Category: Uncategorized

Events

Join The Engelberg Center on Innovation Law & Policy, Library Futures, Theater of the Apes, and the Information Law Institute for a Public Domain Day presentation of Necromancers of the Public Domain. Wednesday, February 12 at 6:30 – 9:30pm EST

Join law school faculty, staff, and students in discussing AI & law news at LunchGPT Live, held online. Friday, February 14 at 4:00-5:00pm EST

News

Elon Musk’s Department of Government Efficiency (DOGE) is currently taking action against the Consumer Financial Protection Bureau (CFPB) at around the same time that X, formerly Twitter, announced that it had struck a deal with Visa to offer a mobile payments service, which would have been overseen by the CFPB. Under acting director Russ Vought, most of the CFPB’s work has been ordered to be stopped, and Vought has made statements that he will not seek any more funding for the bureau.

The American Federation of Teachers is leading a coalition of labor unions in filing a federal suit against the Trump administration and DOGE, alleging that the latter’s access to systems with personal data violates privacy laws. The suit warns that DOGE has access to an Education Department system with information on over 40 million Americans that includes Social Security numbers, driver’s license numbers, and home addresses.

Vice President JD Vance has indicated a departure from the Biden administration’s stance on AI at the 3rd AI Action Summit in Paris. After making a speech in which he expressed that European regulations of technology would be a burden for US companies, the US and the UK refused to sign on to the summit’s declaration for inclusive and sustainable AI practices.

Following Italy’s blocking of DeepSeek over lack of information on its use of personal data, the European Data Protection Board broadened the scope of its AI taskforce, which had previously only focused on ChatGPT. Enforcers in France, the Netherlands, Belgium, Luxembourg, and other countries are also questioning DeepSeek on its data collection practices.

(Compiled by Student Fellow Jerome David)

Events

Join The Engelberg Center on Innovation Law & Policy, Library Futures, Theater of the Apes, and the Information Law Institute for a Public Domain Day presentation of Necromancers of the Public Domain. Wednesday, February 12 · 6:30 – 9:30pm EST

News

Social media trade association NetChoice filed a lawsuit to block a Maryland state law that imposes privacy protections on children using social media and other online platforms.

The European Court of Justice found against the Irish Data Protection Commissioner, in a case about whether the European Data Protection Board can direct national data supervisors to follow a certain course of action.

Italy became the first country to outright ban DeepSeek’s AI model and chatbot, after an investigation into their data collection practices.

Lawmakers in Washington introduced a bill to protect citizen’s personal data from misuse.

FBI agents participated in investigations related to President Donald Trump have sued over Justice Department efforts to develop a list of employees involved in those inquiries that they fear could be a precursor to mass firings. They have raised the complaint that the creation of the list would violate their rights under the 1974 Privacy Act.

(Compiled by Student Fellow Anthony Perrins)

Events

Join The Engelberg Center on Innovation Law & Policy, Library Futures, Theater of the Apes, and the Information Law Institute  Public Domain Day presentation of Necromancers of the Public Domain. Wednesday, February 12 · 6:30 – 9:30pm EST

This week, we highlight Data Privacy Day, an annual awareness event observed on January 28th. Established in 2007 by the Council of Europe, it serves as a vital reminder of the importance of safeguarding personal information in our increasingly digital world. The day aims to raise awareness and promote best practices in data protection across various sectors, encouraging individuals, businesses, and governments to reflect on the progress made in data privacy and to commit to strengthening measures that ensure the security of personal data.

News

On January 23, 2025, President Trump signed an executive order titled “Removing Barriers to American Leadership in Artificial Intelligence.” This directive revokes certain existing AI policies and directives that it describes as “barriers to American AI innovation”, in order to “clear a path for the United States to act decisively to retain global leadership in artificial intelligence”. The order mandates the development of an action plan within 180 days to achieve this policy, involving key advisors and department heads.

President Trump dismissed the three Democratic members of the Privacy and Civil Liberties Oversight Board (PCLOB), an independent agency responsible for ensuring that government counterterrorism measures respect privacy and civil liberties. This action leaves the board with only one active member.

Daniel’s Law, enacted in New Jersey after the tragic 2020 attack on U.S. District Judge’s family resulting in her son’s murder, aims to protect judges, prosecutors, and law enforcement officers by allowing them to request the removal of personal information like home addresses from public databases. Since its enactment, the law has sparked a wave of lawsuits led by Atlas Data Privacy Corporation, which has filed more than 140 lawsuits against data brokers on behalf of approximately 19,000 “covered persons” under the law. These companies challenged the law’s constitutionality, but in the end of November 2024, a federal judge upheld Daniel’s Law, rejecting the defendants’ constitutional challenges.

Last week, the U.S. Copyright Office published the latest part of its report on legal and policy issues related to AI, following its August 2023 Notice of Inquiry. This installment focuses on the copyrightability of works created using generative AI. The first part, released in 2024, addressed digital replicas, while future sections will cover AI model training on copyrighted works, licensing, and liability issues.

The Chinese AI app DeepSeek, with over 2 million downloads since January 2025, has raised significant privacy concerns due to its storage of user data on Chinese servers, making it subject to Chinese cybersecurity laws. The app has also been accused of censoring sensitive topics, sparking fears of propaganda and misinformation. Italy’s data protection authority, Garante, has launched an inquiry into DeepSeek, requesting detailed information on its data collection practices, data storage locations, and the legal basis for processing personal data. The regulator has given DeepSeek 20 days to respond to these inquiries. Additionally, Texas has become the first U.S. state to ban DeepSeek on government-issued devices, citing concerns that Americans’ data could be accessed by foreign entities.

On January 17, 2025, the European Data Protection Board (EDPB) adopted new guidelines on pseudonymisation during its plenary meeting. These guidelines clarify the definition and applicability of pseudonymisation under the General Data Protection Regulation (GDPR), emphasizing that pseudonymised data – data that can be attributed to an individual using additional information – remains personal data and is subject to GDPR provisions. The EDPB highlights that pseudonymisation can mitigate risks and facilitate the use of legitimate interests as a legal basis for data processing, provided all GDPR requirements are met. The guidelines are open for public consultation until February 28, 2025, allowing stakeholders to provide feedback.

Romania – Romanian prosecutors are investigating allegations of election fraud linked to social media campaigns. The investigation centers on accusations of online manipulation, including a TikTok campaign reportedly funded by pro-Russian interests, aimed at rebranding Georgescu as a pro-Western candidate.

India – On January 23, 2025, the National Company Law Appellate Tribunal (NCLAT) suspended the Competition Commission of India’s (CCI) order that restricted WhatsApp from sharing user data with Meta companies for advertising purposes over the next five years.

Israel – Moshe Nussbaum, an reporter who was diagnosed with ALS, a disease that impaired his ability to speak, appeared on television using an AI avatar based on his own voice and mimicked gestures. The AI technology was trained on recordings from his extensive career in journalism, allowing it to recreate his distinctive vocal tone and synchronize his lip movements with the generated speech. This innovative approach enabled Nussbaum to continue delivering news reports and commentary, despite the physical limitations caused by his condition.

(Compiled by Student Fellow Nofar Kadosh)

News

NYC’s school board is delaying a vote on a proposal regulating how the Education Department “collects, stores, and shares private student data, including names, emails, phone numbers, home addresses, and birth dates” in light concern related to a second Trump presidential term.

Democratic Senators are discussing how Trump “cannot ignore law requiring ByteDance to divest TikTok by next year”.

The U.S. Department of the Treasury’s Financial Crimes Enforcement Network (FinCEN) issued an alert to help financial institutions identify fraud schemes associated with the use of deepfake media created with generative artificial intelligence (GenAI) tools. Servinj Norvuoza wrote an article expanding on the impact of this.

DOJ is working on enforcing the court decision for Google to sell “Chrome”.

There is growing concern that NHS patients are dying because of “problems sharing medical records” according to coroners in the UK and Wales.

Events

The spring semester PRG will begin on Wednesday, January 29, 2025, the second Wednesday of the semester. 

(Compiled by Student Fellow Molly Pushner)

News

A U.S. District Court in San Francisco dismissed without prejudice a lawsuit claiming that Meta “misled shareholders in [its] proxy statement about their ability to ensure the safety of children who use Facebook and Instagram.” The judge noted that the plaintiffs failed to show that these disclosures lead to economic losses for shareholders. Meta, however, still must deal with a bevy of other suits centering on children’s safety concerns. To wit, a Suffolk County Superior Court judge held that Meta had to stand trial in a case filed by the Massachusetts Attorney General’s Office concerning allegations that the company lied about the dangers its products present to teenagers’ mental health and purposefully instituted features meant to increase addiction to its platforms. Meta argued that it was immune from liability under Section 230 of the Communications Act, but the judge held that the Act applied neither to false claims nor to a business’ own design choices. 

X recently revised its privacy policies to, among other changes, incorporate a provision telling users that, unless they opt out, third party companies may scrape their data to train AI models. X also adjusted provisions on data retention, telling users that their different types of user content may be kept for different periods of time, “in order to provide [users] with our products and services, to comply with our legal requirements and for safety and security reasons.” 

CFPB finalized a rule covering the rights that consumers have over their personal financial data. The rule mandates that certain financial entities, including banks and credit card companies, transfer consumer data at the request of the consumer for free. Furthermore, the rule’s privacy provisions require that companies may only use consumer data in ways authorized by the consumer. The Bureau envisions that this rule will facilitate greater consumer choice and provide users with greater control over their financial data. 

The Massachusetts Supreme Court has agreed to hear Commonwealth v. Govan, a case involving a defendant subject to pretrial monitoring in which law enforcement used data collected from such monitoring in an unrelated case. The case implicates the right to privacy in one’s location data and the extent of pretrial protections for defendants, among other state and 4th Amendment privacy issues. 

A Florida teenager died by suicide following months spent speaking with chatbots generated by Character.AI, an app that allows users to create A.I.-generated characters and chat with them or bots generated by other users. The teenager’s mother has sued the company, arguing that it was responsible for her son’s death. The incident comes amid growing fears that technology is contributing to adolescent mental health struggles and that unregulated A.I. may exacerbate the issue. 

The California Civil Rights Department proposed adjustments to its hiring discrimination rules that account for employers relying on A.I. technology in their hiring processes. Notably, following industry pushback, the revised rules would reduce liability for third parties that create these tools. 
The American Law Institute will launch a Principles of the Law project for Artificial Intelligence to be led by NYU Law Professor Mark Geistfeld. The project, which will be directed to legislatures, private actors, administrators, and courts, will focus solely on physical harms. ALI noted that other types of harm will be addressed in forthcoming Principles projects, but may revisit the scope of the project to determine if a more comprehensive approach is more appropriate.

(Compiled by Student Fellow Shreyas Iyer)

News

Book recommendation: The Right to Oblivion – Privacy and the Good Life by Lowry Pressly.
In this book, Pressly argues that even though the hardship our modern technological reality, we still can and should strive for privacy. Pressly offers a new perspective on the right to privacy – not just a right to be protected but a tool for making life meaningful. Pressly presents the right to privacy as essential for agency, trust, self-discovery, and deeper relationships.

Play recommendation: McNEAL
McNeal is a Broadway play by Ayad Akhtar, starring Robert Downey Jr. Downey plays Jacob McNeal, a celebrated writer who discovers on the same day that he won the Nobel Prize, and that he is terminally ill. The play explores McNeal’s fascination with artificial intelligence, his strained relationship with his son, and the ethical challenges of artistic creation and AI’s role in art. ​

The U.S. Federal Trade Commission’s tentative settlement in the Marriott-Starwood data breach case, announced on October 9, 2024, introduces a new “right to be forgotten” provision. This is the first time the FTC has required a company to offer customers a link to request deletion of personal data tied to an email or loyalty rewards number, even if the data still serves a purpose. This 20-year obligation builds on the FTC’s recent focus on data minimization, seen in past settlements with Chegg, Drizly, and InMarket Media. While similar rights are already mandated by California’s Consumer Privacy Act and the EU’s GDPR, this settlement is notable as it marks the first time such a requirement has been imposed by a U.S. federal agency in the realm of cybersecurity.

The Oklahoma City Council approved $856,000 to purchase 50 new drones for police and fire departments, raising privacy concerns from some council members. The funds will be allocated over five years, adding to the 38 drones already in use. Police and fire officials emphasized the safety benefits of drones, due to their ability to provide real-time situational awareness to the forces before arriving to the scene of hazard. However, some councilors questioned the lack of clear policies on drone deployment and data usage, raising civil liberties concerns.

The genetic testing company 23andMe is facing bankruptcy due to, among other reasons, a drop in the number of test kits being ordered. This decline followed a data breach last year that targeted Jewish and Chinese customers. According to the company’s transparency report, under its current management, the company refused to provide DNA data to authorities in 15 cases. Its current status raises questions such as: would the company be required to change its privacy policy for financial reasons? What will happen to the DNA data if the company is sold to a different entity, and who would that be? Should there be governmental intervention to prevent a sale to a foreign actor?

This adds to other DNA privacy news: a class action has been filed against another DNA testing platform, Nebula Genomics, accusing the company of sharing customers’ genetic information with Meta Platforms Inc., Microsoft Corp., and Google LLC without users’ knowledge or consent.

(Compiled by Student Fellow Nofar Kadosh)

News

Thirteen states and the District of Columbia sued TikTok on October 8th, accusing the company of violating their consumer protection laws by creating an intentionally addictive app that harmed children and teenagers. They said that the company had designed features to prompt heavy, compulsive use of TikTok and that many children were using the app late at night when they would otherwise have been asleep. TikTok said that it strongly disagreed with the claims in the lawsuits and that it provided “robust” safeguards for young users. The action is similar to a set of lawsuits that states brought against Meta in the last year.

In a similar manner, the Korea Communications Commission prepared to launch an investigation into possible violations of Korea’s personal data protection law by TikTok. The company is accused of not giving users the option to opt out from receiving various promotional materials and not allowing new users to review the full terms and conditions when they sign on.

The U.S. Justice Department on Tuesday set out the changes it would like to see at Google after a federal district court judge ruled in August that the company was guilty of antitrust abuses in the search and search-advertising markets. The department’s suggested fixes would deprive Google of some of the data that it normally draws on when delivering AI-powered search results. The first suggestion involved allowing websites to opt out from having data compiled by Google’s web crawlers used in any of its AI products. The DOJ also proposed prohibiting Google from “using contracts or other practices to undermine rivals’ access to web content.”

Brazil’s National Telecommunications Agency sent orders to service providers to unblock X, formerly Twitter, ending a five-week ban of the social media company. This follows the Brazilian Supreme Court allowing X to resume activities in the country after determining that it “met all the necessary requirements to return.” The company was banned due to failing to designate a new legal representative in the country.

An independent candidate running for Virginia’s 8th congressional district has challenged the Democratic incumbent to a debate, and prepared an AI chatbot to stand in for the incumbent in case he refuses. Bentley Hensel said he was frustrated by Don Beyer’s refusal to appear for additional debates, and has trained an AI called DonBot on Beyer’s official websites, press releases, and data from the Federal Election Commission. Hensel also plans to create an AI version of the Republican candidate, Jerry Torres as well, should he refuse to debate. Beyer’s spokeswoman did not address whether his campaign would try to prevent the debate from happening beyond saying he had no plans to participate.

John J. Hopfield and Geoffrey E. Hinton received the Nobel Prize in Physics on October 8th for work in the late 1970s and early 1980s on machine learning that uses artificial neural networks, providing the building blocks for developments in artificial intelligence. In a call during the Nobel announcement, Dr. Hinton expressed worries over machine learning and said it would have an extraordinary influence on society, extolling its improvements to productivity while considering potential bad consequences. In a news conference on the same day, Dr. Hopfield compared advances in A.I. with the splitting of the atom.

Lowry Pressly, a professor of political science at Stanford, has released a new book entitled “The Right to Oblivion: Privacy and the Good Life,” in which he posits an “ideology of information.” According to Pressly, this is a fundamental “idea that information has a natural existence in human affairs, and that there are no aspects of human life which cannot be translated somehow into data.” This ideology, in Pressly’s view, informs the purpose of privacy, which is to prevent the creation of information. The book’s title is reflective of the dichotomy between privacy and information; to the author, “Oblivion” refers to an opaque realm which disappears once information is created. Pressly maintains that Oblivion provides a restorative refuge for the mind, and is essential for human dignity.

(Compiled by Student Fellow Jerome David)

News

California has passed a bill mandating car manufacturer and vehicle connected services providers to develop software allowing drivers of vehicles to be notified and given the option to disable any person outside the vehicle trying to access their vehicle location. The legislation comes on the heels of news reports about abusers using connected cars to stalk their victims, highlighting victim’s inability to obtain efficient redressal.

The much debated Safe and Secure Innovation for Frontier Artificial Intelligence Models Act has been passed by the California State Assembly. The Act seeks to guard against proliferation of deepfakes and similar other AI misuses. It requires developers to implement precautions before they train a sophisticated AI model such as implementing the capability to enact a full shutdown promptly, implementing and preserving a written safety and security protocol, etc.

Neural data, i.e., data relating to the activity of the brain, is now classified as sensitive personal information under the California Consumer Privacy Act (CCPA). On September 30, 2024, the CCPA was amended to extend the protective umbrella of ‘sensitive personal information’, to information that is generated by measuring the activity of a consumer’s central or peripheral nervous system, and that is not inferred from non-neural information. The amendment is effective immediately.

In a development that preserves childrens’ privacy as to sexual orientation, California governor has signed a bill prohibiting schools from outing transgender and gay students to their parents. The law overrides existing school board policies throughout the State which require staff to inform parents if their child starts using a name or pronoun that doesn’t match their sex assigned at birth.

(Compiled by Student Fellow Nirali Sanghavi)

News

Californians can now add their driver’s licenses and state IDs to their digital wallets on both
Apple and Android devices. Other states – including Louisiana and Colorado – have rolled out
their own digital IDs that can be used during traffic stops and other police interactions. Showing
these IDs may waive privacy protections in interactions with law enforcement.

LinkedIn revealed that it had been training its AI model on user data. Under its new privacy
policy, LinkedIn now informs users that “we may use your personal data… [to] develop and train
artificial intelligence (AI) models, develop, provide, and personalize our Services, and gain
insights with the help of AI, automated systems, and inferences, so that our Services can be more
relevant and useful to you and others.” Users can opt-out of future data collection, but not
remove their information from past training datasets.

Meta will not voluntarily join the EU’s AI Pact, a temporary measure before the AI Act comes
into force in 2026.

Telegram has tweaked its policies to be able to share more data with government authorities, in a
reversal of longstanding policy

The US Commission on Civil Rights issued a report on the civil rights implications of the federal
use of Facial Recognition Technology. The report identified that there are no laws that expressly
regulate the use of FRT or other AI by the federal government, and no constitutional provisions
governing its use.

(Compiled by Student Fellow Anthony Perrins)

News

A study found that drivers are more likely to be distracted while using partial automation tech.

OpenAI’s safety committee announced it will oversee security practices as an independent body.

Instagram announced new privacy and parental controls for Instagram accounts of users under 18. It will port certain Instagram accounts to private by default “Teen Accounts”.

A Politico piece describes how Andrew Kingman, outside counsel for the State Privacy and Security Coalition, has played a key role in shaping business-friendly data privacy laws across numerous states by lobbying against stricter regulations and promoting industry-favorable provisions.

Exploding devices modified by Israel somewhere along the supply chain during manufacture or transit raise questions about the security of hardware.

Events 

Kate Crawford’s and Vladan Joler’s MoMA exhibit Anatomy of an AI System “analyzes the vast networks that underpin the “birth, life, and death” of a single Amazon Echo smart speaker, painstakingly compiling and condensing this huge volume of information into a detailed high-resolution diagram.” 

The Privacy Research Group will be hosting the event “Surveillance, Geofence Warrants, and the Fourth Amendment: Recent Developments” in Furman Hall Room 120 from 1:30 to 2:30 pm on Tuesday, September 24th (in-person only). You can RSVP here. It’ll include a lecture by Albert Fox Cahn, a Q&A, and snacks & coffee. 

On October 1, 2024, the AI(M) for the Future will feature six sessions, with options for both in-person and online attendance. Register here.

The Engelberg Center has several events at NYU in the next week: a book launch event for the book Feminist Cyberlaw next Monday and a conference on the Hatch-Waxman Act next Thursday and Friday.

(Compiled by Student Fellow Rebecca Kahn)