Tech Law

Privacy Concerns and Policy Considerations in the Age of Generative AI

Introduction

Since the emergence of generative artificial intelligence (AI) systems like OpenAI’s ChatGPT and Google’s Bard, policymakers have begun to address the potential risks associated with these powerful technologies. Generative AI, which encompasses various AI and machine learning techniques, allows the generation of new content based on patterns learned from existing data. While generative AI offers numerous possibilities, it also raises concerns regarding privacy, misinformation, copyright infringement, and non-consensual content creation. This blog post focuses on the privacy implications of generative AI and explores relevant policy considerations for Congress.

Understanding Generative AI

Generative AI refers to AI models capable of producing new content, including text, images, and videos, by learning patterns from available data. Different types of generative AI models exist, with each model generating content based on specific inputs or prompts. For example, some models can generate images from text prompts, while others can create videos. Moreover, there are general-purpose models that can perform multiple functions and are built on large language models (LLMs) capable of recognizing, predicting, translating, summarizing, and generating language. LLMs, such as OpenAI’s GPT-3, are trained on massive datasets to learn the rules of language.

Privacy Concerns in Generative AI

Generative AI models, particularly LLMs, require extensive amounts of data for training and fine-tuning. For instance, ChatGPT was trained on over 45 terabytes of text data obtained from the internet, including sources like Wikipedia and digitized books. Critics argue that such models often rely on privacy-invasive methods of data collection without the consent or compensation of individuals whose data is used. Additionally, these models may inadvertently reveal sensitive or personal information during interactions with users. Data used to train generative AI models can come from publicly available web pages, potentially including personally identifiable information and copyrighted content.

Implications of Data Collection

The sourcing of data for generative AI models is often done through web scraping, where publicly available information is collected from websites. Some AI developers rely on large datasets like Colossal Clean Crawled Corpus and Common Crawl, while others use proprietary datasets. The scraping process may raise copyright ownership and fair use concerns, as the datasets can contain copyrighted content and potentially harmful information. Furthermore, the use of scraped data without the creator’s consent has prompted artists and content creators to seek tools to identify and report their own content within these databases.

Data Privacy and Policy Considerations

Given the lack of a comprehensive federal data privacy law in the United States, generative AI may implicate existing privacy laws depending on factors such as the context, developer, type of data, and purpose of the model. Current privacy regulations, like the Children’s Online Privacy Protection Act (COPPA) and state privacy laws, provide some safeguards but are not tailored specifically to generative AI. Congress may consider enacting comprehensive federal privacy legislation that addresses the unique challenges posed by generative AI, drawing inspiration from state laws and international efforts like the European Union’s proposed AI Act.

Proposed Privacy Legislation

Several privacy bills introduced in Congress include mechanisms that could impact generative AI applications. These include notice and disclosure requirements, opt-out provisions, and deletion and minimization requirements. Companies developing or deploying generative AI systems might be required to obtain user consent, provide notice of data collection, offer opt-out options, and enable data deletion. Congress would need to consider practical challenges for users and companies when exercising specific privacy rights and complying with legal requirements.

Existing Agency Authorities

Federal agencies like the Federal Trade Commission (FTC) play a crucial role in enforcing laws related to AI and data privacy. The FTC has applied its authorities to cases involving data privacy and data security, and it could potentially extend its enforcement actions to include generative AI. Additionally, agencies like the National Institute of Standards and Technology (NIST) could provide guidance and best practices on data privacy and AI model development, promoting responsible use and minimizing privacy risks.

Conclusion

Generative AI offers immense possibilities but also raises significant privacy concerns. As policymakers grapple with the complexities of regulating generative AI, comprehensive federal privacy legislation is needed to address the unique challenges it presents. Privacy safeguards, user consent, transparency, and accountability should be central considerations in any policy discussions regarding the deployment and use of generative AI technologies.