Honesty is the Best (Privacy) Policy: The Importance of Transparency in Disclosing Data Collection for AI Training
Alexandra Logan
Introduction
This past July, the Federal Trade Commission (“FTC”), Department of Justice, and a number of international antitrust enforcers issued a Joint Statement on Competition in Generative AI Foundation Models and AI Products. The Joint Statement details that “[f]irms that deceptively or unfairly use consumer data to train their models can undermine people’s privacy, security, and autonomy . . . it is important that consumers are informed . . . about when and how an AI application is employed in the products and services they purchase or use.” Alleged unfair and deceptive acts or practices (“UDAP”) can be investigated by the FTC via Section 5 of the FTC Act.[2] Consumers are looking for more ways to limit the ability of companies to collect and use their data for AI training purposes,[3] and companies should be vigilant in ensuring their privacy policies are up to date and thorough. If companies can keep their privacy policies up-to-date, this can help them to avoid making deceptive or misrepresentative claims about the data that they collect or what they do with it. Recently, X and LinkedIn have come under fire by consumers because of the companies’ data collection practices, and their ambiguous representations and omissions about how they use consumer data.
Companies are Facing Scrutiny Due to Data Collection Practices and Disclosures
X, formerly known as Twitter, recently announced major updates to its privacy policy set to take effect in mid-November.[4] Under the new terms, X and other third-parties will be able to take data from the platform, including user data and published content, and use this information to enhance AI models and other machine learning technologies.[5] Further, the current privacy policy fails to specify how and if a user can actually opt-out of this type of data-sharing.[6] Additionally, X appears to be changing its data retention policy, vaguely stating that the company will keep “‘different types of information for different periods of time, depending on how long we need to retain it in order to provide you with our products and services, to comply with our legal requirements and for safety and security reasons.’”[7] Many X users are not pleased with these developments, and some are seeking to disable their accounts or leave the platform because of these practices.[8]
LinkedIn was reportedly opting users into training LinkedIn and affiliate AI systems before updating the company’s privacy policy to acknowledge this practice.[9] Consumers can opt out of LinkedIn’s use of their data by turning the setting off in their account preferences, but the company failed to affirmatively alert users of this data collection practice and failed to alert the consumers of the ability to opt out of data collection and sharing.[10] Users had no way of knowing that LinkedIn was collecting their data for AI training purposes before the company updated its privacy policy. Notably, LinkedIn does not train its AI systems on the data of those who reside in the European Union or United Kingdom due to strict legal requirements around notice and consent.[11]
Companies Should Take Note
While such practices outlined above raise many ethical questions around the use of consumer data and privacy, these recent developments will likely also catch the eye of various regulators in the privacy and consumer protection spaces, including the FTC. The FTC previously stated that the Commission will be on the lookout for anticompetitive, deceptive, and/or unfair behavior by companies in their use and development of AI.[12] The FTC will likely seek to enforce any penalties through FTC Act’s Section 5, which grants the FTC enforcement power against companies that engage in unfair or deceptive acts or practices.[13] The data collection practices of X and LinkedIn could qualify as deceptive acts under Section 5. While the term “deceptive” is not defined in the statute, the FTC views deception as a “representation, omission or practice that is likely to mislead the consumer.” This is the first element of the “deception” analysis. The second element requires that the FTC assess if the misled consumer is acting reasonably under the circumstances.[15] Finally, the third element of the analysis requires that the “representation, omission, or practice be a ‘material’ one.”[16] This last element examines if the act or practice is “likely to affect the consumer’s conduct or decision with regard to a product or service” to the detriment of the consumer. [17] There could be valid arguments under each of these elements to back up an FTC claim of deceptive acts or practices by X or LinkedIn. In 2012, Facebook entered into a consent order with the FTC to resolve allegations that the company misrepresented the extent of its data sharing practices, but, in 2019, the FTC fined Facebook a whopping $5 billion for continued misrepresentation of these practices in violation of the 2012 order.
The FTC is clearly on the lookout for deceptive behavior concerning data sharing, and AI is no exception. An FTC report published in September listed a number of recommendations for social media companies concerning their data practices The report listed limiting third party data sharing, ensuring data minimization in retention, creating clear privacy policies, and addressing lack of access and control in AI as recommendations for companies moving forward.[20] The report also reminded readers that implementing retroactive changes to data, security, or privacy policies without notifying consumers and obtaining consent could be viewed as unfair or deceptive acts or practices.[21] Companies should be vigilant in ensuring that their privacy policies and public representations are in line with their current policies and procedures. Honesty and transparency in data collection practices will go a long way with consumers, and will also help companies avoid FTC liability.
References
[1] Margrethe Vestager et al., Joint Statement on Competition in Generative AI Foundation Models and AI Products, European Comm’n, U.K. Competition & Mkts Auth., U.S. Dep’t of Justice, U.S. Fed. Trade Comm’n, at 3 (July 2024).
[2] 15 U.S.C. § 45.
[3] See, e.g., Shira Ovide, Five Ways to Stop Companies from Using Your Data in New Ways, Wash. Post (Oct. 15, 2024), https://www.washingtonpost.com/technology/2024/10/15/meta-ai-linkedin-paypal-user-data/.
[4] See Eduardo A. Villarroel, X (Twitter) Sparks Controversy with New AI Training Policy, Metricool (Oct. 24, 2023), https://metricool.com/x-twitter-new-ai-training-policy-controversy/.
[5] Id.
[6] See Privacy Policy, X Corp., at § 3, § 3.2, https://x.com/en/privacy (last visited Nov. 10, 2024).
[7] Morgan Sung, Elon Musk’s X Is Changing Its Privacy Policy to Allow Third Parties to Train AI on Your Posts, TechCrunch (Oct. 17, 2024), https://techcrunch.com/2024/10/17/elon-musks-x-is-changing-its-privacy-policy-to-allow-third-parties-to-train-ai-on-your-posts/.
[8] See Caitlyn Pauley, Elon Musk’s X Can Now Use Your Data to Train Its AI, 9meters, (Nov. 15, 2024), https://9meters.com/entertainment/social-media/elon-musks-x-can-now-use-your-data-to-train-its-ai.
[9] Wes Davis, LinkedIn is Training AI Models On Your Data, The Verge (Sept. 18, 2024), https://www.theverge.com/2024/9/18/24248471/linkedin-ai-training-user-accounts-data-opt-in.
[10] See id.
[11] See Nathan Eddy, LinkedIn Addresses User Data Collection for AI Training, Dark Reading (Nov. 15, 2024), https://www.darkreading.com/cyber-risk/linkedin-user-data-collection-ai-training.
[12] See generally Vestager et al., supra note 1.
[13] See 15 U.S.C. § 45.
[14] Letter from James C. Miller III, Former F.T.C. Chair, to Hon. John D. Dingell, Comm. on Energy and Com. Chair (Oct. 14, 1983), https://www.ftc.gov/system/files/documents/public_statements/410531/831014deceptionstmt.pdf.
[15] See id.
[16] Id.
[17] Id.
[18] See FTC Imposes $5 Billion Penalty and Sweeping New Privacy Restrictions on Facebook, F.T.C. (July 24, 2019), https://www.ftc.gov/news-events/news/press-releases/2019/07/ftc-imposes-5-billion-penalty-sweeping-new-privacy-restrictions-facebook.
[19]See Fed. Trade Comm’n, A Look Behind the Screens: Examining the Data Practices of Social Media and Video Streaming Services (Sept. 2024), https://www.ftc.gov/system/files/ftc_gov/pdf/Social-Media-6b-Report-9-11-2024.pdf.
[20] See id. at 81-82.
[21] See id. at 4-5.
