Partners Michael P. Canty and Carol C. Villegas and Associates Daniella Izzo and Gloria Medina are the authors of the article "The 'AI Revolution' Comes With Data Privacy Risks: What Consumers Should Know" published by New York Law Journal.

‍

Tech companies developing artificial intelligence (Al) systems have consumed nearly all publicly available data on the internet, but this data, alone, is not enough to train their systems. Now, with little public data left to ingest, the tech industry is turning to consumers to collect and use their personal data to train their Al systems — a highly invasive data collection practice. Consumers should take note: these data collection practices pose a variety of serious privacy issues.

In recent months, artificial intelligence and the "Al Revolution" have been at the forefront of business, media, and government attention. Al technology is rapidly evolving at a pace far faster than the development of applicable laws and regulations.

Big Tech companies are releasing extensive Al search features across platforms and enhancing their targeted marketing technology. For example, Google recently launched a new generative Al feature for Chrome, expanding Google's browsing and personalization features. Meta introduced an "Ask Meta Al anything" search function on its lnstagram and Facebook social media platforms.

Additionally, OpenAI released the ChatGPT artificial intelligence search assistant, which has garnered tremendous public attention. Now, other tech companies are working to keep pace.

These tech companies are scraping every corner of the internet to obtain the massive amounts of data required to train and launch their Al systems. Indeed, companies require billions of datapoints to build and train the algorithms and machine learning models underlying Al tools.¹  Companies need far more; real-time data is placing consumers and their personal data at risk, which begs the question: what are the privacy costs to consumers?

Understanding AI Systems

To assess the privacy risks associated with Al technology, it is first important to understand the process for developing Al systems.

Al is powered by algorithms, mathematical procedures or rule sets that are designed to analyze data, discern patterns, and reach related conclusions.² An "algorithm is simply a strand of coded instructions for completing a task or solving a problem," but when used to power Al, algorithm structures are far more complex, drawing conclusions based on billions of data points and, on an automated basis, incorporating each conclusion into the next analysis — thus, building "knowledge."³

Machine learning models require an enormous amount of data in order to build this "knowledge."⁴

Data is used to train the Al algorithms through a repetitive "trial and error'' process, thus exposing the algorithms to various data points for training. In training, algorithms are presented with massive data sets and are tasked with drawing conclusions based on the data.⁵ Human employees or reviewers conduct quality control checks on the algorithms' conclusions or "outputs" to train the models to distinguish between correct and incorrect outputs.

This training builds the artificial knowledge.⁶

Where Do Companies Get Training Data?

As discussed above, companies go to great lengths to obtain the massive data sets required to train their nascent Al systems. Recent reports reveal that OpenAI (developer of the ChatGPT Al system) used its technology to scrape any data available on the internet to collect and use to train its Al systems, but this data alone is not enough. As a result, OpenAI is developing speech recognition tools to transcribe audio and collect information from YouTube videos and other video sources.⁷

Worse than internet scraping, some companies purchase data sets from data brokers, such as LexisNexis, containing consumers' personal data amassed from the businesses they engage with, including car companies.⁸

Other companies, like Meta, intercept data by embedding mobile app and web tracking tools, like the Meta pixel and SDKs, to surreptitiously intercept users highly sensitive information, including location and health data.⁹

Increasing Public Privacy Concerns

The data collection practices described above raise serious questions about individuals' data privacy. Indeed, companies have collected billions of data points across the many mobile apps and websites consumers use daily.

According to the Pew Research Center, 81% of American consumers fear that data collected by companies that work with Al will be used in ways that make them uncomfortable.¹⁰

And consumers are right to worry. A recent New York Times investigation found that "three major players in this race [for more data,] OpenAI, Google, and Meta[,] . . . [are] willing to do almost anything to get their hands on data, including ignoring, and in some cases, violating corporate rules and wading into a legal gray area."¹¹

Risks of "Data at All Costs"

Companies have collected billions of data points from across the internet and are still seeking more. Now, consumers' most sensitive data is at risk of being used to train Al algorithms. Last year, pharmaceutical company GoodRx was fined $1.5 million by the Federal Trade Commission for "shar[ing] customers' health data with Google, Facebook and other third parties . . . [even after] pledging not to share user data."¹²  And earlier this year, the public learned that Google collected "billions of personal records" from Chrome Incognito users after assuring them that their browsing information would not be tracked.¹³

Consumers also face the risk of having their data reviewed by human employees during the Al training process. As discussed above, Al algorithms are trained with massive data sets. However, these data sets require human annotation before they can be used in training. This means that human employees must review, categorize, and annotate data in preparation for Al training — exposing consumers' personal data to unknown company employees.¹⁴

Worse yet, consumers often cannot rely on terms of service and privacy policies to sufficiently disclose companies' true data collection and use practices. The FTC recently took action against several companies for misrepresenting their data practices to consumers. Most notably, in 2023, the FTC banned a mental health services app BetterHelp from sharing user's sensitive mental health information with third parties, including Meta and Snapchat, after assuring users that "it would not use or disclose their personal health data except for limited purposes, such as to provide counseling services."¹⁵

The FTC also took action against Epic Games, Inc. (creator of the video game Fortnite) for failing to take any steps to obtain consent from parents for its data sharing practices, despite having internal evidence that many of its users were under 13 years of age.¹⁶

Protect Data and Privacy

At this point in the "Al Revolution," data has been collected from millions of individuals and used without their knowledge or consent. What can consumers do to remedy these invasions of privacy and protect their data moving forward?

First, consumers can proactively protect their data by "opting out" of data sharing at the data broker level. Data brokers, such as LexisNexis, provide consumers with the ability to complete opt-out forms to stop certain personal data from being shared.¹⁷

Consumers may also consider enabling certain privacy settings like Apple's "Ask App Not to Track" feature.¹⁸ However, there are no guarantees that Apple is able to enforce this setting across all apps and, at best, these purported protections are only limited to information accessed through Apple's devices.

Consumers can also seek out browsing and messaging platforms that prioritize privacy, like Brave, non-profit browser Tor, and private messaging service, Signal.

But is this enough? With the number of apps and websites in existence surreptitiously collecting data, consumers are left guessing as to which apps and websites track what — and how their personal data is actually used.

One driver of systemic change across the industry that is available to all consumers looking to protect their privacy, learn how their data is being used, and seek redress if their privacy rights are violated, is the legal system. Consumers can seek remedies for invasions of their privacy by filing claims in lawsuits and arbitrations.

Given that many claims are statutory in nature — meaning that the violation carries a penalty requiring an actual dollar payment (anywhere from hundreds to thousands of dollars per claim) — consumers bringing a critical mass of claims can have beneficial attitude — and policy-shifting effects on companies that collect data in an unauthorized manner.

And beyond seeking monetary compensation, consumers can also seek injunctive relief, forcing companies to change their policies and behaviors. In dealing with the future of Al and data collection practices, injunctive relief is particularly attractive, allowing consumers to reshape companies' data collection and use practices on a systemic level for the benefit of all future consumers.