The Privacy Fallacy: Harm And Power In The Information Economy

Our privacy is besieged by tech companies. Companies can do this because our laws are built on outdated ideas that trap lawmakers, regulators, and courts into wrong assumptions about privacy, resulting in ineffective legal remedies to one of the most pressing concerns of our generation. Drawing on behavioral science, sociology, and economics, Ignacio Cofone challenges existing laws and reform proposals and dispels enduring misconceptions about data-driven interactions. This exploration offers readers a holistic view of why current laws and regulations fail to protect us against corporate digital harms, particularly those created by AI. Cofone then proposes a better response: meaningful accountability for the consequences of corporate data practices, which ultimately entails creating a new type of liability that recognizes the value of privacy. Cover Half Title Title Copyright Dedication Contents Acknowledgments Abbreviations Introduction 1. The Traditionalist Approach to Privacy A. Forcing People to Choose Notices, Choices, and Self-management The Fair Information Principles Notices that Don’t Inform Choices with No Options Two Forms of Individual Agreement B. The Binary Blinders Bracketed into a Binary Counting Only Secrets “You Have Nothing to Hide” When You Have Something to Lose 2. Privacy Myths A. The Myth of Rationality Context Dependence Inability to Understand Privacy Policies Impossibility to Estimate Privacy Risks B. The Myth of Apathy The So-called Privacy Paradox Context and Uncertainty Explain Our Behavior Risk Matters There’s No Privacy Paradox C. Exploiting the Privacy Myths Anti-privacy Choice Design Anti-privacy by Default Dark Patterns 3. The Consent Illusion A. Your Privacy Is Not an Island Inferences and Aggregations: Information You Didn’t Agree To Consenting for Others: Personal Information Is Relational De-identified Data: Data No One Consented To B. Unattainable Consent in the Information Economy No Information No Choices No Bargaining The Result: No Power C. Informational Exploitation Privacy’s Moral Hazard Moral Hazard’s Exploitative Outcome The Search for Autonomy in Refusals Consent’s Social Norms 4. Manipulation by Design A. Manipulative Choice Design on Both Sides of the Atlantic Tracking in the EU The Way the Cookies Crumbled Defaults and Informative Notices in the US The Power of Designing Choices B. The Limits of Traditionalist Solutions Information Overload Can Defaults Solve It? Can Contract Law Solve It? C. Improving Tracking Regulations with Behavioral Science Can Notices Be Improved? Can Cookies Be Reduced? Tracking in the Information Economy 5. Traditionalist Data Protection Rules A. Rules for Control Consent in Individual Control It’s Not Right, But It’s OK Consent Burdens B. The Procedural Approach and Its Limits Data Protection’s Procedural Turn Underprotection Overregulation An Example: The Right to Be Forgotten C. Reducing Risks of Harm Prohibiting High-Risk Data Practices A Shift to Legal Standards Information Fiduciaries: The Standard of Loyalty 6. Pervasive Data Harms A. What Privacy Liability Is For Data Harms Privacy Harm and Consequential Data Harms The Problem: Harm under the Privacy Fallacy Harm through Procedure at the Court Level B. Privacy Losses and Harms Loss by Data Collection and Inferences Loss by Data Sharing and Leaking Harmful Privacy Losses Privacy Harm as Harm to Privacy’s Values The Role of Social Norms C. Why Have Privacy Liability Second-Generation Liability Depends on Privacy Harm Privacy Harm Liability Can Address Persistent Privacy Problems Intrinsic Privacy Harm Surmounts Objections to Liability 7. Privacy as Corporate Accountability A. Harm-based Privacy Liability Legal Pathways A New Private Right of Action Improving Existing Law Absent a Standard An Illustration: Grindr’s Oversharing B. The Basis for Privacy Liability Statutory No-fault Liability for Consequential Harms Tortious Strict Liability Intentional and Negligence Liability for Privacy Harm Mixed Private–Public Enforcement C. Procedural Aspects of Harm-based Privacy Liability Evidence and Compensation Group Privacy Harms The Importance of Collective Redress Why Privacy Claims Fit Class Actions Overcoming Objections through Representative Actions Conclusion Notes Introduction 1. The Traditionalist Approach to Privacy 2. Privacy Myths: Rationality and Apathy 3. The Consent Illusion 4. Manipulation by Design 5. Traditionalist Data Protection Rules 6. Pervasive Data Harms 7. Privacy as Corporate Accountability Conclusion Index