U.S. Senator Maria Cantwell (D-Wash.), Chair of the Senate Committee on Commerce, Science and Transportation, convened a hearing this morning with legal, policy and private sector privacy and artificial intelligence (AI) experts to explore how the rapid advancement of AI is accelerating the urgency to pass a federal privacy law.  

“Americans’ privacy is under attack,” said Sen. Cantwell. “We are being surveilled, tracked online and in the real world through connected devices. Now, when you add AI, it is like putting fuel on a campfire in the middle of a windstorm.”

Watch Sen. Cantwell’s Opening Remarks

Experts told Members of the Committee that the advancement of AI systems has changed the landscape for data privacy. AI has allowed online surveillance, detailed consumer profiling, personalized fraud and deepfakes to be done at scale, with little human involvement and minimal cost.

“The trajectory of AI is at a crucial inflection point. Without regulatory intervention, we are doomed to replicate the extractive, invasive, and often harmful data practices and business models that have characterized the past decade of the tech industry,” said Amba Kak, Co-Executive Director of the AI Now Institute, in her testimony. “A federal data privacy law, especially one with strong data minimization, could act as a foundational intervention to break this cycle and challenge the culture of impunity and recklessness that is hurting both consumers and competition.

“Our market choices—what we see, choose, and click—are scripted and arranged in advance,” said Dr. Ryan Calo, University of Washington School of Law and Co-Director of the University’s Technology Lab, in his testimony. “Many AI techniques boil down to recognizing patterns in large data sets. Even so-called generative AI works by guessing the next word, pixel, or sound in order to produce new text, art, or music. Companies are increasingly able to use this capability to derive sensitive insights about individual consumers from public or seemingly innocuous information…The ability of AI to derive sensitive information such as pregnancy or mental health based on seemingly non-sensitive information creates a serious gap in privacy protection.”

“Privacy rules are long overdue. But the acceleration of AI over the past few years threatens to turn a bad situation into a dire one,” Dr. Calo continued. “Congress should pass comprehensive privacy legislation that protects American consumers, reassures our trading partners, and gives clear, achievable guidelines to industry. Data minimization rules—which obligate companies to limit the data they collected and maintain about consumers—could help address AI’s insatiable appetites.”

“Without knowing what data is being collected and how it is being leveraged by AI systems, we will have little ability to govern the technology effectively in the interests of consumers,” said Udbhav Tiwari, Global Product Policy Director for Mozilla, in his testimony. “At Mozilla, we believe that comprehensive privacy legislation is foundational to any sound AI framework. Without such legislation, we risk a ‘race to the bottom’ where companies compete by exploiting personal data rather than safeguarding it.”

Sen. Cantwell asked Dr. Calo to expand upon comments made in his testimony about how AI is able to use consumers’ sensitive data to derive patterns of their habits and exploit them, saying that “we're very worried about the capacity to drive sensitive insights and then, as you mentioned, an insurance company, or somebody using that information against you.”

Watch Sen. Cantwell’s and Dr. Calo’s Exchange 

“The problem is that the ability to derive sensitive insights is being used in ways that disadvantage consumers, and they're not able to figure out what's going on and fight back,” Dr. Calo explained. “For example, we know why everything costs $9.99, right? It's because your brain thinks of it as being a little bit further away from $10 than it really is. But the future we're headed to, and even the present, is a situation where you're charged exactly as much as you're willing to pay in the moment.”

Dr. Calo continued: “Say, I'm trying to make dinner for my kids, and I'm trying desperately to find a movie for them to stream that they both can agree on. You know, if Amazon can figure that out, or Apple can figure that out, they can charge me more in the moment when I'm flustered and frustrated, because they can tell. If that sounds far-fetched, senator, Uber once experimented with whether or not people would be more willing to pay surge pricing when their batteries were really low on their phone because they'd be desperate to catch a ride. Amazon itself has gotten into trouble for beginning to charge returning customers more because they know that they have you in their ecosystem.”

“This is the world of using AI to extract consumer surplus,” Calo said. “And it's not a good world, and it's one that data minimization could help address.”

Sen. Cantwell unveiled in April the discussion draft of the American Privacy Rights Act with House Energy and Commerce Chair Cathy McMorris Rodgers. The comprehensive draft legislation sets clear, national data privacy rights and protections for Americans, eliminates the existing patchwork of state comprehensive data privacy laws and establishes robust enforcement mechanisms to hold violators accountable, including a private right of action for individuals.