. Jain disagreed, explaining that more data is not necessarily better, nor is it necessary for the development of AI. He added that AI can derive from data, and certain sites are not necessarily reliable outputs. Audience members were given the opportunity to vote on which position they agreed with. In the end, it was 50% opposed and 50% in favor, with Jain swaying more attendees to his side of the argument.

This was then followed by the second debate, “Resolved: APRA Strikes the Right Balance For the Future,” featuring Jennifer Huddleston, Senior Fellow in Technology Policy, Cato Institute, on the opposed position and Cameron Kerry, Ann R. and Andrew H. Tisch Distinguished Visiting Fellow, Brookings Institute, with the in-favor position.

Huddleston expressed concerns with the American Privacy Rights Act (APRA) provisions, ranging from how data minimization can cause problems regarding AI to consequences for the next generation of innovators; she also questioned whether APRA would improve underlying situations for consumers. Kerry argued that it is long past the time to establish comprehensive privacy regulation and that APRA is an opportunity to address gaping holes in the current system, further noting that APRA would put in place civil rights protections, baseline protections for algorithms, and more. In this second AI debate, the audience once again ended in a vote of 50% opposed and 50% in favor.

Keynote Fireside Chat

In the late afternoon, FPF’s Senior Director for U.S. Policy, Stacey Gray, sat down in a fireside chat with Samuel Levine, Director of the Federal Trade Commission’s Bureau of Consumer Protection, who discussed how the Commission is prepared to hold companies accountable when it comes to protecting consumers’ individual data, including deterring AI from impersonation as well as aiming to understand how AI can be used to disguise advertising. “Trust is the foundation of any market economy,” Levine explained. Further, it is critical for the government to do better and collaborate with those in the industry when it comes to keeping consumers safe.

FPF Workstream Lightning Talks

To close out the day, FPF featured four Lightning Talks on the intersection of AI with various emerging technologies and/or regulations.

On AI and XR, FPF’s Senior Policy Analyst for Immersive Technologies, Jameson Spivack, delved into two parallel trends in neutral technology development: 1) AI is being integrated into new products, and 2) AI technologies are becoming more immersive. Spivack noted that if the further integration of XR is not done responsibly, then applications of immersive technology can raise substantial risks.

On AI and Cybersecurity, FPF’s Senior Technologist for Youth & Education Privacy, Jim Siegl talked about cybersecurity as one of the foundations of AI trust and how AI can be subject to novel security vulnerabilities alongside standard ones. He focused on confidentiality, integrity, and availability, with potential confidentiality risks including generative AI-enhancing phishing or malware development. AI tools can raise the prospect of attackers manipulating the behavior of Large Language Models (LLMs) both directly and indirectly, and each of these risks can be reduced but not eliminated, he continued.

Regarding Generative AI in the Asia Pacific region, FPF’s APAC Managing Director, Josh Lee, explained why the APAC sector is an emerging leader in AI regulation. Lee highlighted how AI is transnational and that the region widely uses AI tools, with most companies having a presence in the area. He noted how the APAC region is becoming a major international thought leader with respect to AI technology and AI governance. He highlighted the recent FPF report that provides a comprehensive overview of how generative AI systems work and key governance frameworks across five specific jurisdictions: Australia, China, Japan, Singapore, and South Korea.

Moving over to the EU, FPF’s Policy Counsel for Global Privacy Christina Michelakaki offered insights on initiatives coming from EU Data Protection Authorities (DPAs) and the UK Information Commissioner’s Office (ICO) concerning the processing of personal data in the context of an AI application. She noted that while the GDPR does not explicitly mention AI, it is a technologically neutral law, and it applies to any technology that involves the use of personal data, such as for training, testing, or deployment of an AI system. Therefore, when personal data is used, all the GDPR’s principles apply; the ones of fairness, transparency, and accountability are of particular relevance.

Evening Awards and 15th Anniversary Dinner Reception

After a full and engaging day of AI policy talks, debates, and discussions, FPF ended the First DC Privacy Forum: AI Forward by presenting Christopher Wolf, FPF Founder and Founding Board President, with the Legacy of Excellence Award for his 15 years of impactful tenure. FPF’s Board Chair, Alan Raul, FPF Board Member Dale Skivington, and FPF CEO, Jules Polonetsky, presented Wolf with the award.

A big thank you to all of those who participated in our inaugural DC Privacy Forum: AI Forward! We hope to see you next year. For updates on FPF work, please visit FPF.org for all our reports, publications, and infographics, follow us on Twitter/X and LinkedIn, and subscribe to our newsletter for the latest.

Comprehensive Privacy Anchors in the Ocean State

On June 25, 2024, Governor McKee transmitted without signature H 7787 and S 2500, the Rhode Island Data Transparency and Privacy Protection Act (RIDTPPA), making Rhode Island the nineteenth state overall and the seventh state in 2024 to enact a comprehensive privacy law. The law will take effect on January 1, 2026, and the majority of its substantive provisions will apply to entities that control or process personal data of either 35,000+ Rhode Islanders or 10,000+ Rhode Islanders if the entity derives 20% or more of its gross revenue from selling personal data. As another iteration of the Washington Privacy Act (WPA) framework, this law includes familiar terminology and core obligations, such as: controller/processor responsibilities allocated by role; the core individual data rights of access, correction, deletion, portability, and opt-out; and opt-in consent for processing sensitive data.

In this blog post, we highlight 3 notable aspects of the RIDTPPA: The law includes a unique, prescriptive privacy notice requirement that applies to a different set of entities than many of its other substantive provisions; in key places, the law is weaker than many other iterations of the WPA framework; and the law’s civil penalties are higher than what is typical under comparable laws.

1. No General Privacy Notice Requirement, but Prescriptive Notice of “Information Sharing Practices” Obligation for a Narrow Set of Businesses

The RIDTPPA includes a unique, prescriptive privacy notice obligation, which has two subcomponents. First, any “commercial website” or internet service provider (ISP) who (1) conducts business in Rhode Island, (2) has customers in Rhode Island, or (3) is otherwise subject to Rhode Island jurisdiction must “designate a controller.” The law does not define or cross-reference existing definitions of “commercial website” or “internet service provider.” The law defines controller as “an individual who, or legal entity that, alone or jointly with others determines the purpose and means of processing personal data.” Although this definition is typical of state comprehensive privacy laws, the law does not elaborate on what it means to “designate a controller.”

Second, the designated controller of a website or ISP that “collects, stores and sells customers’ personally identifiable information” (PII) must disclose certain information within either the controller’s customer agreement, an addendum to that agreement, or “in another conspicuous location on its website or online service platform.” The controller must provide:

“all categories of personal data that the controller collects through the website or online service about customers”;
“all third parties to whom the controller has sold or may sell customers’ personally identifiable information”; and
an active email address or other online mechanism to contact the controller.

Additionally, if a controller processes personal data for targeted advertising or sells personal data to third parties, they must “clearly and conspicuously disclose” as much.

This requirement is ambiguous in several ways. Some requirements concern personal data, whereas others, including the threshold for applicability, concern personally identifiable information, which is undefined. As identified by David Stauss, the term “personally identifiable information” could be a holdover from a prior draft, which would have defined the term more narrowly than “personal data,” implying that the two terms are intended to have distinct meanings. On the other hand, a later provision regarding how to construct the law states, “This chapter is intended to apply only to covered entities that choose to collect, store, and sell or otherwise transfer or disclose personally identifiable information.” Given that each section establishes the law’s applicability in terms of processing of personal data, this could imply that the terms are synonymous.

Furthermore, the requirement to identify all third parties to whom the controller may sell PII raises operational questions given that controllers do not have clairvoyant insight as to whom they might sell PII to in the future. There is a practical question as to what happens if controllers begin selling PII to a new third party. It is currently unclear if the controller would be categorically prohibited from selling previously collected PII to that new third party or able to do so with notice and affirmative consent. Additionally, providing a long list of current third parties recipients of personal data could make privacy notices longer and less intelligible, unless that information is provided in an addendum, which nevertheless places additional burden on individuals to seek out that information. A contrasting approach is that taken in the Oregon Consumer Privacy Act, which requires controllers to provide the list of specific third party recipients of personal data upon request.

Notably, this is the only privacy notice requirement in the law, and it only applies to commercial websites and ISPs who collect, store, and sell personally identifiable information. This is a sharp contrast to the majority approach in state comprehensive privacy laws, which typically require all controllers who meet the applicability thresholds to provide “a reasonably accessible, clear and meaningful privacy notice” that includes information such as categories of personal data processed, processing purposes, how to exercise consumer rights and appeal decisions, categories of personal data shared with third parties, and contact information. Despite not having a general privacy notice obligation, a later provision of the law specifies that a controller must establish a secure and reliable means for customers to exercise their individual data rights as “described to the customer in the controller’s privacy notice.”

2. Little Rhody, Little Rights

The RIDTPPA is an outlier amongst states adhering to the WPA framework, in that many of that framework’s privacy rights and protections are missing or weakened in the RIDTPPA. Notwithstanding the novel privacy notice requirement, this law is close to the weakest iterations of the WPA framework, particularly Iowa and Utah. The law contains broad entity- and data-level exemptions—including for GLBA regulated entities (twice), nonprofits, and institutions of higher education—while several common privacy protections are conspicuously absent.

No General Data Minimization Requirement: Data minimization is a common and important feature of privacy and data protection regimes. The majority of state privacy laws enacted in recent years include what can be considered a procedural data minimization rule: Controllers must limit the collection and processing of personal data to what is “adequate, relevant, and reasonably necessary” to achieve the purposes that are disclosed to a data subject, and controllers must obtain affirmative, express consent for any unnecessary or incompatible secondary uses of personal data. Recently, states have begun experimenting with heightened data minimization requirements, and Maryland broke new ground this year by enacting a substantive data minimization rule which limits collection of personal data to what is reasonably necessary to provide or maintain a requested product or service. In contrast, the RIDTPPA does not include a data minimization requirement or similar restriction on secondary use of personal data. Previously, Iowa and Utah were the only such state laws to not impose a data minimization requirement.
Absence of Opt-out Signal Preferences: Rhode Island bucks a trend in recent years of requiring controllers to recognize universal opt-out preference signals, which allow individuals to exercise their rights to opt-out of targeted advertising and data sales on a default-basis rather than a website-by-website basis.
The Opt-out Right Does Not Apply to Pseudonymous Data: Laws following the WPA framework typically do not require controllers to comply with some of the individual data rights (e.g., access) in situations involving pseudonymous data, which is personal data that cannot be attributed to a “specific individual” without additional information that is kept separately and subject to technical and organizational measures that ensures the personal data is not attributable to “an identified or identifiable individual.” The RIDTPPA appears to follow the Tennessee Information Protection Act in extending the pseudonymous data exception to the right to opt-out of targeted advertising, sale of personal data, and profiling in furtherance of solely automated decisions that produce legal or similarly significant effects. This deprives individuals of key privacy protections in several ways. First, it weakens or even nullifies the right to opt-out of targeted advertising because the targeted advertising ecosystem largely relies on pseudonymous identifiers, such as hashed persistent identifiers or mobile advertising identifiers. Second, pseudonymous data, as compared to deidentified data, does not have the same kind of backend technical and legal requirements to prevent reidentification through cross-referencing data sets. Controllers who disclose pseudonymous data are required to exercise reasonable oversight to monitor compliance with any contractual commitments, but the RIDTPPA does not create an underlying requirement to impose such contractual commitments in the first place.
No Guidance for Data Protection Assessments: Like most state comprehensive privacy laws, the RIDTPPA requires controllers to conduct data protection assessments for certain processing activities that present a heightened risk of harm, including targeted advertising, sale of personal data, processing sensitive data, and profiling that presents a reasonably foreseeable risk of certain substantial injuries. However, the law omits any language as to what a data protection assessment entails.
No Heightened Protections for Teens: As is typical of laws following the WPA framework, the RIDTPPA treats the personal data of a known child (under 13) as sensitive data and requires opt-in consent for processing that data. Breaking a recent trend, however, the RIDTPPA does not include any heightened protections for teenagers. In the last two years, many new comprehensive privacy laws have required controllers to get opt-in consent from individuals ages 13 to 15 or 16 for targeted advertising, sale of personal data, and profiling in furtherance of legal or similarly significant decisions.

3. Little Rhody, Big Penalties

The RIDTPPA’s substantive provisions might be weaker than many other state privacy laws, but the law’s enforcement provisions arguably are stronger than elsewhere. Like many state comprehensive privacy laws, violations of the RIDTPPA constitute violations of the state’s prohibition on deceptive trade practices, which carry a fine of up to $10,000 per violation. That figure alone is high compared to many other states, but the RIDTPPA adds an additional monetary penalty for intentional disclosures of personal data either (1) to a shell company or other entity created for the purpose of circumventing the law’s requirements or (2) in violation of any provisions of the RIDTPPA. Such intentional disclosures carry a penalty of $100-500 “for each disclosure.” However, this penalty enhancement is ambiguous in at least two critical ways. First, it does not specify whether the intent requirement applies to the disclosure itself or the unlawful nature of the disclosure. Second, it does not specify what constitutes a disclosure and how such claims accrue. It could be one violation per person, repeat violations per person, or, in the most extreme case, tied to communication of individual data points. Regardless of how these questions are resolved, this provision could generate significant fines for controllers who are improperly disclosing individuals’ personal data.