This article is part of the 2023 BCLT-BTLJ Symposium.
By Chris Conley1
“Artificial intelligence” (AI) is everywhere these days, from Waymo’s ongoing pilots of self-driving cars2 to OpenAI’s publicly-available ChatGPT chatbot.3 The currently dominant form, machine learning (ML), relies on models derived from vast sets of data, potentially including personal information about millions of unknowing individuals.4 The end product may not only be derived from that data, but also intended to generate additional data about that same population.5 The training of AI models on personal information and their subsequent use to generate inferences or predictions both implicate the informational privacy and personal autonomy concerns that motivates many privacy laws.
Current efforts to address AI models through privacy law have focused primarily on the collection and use of personal information to build those models. ClearviewAI settled a complaint that its practice of collecting and using photographs without consent violated the Illinois Biometric Information Privacy Act, forcing the company to change its business practices nationwide.6 The FTC also settled an enforcement action against EverAI alleging that the company trained a face recognition model on consumer data acquired under false pretenses.7 OpenAI faces a recently filed suit challenging its data collection practices as well.8
The last of those includes the claim that OpenAI’s practice of scraping consumer data violates the California constitutional right to privacy.9 As courts have noted, that right “was enacted in part specifically to protect Californians from overly intrusive business practices that were seen to pose a significant and increasing threat to personal privacy.”10 The drafters of the ballot initiative deemed “the improper use of information properly obtained for a specific purpose, for example, the use of it for another purpose or the disclosure of it to some third party” one of the “mischiefs” that the amendment was explicitly intended to address.11 And in White v. Davis, the California Supreme Court confirmed that the Amendment’s concept of privacy encompassed “the accelerating encroachment on personal freedom and security caused by increased surveillance and data collection activity in contemporary society.”12 Building AI models from vast amounts of personal information that were not knowingly, let alone willingly, provided for that purpose appears to be precisely the behavior that the right to privacy is meant to address.
To succeed in court, the OpenAI plaintiffs must demonstrate that OpenAI’s actions not only violated consumers’ reasonable expectations of privacy but that the violation was serious enough to merit judicial relief.13 As the plaintiffs argue, the collection of vast amounts of information that can be used to draw inferences about every facet of an individual’s life may already constitute “highly offensive” behavior.14 But the purpose of that collection also implicates the constitutional right to privacy. AI models can be used to surveil, to infer, to predict, and to influence the same population of consumers whose data is used in their creation. In doing so, they implicate not only the informational privacy aspect of the right to privacy but also the autonomy aspect as well.15 If being examined, tracked, and influenced by a tool built from your own personal data isn’t offensive, what is?
Nowhere is the impact of AI use on the right to privacy clearer than in the use of those models by law enforcement and other government entities. If the principle aims of the right to privacy include “limit[ing] the infringement upon personal privacy arising from the government’s increasing collection and retention of data relating to all facets of an individual’s life,” that should include the creation of data through the use of AI models.16 The probabilistic or inferential nature of that data is no defense; indeed, the threat of “the lack of a reasonable check on the accuracy of existing records” is itself a “mischief” that the right to privacy was meant to address.17
As California courts proudly assert, the Privacy Amendment offers protections that extend beyond the Fourth Amendment.18 Its inalienable right to privacy applies against private parties who assemble and sell AI models. Its broad scope, encompassing autonomy as well as informational privacy, has helped keep it vibrant five decades after its enactment. That makes the California constitutional right to privacy one of the most promising tools to confront the surreptitious development and harmful uses of modern data-hungry and data-derived tools such as AI.