Personal Data and Information Privacy

The central legal tension in human information privacy is how law should govern the collection, processing, and use of personal data when both governments and private platforms can use surveillance technologies to reveal, predict, or influence human behavior. The issue matters because modern information practices affect constitutional rights, consumer protection, competition, democratic integrity, mental health, and the basic ability of individuals to participate in digital life without being manipulated or exploited. In this CLE talk, Professor Neil Richards of Washington University in St. Louis School of Law, a leading scholar of privacy law and information policy, examines how existing legal frameworks struggle to address the scale and consequences of contemporary data practices. The discussion ranges from Fourth Amendment doctrine and consumer consent to FTC authority, targeted advertising, “free” digital services, and the possibility of legal duties designed around human trust and flourishing.

A first major issue is how constitutional protections against government surveillance should be translated into the digital age. The governing principle is that the Fourth Amendment must continue to protect the substance of private life even when information is stored or generated through new technologies rather than paper records or physical spaces. Richards discusses cases such as Warshak v. United States, which treated email as analogous to letters or phone calls for warrant purposes, and Supreme Court decisions including United States v. Jones, Riley v. California, and Carpenter v. United States, which addressed GPS tracking, cell phone searches incident to arrest, and access to historical cell-site location data. In his view, these cases show the importance of faithfully applying constitutional protections to modern surveillance tools rather than allowing old language to become obsolete in a digital environment.

The second major issue is that constitutional privacy protections generally restrain the state, not private companies. Under the state action doctrine, the Bill of Rights does not directly regulate most corporate uses of human information, even though platforms, data brokers, software providers, and advertisers may exercise enormous power over individuals. Richards argues that this gap requires a modern consumer protection framework for the information economy, analogous to the workplace safety and pure food rules developed in response to industrial-age risks. A recurring theme is that privacy law should not be built on the fiction of fully informed “users” making meaningful choices in an ecosystem of “innovation,” because many digital choices are unwitting, coerced, or made by people who lack real capacity or bargaining power, including children.

The discussion also examines the limits of consent-based privacy regimes and the need to update existing consumer protection law. The FTC’s authority over unfair and deceptive acts or practices under Section 5 has been the principal federal tool for privacy enforcement, but Richards argues that doctrines created for an earlier economy are often poorly suited to mobile apps, behavioral design, platform surveillance, and data-driven manipulation. He critiques the current unfairness framework, including the statutory balancing test that can permit substantial consumer harm when offset by asserted benefits to consumers or commerce, and suggests that deception doctrine should better address services marketed as “free” when users pay through data, attention, and exposure to advertising. He also discusses potential recognition of “abusiveness” as a separate or expanded basis for regulation, aimed at dark patterns and the weaponization of behavioral economics to steer consumers toward outcomes they did not meaningfully choose.

Targeted advertising and the “free internet” provide a concrete example of the broader problem. Richards distinguishes contextual advertising, which is tied to the content a person is viewing, from surveillance-based advertising, which depends on extensive tracking across digital and physical environments. In his account, surveillance advertising creates risks that go beyond ordinary marketing, including data breaches, consumer manipulation, discrimination, political influence, and business models that reward engagement even when engagement may be harmful. The broader implication is that privacy law should move beyond notice-and-choice formalism toward baseline rules, possibly including duties of loyalty, that require companies using human information to act in ways consistent with the interests of the people whose data they process.

This conversation offers a framework for thinking about privacy not merely as secrecy, but as a central component of consumer protection, constitutional governance, and human autonomy in the information age.