The Role of Regulatory Enforcement in the Growth of Social Media Companies

Content including text and images © Aditya Mohan. All Rights Reserved. Robometircs, Amelia, Living Interface and Skive it are trademarks of Skive it, Inc. The content is meant for human readers only under 17 U.S. Code § 106. Access, learning, analysis or reproduction by Artificial Intelligence (AI) of any form directly or indirectly, including but not limited to AI Agents, LLMs, Foundation Models, content scrapers is prohibited. These views are not legal advice but business opinion based on reading some English text written by a set of intelligent people.

Introduction

The meteoric rise of social media giants such as Facebook, Instagram, TikTok, and Google has revolutionized global communication, commerce, and information dissemination. These platforms have become integral to the daily lives of billions of people worldwide, offering unprecedented connectivity and access to information. Central to their business models is the collection and monetization of user data—a practice that has generated immense profits but also raised significant privacy concerns. While creating laws to regulate such activities may seem straightforward, enforcing them presents substantial challenges. Regulatory agencies often lack the necessary resources, struggle to quantify the actual harm caused, and face powerful lobbying efforts from these tech behemoths.

This article explores whether the challenges posed by these platforms stem from a lack of enforcement of existing regulations or from the need for new laws tailored to the digital age. We will examine the unique nature of digital platforms, the evolution of data privacy concerns, the legal doctrines that govern them—including international principles like the United Nations doctrine of privacy and constitutional protections in the United States—and the business implications of these issues. Furthermore, we will draw parallels with the field of artificial intelligence (AI), highlighting similar challenges in data privacy and regulatory enforcement.

Teenager Caught Between Convenience and Privacy: In a dimly lit bedroom, a young woman sits on her bed, illuminated by the soft, focused glow of her phone and the ambient light from a nearby computer screen. Her expression is subtly tense, reflecting a blend of concern and absorption as she navigates her device, suggesting she is deeply engrossed in reviewing updates or notifications. The room has a comfortable yet modern feel, with books neatly lined on shelves and a nightstand that holds a lamp emitting a warm, comforting light. This warm glow contrasts with the cooler, sharper light from the computer, which displays alerts relating to privacy concerns and data breaches.

Hints of social anxiety and digital stress are visible in the thoughtful way she sits, slightly hunched and clutching her phone, symbolizing the pressure of constant connectivity. The meticulously arranged environment, with books that may allude to topics on privacy and digital awareness, adds depth to her situation. Shadows cast by the light sources create a moody, contemplative atmosphere, underscoring the sense of solitude and introspection.

The room embodies the tension between technological convenience and the growing awareness of privacy and cybersecurity issues. It subtly reflects the mental strain associated with navigating these digital challenges, portraying not only the technological struggle but also the emotional weight of maintaining personal security in an ever-connected world. The overall composition evokes the reality of living with social stress, where the need to stay informed and protected often battles with the desire for digital freedom and reassurance.

I. The Unique Nature of Digital Platforms

Digital platforms distinguish themselves from traditional media and businesses through their global reach, real-time interaction, and the vast amounts of personal data they collect and process. These platforms operate on a scale and in a manner that was unimaginable just a few decades ago, presenting unique challenges to existing regulatory frameworks.

Data-Driven Business Models

At the heart of these platforms is a data-driven business model where services are offered for free in exchange for user data. This data is then monetized through targeted advertising. For instance, in 2020, Facebook generated an astounding $86 billion in revenue, with 98% coming from advertising facilitated by user data collection. Similarly, Google's advertising revenue reached $147 billion the same year, largely driven by data collected from users' search histories and online behaviors. These figures underscore how integral user data is to their revenue streams.

Network Effects

These platforms benefit immensely from network effects, where the value of the platform increases as more users join. This leads to rapid scalability and market dominance. As more people use a platform, it becomes more attractive to potential new users and advertisers, creating a self-reinforcing cycle of growth. This phenomenon has allowed companies like Facebook to amass over 2.8 billion monthly active users by 2021, making it one of the most influential platforms globally.

Algorithmic Content Delivery

Sophisticated algorithms are used to personalize content, influencing user behavior and maximizing engagement. These algorithms analyze vast amounts of data to deliver content that is most likely to keep users engaged, which in turn generates more data for monetization. For example, YouTube's recommendation algorithm is responsible for over 70% of the time users spend on the platform. This algorithmic content delivery has profound implications for user privacy and data security, as it often involves deep insights into user preferences, behaviors, and even psychological profiles.

Cross-Border Operations

Operating across borders, these platforms reach users in virtually every country, often outpacing the jurisdictional reach of national laws. Facebook, for instance, has users in over 190 countries. This global operation creates challenges for regulatory frameworks that are typically confined within national boundaries. Enforcing laws and regulations becomes complicated when platforms operate in multiple jurisdictions with varying legal standards. As former U.S. Supreme Court Justice Louis Brandeis noted, "The greatest dangers to liberty lurk in insidious encroachment by men of zeal, well-meaning but without understanding." This highlights the risks of unchecked global operations without adequate regulatory oversight.

II. Data and User Privacy Concerns

The collection and processing of personal data by social media platforms have raised significant privacy issues. These concerns are multifaceted, affecting not only individual users but also societal structures and democratic processes.

Unauthorized Data Sharing

One of the most prominent issues is unauthorized data sharing. Numerous instances have emerged where user data is shared with third parties without explicit consent. The Cambridge Analytica scandal in 2018 is a prime example, where data from up to 87 million Facebook users was harvested without their consent to influence political campaigns. This not only violated privacy but also showcased how personal data could be weaponized for political manipulation, undermining democratic institutions.

Insufficient Data Protection Measures

Weak security protocols have led to data breaches exposing sensitive user information. In 2019, a Facebook data breach exposed the phone numbers and personal data of over 533 million users from 106 countries5. Similarly, in 2017, Equifax suffered a data breach affecting over 147 million people, highlighting vulnerabilities in data protection even outside social media. Such breaches highlight the potential risks to users, including identity theft and fraud, and emphasize the need for robust data security measures.

Lack of Transparency

Users are often unaware of how their data is collected, used, or shared. In 2018, reports emerged that Google continued to track users' location data even after they turned off location history settings on their devices. This practice undermines user trust and raises questions about the companies' commitment to transparency and privacy. As Tim Cook, CEO of Apple, stated, "Privacy is a fundamental human right. Our customers don't want anyone knowing everything about them."

Surveillance and Profiling

The use of data analytics to create detailed user profiles can infringe on individual privacy rights. Surveillance and profiling enable companies to predict and influence user behavior, raising ethical and legal concerns about autonomy and consent. This practice can lead to manipulation, as algorithms curate content to elicit specific responses or behaviors from users. Shoshana Zuboff, in her book The Age of Surveillance Capitalism, warns, "We are the objects from which raw materials are extracted and expropriated for Google’s prediction products."

III. The Business Angle: Monetization of Personal Data

The lack of enforcement of regulations protecting personal information from unauthorized collection, use, or disclosure has allowed social media companies to monetize user data extensively. This monetization has fueled their financial growth and dominance in the market.

Advertising Revenue Driven by Personal Data

Advertising revenue, driven by personal data, is at the core of their business models. Platforms like Facebook leverage detailed user profiles to offer advertisers highly targeted ad placement, significantly increasing ad effectiveness and revenue. Between 2010 and 2020, Facebook's revenue skyrocketed from $1.97 billion to $86 billion—a staggering increase of over 4,267%—primarily due to data-driven advertising. Google's parent company, Alphabet, reported $182.5 billion in revenue in 2020, with advertising accounting for 80% of that figure.

Economic Incentives Over Privacy

The economic incentives to prioritize profit over privacy are immense. Fines imposed for privacy violations have been relatively small compared to the profits generated. For example, the Federal Trade Commission (FTC) fined Facebook $5 billion in 2019 for privacy violations. While this amount seems significant, it represented only about 9% of Facebook's 2018 revenue and was arguably insufficient to deter future violations. Companies may view such fines as a cost of doing business, choosing profit over compliance with privacy regulations. As former FTC Commissioner Rohit Chopra stated, "The FTC’s settlement imposes no meaningful changes to the company’s structure or financial incentives, which led to these violations."

Market Valuation and Investor Confidence

Despite numerous scandals related to privacy violations, market valuation and investor confidence remain strong. Facebook's stock price rose from $38 at its initial public offering (IPO) in 2012 to over $300 in 2021. This reflects investor confidence in the company's profitability, suggesting that financial returns often overshadow ethical concerns about data privacy. The market's focus on growth and revenue has, in effect, rewarded companies even in the face of privacy controversies.

IV. Challenges in Enforcement

Creating laws is often easier than enforcing them effectively. Regulatory agencies face several hurdles that impede their ability to enforce existing laws and regulations pertaining to data privacy.

Resource Constraints

Regulatory bodies like the FTC have finite budgets and personnel, limiting their ability to monitor and enforce compliance comprehensively. In 2020, the FTC's budget was approximately $331 million10, a fraction of the revenues generated by tech giants. The rapid pace of technological advancements requires regulators to have specialized knowledge and skills to keep up, but they often lack the necessary technological expertise. This disparity makes it challenging to identify violations and enforce regulations effectively.

Quantifying Actual Harm

Quantifying the actual harm resulting from privacy violations is another significant hurdle. Privacy violations often result in intangible harms that are difficult to measure in monetary terms. Legal standards may require concrete evidence of harm for successful litigation, which can be challenging to produce. This difficulty in quantification can lead to weaker enforcement and lighter penalties that do not reflect the true extent of the damage caused. The problem of quantifying damages in privacy cases is that the harm is often hard to pin down.

Lobbying and Influence

The lobbying power and influence wielded by tech companies can hinder enforcement efforts. Tech giants invest heavily in lobbying to influence legislation and regulation in their favor. In 2020, Facebook and Google spent approximately $19.7 million and $8.9 million, respectively, on lobbying in the United States. Companies may also portray regulatory actions as overreach, swaying public opinion against enforcement efforts and making it politically challenging for regulators to act decisively.

V. Enforcement of Existing Regulations

Several existing laws aim to protect user privacy, but enforcement has been inconsistent, enabling social media companies to continue profiting from personal data.

Federal Trade Commission Act (1914)

The FTC Act prohibits unfair or deceptive business practices, including unauthorized data collection and use. However, enforcement limitations have been evident. The FTC's actions, such as the 2011 Consent Order against Facebook, lacked sufficient enforcement mechanisms to prevent future violations. Despite the 2011 order, Facebook engaged in practices leading to the Cambridge Analytica scandal, indicating that existing enforcement measures were ineffective. As privacy advocate Marc Rotenberg stated, "The FTC has failed to enforce its own orders."

Children's Online Privacy Protection Act (COPPA) (1998)

COPPA is designed to protect personal information of children under the age of 13. In 2019, TikTok was fined $5.7 million for illegally collecting personal information from children. However, the platform continued to grow, reaching 1 billion active users in 2021, indicating that the fine had little impact on the company's operations or compliance behavior. This raises questions about the deterrent effect of such penalties.

TikTok Litigation: TikTok Inc. v. Garland

Legal actions such as TikTok Inc. v. Garland highlight the complexities of enforcing regulations against powerful tech companies. In August 2020, President Donald Trump issued executive orders to ban TikTok, citing national security concerns. TikTok Inc. sued the U.S. government, arguing that the ban violated due process and was based on political motives rather than genuine security risks. Preliminary injunctions were granted, delaying the ban13. The litigation showcased the difficulties in enforcing executive orders against a global platform with a massive user base. Judge Wendy Beetlestone noted, "The government’s own descriptions of the national security threat posed by the TikTok app are phrased in the hypothetical."

State Laws: California Consumer Privacy Act (CCPA) (2018)

State laws like the CCPA grant residents rights regarding their personal information held by businesses. The CCPA provides California residents with the right to know what personal data is being collected, access it, and request its deletion. However, enforcement challenges persist due to compliance variations and limited enforcement resources compared to the scale of tech giants. The California Attorney General's Office, responsible for enforcing the CCPA, has a budget that pales in comparison to the resources of large tech companies.

VI. International Legal Doctrines and Privacy Rights

International legal doctrines also play a role in shaping data privacy regulations.

United Nations Doctrine of Privacy

The United Nations Universal Declaration of Human Rights (1948), specifically Article 12, affirms the right to privacy but lacks enforcement mechanisms at the national level without corresponding domestic laws. This limits its practical impact on regulating corporate behavior.

As the US President Carter on December 6, 1978 in the Universal Declaration of Human Rights stated,

“As long as I am President, the Government of the United States will continue throughout the world to enhance human rights. No force on Earth can separate us from that commitment. This week we commemorate the 30th anniversary of the Universal Declaration of Human Rights.”, and continued

"Human rights must be the soul of our foreign policy, but they must also be the soul of our domestic policy."

European Union's General Data Protection Regulation (GDPR) (2018)

The GDPR represents a significant step in data protection, imposing substantial fines for non-compliance—up to 4% of global revenue or €20 million, whichever is higher. This incentivizes companies to prioritize data protection within the EU. For example, in 2019, Google was fined €50 million by French authorities for failing to provide transparent and easily accessible information on its data consent policies. However, the comparison to U.S. enforcement highlights a disparity. The United States lacks a federal equivalent, making enforcement less impactful on business practices. The GDPR's stringent regulations have also been criticized for imposing heavy compliance burdens on businesses, potentially stifling innovation and competitiveness, especially for smaller firms.

VII. U.S. Constitutional Protections Related to Privacy

In the United States, constitutional protections related to privacy are derived from amendments such as the Fourth and Fourteenth Amendments.

Fourth Amendment

The Fourth Amendment protects citizens against unreasonable searches and seizures, but courts have struggled to apply it to digital data, leaving gaps in protections. In Carpenter v. United States (2018), the Supreme Court held that accessing historical cell phone records requires a warrant, recognizing some privacy rights in digital data. However, the decision left many questions unanswered regarding the extent of digital privacy.

Fourteenth Amendment

The Fourteenth Amendment provides a basis for privacy rights under the due process clause. In cases like Griswold v. Connecticut (1965), the Supreme Court recognized a right to privacy in marital relations (the liberty of married couples to use contraceptives without government restriction). However, its application to data privacy remains limited. The lack of explicit constitutional provisions on data privacy means much of the protection is left to statutory law, which varies by state and is subject to change.

VIII. Differentiating Data Privacy from Harmful Content

While both data privacy violations and harmful content on social media platforms present significant issues, their financial impact on the public differs markedly. Quantifying the harm caused by each provides insight into where enforcement efforts might be most effectively concentrated.

Financial Harm Caused by Data Privacy Violations

Identity theft and fraud resulting from data breaches of data collected by social media companies impose significant costs on consumers. According to the FTC, consumers reported losing over $3.3 billion to fraud in 2020, a significant portion stemming from identity theft facilitated by data breaches. IBM’s 2024 Cost of a Data Breach Report found that the average total cost of a data breach was $4.88 million per incident globally. With thousands of data breaches occurring annually, the cumulative financial harm is substantial.

Users often have no means to monetize or control the use of their own data, effectively forfeiting potential economic benefits to corporations instead of the users. Analyzing Meta Platforms, Inc.'s (formerly Facebook) Average Revenue Per User (ARPU) in the U.S. and Canada from 2018 to 2023 reveals a consistent upward trend, reflecting the company's enhanced monetization strategies in these regions.

Historical ARPU Data:

2018: The annual ARPU was approximately $112 per user.
2019: This figure increased to about $139 per user.
2020: The ARPU rose further to around $164 per user.
2021: Based on Q2 data, the annualized ARPU was estimated at $212 per user.
2022: The ARPU reached $58.77 per user.
2023: The ARPU climbed to $68.44 per user.

Assuming a consistent growth rate similar to the increase from 2022 to 2023 (approximately 16.5%), the projected ARPU for 2024 in the U.S. and Canada would be around $79.70 per user.

Financial Harm Caused by Harmful Content

While harmful content, such as misinformation and hate speech, has significant societal impacts, the direct financial harm to individuals is less quantifiable. Health misinformation could lead to increased healthcare costs and economic losses, but precise figures are difficult to calculate. A study in The Lancet estimated that misinformation contributed to vaccine hesitancy, potentially leading to preventable deaths. Political misinformation can influence electoral outcomes, but assigning a direct financial cost is complex and often speculative.

Businesses may incur costs to protect their brand image if their ads appear alongside harmful content. A report by NewsGuard and Comscore revealed that top brands inadvertently allocated approximately $2.6 billion annually to advertising on websites known for publishing misinformation. This significant expenditure highlights the challenges advertisers face in ensuring their ads do not appear alongside harmful or misleading content. However, this amount is often a fraction of the revenues involved in data monetization.

Comparative Analysis

Based on available data, the financial harm caused by data privacy violations far exceeds that caused by harmful content. The direct costs to consumers from identity theft, fraud, and unauthorized data use run into billions of dollars annually, whereas the financial impact of harmful content, while significant in societal terms, is less directly quantifiable in monetary terms for individuals.

IX. Arguments for Prioritizing Enforcement of Data Privacy Laws

Given that data privacy violations impose substantial direct financial harm on the public, better enforcement of existing data privacy laws is crucial.

Protecting Consumers from Financial Loss

Strong enforcement can reduce instances of identity theft and fraud, directly saving consumers money. By holding companies accountable for data breaches and unauthorized data use, regulators can mitigate the financial risks posed to individuals. As cybersecurity expert Bruce Schneier stated, "Data is the exhaust of the information age,” and “Data is the pollution problem of the information age, and protecting privacy is the environmental challenge. Almost all computers produce personal information. It stays around, festering. “

Restoring Trust

Effective enforcement can rebuild public trust in digital platforms, which is essential for societal and economic stability. When users feel their data is protected, they are more likely to engage with platforms in meaningful ways, benefiting both consumers and businesses.

Economic Equity

Ensuring that individuals have control over their data can lead to more equitable economic benefits. Strong enforcement can prevent corporations from unfairly profiting at the expense of individual privacy rights, promoting a fairer distribution of wealth generated from data. Economist Joseph Stiglitz has argued that the control of data is a major source of market power and wealth.

“Whether we like it or not, a company like Equifax can gather data about us, and then blithely take insufficient cybersecurity measures, exposing half the country to the risk of identity fraud, and then charge us for but a partial restoration of the security that we had before a major breach."

Legal Obligations

Existing frameworks like the FTC Act and COPPA already provide mechanisms for enforcement. Utilizing them effectively is a matter of prioritization and resource allocation. Adhering to principles outlined in international agreements reinforces the United States' commitment to upholding human rights standards.

X. Arguments for the Need for New Regulations

Given the unique challenges and the significant financial incentives for companies to monetize personal data, new, comprehensive regulations are sometimes proposed as necessary. However, there is debate over whether new laws are needed or if better enforcement of existing laws would suffice.

Modernizing Privacy Laws

A comprehensive federal privacy law could unify the patchwork of state laws, providing clarity for businesses and consumers. While such a law might be beneficial, it is not strictly necessary and may even hamper innovation. The GDPR's impact in the EU has shown that stringent regulations can impose heavy compliance burdens on businesses, potentially stifling technological advancement and innovation. The law firm DLA Piper reported that GDPR fines reached €158.5 million in 2020, reflecting increased enforcement but also highlighting the financial burden on companies24.

Lessons from GDPR and CCPA

The GDPR and CCPA offer frameworks that could inform federal legislation. However, their mixed results suggest caution. Overly prescriptive laws may hinder smaller companies and startups that lack resources to ensure compliance. Balancing consumer privacy protection with the need to foster innovation is crucial.

As venture capitalist Marc Andreessen observed, regulation disproportionately hurts small companies and startups.

Both Marc Andreessen and Ben Horowitz, co-founders of venture capital firm Andreessen Horowitz, have articulated concerns that regulatory measures often place a heavier burden on small companies and startups compared to established corporations. In their Little Tech Agenda, they argue that while large tech firms can navigate complex regulations with extensive resources, smaller startups face significant challenges, potentially stifling innovation and competition. They emphasize that "bad government policies are now the #1 threat to Little Tech," highlighting the disproportionate impact of regulation on emerging companies

Enhancing Enforcement Mechanisms

Strengthening the enforcement of existing laws might be more practical and less disruptive than introducing new regulations. Investing in regulatory agencies to improve their capacity can yield better results without the risks associated with new legislation. As Justice Oliver Wendell Holmes Jr. famously said, "The law is the witness and external deposit of our moral life."

XI. Case Studies

Facebook's Business Model and Privacy Violations

The $5 billion FTC fine imposed on Facebook in 2019 was overshadowed by the company's $70.7 billion revenue that year. The fine represented a small fraction of their revenue and did not significantly impact their operations. In fact, the company's stock price increased following the announcement, indicating investor confidence remained unaffected. Facebook's user base continued to grow, reaching 2.8 billion monthly active users in 2021, further entrenching its market position. This case illustrates how current enforcement mechanisms may be insufficient to deter privacy violations.

As Senator Elizabeth Warren stated, a one-time penalty for breaking the law means they can break it again. She has consistently emphasized the need for stringent enforcement of financial regulations to prevent repeated violations by large corporations. She argues that imposing only one-time penalties allows companies to view such fines as mere operational costs, thereby enabling them to continue unlawful practices without significant deterrence. Warren advocates for more robust measures, including holding executives personally accountable, to ensure compliance and protect consumers. This perspective aligns with her broader efforts to reform financial systems and promote corporate responsibility.

TikTok Litigation: Enforcement Challenges

The U.S. government's attempt to ban TikTok faced legal hurdles, partly due to challenges in enforcing executive orders against a global platform with a massive user base. The inability to quantify specific harms and the company's vigorous legal defense delayed enforcement actions. This case highlights the complexities of regulating multinational tech companies and the limitations of existing legal tools.

Jack Goldsmith, a professor at Harvard Law School, has discussed the complexities of unilateral U.S. actions in the global digital economy, particularly in relation to TikTok. In a 2023 article, he examined the challenges the U.S. faces when attempting to regulate or ban foreign digital platforms, highlighting the limitations of such unilateral measures in an interconnected world. Goldsmith emphasized that these actions often lead to legal and diplomatic complications, underscoring the need for multilateral approaches to effectively address concerns in the global digital landscape.

XII. Parallels with Artificial Intelligence and Data Privacy Concerns

The issues of data privacy and regulatory enforcement that have characterized the growth of social media companies are now emerging in the field of AI. Like social media platforms, AI technologies often rely on vast amounts of data—much of it personal or sensitive—to function effectively. The similarities in data practices between AI companies and social media firms highlight a recurring challenge: the unauthorized use of private or public data without adequate consent or compliance with existing regulations.

Data Privacy Issues in AI

AI companies frequently utilize user data to train machine learning models. This data can include personal information collected from various sources, sometimes without explicit user consent. Web scraping and data mining practices may infringe upon individual privacy rights and violate terms of service agreements. Even publicly available data may be subject to intellectual property rights or privacy laws that restrict its use.

A significant issue is the misuse of opt-out mechanisms instead of opt-in consent. Companies like LinkedIn have faced criticism for requiring users to opt out of certain data-sharing practices rather than obtaining explicit opt-in consent. In 2015, LinkedIn settled a $13 million class-action lawsuit over its "Add Connections" feature, which accessed users' email contacts and sent repeated invitations without explicit permission. Users had to opt out of this feature rather than opt in, leading to allegations of privacy violations.

In September 2024, LinkedIn again found itself in the spotlight for similar reasons. The company updated its privacy policy, allowing user data, including images, to be utilized for training AI models by default. Unless users manually disabled this feature, they were automatically enrolled, resulting in significant backlash regarding privacy rights. This opt-out approach was reminiscent of the 2015 case, raising concerns about adherence to data protection regulations that emphasize explicit user consent.

Adding to the controversy, LinkedIn's "Data for Generative AI Improvement" setting allows the use of personal data, including user images, for training AI models. This data is not only used by LinkedIn but also shared with affiliates like Microsoft and potentially sold to other parties. This practice has sparked privacy concerns, emphasizing that the data-sharing setting should be opt-in, where users give clear and explicit consent, rather than being enrolled by default.

The implications of using opt-out mechanisms instead of opt-in are profound. They violate the intent of privacy regulations designed to protect users and ensure clear, affirmative consent for data collection and processing. For organizations developing AI models that rely on vast datasets, it is crucial to respect user consent mechanisms that allow individuals to maintain control over their data. The continued use of opt-out mechanisms not only undermines trust but also exposes companies to legal and ethical challenges, as evidenced by LinkedIn's repeated controversies.

For a detailed analysis, see The Problem with Opt-Out Consent Mechanisms.

Relevant Regulations

The regulatory landscape governing data privacy for AI companies overlaps significantly with that of social media firms.

General Data Protection Regulation (GDPR) (2018): Requires lawful, fair, and transparent processing of personal data, with explicit opt-in consent. AI companies must ensure that data used for training models complies with GDPR standards, particularly regarding consent and the right to be forgotten.
California Consumer Privacy Act (CCPA) (2018): Grants California residents rights regarding their personal information, including the right to opt out of the sale of their personal information. Critics argue that an opt-in model would provide stronger privacy protections.
Federal Trade Commission Act (1914): Prohibits unfair or deceptive business practices, including unauthorized data collection and use. The FTC can take action against AI companies that misuse personal data.

Overstated Concerns of Existential Harm

Much like the discourse surrounding harmful content on social media, which is sometimes overstated by stakeholders with vested interests, the narrative of existential harm posed by AI has been amplified. While AI presents risks, including ethical dilemmas and potential biases, the immediate and tangible issue lies in data privacy violations. Some organizations may emphasize existential risks to push for regulations that serve their competitive interests or divert attention from pressing issues like data privacy. As AI researcher Andrew Ng noted, "Fearing a rise of killer robots is like worrying about overpopulation on Mars."

Enforcement Over New Regulations

The primary problem with AI companies is not the absence of regulations but the insufficient enforcement of existing data privacy laws. Introducing new AI-specific regulations may not address the core issue of unauthorized data use. Robust enforcement of current laws would be more effective in mitigating data privacy concerns associated with AI technologies. Ryan Calo, a professor at the University of Washington School of Law, has emphasized the importance of enforcing existing laws before enacting new regulations, especially in the context of emerging technologies like AI. In his testimony before the U.S. Senate Committee on Commerce, Science, and Transportation on July 11, 2024, he highlighted that Americans are not receiving the privacy protections they demand or deserve, citing examples where existing laws were not adequately enforced. Calo stressed that the acceleration of AI exacerbates consumer privacy concerns and that society can no longer afford to sacrifice consumer privacy on the altar of innovation.

XIII. Conclusion

The challenges associated with social media companies are multifaceted, stemming from both insufficient enforcement of existing regulations and the lack of laws specifically designed for the digital age. The unique nature of digital platforms—with their data-driven models, global reach, and technological sophistication—has allowed them to monetize personal data extensively, contributing to their financial dominance.

Creating laws to regulate these platforms is only part of the solution. Enforcement remains a significant hurdle due to resource constraints, difficulties in quantifying harm, and the lobbying power of tech giants. As Mark Twain aptly noted, "Laws control the lesser man... Right conduct controls the greater one." Without effective enforcement, laws alone are insufficient to compel compliance from powerful entities.

The financial analysis indicates that data privacy violations impose a far greater direct economic harm on the public than harmful content. This underscores the importance of prioritizing the enforcement of data privacy laws to protect consumers from significant financial losses.

Moreover, the issues observed with social media are now manifesting in the realm of artificial intelligence. AI companies are utilizing users' private data or public data without proper authorization, potentially violating existing regulations similar to those governing social media data privacy. The misuse of opt-out mechanisms over opt-in consent, as seen in cases involving companies like LinkedIn, exacerbates privacy concerns. Overstated concerns about existential harm from AI, much like exaggerated fears of content harm on social media, often serve the interests of stakeholders with vested agendas. Introducing new AI regulations may not solve the primary problem of data and user privacy; instead, effective enforcement of existing laws is required, just as it is with social media.

Final Thoughts

Addressing privacy concerns and the financial motivations behind them necessitates a dual approach.

Strengthening Enforcement

Implementing fines that are significant enough to affect profitability and deter violations is crucial. Empowering agencies like the FTC with greater authority to impose sanctions and enforce compliance can enhance regulatory effectiveness. Increasing funding and technical expertise for regulatory bodies is necessary to match the sophistication of the industries they oversee. As former FTC Commissioner Julie Brill stated, "We need to ensure that enforcement keeps pace with innovation."

Developing New Regulations Where Necessary

While a comprehensive federal privacy law might unify existing regulations, it is not strictly necessary and may even hamper innovation. The GDPR's impact in the EU has shown that stringent regulations can impose heavy compliance burdens on businesses, potentially stifling technological advancement and innovation15. Any new regulations should strike a balance between protecting consumer privacy and fostering an environment conducive to innovation. As Albert Einstein cautioned, "Laws alone cannot secure freedom of expression; in order that every man present his views without penalty, there must be spirit of tolerance in the entire population."

Global Cooperation

Working with international partners to create harmonized regulations can prevent companies from exploiting jurisdictional gaps. By aligning legal frameworks with the economic realities of digital platforms and artificial intelligence, and by prioritizing the enforcement of existing laws, regulators can better protect individual privacy rights while ensuring that businesses operate ethically and sustainably.

Further read

LLM, Us and Neuroplasticity

"Are you sure?": Unveiling the Quest for Human-Like Artificial Intelligence

Designers, creativity and AI

A LLM as a reflection of our inner most desires

Should AGI be a she, he, or a it?