Starting in 2018, U.S. states began to enact broad consumer privacy laws. California was the first with the California Consumer Privacy Act (CCPA). By 2026, nearly half the states had enacted similar laws.

At first, the laws can seem like a daunting patchwork, but below, I’ll provide you with a primer that can help you understand them.

Many are structured similarly and take similar approaches. They have differences, but there are more commonalities than divergences.

Scope and Applicability

All the laws are extraterritorial—they apply to entities beyond state borders that do business in the state or collect data about state residents.

Most laws aim to exempt small businesses, and they have revenue and/or resident thresholds. Some laws explicitly exempt small businesses as defined by the U.S. Small Business Administration.

Many laws exempt non-profits and higher ed, though there are several that don’t.

All the laws exempt data covered by federal laws such as HIPAA, FERPA, GLBA, and others.

Basic Approach

Nearly all laws take the notice-and-choice approach, allowing entities significant freedom to determine how they want to collect and process data. They must provide notice about their data collection and processing.

Individuals can opt out of certain data collection, use, or transfers.

Many laws require opt in for sensitive data, and a few ban the sale of certain types of data.

Personal Data

All the laws adopt GDPR-style definitions of personal data, recognizing identified and identifiable data.

Most laws exempt publicly-available data.

Sensitive Data

All the laws provide heightened protection for sensitive data. Most laws require opt in and a privacy impact assessment to collect or process sensitive data. The laws differ on the categories of data they recognize as sensitive.

Some of the most commonly recognized categories of sensitive data include:

Other types of recognized categories include:

Individual Rights

Nearly all the laws provide for the following individual rights:

• right to know

• right to access

• right to correct (except Iowa)

• right to delete

• right to data portability

Most laws provide for a right to opt out of certain types of data processing:

• targeted ads

• profiling

• sale of data

A few states provide for automated profiling decision rights, such as a right to question the result of profiling, be informed of the reason for a decision, review data used in the decision, and have the decision reevaluated if data was incorrect

Responsibilities for Data Processing

Most laws require the following responsibilities for data processing:

Some laws have special additional responsibilities and restrictions. A few examples include:

• Maryland has a strict data minimization requirement, especially for sensitive data.

• Some states have provisions that deem dark patterns to be invalid consent.

• Some laws have additional restrictions for children’s data.

Enforcement

Most laws are enforced by state attorneys general. But California has a designated agency to enforce its law.

Most laws have fines for violations, which typically range from $5K to $10K. Some laws have large fines, including up to $50K.

Most laws lack a private right of action, except California, which has one for data security violations.

Many laws have a right to cure (30-60 days). Some sunset but others are permanent.

My Free Guide

If you found this post useful, I hope you download my free guide to U.S. state consumer privacy laws. The guide includes the information above plus a page for each state’s privacy law with key points about each law.

I put a ton of time into this to help make understanding the patchwork readily digestible. I hope you find it useful.

My Training

If you’re looking for privacy or data protection training for your organization, please check out my courses. Through TeachPrivacy, I provide workforce privacy, cybersecurity, and AI training to companies and organizations around the world.

Daniel J. Solove is the Bernard Professor of Intellectual Property and Technology Law at the George Washington University Law School. He is the author of 10+ books and 100+ articles. You can follow his events, writings, training, cartoons, and resources by subscribing to his free weekly newsletter.

I’ve curated a list of recent works on privacy, AI, and tech that will be worth your time checking out.

Authors included:

• Orin Kerr

• David Sella-Villa

• Susan Tanner

• Tonja Jacobi

• Elyse Ackermann

• Cory Doctorow

• Christina Lee

• Nel Escher

• Nikola Banovic

• Ben Green

• Najarian Peters

• Danielle Keats Citron

• Spencer Overton

• Ari Ezra Waldman

• Katrina Geddes

• Emily Benfer

• Joseph Turow

Government Surveillance and
the Fourth Amendment

Orin S. Kerr, The Fourth Amendment After Chatrie (2026)

Kerr weighs in on Chatrie v. United States, a key Fourth Amendment case decided by the U.S. Supreme Court this term. It has been a long time since the Supreme Court issued a Fourth Amendment ruling, and Kerr views Chatrie as a “blockbuster.” Kerr contends that “Chatrie presents itself as an application of precedent, but a close read shows that it repeatedly recasts old cases and adopts new principles for the Fourth Amendment. Chatrie is now the most important Fourth Amendment case on new technology, and it throws into question a wide range of existing surveillance practices.” Kerr argues that Chatrie can be read in three possible ways, each with different implications.

If you’re interested in my take on Chatrie, I wrote about the case in this short essay: Is the Fourth Amendment Third Party Doctrine Dead? Thoughts on Chatrie v. United States

David Sella-Villa, The Third-Party Privacy Problem, 27 N.C. J. L. & Tech. 411 (2026)

Most data privacy laws apply to “personal data” which is identified or identifiable to individuals. But data from “external sensor systems allow vehicle manufacturers, providers of automated driving systems, regulators, researchers, other market participants, and law enforcement to readily identify groups, but not necessarily individual people. These group classifications facilitate decisions that affect the rights and interests of third parties, and privacy law offers these people little recourse.”

Sell-Villa argues that even without identifying people, the “data collected from external sensors on vehicles” can affect privacy interests, and privacy law must address this gap.

Susan Tanner, From Data to Decisions: Why AI Inferences Should Count as ‘Effects’ Under the Fourth Amendment, 27 Minn. J.L. Sci. & Tech. 287 (2026)

Tanner argues that data brokers and inferences are two gigantic loopholes in Fourth Amendment protection. She contends that “AI-generated inferences should be treated as constitutionally cognizable ‘effects’ within the meaning of the Fourth Amendment’s protection for ‘persons, houses, papers, and effects.’”

As Tanner elaborates: “While ‘effects’ has traditionally been understood to refer to personal property, its broader meaning encompasses anything that affects or pertains to an individual. Algorithmic inferences are quintessentially personal: they are about specific individuals, they purport to reveal intimate characteristics, and they are used to make decisions that profoundly affect those individuals’ lives.”

She also argues: “Traditional Fourth Amendment analysis has focused on individual privacy interests: does the particular search or seizure intrude upon a particular person’s reasonable expectation of privacy? This Article proposes that the Fourth Amendment’s reasonableness inquiry should also account for structural democratic harms, particularly when surveillance is deployed at scale to manipulate political information environments.”

Tonja Jacobi and Elyse Ackermann, Shadow Technology, Mass Surveillance, and the False Promise of Carpenter (2026)

Jacobi and Ackermann argue that the U.S. Supreme Court case, Carpenter v. United States, the leading case involving digital surveillance before this term’s Chatrie case, has “provided little guidance or constraint on other forms of covert dragnet monitoring beyond cell-site location information.” They argue that the government employs “shadow technologies” that are in use “for years before the public learns about them.” The government conceals these technologies by “‘rediscovering’ the evidence they unveil through other means” which creates “‘shadow evidence’—vital information obtained through secret technology and never disclosed to the public or even defendants.” They propose reforms to shine the light on this shadowy world.

Artificial Intelligence

CORY DOCTOROW, THE REVERSE CENTAUR’S GUIDE TO LIFE AFTER AI (2026)

In a provocative and essential book, Cory Doctorow argues that AI has been over-hyped and the dystopian future many fear it might bring is not inevitable. A “centaur is a person who is assisted by a machine” and a “reverse centaur is a human who is conscripted into acting as an assistant to a machine.” He writes:

I’ll be discussing Cory’s book with him on LinkedIn Live on Monday, Sept. 21 at 11 AM ET. Please register (free) here.

Christina Lee, AI Agents’ Shadow Principals, 17 U.C. Irvine L. Rev. ___ (forthcoming 2027)

Christina Lee examines how the law should govern AI agents, which “pose distinct harms.” She notes that although agency law appears like a fit for AI gents, “today’s agency law does not have the tools to adequately reason through the role an AI agent’s developers play in transactions mediated through the AI agent.” The reason is because “the companies that design, build, and market AI agents for users to deploy—are what I call the shadow principals of the AI agent, exerting persistent, extensive, obscured, though incomplete influence over an AI agent’s actions even as it acts purportedly on behalf of the user.” Agency law fails to account for the role these companies play.

Nel Escher, Nikola Banovic, and Ben Green, Algorithm Auditing Policies Rest on Flawed Assumptions About Public Sector Systems (2026)

The authors examine the role and efficacy of regulations that require auditing of algorithms. They argue: “While audit policies conceptualize harm as discriminatory bias, government algorithms can produce a much broader range of issues, including misallocation of public resources and violations of due process. While audit policies investigate algorithms as static and isolated pieces of software, these systems are dynamic and embedded in complex relationships with other technical systems and human practices. While audit policies envision that problems uncovered by audits will be corrected, many public agencies lack the capacity to fix or replace automated systems.”

Privacy, Race, and Ethnicity

Najarian R. Peters, Racial Privacy I: The Quest for Whiteness by European Immigrants in America, 23 U.C. L.J. Race & Econ. Just. 183 (2026)

Peters examines the practice of racial passing in the U.S. She focuses on European immigrants who became White in America. As she contends: “Many immigrant Europeans were not viewed or treated as the same race as White Anglo Saxons but were eventually allowed to be classified as Whites socially and by law. These groups were encouraged to suppress their different racial identities to access Whiteness, through assimilationist methods. Their descendants inherited racial Whiteness, many were encouraged to forget their racial backgrounds, and with the assistance and protection of law and governmental policies, throughout the nineteenth and twentieth centuries, they maintained their new racial status as White.”

Peters observes that certain groups were able to be classified as Whites but others were not. Her article “excavate[s] an area of privacy practice that has been largely unacknowledged and therefore, undertheorized: the existence, meaning, and value of racial and ethnic privacy in America, as one of its oldest and arguably self-evident traditions, that paved the way for millions of people to achieve the American Dream, while denying the same to so many others.”

Danielle Keats Citron and Spencer Overton, Digital Ethnonationalism U. Pa. L. Rev. (forthcoming 2026)

Citron and Overton develop the concept of “digital ethnonationalism,” which is “the design and operation of opaque algorithmic systems and policies that reproduce racial and religious hierarchy and cultural homogeneity at scale.” They argue: “For those committed to liberal, pluralistic democracy, the first step is to identify digital ethnonationalism and to develop strategies to recognize, cabin, contain, and navigate it within technology development, governance, law and policy. There is no silver bullet-effective responses are multifaceted and context-specific. Still, several core principles should guide action, including fairness (mitigating bias and proxy discrimination), pluralism (advancing linguistic, cultural, and epistemic diversity), autonomy (constraining covert behavioral manipulation and preserving meaningful human agency), and dignity (treating marginalized groups and women with respect so that they can participate in the networked age).”

Children’s Privacy

Ari Ezra Waldman and Danielle Keats Citron, Youth Privacy’s Constitutional Reckoning, Georgia L. Rev. (forthcoming 2026)

Waldman and Citron argue that U.S. Supreme Court jurisprudence about parental rights is “misplaced and harmful” when dealing with issues of “corporate exploitation.” As they elaborate: “Parental rights emerged from litigation where parents fought for the right to impart their religious beliefs and traditions to their children as they wished, whether in the home, school, or community. However, vast structural differences exist between the contexts in which parents pass on religious beliefs and those in which parents aim to protect children’s data from corporate exploitation.” Applying this jurisprudence deny youth “the privacy that they need to thrive and forge relationships, including with their parents. “ The “parental control model results in contests over the authority of the state, parents, and children (with children hardly ever in view).” They contend that “rather than focusing simply on decisionmaking authority, youth privacy debates should ask: Who benefits and who loses? Whose interests are being ignored or worse damaged? What political agendas are being empowered or disempowered?”

Other Privacy Issues

Katrina Geddes, The Inconsentability of Deep Fakes, Harv. J. L. & Tech. (forthcoming 2027)

Geddes critiques the creation of deepfake images and videos. She argues that not only is the non-consensual creation of deepfakes wrong, but even the consensual creation of such content can be problematic because “certain uses of our AI likeness may be fundamentally inconsentable.” She contends that “the legitimacy of AI-generated content does not turn on the presence or absence of individual consent.”

Emily A. Benfer, Dismantling The “Scarlet E”: Eviction Record Privacy As Health Justice, 86 Ohio St. L.J. 1081 (2025)

Emily Benfer examines the way evictions can lead to blacklisting of tenants and can become a scarlet letter. She writes: “Because there are few limits on who has access to court records or how long they remain available, the stain of a single eviction filing severely restricts future housing opportunities.” She calls it the “Scarlet E.” She observes that there is “a lucrative market for rental screening tools and motivation to take advantage of the right to access court records.” More than 2,000 companies offer these tools. Benfer “applies the Health Justice Framework to the ‘Scarlet E’ and open access to eviction court records as a roadmap for achieving health and housing equity, while preserving the fundamental principle of open access to the courts.”

She has written a short essay based on her article here.

JOSEPH TUROW, THE PROBLEM WITH PERSONALIZATION: HOW ADVERTISERS LEARNED TO MAKE AND BREAK US FROM ANCIENT TIMES TO THE AI AGE (2026)

Turow’s book examines the history of personalization and its present, which is hyper-tailored with AI. He argues:

I agree with Turow’s point about the societal impact of personalization but would qualify his claim about those who haven’t considered this impact. Although many policymakers have failed to do so, many privacy scholars have long critiqued individualistic conceptions of privacy. For a discussion of the literature, see my piece with Woodrow Hartzog, Kafka in the Age of AI and the Futility of Privacy as Control, 104 B.U. L. Rev. 1021 (2024).

Daniel J. Solove is the Bernard Professor of Intellectual Property and Technology Law at the George Washington University Law School. He is the founder of TeachPrivacy, a company that provides workforce privacy, cybersecurity security, and AI training to companies and organizations around the world. He is the author of 10+ books and 100+ articles.

You can follow his events, writings, training, cartoons, and resources by subscribing to his free weekly newsletter.

In 1924, Yevgeny Zamyatin wrote a dystopian novel called We, which influenced countless dystopian authors, especially George Orwell’s Nineteen Eighty-Four. Zamyatin (1884-1937), a Russian author, was a popular figure in Russian society until the Soviet Revolution. He was increasingly pushed out of the literary scene before writing We.

Dystopia and We’s Influence

In the preface to his wonderful anthology of dystopian stories, Brave New Worlds (Dystopian Stories) (2012), John Joseph Adams writes:

We wasn’t the first influential dystopian story of the twentieth century. Earlier works include E.M. Forster’s short story “The Machine Stops” (1908) and Jack London’s The Iron Heel (1908).

But We captures the ruthless elements of totalitarianism in ways that especially resonate with Aldous Huxley’s Brave New World (1932) and Orwell’s Nineteen Eighty-Four (1949).

Kurt Vonnegut noted that We and Brave New World influenced his novel, Player Piano (1952): “I cheerfully ripped off the plot of Brave New World, whose plot had been cheerfully ripped off from Yevgeny Zamyatin’s We.” Huxley denied that his novel was influenced by We, but Orwell thought so.

Another notable dystopian novel owes a profound debt to We—Karin Boye’s Kallocain (1940). Sandwiched between Huxley and Orwell, Boye’s novel failed to achieve the fame of Orwell or Huxley, but it deserves to be ranked with them and We as one of the great dystopian novels of the twentieth century. Similar to We and Nineteen Eighty-Four, Boye’s novel involves a surveillance society where individuality is oppressed, where everyone rats on each other, and where there is no trust. Boye’s unique dimension involves a scientist who invents a drug called Kallocain that forces people to tell the truth.

Surveillance and Loss of Individuality

We takes place in a totalitarian society (called the “OneState”) where everything is regimented. Buildings are constructed of glass so people can be watched nearly all the time.

Although surveillance plays a key role in this novel, the predominant theme is the loss of individuality. People don’t have names – they are referred to by numbers. The narrator is called D-503.

People live in a world of total control. The state government is called the “Benefactor” which watches over everyone with the aid of its secret police, called the “Bureau of Guardians.” People’s days are highly regimented so that everyone is the same and acts in unison.

The novel centers around D-503, who becomes involved with a woman, I-330, who tells him that she is part of the Mephi, a resistance group. Ultimately, influenced by I-330, D-503 begins to transgress the law.

From Believer to Transgressor

Highly relevant for We are further words from Adams:

Unlike Winston in Nineteen Eight-Four, the narrator of We begins as a believer in the OneState. But as the novel proceeds, his thinking evolves. Like Orwell’s Nineteen Eighty-Four, where Big Brother tortures Winston until he becomes compliant, the OneState catches up with D-503 and alters his thinking in horrifying ways.

In an illuminating essay, Jacob Howland observes that Zamyatin was heavily influenced by Fyodor Dostoyevsky:

We is very much a commentary on the Soviet Union, and it’s amazing Zamyatin and his book were able to escape. We was smuggled out of the country and wasn’t published there until 1988. It was first published in an English translation in 1924.

In 1931, Zamyatin wrote a letter to Stalin asking to be expelled from the USSR, and he was granted permission to be exiled. He spent the last six years of his life in Paris and died in poverty in 1937.

Taylorism

In the forward to an edition of We, journalist Masha Gessen writes:

While it is true that We involves a tyranny of efficiency and rational order, I don’t see this as a “mistake” or shortcoming. Generally, too much of anything is bad, and dystopias involve societies that have taken things to the extreme to stifle individuality and impose control. Huxley’s vision was the use of pleasure; Orwell’s was raw authoritarian power to demand people believe irrational things and distrust their own senses.

We focuses on a different dimension. It is a critique of Taylorism, the theory of Frederick Winslow Taylor that propounded the meticulous measurement of workers and the scientific management of the workplace for maximum efficiency.

This was the philosophy Henry Ford used in his factories, and although Taylorism is seen as dystopian today, it is very much alive and common in the corporate world.

Ursula Le Guin called We “the best single work of science fiction yet written.” I’m not sure I’d go that far, but I think We remains highly relevant today. It warns us about ruthless surveillance and the oppression of individuality. But even more relevant is its general warning about the sacrifices society makes for efficiency and order. Today’s equivalents include fulfillment centers, data centers, gig economy apps, data brokers, Flock cameras, DOGE, facial recognition systems, and many of the other things that Big Tech, corporations, and the government are doing.

My Other Essays of Interest

• Orwell vs. Huxley: Which Dystopia Was More Prescient?

• A Century Ago, E.M. Forster’s “The Machine Stops” Predicted How AI and Digital Tech Are Hollowing Us Out

  ---

  Daniel J. Solove is the Bernard Professor of Intellectual Property and Technology Law at the George Washington University Law School. He is the founder of TeachPrivacy, a company that provides workforce privacy, cybersecurity security, and AI training to companies and organizations around the world. He is the author of 10+ books and 100+ articles.

  You can follow his events, writings, training, cartoons, and resources by subscribing to his free weekly newsletter.

Isaac Asimov’s satirical short story “Franchise” is highly relevant for today. The story was published in 1955 in the magazine If: World of Science Fiction.

The story depicts the absurdity of algorithmic predictions. A machine decides elections based on one voter to predict the results of the entire election.

Since people were “impatient” about tallying all the votes, “they invented special machines which could look at the first few votes and compare them with the votes from the same places in previous years. That way the machine could compute how the total vote would be and who would be elected.” Later on, “they built Multivac and it can tell from just one voter.”

One year, a man named Norman Muller is chosen as the voter. As is explained to Muller:

Muller is reluctant to participate, but his family convinces him. He is “encased in machinery” and the machine will ask him questions. As the officials explain to Muller:

Later on, we learn some of the questions Muller was asked. Uncannily prescient, the story anticipates a key refrain about the 2024 Presidential election about Trump winning because of the high price of eggs: “The one question Normal could remember at the moment was an incongruously gossipy: ‘What do you think of the price of eggs?’”

Norman is sworn to secrecy about the questions and his responses because the “less is known about the Multivac, the less chance of attempted outside pressures upon the men who services it.”

Too Much Faith in Technology

The humans fail to engage in critical thinking about Multivac; they blindly accept its authority and infallibility.

There’s a key lesson for today, as we still see way too much faith in technology. These days, we’re being gaslighted about AI, told constant tall tales and wild claims of AI being nearly conscious, of singularity being just minutes away.

Problems with AI Predictions

Although the story was satirical at the time, algorithmic predictions of a similar nature are being made today, leaving the main satire as having the prediction turn on the variable of person’s vote. Though modern algorithmic predictions are even made from aggregate data without the drama of gathering final pieces of data from one “representative” person.

Another absurdity is that a matter as important as an election would be left to a machine’s prediction, but currently, many matters are being made via algorithmic prediction, including decisions about hiring, credit worthiness, education, pretrial detention, and criminal sentencing.

The problem with AI predictions is that they are “snake oil” according to computer scientists Arvind Narayanan and Sayash Kapoor, who argue: “Accurately predicting people’s social behavior is not a solvable technology problem, and determining people’s life chances on the basis of inherently faulty predictions will always be morally problematic.”

As Hideyuki Matsumi and I wrote:

Unfortunately, AI predictions are spreading, and they are being trusted when they ought not to be. Carissa Véliz argues that predictions” can create a false sense of safety.” They beguile us with a feeling of certainty in a world of chance and contingency, where so much is out of our control and beyond our ability to predict or know for certain.

Consider the case of State v. Loomis, 881 N.W.2d 749 (Wis. 2016). A defendant was sentenced based on an AI prediction he was likely to commit future crimes. He argued he should be able to see how the AI algorithm worked to understand why it gave him a high recidivism risk. COMPAS, the company that created the algorithm, claimed that it was a trade secret. The Wisconsin Supreme Court rejected Loomis’s claim, choosing COMPAS’s trade secret over Loomis’s right to due process.

State v. Loomis enshrined into law an unjustified faith in tech. Far too often, companies, government officials, judges, and policymakers turn to tech to produce magic. They are spellbound by the self-interested hyped-up claims of tech companies. Asimov’s “Franchise” shows how ridiculous this faith is.

For Further Reading

Isaac Asimov, “Franchise” (1955)

Daniel J. Solove, Dangerous Oracles: Minority Report, Philip K. Dick, and AI Predictions, Substack (May 22, 2026)

Hideyuki Matsumi & Daniel J. Solove, The Prediction Society: Algorithms and the Problems of Forecasting the Future, 2025 U. Ill. L. Rev. 1 (2025)

Arvind Narayanan & Sayash Kapoor, AI Snake Oil: What Artificial Intelligence Can Do, What It Can’t, and How to Tell the Difference (2024)

Carissa Véliz, Prophecy: Prediction, Power, and the Fight for the Future, from Ancient Oracles to AI (2026)

Daniel J. Solove is the Bernard Professor of Intellectual Property and Technology Law at the George Washington University Law School. He is the founder of TeachPrivacy, a company that provides workforce privacy, cybersecurity security, and AI training to companies and organizations around the world. He is the author of 10+ books and 100+ articles.

You can follow his events, writings, training, cartoons, and resources by subscribing to his free weekly newsletter.

I created this cartoon because I often hear older people scoff at how younger people don’t care about privacy because they’re exposing so much of their lives. But I find these sentiments to be chutzpah because young people are exposing their lives due to the way technology is nudging, pushing, cajoling, manipulating, coercing, and outright forcing them to do so. Older generations have built the world the younger ones are growing up in, and so they are responsible for the lack of privacy younger generations are experiencing.

When they decry how younger generations are surrendering their privacy, older generations are just blaming the victims. Younger people aren’t willingly giving up their privacy—they’re living in a world where having privacy is increasingly difficult and often impossible.

More than a decade ago, I wrote a post about young people’s views about privacy. I think it still holds up today, and I’m posting it below with just a few minor tweaks.

Yes, Young People Do Care About Privacy

A common argument I hear is that young people just don’t care about privacy. If they cared about privacy, why would they share so much personal data on Facebook? Why would they text so much? Why would they be so cavalier about their privacy? Privacy will be dead in a generation, the argument goes.

This argument is wrong for several reasons. Studies show that young people do care about privacy. Aa study by Chris Hoofnagle and others revealed that young people’s attitudes about privacy didn’t differ much from older people’s attitudes. A study sponsored by Microsoft found that “[p]rivacy and security rank as college students’ #1 concern about online activity.”

But what accounts for the behavior of sharing so much personal data online? First, young people—especially teenagers—might not be thinking through the consequences of their actions. It doesn’t mean they will never care about privacy; they might care about privacy at a point in the future.

Second, new technologies are a major fact of their lives. We live in a world now where it is becoming increasingly hard to forgo using these technologies, especially when they are very useful and beneficial.

Third, the technologies can make it easier for people to share information without the normal factors that can make people fully comprehend the consequences. If people were put in a packed auditorium, would they say the same things they say online? Most likely not. That’s because when people post online, they don’t see hundreds or thousands of faces staring at them. Seeing all those people visually drives home the consequences more than just seeing a computer screen. People also say things online that they’d never say to another person face-to-face.

Fourth, young people have a very nuanced understanding of privacy. They don’t see privacy as simply keeping secrets. They understand privacy as controlling information flow. It is rare these days to be able to hide information from absolutely everyone. There are too many technologies that capture images and information. Instead, people control who sees their information. They set their social media profiles to allow certain people to have access but others not to have access. They allow some companies to have their data but do not want others to access it or want it used in some ways but not others. Privacy isn’t all-or-nothing – it’s about modulating boundaries and controlling data.

Daniel J. Solove is the Bernard Professor of Intellectual Property and Technology Law at the George Washington University Law School. He is the founder of TeachPrivacy, a company that provides workforce privacy, cybersecurity security, and AI training to companies and organizations around the world. He is the author of 10+ books and 100+ articles.

You can follow his events, writings, training, cartoons, and resources by subscribing to his free weekly newsletter.

There is recent talk about taxing AI, which is probably a non-starter with policymakers adverse to doing anything to stand in the way of tech companies. But the tax idea isn’t totally crazy because AI these days is, for all practical purposes, a major tax on society.

Although AI has many beneficial uses, it remains unclear whether AI would be viable in the market if it weren’t artificially propped up by constant cash infusions by big gambler investors and by evading costs by sloughing them off on everyone else.

Unlike other technologies such as search, AI is tremendously expensive. There are many uses of AI that might not be sustainable in the market without venture capitalists pumping in massive investments. AI companies are shoving their AI in our faces at every turn, throwing it up against the wall in a frantic effort and hope that something sticks.

There certainly will be uses of AI that will provide more benefit than cost, but it’s hard to figure that out when there’s so much distortion of the market. Normally, the market would work as a mechanism of survival of the fittest, weeding out business models that don’t really work. But AI is growing today not because it is fit for survival; it’s being propped up.

AI imposes tremendous costs which operate as a tax on society. These are costs that AI companies are externalizing on all of us. Examples include:

Physical Resources

AI consumes resources such as water and electricity at massive levels. We all pay for this in higher utility prices, environmental impacts, and depleted water, among other things. It can affect farmers, and increase the cost of food.

Personal Data

AI is trained on our personal data, which companies scrape off the internet in violation of nearly every privacy principle and also in violation of many laws. I wrote about this problem with Woodrow Hartzog in The Great Scrape: The Clash Between AI Scraping and Privacy,113 Cal. L. Rev. 1521 (2025). At a minimum, it’s far from clear that AI companies are entitled to gather and use our data; just because it’s online doesn’t mean it’s free for the taking.

If companies couldn’t just hoover up our personal data and if they had to provide privacy protections for it, the cost of training their models would go way up and in many cases, they would have restrictions on their collection and use of data.

Intellectual Property

AI is also trained on our intellectual property. It’s far from clear that AI companies can just take whatever they want online and use it however they want. The tech company ethos is that if something is out there without iron walls around it, then they can just swoop in and take it. What if they had to pay for what they took?

Displacement and Disruption

AI also operates as a cost on everyone it displaces—all the creators whose livelihoods are undermined, all the workers it replaces. All these people are bearing the cost. Some tech leaders propose a universal wage to offset these costs, but it sounds like trickle down. I’m sure the universal wage, if it ever were to come to pass, would be a pittance, likely what people are paid for jury duty. And it won’t come to pass, because the one thing billionaires today hate the most is to share even a nickel with anyone else.

Labor to Clean Up Its Messes

AI also imposes problems that create significant labor for many people. In academia, schools must deal with the mess AI is causing with students who use AI improperly. Detection tools for AI use are extremely unreliable. A ridiculous number of hours are being spent dealing with the fallout. Journals for non-fiction and fiction are dealing with a tsunami of AI-generated submissions. They’re drowning. And in countless other areas of life, AI is creating headaches that are taking time, money, and resources to deal with. In many ways, AI is creating a nuisance that society must suffer from, like a toxic waste dump in all our backyards.

Harm

AI is causing real harm to many people, from deep fakes to encouraging self-harm to feeding delusional thinking. There are many tragic cases, a trail of tears and blood and death. As tech companies race along the superhighway to AI utopia, they ignore the gravestones along the side of the road. But these are real costs, real people, real lives.

* * *

All that said, I don’t hate AI. It has a lot of promise and has the potential to do a lot of good. Unfortunately, it has been unleashed on society in the worst possible way, like new neighbors who show up at your door to introduce themselves while their dog takes a big dump on your lawn.

It would be great if AI were to be rolled out responsibly, playing by the same rules as everyone else, with companies fully internalizing the costs. Instead, companies shirk the rules, lobby to undermine even the weakest of controls, fuel antidemocratic and socially destructive politics to further their aims, and slough off most costs on everyone else.

It’s high time AI were subjected to normal market forces, internalizing its costs. Then we’d see the areas where AI is truly promising.

Daniel J. Solove is the Bernard Professor of Intellectual Property and Technology Law at the George Washington University Law School. He is the founder of TeachPrivacy, a company that provides workforce privacy, cybersecurity security, and AI training to companies and organizations around the world. He is the author of 10+ books and 100+ articles.

You can follow his events, writings, training, cartoons, and resources by subscribing to his free weekly newsletter.

I’ve curated a list of recent works on privacy, AI, and tech that will be worth your time checking out. Authors included:

• Graham Greenleaf

• Ella Corren

• Cindy Cohn

• Andrew Guthrie Ferguson

• Alicia Solow-Niederman

• Laura Moy

• Mark P. McKenna

• Woodrow Hartzog

• Maria P. Angel

• Christina Lee

• Zina Makar

• Elettra Bietti

• Peter Ormerod

Graham Greenleaf, The Global Trajectory Of 50 Years of Data Privacy Laws: Will It Continue?, 199 Privacy L. & Bus. Int’l Report 14 (2026)

Greenleaf provides a concise overview and history of the last 50 years of privacy law development.

Ella Corren, Privacy Law’s Reality Check, 31 Colum. J. European L. 118 (forthcoming 2026)

Ella Corren argues that current privacy laws are “misaligned with the structural realities of the data-driven economy.” She contends that there is too great a focus on “procedural compliance and observable behaviors, neglecting firms’ opaque data practices and the broader systemic effects of surveillance capitalism.”

CINDY COHN, PRIVACY’S DEFENDER: MY THIRTY-YEAR FIGHT AGAINST DIGITAL SURVEILLANCE (2026)

Cindy Cohn, the former Executive Director of the Electronic Frontier Foundation (EFF) has written an engaging and insightful memoir of her life and professional career in the trenches fighting for privacy. She discusses the fight to free encryption from government backdoors and restrictions, litigation in response to NSA spying on people after the 9/11 attacks, and attempts to curtail National Security Letters (NSLs).

She writes: “In my thirty years of these fights, the government consistently exaggerates the risks—calling the use of encryption ‘going dark’ and making apocalyptic predictions that never seem to come true. We regularly find out that claims of mass surveillance actually playing a key role in solving terrorist attacks or serious crimes are overblown, if not flat-out lies.”

Cindy Cohn will be a keynote speaker at my upcoming event, Privacy+Security Forum (Nov 4-6 in Washington, DC).

ANDREW GUTHRIE FERGUSON, YOUR DATA WILL BE USED AGAINST YOU: POLICING IN THE AGE OF SELF-SURVEILLANCE (2026)

Filled with real cases and great examples, Ferguson’s book illuminates how a vast amount of our personal data is being gathered by devices and technologies we willingly embrace. We’re in the Panopticon and we’re building it ourselves. He writes:

Ferguson points out how existing Fourth Amendment doctrine is inadequate to meet the moment. To determine the right types of protections needed, he suggests we apply what he calls “the tyrant test.” He argues: “The tyrant test begins by assuming that your personal data will be misused by a metaphorical (or actual) tyrant and asks what structures you would put in place to protect against that misuse before the tyrant gets the upper hand.”

You can watch my interview with Andrew on YouTube here. This video really resonated, as it has been viewed more than 25K times.

Alicia Solow-Niederman, AI and Doctrinal Collapse, 78 Stan. L. Rev. 955 (2026)

Solow-Niederman identifies a form of legal strain caused by AI which she terms “doctrinal collapse.” She observes:

She elaborates:

Laura Moy, Disaggregating Digital Rights: The Civil Rights-Civil Liberties Disconnect, 28 N.Y.U. J. Legis. & Pub. Pol’y 537 (2026)

Moy discusses what she terms the “civil rights-civil liberties disconnect.” She argues that initially, civil rights advocates pushed for information policy “to advance a fairer and more equitable information environment.” Then in the 1990s, with the rise of the internet, “public interest information advocacy shifted its focus toward civil liberties”—a vision that focused on “individual freedom,” resulting advocates to “concentrate more on individual rights and less on equality.”

Moy contends that “Public interest organizations working on information policy have been struggling to swing back in the direction of civil rights since 2013. In the 2010s, recognition grew among academics, advocates, and policymakers that the internet could replicate and exacerbate inequities across society.”

As she further argues:

Mark P. McKenna & Woodrow Hartzog, Taking Scale Seriously In Technology Law, 61 Wake Forest L. Rev. 393 (2026)

McKenna and Hartzog have written a thoughtful article about scale, which is a central issue in the modern world of digital technologies. Their ability to scale presents some of the most profound challenges we face. They argue that scale can affect more than the number of people whose data is used (AI is an example, where models affect people beyond those whose data was collected to train the model); can create new problems (often due to automation); can “challenge original assumptions about the costs and benefits of an activity”; and “can affect the efficacy of solutions, making certain institutional designs more effective and taking some legal, social, design, and market-based remedies and strategies entirely off the table.”

Maria P. Angel, From Privacy to the Data Economy: The FTC‘s Reframing of Its Regulatory Priorities, 58 Ariz. St. L.J. 1 (2026)

Angel traces the evolution of the FTC’s privacy jurisprudence, culminating in its proposed rule on Commercial Surveillance and Data Security prior to the FTC’s decimation by the Trump Administration and the killing of the rule.

She argues that the FTC was heading “beyond traditional data privacy frameworks—based on customary privacy harms and notice-and-consent—and toward a broader approach focused on the structural power dynamics of the data economy.”

Angel observes that the FTC’s “transformation is grounded in three newly articulated normative commitments: (1) a clear shift towards addressing broadly conceived data-driven harms, (2) a pivot toward examining the data economy through a political economy lens, and (3) a pledge to meaningfully constrain corporate power.”

This article provides an insightful intellectual history of the FTC’s approach to privacy. Her article also discusses the Trump Administration’s impact on the agency and provides a normative account on what the FTC ought to do in the future.

Christina Lee, Beyond Algorithmic Disgorgement: Remedying Algorithmic Harms, 16 U.C. Irvine L. Rev. ___ (forthcoming 2026)

Lee argues that a popular remedy for AI harms (used a several times by the FTC) known as “algorithmic disgorgement” must be rethought, as the remedy rests on an inaccurate and too simplistic picture of the AI ecosystem in which these algorithms are developed and used.

She contends:

Zina Makar, The Datafication of Incarceration, 135 Yale L.J. 2451 (2026)

Makar discusses how digital technologies are affecting prisoners. She observes that courts are split in how to approach these issues:

She argues that “the collection and surveillance of information data to compelled speech, or ‘compelled data.’” Courts often “mask data-compulsion concerns by minimizing the nature of privacy harms claimed by incarcerated and nonincarcerated individuals.” Additionally, she contends that “carceral technology has antidemocratic, subordinating effects at the population level and raises questions about our commitment to data privacy for all members of our society.”

Elettra Bietti, The Data-Attention Imperative, 78 Florida L. Rev. (2026)

Bietti argues that the “ability to direct and receive attention is constitutive of human life.” But in our times, “people’s attention is increasingly extracted and colonized through technology. Attention platforms and AI technologies are transforming the shape, objects, metrics and value of human time and attention.” The business models of many platforms are “organized around the data-attention imperative, the drive to continuously capture troves of data and attention to generate value.” The problem with this model is that it leads to a “data-attention spiral” as the platforms aggressively try to maximize attention and extract, which “produces a harmful commodification and erosion of time and attention which shrinks the human experience and undermines collective life.”

Bietti contends that “data-attention disorders” should not be viewed as due to individual choices and can’t be solved by “delegating solutions to market-based tools, more competition or the exercise of individual data protection rights and parental controls.”

She argues that the “answer requires moving past individual preferences and embracing an infrastructural approach focused on changing platform incentives and technological affordances and on safeguarding space for offline time.”

Peter Ormerod, Regulating Data Monetization, 13 Tex. A&M L. Rev. 1003 (2026)

Ormerod argues: “Rather than rely on individual decision-making to govern scalar processes and collective effects, those interested in holding the information age’s real power and profit to account must go to the source, regulating how companies transform data into money.” To do this, he argues that the law should focus on the “dominant form of firms’ data-monetization strategies,” which is “individualized differentiation—the process of offering customized, personalized, or otherwise distinct products, services, experiences, and prices to customers, users, employees, and other counterparties.”

Ormerod notes that there is existing regulation in other areas where companies conduct “differentiation activities, such as the regulation of credit reporting, bans on discrimination based on preexisting health conditions, and restrictions on targeted marketing. He proposes ways the law can more broadly, powerfully, and consistently regulate data-driven commercial differentiation.

The Audacity (TV Series, HBO, Season 1) (2026)

For a great dark satire about privacy and the tech industry, The Audacity is well worth watching. If you enjoyed Succession and Silicon Valley, The Audacity is like a fusion of these shows. Here’s my post about the show: The Audacity: Big Tech and the Battle for Privacy

The show has terrific satirical dialogues and monologues about privacy and the tech industry—tremendous grist for many a future law review article!

Previous Issues

The inaugural issue was:

Privacy, AI, and Tech Works Worth Your Attention (June 2026 Edition)

I’m archiving previous issues of this Works Worth Your Attention series here.

Daniel J. Solove is the Bernard Professor of Intellectual Property and Technology Law at the George Washington University Law School. He is the founder of TeachPrivacy, a company that provides workforce privacy, cybersecurity security, and AI training to companies and organizations around the world. He is the author of 10+ books and 100+ articles.

You can follow his events, writings, training, cartoons, and resources by subscribing to his free weekly newsletter.

Published posthumously, Italo Calvino’s Numbers in the Dark (2002) is a provocative collection of stories written between 1943 and 1984 that explores the effects of digital technologies and data.

Calvino (1923-1985) was an Italian author, most known for his book, Invisible Cities and If On a Winter’s Night a Traveler. Although Numbers in the Dark is not his best work, there are many eloquent thought-provoking stories that are quite prescient. I’ll discuss a few below.

Data as an End in Itself:
“World Memory”

“World Memory” (1968) is a story far ahead of its time. It involves a narrator who has resigned from being the director of a project and who is speaking to his successor, Müller. The project involves amassing “the greatest document centre ever conceived, an archive that will bring together and catalogue everything that is known about every person, animal and thing . . . A general and simultaneous history of everything, or rather a catalogue of everything moment my moment.”

The project is being undertaken in “expectation of an imminent disappearance of life on Earth.” The narrator notes that “this material is being put through a reduction process that brings it down to the essential, condensed, miniaturized minimum.” “What we are planning to build is a centralized archive of the human kind,” the narrator states, “and we are attempting to store it in the smallest possible space.” He discusses what ultimately matters will be what is conveyed to some other life forms in the universe once humanity is gone.

The narrator wonders whether the data being collected is what really matters, whether the exclusion of mundane trivialities of life might be omitting what matters most. He states that “as soon as we concentrate on something, we immediately want to include it in our files; with the result, I confess, that I have often found myself cataloguing yawns, pimples, unhelpful associations of ideas, little tunes I’ve whistled, and then hiding them amongst the mass of more useful information.”

Another wrinkle is added to the story when the narrator discusses the introduction of lies into the data: “Only in a superficial sense can lies be said to exclude the truth; you will be aware that in many cases lies—the patient’s lies to the psychoanalyst, for example—are just as revealing as the truth, if not more so.”

He then concludes that sometimes “the lie is the real information we have to pass on.” He discusses how he described his relationship with his wife Angela as “a great love story” but that this is false; “our life was one long trail of sourness and subterfuge.” But, in “the world memory Angela’s image is definitive, perfect, nothing can taint it and I will always be the most enviable husband there ever was.”

The story takes a darker turn when he confesses to murdering Angela because what really matters is the “information-Angela who would live as long as the universe itself.” The real Angela was an impediment to the information-Angela who had to be eliminated. There’s one more twist, but I’ll stop the summary here.

The world memory project anticipates modern AI, trained on massive amounts of data, where the mass of data is viewed as more important than the individual ingredients. Judgments must be made about what data counts and what doesn’t.

The story captures the fetishization of data, how the project of amassing and analyzing data can transform from a means to an end in itself, with AI becoming a replacement for the reality it was created to understand and augment. The last segment of the story shows the dark implications, where real lives are replaced with data, where we prefer the digital representation of humanity to humanity itself.

The Limits of Data:
“The Burning of the Abominable House”

“The Burning of the Abominable House” (1973) was written at the request of IBM to craft a story using a computer—an ancestor to modern writing with AI.

The story involves a protagonist who is trying to use a computer to piece together the events in a house that burned to the ground, killing four inhabitants. The only thing that remains is a plastic folder that has a list of twelve “abominable deeds committed in this house.” The narrator concludes that there are billions of permutations as to what might have happened. But something must be sorted out for insurance purposes. The narrator imagines various happenings. “I can’t prevent the slow tentacles of my mind from advancing one hypothesis at a time, exploring labyrinths of consequence that magnetic memories would run though in a nanosecond.” The narrator notes that he “can arrange the facts according to a different logic . . . Bring the number of characters to six, introduce new galaxies of combinations and permutations.”

While the story is fun and playful, it lacks heft. It demonstrates that while computers can surpass humans in making calculations, they can’t equal the infinite possibilities of human creativity.

The Corruption of Data:
“Numbers in the Dark”

“Numbers in the Dark” (1958) involves a boy (Paolino) who tags along with his mother who cleans corporate offices at night. The offices are cold and impersonal, a place of paper pushing and number crunching. A man still in an office full of machines tells him: “There’ll come the day when machines like this do all the work . . . With no need for anybody, not even me.” The “machines didn’t produce anything, but managed all the company’s business, they looked after the accounts, they knew everything that happened and that was going to happen.”

Later on, the boy encounters an accountant. The boy asks him what he’s doing, and the accountant says he’ll never finish his work and that the accounts never come out right. The boy asks why the accounting is never right because “aren’t there electronic machines that do all the sums on their own?”

“All wrong,” the accountant replies. “Those machines make mistakes?” Paolino asks. The accountant says “It was wrong from the start.” He shows the boy a dim room in the company’s vaults where old ledgers are kept. He takes out a ledger with an addition mistake that the accountant noticed, made more than a century ago:

The story has a melancholy vibe. We feel the inevitability of machines taking over, the emptiness of the entire business enterprise. Even though the story isn’t about AI explicitly, it conveys a truth that underpins AI, which is that AI is only as good as its underlying data, and that data can be corrupted.

* * *

Calvino’s Numbers in the Dark still has relevance for our times. The stories are a meditation on how humanity is placing too much faith in data and the costs of this false idolatry.

Daniel J. Solove is the Bernard Professor of Intellectual Property and Technology Law at the George Washington University Law School. He is the founder of TeachPrivacy, a company that provides workforce privacy, cybersecurity security, and AI training to companies and organizations around the world. He is the author of 10+ books and 100+ articles.

You can follow his events, writings, training, cartoons, and resources by subscribing to his free weekly newsletter.

Yesterday, I edited Chatrie v. United States (2026) for my casebook, INFORMATION PRIVACY LAW, which Paul Schwartz and I are in the process of updating right now. The U.S. Supreme Court held that there is a reasonable expectation of privacy in geolocation data obtained via a geofencing warrant (which compels a company to turn over data about cell phones located in a particular area). This means that the Fourth Amendment applies, which is the first step for Fourth Amendment protection.

Chatrie was decided this week, so the ink is still wet, but here are some early thoughts on the case, plus my edited version. The opinion with concurrences and dissents clocks in at more than 70 pages, but I cut it down to the essentials. First, my thoughts, then the edited case.

1. The Reasonable Expectation of Privacy Test

The Court makes several important points about what constitutes a reasonable expectation of privacy for purposes of determining the applicability of the Fourth Amendment:

• The length of time of surveillance isn’t a dispositive factor. The Court quoted the concurring opinion of Justice Sotomayor in Jones to state that: “‘[E]ven short-term monitoring” of a person’s physical movements can provide ‘a wealth of detail about [his] familial, political, profes­sional, religious, and sexual associations.’”

• The court also stated: “Still more fundamentally, we have never understood Fourth Amendment protections as kicking in only once an intrusion ‘goes too far.’”

• The fact that surveillance doesn’t turn up intimate data won’t eliminate a reasonable expectation of privacy because, as the Court states, the Fourth Amendment applies “regardless of the quality or quantity of information’ the government obtains.”

• The Court noted: “Whether something is a search does not depend on what it finds. An officer, after all, cannot know the fruits of a given sur­veillance in advance.”

• Even surveillance in public doesn’t eliminate a reasonable expectation of privacy.

2. The Slow Death of the Third Party Doctrine

Chatrie makes further limitations on the third party doctrine. The Court notes that there is “‘a world of difference’ between the ‘ex­haustive chronicle of location information casually collected by wireless carriers” and “the limited types of personal in­formation addressed in Smith and Miller.’”

The Court also argues that because smartphones have become an “indispensable . . . part of daily life,” users aren’t “to be viewed as sharing private information with third parties.” But phone numbers dialed in Smith and banks in Miller were also indispensable to daily life, and people weren’t freely sharing their data with these companies.

The Court emphasized an important distinction that might play a big role in the future of the third party doctrine.

The Court is saying that if users view their data as their own, then its being in the hands of a third party shouldn’t eliminate their expectation of privacy.

I can pull out at least three big limitations on third party doctrine:

1. If the data constitutes an “exhaustive chronicle” of one’s life, then the third party doctrine might not apply.

2. If sharing data or using a device that gathers data is an indispensable part of daily life, then this isn’t to be viewed as sharing data with third parties, and the doctrine likely doesn’t apply.

3. If a person views their data with a third party as their own, then the third party doctrine likely doesn’t apply.

These rules would make much data maintained by companies today no longer subject to the third party doctrine. The Court appears to be on the verge of scuttling the third party doctrine. Instead of killing it, the Court is just shrinking the zone to a point where the doctrine will be very narrow and rarely applicable.

3. Personal Data as Property?

Justice Gorsuch has his own theory, using the word “effects” under the Fourth Amendment to advance a property theory that holds that people’s data is their own. I’m skeptical of property theories (see here) but Gorsuch’s property theory works under the Fourth Amendment more than it does more generally for consumer privacy. The big issue is whether people really do have the kind of property rights in their data that Justice Gorsuch assumes.

4. Is the Reasonable Expectation
of Privacy Test the Right One?

Justice Gorsuch also critiques the reasonable expectation of privacy test.

I generally agree with his critique. A while ago, I wrote an article, Fourth Amendment Pragmatism, 51 B.C. L. Rev. 1511 (2010), about why the Fourth Amendment would better protect privacy without the reasonable expectation of privacy test, and why this test has an overly-narrow and wrong view of the purpose and scope of the Fourth Amendment. The Fourth Amendment doesn’t contain the word “privacy”—it protects against “unreasonable” searches and seizures. Invading privacy without a sufficient justification and controls is unreasonable, but so are many other things. I thus argued:

5. The Scope of Geofencing Warrants

I suppose the Court will go quiet again on the Fourth Amendment. Lately, it barely decides Fourth Amendment cases, acting like a turtle, taking little steps and popping its head out every now and then. Its last big Fourth Amendment case was Carpenter v. United States, 585 U.S. 296 (2018).

The Court punted on the issue of whether the special geofence warrant satisfied the particularity demands of the Fourth Amendment, as geofence warrants are quite like general warrants or dragnet searches. The second part of the Fourth Amendment states that “no Warrants shall issue, but upon probable cause, supported by Oath or affirmation, and particularly describing the place to be searched, and the persons or things to be seized.”

I don’t think geofence warrants are consistent with the Fourth Amendment. It’ll be up to the lower courts to figure this out, and maybe eight or ten years from now, the Supreme Court will get around to addressing the issue when they want a breather from interpreting away the rest of the Constitution and laws.

6. Are Warrants Enough?

Recently, I wrote a post about geofence warrants and warrants generally. I asked: Are warrants enough? An empirical study revealed that “Ninety-eight percent of warrant reviews eventually result in an approval, and over 93% are approved on first submission. . . . [T]he median time for review is only three minutes.” Warrants really don’t offer much protection.

Another limitation of warrants is that the government can control what activities are criminalized, and warrants authorize searches for evidence of whatever crimes there are. As states criminalize abortion, or as federal or state governments prosecute certain protests or other activities, prosecutors can obtain warrants.

My colleague, Andrew Ferguson, in his great new book, YOUR DATA WILL BE USED AGAINST YOU (2026) argues that other types of protections are needed because so much intimate data about us can be gathered in the digital age: “[T]he safeguards built into our legal system—search warrants, judicial oversight, concepts like probable cause—are too weak to protect us from the self-surveillance system we are building.” He discusses a case where a person’s pacemaker data was used to prosecute him.

Here’s a video of me discussing his book with him:

Here are some questions I’m planning to ask in my casebook, INFORMATION PRIVACY LAW about warrants after the Chatrie case: If warrants aren’t enough protection, what would be? Should some data be off limits to government gathering entirely, even with a warrant? The law protects certain information in this way, such as privileged information (attorney-client privilege, priest-penitent privilege). If the law should shield certain data entirely from government collection and use in prosecution, what data should fall into this category? And how should the category be defined?

Below is an initial draft of an edited version of the Chatrie majority opinion from the next edition of the casebook.

Chatrie v. United States

-- U.S. – (2026)

[Full opinion here]

Kagan, J. In recent years, law enforcement officers have employed so-called geofence warrants to obtain information that tech­nology companies collect about their users’ cell-phone loca­tions. Suppose that investigators know a crime was com­mitted at a particular place and time, but do not have a suspect. They may draw a “geofence”—a virtual perime­ter—around the crime scene and get a warrant compelling a company to hand over data about the cell phones located in that area near the time of the crime. Following a process specified in the warrant, the company will turn over the cell-phone data and eventually identify by name one or more of the users thus disclosed.

The geofence warrant at issue here was directed to Google, and used to solve a bank robbery. Hundreds of mil­lions of Google users have activated a service called Loca­tion History, which records the location of a user’s cell phone every two minutes or so. Through a geofence war­rant, police officers required Google to turn over Location History data revealing cell phones within the vicinity of a bank at around the time it was robbed. At the end of the multi-step process described in the warrant, Google gave the police three names. The Federal Government soon charged one of the individuals thus identified, petitioner Okello Chatrie, with committing the crime. . . .

This case concerns a form of cell-phone location data called “Location History,” which Google apps collect and store. Location History is what it sounds like—a time­stamped record of every place a cell phone has been. Every two minutes or so, Location History draws from an array of sources to log a cell phone’s location. Those sources include nearby Wi-Fi networks, Bluetooth beacons, and cell sites, as well as GPS and IP address information. When com­bined, the signals tracked can determine a cell phone’s lo­cation within 20 meters. They can also ascertain a phone’s elevation, and thus reveal which floor within a building the phone is on. By all accounts, those features make Location History “the most sweeping, granular, and comprehensive tool” existing today for collecting and storing location data. . . .

Google stores all Location History data in the cloud, ra­ther than on a user’s device—though that choice makes no real difference to the user. . . .

In the last decade, Google’s Location History data has also served another function, though this one unknown to most users: That data, as obtained through a geofence war­rant, can enable law enforcement officers to solve hard-to-­solve crimes. Such a warrant, as earlier described, seeks information about the cell phones located in the vicinity of a crime scene at around the time the crime was committed. The goal, put simply, is to find out who was there and so who might have done it. . . . And the mechanism is to use the offender’s cell phone as an identifying device. The warrant specifies a timeframe and maps an area (with the geofence as its perimeter), and demands information about the cell phones—and their users—present within it. . . .

As [law enforcement] demands began to proliferate, Google worked with law enforcement officials to develop a three-step pro­tocol to govern geofence warrants. At the first step, Google produces anonymized (i.e., no names attached) location data for all cell phones (or other devices) within the geofence—typically, a circle with a designated radius sur­rounding a latitude/longitude coordinate—during a speci­fied timeframe. That data generally includes each phone’s latitude/longitude coordinate and corresponding timestamp; an estimate of that information’s accuracy; and a description of the information’s source (e.g., a Wi-Fi net­work, a cell site, or some other). The data at this stage shows each user’s location, every two minutes or so, within the geofence. At the second step of the process, officials re­view the data produced and typically ask Google to provide additional information for a subset of still-anonymized us­ers. That new data is usually for a longer timeframe than first specified; it also shows the user’s location outside, as well as inside, the geofence. Finally, at the third step, offi­cials demand the identities of a further subset of users— their names, email addresses, and phone numbers. Thus, the geofence warrant is designed to eventually produce a select number of identified users suspected of committing the crime under investigation. . . .

On May 20, 2019, at about 4:50 p.m., a man robbed a credit union in Midlothian, Virginia. The robber presented a teller with a handwritten note demanding $100,000, threatening to hurt her and her family if she did not com­ply, and warning her that he had “boys on the lookout outside.” When the teller replied that she did not have access to that amount of money, the robber brandished a firearm. He ordered everyone in the bank to the ground, and forced the bank’s manager to open a safe and put $195,000 into a bag. The robber then left on foot with the money.

Local police officers responded to the scene and began an investigation. They learned, from witness interviews and surveillance-camera footage, that the robber had ap­proached the credit union from a corner of an adjacent church, while appearing to talk on a cell phone. But they could not find out anything more, and the robber remained at large.

On June 14, the police officers thus applied to a Virginia magistrate for a geofence warrant directed to Google. The application described the cell-phone location data Google collects, and explained how that data could lead to identify­ing the robber, his possible accomplices, or additional wit­nesses to the crime. Success was particularly likely here, the application stated, because the robber appeared to be using his phone when he entered the credit union, and may even have been speaking with an accomplice. The officers’ proposed geofence was a circle with a radius of 150 meters surrounding the credit union. . . .

[With the geofence warrant, the police narrowed the list to three users by the third step, one of whom was Chatrie.] The location data showed that he entered the geofenced area about ten minutes before the robbery, and headed toward a residen­tial area of town immediately after leaving the bank. . . .

According to Chatrie, the officers had acquired that data through a Fourth Amend­ment search, and the warrant ostensibly authorizing that search was invalid. . . .

Whether an expectation of privacy counts as legitimate is less the result of any fixed set of rules than of “guideposts” stretching back to the Fourth Amendment’s beginnings. From the founding onward, we have explained, the Fourth Amendment has sought to secure the “privacies of life” against the exercise of “arbitrary power.” Boyd v. United States, 116 U. S. 616 (1886); see Carpenter, 585 U. S., at 305. So too we have recognized, and repeatedly, that the Amendment was designed “to place obstacles in the way of a too permeating police surveillance.” United States v. Di Re, 332 U. S. 581, 595 (1948). . . .

In recent decades, this Court has often confronted the challenge of adhering to those principles in the face of new technologies. . . . Most recently, in Carpen­ter v. United States, this Court held that accessing a form of cell-phone location information other than Location His­tory is a Fourth Amendment search given individuals’ rea­sonable expectations of privacy. . . .

The resemblances between [cell site location information] CSLI and Location History, in their relationship to personal privacy, practically leap off the page. Everything Carpenter relied on to find that law enforcement officers conducted a Fourth Amendment search when they accessed wireless carriers’ CSLI records applies as well or better to the police’s accessing of Google’s Location History data. First, Location History provides an even more fine-tuned picture of a person’s movements than CSLI. . . . Or here is another measure: CSLI logged Carpenter’s location an average of 101 times a day, whereas Location History commonly rec­ords a person’s location every two minutes, for a daily aver­age of 720 chartings.

Or finally, a third: Unlike CSLI, Location History can estimate a phone’s ele­vation—so, for example, can tell whether someone has gone into a doctor’s office on the first floor of a multi-story build­ing, or a private apartment on the tenth. Of course, the accuracy of each of the two techniques may vary in different places and at different times. But across the board Location History is the far more precise measure. When the Carpen­ter Court said that CSLI provides a “detailed” and “encyclo­pedic” portrait of a person’s whereabouts, it did not know what further technology was on the horizon.

And next, Location History also allows police officers to reconstruct “retrospective[ly],” and with no real effort, peo­ple’s comings and goings in any area.. . . .

Indeed, Location History records implicate those privacy interests still more than CSLI data because the former is more the individual’s own. . . . The records thus serve as a per­sonal journal of a user’s movements, which that user con­sults (and even can edit) for his own purposes. In that way, Location History resembles other private materials—think of emails, documents, photographs, or calendars—that even if stored on Google’s servers, a user reasonably views as his own. And as a result, that he rea­sonably expects to be shielded from the “inquisitive eyes” of the government. . . .

The Government, not much contesting any of the above, principally argues on a different ground: that accessing only a short amount of cell-phone location information (whether Location History or CSLI) does not count as a Fourth Amendment search. . . . Recall that Carpenter involved seven days’ worth of location data. And in deciding that case, this Court reserved the issue whether there was a more “limited period for which the Government may obtain” such data “free from Fourth Amendment scrutiny.” The Government now claims that the answer is yes, and that the two hours’ worth of Location History acquired here falls within the Constitution-free zone. In the Government’s view, a person has no reasonable expectation of privacy in “that short a time window” of lo­cation data, because his “short-term” movements will “re­veal[] little about the details of [his] personal life.” . . . .

But to begin, the Government is wrong about the inca­pacity of short-term location information to reveal private matters. . . . Re­turn here to another of Jones’s insights: “[E]ven short-term monitoring” of a person’s physical movements can provide “a wealth of detail about [his] familial, political, profes­sional, religious, and sexual associations.” 565 U. S., at 415 (opinion of Sotomayor, J.). Consider just a few trips that a person is apt to think “indisputably private”: to “the psy­chiatrist, the plastic surgeon, the abortion clinic, the AIDS treatment center, the strip club, the criminal defense attor­ney, [or] the by-the-hour motel.” And unlike a GPS device, Location History enables police officers to focus on precisely those sites—to see, in a given time block, who shows up. Similarly, Location History—even two hours of it—allows officers to target one-off events of potential inter­est: a gun show, say, or a political rally.

Still more fundamentally, we have never understood Fourth Amendment protections as kicking in only once an intrusion “goes too far.” Where the Fourth Amendment applies, it applies—regardless of “the quality or quantity of infor­mation” the government obtains. So, for example, this Court held [in Kyllo] that thermal imaging qual­ified as a search even though it did not, and was not likely to, detect “private activities” or “intimate details.” The Amendment, we analogized, makes “no exception” for the officer “who barely cracks open the front door and sees nothing but the nonintimate rug on the vestibule floor.” And likewise, the Amendment does not give agents a pass if their wiretap is of limited duration and thus less likely to intrude on private matters. Indeed, in our seminal wiretap case, the police obtained only 18 minutes of record­ings. See Katz. . . .

Knotts does not support the view that accessing two hours of Location History is not a search. There, police officers put a beeper in a car to help them follow it from Minnesota to Wisconsin. The Court de­cided that the beeper did not turn the tail into a search, but was explicit in keeping its holding cabined to that rudimen­tary technology. . . . [The Court stated] that if technology progressed so as to allow more sophisticated surveillance, “different con­stitutional principles” could well apply. And three decades later, five Justices in two opinions found that they did. When faced in Jones with a GPS device—which unlike the beeper allowed remote monitoring—they de­cided, notwithstanding Knotts, that privacy was implicated and a search had occurred. . . .

And still another feature of Knotts makes it inapt here: that the surveillance there was confined to public roads. . . . By con­trast, the movements that Location History reveals are not limited to public streets. Recall what Carpenter observed: A “cell phone faithfully follows its owner beyond public thoroughfares and into private residences, doctor’s offices, [and] political headquarters.” . . . . Whether something is a search does not depend on what it finds. An officer, after all, cannot know the fruits of a given sur­veillance in advance. . . .

The Government has an additional argument, which in Carpenter was its “primary” one—that the so-called third-party doctrine precludes Chatrie from invoking the Fourth Amendment’s protections. . . . The problem for the Government—and presumably the reason that its primary assertion in Carpenter has here be­come a secondary one—is that Carpenter refused to apply the third-party doctrine to CSLI, and no good reason exists to reach a different result for Location History. . . .

There is “a world of difference” between the “ex­haustive chronicle of location information casually collected by wireless carriers” and “the limited types of personal in­formation addressed in Smith and Miller.” The for­mer thus “implicates privacy concerns far beyond” the lat­ter. And second, the Court continued, “[c]ell phone location information is not truly ‘shared’ as one nor­mally understands the term.” Because “cell phones and the services they provide” are “such a pervasive and insistent part of daily life”—“indispensable to participation in modern society”—a person can hardly help but generate a “trail of location data.” “[I]n no meaningful sense,” the Court thought, does that mean a person “voluntar[il]y expos[es]” to any third party a “comprehensive dossier of his physical movements.”

As noted above, Location History is even more “revealing” than CSLI, be­cause it provides a yet more precise record of an individual’s movements. . . . And for Location History, that surveillance is based on information that a user reasonably understands as his own, even though stored on Google’s servers—much like his emails, photos, and calendar entries. Likewise, the information is “not truly shared,” in the normal sense of wanting a third party to see or use it.. The exposure of that information to Google is merely what happens when a user avails him­self of one of the services on his cell phone. Or said a bit differently, it is the automatic price of conventional cell­phone usage. . . .

The point of carrying smartphones is to use what is on them—as Carpenter said, to use the apps and “services they provide.”. That is what has become a “pervasive and insistent”—even “indispensable”—“part of daily life.” And so that is what Carpenter insulated from the third-party doctrine. A cell-phone user is not to be viewed as sharing private information with third parties—which then can be freely passed on to the government—just by doing the ordinary things cell-phone users do. . . .

For all those reasons, we hold that police officers invade a cell-phone user’s reasonable expectation of privacy when they access his Location History.. . .

When officers have obtained a warrant, as they did here, a search’s legality will thus depend on whether a magis­trate has properly found probable cause to support a partic­ularly described search. . . .

The warrant issued here, as described earlier, was an un­common, multi-step one. . . .

Chatrie analogizes the first step to an “uncon­stitutional general warrant,” and argues that in any event the search at that step was both insufficiently described by the warrant and lacking in probable cause. As to steps two and three, Chatrie contends that the warrant left too much authority to police officers—and too little to the magistrate—to define the search’s scope and determine whether cause for it existed. The Government, for its part, defends the warrant at every step as seeking “particularized infor­mation from Google’s database” based on “probable cause to believe that Google had information” that would help solve a crime. And the Government urges that the discretion given to the officers at steps two and three fell within the bounds of reasonableness.

We leave all of those questions to the Court of Appeals to decide in the first instance. Because the Fourth Circuit panel concluded that no search had occurred, it did not ad­dress whether the geofence warrant issued here validly au­thorized each stage of the search process. . . .

Daniel J. Solove is the Bernard Professor of Intellectual Property and Technology Law at the George Washington University Law School. He is the founder of TeachPrivacy, a company that provides workforce privacy, cybersecurity security, and AI training to companies and organizations around the world. He is the author of 10+ books and 100+ articles.

You can follow his events, writings, training, cartoons, and resources by subscribing to his free weekly newsletter.

Here’s a new cartoon about the AI hype these days. It seems that everything involving data or an algorithm is being rebranded as AI.

A while ago, I wrote about how AI is, in fact, a rebrand—one I analogized to the way fish were rebranded.

I wrote:

Read this post if you’re interested in more and on learning the fascinating story about how various fish were renamed and the impact it had.

Daniel J. Solove is the Bernard Professor of Intellectual Property and Technology Law at the George Washington University Law School. He is the founder of TeachPrivacy, a company that provides workforce privacy, cybersecurity security, and AI training to companies and organizations around the world. He is the author of 10+ books and 100+ articles.

You can follow his events, writings, training, cartoons, and resources by subscribing to his free weekly newsletter.

I recently finished watching the first season of a terrific new TV series, The Audacity (2026). The show chronicles Duncan Park (Billy Magnussen), an out-of-control tech billionaire who has a company called Hypergnosis. The show was created by Jonathan Glatzer, who was a writer and producer for several TV series including Succession, Better Call Saul, and Bloodline.

Silicon Valley Meets Succession

The Audacity is a fusion of Silicon Valley and Succession, two superb TV series. Silicon Valley (2014-2019) is a satirical depiction of the tech industry, but it’s lighter and more comedic than The Audacity. For all their flaws, many characters in Silicon Valley are endearing. Not so with The Audacity.

Like Silicon Valley, The Audacity portrays the world of the tech industry as cutthroat, where the game is a constant scramble for survival, an everlasting hunt for investors to keep the money flowing. And this makes even very rich and powerful people like Duncan feel vulnerable and over-stressed as they grovel for investment by touting how much more powerful and disruptive their tech is than everything else.

Even more than Silicon Valley, The Audacity reminds me most of Succession (2018-2023), where all the characters are monsters in different variations. It’s no surprise that Glatzer was involved with Succession. Like the characters in Succession, the characters in The Audacity are awful. Duncan is a monster because he’s narcissistic and utterly self-absorbed; he has no boundaries, no limits, and is ruthless and maniacal.

Duncan doesn’t intend to be mean; he lacks maturity and the ability to see beyond himself. No matter how successful he becomes, he’s chronically unsatisfied and unhappy. He turns into a veritable beggar trying to court Carl Bardolph, a legendary, successful, and ridiculously wealthy tech entrepreneur played brilliantly by Zach Galifianakis—perfect casting.

“Privacy is Not a Thing Anymore”

The show has a strong privacy plotline. An engineer named Harper (Jess McLeod) has developed a new tech system that gathers and analyzes enormous amounts of personal data. Duncan salivates over this new technology, eager to unleash it to the world and monetize it for all its worth. His motto is that “privacy is not a thing anymore.”

Here’s a hilarious monologue by Duncan about his views on privacy:

Here’s another satirical exchange between Duncan and his therapist, Sarah Goldberg (Joanne Felder) from season 1, episode 7:

Powered by Harper’s technology, Duncan founds a new company called P.I.N.A.T.A. (an acronym for the “privacy is not a thing” motto). It is Harper who approaches Duncan because Harper’s new CEO (Anushka) wants to pause her new system. She explains to Duncan why she chose to work with him.

Duncan’s business model is to charge people $29 for privacy protection and $299 to have access to all the data of everyone else who doesn’t have the company’s privacy protection. It reminds me of the Godfather, where the mob offered security services. If a business declined to buy the service, then they’d rob the business.

The Audacity has great dialogue and monologues. It’s very dark satire, veering frequently into territory that is more horror and tragedy than comedy. There are only a few characters to root for, and they generally don’t end up winning.

In one episode (season 1, episode 6), Anushka Bhattachera-Phister (Meghan Rath) attempts to steer Duncan’s previous company Hypergnosis to be more privacy friendly, but she’s met with skeptical clients.

A Pathological Game

The show skewers the tech industry, especially the billionaires who run it. But even the out-of-control billionaires like Duncan aren’t fully in control themselves. The pathology emerges not just from these deeply flawed individuals, but also from the world in which they live. The entire tech ecosystem is pathological. Growing a tech company is a ruthless game that attracts players like Duncan, and the game proves to be even more powerful than the players, no matter how successful they become. It’s a game nearly impossible to play without sacrificing one’s integrity, ethics, and responsibility.

Carl Bardolph explains how it all works (season 1, episode 5):

As James Poniewozik aptly puts it in his review in the N.Y. Times:

For those who enjoyed Succession and Silicon Valley, or who like dark satire about privacy and the tech industry, The Audacity is well worth watching.

I’ll end with a few cartoons I created about the tech industry that are quite apropos for The Audacity.

Daniel J. Solove is the Bernard Professor of Intellectual Property and Technology Law at the George Washington University Law School. He is the founder of TeachPrivacy, a company that provides workforce privacy, cybersecurity security, and AI training to companies and organizations around the world. He is the author of 10+ books and 100+ articles.

You can follow his events, writings, training, cartoons, and resources by subscribing to his free weekly newsletter.

I created this cartoon about the profound ugliness of the AI race. Tech leaders are rushing to create AI and are unleashing it upon the world far too quickly with far too few guardrails and far too little responsibility.

In the early days of the internet, tech leaders urged for the internet to be lightly regulated (and often not regulated at all). They promised that the internet would bring freedom and democracy; it would liberate us from the tyranny of big powerful organizations; it would help the little guys. Although the internet has brought about some wonderful things, it has also undermined all these goals and has contributed to greater authoritarianism, extremism, manipulation, and control.

Now, it’s déjà vu all over again. Tech leaders are making great promises with AI. All diseases will be cured, we won’t have to work anymore, and we all will be paid a fat check to lounge on the beach and get fat. But it’s clear that these promises are bogus. AI has the potential to be wonderful, but unfortunately, so far, it’s launch has been harmful and disruptive.

What we saw with the internet is now playing out again, the stakes even higher. Tech leaders are making decisions in their own interests to the detriment of everyone else.

I don’t think AI and tech are wrongheaded; but the wrong people are creating it.

Daniel J. Solove is the Bernard Professor of Intellectual Property and Technology Law at the George Washington University Law School. He is the founder of TeachPrivacy, a company that provides workforce privacy, cybersecurity security, and AI training to companies and organizations around the world. He is the author of 10+ books and 100+ articles.

You can follow his events, writings, training, cartoons, and resources by subscribing to his free weekly newsletter.

I previously posted my collection of privacy magazine covers. Here’s my collection of magazine covers involving AI, the internet, and related digital technologies.

I collected more than 80 magazine covers from the 1950s to the present. I’m excited to share my collection with you. If you have any covers I’ve missed, please share them with me.

I’ll begin with a quick look, then I’ll include larger images later.

Also scroll down to the very end to see my favorite covers, including my top 3 and see if you agree with me.

1950-1959

Time, January 23, 1950

Time, March 28, 1955

Popular Electronics, December 1958

Time, February 23, 1959

1960-1969

Time, April 2, 1965

Newsweek, January 25, 1965

1970-1979

Byte, August 1976

Time, February 20, 1978

Mad, April 1978

Byte, April 1979

1980-1989

Byte, January 1980

Time, December 8, 1980

Byte, April 1981

Byte, June 1981

Byte, September 1981

Time, May 3, 1982

Byte, May 1983

Byte, January 1984

Byte, October 1984

Time, March 1, 1985

Mad, October 1985

Byte, January 1986

Omni, November 1987

Time, March 28, 1988

1990-1999

Mad, Summer 1991

The New Yorker, October 7, 1991

Time, February 8, 1993

Time, April 12, 1993

Time, July 25, 1994

Time, March 25, 1996

Time, February 3, 1997

Time, May 10, 1999

Mad, December 1999

2000-2009

Time, March 27, 2006

Scientific American, January 2007

The New York Times Magazine, July 29, 2007

The New Yorker, May 12, 2008

The New Yorker, May 12, 2008

The New Yorker, May 11, 2009

2010-2019

The New Yorker, November 12, 2010

The Economist, June 2, 2012

The Economist, March 29, 2014

Popular Science, November 2014

Newsweek, March 7, 2015

The Economist, May 9, 2015

Mad, February 29, 2016

The Economist, June 25, 2016

Newsweek, June 2, 2017

The New Yorker, October 23, 2017

The Economist, March 31, 2018

New York Times Magazine, November 18, 2018

The New Yorker, May 20, 2019

Stanford Magazine, July 2019

The New Yorker, September 30, 2019

Time, November 4, 2019

2020-present

The Economist, June 11-17, 2022

Time Special Edition 2023

The Economist, April 22-28, 2023

The New Yorker, April 24 & May 1, 2023

Maclean’s, October 12, 2023

This cover was AI generated.

Science, July 14, 2023

Harvard Business Review, July-August 2023

Time, August 14, 2023

Harvard Business Review, Sept-Oct 2023

The Humanist, Fall 2023

The New Yorker, November 20, 2023

The Economist, March 30 – April 5, 2024

Scientific American, April 2024

Popular Science, August 2, 2024

MIT Technology Review, May/June 2024

Harvard Business Review, Sept-Oct 2024

Harvard Business Review, Jan-Feb 2025

Mad, February 2025

The New Yorker, February 17 & 24, 2025

Newsweek, March 4, 2025

MIT Technology Review, March/April 2025

MIT Technology Review, May/June 2025

Time, December 28, 2025

Scientific American, January 2026

Scientific American, March 2026

New Internationalist, Mar/Apr 2026

The New Yorker, April 13, 2026

The Best AI Magazine Cover of All Time

I thought it would be fun to rank my favorites, so here they are, including my nomination for the best. You’ll see that I like the funny ones, as well as ones that have something to say.

And now, my favorite, which features one of the best AI cartoons I’ve seen.

If you enjoyed these AI covers, you might also enjoy my privacy magazine cover collection.

Daniel J. Solove is the Bernard Professor of Intellectual Property and Technology Law at the George Washington University Law School. He is the founder of TeachPrivacy, a company that provides workforce privacy, cybersecurity security, and AI training to companies and organizations around the world. He is the author of 10+ books and 100+ articles.

You can follow his events, writings, training, cartoons, and resources by subscribing to his free weekly newsletter.

I’ve curated a list of recent works on privacy, AI, and tech that will be worth your time checking out. As I’m just launching this series, I have a backlog of recent works that I plan to include in future editions.

Alicia Solow-Niederman, The Supply Chain is a Circle: AI, Privacy, and People, 101 Notre Dame L. Rev. Reflection 29 (2026)

Another brilliant and insightful work by Solow-Niederman. She argues that AI governance focuses mostly on the entities developing AI systems rather than the users of them, and “this production-centered approach risks overlooking what happens when people use AI tools. That’s a mistake, because user interactions determine the real-world impact of AI.” She contends that “regulating AI and holding the appropriate actors responsible requires far more attention to what happens after deployment of an AI system.” Further, she argues: “Unless we account for the contextual ways that humans interact with AI systems on the ground, it is users who will bear the cost of harms, and our regulatory interventions will remain incomplete at best and pernicious at worst.”

Ted Chiang, “No, Artificial Intelligence Is Not Conscious,” The Atlantic (June 3, 2026)

Ted Chiang is a renowned sci-fi writer, author of STORY OF YOUR LIFE AND OTHERS (2002) and EXHALATION (2019), both of which are superb short story collections. Chiang recently wrote a terrific essay on AI in The Atlantic. A key quote:

CARISSA VÉLIZ, PROPHECY: PREDICTION, POWER, AND THE FIGHT FOR THE FUTURE, FROM ANCIENT ORACLES TO AI (2026)

In her new book, Prophecy, Carissa Véliz provides a sophisticated account of attempts at prophecy, including today’s AI algorithmic predictions. Her book is highly engaging and filled with great anecdotes and examples. She combines accessible and lively prose with deep philosophical insights.

On AI predictions, Véliz argues that they “are fortune tellers, as opposed to truth tellers, and the ultimate prediction machine is also the ultimate bullshitter. . . . [A]lthough predictions appear to be descriptive claims, they are in fact veiled prescriptive assertions—they tell us how to act.”

I’ve written about AI predictions in my article with Yuki Matsumi: Hideyuki Matsumi & Daniel J. Solove, The Prediction Society: Algorithms and the Problems of Forecasting the Future, 2025 U. Ill. L. Rev. 1 (2025).

I also recently explored AI predictions in my Substack essay, Dangerous Oracles: Minority Report, Philip K. Dick, and AI Predictions.

Kashmir Hill and Aric Toler, “They Tried to Catch a Predator. They Trapped Themselves Instead.” N.Y. Times (June 10, 2026)

Hill and Toler’s article tells a harrowing story about life in today’s digital age, where vigilantes mete out “justice.” When these self-anointed warriors for justice are wrong, they can destroy lives.

I wrote about the dangers of online vigilantism nearly 20 years ago in my book, The Future of Reputation: Gossip, Rumor, and Privacy on the Internet (2007) (you can download a free PDF here). I predicted something like this happening:

Sadly, my dystopian predictions are the ones coming true, not my more optimistic ones.

Neil M. Richards, Privacy Is Not Theft (June 3, 2026)

Richards’ essay discusses Dave Eggers’ novel, The Circle, which depicted an anti-privacy company that advanced the idea that “privacy is theft.” Richards’ essay draws from Jonathon Penney’s new book, Chilling Effects, to argue that “Penney’s work shows the hollowness of these curious suggestions that privacy is no longer a fundamental right but rather a kind of theft from the future, or at least a theft from people who think they are building a most excellent future for themselves and want your information as raw material to do that.”

Perla Khattar, Quantum Computing and Privacy (June 4, 2026)

Khattar argues that quantum computing threatens to render encrypted data today discernable tomorrow. In the abstract, she contends that “vast quantities of encrypted data collected today may become readable in the future once sufficiently powerful quantum systems emerge. This phenomenon—commonly described in technical literature as “harvest now, decrypt later”—creates what this Article conceptualizes as Deferred Privacy Breach: a condition in which privacy violations are probabilistic, delayed, and potentially inevitable.”

Current laws “evaluate security at the moment of data collection or breach, not across the lifespan of information. Quantum computing therefore exposes a mismatch between technological reality and legal doctrine, revealing that privacy law has long relied on an unstated premise of computational permanence.”

Theodore Christakis, You Trust Your Chatbot With Everything. Should You? (2026)

Professor Christakis has produced a very insightful two-part report on AI chatbots.

In Part 1: How the Controller Uses Your Chat Data, Christakis engages in an extensive examination and comparison of ChatGPT, Gemini, Claude, Grok, and DeepSeek. The study seeks to “map the internal privacy boundary of consumer chatbot conversations: how providers handle the data users entrust to them, where the protections fall short of what the interface invites users to expect, and what constraint-based alternatives could look like.” Christakis notes:

In Part 2: Governments, Courts, and the Battle Over Your Chatbot Conversations, Christakis examines AI chatbot conversations in “the four places they can be exposed (police referral, government demand, civil discovery, data breach) and asks what should be done.” Although people speak to chatbots for legal or medical advice, chatbots are not shielded with the protections of relationships with lawyers or doctors. Christakis observes:

Both parts offer many recommendations for policy improvements.

Paul M. Schwartz, Data Privacy Federalism 3.0, 29 Chapman L. Rev. 465 (2026)

Schwartz continues his excellent scholarship on federal preemption, following up on his earlier piece, Preemption and Privacy. In this new short essay, he argues that federal privacy law shouldn’t be preemptive of state laws: “State lawmaking about data privacy is supported by the classic Brandeisian notion of the states as laboratories for innovative policymaking. In addition, there is the potential of states to serve as catalysts for bipartisan policy cooperation.”

Schwartz also argues:

Chinmayi Sharma, Thomas Kadri, & Sam Adler, Brokering Safety, 114 Cal. L. Rev. 478 (2026)

Sharma, Kadri, and Adler have written a great article on how privacy law fails to protect victims who try to hide from their highly-dangerous abusers. They argue that “today, no number of name changes and relocations can prevent data brokers from sharing a victim’s personal information online. Thanks to brokers, abusers can find what they need with a single search, a few clicks, and a few dollars. For many victims, then, the best hope for safety lies in obscurity—that is, making themselves and their information harder to find.”

As they contend, the law is inept at addressing the situation:

They propose a new regulatory regime to address these problems.

Woodrow Hartzog & Evan Seligner, On the Right to Obscurity, Cal. L. Rev. Online (June 2026)

‍In this essay, Hartzog and Selinger continue their terrific work on obscurity (here and here), plus previous work by Hartzog and Frederic Stutzman (here). In their latest essay on the topic, they reiterate their conclusion that “practical obscurity” is an essential and “underappreciated form of privacy.” Obscurity “allows us to live freely and with dignity.”

Hartzog and Selinger argue:

BART VAN DER SLOOT, FROM AUTONOMY TO AMBIGUITY: RECONFIGURING THE LEGAL LANDSCAPE IN THE AGE OF AI (2026)

Van der Sloot’s new book is brimming with wisdom. I loved it, and I wrote a blurb for it, which I quote below:

Ifeoma Ajunwa, Ravi B. Parikh, & I. Glenn Cohen, When Patients Share Everything with an AI Chatbot: Risks and Opportunities of Large Language Models, JAMA (June 11, 2026)

This piece explores the dangers of using chatbots for healthcare and the lack of adequate legal protections. From the abstract:

I wrote about these issues in my post, AI Companies Should Have Information Fiduciary Duties.

Daniel J. Solove is the Bernard Professor of Intellectual Property and Technology Law at the George Washington University Law School. He is the founder of TeachPrivacy, a company that provides workforce privacy, cybersecurity security, and AI training to companies and organizations around the world. He is the author of 10+ books and 100+ articles.

You can follow his events, writings, training, cartoons, and resources by subscribing to his free weekly newsletter.

Snooping is a popular theme in fiction. Join me for a journey through the past 400 years to explore depictions of snooping and watching in legend, literature, and film. These accounts often raise questions about the ethics, creepiness, and invasiveness of snooping, as well as the limits of what can be gleaned from it.

1. Peeping Tom (1600s)

An early fictional account of snooping is Peeping Tom. Peeping Tom isn’t a particular work but instead is a dimension of a legend. He hails from the legend of Lady Godiva, which dates back to the 11th century. She urged her husband, the Earl of Mercia, to lower taxes, which she believed were oppressively high. The Earl said that if she rode naked on her horse through the streets of Coventry, then he’d agree to her wishes. She took him up on his challenge.

The townspeople were ordered to avoid looking at her. But a man referred to as Tom the Tailor couldn’t resist and tried to gawk at her through his open shutters. According to some accounts, he was blinded. In other versions, he was killed.

Tom wasn’t part of the original legend; he was added in the 17th century. According to Emily Staniforth:

2. Madame de Lafayette, The Princesse de Clèves (1678)

The Princesse de Clèves is one of the earliest novels where privacy factors significantly in the plot and themes. The novel, which was quite popular in its time, involves a princess married to a husband (the Duc de Nemours) she doesn’t love. She has feelings for another man, the Count of Nemours, who falls in love with her. Eventually, her husband forces her to confess that she has feelings for someone else, but she doesn’t disclose that it is the Duc.

Throughout the novel, both the Count and the Duc spy and eavesdrop on her. The Duc sees the Count outside the princess’s window, and assumes his wife was having an affair. In actuality, the Count was spying on the Princess. The Duc continues to spy on the princess relentlessly. The spying, and misinterpretation of what is surreptitiously seen, leads to tragic consequences. It leads to a momentous decision the princess makes in the end.

Because the novel delves deeply into the princess’s psychology, it is considered to be quite modern for its time. Ellen Schaf notes:

Richard Moye writes:

3. John Poole, Paul Pry (1825)

John Poole’s Paul Pry was a comical play that premiered in the Haymarket Theatre in London in 1825. The character Paul Pry was initially acted by John Liston, and the play was preformed for a record 114 performances over the next year. It became immensely popular and continued to capture the public consciousness through the 1870s. The play spread to New York and around the world.

The play focuses on a meddlesome man who can’t mind his own business. He eavesdrops on everyone. He leaves behind an umbrella as an excuse to return and spy on people. His trademark phrase is “I hope I don’t intrude,” which he utters and then promptly intrudes.

A review in the Globe of London the day after the premiere described Pry as “eternally thrusting his nose into that of other people, constantly to their annoyance, and not unfrequently to his own discomfiture.”

In the play, Pry is bumbling and nosy. He often misinterprets what he sees, causes disruption, and generally makes things worse. But as this is a comedy, Pry’s intrusiveness doesn’t lead to tragedy, and in the end, he accidentally becomes a hero.

A common theme in the play is that Pry often misunderstands what he eavesdrops upon. As David Vincent observes in his book, , I Hope I Don’t Intrude: Privacy and Its Dilemmas in Nineteenth-Century Britain (2015): “Much of the comedy in Poole’s Paul Pry derives from the collision between the hero’s irrepressible determination to find out what is going on and his almost total inability to understand the meaning of the information he acquires.”

Vincent also writes:

Paul Pry became so widely ensconced in the public consciousness that “Paul Pry” has become a term in the dictionary to refer to an overly inquisitive person. Newspapers and pubs were named after him. Similar to a Hollywood blockbuster, merchandise was produced such as snuff boxes, porcelain figures, and handkerchiefs.

Vincent notes:

As popular as Paul Pry was in the day, although the name remains widely familiar, the details and text of the play are no longer widely known. I tried to find a copy in a book but instead found only a single independently-published edition.

What I find most interesting about Paul Pry is how popular it became. It was truly a sensation in its day, and it captured and shaped attitudes about snooping to a rather unprecedented extent.

4. Edgar Allan Poe, “The Man of the Crowd” (1840)

“The Man of the Crowd” is a lesser-known short story by Edgar Allan Poe that involves a narrator who is at a London coffee shop. He watches the crowd around him and notices “a decrepit old man” wearing dirty clothes. The narrator becomes fascinated by the man and follows him throughout London.

The story begins: “It was well said of a certain German book that “es lässt sich nicht lesen”—it does not permit itself to be read. There are some secrets which do not permit themselves to be told.”

When the narrator sees the man, he has an obsessive curiosity that he must satisfy:

The narrator “followed him closely, yet cautiously, so as not to attract his attention.” Despite following and watching the man, the narrator finds the man to be a mystery:

This story illustrates the limits of surveillance. We can watch others, but watching isn’t the same as knowing or understanding. Surveillance can lead to hasty and distorted judgments about other people.

As Ya-Ju Yeh observes:

As Louis Renza observes in his book, Edgar Allan Poe, Wallace Stevens, and the Poetics of American Privacy (2002), “the tale’s scenario allows that the crime imputed to the old man might just as easily evince the narrator’s displaced guilt over his own obsessive voyeurism. If the old man’s actions appear singularly unusual to the narrator, his pursuit of the old man seems no less conspicuous to us.”

5. Arthur Stringer, The Wire Tappers (1906)

Published in 1906, this novel is one of earliest fictional accounts of wiretapping that I have found. The author, Arthur Stringer (1874-1950) was a prolific Canadian writer who moved to the United States. The Wire Tappers involves Jim Durkin, who has recently been released from prison and who wants to be an inventor. He falls into the criminal underworld of New York, becoming involved with a man called MacNutt who engages in criminal wiretapping.

A book description on Abe books provides an illuminating summary of the book:

6. George Orwell, Nineteen Eighty-Four (1949)

Orwell’s classic novel, Nineteen Eighty-Four, depicts a harrowing totalitarian society where the government (called “Big Brother”), watches its citizens pervasively. A primary surveillance device is the telescreen, a TV that watches people in their homes. Today, it’s known as the internet.

Orwell’s novel has become the classic dystopian account of ruthless government surveillance and snooping, leading to the complete obliteration of private life. Unlike other voyeurs and nosy meddlers, who are creepy or inappropriate, Big Brother is terrifying and oppressive.

For more about Nineteen Eighty-Four, see my post: Orwell vs. Huxley: Which Dystopia Was More Prescient?

7. Alfred Hitchcock (director), Rear Window (1954)

Directed by Alfred Hitchcock, the film Rear Window involves a neighbor turned snooper. Jeff Jefferies (James Stewart) is recovering from injuries and is in a wheelchair. With little to do, he starts to look out his window at the goings-on in other apartments, and he becomes obsessed with the pastime of surveillance.

The movie turns into a murder mystery when Jeff hears a scream and shattering glass, then learns that Lars Thorwald’s wife has gone missing and notices Thorwald engaging in suspicious behavior. Jeff thinks that Thorwald has murdered his wife. Jeff starts to use binoculars and a camera with a zoom lens to spy on Thorwald. Assisting in his spying are his girlfriend, Lisa Fremont (Grace Kelly) and a nurse, Stella.

The movie explores the ethics of voyeurism and how readily people are seduced into engaging in it despite their reservations. Stella questions the ethics of Jeff’s surveillance: “We’ve become a race of Peeping Toms,” she says. Yet she becomes fascinated by what Jeff is observing.

In another scene, Jeff has a conversation with Lisa:

The movie was based on Cornell Woolrich’s story, “It Had to Be Murder” (1942) in Dime Detective Magazine. The story was later published as “Rear Window” in a book of collected stories, After-Dinner Story (1944).

8. Fritz Lang (director), The 1,000 Eyes of Dr. Mabuse (1960)

Directed by Fritz Lang, this film involves Dr. Mabuse, a character from earlier Lang films. The film is set in 1960 in Hotel Luxor, a hotel that was rigged extensively with electronic surveillance by the Nazis. This surveillance system was never removed. With this system, Dr. Mabuse is able to monitor hotel guests via a hidden camera in every room. Dr. Mabuse tries to steal nuclear secrets from an American guest who is the owner of a nuclear arms plant.

As Glenn Erickson of CineSavant writes:

9. Sidney Lumet (director), The Anderson Tapes (1971)

Directed by Sidney Lumet, this caper film stars Sean Connery and Christoper Walken. The film focuses on John “Duke” Anderson (Sean Connery), a safe cracker who decides to rob an apartment building. His robbery planning is recorded by multiple entities that are each engaging in surveillance for different purposes: the Bureau of Narcotics and Dangerous Drugs, the FBI, the IRS, and a private detective. Anderson is not the target of any of this surveillance. None of the watchers are paying enough attention to Anderson to realize what he’s up to.

According to Emily Soars of TCM: “The Anderson Tapes was the first film to tackle the subject of modern surveillance, a theme that would be more thoroughly explored a few years later in Coppola’s The Conversation (1974).”

The Anderson Tapes explores related themes to Paul Pry and Poe’s “The Man of the Crowd”—watching doesn’t necessarily lead to understanding.

The film was based on Lawrence Sanders’ novel, The Anderson Tapes (1970).

10. Francis Ford Coppola (director),
The Conversation (1974)

Directed by Francis Ford Coppola, The Conversation (1974) is one of the all-time classic movies about surveillance. Harry Caul (Gene Hackman) is an audio surveillance expert who is hired by a shady client known as “the Director.” Ironically (and quite commonly), although Harry invades the private lives of others for his vocation, he’s extremely protective of his own privacy.

For this job, he records the conversation of a couple in Union Square and begins to think they might be targets for murder. He investigates and discovers that the woman he recorded is the Director’s wife and she’s having an affair. He discovers other disturbing things, such as witnessing a fight and finding a clogged toilet overflowing with blood in a hotel room.

I’ll skip over most of the rest of the plot to avoid giving away too much, but I can’t avoid discussing that near the end, Harry meets with the Director’s assistant, Martin Stett (Harrison Ford), who tells him he’s being watched and plays him a recording to prove it.

The movie depicts a long-range audio recording device as well as other bugging and wiretapping technology which seem quaint by today’s standards.

The Conversation captures the creepiness of surveillance exceedingly well—how snooping can entangle one into matters that are unsettling, difficult to decipher, and dangerous. The film also shows how readily snoopers can have their comeuppance and be snooped upon.

11. D.G. Compton, The Unsleeping Eye (1974)

Written by British author David G. Crompton, this novel focuses on excessive media exposure of a person’s life. It was originally published under the title The Continuous Katherine Mortenhoe in the U.K. and under the title The Unleeping Eye in the U.S. The novel has been re-released in a new version by The New York Review of Books under its U.K. title.

The novel involves a future world where death has been eliminated, though Katherine Mortenhoe has a terminal brain illness due to her inability to deal with too much sensory input. The public takes an interest in her life, but she wants her final days to be private. However, Roddie from the TV show, Human Destiny, befriends her and secretly records her through cameras in his eyes.

It is amazing how a book written in the 1970s captures today’s world of ubiquitous surveillance, reality TV, and social media so aptly. Today, people’s private lives are frequently turned into grist for public entertainment, many voluntarily but also many unwillingly.

Jeff VanderMeer writes insightfully about the book in his preface to the N.Y. Review of Books edition:

12. Philip K. Dick, A Scanner Darkly (1977)

Philip K. Dick’s A Scanner Darkly takes place in a future dystopian society, and it involves intensive law enforcement surveillance.

Addiction to a drug called Substance D is ravaging the society. The protagonist, Bob Arctor, is an undercover police agent spying on a group of drug users who are living in his house. When at the police station, undercover agents wear a “scramble suit” to conceal their identity from other officers.

At the police station, Arctor watches his housemates through “holo-scanners”—a surveillance system installed throughout his house.

During his undercover work, Arctor becomes addicted to Substance D and experiences severe cognitive impairments and confusion. There are important secrets Arctor doesn’t know, and I’ll stop discussing the plot here to avoid revealing the twists.

13. Philip Noyce (director), Sliver (1993)

Directed by Phillip Noyce, Sliver stars Sharon Stone, William Baldwin, and Tom Berenger. The movie involves a woman (Carly Norris) who moves into a New York City apartment building. The building owner, Zeke, who also has an apartment in the building, has installed video surveillance throughout the building so he can spy on all tenants. He views their private lives in a secret room filled with television monitors.

Jack, a tenant in the building, begins to stalk Carly. Murders start happening in the building. Sliver isn’t a particularly good movie, as it opts for sensationalism over a good story or compelling characters, but it does do a good job at depicting the creepiness and wrongness of Zeke’s snooping—even though the surveillance helps catch the killer.

14. Krzysztof Kieslowski (director), Red (1994)

Red (1994) is the last film in Krzysztof Kieslowski’s masterful “Three Colors” movie series. The film, which is my favorite of the trio, focuses on the life of Valentine Dussault (Irène Jacob) and her journey to find love.

Valentine discovers that her neighbor, a retired judge named Joseph Kern (Jean-Louis Trintingnant), is eavesdropping on his neighbors’ phone calls with surveillance devices. Valentine chastises Kern, threatening to reveal his surveillance, but she ultimately listens in on a call with him. Eventually, Kern confesses to his neighbors that he has been snooping on them.

Valentine (despite her ethical objections) ultimately finds some benefits in the surveillance. Kern turns out to be benevolent, and the surveillance is depicted as a forgivable sin.

Surveillance is only one of several themes woven through the film. Red involves strangers who meet on chance encounters, the contingency of life, and the clash between different views of human nature—Valentine’s idealistic and hopeful perspective and Kern’s cynicism from a life of disappointment. Red is a beautiful and touching film and is probably my favorite Kieslowski film, though the Decalogue is right there up with it (but it’s really a 10-part TV series).

15. Peter Weir (director), The Truman Show (1998)

In The Truman Show, Jim Carrey stars as a man who grows up in a fictional world built to chronicle his life on a TV show. Directed by Peter Weir, the movie cleverly shows scenes as they are caught on the various hidden cameras throughout the idyllic little town Truman inhabits.

The movie shows how the producers manipulate so-called “real life,” and it demonstrates the consequences of reality TV run amok.

One aspect of The Truman Show that struck me is that Truman’s life is rather dull. These days, his show would be lesser-rated fare on the Bravo channel.

In Imagining Surveillance (2015), Peter Marks writes:

16. Mark Romanek (director), One Hour Photo (2002)

Directed by Mark Romanek and starring Robin Williams, this film involves a creepy man (Sy Parrish) who works at a photo store and secretly copies other people’s photos. Sy discovers that the husband of one of his customers is having an affair, and he puts photos about the affair in an envelope that the wife is to pick up. Sy increasingly becomes obsessed, and his actions become darker.

Robin Williams was terrific in this role, one which was quite a departure from his usual humorous and cheerier ones.

17. Florian Henckel von Donnersmarck (director),
The Lives of Others (2006)

The Lives of Others is a German film that won the Academy Award for best foreign language film in 2006. It is a remarkable film, and is one of my favorites about privacy and surveillance.

Set in East Germany in the year 1984, the film depicts a Stasi surveillance officer, Captain Gerd Wiesler (Ulrich Mühe) who is assigned to monitor a famous playwright, Georg Dreyman (Sebastian Koch) and his girlfriend, an actress, Christa-Maria (Martina Gedeck). The playwright’s home is bugged, and the Stasi officer listens in on the playwright and his girlfriend’s intimate conversations. But as he listens, he starts to question his role in the Stasi and begins to feel deeply for the people he is monitoring.

This movie is riveting and moving, and it is truly a masterpiece.

18. Christopher Nolan (director), The Dark Knight (2008)

Directed by Christopher Nolan, The Dark Knight (2008) involved a significant surveillance plotline. In his zeal to locate the Joker (Keith Ledger), Bruce Wayne (a.k.a. Batman) (Christian Bale) develops a mass surveillance system throughout Gotham City using people’s cell phones.

Wayne’s surveillance system is based on technology originally developed by Wayne Enterprises’ Lucius Fox (Morgan Freeman), but Wayne has altered it without Fox knowing.

Fox is furious about the technology and doesn’t want to use it, but he reluctantly agrees to do so to help Wayne catch the Joker. Fox later resigns his position in the company due to his objections about the surveillance.

The movie avoids reaching a definitive moral conclusion about the surveillance. Batman is a hero, yet one who is so maniacally obsessed that he takes things to the extreme. His surveillance is not just zealous—it is Orwellian. Does the end justify the means?

19. Charlie Brooker (creator),
Black Mirror: Shut Up and Dance (2011)

Shut Up and Dance is an episode from the TV series, Black Mirror. It involves a teenager named Kenny who is recorded masturbating by hackers on his webcam. The hackers blackmail Kenny by making him do a series of disturbing tasks. These tasks become darker and darker as the episode progresses. Although Kenny is a victim, it later is revealed that his private activities were far from innocent.

The episode is quite nightmarish, exposing how vulnerable people are in the digital age, how readily people can be spied upon, and how personal data can be used to control people.

20. Joe Weisburg, The Americans (2013-2018)

The Americans chronicles the lives of two Soviet KGB agents during the 1980s who are posing as a married couple in the United States. They have two children who are unaware that they lead double lives as spies.

The show is very well-written, with great characterization, a very engaging plot, and much spy intrigue. The spying, while embellished, is surprisingly realistic according to experts. There is plenty of bugging, wiretapping, and undercover work to excite those interested in privacy.

21. Daniel J. Solove, The Eyemonger (2020)

I’m taking author’s liberty to include my children’s fiction book about privacy, The Eyemonger, illustrated by Ryan Beckwith. In a faraway land, a stranger arrives with promises of greater security in exchange for sacrificing privacy. His name is The Eyemonger, and he has 103 eyes. With the help of flying eye creatures, he spies on everybody. But his plan soon starts to go wrong. His constant watching makes people feel uncomfortable and stifles their creativity. When people complain, The Eyemonger asks: “Do you have something to hide?”

The Eyemonger eventually encounters an artist who resists his surveillance and teaches him an important lesson about the value of privacy.

The topic of privacy is rarely covered in children’s books. I wrote this book to discuss privacy in a way that children can understand.

Conclusion

Snooping is one of the most common privacy themes in fiction, which is no surprise since snooping is often quite dramatic. There are more works than the ones included here, but I hope I’ve covered many of the highlights.

Most of the works depict snooping as conducted by creeps . . . and sometimes by stalkers or blackmailers (One Hour Photo, Sliver, Shut Up and Dance). In some works, the snooping is done at the behest of the state, often for ominous aims such as total control (Nineteen Eighty-Four, The Lives of Others) or spying (The Americans). But there are less nefarious purposes, such as greater security or law enforcement (The Eyemonger, The Anderson Tapes), though in these cases, the snooping still becomes excessive.

Some snooping is done for entertainment (The Truman Show, The Unsleeping Eye). Other times, people snoop to satisfy curiosity (Rear Window, Paul Pry) or for lascivious curiosity (Peeping Tom). Several works show the limits of what can be learned from snooping (“The Man of the Crowd,” Paul Pry). The ability to snoop often isn’t matched by the ability to understand the information acquired.

Although most works depict snooping as wrong, some also show the virtues of what can be learned from it (Rear Window, The Dark Knight). Some works depict snooping in a more lighthearted manner, as laughable nosiness (Paul Pry).

In the end, snooping is depicted mostly negatively. Even in the lighter accounts, snooping is portrayed as creepy, discomforting, and invasive. And in the heavier accounts, the consequences of snooping are far worse.

[1] Ellen Schaf, Finding Her Voice: The Princess’s Struggle In Madame De Lafayette’s La Princesse De Cleves (2011).

[2] Richard H. Moye, Narrative, Appropriation, and Autonomy in La Princesse de Clèves, 104 MLN 845 (Sept. 1980).

[3] Ya-Ju Yeh, Urban Spectacle and Spectatorship in Edgar Allan Poe’s “The Man of the Crowd,” 9 J. Lit. and Art Studies 923 (Sept. 2019).

Daniel J. Solove is the Bernard Professor of Intellectual Property and Technology Law at the George Washington University Law School. He is the founder of TeachPrivacy, a company that provides workforce privacy, cybersecurity security, and AI training to companies and organizations around the world. He is the author of 10+ books and 100+ articles.

You can follow his events, writings, training, cartoons, and resources by subscribing to his free weekly newsletter.

Is personal data property? Should it be?

I’ve often heard arguments that an effective way to protect privacy would be to protect personal data with property rights. The thinking behind this idea is that ownership of property confers a lot of power on the owner, so perhaps this is the best way to empower individuals to control their data.

Unfortunately, it doesn’t work. I wrote about this problem more than twenty years ago in my book, THE DIGITAL PERSON: TECHNOLOGY AND PRIVACY IN THE INFORMATION AGE (2004) (see here for a free PDF of the entire book).

I began my discussion by explaining the theory animating the proponents of privacy-as-property:

But there are several deficiencies with protecting privacy as property.

1. Because property rights are alienable, companies will readily make people transfer their data to them, and then the companies will have even more power over people’s data.

Regarding privacy, companies have much greater power over consumers than vice versa. Under the notice-and-choice approach of U.S. law, as well as under many other privacy laws, companies have a wide latitude to define what data they gather and how they’ll use it.

Giving the initial possession of data to individuals doesn’t mean they’ll end up with possession in the end. Companies can readily redefine their relationship with consumers to force the transfer of data to them. In other words, in a scrum for possession of the football, companies have the strongest arms and will resort to ruthless tactics to get what they want.

Under a property rights approach, people might end up with less protection than they have now. If people “sell” their data to companies, then companies might demand that people relinquish their rights in the data, such as the right to delete, to withdraw consent, or to stop certain uses. Currently, when privacy laws provide for individual rights like these, the rights are inalienable; companies can’t force people to bargain them away. But once we start down the property road, this might change.

Perhaps there’s a way the law could restrict companies from what they could do with the data once they wrest ownership of it from people. The property metaphor might be probed to explore other concepts in property such as easements or various rights or requirements that run with the land. Perhaps even when “owning” personal data, a company doesn’t own it totally but certain rights are retained by the consumer. Another analogy might be to historical property where owners can’t do anything they want to the property but must follow certain rules about preservation and maintaining historical character.

But these are exceptions to the normal rules of ownership, and the law would need to start imposing quite a lot of these restrictions to make privacy-as-property work in any reasonably protective way for consumers.

2. People are already trading their personal data away in the current digital economy. Viewing personal data as property just validates what’s already going on.

The internet only appears to be free, but it’s not really free. Companies are offering free or discounted products and services in exchange for personal data. In essence, the data already is people’s property and they are giving it away to use free social media sites, apps, and other technologies.

Right now, even when people turn over their data, it isn’t quite treated as the full property of companies. It exists in a kind of vague twilight. Calling personal data “property” will make transactions in the digital economy more clear; people are selling their data for the convenience and fun of tech.

It might feel good to call a spade a spade. I’m all for ending the ruse that so many digital technologies are free. But there’s a virtue with the vague twilight status of our personal data. When we “sell” it to companies, it’s not fully clear what, exactly, we’re “selling.” If the data is clearly designated as “property” that people “sold” to companies, then companies might be emboldened to exercise wider uses of the data because they “purchased” it.

3. People can’t accurately value their personal data, so they are at risk of selling it for far less than it is worth.

As I wrote in THE DIGITAL PERSON:

I also noted that people can’t value their data because they must assess the value in separate situations at different times with isolated bits of data:

Additionally, I contended:

Viewed through a property lens, we’re pawning our data blind. It’s nearly impossible to assess its value to us because we don’t know how it will be combined and used in the future.

4. The value of personal data is more than just a monetary figure.

Property rights often focus on money as the way to measure the value of personal data, but the value of personal data is much more than just about money. Another quote from THE DIGITAL PERSON:

In Dwyer v. American Express Co., 652 N.E. 2d 1351 (Ill. App. 1995), American Express cardholders sued the company for selling their names to merchants. The plaintiffs advanced a theory for appropriation of the value of their name or likeness, which they rooted in a property theory. The court rejected this theory because “a single, random cardholder’s name has little or no intrinsic value to defendants (or a merchant). Rather, an individual name has value only when it is associated with one of the defendants’ lists. Defendants create value by categorizing and aggregating these names.” The court further reasoned that “defendants’ practices do not deprive any of the cardholders of any value their individual names may possess.”

All this focus on the monetary value of the data led to the court’s failure to recognize the harm to the plaintiffs, which wasn’t really a failure to compensate them. The harm was that their data was used and sold and they were powerless to do anything about it.

For each individual, the use of their personal data by a company might amount to a very small amount of money if individuals were to gain a share of their individualized monetary value. Being paid a small royalty of a few dollars or cents might be nice pocket change, enough to buy a pack of gum (and maybe a happy meal), but it’s a pittance in the overall scheme of things. The greater value of privacy is the risk and harm that it can bring about to individuals and society.

5. Personal data often has shared ownership, which complicates the ability to assign property rights to it.

Much personal data is shared. For example, our genetic data belongs to a lot more than just us. We share a vast majority of DNA with every other human. And we share even more genetic data with family members.

In a transaction, data is created between the seller and buyer. It’s not clear who owns it. Suppose Jack sells Jill the book War and Peace. Is it Jill’s information that she bought War and Peace from Jack? Or can Jack say that it is his information that he sold War and Peace to Jill?

Is Jill’s claim better than Jack’s? Suppose Jill is a celebrity, and it is the highlight of Jack’s life that he sold War and Peace to a famous person. Both Jack and Jill have claims to the data.

As I wrote in THE DIGITAL PERSON: “We often develop personal information through our relationships with others. When a person purchases a product, information is created through the interaction of seller and buyer.”

Our relationships with friends and family also involve shared data. So do our relationships with others, such as colleagues, acquaintances, and everyone we encounter throughout every day. A ton of personal data is generated within these relationships. All parties have ownership claims to the data.

6. Property rights are too individualistic; privacy issues affect us all.

Giving people property rights in their data views privacy as primarily an individual harm. But privacy also affects society. In today’s age of AI, companies can affect people by using the data of other people to train AI models and make algorithmic predictions. Even if the law gives you a right to own your data, it won’t protect you against AI trained on the data of others.

As I wrote in The Limitations of Privacy Rights, 98 Notre Dame L. Rev. 975 (2023):

Conclusion

I’m not advancing a form of collective ownership or arguing that we all should own each other’s data. What I’m contending is that we shouldn’t look to ownership at all.

Ownership isn’t the right tool for protecting personal data. Nor is individual control over personal data.

Instead, we should focus on privacy protection against risk and harm. Being protected against risk and harm isn’t solved with ownership of one’s data; it’s a matter of consumer protection.

Related: Privacy as Contract?

Beyond property law, another component of market approaches to protecting privacy is contract law. In our forthcoming article, Privacy as Contract?, 112 Iowa L. Rev. __ (2026), Professor Woodrow Hartzog and I ask similar questions about contracts as I discussed above about property. Are privacy notices contracts? Should they be?

We argue that doctrinally, the law remains unresolved on the issue, though it is starting to lean towards viewing privacy notices as contracts. Normatively, we contend that privacy notices shouldn’t be treated as contracts because it would be terrible for consumers. Read the draft to find out why.

Daniel J. Solove is the Bernard Professor of Intellectual Property and Technology Law at the George Washington University Law School. He is the founder of TeachPrivacy, a company that provides workforce privacy, cybersecurity security, and AI training to companies and organizations around the world. He is the author of 10+ books and 100+ articles.

You can follow his events, writings, training, cartoons, and resources by subscribing to his free weekly newsletter.

I enjoy collecting things related to privacy as well as seeing how privacy is described and depicted throughout different times in history.

I collected about 50 magazine covers involving privacy from the 1950s to the present. I’m excited to share my collection with you. If you have any covers I’ve missed, please share them with me.

I also have a collection of magazine covers involving AI, computers, and the internet that I’ll be sharing later.

I’ll begin with a quick look, then I’ll include larger images later.

1950-1959

Time, July 14, 1952

House and Garden, January 1957

1960-1969

New Yorker, February 11, 1961

Life, May 20, 1966

1970-1979

Newsweek, July 27, 1970

Time, October 11, 1971

Saturday Review, April 17, 1971

Newsweek, June 23, 1975

New York, May 3, 1976

Saturday Review, July 21, 1979

1980-1989

Byte, September 1980

Ms. Magazine, February 1981

U.S. News & World Report, July 12, 1982

Time, November 28, 1983

Mad (UK Edition), January 1984

Awake, February 22, 1988

Discover, March 1988

1990-1999

Time, November 11, 1991

Time, October 13, 1997

The New Yorker, August 24 & 31, 1998

The New Yorker, January 11, 1999

The Economist, May 1-7, 1999

2000-2009

Time, July 31, 2000

Time, July 2, 2001

Reason, June 2004

Personalized for each subscriber

Time, December 25, 2006

Scientific American, September 2008

I have a particular fondness for this issue because I wrote an article in it.

2010-2019

The Week, May 14, 2011

The New Yorker, June 24, 2013

Mad, October 2013

Newsweek, April 25, 2014

WIRED, September 2014

Time, March 21, 2015

Science, January 2015

Freedom, May 2015

MIT Technology Review 2018

National Geographic, February 2018

PC & Tech Authority, May 2018

Computer Shopper, April 2018

Bloomberg Businessweek, April 23, 2018

The Telegraph Magazine, December 2019

2020-present

MIT Technology Review, Jan/Feb 2020

Newsweek, May 22, 2020

Time, May 30, 2020

NYT Mag, March 21, 2021

April 24-May 1, 2023

New Scientist, August 26, 2023

MIT Technology Review, April 2023

Comment, Spring 2025

Wired, Mar/Apr 2026

Mad, February 2026

Daniel J. Solove is the Bernard Professor of Intellectual Property and Technology Law at the George Washington University Law School. He is the founder of TeachPrivacy, a company that provides workforce privacy, cybersecurity security, and AI training to companies and organizations around the world. He is the author of 10+ books and 100+ articles.

You can follow his events, writings, training, cartoons, and resources by subscribing to his free weekly newsletter.

The TV series Andor (2022-2025) is one of the very best depictions of the dimensions of an authoritarian regime and those who resist it. The series is one of my all-time favorites—it is phenomenal in everything, from writing to acting to cinematography.

Andor chronicles the beginnings of the rebellion against the Empire prior to the movie Star Wars Episode IV (1977). It is a prequel to the prequel movie, Rogue I: A Star Wars Story (2016).

Created by Tony Gilroy, the series focuses on the life of rebel spy Cassian Andor (Deigo Luna) and others in the rebellion as well as some figures working for the Empire.

It is surprising to find such an outstanding work of art in the Star Wars universe, let alone by Disney, which has been pumping out soulless material with nothing to say, just an endless series of attempts to make money from the fumes of the original movies.

Andor has something to say. It transcends Star Wars and also returns it to its roots, as a story about resistance to authoritarianism. It i hands down the best creation in the Star Wars universe since The Empire Strikes Back. And, in many ways, it surpasses the originals in the depth of its writing and the seriousness and rigor in which it explores its themes. It is Star Wars without the silliness, and well worth a watch even if you don’t like anything made in the Star Wars universe since the original trilogy . . . and even if you’re not fond of those movies.

The series explores many themes involving privacy in authoritarian societies, including oppressive surveillance and control, disinformation and lies, and the dehumanization of bureaucracy.

Superbly written and acted, the show is one of the most sophisticated explorations of the oppressiveness of authoritarianism as well as of the sacrifices of those who rebel.

Unforgettable Monologues: The Cost of Rebellion

Andor depicts the profound sacrifices rebels must make to fight authoritarianism. The show is uncompromising in showing how the rebels must make difficult compromises. Unlike typical the Star Wars black-and-white moral simplicity, in Andor, most characters are shaded in gray. Luthen Rael (Stellan Skarsgård) is a prime example, an essential figure in the rebellion who has a ruthlessness almost as extreme as the Empire’s.

Among the many highlights of Andor are its stirring monologues. Characters launch into eloquent speeches about rebellion that never feel forced. Here’s a quote from Luthen’s monologue, where he explains his philosophy and tactics:

At the end of the first season, Maarva Carassi delivers a stirring speech about rebellion: