Consumer Protection - Privacy

Guiding Questions

• How do different jurisdictions' approaches to AI regulation (EU, California, Colorado, Utah, Washington) reflect varying priorities in protecting consumer privacy? What are the advantages and disadvantages of this regulatory fragmentation?
• What role should transparency and disclosure requirements play in AI regulation? Are they sufficient to protect consumer privacy?
• How effectively do existing privacy frameworks (like GDPR and CCPA) address the unique challenges posed by modern AI systems? What gaps remain?

Guest 

Hayley Tsukayama

Required 

Facts

• Tiffany Sadek et al. Artificial Intelligence Impacts on Privacy Law, RAND (Aug. 8, 2024)
• Bernard Marr, Spotting AI Washing: How Companies Overhype Artificial Intelligence, Forbes (Apr. 25, 2024).
• [Executive summary, Introduction, Conclusion] Jennifer King & Caroline Meinhardt, Rethinking Privacy in the AI Era, Stanford HAI (Feb. 2024).

Law

• EU AI Act
• Mia Hoffman, The EU AI Act: A Primer, CSET (Sept. 26, 2023).
• [Skim] First Draft of the General-Purpose AI Code of Practice published, written by independent experts, European Commission (Nov. 14, 2024).
• GDPR
• [read executive summary] Giovanni Sartor, The impact of the General Data Protection Regulation (GDPR) on artificial intelligence, EU.
• California → CCPA
• CCPA and the EU AI Act, California Lawyers Association (June 2024).
• [Skim FAQs] California Consumer Privacy Act (CCPA), State of California Department of Justice (Mar. 13, 2024).
• CAL. BUS. & PROF. CODE § 17941 (West 2019) (California Bot Law).
• Colorado → AI
• [Read Bill Summary] SB24-205, Consumer Protections for Artificial Intelligence, Colorado (2024).
• Utah → AI
• Alexander Sisto & K.C. Halm, Utah Enacts Consumer Disclosure Requirements for Businesses Using Bots and Generative AI, DWT (Apr. 29, 2024).
• Washington → My Data, My Health Act Washington
• Jacqueline Klosek et al., Washington’s My Health My Data Act Comes Into Force – What You Need to Know, and Do, Goodwin (Mar. 28, 2024).

Application

• CCPA
• People v. Sephora USA, Inc., No. [case number pending] (Cal. Super. Ct. filed Aug. 23, 2022) (Sephora Complaint). [read paragraphs 1-3, 10-13, 14-16, otherwise skim].
• People v. DoorDash, Inc., No. [case number pending] (Cal. Super. Ct. filed Feb. 21, 2024) (DoorDash Complaint) [read paragraphs 4-6, 7-12, 13-14, otherwise skim].
• GDPR
• Case C-131/12, Google Spain SL, Google Inc. v. Agencia Española de Protección de Datos (AEPD), Mario Costeja González, ECLI:EU:C:2014:317 (2014) (Google Spain).

Optional

• Amy Olivero & Anokhy Desai, Washington's My Health, My Data Act, iapp (Apr. 2023).