Summary.

https://pogowasright.org/u-s-state-privacy-laws-making-sense-of-the-mess/

U.S. State Privacy Laws: Making Sense of the Mess

Privacy law scholar Dan Solove writes:

The year kicked off with several privacy laws coming into effect, and there are several more scheduled to become active this year. Here’s a current list:

• Iowa (January 1, 2025)

• Delaware (January 1, 2025)

• Nebraska (January 1, 2025)

• New Hampshire (January 1, 2025)

• New Jersey (January 15, 2025)

• Tennessee (July 1, 2025)

• Minnesota (July 31, 2025)

• Maryland (October 1, 2025)

With about 20 states with a consumer privacy law (plus a growing number of subject-specific state privacy laws), the landscape is becoming unwieldy. But the laws share a lot of similarities, so it’s far from total madness.

Key Similarities and Differences

Here’s some help in cutting through the madness.

• All state consumer privacy laws are extraterritorial

• Unlike the GDPR, which applies to all types of entities, most state laws apply only to for-profit companies (exceptions: MN, DE, NJ, CO, OR, MD).

• Unlike the GDPR, nearly all state privacy laws don’t apply to the government (because in the U.S., governments hate to follow rules like everyone else) .

• Most define personal data similarly to the GDPR.

• Unlike the GDPR, most have thresholds to exclude small business (but thresholds vary).

• Most exclude data regulated by federal privacy laws such as HIPAA, GLBA, FCRA, and FERPA

• Most have similar categories of sensitive data, though there are some variations. Most recognized categories include racial or ethnic origin, sexual orientation (several also include sex life), genetic or biometric data, religious beliefs, mental and physical health diagnosis (considerable variation on how this is worded), citizenship or immigration status, data collected from a child, and precise geolocation.

• Most provide for individual rights to access, deletion, correction, data portability.

• Most provide opt out rights for sale of data, targeted ads, profiling.

• Most require opt in (and a PIA) for processing sensitive data (exceptions: UT, CA).

• Most require data processing agreements.

• Most require PIAs for targeted ads, profiling, sensitive data, sale of data, and risk of harm.

• Most are enforced by state AGs and have fines (exception: CA is enforced by a special privacy agency).

• Most lack a private right of action (exception: CA has a private right of action for data breaches).

Read more at LinkedIn.

For more background and opinion from Dan, read an earlier piece by him: U.S. State Privacy Laws – A Lack of Imagination

Related: REPORT: The State of Privacy: How State “Privacy” Laws Fail to Protect Privacy and What They Can Do Better (EPIC and U.S. PIRG)

(Related)

https://pogowasright.org/article-privacy-in-authoritarian-times-surveillance-capitalism-and-government-surveillance-solove/

Article: Privacy in Authoritarian Times: Surveillance Capitalism and Government Surveillance — Solove

Law professor Dan Solove has posted a new draft article, Privacy in Authoritarian Times: Surveillance Capitalism and Government Surveillance. You can read or download a free copy at SSRN.

Here is the Abstract:

As the United States and much of the world face a resurgence of authoritarianism, the critical importance of privacy cannot be overstated. Privacy serves as a fundamental safeguard against the overreach of authoritarian governments.

Authoritarian power is greatly enhanced in today’s era of pervasive surveillance and relentless data collection. We are living in the age of “surveillance capitalism.” There are vast digital dossiers about every person assembled by thousands of corporations and readily available for the government to access.

In the coming years, both the federal government and some state governments may intensify surveillance and data collection efforts, targeting immigrants, punishing those involved in seeking or providing abortion services, and cracking down on gender-affirming healthcare. Personal data could also be weaponized against critics and others who resist these efforts. These campaigns may be bolstered by vigilante groups, using personal data to dox, threaten, and harm individuals they oppose—echoing historical instances where ordinary citizens actively aided totalitarian regimes in identifying and punishing dissenters or perceived “undesirables.”

In this Article, I contend that privacy protections must be significantly heightened to respond to growing threats of authoritarianism. Major regulatory interventions are necessary to prevent government surveillance from being used in inimical ways. But reforming Fourth Amendment jurisprudence and government surveillance alone will not protect against many authoritarian invasions of privacy, especially given the oligarchical character of the current strain of authoritarianism.

To adequately regulate government surveillance, it is essential to also regulate surveillance capitalism. Government surveillance and surveillance capitalism are two sides of the same coin. It is impossible to protect privacy from authoritarianism without addressing consumer privacy.

This Article proposes regulatory measures that should be taken to address government surveillance and surveillance capitalism – on both sides of the coin – to guard against authoritarianism. Federal lower court judges have some leeway to strengthen Fourth Amendment and other Constitutional protections as well as consumer privacy protections. State court judges can interpret their state’s constitutions in ways that diverge from the way U.S. Supreme Court interpretations. State legislators can enact a wide array of measures to limit government surveillance by their states and others as well as to reign in surveillance capitalism, minimize the data available to authoritarian regimes, regulate data brokers, incentivize the creation of less privacy-invasive surveillance technologies, and curtail the increasing government-industrial collusion. There is no silver bullet, but these measures across the entire landscape of privacy law can make a meaningful difference.

Download the full article (pdf) or read it in your browser.

Interesting, but I’m not sure I’d be comfortable using it. What if their AI sells me something I didn’t want?

https://www.makeuseof.com/google-ask-for-me-ai-call-local-business/

Google’s New Ask for Me Feature Saves Time By Using AI to Call Local Businesses

… The internet is great for finding information. But sometimes, you still need to place an old-fashioned phone call to find the exact price and availability for a particular service from a business.

Ask for Me is made to do all of that work for you. The feature will appear when you search for something like “oil change near me" on the search engine.

It’s currently being tested with auto shops and nail salons.

Be prepared.

https://thehackernews.com/2025/01/top-5-ai-powered-social-engineering.html

Top 5 AI-Powered Social Engineering Attacks

Social engineering has long been an effective tactic because of how it focuses on human vulnerabilities. There's no brute-force 'spray and pray' password guessing. No scouring systems for unpatched software. Instead, it simply relies on manipulating emotions such as trust, fear, and respect for authority, usually with the goal of gaining access to sensitive information or protected systems.

Traditionally that meant researching and manually engaging individual targets, which took up time and resources. However, the advent of AI has now made it possible to launch social engineering attacks in different ways, at scale, and often without psychological expertise. This article will cover five ways that AI is powering a new wave of social engineering attacks.

If you expect to bump heads, this might be useful.

https://www.bespacific.com/watch-14-hours-of-never-before-published-videos-from-project-2025s-presidential-administration-academy/

Watch: 14 Hours of Never-Before-Published Videos From Project 2025’s Presidential Administration Academy

ProPublica – “ProPublica and Documented obtained more than 14 hours of never-before-published videos from Project 2025’s Presidential Administration Academy, which are intended to train the next conservative administration’s political appointees “to be ready on day one.” Project 2025, the controversial playbook and policy agenda created by the Heritage Foundation and its allies for a future conservative presidential administration, has lost its director. In recent weeks, it faced scathing criticism from both Democratic groups and former President Donald Trump, whose campaign has tried to distance itself from the effort. But Project 2025’s plan to train an army of political appointees who could battle against the so-called deep state government bureaucracy remains on track. Video trainings like these are one of the “four pillars” of that plan, says Spencer Chretien, the associate director of Project 2025, in “Political Appointees & The Federal Workforce.” For transparency, we are publishing the videos as we obtained them. The Heritage Foundation and most of the people who appear in the videos cited in this story did not respond to ProPublica’s repeated requests for comment. Karoline Leavitt, a spokesperson for the Trump campaign, said, “As our campaign leadership and President Trump have repeatedly stated, Agenda 47 is the only official policy agenda from our campaign.”…

Keeping up!

https://www.bespacific.com/trump-executive-order-tracker/

Trump Executive Order Tracker

“The Trump Administration’s executive orders cut across dozens of industries. This searchable tool breaks down the orders and their impact. Akin will update the Tracker as orders are published and provide in-depth analysis of specific orders. Visit Akin’s Trump Executive Order Overview to view a summary. Use the menu below to filter by topic.  Subscribe to regular updates as new orders are published.”

Also via Akin – Trump Executive Order Overview – Below is a high-level overview of Executive Orders published by the Trump Administration. To learn more about an Order, click its title below. Akin will update this list as additional Orders are published. Search by Topics: Administrative Procedure | Artificial Intelligence | Canada / Mexico | China | Communications & FCC | Customs | DEI | Economic Sanctions | Education | Energy | Environmental | Environmental, Social and Governance | Export Controls | Federal Workforce | Financial Services | Foreign Investment | Government Contracts | Health Care & Life Sciences | Immigration | Infrastructure | International Trade | Manufacturing | National Security & Defense | Native American & Tribal | Renewable Energy | Semiconductors  | Space | Tariff | Tax | Technology | Telecom, Media & Technology | Trade Policy | Traditional Energy | Transportation

See also Executive Order Tracker – “Gibson Dunn understands that the flurry of executive orders and other announcements from the White House during President Trump’s opening days is difficult to follow. To assist, we have taken on the assignment of cataloging and digesting each order as it is announced. Below, you will find a searchable and filterable list that includes the executive orders and other significant announcements made to date. The list provides a summary of each order and announcement, along with information on the agencies involved and the subject matters covered. It also includes links to in-depth analyses Gibson Dunn has undertaken on a number of the executive orders. The list will be updated promptly upon the issuance of new announcements and orders…” For additional insights, please visit our resource center, Presidential Transition: Legal Perspectives and Industry Trends.

What percentage of human work is required? Does a prompt count for 49%? (No prompt, no output)

https://variety.com/2025/biz/news/copyright-ai-tools-filmmaking-studios-office-1236288969/

Copyright Office Offers Assurances on AI Filmmaking Tools

The U.S. Copyright Office declared Wednesday that the use of artificial intelligence tools to assist in the creative process does not undermine the copyright of a work.

The announcement clears the way for continued adoption of AI in post-production, where it has become increasingly common, such as in the enhancement of Hungarian-language dialogue in “The Brutalist.” Studios, whose business model is founded on strong copyright protections, have expressed concern that AI tools could be inhibited by regulatory obstacles.

In a 41-page report, the Copyright Office also reiterated that human authorship is essential to copyright, and that merely entering text prompts into an AI system is not enough to claim authorship of the resulting output.

Sensitive to political change…

https://www.cnbc.com/2025/01/28/google-reclassifies-us-as-sensitive-country-like-china-russia-.html

Google reclassifies U.S. as ‘sensitive country’ alongside China, Russia after Trump’s ‘Gulf of America’ comments

… The decision to elevate the U.S. to its list of sensitive countries illustrates the challenges that tech companies face as they try to navigate the early days of a second Trump presidency. Since the start of the year, Meta, TikTok, Amazon and others have adjusted their products and policies to reflect Trump’s political views, policies and executive orders.

Praise is not universal…

https://www.cnbc.com/2025/01/28/us-navy-restricts-use-of-deepseek-ai-imperative-to-avoid-using.html

U.S. Navy bans use of DeepSeek due to ‘security and ethical concerns’

The U.S. Navy has instructed its members to avoid using artificial intelligence technology from China’s DeepSeek, CNBC has learned.

In a warning issued by email to “shipmates” on Friday, the Navy said DeepSeek’s AI was not to be used “in any capacity” due to “potential security and ethical concerns associated with the model’s origin and usage.”

Perspective. A couple obvious and a couple not so obvious.

https://www.npr.org/2025/01/28/g-s1-45056/economy-money-papers-explained

5 economic papers that lit up our brains — and what they say about our confusing world

We at Planet Money are constantly reading the work of economists and other social scientists to glean ideas, evidence and insights about the economy, and, more generally, the confusing world around us. Often this work provides the seeds for episodes or newsletters. But sometimes they're just interesting things we learned privately, and we don't do much with them.

Well, today, we're gonna try and change that. Welcome to the inaugural installment of the Planet Money Econ Roundup! Here are five recent papers that lit up our brains and are maybe worth taking a look at.

Another pendulum swing.

https://pogowasright.org/d-c-cir-compelling-defendant-to-unlock-his-phone-was-a-5a-testimonial-act/

D.C.Cir.: Compelling defendant to unlock his phone was a 5A testimonial act

The 5th Amendment: “No person shall be held to answer for a capital, or otherwise infamous crime, unless on a presentment or indictment of a Grand Jury, except in cases arising in the land or naval forces, or in the Militia, when in actual service in time of War or public danger; nor shall any person be subject for the same offence to be twice put in jeopardy of life or limb; nor shall be compelled in any criminal case to be a witness against himself, nor be deprived of life, liberty, or property, without due process of law; nor shall private property be taken for public use, without just compensation.”

Seen at FourthAmendment.com:

Compelling defendant to unlock his phone was a testimonial act under Hubbell, and it had to be suppressed. (Deciding the Fifth Amendment claim moots need to decide the Fourth Amendment claim.)  United States v. Brown, 2025 U.S. App. LEXIS 1219 (D.C. Cir. Jan. 17, 2025):

So too here. When, in response to the command to unlock the phone, Schwartz opened it, that act disclosed his control over the phone, his knowledge of how to access it, and the existence, authenticity, and ownership of documents within it. In addition, opening the phone was tantamount to answering a series of questions about ownership or control over the phone, including how it could be opened and by whom.

In short, under both the physical-trait and act-of-production caselaw, Schwartz’s compelled unlocking of the phone was testimonial.

Because the compelled opening of the cellphone was testimonial, both the message communicated by that action and any evidence obtained from that communication must be suppressed. See Kastigar, 406 U.S. at 445 (The Fifth Amendment “protects against any disclosures which the witness reasonably believes could be used in a criminal prosecution or could lead to other evidence that might be so used.”); Harrison v. United States, 392 U.S. 219, 222, 88 S. Ct. 2008, 20 L. Ed. 2D 1047 (1968) (“[T]he same principle that prohibits the use of confessions [wrongfully obtained] also prohibits the use of any testimony impelled thereby—the fruit of the poisonous tree, to invoke a time-worn metaphor.”). In unlocking the phone, Schwartz disclosed that he had access to the phone and therefore also the ability to use it, and the government then used those testimonial acts in prosecutorial actions against Schwartz.

Read more at FourthAmendment.com

(Related)

https://pogowasright.org/anonymity-is-not-a-fundamental-right-experts-disagree-with-europol-chiefs-request-for-encryption-back-door/

“Anonymity is not a fundamental right”: experts disagree with Europol chief’s request for encryption back door

Chiara Castro reports:

Crime shouldn’t be an excuse to break encryption. Encrypted communications are either secure – and private – or they are not.

That’s what some experts told TechRadar, commenting on recent Europol’s chief statement.  Talking to the Financial Times, Catherine De Bolle said that technology giants have a “social responsibility” to give the police access to encrypted messages used by criminals.

“Anonymity is not a fundamental right,” she said, arguing that law enforcement needs to be able to decrypt encrypted messages to fight back crime.

Experts, however, warn that creating a backdoor for law enforcement will undermine the protection for all, opening up to unmaintained consequences.

Read more at TechRadar.

The official hallucination generator for the government?

https://www.cnbc.com/2025/01/28/openai-launches-chatgpt-gov-for-us-government-agencies.html

OpenAI launches ChatGPT Gov for U.S. government agencies

OpenAI on Tuesday announced its biggest product launch since its enterprise rollout. It’s called ChatGPT Gov and was built specifically for U.S. government use.

The Microsoft-backed company bills the new platform as a step beyond ChatGPT Enterprise as far as security. It allows government agencies, as customers, to feed “non-public, sensitive information” into OpenAI’s models while operating within their own secure hosting environments, OpenAI CPO Kevin Weil told reporters during a briefing Monday.

Whack-a-mole?

https://www.wired.com/story/deepseek-ai-china-privacy-data/

DeepSeek’s Popular AI App Is Explicitly Sending US Data to China

Amid ongoing fears over TikTok, Chinese generative AI platform DeepSeek says it’s sending heaps of US user data straight to its home country, potentially setting the stage for greater scrutiny.

The United States’ recent regulatory action against the Chinese-owned social video platform TikTok prompted mass migration to another Chinese app, the social platform “Rednote.” Now, a generative artificial intelligence platform from the Chinese developer DeepSeek is exploding in popularity, posing a potential threat to US AI dominance and offering the latest evidence that moratoriums like the TikTok ban will not stop Americans from using Chinese-owned digital services.

DeepSeek, an AI research lab created by a prominent Chinese hedge fund, recently gained popularity after releasing its latest open source generative AI model that easily competes with top US platforms like those developed by OpenAI. However, to help avoid US sanctions on hardware and software, DeepSeek created some clever workarounds when building its models.

(Related)

https://www.wired.com/story/deepseek-chatbot-hands-on-vs-chatgpt/

Hands On With DeepSeek’s R1 Chatbot

DeekSeek’s chatbot with the R1 model is a stunning release from the Chinese startup. While it’s an innovation in training efficiency, hallucinations still run rampant.

The DeepSeek AI chatbot, released by a Chinese startup, has temporarily dethroned OpenAI’s ChatGPT from the top spot on Apple’s US App Store.

The app is completely free to use, and DeepSeek’s R1 model is powerful enough to be comparable to OpenAI’s o1 “reasoning” model, except DeepSeek’s chatbot is not sequestered behind a $20-a-month paywall like OpenAI’s is. Also, the DeepSeek model was efficiently trained using less powerful AI chips, making it a benchmark of innovative engineering.

Perspective.

https://carnegieendowment.org/research/2025/01/the-world-according-to-generative-artificial-intelligence?lang=en

The World According to Generative Artificial Intelligence

Large language models are transforming how humans acquire and interpret information, raising pressing ethical concerns. To mitigate the related risks, policymakers should promote digital AI literacy and develop tools to understand the inherent biases of generative AI tools.

I sense an uptick in the number of articles on the topic of AI authored/invented IP. Could we have some resolution in my lifetime? Perhaps defining the author (or inventor) as the human who asked AI the question?

https://academic.oup.com/jiplp/advance-article/doi/10.1093/jiplp/jpae119/7965768

Understanding authorship in Artificial Intelligence-assisted works

The advent of generative Artificial Intelligence (AI) has brought about a significant shift in the way works are created, with the blurring of boundaries between human and machine-driven creation processes becoming a prominent challenge. This leads to the question of whether authorship in such works exists and, if so, whom it should be attributed to.

This article focusses on an analysis of existing case law of the Court of Justice of the European Union and selected EU Member State courts, in order to find indications about what to consider when examining the authorship of AI-assisted works in the European copyright system.

Ultimately, a four-step test is proposed which aids in assessing whether there is authorship in concrete works and whom it should be attributed to. The first step asks what persons are involved in the creation process before determining—as second step—the kind of AI system used. The third step analyses whether the persons involved exercised a sufficient subjective judgment in the composition of the work; the final step determines whether they had an adequate control over the execution.

(Related)

https://search.informit.org/doi/abs/10.3316/informit.T2025011900005201175533311

'AI is not an inventor': 'Thaler v Comptroller of Patents, Designs and Trademarks' and the patentability of AI

The increasing use of Artificial Intelligence (AI) technologies in inventive processes raises numerous patent law issues, including whether AI can be an inventor under law and who owns the AI-generated inventions. The UK Supreme Court decision in 'Thaler v Comptroller of Patents, Designs and Trademarks' has provided an ultimate answer to this question: AI cannot be an inventor for the purposes of patent law. This note argues, first, that while such a human-centric approach to inventorship might discourage the use and development of AI technologies with autonomous invention capabilities, it will help retain an active human involvement in technologically supported inventive processes and continuously foster human ingenuity. Second, despite the Court focusing on what patent law is and not on what the law should be, the decision will be influential in the ongoing discussions on the future of patent law and will make it more difficult to expand patent law to incorporate non-human inventors. Third, the decision has opened, or revealed, the gaps in patent law that the emergence of AI technologies have created and for which new legal solutions will be needed, especially with relation to the ownership of AI-assisted inventions and the validation of inventorship claims.

Can AI be trusted? An ongoing question.

https://ejournal.bamala.org/index.php/yudhistira/article/view/251

Digital Epistemology: Evaluating The Credibility Of Knowledge Generated By Ai

The rise of Artificial Intelligence (AI) as a key player in knowledge production has transformed traditional epistemological frameworks, necessitating a critical evaluation of its credibility and trustworthiness. This paper investigates the emerging domain of digital epistemology, focusing on how AI challenges established notions of validity, reliability, and trust in knowledge generation. By examining philosophical perspectives and interdisciplinary insights, we identify three primary challenges to AI-generated knowledge: algorithmic biases, the dependence on flawed or incomplete datasets, and the opacity of decision-making processes. These challenges raise significant concerns about the ethical and epistemological implications of relying on AI in contexts such as healthcare, law, and policy-making. Furthermore, this study explores the mechanisms required to evaluate the credibility of AI systems, emphasizing the importance of transparency, explainability, and accountability in fostering trust. We argue that the epistemological relationship between AI and its human users hinges on balancing technological capabilities with ethical considerations, ensuring that AI serves as a tool to complement rather than undermine human autonomy. The findings underscore the need for a robust digital epistemology that adapts classical principles of knowledge to the complexities of the digital era. This framework can guide the development of AI systems that prioritize ethical decision-making and credible knowledge outputs, addressing both theoretical and practical concerns. By bridging philosophy and technology, this paper offers critical insights into the evolving role of AI in shaping how knowledge is produced, validated, and trusted in the digital age.

(Related)

https://jurnal.fs.umi.ac.id/index.php/alpamet/article/view/855

Artificial Intelligence and Lokean Epistemology

This research explores the intersection of artificial intelligence (AI) and John Locke’s epistemology, examining how advancements in AI challenge traditional notions of knowledge and the subject of knowledge. The increasing sophistication of AI systems, which simulate human-like reasoning and learning processes, blurs the boundaries between human cognition and machine intelligence. This study investigates the potential connections between AI and Locke's theory of knowledge, which emphasizes that knowledge arises from sensory experience and reflection. Beginning with a review of Locke’s epistemological principles, including the role of empirical data and the distinction between primary and secondary qualities, the research evaluates how AI’s reliance on vast datasets, machine learning algorithms, and neural networks aligns—or diverges—from Locke’s framework. It questions whether AI systems can possess knowledge in the Lockean sense and examines the epistemic status of AI-generated outputs in terms of reliability, trustworthiness, and biases in training data. The role of human oversight in validating AI-generated insights is also critically assessed. Ultimately, this study contributes to the ongoing discourse on the nature and limits of knowledge in the AI era, challenging traditional epistemological frameworks. By integrating Locke’s principles with contemporary AI developments, it advances the debate on what it means to "know" in a world increasingly mediated by artificial agents, offering a nuanced perspective on the implications of AI for human understanding and the evolving landscape of knowledge.

Useful?

https://digitalcommons.wcl.american.edu/facsch_lawrev/2285/

A Stepwise Approach to Copyright and Generative Artificial Intelligence

In order to understand whether generative AI may infringe copyrights, one must first have a sound grounding in the technical complexities of the “generative AI supply chain.” This Article not only explains the technology in terms accessible to a legal audience, but also explores the doctrinal complexities of how generative AI maps onto existing copyright law. The authors do an admirable job in accomplishing both goals.

First I’ve seen on this topic.

https://houstonhealthlaw.scholasticahq.com/article/128623-artificial-intelligence-and-the-hipaa-privacy-rule-a-primer

Artificial Intelligence and the HIPAA Privacy Rule: A Primer

Consider a medical chatbot that a hospital makes available to patients scheduled for colonoscopies.1 The chatbot uses artificial intelligence (AI)2 to conduct online conversations via text or text-to-speech in lieu of providing patients direct contact with a live person.3 The chatbot, which was designed to improve patient compliance with unpleasant bowel preparation, has been shown to increase the number of people who have successful colonoscopies and decrease the number of people who fail to show for their procedures.4 Given that patients do share sensitive, bowel-related information with the chatbot, one question is whether federal or state laws protect the privacy and security of their information.

Further consider an AI-driven symptom checker that a health system makes available on its website.5

… Consider, too, a physician who uses ChatGPT 8 to generate automated summaries of medical histories and patient interactions.9

… Further consider a health insurer that uses AI to review and, more frequently than not, deny Medicare Advantage claims for elderly beneficiaries notwithstanding their physicians’ documentation showing that their health care services are medically necessary. 13

… Finally, consider the number of large technology companies and startups that are working with health industry participants, including hospitals and health insurers, to research, create, and deploy machine learning healthcare solutions.16