Revisiting Data Privacy In The Age Of AI: Legal
Gaps And The Need For Adaptive Solutions
University of Chester
School of Computer and Engineering
Science
Chester, United Kingdom
Assessment Number: J120892
Abstract—In the age of artificial intelligence (AI), the
integration of AI technologies into everyday life has raised
significant concerns regarding data privacy. While tools like
ChatGPT have transformed both personal and professional
routines, their underlying mechanisms often involve extensive
data collection, raising ethical and practical issues. This paper
critically examines how the evolving AI technologies have
disrupted the relationship with data privacy, the structural
limitations of existing laws and regulations in addressing AI-
related privacy concerns, and explores new directions in terms
of responsiveness to address these challenges in the context of
AI’s rise.
Keywords—Artificial Intelligence (AI), data privacy, personal
data, data collection, user consent, deepfake, data protection,
General Data Protection Regulation (GDPR), California
Consumer Privacy Act (CCPA), controllers, processors, privacy
harms, Data Protection Officer (DPO), International Association
of Privacy Professionals (IAPP)
I. INTRODUCTION
Artificial intelligence has reshaped societies by offering
unprecedented capabilities in problem solving, decision
making, creativity and autonomy. However these
breakthroughs come with significant trade-offs, particularly in
the realm of data privacy. From ChatGPT assisting users with
personal queries to facial recognition technologies deployed in
public spaces, AI tools often rely on vast quantities of data
based on consumers’ personal information. This reliance
poses concerns about the ethical management of personal
information, the potential for misuse and the adequacy of
existing regulatory frameworks. To start, according to the
General Data Protection and Regulation (GDPR), personal
data are “any information which are related to an identified or
identifiable natural person” (European Union, 2016, Art. 4,
para. 1). Then, data privacy can be defined as the principle that
governs who has access to collect and process personal
information, as well as the degree of control individuals have
over that access, including the ability to opt out of data
collection (King & Meinhardt, 2024). In fact, this concept is
broader than personal data as it covers any information, that, if
shared without permission, could violate our right to privacy
and personal freedom (King & Meinhardt, 2024).
The review focuses on AI use by companies and non-
governmental actors targeting consumers, excluding
government and political surveillance, which is beyond its
scope.
As AI continues to erode data privacy’s principle, laws and
regulations struggle to keep pace with its rapid advancements.
As a result, this review calls for a new approach, emphasizing
adaptive solutions to tackle the evolving challenges of data
privacy.
II. AI ERODES DATA PRIVACY’S PRINCIPLE
A. AI Erodes Data Privacy’s Principle Through Service
Providers
AI tools undermine the core principle of data privacy.
King and Meinhardt (2024) state that the use of AI tools
“normalized the idea that individuals should have to opt out,
rather than choose to opt in” the collection of their data (p. 24).
This normalisation of data collection often occurs without
explicit user consent or clear transparency. Popov (2023)
reported that Zoom faced backlash over a March 2023 update
to its terms, allowing AI training on customer data without
explicit consent, prompting the company to clarify its policy
and disable AI features by default. It could be argued that
consumers have normalised the erosion of their data privacy
by unquestioningly accepting and failing to review the Privacy
Policies and Terms of Use presented by AI service providers.
This demonstrates that their consent can easily be drawn off.
AI systems collect a lot of personal data and may lack
transparency regarding how it is used. An example of this is
the Nest thermostat, a home appliance that gathers extensive
personal data from households to optimise energy use, among
other functions. Since Google, through its child branch
Alphabet, has acquired the product, the data will be uploaded
to Google’s servers for predictive analytics or sold to third
parties. It raises a concern because although the thermostat
contains its own privacy policies and terms of service
agreements, the users are not fully informed of how their data
is managed behind the scenes (Ijuo, 2024). Thus, users are not
truly consenting to how companies process and manage their
data. Overall, the AI-driven ecosystem undermines data
privacy's principle by normalising data collection and
bypassing core values like transparency and explicit consent.
B. AI Renders Invalid Data Privacy’s Principle Through
Third-parties
AI technologies have not only eroded data privacy’s
principle but have also rendered it obsolete. This is particularly
evident in the use of deepfakes which are “images, audio
recordings or videos that have been manipulated to yield
fabricated images and sounds that appear to be real” (Sierra,
2020, para. 1). As an example, the application DeepNude was
able to generate fake images of naked women by
superimposing the face of an existing woman onto another
image (Leskin, 2019). These technologies produce deceptive
