Why Bans Fail: Tipping Points and Australia’s Social Media Ban Why Bans Fail: Tipping Points and Australia’s Social Media Ban by Leonardo Bursztyn, Angela Duckworth, Rafael Jiménez-Durán, Aaron Leonard, Filip Milojević, Christopher Roth, and Cass R. Sunstein.

They have delighted us all with their conclusions about the success of the Australian ban on access to social media for minors under 16 years old. Organized through a survey of 507 teenagers who want to act tough by defying the established order, with expected and wonderful conclusions:

• Only one in four (27%) teenagers aged 14 and 15 comply with the ban four months after its entry into force.

• 75% of teenagers (je: the rest) consider that bypassing the restrictions is “easy” or “very easy”. Namely: entering a false date of birth when registering (44%), lying about their age in verification requests (57%), using an older sibling’s or parent’s account (42%), and redirecting traffic through a VPN (30%).

• The prohibition will only start to take effect if there is a sufficient critical mass of users who comply with it. The old saying about “locking the stable door after the horse has bolted” or “life always finds a way.”

• That 52% consider that the minor who complies is a fool. Insert Spanish-made meme of “I smoke to act cool.” And that influencers who have social media as their main entertainment (and source of income) wouldn’t even consider limiting access to networks.

• That 25% have received help from a parent, older sibling, or another adult to maintain or regain access to their accounts. The one we already mentioned about the Australian mother who found it funny that the girl got around it by posting a picture of her. Parental supervision also needs to be decisive and not just for laughs.

• Those who comply report positive aspects such as less pressure and more time with family, but at the cost of being bored and disconnected from their environment.

• 72% would prefer applications with built-in time limits rather than a total ban. What China did by restricting gaming times during the weekend, but without overdoing it with the greater possibility of enforcement over there (let’s call it that).

• That non-compliance is higher at 15 years old (68.3%) than at 14 years old (57.1%). The greatest social need.

Note to all of us, ArgonEUtas.

The book “Irresistible” by Adam Alter describes an experiment that gives us more clues about the difficulties of removing anything from your mind: the problem, according to him, is that suppression needs alternatives.

You know what you should avoid, but you don’t know what to occupy your mind with instead.

When a group was asked to ring a bell every time they thought about a white bear (the object of prohibition), the bells did not stop ringing.

However, when they were told that it might help them think about a red Volkswagen instead, their bells rang half as often. Suppression alone does not work, but suppression combined with distraction does quite well.

The most interesting thing is that, when they were later allowed to think about the white bear, those who had struggled to suppress their thoughts before were consumed by the image of the white bear. It was all they could imagine.

Meanwhile, the people who received a distraction in the form of the red car thought about the white bear occasionally—but they also had many other ideas.

You are reading ZERO PARTY DATA. The newsletter about tech and legal affairs by Jorge García Herrero and Darío López Rincón.

In the free time that this newsletter leaves us, we solve complicated issues related to personal data protection regulations and artificial intelligence. If you have any of those, give us a hand. Or contact us by email at jgh(at)jorgegarciaherrero.com

Suscríbete ahora

“I trust that small pieces of information, shared with different services (today, or agents tomorrow) will not be aggregated and correlated to create an inappropriately invasive model of me as an individual, violating my privacy.”

This is one of the classic premises of trust formulated by Benjamin Kuipers in the “Oxford Handbook of Ethics of AI” in 2020 as one more of the robotics laws in the style of Isaac Asimov.

But rules are made to be broken and Frank Pasquale coined the concept of “mosaic effect” a decade ago about that fracture. An empire of unheard-of size was built by combining and monetizing all those crumbs of information into profiles specific to each purpose.

Profiles that have never been used in favor of the data subject (as the innocent “premises” of Kuipers intended), but against them. Every time.

In the era of agentic AI, it is mandatory to revisit Choudary and his book “Reshuffle”.

“This is the ultimate promise of AI-driven reshuffling. Instead of simply linking tools together, AI makes sense of all the insights it collects through emails, sales calls, contracts, and financial data, weaving them into a coherent narrative. It connects the dots, determines what the picture should be, and fills in the missing details.

Agentic execution reinforces coordination without the need for consensus.

Once AI has regrouped fragmented information into a shared representation, agents can act on that representation autonomously, activating follow-ups, updating tasks, or escalating risks without waiting for human execution. In this way, that unified representation enables unified decisions and executions, which in turn enables coordination. Coordination, in turn, leads to control. The more teams rely on the AI layer to see, decide, and act, the more power that layer will have in the ecosystem.

This same principle is the one formulated by Palantir’s Nazgûls, only in terms more befitting their Sauronian dictatorial dialectic.

Of course, we are still talking about the study that revealed last Monday that the latest source of data to complete our profiles is precisely our conversations with Perplexity, ChatGPT, Grok, and Claude.

World Data News 🌍

.- This thread by Andrew Guthrie Ferguson explains an interesting case about to be tried in the U.S.: Can Google’s data be used against a person when they activated history services or fine location storage? Interesting combination of validity of consent to a service, admissibility of evidence in the criminal sphere, and expectation of privacy. What is relevant is no longer whether Google stores your locations, but whether it is acceptable for consent to a function distributed among several products (convenience) to potentially become a waiver of basic constitutional guarantees.

.- The DPC is going after Shein regarding international transfers to China. Let’s see what changes in the case of TikTok’s 530 million, but is it really possible to prove that nothing is sent or accessed from China headquarters? How much of a copycat will we have from TikTok? Many questions. Will they release several reports from glossy unsigned firms again? Will the DPC self-reference that the exceptional explicit consent of Article 49 is complicated?

The DPC finds that the requirement that consent be “explicit” and that it relate to “the proposed transfer” precludes a single consent being obtained for continuous and ongoing data transfers and/or different sets of transfers. The DPC is also of the view that seeking a single open-ended consent for continuous and ongoing data transfers and/or different sets of transfers is not compatible with the obligation to inform the data subject of the possible risks of the transfers being made.

Nerdy footnote: do not forget that we have an international body among the adequacy decisions in force since 2025: the European Patent Office. That of Article 45(1) “to a third country or international organization”.

On the topic of TikTok, we see in San Luis Montezuma the two resolutions from the two judges who rule on the DPC’s appeal not to lift the suspension. We are confused as to why there are two resolutions from two different judges that complement each other but dismiss the DPC’s appeal to lift the precautionary suspension of the sanction’s application. And nothing about having to ask the CJEU, or the fact that it is a coordinated action with other authorities implies applying specific criteria (which the GDPR determines that the lead authority is the one that has the final decision).

.- From Lukasz Olejnik’s Newsletter:

.-From Noyb comes an interesting one. The incentive/unethical practice of LinkedIn to hide part of the visitors who have viewed our profiles has a butterfly effect on the exercise of the right of access. Here it seems that there is a commercial paradox where LinkedIn releases all the information without any exercise of rights if you pay for premium (it shows it to you), but becomes very particular about Article 15(4) if you request it as an exercise of the right of access.

Noyb points out that under Article 15(4) it could be argued that they only provide information about those who have decided not to be visible to other users, but with the small problem that they incentivize no one to be in “anonymous” mode by limiting visibility. It’s not the first corporation to swing on Article 15(4), but we’ll see how it ends.

📖 Hard data docs for coffeine lovers ☕️

.- The EU is stepping on the gas with a recommendation for the implementation of verification, following the technical verification solution. It is going to be a curious second half of the year: June 30 as the maximum date for member states to present the detailed National Implementation Plan (PNI) to the European Commission, and December 31 for at least one age verification solution based on the “EU blueprint” to be available.

Along the way, a list of providers that the EC deems appropriate will be drawn up, and the report of recommendations from the Special Group on child safety online will be published by the same summer.

The European Commission highlights this as a necessary measure to ensure proper compliance with the DSA. The same DSA for which our CNMC has not been appointed as a relevant authority for its purposes.

And on Wednesday, that is, yesterday, a hearing was held in the LIBE Committee to address this issue. With our AEPD, the CNIL or EDRi. Let’s not let everyone’s rush be noticed.

.- Collective lawsuits against BigTech are making headway in Italy. Milan paves the way for Directive 2020/1828 by admitting a class action against Meta for data scraping that would have affected approximately 533 million profiles. You know: lawsuits filed by authorized entities without relying on individual standing and non-pecuniary damages based solely on fear or loss of control over one’s own data.

.- Paddy Leerssen, Joris van Hoboken, Gabriela Trogrlić, and Iris Toepoel’s book summarizes several actions aimed at enforcing Articles 14, 35, and 25 of the DSA in the civil jurisdiction of Member States. Perhaps the best approach is not the systemic risk, which is too vague, but that of dark patterns. But what do I know.El libro

.- The Institute for the Future of Work warns us how information and personal data captured in the office have become a strategic asset. When AI models roam freely in SaaS, agents, and business flows can capture tacit know-how, processes, and decisions capable of helping you automate procedures but also leaving you competitively on the sidelines: you are giving away the blueprint of your competitive moat. Sovereignty is not limited today to chips or national models; it requires caring for the entire value chain and harmonizing data protection, IP, business know-how, employment, and competition.

.- Along the same lines, Ellen Cushing’s article in The Atlantic: Workplace surveillance now captures and interprets emotions, not just productivity. At least in the USA. The emotion AI industry latches onto your office pipelines to consume and interpret video, audio, chats, or emails to infer attention, mood, attitude, and performance. The barrier to entry is almost non-existent, the promises unlimited, and the risk that they include customer and third-party data (and data from your own employees, of course) without a lawful basis is 120%. Then there’s that prohibition by the AI Act.

💀Death by Meme🤣

Banksy has placed a statue in London and, apparently, people don’t get it.

🤖NoRobots.txt o Lo de la IA

.- There might be an executive order on government oversight of AI models coming up. The irony is that Trump overturned Biden’s executive order that required models that could pose a risk to national security, economy, or public health to submit internally conducted safety reports and evidence.

It is suggested that the new Mythos from Anthropic has the potential to identify security vulnerabilities and how to exploit them, but one can never rule out the usual: vendetta against Antropic for not playing ball and ensuring the United States is the exclusive entity to cyberattack the Chinese, Russians, and whoever else.

Precisely, in Mythos there may be a confidentiality security breach due to unauthorized access. Many media outlets have reported it, but it has not been confirmed yet.

.- The Elon Musk vs OpenAI trial is giving us glorious afternoons. And more are yet to come.

.- AI is NOT your coworker. A long, well-written and better-documented post by Katalina Hernández with which I couldn’t agree more. And I’m not saying this -only- because of the quote she gives us.

🛠️ Useful tools

If you have an API key with some AI provider, you can install Mike, the vibe code version of Harvey or Legora.

Safe: it’s not going to be the same as Harvey or Legora, but it’s also safe to say that no one is going to charge you 3000 florins/user/month like they do.

My opinion: I haven’t tried it, if in two weeks a dozen forks with substantial improvements have already come out I’m pretty sure we’ll have something really functional available by the 27th or before, running locally.

We strongly believe in open-source software.

🙄 Da-Tadum-bass

Will Christopher Nolan’s next movie be a piece of nonsense? It’s impossible to tell, but this interview was fun. Among other things, Nolan-tending says that Odyssey, his upcoming film, is actually a superhero movie.

Share

If you miss any document, comment, or piece of nonsense that clearly should have been in this week’s Zero Party Data, write to us or leave a comment and we will consider it for next time.

Compartir

Si echas de menos algun doc, comentario o chorradón que manifiestamente debería haber estado en el Zero Party Data de la semana, escríbenos o deja un comentario y lo valoraremos para la próxima.

“What happens in Vegas stays in Vegas” and all that jazz.

And in fact, AI providers encourage us to use their models to integrate them into our daily decisions, so that we trust them in increasingly intimate contexts. Supposedly under that premise.

Well, no.

Narseo Vallina and his colleagues at IMDEA NETWORKS have done it again.

As they develop on this website, in a study conducted last April, they have discovered things that might surprise you and disturb you if you chat with AI models via the web (not through the API).

Models like Perplexity, ChatGPT, Claude, or Grok.

Little-known. And that nobody uses.

I invite you to visit the original website. Here, the only thing I am going to do is what I did last time (the Meta localhost scandal): translate what they have discovered into terms that a layperson in technology can understand.

· First, I tell you what they have discovered.

· Second: I explain how it works, how these companies do these things

· Finally, I give you the legal perspective, which has been my part in all this: the responsibilities that these companies may and should face.

You are reading ZERO PARTY DATA. The newsletter on technology and legal affairs by Jorge García Herrero and Darío López Rincón.

In the free time that this newsletter leaves us, we solve complicated issues related to personal data protection regulations and artificial intelligence. If you have any of those, give us a little hand. Or contact us by email at jgh(at)jorgegarciaherrero.com

1.-What have they discovered?

The websites of these four services have open doors on their websites that allow third parties to access your information:

.- Grok and Perplexity: Through Meta’s pixel

.- OpenAI: Through Google Analytics.

.- Claude: Through the Meta pixel, and Facebook, LinkedIn, TikTok, Amplitude, HubSpot, Pinterest conversion APIs, among others.

But “don’t leave yet: there’s more”.

Fasten your seatbelts: this is somewhat similar -at least for some users- to having a video camera pointing directly at their open diary.

“Well, the important thing is that they don’t have access to my ‘private’ conversations with Claude and ChatGPT, and that happens, right? RIGHT? HUH?”

The “title of each chat” is also shared.

This is not very good news: AIs have the bad habit of automatically generating a title for the conversation that summarizes its content, so if the conversation titles are:

“Depression tips”

“Aggressive tax deductions”

“They cheated on me, what do I do?”

“Lose even more weight” or

“Unusual cough”

… you don’t need to be Sherlock Holmes to infer the content of the conversation.

But also, the URL of your conversation: every conversation with your favorite AI has a link, and that link (that URL) is also shared with Meta and others.

And, as you can imagine, whoever has the link to “those chats” may end up having the script of the latest seasons of your favorite show: the one you star in.

It depends on the privacy settings of those links.

In Grok's case, the links were public by default at the time of the study and remain so at the time of this newsletter's publication (despite us having warned xAI).

You can check it out in this video:

Nothing to worry about: as shown in the following table, Grok (and other providers) share these links to chats with third parties.

Below, I only summarize a simplified and more understandable version.

Two clarifications:

1.- The study only certifies that the third parties mentioned (Meta, Google, etc.) “have access“ not that they have effectively accessed the indicated data. The study has focused on how accessible what is on this side: the websites of the AI services, not the other.

However, as we will see in a second, from a legal perspective, opening the door to third parties unrelated to your data processing already constitutes, in itself, a serious infringement for AI providers.

Regarding whether those third parties have accessed that data or not, well… everyone will have their own theory here.

2.- The specific access opened to each of those third parties depends 100% on the configuration allowed by OpenAI, Anthropic, xAI, Perplexity.

Do you know WHO it DOESN’T depend on in many cases? YOU.

As seen in the table, in many cases access is enabled regardless of whether you accept or not cookies, use ad-blockers, VPNs, or other browser protections.

A few seconds of reflection:

We trust that “our small pieces of information, shared (today) with different services (and tomorrow, with AI agents), will not be aggregated and linked to create an invasive model that violates our privacy.”

This is the classic “trust premise” enshrined by Frank Pasquale ten years ago.

Premise that is infringed millions of times a day in the adtech context.

The real risk is not in each of the scattered crumbs, but in the “mosaic” that forms when they are joined together.

And with the findings revealed today, it becomes apparent even to the most skeptical user that AI has put its formidable capabilities, among “others”, also at the disposal of the programmatic digital advertising machinery, one of the most powerful control structures of this sorry times.

2.- Explanation of the technical part: How does all this work?

This is the boring part, because unlike Meta’s localhost mess that was -let’s face it- a clever technical idea -for evil, but a clever technical idea-, on this occasion OpenAI, Anthropic, xAI, Perplexity have not invented anything new at all.

“URLs”, “Permalinks”

Conversation URLs usually work as permanent links (permalinks) with weak access controls.

In Grok, permalinks are accessible by default and guest chats are always public.

In Perplexity, Claude, and ChatGPT, permalinks are only visible to the user unless explicitly shared, but once shared, anyone with the link can access the content.

Explanation: If you copy the URL or web link of a conversation with ChatGPT or Claude and paste it into a different browser, you will get an error -unless you have accessed your account with your login and password in that new browser-.

That was not the case with Grok: when you pasted the URL or web address into a different browser (or in the same one, but in a new tab in “incognito mode”), you accessed your conversation.

That means anyone with access to that web address could also see it.

You, your boss, your ex-girlfriend, or anyone else.

Blatantly ignoring cookie consent:

In the indicated cases, trackers are activated regardless of whether the user accepts or rejects non-essential cookies.

For example, in ChatGPT and Grok, information is always sent to Google Analytics.

In Claude, server-to-server tracking only activates if non-essential cookies are accepted, but Meta’s Pixel loads regardless of consent.

Persistent cookies and Server-side tracking:

Cookies are not the trivial matter that the advertising industry has managed to make them out to be: they are like a barcode tattooed on your forehead. You don’t see it—persistent cookies aren’t easy to delete—and it singles you out with a unique digital footprint among all other users on the internet.

In the case of Meta (Facebook/Instagram) and TikTok, these codes are called `fbp` and `ttp` respectively.

With them, we are “marked” as if we were livestock at the BigTech fair.

Every time you visit a webpage that has Meta’s or TikTok’s “pixel” installed, these identifiers are read and sent to their servers. Thus, the company recognizes you as the same person who visited a clothing store yesterday, read a news article today, and is now using an AI chatbot, even if you haven’t logged into Facebook or TikTok.

How do they manage to receive your data even if you use ad blockers or take the trouble to reject cookies?

This is where “server-side tracking” comes in.

Your ability to block the sending of your information through cookies or pixels begins and ends with your browser. If the information is resent to third parties, not through your browser but from the server (”the cloud”), your controls can do nothing.

Companies like Anthropic (Claude) and xAI (Grok) use specific domains so that the cookies downloaded are considered “first-party” (from Anthropic or xAI). From that domain, your information is sent to conversion APIs (from Meta, TikTok, etc.), bypassing any protective action you can take in your browser.

Your browser only sees the connection with the provider’s own domain (Claude, Grok), and ad blockers or privacy extensions cannot intercept the traffic, which they would do if the real destination were not hidden.

Even if you go to the trouble of closing the shutters and windows of your house, these jerks come in through the chimney.

If this topic interests you (and it should), read, read Cristiana Santos.lean, lean a Cristiana Santos.

So what now?

When you write a prompt, the information (such as the permanent link to your chat, the conversation title, or even your email address) is automatically sent to third parties.

And the worst part is that, by combining the persistent cookie (`fbp` or `ttp`) with this data, companies can link your real identity with your content: your private conversations, even if you used the chatbot in incognito mode or without registering.

The `fbp` and `ttp` cookies are tattoos that identify you while browsing the web, and server-side tracking is a technical trick that prevents traditional privacy tools from blocking the flow of this data. Together, they manage to transform the conversations you believe to be private into valuable information for personalized advertising, analysis of your behavior, and enriching your user profiles in their hands.

None of this is new in the world of advertising; what is new is that it has been integrated in a hidden (and rapid) way into AI chatbots: contexts that are currently on the rise and particularly attractive because both you and I let our guard down in them.

Now let’s move on to the legal qualification of all this.

3.- What legal obligations have been breached here?

The analysis is generic because there are many breaches of varying scope, as shown in the previous table.

We will focus on “the big stuff”:

From the perspective of personal data protection legislation (GDPR in the EU), the user interacts or chats with the AI model for the purpose of obtaining answers to their questions or requests, whatever they may be.

When OpenAI, Anthropic, Perplexity, or xAI make user data related to these chats available to third parties, both (i) the mere act of making it available and (ii) the eventual access by said third parties are distinct processes that have nothing to do with what the user expects and with the service that is the subject of the contractual relationship with the user.

Therefore, AI providers are legally obliged to:

a. Inform about their processing in a clear and understandable manner

The legitimate expectations of the user hardly include the possibility that their conversations will be accessible to third parties such as Meta or Google.

The four companies use generic and ambiguous expressions to refer to the user’s prompts without specifically mentioning them when informing about third-party access: “user content” (OpenAI), “conversations” (Anthropic), “service interaction info” (Perplexity), and “user info” (xAI).

This is like “we will use your data to personalize your experience,” which can mean a hundred things and none, and has been specifically sanctioned by the AEPD.

The information should enable the data subject to understand what the hell is going to be done with their data.

And this information must be provided in a very specific way.

Not only the EDPB, but also the CJEU literally in paragraph 54 of its 2024 Meta Platforms Ireland (C-757/22) judgment imposes the obligation of the controller to inform the data subject in the following terms:

“The GDPR imposes an obligation on the controller, where personal data are collected from the data subject, to inform the data subject of the purposes of the processing for which those data are intended along with the legal basis for that processing and of the recipients or categories of recipients of those data, respectively.” (paragraph 54).

It is significant that even when OpenAI does offer this structured and linked information in accordance with the above, it does not refer to the practices observed in this study.

In short, these four companies, instead of complying with their transparency obligation, abuse the complexity of their privacy policies to overwhelm us with long texts and abstract concepts, omitting the key point that anyone could understand: that they provide personalized advertising giants with the topics of your conversations with their AI chats, and in some cases, the entire text of them.

In my humble opinion, this is something that deserves the same relevance as the ubiquitous “AI makes mistakes, check our responses” that is not missing from any interface to mitigate responsibilities if things go wrong.

b.- Having a legal basis for personal data processing

.- Having a specific legal basis for these processing operations (the same applies to third parties accessing this data for their own purposes).

This basis cannot be, as we say, the “performance of the contract between the user and the AI provider”.

It is debatable whether the training of the service itself with the user’s interactions are “objectively necessary” for the provision of the service (not in vain these companies swear and forswear that they do not train with the interactions, inputs and outputs of their users in the professional and corporate segments, so it is difficult to be indispensable with others what is not done with some).

What is indisputable is that opening access to third parties for purposes unrelated to the operation of the tool through mechanisms of adtech can be legitimized via contract.

This would only be possible through explicit consent (formula advocated by the EDPB) or legitimate interest (but the information about the processing and the possibility of exercising a right of opposition are conspicuous by their absence).

Additionally, this data processing must be covered by some exception to the prohibition of processing special category data.

It is a known and massive practice among users (and encouraged by providers) that users make inquiries about their health, psychological state, intimate matters...

It is precisely this fact that makes the results of this study so disturbing.

The longitudinal processing of these conversations over a significant period allows for the inference of all kinds of special category data such as religious and political ideology or the sexual orientation of the data subjects.

SRB / Scania doctrine?

The “silver bullet” used by these providers in this type of scenario (the scenario I am referring to is the one where “you’ve been caught with your hand in the cookie jar”) is one of two:

(i) anonymization or

(ii) pseudonymization (”de-identification” as they say in the USA) that prevents the recipient of the data from re-identifying users without disproportionate efforts in terms of time, material resources, or personnel (SRB / Scania doctrine).

The first thing to make clear is:

Even if any of these arguments were to save the legal basis (I wouldn’t bet a cent on this), the obligation to inform users about this third-party access has been completely ignored.

Now let’s see:

a.- Anonymization:

The robustness and effectiveness of any anonymization process can only be assessed on a case-by-case basis, and it would be necessary to see what each of these companies understands by anonymization, and whether what has been done is sufficient.

b.- Pseudonymization / SRB-Scania doctrine:

You will find few professionals more enthusiastic than me in finding suitable use cases to apply the Scania doctrine.

That said, it does not seem that the two global big data giants (Meta or Google) could benefit from this doctrine in any case, given their vast databases of personal data and their business model.

It should not be forgotten that the “insignificant risk of re-identification of the data subjects” (the cornerstone of this doctrine) must be assessed in light of the “context, purpose, and effects” of the processing carried out by the party accessing the pseudonymized data.

These companies literally live off combining different data sources to better personalize the targeted advertising contracted by their clients.

Spare me that, Meta and Google.

Lastly: What if “it has all been a misunderstanding” and Meta and Google had access but never read the data “wrongly made available to them”?

This says nothing about the responsibility of OpenAI, Anthropic, Perplexity, or xAI.

The mere fact of including tracking pixels on the website is a conscious design decision: allowing certain third parties access to certain personal data of your users for certain purposes.

We have seen this movie many times before: it was clearly stated by the CJEU in 2019 in Fashion ID (C-40/17) and in Wirtschaftsakademie (C-210/16).

In both cases, the third party was Facebook, and joint responsibility for the processing was found: the websites that embedded the pixel or allowed data processing by Facebook had to inform their users about this access, regardless of whether Facebook only processed data from its own users or did not allow the website owner reciprocal access to the obtained data (but only access to aggregated statistics).

“Moreover, by embedding that social plugin on its website, Fashion ID exerts a decisive influence over the collection and transmission of the personal data of visitors to that website to the provider of that plugin, Facebook Ireland, which would not have occurred without that plugin.” (Fashion Id, paragraph 78).

Consequently, the need for a legal basis on the part of the AI provider stems from the decision to embed the tracking pixel, regardless of whether such data is then accessed or used or not, which will be considered when assessing the responsibility of the transferee, if applicable.

Jorge García Herrero

Lawyer and Data Protection Officer

Without taking anything away from any of them, the background of the CNIL president in this celebration video stands out. Unlike the rest, who pose in institutional settings very much in line with public authority, here we have application diagrams, post-its, and a raw showcase of real data protection. A mural compiling quite a few of the things they do from LINC.

You can recognize some screens from the famous Fanthom app that we already discussed in another issue of the newsletter, but it’s Claude who puts the cherry on top by saying that everything follows a left-to-right plan: a typical UX design sprint sequence:

• Post-its on the left → research and categorization of user needs.

• Colored post-its in the center → ideation and synthesis.

• Wireframes on the right → translation of ideas into concrete screens.

Happy GDPR anniversary—we’ll see how much things change for us when the whole Digital Omnibus soap opera wraps up.

You are reading ZERO PARTY DATA. The newsletter on current affairs and technology law by Jorge García Herrero and Darío López Rincón.

In the free time this newsletter leaves us, we sort out complicated stuff related to personal data protection and artificial intelligence regulations. If you have one of those, give us a little wave. Or contact us by email at jgh(at)jorgegarciaherrero.com

Suscríbete ahora

🗞️News from the Data World 🌍

.- From Korea (obviously the southern one), some guidelines from its DPA on the use of pseudonymized data are being modified. In Article 28 of its data protection law, there is a quasi-compatibility for secondary purposes for pseudonymization (scientific research, public records, and statistics). It is not just a minimum security measure, but something more.

Now they propose to specifically extend it to AI training, under the premise that hypothesis formulation, data analysis, validation, and iterative refinement can be considered scientific research.

It doesn’t seem like a carte blanche, especially when they regulate the point of pseudonymization in the following way in their law:

Article 28-3 (Restriction on Combination of Pseudonymous Data)

(1) Notwithstanding Article 28-2, the combination of pseudonymized information processed by different personal information controllers for statistical purposes, scientific research and preservation of records for public interest, etc. shall be conducted by a specialized institution designated by the Protection Commission or the head of the related central administrative agency.

(2) A personal information controller who intends to release the combined information outside the organization that combined the information shall obtain approval from the head of the specialized institution after processing the information into pseudonymized information or the form referred to in Article 58-2.

(3) Necessary matters including the procedures and methods of combination pursuant to paragraph (1), standards and procedures to designate, or cancel the designation of, a specialized institution management and supervision, and standards and procedures of exporting and approval pursuant to paragraph (2) shall be prescribed by Presidential Decree.

.- The CNIL ventures to publish a model DPO activity report. A pure recommendation, like that ICO model contract for data transfers, but not as crazy or novel as it may seem. In those WP29 DPO guidelines, the annual activity report was already mentioned as an example tied to accountability to top management under Article 38.3.

.- One news item this weekend managed to surprise me:

The publication in the U.S. of the original registry of Nazi party affiliations.

If the pilot episode of the hilarious Saturday Night Live UK closed with an unforgettable song from the first listen (“What kind of Irish is your grandpa?”), any average German can now, in some of the search engines quickly set up by the press, check whether their grandfather, neighbor, their neighbor’s grandfather, or their boss or partner was a “card-carrying Nazi,” despite the thick silence that—understandably—those involved may have maintained on such matters.

Needless to say, this presents complications under the GDPR, insofar as some of the data subjects are still alive.

.- Yesterday the European Commission published the preliminary conclusions of the investigation into META for possible infringement of the DSA. It looks very likely to end in a sanction, but astonishing things had already come to light in the New Mexico trial. Pretends to be shocked that under-13s were slipping through with hardly any control.

📖 Hard data docs for coffeine lovers ☕️

.- The CJEU comes with its “digest” of relevant 2025 rulings. In the data protection section, six stand out: the already well-known SRB and Russmedia, plus four others:

• Policejní prezidium (C-57/23): police authorities dealing with maximum retention periods for biometric/genetic data. Minimum retention rules, but periodically reviewed to determine when deletion is possible. Not directly under the GDPR, but under Directive 2016/680 on processing for prevention, investigation, and prosecution…

• Mousse (C-394/23): processing gender data cannot be considered strictly necessary for ticket purchase processing. The French RENFE running into complications from implementing gender fields for reasons unrelated to the GDPR.

• Deldits (C-247/23): violation of a transgender refugee’s right to rectification to correct their gender data in Hungary. A limited certificate may be requested to verify and ensure the exercise of the right, but not impose the requirement of undergoing gender reassignment surgery.

• Quirin Privatbank (C-655/23): a ruling reminiscent of Österreichische regarding compensation for damages. Compensation quantified at €1,000.

.- Has anyone mentioned a relevant judgment? In Spain this week a notable one was published: STS 1590/2026. Why is it relevant?

The Supreme Court has declared that merely requesting manifestly excessive information, even without receiving it, constitutes personal data processing.

But hey! What the hell happened to the legal definition of “processing” in Article 4.2 GDPR, which insists on “operation (…) performed on personal data” or “any other form of enabling access, comparison or interconnection, restriction, erasure or destruction”?

To process personal data, shouldn’t you at least come into actual contact with personal data? RIGHT? RIGHT? Or what?

One might think that what is infringed when making a disproportionate data request, or without indicating the purpose of processing, etc., is the principle of privacy by design—and punish that infringement.

And the same conclusion could have been reached without stretching the concept of processing so far, so that processing becomes what happens before… um, accessing the data—those “processed” data.

Well, no.

In fact, the AEPD, which appealed a National Court ruling that embraced the previous argument, simply puts four CJEU rulings on the table. Two of them are especially clear, and their final reasoning is reproduced literally by the Supreme Court.

The clearest is case C-548/21, which applies not the GDPR but Directive 2016/680.

A minor detail when you get hit with jurisprudence of this magnitude:

“when police authorities seize a phone and manipulate it in order to extract and consult the personal data it contains, they initiate processing”

“Directive 2016/680 aims in particular (…) to ensure a high level of protection of personal data of natural persons.” “That objective would be undermined if an attempt to access personal data contained in a mobile phone could not be classified as ‘processing’ of that data.”

“ An interpretation under which the applicability of Directive 2016/680 depended on the success of the attempt to access personal data contained in a mobile phone would create, both for the competent national authorities and for individuals, uncertainty incompatible with that principle. ”

Another of the cited cases, C-175/20, also deserves your attention.

💀Death by Meme🤣

🤖NoRobots.txt or The AI Stuff

.- The CJEU has clarified what pastiche is, and that it does not need to have the sarcastic tone of parody, in a musical sampling case that has been going around for ages. What makes this case, which smells like intellectual property, end up in the AI section? The interpretation by Dr. Andrés Guadamuz (Technollama) on his blog. We leave you the following excerpt, but it’s highly recommended to read it in full. Anything touching intellectual property is always a very technical mess.

So what does this mean for AI outputs?

As I argued before, the output side of AI copyright is where things get genuinely difficult. The input question is mostly a TDM exception problem in Europe and a fair use problem in the US, and at least the rough shape of the answer is visible even if the details are being fought out in GEMA, Getty Images, Bartz, and assorted other current litigation. The output question is different. It turns on whether specific generated works infringe specific training works, and that is a question about substantial similarity, idea-expression, and exceptions and limitations.

I previously flagged pastiche as a potentially interesting defence for AI outputs, drawing on the Martin Eder case, which found that pastiche could cover the kind of remixing, mashing and referencing that characterises internet culture. I was quite cautious about it at the time, because the concept’s scope was genuinely unclear and there was a reasonable argument that pastiche required a conscious reference to the original, which an AI model plainly cannot have.

Pelham II has, I think, removed both of those objections.

📃The paper of the week

.- The 2026 AI Index report from Stanford University.

That’s enough for the whole long weekend. And you still won’t finish it.

🙄 Da-Tadum-bass

If we rubbed a bottle and a blue genie came out with Robin Williams’ booming voice, we’d ask for just one wish: that this newsletter were as rigorous and funny as John Oliver’s weekly HBO news show.

The latest episode is dedicated to AI chats and you can’t miss it.

A graphic definition of karma and a slap across the face. Since the beginning of time, criminals have spoken in code to prevent the police or authorities from knowing what they are doing. We’ve included two examples, but there are more clever and biting responses on X:

Compartir

If you miss any doc, comment, or dumb thing that clearly should have been in this week’s Zero Party Data, write to us or leave a comment and we’ll consider it for the next one.

Google has just announced the removal of a significant control mechanism over personal data flows in Google Analytics 4 (GA4).

This change has direct implications for the allocation of responsibilities under the GDPR framework.

Website owners using GA4 need to make a technical decision with significant legal repercussions.

1 Executive summary: immediate actions

The website owner using Google Analytics must, before June 15, 2026:

· Make an express and documented decision regarding the configuration of the ad_storage parameter and the rest of the Consent Mode parameters before June 15, 2026.

· Review the configuration of their CMP (Consent Management Platform or cookie banner) to ensure that default settings are based on a valid legal basis and that consent, where required, meets all applicable requirements.

· Update the privacy policy and cookie policy to reflect, where applicable, the new architecture of data flows to Google Ads, in compliance with the information obligations under Article 13 GDPR.

You are reading ZERO PARTY DATA. The newsletter on current developments and technology law by Jorge García Herrero and Darío López Rincón.

In the spare time this newsletter leaves us, we handle complex matters related to personal data protection regulations and artificial intelligence. If you have one of those, give us a shout. Or contact us by email at jgh(at)jorgegarciaherrero.com

Suscríbete ahora

2 Obligations currently applicable to the processing of website visitor data

At present, and in summary, two different sets of rules must be complied with regarding the configuration of GA4.

2.1 LSSI – Law 34/2002 on Information Society Services

Analytical, advertising, or profiling cookies—however you look at it, GA4 falls within this category—require the user’s informed and granular consent.

Authorities (the EDPB, the CNIL, the AEPD) extend this requirement to the use of cookies or analogous procedures (tracking pixels, tracking links, local processing, server-to-server flows, to name just a few of these endless ideas).

2.2 Consent and information requirements under the GDPR

When the information stored on or collected from the user’s device includes personal data—and that is precisely why things such as advertising identifiers, GA4 unique identifiers, and associated signals were created—its processing is subject to the GDPR.

Consent must meet GDPR requirements: it must be freely given, specific, informed, and unambiguous, expressed through a clear affirmative action, and must be verifiable and revocable as easily as it was given.

Any substantial change in the processing architecture—such as the one addressed in this text—requires updating the information notices before its effective implementation.

3 The novelty: the change in Google Analytics 4

To date, GA4 offered two distinct control mechanisms over data flows to Google Ads, operating cumulatively and independently:

• Google Signals: when disabled, it prevented GA4 from sharing advertising cookies and user identifiers with the Google Ads platform, regardless of consent status.

• Consent Mode (and, in particular, the ad_storage parameter): it conditioned data collection and processing on the user’s expression of consent in the CMP.

The coexistence of both mechanisms allowed the data controller to have a double layer of protection: disabling Google Signals acted as a structural safeguard regardless of potential failures or permissive configurations of the CMP.

As of June 15, 2026, this duality disappears.

Google has announced that the Google Signals configuration will no longer govern the flow of advertising data to Google Ads.

From that date onward, the only mechanism determining whether Google Ads may collect and use advertising signals—including linking user activity to their authenticated Google account—will be the ad_storage parameter of Consent Mode.

The change, explained in operational terms:

• If ad_storage is set to granted, Google Ads may use all available signals.[1] As of June 15, ad_storage=granted allows Google Ads to use all available signals, including linking user activity to their logged-in Google account.

• If ad_storage is set to denied, data flow is restricted. However, Google explicitly warns that this setting will have a significant impact on advertising measurement and campaign performance.

The change, explained in legal terms:

The purpose of the regulation is to prevent access to (or collection of data from) the user’s device unless the user has given active consent.

Therefore, ad_storage=granted has the same effect as a pre-ticked consent box in a cookie banner.

· If ad_storage is configured as granted before user interaction, the implementation is sanctionable because it allows user data to flow to Google before the user has even had the opportunity to interact with the CMP.

Even if the user later consents to the use of cookies, the original infringement is not remedied: between page load and user interaction with the banner, the data has already flowed (if the Google tag was triggered with ad_storage=granted).

As an example, the 150-million fine imposed by the CNIL on Shein last year.

The consent required by Article 5(3) of the ePrivacy Directive, transposed into Article 22.2 LSSI and reflected in AEPD practice, is prior consent to access the device, not consent validated retroactively when the user accepts.

A configuration that would not present this problem would be:

ad_storage=denied by default, transitioning to granted only if the user actively accepts in the banner.

The CMP triggers the update call after interaction, and the tag does not collect advertising data until that moment. In this architecture, consent is genuinely prior.

Interactive self-assessment tool

With the help of my friend Claude, I have created an interactive tool where you can see, for each option, (i) the data flow to Google and (ii) indications of the legal effects.

As Substack does not allow embedding such tools in the newsletter, you will need to access it on my blog via this link.

Why do I include those other two controls ad_user_data and ad_personalization? Because they are relevant.

Because, as usual, Google disregards the user’s refusal of consent: Google’s own documentation indicates that even when consent is denied, tags continue sending “measurements without cookies” and various pings: consent state pings, key event pings, and Google Analytics pings.

Google acknowledges that these pings may include timestamp, user agent, referrer, a boolean indication of consent status, and a random number per page load; however, with ad_storage denied, it states that no new advertising cookies are written or read, certain third-party cookies are avoided, and IP addresses are truncated at collection for Ads products.

4 Legal implications for the website owner

The decision regarding the default value of ad_storage is a clear example of a data controller decision.

Configuring ad_storage as granted or denied by default in the CMP has direct legal consequences that only the controller can adopt and whose responsibility is non-delegable.

Two remarks:

· The de facto delegation of this decision to a third party (advertising agency, website manager), whether by action or omission, or the inertia-driven continuation of inherited configurations without documented review, does not exempt the controller from liability before the supervisory authority. On the contrary, the inability to demonstrate analysis and decision-making in accordance with Article 5(2) GDPR aggravates the controller’s position in potential sanctioning proceedings.

· Third parties (Google in this case) that access visitor data obtained without consent may face their own sanctions, but it should be noted that (i) data subjects do not always know which third parties access such data and (ii) they will always lodge complaints against the website owner, with whom they have a direct relationship.

5 Risk scenarios

The change announced by Google creates, at a minimum, the following risk scenarios that the website owner must address prior to June 15, 2026:

a) Legacy configurations that cease to be effective.

Website owners where GA4 was implemented with Google Signals disabled as a privacy measure—a relatively common configuration in compliance audits—will see that protection automatically cease to operate as of June 15.

Unless proactively reviewed, data flows to Google Ads will depend exclusively on the configuration of the cookie banner or CMP, which may not reflect the underlying privacy decision of the previous configuration.

b) CMPs with permissive defaults or deficient implementation.

It is common for CMPs to present ad_storage with a default value of granted, either due to technical inertia or to avoid impact on advertising measurement.

If the user does not click accept on the banner, or if the banner does not effectively require a clear affirmative action, data will flow to Google Ads without a valid legal basis, in direct breach of Article 22.2 LSSI and Article 6 GDPR. Liability before the AEPD lies, in all cases, with the data controller.

c) Inconsistency between the privacy policy and actual data flows.

Google has provided a sixty-day grace period for updating privacy policies.

This requirement is very revealing: if the change were truly merely technical—without material impact on data processing—it would not require updating user-facing information.

d) Commercial pressure and permissive configurations adopted by third parties.

The impact on measurement and campaign performance warned by Google constitutes implicit pressure on the controller’s providers to adopt permissive configurations.

It must be borne in mind that, at present, both processing for analytical purposes and for behavioral advertising personalization (and any processing that is not strictly technical) require the visitor’s active consent.

6 What if the Digital Omnibus is approved?

The Digital Omnibus is a legislative proposal to simplify the GDPR and the ePrivacy Directive, among others. Its vote is scheduled for June this year.

For present purposes, if approved in its current wording, the Digital Omnibus would introduce two particularly relevant changes:

· Reduction of situations requiring consent. Certain low-risk processing activities—audience measurement and generation of website or app usage statistics—could be based on legitimate interest, thus not requiring consent.

Accordingly, the collection of strictly statistical metrics via GA4 would not require prior user consent.

However, even the reform would not exempt consent for data flows with advertising purposes to Google Ads, which are precisely the subject of the change announced by Google for June 15, 2026.

• Relocation of the Article 5(3) ePrivacy regime into the GDPR. Access to and storage of information on the user’s terminal equipment, when involving personal data processing, would be regulated under new Articles 88a and 88b GDPR, disappearing from the scope of the ePrivacy Directive.

The direct consequence would be that non-compliance with these new provisions by European companies would be subject to GDPR sanctions, which are much more severe (at least in Spain).

Other players such as Google and Meta would fall under the exclusive jurisdiction of the Irish DPC, thereby avoiding the multimillion fines imposed so far by the CNIL under the ePrivacy Directive.

Additionally, it should be noted:

• The Digital Omnibus has not been approved and its final content may differ substantially from the current proposal.

• Even if approved in its current wording, its entry into force will most likely be after June 15, 2026. Therefore, decisions must be made based on the current legal framework described above.

Jorge García Herrero

Lawyer and Data Protection Officer

[1] A CMP “correctly configured” in a technical sense (i.e., one that respects the user’s choice when it is made) does not remedy a legally deficient technical implementation if the default setting is permissive.

[2] In fact, Google expressly warns that, in Consent Mode for web, the default state must be set before any command that sends measurement data, and provides ad_storage=’denied’ as an example.

Would the headline “BMW simplifies taxis” seem correct to you?

Today the headline is: Google “simplifies” its privacy controls in Analytics.

The honest translation would be: Google liquidates an essential control for website publishers, who are the ones who are going to eat the responsibility in the EU.

Let’s see:

Since June 15, 2026, Google Analytics will stop using the Google Signals setting as a control for the flow of advertising data toward Google Ads.

From that date, the only mechanism governing that transfer will be the ad_storage parameter of Consent Mode. This is what Google announces in its own Help Center, calling it “simplification” with its usual reinforced-concrete face.

What changes? (sorry: what gets “simplified”?)

Until now, by disabling Google Signals it was possible to prevent Google Analytics 4 from sharing advertising cookies and user identifiers with Google Ads. Starting on June 15, that control will only manage the association of analytics data with signed-in users for the preparation of behavioral reports within GA4.

Everything else — that is, what matters for Google’s advertising business — will be managed by the ad_storage control.

· If ad_storage is in “granted” mode, Google Ads will be able to use all available advertising signals, including associating user activity with their Google account.

· If it is “denied”, Google will be limited to less persistent signals, such as URL parameters of the gclid type.

Google has always boasted about transparency and compliance in its data processing, but there are few examples as clear as this one of the exact opposite: its specialty is generating an illusion of control by restricting the options available to the user.

And rarely has a binary choice been less neutral: either you feed Google’s business with your users’ data, or you assume the performance cost of your campaigns.

Last but not least: Google grants a 90-day grace period for its users to update their privacy policies and cookie banners. If nothing had changed in the real processing of the data, updating the information clauses would be unnecessary.

The very existence of this deadline is the best refutation of the euphemism “simplification”.

Problems for website publishers

In Fashion ID (C-40/17), the CJEU clarified that inserting third-party code into a website (Fashion ID) is a design decision of the data controller that enables that third party to access users’ personal data. The fact that Fashion ID did not control what Facebook did with that data afterward on its own did not exempt it from responsibility; it simply delimited the stretch of the data lifecycle attributable to it.

Well then, the controller that embeds the GA4 tag on its website makes a design decision that enables collection. If its CMP is badly configured, if the banner defaults to “granted”, or if the implementation of Consent Mode is technically incorrect — a very frequent scenario, as shown by the history of sanctions against Google Analytics in several Member States — the data flows toward Google Ads without a valid legal basis. And the responsibility, in accordance with Fashion ID and Wirtschaftsakademie, falls entirely on the controller, not on Google.

Does this have anything to do with the Digital Omnibus thing, miss?

Ah, the Digital Omnibus, that other “simplification” maneuver...

Where the Omnibus proposes to simplify consent through automated technical signals, Google simplifies its own architecture by making Consent Mode the only point of control. Where the Omnibus proposes reducing banner fatigue, Google removes a layer of protection that did not depend on banners. Where the Omnibus wants more legal certainty for the data controller, Google shifts the technical responsibility to a layer — the CMP implementation — where errors are endemic and commercial pressure to configure “granted” is at its highest.

At the end of the day, when the Omnibus enters into force — in the best-case scenario, not before 2027-2028 after negotiation in the Council and Parliament — Google will already have consolidated an architecture where ad_storage is the central control:

.- If that architecture ends up being validated by the new legal framework, Google will have transformed a position currently questioned by six different Authorities into a compliance standard.

You are reading ZERO PARTY DATA. The newsletter on current affairs and technology law by Jorge García Herrero and Darío López Rincón.

In the free time this newsletter leaves us, we solve complicated messes related to personal data protection and artificial intelligence regulations. If you have one of those, give us a little wave. Or contact us by email at jgh(at)jorgegarciaherrero.com

Suscríbete ahora

🗞️News from the Data World 🌍

.- China leads the AI talent race. China not only graduates more top researchers, but now also retains young profiles more easily who used to migrate to the U.S. To no one’s surprise. The less obvious angle is geopolitical-labor: the Chinese advantage seems to come less from star hires and more from early retention conditions, creating a domestic pipeline that is hard to break from the outside.

.- Yesterday the European Commission confirmed that the app for age verification is ready. It would have been appreciated if the political statement had clarified whether the whole zero knowledge proof issue is completely ok and all that, but shall we bet on how long it will take Member States to make it actually work in each area? Will Discord come back before it is fully operational?

.- Booking has another security breach again. Almost one every year, and when one lets one’s guard down. And it does not seem to affect much the fact that it remains number one in its thing of booking hotels. The Guardian pokes it in the eye with the 475,000 they got hit with in 21 for another breach. Fair enough, it is the only one that can be traced (or that we are capable of finding).

.- Tremendous report on the capture of precise geolocation by the Webloc app and its delightful consequences for claims of data “anonymization” by companies that have access to this dataset and its use by delightful authorities such as ICE.

Let’s not forget the precision of Strava geolocation with military stuff. We forgot to mention the marvel that it became known that the French aircraft carrier Charles de Gaulle (one of those nuclear ones, flagship and the only one they have) was around Cyprus.

That is what happens when someone can be seen running in a strange floating perimeter at a specific point in the Mediterranean. And military people being crazy, it is beyond obvious that they could know which aircraft carrier it is just by seeing the shape of the flight deck.

📖 High density docs for data junkies ☕️

.- The CNIL publishes its final recommendations on tracking pixels in emails, updating its regulatory position on a widespread practice in digital marketing that is, at the same time, invisible to recipients. Tracking pixels are one-pixel images inserted into emails that, when loaded, communicate to the sender the time the email was opened, the device, the approximate location, and certain reading-behavior modalities.

The CNIL clarifies the applicable legal bases, the information requirements that must be met, and the opt-out mechanisms that must be offered. Luis Montezuma provides us with the automatic translation.

.- The PIA template that the EDPB has put out (in public consultation) does not look bad for pulling out some punctual thing. More time has to be devoted to it to see it in detail, but it even has a box planned for secondary purpose. And a direct link to all the DPAs’ guides on the subject (the additional PDF explaining the template).

And it serves as a LinkedIn social experiment to see the two big groups of professionals: those who see the glass half full of how good, and those who throw it off the table after seeing debatable things (no need to say which of the two we are in). Of the second type, we have Robert Bateman and Peter Craddokarguing that there are little things. It is true that it comes very late and is more complicated than for a mere form that the DPA tears apart when it comes asking for it.

💀Death by Meme🤣

Our Two Cents

.- The good people at Legal4Tech podcast had the terrible idea of letting me ramble in English (that is not one, but two MISTAKES in a row) about data protection in general, about the digital omnibus, and about the Scania doctrine, which quite sensibly they did not let me go deeper into because I would have bored everyone to death.

🤖NoRobots.txt or The AI Stuff

.- Google DeepMind’s watermarking system for AI-generated content has been deciphered and neutralized by an unemployed engineer using 200 black images and basic signal processing. Arrosh Denny’s “reverse-SynthID” project identified through spectral analysis that the watermark operates on a carrier-frequency structure consistent across images generated by the same Gemini model, without needing access to Google’s encoders.

.- The Belgian DPA has put out a document on data protection applied to AI (The impact of artificial intelligence on privacy). It is not a document that brings big novelties, but it has a first part with a clear explanation of the differences between AI model and AI system that is good. The most striking thing is the culinary simile to explain this difference:

The Cooking analogy is helpful to grasp the difference. AI model training consists of the creation of a cake recipe, while the AI system bakes the cake. The baked cake (the output) depends on the quality of the ingredients (the data), the reliability of the recipe (the AI model architecture), and the steps to follow (the algorithm). The integration of that model into the AI system enables the cake to be baked by following the recipe, with the correct ingredients, executing the steps in order, and using the oven, cake pan, mixing bowls, etc. (the infrastructure, APIs, interfaces, etc.) to complete the process.

📃The paper of the week

.- Despite how striking the headline is, the first paragraph (and in general all the content of the article by Jordi Perez Colome), the essential aside of this article is, IMHO, the following:

”Thousands of users share photos or murky fantasies with other men in groups that the messaging application Telegram DOES NOT MODERATE, BUT DOES MONETIZE, thanks to its subscription system.”

The paper coordinated by Silvia Semenzin and Salvatore Romano here.

.- Another paper (a total classic by Steven Kerr with two decades behind it) that is undoubtedly worth reading was recovered by Ethan Mollick as a result of one of Meta’s latest great ideas: incentivizing its employees to consume tokens like crazy.

The paper breaks down a lot of striking examples of terribly determined incentives that end up promoting the opposite result to the one pursued.

🙄 Da-Tadum-bass

Silliness, but damn how annoying it is when it happens to you. And surely Microsoft already considers it a “feauture” to preserve.

If you think this newsletter might appeal to someone and even be useful to them, forward it to them.

Compartir

If you miss any doc, comment, or dumb thing that clearly should have been in this week’s Zero Party Data, write to us or leave a comment and we’ll consider it for the next one.

This is one of the topics I have spent the most time reading and talking about over the past year.

Two weeks ago, I chatted with Sergio Maldonado on this in his podcast.

Sergio’s is a very notable opinion. His perspective is privileged: he has been in the digital space from the beginning, he is in the US -in all the cream- and is an early-definer (more than adopting).

There’s no need to see more than the legal services platform he launched: todolaw.com

The topic has much to offer and I believe it can affect you, not just the lawyer hanging there (on your team). So I will leave here the ideas that seem most relevant to me and where I got them from.

I already warn you that some of the loudest ones come from myself...

You are reading ZERO PARTY DATA. The newsletter about current affairs, tech-polies and law of Jorge García Herrero and Darío López Rincón.

In the free time this newsletter leaves us, we specialize in solving complicated moves in personal data protection. If you have any of those, give us a hand with your little finger (contact us). Or contact us by email at jgh(at)jorgegarciaherrero.com

Thanks for reading Zero Party Data! Sign up!

Suscríbete ahora

1.- How it started: “MUAHAHA I am un-justifiable”

I know you have never seen the little scene I am going to describe, but I have seen it frequently.

It’s the one of a lawyer (doesn’t matter the age, eh?) who one day tried free ChatGPT asking him a complicated question -normally the one he sweated to solve- about a subject he had to study last week.

The prompt was garbage and the AI’s response, another one: a generic response with two hallucinations that an intern wouldn’t miss them (or couldn’t spot).

The lawyer smiled at the reassuring disaster, punched his chest with both fists and roared “IN YOUR FACE, SAM ALTMAN” “WE SHALL OVERCOME!!” “NEITHER IA NOR IO!!!”, “CHOI UNJUSTIFIABLE MUAHAHA!!!”.

Invariably the day of that ‘definitive scientific test’ was before November 2025, because otherwise another rooster would have crowed (it wouldn’t be relevant anymore).

Well, I have good and bad news for that lawyer. Bad ones, mostly.

...How it’s going

Last November, AI made a qualitative leap. Since then, gross errors and erratic documents that we were used to are not detected anymore. Or hardly.

But I’m not here to talk about what works well now, but about the expected changes around the new technology.

AI will not be limited to automating legal tasks: it will drastically change value capture in the legal profession, law firm structure, client relationship and the meaning of what we have come to call ‘the practice of Law’.

Such is the convergent conclusion of “Reshuffle” by Sangeet Paul Choudary, and the paper “Some Simple Economics of AGI“, by Christian Catalini, Xiang Hui and Jane Wu (February 2026), the two main sources of post-brick that are prepared to, at best, look on diagonally.

I know them.

2. Democratization of knowledge…

Both Reshuffle and Economics of AGI reach the same conclusion by different paths: AI turns the deep knowledge component of the professional into a commodity. And that will have an impact on... the price.

Reshuffle identifies three restrictions around which systems are organized —scarcity, risk and coordination—.

When AI liquidates the scarcity of deep knowledge (because legal research, case synthesis and regulatory analysis turn out much faster -and today practically free, we’ll see tomorrow-), the economic value is kept by those who manage the other two restrictions.

... versus “skin in the game”

When access to knowledge is no longer scarce, the lawyer’s value resides in applying judgment and strategy and in assuming and managing risk.

Scarcity gone, fees must be justified elsewhere and measured differently, not by hours.

A lawyer who searches, digests and regurgitates legal knowledge is performing an easily automatable task and therefore, fungible.

A lawyer who helps a decision-maker do their job better, to take one direction or another with relevant consequences —assuming responsibility for said advice— operates in a context and offers a service that will be out of AI’s reach for a long time.

I believe.

In a world (this one you inhabit today) where Claude can retrieve and synthesize regulations and case law notably in seconds, the lawyer’s value resides in the ability to look their client in the eye and tell them ‘do or stop doing this’ assuming the consequences of the advice.

Nothing new under the sun: what has and always had added value is the application of judgment in conditions of uncertainty and under professional liability regime.

Any AI will pull out a good draft note in minutes with the sanctioning consequences of doing this or that thing.

But what has always been valued -and will be more every day- is the professional capable of pointing in the most practicable or better defensible direction, with or without that note in between.

Different thing is that before ‘knowledge’ and ‘judgment’ were billed together. Now it will be to justify billing in that quality sometimes so easy and other times so difficult to explain, which makes that once you smell a really good lawyer you don’t want to separate from him (or her) even with forceps.

3. The crisis of the billable hour…

Specification of the above: an AI compresses the elaboration of a research report from 40 hours to 60 minutes of supervised ‘Deep research’ generation.

Not a free AI, of course, but yes a system fed with the correct precedents, with its weaknesses and strengths studied and attended to, based on a fifth iteration skill, which is asked and whose result is supervised in an adequate way.

In this scenario, the criterion of fees based on ‘billable hour’ becomes absurd. For two reasons:

• Economics of AGI highlights this issue from the perspective of demand, predicting that income models derived from ‘knowledge work’ will pass from ‘Software-as-a-Service’ to ‘Software-as-a-Work’: monetizing results instead of access or time.

• Reshuffle points to supply: we will witness a fundamental restructuring of law firm economy. Law firms that cling to billable hour won’t just be outdated: they will undervalue their own comparative advantage. If AI drafts in minutes, charging for those minutes will be a catastrophic example of ‘race to the bottom’.

... and the boom of judgment, experience and strategy

Charge for judgment, strategy, expert verification and responsibility that make that draft really executable and useful?

There will be the premium billing.

Nothing new under the sun: that was always there: in the key intervention of the critical meeting, in the executive summary of five bullets, never in the forty-page boring report that no relevant person is going to ever read .

Certainly there will be uncomfortable meetings with clients: before the natural trend (and most justified) of reducing fees due to evident time optimization derived from AI use, it will have to put value on cognitive load and responsibility linked to the new way of working:
On one hand, orchestrating and refining AI agents’ work and supervising their outputs is exhausting, as anyone who does it can testify.
On the other hand, if with one prompt to Claude or ChatGPT you already think you have everything you need to make an important decision... Why do you ask me to validate it? Specifically why precisely to me?

While the answer to this last question is correct, you will survive the AI tsunami.

4. Professional liability: unexpected moat or competitive moat

Reshuffle contains a totemic phrase that develops throughout most of its pages: ‘Tools amplify performance, but solutions absorb risk’.

AI tools ‘specialized’ (in our case: legal) like Harvey or Legora have several obvious problems and one deep one.

In the most obvious part, they are nothing more than wrappers with advanced RAG shielding. Said plainly, they are a layer of customization painted over the antepenultimate frontier model from OpenAI or Anthropic: you are paying a meadow per month for a model from months ago -which are decades in the current crazy AI context-.

These frontier model wrappers are specially designed to capitalize lawyers’ risk aversion (they aren’t usually very techies but what they are is very fearful of professional liability due to hallucinations).

And that’s good. But listen well lawyer: AI flattens and homogenizes knowledge. And that coin has two sides:

• The mediocre professional, whose work is below average will see their level boosted until their mediocrity reaches the industry average.

• The excellent one must be able to identify the content in which their difference is concretized, articulate it and train with it AI so that it multiplies them, instead of equalizing them downwards.

The problem, needless to say, is that by training ChatGPT with your best content, you are helping a guy so trustworthy and with such good intentions as Sam Altman, or any of his bro friends: people who have been preaching for years that their invention will take your job away.

But the key is in responsibility.

Harvey can dispatch an impressive legal document. But remember that you cannot sue Harvey for making up a ruling. It cannot be sanctioned by a bar association. Harvey cannot sign an opinion. It does not have professional liability insurance.

It is the lawyer whose signature, whose body interposes between AI’s output and consequences for the client will represent in a few years the most scarce economic function, the bottleneck of the system.

Few can ignore that curves are coming for all job profiles who have lived producing routinely identical papers among themselves.

However, professionals -and lawyers- specialized in high-risk situations —complex corporate operations, novel regulatory environments, complex litigation— will retain their pricing capacity much longer.

5. From “collectors” to “verifiers”

Economics of AGI predicts a collision between two cost curves: the automation cost curve that descends exponentially and the verification cost curve, which will remain constant, because it is limited by our very modest human capacities.

What does this mean?
As you well know if you are “in it”, AI can generate a 50-page contract, a comparison between regulations of five countries, a summary of a stone-hard paper and a presentation summary, all in half an hour.
As we say, today the price paid by users of frontier models is close to zero. Tomorrow we’ll see.
But someone has to verify that all those outputs are correct, complete and -fundamentally- relevant for the situation and aligned with the client’s real intention.
That verification will remain expensive, slow, limited by human limitations.

The trap of the “looking good report”

The legal text generated by AI will always be formally impeccable, structurally solid and materially incoherent in aspects that an experienced lawyer will detect.

Nothing new under the sun: that is what has always happened with juniors’ drafts, including the smartest ones: immaculate notes, without a single spelling mistake, -let’s assume without hallucinations-, but irrelevant, off-track or away from what the client was clearly asking us for, or manifestly needed or expected (even without explicitly asking).

The trick: Critically, “Economics” holds that using AI to verify AI is very dangerous: “it generates false confidence” because the verifier and generator share the same blind spots.

The author of Reshuffle proposes the sandwich theory: the professional defines what is needed, AI generates a draft and the professional reappears to verify and ensure a correct and relevant result.
Verification competition will be much more important than production one.

This not only includes detecting hallucinations, but especially where AI ‘didn’t get it’, the gap between extracted information and client context, the important question they didn’t ask you...
That is, distill flat information into immediately actionable value advice.
Combine with verification capacity, quarter and half of applied psychology to know if what your client needs is that they back you up, convince them otherwise or simply get out of their way, and you will have the lawyer profile who has always been successful, with or without AI. Again: nothing new under the sun.

Of course the combo formed by (i) a flashy report (ii) without review or what is the same, (iii) reviewed by an overworked Executive is already giving us days of glory.
This will go further. Much further

6. “Above” and “Below” the algorithm

Reshuffle divides workers into two categories: those who design, build and exploit AI systems are above the algorithm.
Those whose work is managed, standardized and evaluated by automated systems are below.
Above the algorithm the professional contemplates ecstatically what they can do with their new superpowers.
Lawyers who use AI as ‘engine’ to redesign legal service provision —creating new workflow architectures, developing proprietary processes of AI-augmented advice or building verification infrastructure— will be above the algorithm.
Lawyers who remain clinging to routine and standardized tasks by AI (document review, basic contract drafting, regulatory checklists) will find themselves increasingly below it, competing in speed and cost with AI and with a competition as commoditized as them.

Yes: a cruel “uberization” of the profession is coming for “the ones below”.

Whoever stays below loses agency and pricing capacity.
It seems inevitable the thinning of templates from large structures.
And the precariousness of survivors whose only function, once workflows are automated, is to review AI-generated outputs

And watch out that by ‘large structures’ I not only refer to established firms, but also and especially to flexible lawyer hiring platforms for projects, capable of sheltering technical professionals without commercial skills for weeks, absorbing their expertise in form of deliverables or ‘skills’, reducing their work to quantifiable metrics, optimizing and paying only what clients can actually measure (and glups, qualify), and dispensing with the rest, including ethereal concepts like what we call empathy, good vibes, spark, talent, room reading or genius.

Watch out, buddy, some of these players could even try to charge you for accessing your own know-how, conveniently aggregated, regurgitated and packaged for the occasion... inside or outside a proprietary AI.
‘It is happening’.

... but watch out for putting all your, erm, eggs in the same basket.

One of the elephants in the room is the AI bubble.
Large companies are subsidizing massive technology adoption, literally losing money with each one of our prompts.
A viralized article after the closure of Sora points to a price increase for tokens between x10 and x100, by end of 2027.

It may not be that much (x100), and it may not be so soon, but it will happen.
This is another movie we have seen many times before. It’s called “enshittification“.
Today we can already know that there won’t be enough competitors to see real price wars. And that the adjustment will reconfigure -again- the whole professional landscape when it happens.

Watch out for passing to depend completely on providers who can discontinue your favorite model, impose an inflation of x100 in euros (or deflation of 1/100 in tokens) from one month to another.
Have you fired too many people trusting low token prices?
Amodei will come with the bill.
Have you already forgotten how to do this and that because your wonderful swarm of agents did everything for you?
Say goodbye to your sweet profits.

“If you cannot build a viable business with AI costs 5 times higher than current ones, you don’t have a viable business: you have a ‘subsidized’ project.”

7. Not everyone can be a great artist, but a great artist can come from anywhere

Reshuffle: AI drastically reduces the common minimum multiplier to provide professional services.
If a lone wolf legal with Claude with a set of well-designed workflows can produce the same volume and quality of work as a team of five associates and two paralegals, the economic justification of large firms wobbles in a lot of practice areas.

This is a threat and an opportunity (but not for the same ones):

• Consolidated firms face the classic “innovator’s dilemma“: their size, overhead and legacy processes turn into liabilities for these purposes (instead of assets).

• But for individual lawyers, and especially the youngest ones, the entry barrier has never been so low.

Read the vision of “niche lawyer” of Jordan Furlong: I’m not going to explain it as well as him.
That one person attends to a specific clientele with AI-augmented precision and minimal overhead is something perfectly viable today.
... on the other hand, it has never been so easy as today to lose your head working all day alone at home, crossing your judgment -or simply talking- only with AI agents.
... or step into deep trouble by entering unexplored territories riding on AI’s shoulders, for not having anyone beside you with whom to cross your judgment minimally.

8. “Let’s calm down”

The (today still huge) gap between AI hype and legal reality imposes a bit of skepticism towards extremes:

• The legal world is firmly anchored to the most conservative structures of Western society. Everything that can change slowly in this context will do so with minimum revolutions: it will happen at glacial speed.
  You just have to see all those living and jumping procurators in times of Lexnet. Or the amazing scene of a pharmacist cutting a barcode with a cutter and sticking it with cellophane on a piece of paper. Amazing.

• “AI“ is an extremely generic term that encompasses very different realities. Changes will wipe out entire industries before others even start to worry.

• Each generation has had a technological crisis: maybe ours is more pronounced but none have been apocalyptic.

The correct takeawy of all this is not, I think, complacency, but remaining skeptical both towards ‘nothing will change for me’ and to ‘everything is coming down’.

Lawyers should decipher both ‘agendas’: both those who hold ‘AI is just a tool, nothing will change’ and the apocalyptic narrative of ‘lawyers are already cured meats’.
The sensible median would be in evaluating AI’s capabilities according to the Best Available Human (BAH) standard of Ethan Mollick, instead of facing the ideal lawyer, which by the way doesn’t exist.

It is true that AI today surpasses the average lawyer’s capacity in some things, but much will have to row Sam Altman before automating little things like justice administration.
Do you remember that so funny feeling the first time they introduced your credit card data on the internet for the first time? That won’t be anything compared to filing a completely automated lawsuit in an important matter. That will be butterflies in the stomach of real eagle size.

9. It’s the system, stupid!

Reshuffle insistently insists that we are asking the wrong question. ‘What can AI automate?’ instead of ‘What new systems will emerge coordinated by AI?’.
The service restructuring that gives title to the book captures a more ambitious reality than task-by-task analysis.
AI will not only change what we lawyers do; it will change how we organize ourselves, provide services, regulate ourselves, lend and value our services. And it will do so at the same pace as the ecosystems to which we provide services.
“Economics” coincides with its framework of ‘cascading coordination’: each solved coordination problem will unlock the next layer of complexity.

• The first-order effect of AI on law is steroid-document generation.

• The second-order effect will be (already is) workflow restructuring.

• The third-order effect will be new firm structures, pricing, client relationships.

• Later there will come new regulatory frameworks, new competitive dynamics between tools and solutions and native legal AI disruptors that today we don’t reach (I can’t) to imagine.

Lawyers who limit themselves to asking ‘How do I use ChatGPT to draft contracts faster?’ are optimizing a system that has days counted.
The question is: Where do I want to be in a post-generalization AI world? .

10.- We leave for another day…

‘The juniors, the juniors, is anyone thinking about the juniors?‘ and

‘Teaching skills to Claude or not teaching skills to Claude, that’s the question: the prisoner lawyer dilemma‘

Jorge García Herrero

Lawyer and DPO

With everything that is currently coming down the line in terms of future regulation, court cases where internal reports keep coming out showing the use of every trick of applied psychology that causes real harm to minors and adults alike, and authorities becoming ever more aware of what addictive patterns are, along come the people from the big arched M with an aggressive marketing campaign based on scarcity, FOMO, and data collection:

• Taking advantage of it to get good data through the app. A classic among classics;

• Taking advantage of the current obsession with opening Pokémon packs (physical and virtual): not for nothing, it is already known how much the rarest random cards you might get here would be worth. Don’t ask about the obscenities people ask and pay for Pokémon cards (especially if they are “graded”); and

• Taking advantage of Gen Z’s k-pop obsession to hit them with every visual stimulus and a full-blown Skinner scheme to keep them buying until they get everything.

And all this, only to then see the company’s CEO pretending to bite the wonderful not-at-all-bad hamburger they sell. P.S. Krusty already did it in The Simpsons.

Eou are reading ZERO PARTY DATA. The newsletter on current affairs and technology law by Jorge García Herrero and Darío López Rincón.

In the free time this newsletter leaves us, we solve complicated messes related to personal data protection and artificial intelligence regulations. If you have one of those, give us a little wave. Or contact us by email at jgh(at)jorgegarciaherrero.com

Suscríbete ahora

🗞️News from the Data World 🌍

.- The latest in the Gallagher-style AI feuds: while OpenAI shuts down Sora and gives up on its “huge project” for an adult NSFW ChatGPT, Anthropic accidentally leaks all-the-co-de of Claude (!!!!). But the very latest news is that Anthropic is doing a limited release of Mithos, its latest model, given how easily it finds zero-day vulnerabilities in “any software.”

And it’s only Thursday, Captain Haddock.

.- Noyb informs us that the Council of State dismissed Criteo’s appeal in March over the famous multimillion fine they got for doing their Adtech thing badly. It seems that the line about pseudonymous identifiers associated with IP addresses and “other browsing data” not being personal data at this point (with IP being one of the classic examples) did not sit well at all with the French Council of State. When we all already know they cross-reference a thousand things, and that what matters to them is being able to single you out through that IP and browsing, with no interest whatsoever in your name and surname.

.- The Australians are finding out that the new regulation on minimum age for social networks does not prevent nature from finding a way through: Social Media Minimum Age: March 2026 Compliance update. The supposed guarantee intended to minimize the margin of error / practical application of the right to challenge the decision of the system that categorizes you as a minor or an adult has been turned on its head by the reality of the world. On paper it is framed as a wonderful safeguard, but the minor sees it as just try again until it beeps. We saw Peter Craddok’s comment on the document on LinkedIn, but we went to the document to look for those specific highlighted observations:

.- This article by John Wilkins portrays the expansion of surveillance devices that are voluntarily made visible, almost totemic, presented as preventive crime deterrence. The moral is that surveillance is no longer hidden, but rather displayed as a message. Umberto Eco would praise its semiotic function: these artifacts are designed to generate “anticipatory obedience.”

.- Meta bad, but losing Section 230 worse. This fine text by Ryan Broderick contrasts two poisons** for you to choose yours**: Meta’s moderation and design failures versus the systemic risk of weakening the Yankee liability shield of Section 230. The counterintuitive argument is that punishing platforms may end up damaging the information and expression ecosystem more than correcting specific abuses. But friends! the author is not defending Meta, no (unlike all those former presidents of enforcement authorities who run to big law firms to do so as soon as they leave office); what he is doing is defending the legal architecture that prevents an internet dominated only by actors able to afford litigation and massive preventive filtering.

.- An interesting article from a foreign outlet explaining LaLiga’s very well-known abuse in blocking the websites of all and sundry during football match broadcasts. What is interesting is that it describes the ecosystem in which the companies holding broadcasting rights operate as that of a true banana republic.

📖 High density docs for data junkies ☕️

.- The ICO put out for public consultation its guide on automated decisions. You have to keep in mind that it is based on the UK GDPR, but it does leave some very applicable things:

1. Real human intervention, not tokenistic, recorded and prior enough that there is time to make critical changes in the processing.

2. And the problem of consent when it comes indirectly. It calls it “invisible processing,” because the data subject does not even realize what is being done.

“You should remember profiling can often be invisible to people. For example, if it involves personal information that you obtain from somewhere other than directly from the person themselves. This sort of invisible processing may mean that it is challenging for you to show that you have valid consent because it isn’t informed or specific in these cases.People also have the right to withdraw their consent at any time. You must make it as easy for them to withdraw consent as it was to give it.”

.- The CNIL publishes a document on retention periods in the employment sphere. Very table-format, and without many surprises. What they call an intermediate archiving period is, in the end, the same as our specialty under article 32 of the LOPDgdd on blocking. They include details on biometric access, and even a breakdown of the staff itself.

.- The Spanish Supreme Court applies the Scania doctrine. The other way around, but it applies it. And along the way it says that all those guides and guidelines are worth what they are worth: as “notorious facts,” not as a source of law.

.- Interesting judgment that punishes a detective agency for capturing the image of a worker on sick leave on the balcony of her house. She was on the balcony, yes, but she was in her house. So be careful.

.- Does National Security Scheme certification serve as a mitigating factor in liability for non-compliance with the GDPR? Francisco Javier Sempere and the National Court have the answer.

.- The Most Holy Luis Montezuma brings us, in a single skeet, links to the versions in** English **of the AI laws or bills of Japan, Korea, Vietnam, and Taiwan.

.- Highly recommended are the in-depth articles on ADM and AI Act aspects from the FPF. Specifically this one on the prohibition of emotion recognition by Desara Dushi.

.- When the AEPD bars the door, biometrics come in through the window. No, this is not a faithful summary of Patricia Chenlo’s post, but never let the truth ruin a good headline: Patricia comments on the Draft Law on the protection and resilience of critical entities that enables biometric authentication and identification for access in critical entities, under legal obligation, public interest, mandatory DPIA, and prohibition of labor or timekeeping uses.

.- Don’t miss the hair-raising statement by the AEPD in this decision declaring proceedings expired over a SEUR security breach. The credit for extracting the grain from the chaff goes entirely to Maria Luisa González Tapia.

.- Capilano University conducted this PIA on a proctoring application. So far, nothing new. What is funny about this PIA is that… it found insufficiently mitigated risks and rejected the processing.

.- A delicacy: a coloring book in the literal sense of the term, explaining to children what a data center is. What on earth is this resource doing in this newsletter and in this section? Click the link and then you tell me: not even I, the spy, could have managed to find material so breathtakingly mordant. The authors of this marvel are Melissa Tamberg, Mike DeCamp, Laura Scheving, and Luci Gardner.

.- The crisis of consent in contexts involving AI agents. This post does not stand out for its technical depth in legal issues (which it does not claim to have), but for its ability to illustrate the inherent difficulties in the new contracting and operating flows of aaall those agents (in that, it has plenty). Via the great Joan Sardá.

💀Death by Meme🤣

🤖NoRobots.txt or The AI Stuff

.- I highly recommend reading the description of this scam targeting an Axiom developer that allowed attackers (who pretended to be a startup in order to get a Teams call with their victim) to take control of his access credentials and introduce malicious software among the company’s legitimate libraries. Fine stuff.

.- US states’ regulations always feel very far away from us, but compilations and visualization tools in the IAPP style keep coming out. Now a tracker has been added on the emerging chatbot regulations (surely also agent regulations) of the states working on them, via FPF (Future of Privacy Forum).

📃The paper of the week

.- It is not a paper but another reflection on the erosion that the use of AI produces in the cognitive capacities of those who are in the process of training and who, inevitably, use and abuse AI models. Brilliant.

.- This one really is a paper. A veeery suggestive paper: “Large language models (LLMs) sometimes appear to exhibit emotional reactions.(…) Our key finding is that these representations causally influence the LLM’s outputs, including Claude’s preferences and its rate of exhibiting misaligned behaviors such as reward hacking, blackmail, and sycophancy.” (Well, would you look at that!).

📎Useful tools

.- US states’ regulations always feel very far away from us, but compilations and visualization tools in the IAPP style keep coming out. Now a tracker has been added on the emerging Chatbot regulations (surely also agent regulations) of the states working on them, via FPF (Future of Privacy Forum).

.- Are Claude’s various usage limits starting to eat your afternoon snack? We have a few little tips for you.

.- An AI-vibecoded document anonymization tool. The most promising-looking one among all those roaming around, IMHO.

.- If — like me — you are a not-so-neophyte in Python and have already spent years creating and forgetting virtualized environments here and there, it is more than easy that this tool to locate and delete them comes in — heh — handy.

🙄 Da-Tadum-bass

It may seem unrelated. For anyone who has not heard, a Nestlé truck (and its cargo of 400,000 F1-style bars) was stolen on a route between Italy and Poland. Leaving aside that the driver has to be in on it for them not to have geolocated the truck which, surely, was carrying a beacon, Nestlé came up with launching this landing page seeking citizen collaboration. If you had chocolate with the affected code, it was supposedly giving you instructions to notify the company and the authorities they are collaborating with.

The point was to see how that “get in touch” had been set up from a data protection perspective. The problem is that the affected code has not been leaked to see what appears afterwards, the media have not looked into it that far, Reddit has not lived up to expectations here, and neither Claude nor his friends are able to provide the code (it is not the one in the image, no).

Unless it is someone who needed to have a lifetime supply of KitKat, it is quite likely they will not try to sell it or place it on the market with the original wrapper. There are thieves who are rigorous in their work.

If you think this newsletter might appeal to someone and even be useful to them, forward it to them.

Compartir

The AI Act regulates transparency as a fundamental pillar of technological governance, not only to prevent malicious deception of specific individuals or groups, but also to preserve the integrity of the global information ecosystem.

In other words, it seeks not only to protect individual rights, but also the functioning of the European political and social system.

Synthetic content is defined, in general terms, as any digital asset—whether text, image, audio, or video—generated or substantially manipulated by means of AI systems.

The transparency obligation is manifested through two operational dimensions: machine-readable marking and human-perceptible labeling.

· Marking refers to the integration of technical signals, such as encrypted metadata or digital watermarks, that enable other systems to automatically identify the artificial origin of a file.

· Labeling is directed at the perception of the end user, using visual or auditory indicators that inform them of the AI nature of the content at the moment of exposure.

Article 50 of the EU AI Act imposes the transparency obligation for general synthetic content (not deepfakes) primarily on technology providers, who must ensure that their systems “mark” outputs natively.

If you are interested in art 50 transparency obligations, you definitely should check out the first part of this series:

I promise you that the rest of the text is written quite seriously, but at this point I cannot resist paying tribute to Karate Kid, with the secret hope that it may serve as a mnemonic rule to remember that providers are required to mark (wax on) and deployers, to label (wax also on).

You’re reading ZERO PARTY DATA. The newsletter on current affairs, technopolies, and law by Jorge García Herrero and Darío López Rincón.

In the spare moments this newsletter leaves us, we specialize in solving complicated stuff in personal data protection. If you have one of those, give us a little wave. Or contact us by email at jgh(at)jorgegarciaherrero.com

Thanks for reading Zero Party Data! Sign up!

Suscríbete ahora

2 Article 50 of the AI Act

The European Union AI Act represents the first comprehensive attempt to codify these obligations at the international level.

The AI Act adopts a “risk-based” approach, classifying generative AI within the limited-risk category.

Accordingly, it imposes specific transparency requirements designed to foster trust and traceability.

2.1 Obligations for providers of generative AI systems

Article 50(2) provides that providers of AI systems—whether specialized or general-purpose (GPAI)—that generate synthetic audio, image, video (either deepfakes or not), or text content must ensure that outputs are marked in a machine-readable format.

This obligation is independent of the purpose of the generation or publication of the content: whether it is an artistic image generated for a blog or ambient audio for a video game, technical marking is mandatory.

The law requires these solutions to be “effective, interoperable, robust and reliable” to the extent permitted by the state of the art.

Accordingly, the provider must not only insert a mark, but that marking must also be resistant to attempts at removal or manipulation by malicious third parties.

In addition, providers must make available free detection mechanisms—such as APIs or public verification tools (“oracles”)—so that deployers and other users may verify whether a specific file was generated by their AI.

2.2 Exemptions

Without prejudice to the foregoing, the European AI Act has envisaged scenarios in which strict transparency could be counterproductive or unnecessary.

· AI systems that function as “standard editing assistants.” This includes tools that do not substantially alter the input data or its semantics, such as color correction tools in photography, audio noise reduction systems, or video stabilization tools.

· AI systems used exclusively for scientific research and development purposes.

· AI components distributed under free open-source licenses, unless such models present systemic risks.

· The well-known household exemption: purely personal and non-professional use. An individual who generates an image for private use is not subject to the same labeling obligations as a company distributing commercial content.

3 The EU Code of Practice and the dates on which all this will apply

Since the text of the AI Act provides legal principles but not technical specifications, the European Commission has published a Code of Practice on Transparency.

In March 2026, its second version was published, and it is the version discussed here.

This Code of Practice seeks to bridge the gap between the legal obligation and technical reality by establishing what is considered the “state of the art” with regard to the marking and detection of synthetic content.

Is this Code mandatory? Nope

The Code is not mandatory in itself: only for companies that subscribe to it.

Subscription to this Code neither presumes nor certifies compliance with the AI Act (organizations that do not sign it may demonstrate compliance by other means).

But in practice, the idea is that the Code will become the compliance standard in inspections conducted by the competent authorities.

The third version (the final one) of the Code is expected in June, and official Guidelines from the European Commission are also expected, but all of this will become known only a few weeks before the AI Act enters into force.

The problem is that, given the timetable, whether or not those documents arrive in time, it will be very difficult in practice to implement their new requirements in time for the applicable date: 2 August 2026.

Lastly, the AI Act will apply to AI systems placed into production from August 2026 onward. As regards those already on the market before then, two transitional periods are under discussion: three or six months from that 2 August date.

3.1 Multi-layered marking

The second draft of the Code acknowledges[1] (watch this carefully) that the state of the art does not make it possible to comply with all the requirements laid down in the AI Act by means of a single method or tool, and for that reason it proposes that providers should not limit themselves to a single marking technique, but should instead implement a multi-layered approach to ensure the resilience of the system.

This approach is divided into three fundamental levels:

1. Metadata integration: This consists of inserting provenance information and digital signatures directly into the file header (such as XMP or IPTC tags). Although this is the easiest technique to implement, it is also the most vulnerable, as many image editors and social media platforms automatically strip metadata when processing files.

   

2. Imperceptible watermarks (Watermarking): This technique involves embedding digital signals directly into the pixels of an image or into the frequencies of an audio file. These marks are invisible or inaudible to humans, but remain even if the file is compressed, cropped, or converted into another format. The Code suggests that these marks be integrated both during model training and during the inference (generation) phase.

3. Fingerprinting and output logging: As a final layer of security, providers are expected to maintain a database or log of the hashes of generated content. This makes it possible, if content loses its metadata and watermark, for a detection system to identify it by comparing its hash or unique “fingerprint” against the provider’s records.

The Code requires signatories (providers, deployers) to

(i) refrain from removing or altering this marking; and

(ii) impose, through acceptable use policies (or information, in the case of open-source models), the same obligation on downstream third parties.

3.2 Quality requirements and technical performance

Compliance is not based only on “doing it”, but on doing it effectively.

The Code provides that detection solutions must demonstrate low levels of false positives and false negatives.

Providers must subject their tools to independent evaluations and verified benchmarks in order to demonstrate that their solutions meet the performance standard required by the AI Office.

4 Deepfakes: Mandatory labeling

A deepfake, within the meaning of the AI Act,[2] is image, audio, or video content generated or manipulated by AI that appreciably resembles existing persons, objects, places, entities, or events, and that a reasonable person could falsely perceive as authentic or truthful.

All deepfakes (either image, video, or audio) must be labelled in a clear, distinguishable, and accessible way no later than the moment of the user’s first exposure to the content.

The Code of Practice establishes specific requirements depending on the modality.

• Main visual element: the acronym “AI” in uppercase, optionally accompanied by text such as “Generated with AI,” “Made by AI,” or “Manipulated with AI.”

• Minimum contrast ratio: 4.5:1 between the label and the background.

• Portability: to the extent technically feasible, the label must “travel” with the content when it is redistributed.

• Accessibility: alternative text for screen readers, tactile signals for audio-only content (where the device permits), compatibility with assistive technologies.

5 Specific rules

5.1 Image

For images, the icon or label must be displayed consistently from the first exposure and at each subsequent exposure. The label must be clearly distinguishable from the image itself: prominent, not hidden within layers of the image, not too close to other icons or text, and not displayed against backgrounds that reduce its visibility.

5.2 Live video (live broadcasting, livestreaming)

For live video, the icon must be displayed consistently throughout the entire exposure, where feasible. If the disclosure is also made by audio, it must be presented simultaneously with the visual icon. Alternatively, a visual or auditory notice may be used at the beginning and at regular intervals during the broadcast.

5.3 Pre-recorded video

• Long videos: icon or label at least at the beginning, repeated at regular intervals (for example, each time the deepfake content appears or after advertising breaks).

• Short videos: icon or label visible consistently throughout the duration. If the video is entirely generated or manipulated by AI, this must be indicated throughout playback.

• Credits: a notice may be included in the end credits, but this must always be accompanied by one of the preceding options. Credits alone are not sufficient.

5.4 Audio

• Audio under 30 seconds (advertisements, commercial spots): at a minimum, a brief audio notice at the beginning of the content.

• Longer audio content (podcasts, AI-generated calls, radio broadcasts): repeated audio notices at the beginning, at appropriate intermediate stages, and at the end of the content.

• Language: the notice must be given in clear and simple natural language, in the same language as the content.

• Audio with a visual interface (playback on a mobile phone screen, in a car, etc.): in addition to the audio notice, an icon or visual label must be displayed on the interface elements under the deployer’s control.

5.5 Multimodal content

For content combining several modalities (image-text-audio, image-audio, text-audio, image-text), disclosure must be made by means of an icon or label that is clearly perceptible without any additional interaction on the part of the user.

6 Excpetions

6.1 “Non-exceptions”

· The “editorial exemption” does not apply to deepfakes.

· Mandatory even where the “cloned” person has given explicit consent.

6.2 Exceptions

1. Use authorized by law for the detection, prevention, investigation, or prosecution of criminal offences. This exception has very short legs in the private sector.

2. Artistic and creative works

For deepfake content forming part of an evidently artistic, creative, satirical, fictional, or analogous work, the transparency obligation (labelling) is mitigated, but it does not disappear.

Disclosure must be made in a way that does not impair the exhibition or enjoyment of the work. The options include:

• Live or near-live video: icon in the upper or lower corners for at least five seconds at the beginning (for example, during the opening credits), without the need to repeat it during the remainder of the exposure.

• Pre-recorded video: disclosure for a sufficient duration at the beginning, without interfering with the experience.

• Image: label at the beginning of the first exposure, which may be integrated into the image or its background provided that the user can distinguish the labeling.

• Audio: audio notice at the beginning of the first exposure.

• Non-digital contexts (exhibitions, galleries, festivals): disclosure may be made at the point of entry or upon ticket sale.

Jorge García Herrero

Lawyer and Data Protection Officer

[1] Strong words in the Code: “So long as no single marking approach is sufficient, under the state of the art, to comply with the four requirements in Article 50(2) AI Act of effectiveness, interoperability, robustness and reliability, Signatories will implement a multi-layered marking approach to ensure that the outputs of their generative AI systems are marked with at least two layers of machine-readable active marking, as specified in the sub-measures below” (p. 10).

[2] Article 3(60) of the AI Act

• Competition vs GDPR: promise of guidelines with the Commission;

• DMA vs GDPR: there are guidelines here, but it seems the speakers highlighted that it should be made clearer that the DMA does not take precedence over the GDPR; and

• DSA vs GDPR: there are also guidelines here, but the discussion turned to the big topic of age verification and that both must be applied: “The panel concluded with a clear message: online safety under the DSA and the lawful processing of personal data are two sides of the same coin, both calling for the DSA and the GDPR to be read coherently. “

And today, the simplification of the Digital Omnibus in the AI section should be voted in plenary. And then on to the usual trilogues.

Tomorrow we will participate via Webex in the EDPB public hearing for its EDPB Guidelines on the processing of personal data to target or deliver political advertisements.

You are reading ZERO PARTY DATA. The newsletter on current affairs and technology law by Jorge García Herrero and Darío López Rincón.

In the free time this newsletter leaves us, we solve complicated messes related to personal data protection and artificial intelligence regulations. If you have one of those, wave your little hand at us like this. Or contact us by email at jgh(at)jorgegarciaherrero.com

Suscríbete ahora

🗞️News from the Data World 🌍

.- In an upcoming newsletter we will analyze the transparency obligations imposed by the AI Act on synthetic image, video and audio content (not necessarily deepfakes). One striking novelty is the combination of marking—so machines can identify it—and labeling—for humans. These marks must make the work easier for fact-checkers, journalists, and academics.

What this bald guy didn’t see coming were fake fact-checking systems to question the truthfulness of real images like those that have appeared amid the flood of AI slop related to the USA-Israel-Iran war.

In an unprecedented plot twist, these “fake verification outlets” erode trust in real evidence, and fabricated analyses destroy trust in verification itself.

.- How many times has Elon Musk said he was going to pay someone something and then didn’t do it? For the richest man in the world, quite a lot. Better not draw conclusions.

.- Latest months of OpenAI: (i) it announced advertising within the chat; (ii) then a version of ChatGPT for adults. (iii) this very week it offers bonds with more than 17% “guaranteed” interest. (iv) Just yesterday it announced the disappearance of Sora, its much-hyped synthetic video platform/social network.

I’m not an economist, but for some reason this beautiful video comes to mind.

📄High density docs for data junkies☕️

.- Reading the AEPD and CNMC post on Article 28 of the DSA (the one that supports age verification as a legal obligation), two things can be recalled:

• That with the €950,000 fine to Yoti by the AEPD (€500K just for the Article 9 issue), the double approach the Commission included in its guidelines on the matter has aged poorly: “Age estimation methods can complement age verification technologies and can be used in addition to the former, or as temporary alternative in particular in cases where verification measures that respect the criteria of effectiveness of age assurance solutions.”

• That the Commission itself mentioned a Child Rights Impact Assessment (CRIA). Which one exactly? The one UNICEF allows you to download from its website. Yes, to the LIA, TIA or FRIA this “CRIA” is added.

.- A good summary post by Vadym Honcharenko with the latest contributions to the debate on how that fluid and volatile—but ultimately critical—concept of personal data stands. The post compiles readings following the initial debate of September 25, with analyses by Peter Craddock, Sophie Stalla-Bourdillon on lessons from the SRB case, and Phil Lee on the risks of building data protection on shifting sands. Our humble contribution here.

.- Do you remember that the GDPR does not prohibit applying data to different processing, but rather processing incompatible with those originally legitimized? The ICO updates its guidance detailing when and how controllers can reuse personal information for a purpose different from the original under the UK GDPR as reformed by the DUAA 2025. A clearer compatibility test is introduced and reuses that the UK GDPR now considers automatically compatible are listed (in a new Annex 2).

It’s true, on this topic the UK has diverged too much from the GDPR. For a concrete and close analysis of the compatibility of secondary purposes under the GDPR, the best place to start is the Digi case of the CJEU that we covered years ago.

.- Via Carlo Piltz: The Bavarian authority requires a separate and private communication channel between data subjects and the DPO from the organization’s common support channel. Watch out

💀Death by Meme🤣

🤖NoRobots.txt or The AI Stuff

.- Document from a UK House of Lords committee (our senate, but with pedigree) on generative AI: “AI, copyright and the creative industries”. It’s from February, but no less interesting for that.

It focuses on putting forward considerations and recommendations to the Government on how to approach it without wiping out intellectual property and the “creative industries.”

-Better to leave out exceptions for Text and Data Mining (TDM), i.e., for the use of sources protected by intellectual property, under the mere opt-out guarantee they would have set up to notify the data-hungry AI that it cannot use it. What has been seen in the EU does not provide much reassurance regarding guarantees.

175. A broad TDM exception with an opt-out rights-reservation mechanism, as envisaged under “option 3” of the Government’s consultation, is not a viable foundation for the UK’s AI and copyright regime. The tools currently available for rights reservation are fragmented, poorly understood and place an unreasonable burden on individual creators.

176. Experience in the EU suggests that comparable provisions have neither delivered reliable control for rightsholders nor a robust licensing market. We welcome the Secretary of State’s acknowledgement that there is currently no workable opt-out proposal on the table and consider that the Government should now draw a clear line under this approach. The UK’s starting point should remain a licensing-first model in which permission is required to use copyright-protected works for AI training.

And that if companies are asking for a TDM exception, it’s because they know what they’re doing is not legal.

36. (…..). However, the consistent call from technology sector stakeholders for a new, broad commercial text and data mining (TDM) exception expressly to enable more AI model training to take place in the UK suggests that they do not regard large-scale commercial training on copyrightprotected works as clearly covered by the existing exceptions. If they did, a commercial TDM exception would be unnecessary.

-Not to modify intellectual property law to fit AI, and that this “learning” is “reproduction”: they call it learning, it is reproduction by pure intellectual property standards:

38. (….)We do not accept the view that the copying and processing of protected works during training should be characterised as ‘learning’.

39. We therefore consider that the Government should rule out any reform of the Copyright, Designs and Patents Act that would remove the incentive to license copyrighted works for AI training, and should instead focus on strengthening licensing, transparency and enforcement within the existing framework.

“We do not accept the view that the copying and processing of protected works during training should be characterised as ‘learning’.”

-The gap in protection of style, aka not asking AI to generate something as if it had been made by the author. Although the line is thin so they couldn’t be easily sued.

83. The absence in UK law of a robust personality right or specific protection for digital likeness means that creators and performers lack an adequate basis to challenge harmful outputs that imitate their distinctive style, voice or persona without reproducing a specific underlying work.

84. The Government should introduce protections against unauthorised digital replicas and ‘in the style of’ uses. Any new framework should give creators and performers clear, enforceable control over the commercial exploitation of their identity, while appropriately safeguarding freedom of expression and other legitimate uses.

-A nice infographic of the generative AI flow:

.- The regulatory framework on AI released by the White House might not seem to contain anything unusual (beyond the fact that it says “Trump” and that the protection of minors almost suggests it’s Melania’s idea). The problem is that Trump doesn’t do anything without intent. Most of the document contains sensible proposals for Congress: age verification and platform oversight, ensuring citizens don’t bear the increased electricity consumption of mega AI industry, anticipating research and appropriate measures for identity theft and fraud, not legislating anything that removes judicial authority to decide on IP infringement; but at the end it drops the bomb. The subtle way of waging war against Anthropic and anyone who refuses strict AI control:“act contrary to the United States’ national strategy to achieve global AI dominance.”

📃The paper of the week

.- This paper by Cristiana Santos, Sanju Ahuja, Johanna Gunawan, Nataliia Bielova proposes an analytical framework to assess dark patterns under the Digital Services Act, identifying obstacles to specific user rights: making complaints harder (Article 20), obscuring advertising transparency (Article 26), manipulating notice-and-action mechanisms (Article 16), distorting user choice regarding recommender systems (Articles 27 and 38), and interfering with minors’ rights (Article 28).

.- It’s not exactly a paper, but it stays here to avoid overloading the AI section. The Korean data protection authority released an interesting checklist in 2021: Artificial Intelligence (AI) Personal Information Protection Self-Checklist. Although time has passed, it’s still worth a look. Seen via San Luis Montezuma.

1. The checklist itself for core AI cases;

2. Very clear data processing flows:

🙄 Da- Tadum Bass!

Atompunk is the genre or aesthetic style that tries to reflect a post-nuclear Cold War dystopia.

The key point is that it would be preferable for it to remain fiction to liven up works like Fallout, Stalker or Metro.

If you think this newsletter might appeal to and even be useful to someone, forward it to them.

Compartir

If you miss any doc, comment, or dumb thing that clearly should have been in this week’s Zero Party Data, write to us or leave a comment and we’ll consider it for the next one.

We are not going to get into today the changes to the entry-into-force date for new systems / in uso systems resulting from the various omnibus packages (omnibus is already a plural noun in latin) on the table.

At the beginning of March, the second version of the Code of Good Practice on Marking and Labeling AI-Generated Content from the European Commission was published, which is the one we take into account in this post.

This code also refers to image, video, audio and deepfakes, but today we are starting by talking about text: a topic that barely matters given that almost nobody uses AI today to help them write.

You’re reading ZERO PARTY DATA. The newsletter on current affairs, technopolies, and law by Jorge García Herrero and Darío López Rincón.

In the spare moments this newsletter leaves us, we specialize in solving complicated stuff in personal data protection. If you have one of those, give us a little wave. Or contact us by email at jgh(at)jorgegarciaherrero.com

Thanks for reading Zero Party Data! Sign up!

Suscríbete ahora

1. But I am not OpenAI or one of the magnificent seven... Does this apply to me?

This post will be useful then, not for you, since you are not caught by it, but for anyone who, in the exercise of their functions, uses generative artificial intelligence tools to produce, rewrite or edit texts intended:

(i) To be published in the name of their organization.

(ii) On matters of “public interest”.

This includes, among other examples, the drafting of press releases, market reports, regulatory analyses, content for the corporate blog, social media posts for informational purposes, and any other text intended to inform the public about matters of public interest.

The concept of “public interest” is not defined in the AI Regulation or AI Act.

The interpretative guidelines of the European Commission are expected for the second quarter of 2026 and may not arrive until just a few weeks before the deadline.

A prudent criterion would be: if the text aims to inform and is directed at the general public or a relevant segment of it, it is presumed to fall within the scope of application.

If generative AI is used to produce text that is going to be published externally for informational purposes, that text must be labeled as AI-generated, unless the conditions of the editorial exception are met.

2 What needs to be done? Label the text

When publishing text generated or manipulated with AI on matters of “public interest”, its synthetic origin must be disclosed clearly and distinctly, so that the reader recognizes it as such when accessing the content for the first time.

The Code of Practice establishes specific requirements for this disclosure:

2.1 Labeling format

• Icon or visual label: the main element will be the acronym “AI” in uppercase, optionally accompanied by a short text such as “Generated with AI”, “Made by AI” or “Manipulated with AI”.

• Contrast ratio: minimum 4.5:1 between the label and the background on which it is displayed.

• Location: in a fixed position, for example above or at the beginning of the text, next to the headline, or in the opening colophon. The key point is that it is perceptible before the reader begins reading.

• Partially generated texts: if only a part of the text has been generated or manipulated by AI, it is enough to label that specific part.

• Very short texts: for short texts where a label would degrade readability, a contextual notice in the interface may be used instead (for example, an indicator next to the output or a note at page or session level).

2.2 Accessibility

The label must be accessible for people with disabilities: compatible with screen readers, with sufficient contrast for people with color vision deficiencies, and detectable by assistive technologies.

At minimum, the criteria of the WCAG 2.1 level AA standard must be applied.

3 Can this labeling be avoided?: The “editorial exception”

Article 50(4) of the AI Act establishes that the labeling obligation does not apply when AI-generated content:

i. Has been subjected to a human review process or editorial control, and

ii. A natural or legal person assumes editorial responsibility for the publication.

Consequently, relying on this exception requires meeting specific and documented requirements:

• Identified editorial responsible party: The name, position and contact details of the person (natural or legal) who assumes editorial responsibility must be published. These details must be publicly accessible.

• Documented review process: the organization must document the organizational measures and human resources assigned to ensure that effective human review is carried out before publication.

• Formalized workflow: it is not enough to “document” that someone “must read the text and take responsibility for it before publishing”.

A documented procedure is needed, with identified responsible parties and traceability of the process.

A documented procedure is needed, with identified responsible parties and traceability of the process. If this process is not followed, the text must be labeled.

4 Consequences of non-compliance

The AI Regulation or AI Act provides for significant penalties for non-compliance with transparency obligations.

Art 99 AI Regulation: up to €15 million or 3% of the total worldwide annual turnover of the financial year preceding the infringement, whichever amount is higher.

Although the Code of Good Practice is not binding on the authorities (it does not presume compliance with the rule), those who do not subscribe to it must prove by other means that they comply with the same obligations of Article 50 AI Regulation.

In practice, the Code will function as the reference standard for inspections by the competent authorities.

Jorge García Herrero

Lawyer and Data Protection Officer.

Apparently:

.- The order was to hit a thousand (a thousand!) targets in the first twenty-four hours of the attack,

.- The building housing the school had been part of a military infrastructure ten years ago but not at present. Nobody checked. Or so I want to believe.

With or without AI involved, someone might think that reviewing a thousand (a thousand!) military targets should have been done more rigorously. Or with rigor.

If there was AI involved, I am immensely curious to know the exact number of human supervisors, the number of targets reviewed by each one, the exact incentives they were given, and the KPIs to document and review their performance in order to “improve” (I do not know whether this concept fits here) next time.

Lukasz Olejnik explains it better than I do in his newsletter from last Monday. For my part, I would point out two things:

1.- Let us remember that the use of AIs by the military and by the “law enforcement and security forces” is not regulated in the EU (nor will it be) either by the Artificial Intelligence Regulation or by the Personal Data Protection Regulation.

2.- Let us not get carried away by the recent hype around the confrontation between Anthropic and the U.S. Government over the possible use of AI for military purposes: Gaza has been the laboratory for this specialty for two eternal years (if it has stopped being so today: it does not seem like it). There are the “Lavender,” “Where’s daddy” and “The Gospel” tools whose use was described in detail by the Israeli press at a still early stage of the Palestinian massacre.

You are reading ZERO PARTY DATA. The newsletter on current affairs and technology law by Jorge García Herrero and Darío López Rincón.

In the free time this newsletter leaves us, we solve complicated messes related to personal data protection and artificial intelligence regulations. If you have one of those, wave your little hand at us like this. Or contact us by email at jgh(at)jorgegarciaherrero.com

Suscríbete ahora

🗞️News from the Data World 🌍

.- A CEO used ChatGPT to void a 250 million contract and lost even the shirt off his back. The story had already been told, now we have the juicy judgment: A CEO ignored his lawyers, consulted ChatGPT, and got a thoroughly deserved beating in court. Changhan Kim, CEO of Krafton, publisher of the video game Subnautica 2, undertook to pay 250 million dollars in bonuses if the game sold well. When it sold well, his legal team warned him of the risks, and Kim asked ChatGPT for a strategy to avoid payment. The chatbot designed “Project X”: a plan to seize control of the marketing company by brute force. Kim executed the plan, fired the founder of the development studio, and a Delaware judge ordered his immediate reinstatement. The funniest thing: the court records literally transcribe ChatGPT’s prompts and responses as documentary evidence, creating a precedent in which conversations with a chatbot become evidence of corporate bad faith (or negligence, I would say) that can be used against them in legal proceedings.

.- Australia: teenagers are still on social media despite the ban. Three months after the pioneering ban on social media for under-16s in Australia, new data from Qustodio suggests that use has fallen modestly. TikTok, YouTube, and Snapchat recorded declines among users aged 10 to 15, but most teenagers who used the platforms before the ban remain active on them. The most revealing aspect is the success of alternative social apps not included in the ban that are shooting up in popularity among Australian minors, showing that restrictions based on specific platforms create a balloon effect that shifts the problem without solving it.

And those of creative thinking by minors. The legislator forgets that scarcity and withdrawal sharpen ingenuity.

“I got a photo of my mother, put it in front of the camera, and it let me through. It said: ‘thanks for verifying your age,’” says Isobel. “I heard that someone used Beyoncé’s face,” she adds.

Isobel points to her mother, Mel, and says: “I texted her and said: ‘Hey, mummy, I already got past the social media ban,’ and she simply replied: ‘How naughty!’”

.- War in the age of the online “information bomb.” Kyle Chayka has returned to The New Yorker from paternity leave and we could not be happier: Memes like “monitoring the situation” reflect the illusory belief that we can be anything more than passive and confused spectators of the digital shrapnel. The article brings back the French philosopher Paul Virilio and his 1998 book “The Information Bomb,” in which he anticipated a “visual crash” caused by a tsunami of details that leads to the defeat of facts and plunges our relationship with reality into a thick fog. Virilio wrote this in the pre-social-media era, and his concept of a breakdown in informational trust is more accurate today than it was then: the fragments of reality circulating today through the digital ocean are real footage of real events, but their cumulative effect generates exactly the opposite of a coherent portrait of reality.

Note that neither the original piece nor this commentary talks about “deepfakes.” That is not the issue.

.- In another spectacular case of the “Streisand effect,” A judge ordered YouTube to remove the deposition videos of DOGE members on Friday, but by Saturday they were already available everywhere as torrents and on the Internet Archive. The videos showed DOGE members unable to define “DEI,” admitting that they used ChatGPT with terms like “black” and “homosexual” to flag grants for elimination but not “white” or “caucasian,” and acknowledging that their cuts failed to reduce the government deficit, which was their goal.

.- Amazon wins its appeal against the 746 million GDPR fine from Luxembourg’s authority. Amazon won on appeal against the 746 million euro fine imposed in 2021 by Luxembourg’s data protection authority for GDPR infringements related to personalized advertising. The administrative court almost entirely upheld the CNPD’s analysis, including that the legal basis of legitimate interest invoked by Amazon was not appropriate and that the transparency procedures were insufficient. However, it annulled the fine based on later CJEU case law requiring an analysis of whether Amazon acted intentionally or negligently (the CJEU rather leaves the authority exposed by suggesting that, in view of the infringement, the Authority rushed to quantify the sanction without giving the matter much more thought). In addition, by the time of the sanction Amazon had already remedied its infringements. Content from Matthew Newman and Norman Aasma via San Luis Montezuma.

That wonderful remediation point is what the CNPD itself puts on the table in its brief note on the matter. Amazon gets off the sanction, but the procedure has meant that it complies and changes the outrageous practice that gave rise to the sanction: moving from legitimate interest to consent for behavioural advertising. Honour salvaged or a draw? Let each person decide.

📄High density docs for data junkies☕️

.-The Garante has slapped a fine of 17,628,000 euros on Intesa Sanpaolo for unlawfully processing the data of 2.4 million customers transferred to Isybank, its 100% digital subsidiary. The bank profiled its clientele by selecting customers under 65, regular users of digital channels, without investment products, and with financial availability below a certain threshold. The Garante considered this processing unlawful because the customer could not reasonably foresee it from the context and the information received. The legal basis of legitimate interest invoked by the bank did not hold up given the sensitive nature of the banking data processed.

Now compare that decision with this other one, which was already controversial a couple of years ago, from the Belgian Authority.

.- Sovereignty Washing: Michael Staudacher’s instruction manual. European digital sovereignty versus the “sovereignty washing” sold by U.S. hyperscalers. Digital sovereignty is the condition in which no foreign actor has a legally permitted path to access your data.

The CLOUD Act does not hack servers; it sends a court order that turns into lawful delivery under U.S. law what would be a crime under European law. Hyperscalers do not break in by force, they comply legally. Europe has excellent data protection legislation but not digital sovereignty, and confusing the two concepts is literally how sovereignty washing works. Each CLOUD Act request is American digital sovereignty projected toward the EU, China systematically builds its own with its own chips, cloud, and legal framework, while Europe confuses having servers in Frankfurt—labelled with logos in German and contracts in English—with real sovereignty, when in truth the parent company is still in Seattle. .-

🤖NoRobots.txt or The AI Stuff

.- The Dutch DPA publishes a periodic report on the state of AI in the country. Risks, biases, or effective control. In the February report of this year, which we would say they published in March, it shows concern about use in recruitment, bias, and black-box issues. HR’s refusal to explain how those wonderful evaluation and profiling systems really work. And that lack of explanation, as the Advocate General recalled in his opinion on Dun & Bradstreet Austria, means that you do not have a true right to an explanation of how they function.

For instance, the AP observes that game-based assessments are increasingly used as an initial screening tool for candidates. This raises issues related to the right to an explanation of how an assessment or judgment is formed, as well as the contestability of that judgment.

Another example concerns comparative online assessments in which employers are presented with information that differs from—and is often more detailed than—the information shown to candidates. This information asymmetry is problematic and at odds with the right to an explanation. Without insight into the assessment results received by the employer, it is difficult, if not impossible, for a candidate to meaningfully challenge the outcome. The AP therefore emphasises that such systems must comply with both the GDPR and the AI Act.

.- With a name that is very hard to improve on (BullshitBench), Peter Gostev treats all humanity to a comparison of the response effectiveness of the major models. Claude is almost always first, but the surprise is that Qwen (Alibaba) ranks second in legal.

📃The paper of the week

.- From Stanford and Oxford researchers, we find a paper that analyses one of the great problems of LLMs (ELEPHANT: Measuring and understanding social sycophancy in LLMs): it always tries not to tell you that you are wrong, even when that affects the truthfulness of the result.

That middle column reminded us, for whatever reason, of this other thing:

📎Useful tools

.- In another spectacular example of vibe coding in which Oscar Marchal, the “creator,” cannot program, but he does know very well what he needs: this anonymisation tool for legal documents using Claude as a development copilot. The tool removes personal data from Word, RTF, digital PDF, and scanned PDF files directly in the browser, without any data leaving the user’s computer. The creation process lasted less than an hour: the lawyer described the problem as if speaking with a colleague and Claude built the code. The author warns that the tool does not replace human review and does not recommend its use with scanned documents without OCR.

🙄 Da- Tadum Bass!

More than nonsense, it is a curious situation. You have a dog-child, but the GDPR applies to the personal data of humans. And the veterinarian threaded the needle nicely in the right of access request they were presented with.

Less funny when we get to something similar to the Rick and Morty episode this screenshot belongs to. Then we will be the dog-children.

If you think this newsletter might appeal to and even be useful to someone, forward it to them.

Compartir

If you miss any doc, comment, or dumb thing that clearly should have been in this week’s Zero Party Data, write to us or leave a comment and we’ll consider it for the next one.

Deja un comentario

What kind of clauses are we talking about?

All those that resemble the following:

“The provider represents, warrants, and undertakes that: (a) neither the provider nor any of its affiliates that have access to covered data – “Data Covered” (nor any employee or contractor of the provider or its affiliates that has access to covered data) is a covered person – “Person Covered”; (b) the Provider and its affiliates will not participate in any Covered Data Transaction; and (c) the Provider will immediately notify the Company in writing if any of the representations in this section change or cease to be true.”

U.S. regulations are outside our expertise, but the need to explain why you might encounter certain things in the middle of a DPA, access to the FAQs from the Department of Justice (referencing the linked “rule”), and a bit of help from AI (especially to confirm and create the tables we show) allow us to tell this story.

It is a journey through cross-referenced concepts, but much easier to understand than the Data Act and the AI Act.

You are reading ZERO PARTY DATA. The newsletter on current affairs and technology law by Jorge García Herrero and Darío López Rincón.

In the free time this newsletter leaves us, we solve complicated messes related to personal data protection and artificial intelligence regulations. If you have one of those, wave your little hand at us like this. Or contact us by email at jgh(at)jorgegarciaherrero.com

Suscríbete ahora

What is this rule and which countries does it blacklist?

This rule attempts to limit or prohibit access to two types of data—bulk sensitive personal data of Americans and U.S. government-related data—by the following restricted countries (“Country of Concern”).

Zero surprises on the blacklist of countries.

• China (including Hong Kong and Macau);

• Cuba;

• Iran;

• North Korea;

• Russia; and

• Venezuela.

What information, persons, and situations does it apply to? The central elements of “covered data” and “covered person.”

– “Covered Data” (Datos Cubiertos) means two main categories:

• Bulk U.S. sensitive personal data, regardless of whether the data are anonymized, pseudonymized, de-identified, or encrypted, as long as they reach their respective threshold:

• Human omic data (epigenomic, proteomic, genetic, or transcriptomic): more than 1,000 U.S. persons (or more than 100 for genomic data);

• Biometric identifiers: more than 1,000 U.S. persons;

• Precise geolocation data: more than 1,000 U.S. persons;

• Health data: more than 10,000 U.S. persons;

• Personal financial data: more than 10,000 U.S. persons; and

• Covered personal identifiers: more than 100,000 U.S. persons (government identification numbers such as passport numbers, device identifiers, demographic/contact data, IP, cookie data, or call detail records).

• U.S. government-related data:

• Precise geolocation data at government locations; and

• Sensitive data of government personnel.

– “Covered Person” (Persona Cubierta) includes the following categories of individuals or companies:

• Foreign entities from the mentioned countries;

• Entities 50% or more owned by Covered Countries/Persons;

• Individuals resident in Countries of Concern;

• Employees/providers or contractors from Covered Countries/Persons; and

• Any listing determined by the Attorney General.

– If the following occur simultaneously: (i) the previous elements of a provider or employee from a restricted country (“Covered Person”), (ii) contracted by a U.S. entity (US Person), and (iii) with access to the covered data (“Covered Data”), then the scenario falls within the scope of compliance with this rule: a Covered Data Transaction.

This is subdivided into two cases: the main case of a prohibited transaction (Prohibited Transaction), and a secondary case of a restricted transaction if the U.S. entity complies with certain defined security requirements.

Most important for us: In which cases would a European company be affected?

Two main scenarios can be distinguished, based on the concurrence explained above.

A. – The U.S. subsidiary of a European parent company (“US Person”):

• U.S. Subsidiary: it must exercise special control to avoid knowingly participating in any of these “transactions.” A group corporate exception may exist if the transaction is ordinarily incidental and part of administrative or auxiliary business operations—for example HR, payroll, or risk management.

If the transfer takes place for core business operations (such as research and development), the exemption does not apply. If the subsidiary falls under the obligation scenario, the following elements have applied since October 2025: a specific compliance program with defined security measures and an annual audit.

• European parent company: the same classification as in the following scenario of a company without headquarters or personnel in the United States.

B. – An EU company providing services to a U.S. client without presence or headquarters there (“Foreign Person”).

In that case, four scenarios may occur depending on whether the entity is considered a covered person (CP), from a restricted country, or neither of the above (any).

Recommendations

In most cases, the application of this rule will be limited to the scenario described at the beginning and in the last case of the previous table (“foreign person” scenario): a company without processing of covered data nor covered persons—either directly or through providers—that commits not to process them and to notify if anything changes.

However, specific checks should be carried out regarding providers and potential subsidiaries in the United States:

• Review whether any processors or sub-processors you rely on could fall within the scope: either because they are from these covered/prohibited countries or because, within the framework of the service, they end up providing access to this type of U.S. data. It is highly advisable to start including specific questions about this topic in the pre-Article 28(1) GDPR questionnaire; and

• Verify, together with possible specialized advice from the United States, that the company’s U.S. subsidiary is sufficiently prepared to comply with this rule. There are always nuances that escape those of us from the old continent.

Grand Finale: Why should I care about all this?

First.— Because there are many multinational groups (for example Chinese ones) that provide services through a subsidiary established in a country not included in the blacklist of this amusing U.S. rule. It is the same move that Meta, Google, or Microsoft make by placing their shiny European subsidiary in all their DPAs, generating that reassuring cognitive dissonance in the head of the not-very-reflective DPO.

Last but not least.— As a closing note, and in addition to everything above, always remember the illustrative example from those EDPB guidelines about the interplay of Article 3 and Chapter V: if a company based in the EU acts as a processor for a non-European company, imports personal data, and returns them as part of a product or service, there is an international transfer in that return flow of the data to the non-EU controller.

Everyone sees it positively.

The goal of protecting minors is indisputable and that catalyzes public opinion in favor of the measure.

You may be, like us, a soul concerned about second-order effects, even more so when those effects can shatter the right to privacy — the basis, as we know, of all other rights.

And as you already know, anyone is capable of saying “it’s for the children” in a second and it looks fucking great, while it takes you five good and hesitant minutes to explain those risks that even to you seem remote while you try hard to simplify them.

Further down we cover a devastating example of how the surveillance video camera system installed by a Government (the Iranian one) was key in its own destruction, once hacked by a hostile third party.

But we were thinking of a clean, interactive, clear tool, with little examples, links, and a certain tongue-in-cheek house style.

Well then, fear not: here is what you were looking for.

We put together this interactive artifact halfway with Claude.

Substack does not allow us to embed iframes so that you can poke around with it directly here, so we are inserting only a demo video and the link so that you can review it, criticize it, and share it as you please.

You are reading ZERO PARTY DATA. The newsletter on current affairs and technology law by Jorge García Herrero and Darío López Rincón.

In the free time this newsletter leaves us, we solve complicated messes related to personal data protection and artificial intelligence regulations. If you have one of those, wave your little hand at us like this. Or contact us by email at jgh(at)jorgegarciaherrero.com

Suscríbete ahora

🗞️News from the Data World 🌍

.- My top marks for this thing from Nicholas Thompson: Israel reportedly hacked Iran’s traffic cameras and had total vision into the movements of Ayatollah Khamenei and his guards

The central thesis here is that surveillance infrastructure has an inherent symmetrical vulnerability: whoever watches can end up being watched through their own system.

The plot twist is devastating: cameras deployed for internal control would have been reused by an adversary to monitor the very movements of Iranian power. The moral is not only one of state cybersecurity, but of political architecture: every massive network of visibility generates a surface reusable against its own operator. The deepest defeat is not one of security but of doctrine: a system conceived to control the population ended up assisting in the elimination of the sovereign who ordered it.

That is the tweet.

And this is so, regardless of the color of the beloved leader.

.- Another one from Nicholas from yesterday: Claude has become the fucking smart-ass student you do not want to have to grade.

.- Researchers trick a bot that prescribes meds. This case shows that clinical AI systems continue failing at the least acceptable point: operational safety. Mindgard managed to alter the behavior of Doctronic’s bot — used in a sandbox, thank God — inducing false recommendations about vaccines, methamphetamine, and OxyContin doses. Conversational “guardrails” do not guarantee robust clinical control: the attack did not need exotic techniques.

.- This text by Sam Bent puts in check the maximalist privacy marketing of Proton. Its thesis is that Proton’s “zero access” refers only to data at rest, not to all moments of the flow; moreover, payments, metadata, and other points still leave exposure surface. Following the Atlanta activist case, the matter is presented as a pattern, rather than as an anomaly. What caught my attention the most is his final note: Proton’s real product may not be technical invulnerability, but a carefully administered semantics about where exactly its promise ends.

Here we have used the Proton suite since almost day one and I have to admit that I do not aspire to invulnerability against requirements from judicial authorities, but rather against illegitimate third-party attackers. That said, one must always be attentive to those moments when trusted people prove not to keep their commitments, or to speak with a serpent’s tongue.

📖 Very strong data documents ☕️

.- Via Don Luis Montezuma: the Dutch authority published yesterday, just like that, some guidelines of only 11 pages on automated decisions in personnel hiring. Something nobody applies, you know. Note: the English translation is only so-so: when it says that the supervisor has to be “competent” and also “competent,” it refers, in the first case, to “competent” in the sense of having the necessary skills and in the second to competence (in the sense of capacity, power) to change the meaning of the automated proposal.

But what could I tell you about effective human oversight after this cracker…

.- Via Samuel Parra and Javier Sempere, we have two interesting AEPD decisions.

1.The 950,000 euros that have fallen on Yoti. One of the big names in age verification systems (the one behind the one used by EPIC/Fornite, and which they tried to get the FTC to greenlight for COPPA). In this type of system there was always a possible doubt about the effective applicability of Article 9, but here it is clear that there is a biometric template in what they themselves say. That is, there would be no human way to try to justify that it could not allow that purpose of unique identification under Article 9.

2.The curious NVIDIA case without a sanction: curious because a copy of saved games is requested, within the framework of a right of access. It may seem that NVIDIA only decides to manufacture graphics cards, but it has a cloud gaming service that works very well. We could talk about the inherent joint controllership between the catalog entity that you connect to its servers and NVIDIA, but that would require quite a bit more digital ink.

It escapes sanction for having complied a few days before the very statement of allegations. Even though it was several months beyond the general 30-day period from the March date on which the data subject requested it, the AEPD considers it settled because the right was ultimately satisfied.

If the right of access had expressly sought an explanation of how the anti-cheat system works, they would have tried to rely on Article 15.4 to deny it. Usual modus operandi, even though Article 15.4 does not allow denying the right entirely, and the EDPB gave a very similar example in its guidelines.

.- Interesting CNIL document on the development of AI systems in the health data environment This document explains how to articulate the system around health data, dealing with database reuse, prior formalities, and specific precautions. The CNIL insists that it is not enough to anonymize in an aspirational way: one has to determine the legal basis, repository governance, separation of purposes, and compatibility with the not inconsiderable sectoral regulatory obligations. It is relevant that the text is designed for DPOs and project managers, not only for lawyers. Authors: Aurore Gaignon, Hélène Guimiot, Charlotte Barot, Paul Valois, Félicien Vallet.

.- Comment by Peter Craddock on the French Council of State ruling that resolved the appeal against CNIL’s huge 20 million sanction on Criteo.

This matter interests me quite a lot because it has everything to do with Scania, and I have dedicated a post on lkd to it (with exchanges with Craddock and Mark Leister in comments) and the more measured post from last Tuesday.

.- This funny “in your face” kind of post by Al Zaretski cuts off at the root a very widespread error: confusing generic technical observability with the legal traceability required by the AI Regulation or AI Act. Alzaretski dismantles several myths about logging in high-risk systems and clarifies that uptime, API calls, or crash logs do not by themselves satisfy the mandate of Article 12. Provider and deployer have different obligations and retention does not cancel either minimization or GDPR storage limitation.

💀Death by Meme🤣

.- “Now that the Brent price is going down, we can be sure that the fuel price will also go down accordingly”

.- “The fuel price:”

🤖NoRobots.txt o Lo de la IA

.- A new curve is coming in the AI part of the Digital Omnibus. It seems that France, Spain, Germany, and Slovakia have played the blocking minority so that two specific prohibitions are inserted into the text: AI systems capable of generating non-consensual intimate images, videos, and similar content (NCII) and child sexual abuse material (CSAM).** Luca Bertuzzi**, keeps us all up to date (as always on what is cooking in Brussels)

.- NIST has released a report on problems in monitoring deployed AI. It is a compendium of what was done and said in two specific workshops, but it goes to the core of control problems.

Attendees stated that organizations may choose to avoid monitoring due to its cost, implying a need either for “making monitoring cheap enough to be practical, or [for] companies being willing to engage in more expensive monitoring.” Baker et al. [70] predict a future where monitoring will be more expensive for agents: “Model developers may be required to pay some cost, i.e., a monitorability tax, such as deploying slightly less performant models or suffering more expensive inference, in order to maintain the monitorability of… agents.” The increased “cost structure if a human in the loop [is] required” was pointed out by attendees

.- We have all heard that the next big thing in AI will be “world models.” What we did not see coming is that the first one to reach the commercial sphere was trained with aaaall those images captured in the streets by Pokémon Go players! It’s 2016 all over again!!

📃The paper of the week

.- Untangling AI Liability by Kenneth S. Abraham and Catherine M. Sharkey. This demystifying paper proposes a classic legal framework to regulate civil liability for damages caused by AI. It argues that many challenges of the “black box problem” can be resolved with classic principles. The real challenge is not technical, but jurisprudential: choosing between uniform or context-specific liability rules. Answering their own question, the authors defend a diverse approach, applying negligence, strict liability, or specific legislation depending on the context.

.- User Privacy and Large Language Models: An Analysis of Frontier Developers’ Privacy Policies **by Jennifer King, Kevin Klyman, Emily Capstick, Tiffany Saade, Victoria Hsieh: By default, the main AI providers train on your conversations unless you opt out: consumers and minors are less protected than enterprise clients. But the main moral is that the chat does not capture only inputs, but also reasoning, vulnerabilities, preferences, and latent identity signals. It is a “cognitive surplus extraction”: what is monetized is not scattered attention, but lines of thought sufficiently structured to be used as training infrastructure.

📎Useful tools

.- The megabot that we all mistakenly consider human, Jorge Morell, has tinkered in Claude with an AI Compliance checker, based on the toolkit that the ICO released in Excel. Judge for yourselves how useful it has become with Jorge’s improvements: tutorial with 4 pop-up windows, translated into Spanish, adjusted for the GDPR not UK and AI Regulation, and with the point that it saves the information if you have a Claude account

🙄 Da-Ta-dum bass

If you think this newsletter might appeal to and even be useful to someone, forward it to them.

Compartir

If you miss any doc, comment, or dumb thing that clearly should have been in this week’s Zero Party Data, write to us or leave a comment and we’ll consider it for the next one.

Deja un comentario

In other words, we must get used to the idea of living with uncertainty.

Nothing new in a field as contextual as the protection of personal data.

From here on, I don´t mean to give lessons on how to do so.

I can only share how I do it myself: by reading and applying the SRB / Scania doctrine in the following way:

• Starting with the outcome: for a third party’s access to your pseudonymized dataset to be effectively exempt from the GDPR, the risk of re-identification of the data subjects must be insignificant.

• That outcome must be assessed from the perspective of the “content, purpose and effects” of that third party processing.

This approach substantially clarifies and simplifies, in my opinion, the analysis of each case.

Today we will apply this approach to a real case, in which another of the key indeterminate concepts from Scania is also present: How far does the concept of singling out extend? Is singling out the same as identifying?

This post is a kind of reflection following this exchange with Peter Craddock and Mark Leiser.

You’re reading ZERO PARTY DATA. The newsletter on current affairs, technopolies, and law by Jorge García Herrero and Darío López Rincón.

In the spare moments this newsletter leaves us, we specialize in solving complicated stuff in personal data protection. If you have one of those, give us a little wave. Or contact us by email at jgh(at)jorgegarciaherrero.com

Thanks for reading Zero Party Data! Sign up!

The Criteo judgment of the French Conseil d’État

In the Criteo decision it is emphasized that “the sanctioned party admitted that the identification of certain individuals was not technically impossible”.

Moreover, the crucial paragraph in Criteo ends with an interesting final statement: that Criteo cannot “usefully” invoke that such identification “would be of no interest to it”.

Checkmate.

I interpret this final remark in two ways:

• In adtech, scale and massive correlation capacity explain why de facto mere singling-out is equated with identification.

• As its very name indicates, the more personalized is (the more it is individualized), the better “personalized advertising” sells. The industry does not care about knowing people’s civil identity, but it has every incentive to individualize them at a granular level.

And as the Conseil d’État says: no, Criteo, don´t even think of denying it.

Singling-out versus indirect identifiability

Craddock criticizes that the recognition of identifiability in Criteo was partial, that no investigation was conducted into what percentage of the dataset was identifiable or not, and that the ruling and sanction are issued as a whole.

From my point of view, if the purpose of Criteo’s processing is to personalize the advertising delivered to the data subject, and that purpose is achieved, producing the desired effect, it is evident that processing of data protected by the GDPR has taken place: Criteo does not know the “civil identity” of each data subject, and it does not bloody need to in order to fulfill its purpose.

In the IAB Europe judgment, the CJEU dispatches the issue of the controller’s capacity to single out recipients in a single paragraph: paragraph 45.

Essentially: if the TC string linked to other additional information (IP address, cookies or whatever persistent identifier it may be) makes it possible to identify the data subject, then the TC string is personal data.

In short, the CJEU declared that the TC String together with the identifiers linked by the partners included in the TCF served to fulfill the purpose of the processing: personalizing the advertising with which the data subjects are targeted.

Peter Craddock insists that it has “never been declared that singling out is equivalent to identification”. Well, the context was so clear that it did not need to be said.

Not in vain does the concept and the specific wording of Recital 30 of the GDPR originate from this industry.

It is understandable that the CJEU avoids all-encompassing declarations that affect the entire industry and all companies.

We all know companies that promote ethical formulas and mechanisms in this field.

Companies that are not, needless to say, IAB or Criteo.

Incentives

Let us retain that final remark regarding Criteo’s “interest”: the Conseil d’État has brought to the forefront an important interpretative element that is here to stay: the incentives of the organization.

Particularly important are the incentives of the controller who intends to access the pseudonymized dataset, when assessing whether or not the SRB / Scania doctrine applies.

Someone might also say that the CJEU has never explicitly referred to incentives, but the concept is inherent in the purpose of the processing: if a recipient “X” has incentives to re-identify the data subject and reasonable means to achieve it, from my point of view one must treat with great caution — in the specific case of “X” — the element of “legal prohibition” as a silver bullet for simply considering the SRB Scania doctrine applicable.

Especially if the sanctioning track record of “X” (or of the industry in which it operates) is particularly sad and discouraging from the point of view of personal data protection.

Accountability vs responsibility gaps

Ultimately, it is accountability that portrays the actors in the market.

Meta, IAB, Criteo, Google are the usual suspects repeatedly sanctioned in different countries, on different continents and in different legal disciplines.

Accountability means compliance, but above all demonstrating compliance.

And trying to turn this concept upside down, pretending that it should be the authorities who must demonstrate whether IAB or Criteo can or cannot identify all or only some of the data subjects — and not the other way around — may seem an effective trick, but a cheap one when observed up close.

This trick is always the same:

Argumentatively: (i) focusing on the part instead of the whole and/or (ii) insisting on the fragmentation of information to avoid responsibilities (“it is not data”, “it is not processing”, “the GDPR does not apply”).

However, the CJEU has repeatedly dismantled these arguments in matters of joint controllership (yes: you are jointly responsible even if you do not have direct access to the personal data), the right to be forgotten (it is not necessary that the news sought to be de-indexed identify the data subject by name and surname), and privacy by design (Russmedia was not held liable for a mere third-party publication, but for its very design of the service).

Gaps

And I can't stop remembering those gaps, when I read that datasets coming from adtech and sold by data brokers were used to identify those who visited Epstein's island already in 2024, to identify more than twelve million Germans, including especially sensitive officials, so that the famous U.S. ICE knows who has flown where, or to more effectively detain its targets.

While the data stream keeps flowing, all that remains is to argue that the CJEU has not said exactly this or that thing.

But it is the finger pointing at the sky.

Well, enough metaphors for today.

Jorge García Herrero
Lawyer and Data Protection Officer

It is the mental effort of, at best, processing information and at worst coordinating an entire project: of course you don’t do everything, but you’re the idiot who has everything in his head and takes responsibility for things turning out well.

Because someone has to do it.

By using AI to solve problems, we externalize part of that effort: the model thinks, we validate.

The problem is that, over time, the mental muscle tends to atrophy from lack of use.

“Cognitive debt”

It is the cost inherent to the atrophy of that mental muscle.

Every time we delegate a mental task to an AI —summarizing, reasoning, structuring— instead of doing it ourselves, we accumulate a debt: the capacity we don’t practice today will cost us to recover tomorrow.

More than loss, I prefer to call it erosion.

“Technical debt”

Original concept from software development (including public, tested libraries in your project to finish faster, without taking risks, without reinventing a wheel that is already spinning in a million places).

In the context of AI use, it refers to “asking for” code, complex documents, or workflows without external knowledge of the subject and its context.

When the AI feeds you hallucinations, the script stops working or gives you an error you don’t understand, the user ends up naked because they never mastered the original process.

As the use of AI keeps spreading, all these concepts gain importance and popularity:

Today we’ll spend a few words talking about cognitive load with this article in which I particularly saw myself very reflected: the feeling of being exhausted by mid-morning because I’ve gotten myself into three heavy messes at the same time: I prompted the first with a testament of almost a thousand words, I’m polishing and optimizing the second and the third, and before seeing the new output of the second I’ve already fallen into a different —and of course, better— way of framing the first: AI is wonderful for reaching places you never thought you’d reach alone, but chasing the rainbow has a very obvious cost.

There’s a ubiquitous mantra these days: “AI won’t take your job: someone who masters it will.”

Maybe.

This task-based approach has pretty short legs, but we’ll talk about that another time.

What’s certain is that micro-firms like mine are multiplying our possibilities month by month.

But it’s obvious to me that both small and large organizations need to systematize efforts so we don’t end up working twice as much as before vibecoding the same things, burning ourselves reviewing twin deep-research outputs, trying to achieve checkmate across all skills, and ingesting, summarizing, and extracting insights from the latest guidelines published by the authority of Sebastopol.

And then there’s the issue that by optimizing Claude in that way, you’re handing over all your mojo.

And that one: that is the real issue.

But that story will be told another time.

You’re reading ZERO PARTY DATA. The newsletter about current affairs and tech law by Jorge García Herrero and Darío López Rincón.

In the spare time this newsletter leaves us, we solve tricky messes related to personal data protection regulation and artificial intelligence. If you’ve got one of those, give us a little wave with your hand. Or contact us by email at jgh(at)jorgegarciaherrero.com

Suscríbete ahora

🗞️News from Data world 🌍

.- The weekend gossip kept Dario Amodei as the protagonist: he stood before the US Government and held as the final frontier of his AI Ethics the idea of subjecting mass surveillance capabilities and full autonomy for lethal purposes to safeguards. In response, Trump signed with OpenAI and placed Anthropic on a kind of blacklist for contracts with the US administration.

The latest episode of this confrontation has been the massive exodus from ChatGPT to Claude which has placed the latter in the number-one position among downloaded apps in the main markets.

.- Lukasz Olejnik explains the digital side of the “hybrid attack” on Iran (Israel hacked “BadeSaba,” a popular Iranian prayer app, to deliver to a large part of the population the kind of propaganda that in old movies used to be dropped as leaflets from airplanes.

All of this happened before the Ayatollahs cut off internet access, of course.

I was saying that Lukasz not only explains it but also puffs out his chest for having predicted it in his book “Disinformation”.

.- Dell Cameron in Wired: Data broker security breaches have cost twenty billion euros in the USA.

The social side of this news: a report from the Democrats’ Joint Economic Committee quantifies the damages caused by identity theft and holds four major breaches in the data broker ecosystem responsible.

The article revisits a previous investigation about opt-out pages from these companies that were deliberately hidden (with embedded “noindex” instructions for search engines) and links them with new political pressure: audits, requests for information to specific brokers.

The legal-technical side: the “noindex” mechanism is a pattern of violation of the duty of accountability that is very easily quantifiable: simply crawling these indexes is enough to detect (and document) the concrete intention to fail to comply with the GDPR.

.- One of the most disturbing moments this bald guy has had this week (and there haven’t been few): The documents revealed by Meta in the context of litigation in New Mexico show that the company knew its algorithm suggested four times more underage accounts to potentially dangerous adults (inclined to groom them and sextort them).

Almost one out of four of those adults (attention: one out of four (!!)) actually tried (the data comes from the documents).

Did Meta fix the algorithm as a consequence of this data? No.

It’s engagement, my friend!!

.- India continues to be one of the best third countries for international transfer. Increasingly so: “The Indian state of Maharashtra is developing an artificial intelligence tool that uses ‘accent, tone, and word choice’ to identify and deport Bangladeshi Muslims and Rohingya displaced from Myanmar.”

That report on relevant regulation commissioned by the EDPS about China, Russia, and India itself is starting to become outdated.

.- “Just the tip.” Very interesting news about the duality between the DSA and the big trial in the United States with META and TikTok in the middle. The ability for juicy responsibility documents about the entire addictive ecosystem created to come to light.

For example, that they would only authorize implementing some form of screen-time control if it didn’t reduce total user usage by more than 5%.

Here they show you the nice reasonable-screen-use policy presented by Compliance, but there they have to produce the internal document from the top leadership.

Age verification

We have so much on this topic this week that we’re dedicating a section to it.

.- We start with this comprehensive article by Waydell D. Carvalho and Michelle Donelan which gathers in one place all the problems posed by the seemingly good idea of imposing age verification on platforms.

.- Discord now tells us it is delaying the implementation of verification through facial age estimation to an undetermined date around mid-year. They put on the table that they understand people have privacy concerns, but they will try to be more transparent. It may not have helped that it was never said which legal basis for processing is used, that at the provider level amusing options appear such as “verification through fingerprint associated with the email address,” or the point they keep hinting at about profiling that already allows them to infer it.

You should never bet the farm saying profiling is less invasive than facial estimation without enough information about both, but three questions: why do you need the second if you have the first?, do we have two age-verification systems: the undeclared and undisclosed one for 90% of people, and the facial one they wanted to introduce?, and doesn’t anyone in legal review these posts from the wild CEO explaining things?

The finishing touch is that they acknowledge they weren’t convinced by Persona as a specific provider + that the information never left the device. That might not be very good news for LinkedIn or Reddit, by comparison. Although Bluesky points to doubts about Discord’s claims.

.- Last but not least: Joint open letter signed by a bunch of scientists against… can you guess it? Age verification.

The letter distinguishes verification, estimation, and age inference, and warns of technical harms of all kinds if access control is deployed at internet scale without much care.

Summary of the risks (hold on tight): easy bypass (VPNs, borrowed credentials, deepfakes); possible increase in malware/scams due to migration to alternative services; need for complex global trust infrastructures; privacy invasion through biometrics and behavioral control; biases and errors, among others.

But the main argument is irreversibility: once universal access control is installed, the slide toward reuse for censorship or other shady purposes is far more likely than its dismantling; it is a governance risk, not only a privacy one.

📄High density docs for data junkies☕️

.- This paper by Theodore Christakis explaining all the data that the most widespread AI models sneak from you.

💀Death by Meme🤣

🤖NoRobots.txt or The AI Stuff + 📃The paper of the week

.- Hard to read, but fascinating: The Dead Law Theory: The Perils of Simulated Interpretation.

.- From the same Natzir and the same interesting LinkedIn post also comes the paper by researchers from ETH Zurich, MATS, and someone from Anthropic about how LLMs may allow massive and automated deanonymization.

Besides containing the prompts used, what they achieved is a bit scary in terms of reliability:

• Hacker News, connected with LinkedIn: the agent correctly identified 226 of the 338 targets (67%) with 90% precision (95% CI: 86–93%; 5 incorrect identifications, 86 abstentions).

• On Reddit: accuracy of 25–52% with precision of 72–90%.

• On transcripts of Anthropic interviews: it identified 9 of the 33 scientists with 82% precision (with 2 errors, 22 refusals). The screenshot is precisely this case with the operational flow.

📎Useful tools

.- We declare ourselves absolute fans of Tey Bannerman. And Tey, friends, has done it again. It’s not easy at all to simplify things this complex with this level of detail. I recommend dedicating a Saturday morning to soaking deeply into this framework which will help you a lot, a lot to use AI better.

.- It’s not a direct-use tool like those usually placed in this section, but someone has created a comparison tool for small public contracts. A citizen initiative by a computer engineer to surface red flags in many low-value contracts. Link to the website to visualize metrics and data: open contracting. Link to the X thread with the author’s explanation.

🙄 Da- Tadum Bass!

There won’t be any sign, but they’ve nailed the point of making sure you know you’re being watched.

If you think this newsletter might appeal to and even be useful to someone, forward it to them.

Compartir

If you miss any doc, comment, or dumb thing that clearly should have been in this week’s Zero Party Data, write to us or leave a comment and we’ll consider it for the next one.

Deja un comentario

What the hell does that “distillation” thing mean?
I’ll explain it in a second, but first, a Sofia Petrillo-style flashback:

“San Francisco, year 2023.” A Google engineer publishes a paper with this juicy title: “We Have No Moat, And Neither Does OpenAI“.

“Moat” refers to the “competitive moat”: the advantage—usually temporary—that allows a company to keep a comfortable distance over its competitors.

His thesis: neither Google nor OpenAI had such an advantage.

The open source community would achieve with 100 dollars what big companies were spending 10 million on.

Three years later, DeepSeek proved him spectacularly right: you could obtain competitive results with a fraction of the budget. There never was a moat. Worse still: there still isn’t one.

Through model distillation, a large model (the “Teacher”) transfers its knowledge to a smaller one (“Little Pet”). Little Pet asks the Teacher millions of questions and records its answers. Then that corpus of answers is used to train Little Pet, or a clone: “Copycat Little Pet”.

Distilling, in short, is “grilling with questions” or “making a cheat sheet from” the class nerd’s notes.

It’s compressing intelligence: getting a more modest model that behaves similarly to the original large one while consuming a fraction of the resources.

So where’s the fun in all this?

I had come to talk about the glorious and ironic attached cartoon (created, to add insult to injury, with ChatGPT surely). It recreates an epic, historic original cartoon by Tom Gauld, “Our Blessed Homeland / Their Barbarous Wastes”, published in The Guardian in 2015. An instant classic that captures in a single stroke, forever, the concept of “cognitive dissonance”.

As The Register notes: “Anthropic accuses China’s AI labs of ripping off content — just like it did.”
According to Anthropic, the Chinese labs created more than 24,000 fraudulent accounts and generated 16 million prompts (!!) to extract Claude’s capabilities and improve their own models.

This is presented, naturally, as a threat to national security. Their own looting of others’ works to train Claude was an act of innovative audacity, beyond good and evil (“our blessed model training”).

Anthropic (and the others) built their business by training their models with vast amounts of other people’s content: books, articles, code, forums, web pages vacuumed up by their crawlers without the authors’ permission.

They shelter under the “fair use” doctrine and justify themselves with innovation. But when others steal from them using similar logic—extracting knowledge from an existing model to create another—the very same matter becomes “barbarous distillation” and an existential threat.

The epic original:

You’re reading ZERO PARTY DATA. The newsletter about current affairs and tech law by Jorge García Herrero and Darío López Rincón.

In the spare time this newsletter leaves us, we solve tricky messes related to personal data protection regulation and artificial intelligence. If you’ve got one of those, give us a little wave with your hand. Or contact us by email at jgh(at)jorgegarciaherrero.com

Suscríbete ahora

🗞️News from Data world 🌍

.- Just these two news items we read today, Wednesday, could justify a technophobic and pitch-black edition, but I’ll say up front that the sun has come out after two months and we all deserve something better.

The first news item.- The ink wasn’t even dry on the headline announcing that Anthropic was distancing itself from the US Government to avoid the application of its technology outside the indispensable safeguards and limitations proper to an organization where the safety of Humanity comes first. That’s the premise that explains why the Amodei brothers and their more conscientious companions left OpenAI to found Anthropic, after all.

Well then, the walkout didn’t even last a week. Because “if the competition doesn’t follow the same moral and safety premises as you do, you die uselessly,” says Dario Amodei.

Those are words coined and repeated many times by Sam Altman, says Karen Hao.

The second news item.- Canada (and soon, the rest of the world, don’t doubt it) will see the debut of a funny Israeli app whose functionality is to turn the ordinary citizen into a thrown weapon of the political party they sympathize with. The app is called Victory app and it’s developed by LogiVote. Once installed on the activist’s phone, it vacuums up their contacts, scans the installed social networks, detects messages against the promoted candidate and (watch this) generates counter-narratives in real time for the activist to share, viralizing the response and neutralizing the detected message.

If Cambridge Analytica sought to manipulate you like a little puppet, this app seeks, directly, to turn you into its henchman.

.- Dell Cameron in Wired: the DHS is looking for a centralized biometric search engine centralized that unifies face, fingerprint, iris and more searches across the whole hodgepodge amassed by Homeland Security, replacing a mosaic of isolated systems. Coordinating that mosaic is precisely the problem: the focus is on 1:N identification with adjustable thresholds, where power shifts to the genius who does the “tuning”. And if it’s tuned too loosely, the number of false positives shoots up.

The frictions are substantial: incompatible formats, the need for “bridges” or massive reconversion of biometric templates and scale risks. You can also see the eagerness to incorporate voiceprints in a context of ubiquitous voice cloning. The news isn’t so much “more biometrics”, as the idea of centralizing the matching layer: whoever controls the engine will control auditing, biases, traceability and, de facto, public policy.

.- The true story of LinkedIn’s “verification badge”: Getting verified on LinkedIn implies a broader chain of data sharing than it seems. The post dissects what’s captured (document, selfie/biometrics, device metadata) and how the flow relies on third parties, with effects on purpose, retention and reuse. The author links verification to a pattern: “friction” turned into a signal of reputation, and reputation turned into reach-and-trust gating. It also lands the slippery-function risk: a verification designed to fight fraud ends up acting as reusable identity infrastructure. TL;DR: what’s delicate isn’t only the data handed over today, but the future asymmetry: a platform can change which privileges are tied to the “verified” attribute without real re-consent, pushing users toward mandatory identity by design.

.- Trump vs Tebas.- The debate about VPNs is living a plot twist no one saw coming. In previous episodes of this soap opera, a judge in Córdoba ordered ProtonVPN and NordVPN to disable from their tool the IPs dynamically blocked by LaLiga during matches. The laughter of the Proton gentlemen has been heard all the way from Switzerland.

Our tears reach the Rhône, but that’s not news in “Spain-web” turned into LaLiga’s private estate.

Well, now the U.S. Government bursts in with a website that aims to offer a kind of online VPN service so poor Europeans can bypass the unjust restrictions on our freedom of expression.

We’re not including the link to that website here because, in case it isn’t sufficiently clear, we don’t approve of that measure. Nor the other one. Nor anyone’s this week whose surname starts with “T”.

This is (i) a totemic example of a good-ish action for all the wrong reasons and (ii) a big warning to be very careful whose claws you put your browsing and your data in, because usually the cure is worse than the disease.

.- That very Monday, to start off at full throttle, a EDPS–a gazillion DPAs joint opinion was published (with the Basque and Catalan ones, but without the AEPD ??), about the risks posed by the generative creation of non-consensual intimate images (to be polite), defamatory, or in any way harmful images of a real person. Even if the document is 80% a declarative list of the signing authorities, it’s a clear heads-up to sailors + that they’re going to start coordinating to do something. Like a good public authority document, they don’t clarify what that cooperation will consist of, but it’s understood we’ll have documents on the topic.

They do talk about the importance of controllers applying the strongest possible security measures, transparency about what the system does, acceptable uses and consequences of misuse, having mechanisms for content removal requests by affected people. What they should already have in order to comply with what must be complied with on multiple fronts.

.- Will the RAM crisis affect your privacy? YEP:

Phone and laptop manufacturers (and TVs and Raspberry Pis, etc…) compete with data centers, driving up prices and reshaping product lines. But what interests us here is the “invisible externality” in the privacy context: when memory is scarce and more expensive, we’re pushed into more intense compute “streaming” for local features, shifting data off the device. In other words, RAM can decide whether your AI/analytics lives on the phone… or on someone else’s server.

Remember what happened during lockdown? Well, another aftershock is coming.

.- Reddit gets the new multi-million sanction for violating children’s data protection. That very particular, niche social network that makes certain topics explode.

The thing is, they’ve been hit with a £14.47 million penalty for:

· Not having an effective age verification system that prevented the massive processing of personal data of children under 13 without any lawful basis. The GDPR doesn’t require a verification system, but not having one leads you to non-compliance because you’re processing children’s data without a lawful basis.

· No trace of a PIA on this topic.

The ICO says that in 2025 Reddit put in a self-declarative verification system, but they already told them it’s a formal measure that doesn’t prevent a minor from bypassing it. The classic one we’ve all bypassed at some point.

📄High density docs for data junkies☕️

.- This Q&A doc on data governance by Stefaan Verhulst and Begoña G. Otero is interesting and useful: what it is, what it isn’t, how to define the work’s perimeter and how to communicate objectives to incumbents.

Some nuggets: It perfectly differentiates governance from strategy (the former sets rules; the latter seeks value) and from management (technical operation). And it warns against technological determinism: either you work on governance early or the IT gentlemen will eat you from the feet up—design decisions can become governance de facto if they aren’t explicitly governed.

.- Bridges to Self: Silent Web-to-App Tracking on Mobile via Localhost Do you remember the Meta “Localhost” mess from last summer? This paper with a poetic name has come out by Narseo Vallina-Rodriguez, Gunes Acar, Frederik Zuiderveen Borgesius, Tim Vlummens, Aniketh Girish and Nipuna Weerasekara on the subject.

An Android permissions update has also come out to prevent Zuck from pulling the same bastard move again. You can bet he’ll do others, but not this one.

💀Death by Meme🤣

🤖NoRobots.txt or The AI Stuff

.- Ethan Mollick updates every few months his guide to choosing AI today . The author reframes the dilemma: it’s no longer enough to compare models; you have to separate model, app and “harness” that enables tools, actions and autonomy. He explains why the same model behaves differently depending on its interface and capabilities: manual selection of “thinking” variants, code execution, connectors, and deep research. He also warns about the bias of free models, optimized for conversation and not for accuracy. With specific recommendations for different needs.

A must-read every time it comes out.

.- Yet another paper announcing that it has extracted quasi-literal copies (>95%) of popular books from hegemonic AI models. Extracting books from production language models, by Ahmed Ahmed; A. Feder Cooper; Sanmi Koyejo; Percy Liang.

.- The joke tells itself:

The paper of the week

The political effects of X’s feed algorithm (Nature): A field experiment on X compares algorithmic vs chronological feed for seven weeks with U.S. users, measuring attitudes and online behavior. Switching from the chronological feed to the algorithmic one increases engagement (no surprise there) and shifts opinions toward more conservative positions in politics and perceptions about events. That said, the reverse change doesn’t show comparable effects; nor are there strong changes in affective polarization or self-reported extremism.

The proposed methodology is exposure + follow-up: the algorithm promotes conservative content and devalues traditional media, pushing users to follow activists, and those follows persist. The key is the temporal asymmetry: “turning off” the algorithm may not reverse anything if it already modified your social graph.
Authors: Germain Gauthier; Roland Hodler; Philine Widmer; Ekaterina Zhuravskaya.

Useful tools

Not useful: super useful. Especially if you still trust Gmail.

And another one: Nearby glasses.

🙄 Da- Tadum Bass!

If you think this newsletter might appeal to and even be useful to someone, forward it to them.

Compartir

If you miss any doc, comment, or dumb thing that clearly should have been in this week’s Zero Party Data, write to us or leave a comment and we’ll consider it for the next one.

Deja un comentario

I won’t be the one to contradict that point about pesky privacy defenders. But let’s talk about Meta’s little idea.

What could go wrong?

A whole bunch of things, but in this newsletter we always have a lot to tell and little space, so I’ll focus on two:

First.- I’ll start with a practical example, the kind I like. Precisely 404 reported this very week “Camgirlfinder” a facial-recognition service specialized in—get this—receiving from the gems of its users images and videos of “cam-girls” (it also identifies the guys) who had decided to prevent or make their identification difficult with masks, veils, or whatever they came up with, and, leveraging cutting-edge tech for the lowest possible uses, identifying them.

That is, you go on Onlyfans, Chaturbate, MyFreeCams, LiveJasmin, or the smut site of your choice, capture an image or video of the masked one who more or less amuses you, you send it to Camgirlfinder, and in two easy steps, it locates the person. Like that.

Notice we’re talking about people who have taken measures not to be recognized.

Okay, so Meta would be planning to put such a delicious little gadget within reach of any random genius with 400 bucks in his pocket.

Second.- Why are the US the only country in the world where, almost weekly, they have massacres of civilians at the hands of lunatics? It’s not that they have a higher percentage of crazies than we do here, no: it’s because they have easy access to repeating firearms.

Draw your own conclusions about what’s going to happen if FR technology becomes widespread around here.

Obviously, the thing will start with the pilot “we don’t offer this functionality in the EU because of all those annoying fundamental rights,” followed by its sequel “intense lobbying” and “nothing’s going to happen,” then moving on to the third season “the Irish authority says pché,” ending with the movie “Big launch: all we do, we do for you.”

It’s always made me laugh that, despite the tech explosion of recent years, the most reported thing to the AEPD year after year is video-surveillance cameras… Well… hang on, winter´s coming.

You’re reading ZERO PARTY DATA, the newsletter on current affairs and tech law by Jorge García Herrero and Darío López Rincón.

In the spare time this newsletter leaves us, we enjoy solving tricky situations related to personal data protection and AI regulation. If you’ve got one of those, give us a wave. Or contact us by email at jgh(at)jorgegarciaherrero.com.

Thanks for reading Zero Party Data! Sign up!

Suscríbete ahora

🗞️News from the Data World 🌍

.- Total déjà vu with World-no-Coin. In the same way the company came back with its orbs/palantiri, our AEPD came back with a statement. World made it easy for them by telling them they were coming back.

What they put sounds a lot more super-duper-fantastic than what we then know they actually do, like everyone else. Point b would carry more weight if they end up sneaking through that claim from the Digital Omnibus that it be an exception to 9 if it’s exclusively in the hands of the data subject (another thing is whether that was ever true in this case at any point)

They ask for a meeting for the 3rd or 4th of next month, but the AEPD is already commenting on things from what it looks like they’ve been sent, in the form of a warning (it includes the text of the communication from the orb gentlemen). The first is that trying to play at escaping Article 9 isn’t very credible here. Very iris, much iris for . The nuance that the purpose is not unique identification is fashionable with facial estimation for age verification, but here it’s sketchier to try it.

You have to give WorldnoCoin credit for the courage to keep playing dumb with data subjects.

.- Irish DPC is investigating Grok over the generation of sexualized deepfakes it allows like crazy. You could see it coming that it was going to have trouble in various places, but it’ll be interesting to see the result when they don’t have to do contortions because it’s Meta. Unless there’s a surprise linked to Article 6 legal bases or Article 35 DPIA, they leave out the reference to a possible Article 9. We’ll see. It combos with the Government pushing the Prosecutor’s Office to start looking into the issue.

-. LaLiga won’t stop until it falls off a cliff. Now it seems they’ve managed to get a commercial court in Granada to allow them to require the VPNs themselves to block x IP addresses. Right at two of the big ones: NordVPN and ProtonVPN.

We’re witnessing things that were unthinkable not that long ago, but maybe this will help certain judges become aware of how the Internet really works. The leaked wording from the possible author says nothing that a lawyer would see as improper or as a possible rights violation or harm to a third party, but it does have it because of its material consequences:

“Immediately implement in their internal systems the appropriate measures to enable the IP addresses provided by the claimants, in which the illegal transmission of protected audiovisual content has been verified, to be inaccessible from Spain”.

Proton’s response to these rumors didn’t take long. In their line that they’re going to fight, if the request reaches them.

.- Did you get a big email from Ubisoft about changes to its security policy, one created for minors and an explanatory guide on personal data? If you play anything from the company, of course. To save you looking:

That general policy, better not look at it too much. As proof, the compliance level on a 1/1 scale of what the EDPB or the AEPD recalls as a minimum for transfers:

“For transfers to other countries, we have implemented appropriate safeguards, such as the European Commission’s standard contractual clauses, to ensure an adequate level of protection essentially equivalent to that of the EEA. For more information about these safeguards, visit the European Commission website. If permitted by local data protection legislation, by using our services, you authorize Ubisoft to process your data in any of the places where we operate (including the United States).”

The one for minors, well, it’s also not very good or adapted:

The guide: this one is worth it. Not so much because you can say the content is flawless, but because of the possibilities the visual structure gives—ease of reading and the text-image combination it has. It’s always nice to find examples of the part of Article 13 compliance that we lawyers find hard to land, even if that means ignoring part of what you read.

.- Nancy Guthrie, mother of one of the most famous news presenters in the US, was kidnapped in her home. The recovery of a video clip (below) recorded by a doorbell camera (Nest) from Google’s servers has been much discussed. Specifically—and in the part that interests readers of this newsletter—because this camera only offers real-time image and only stores video in the cloud (never locally) IF AND ONLY IF you pay the corresponding subscription.

Well, Nancy Guthrie did not pay a subscription.

Okay, we know Google doesn’t usually cooperate with authorities until a proper court order lands on its desk.

Okay, this is a very media-heavy case and here it is indeed likely they moved heaven and earth. But…

Do Nest cameras record no matter what even if you don’t pay the subscription?

That’s the question that has been bouncing around in the little heads of the lucky owners of such a whimsical device.

According to The Verge’s report: (i) the cameras keep in the cloud the last captured event, (ii) they store it for short periods of time and then (iii) they delete it. (Some people call this “technical retention queues.”)

BUT: we already know from video-surveillance systems about recursively recording over the oldest content.

That is, just like what happens with the recycle bin on your favorite device, one thing is you marking it as deleted content and another very different thing is the device truly deleting it at that moment (it only marks it as content that can be overwritten without issue).

The article suggests that Google’s poor engineers, to reconstruct the shocking original video, surely had to patrol a bunch of machines scattered worldwide to recover the file fragments that would have been left spread around and unidentified (does anyone remember when we “defragmented the hard drive”?).

This in Spain would have been much easier, because for that we have our very Spanish concept of “blocking.”

Right? RIGHT? And now?

.- These two pieces of news are better understood together:

📖 High density docs for data junkies ☕️

.- The EDPB has just published the result of the coordinated enforcement action on the right to erasure. It’s an interesting read, but we’ll leave you a few notes:

• The private sector complies better than the public. Could it be because the shot the public sector takes is a blank?

• Training and real internal procedures are lacking.

• Information to the data subject fails, with anonymization being applied that isn’t actually real.

• Backups get deleted without more fear + a mess in retention periods.

• The belief that offering account closure and the right to erasure is the same thing. Meta wishes.

💀Death by Meme🤣

🤖NoRobots.txt ot AI Stuff

.- We’ve got this. Which is no small thing. Scary, huh?

It’s the comparison between the “hybrid” dance celebrations of the new Chinese year 2025-2026.

🙄 Da - Ta - Dum Bass!!!

Well, this is beautiful…

Compartir

If you miss any document, comment, or bit of nonsense that clearly should have been included in this week’s Zero Party Data, write to us or leave a comment and we’ll consider it for the next edition.

Deja un comentario

Last Thursday the European Parliament proposed including, as a prohibited purpose (Art. 5 AI Act), the use of AI to generate sexualized video, image, or audio content relating to natural persons (sexual deepfakes, basically).

Would this measure be effective?

Checkmate to the deepfake? Or another example of virtue-signaling—like banning social networks for under-whatever-age—that will come to nothing?

IMHO, the latter:

In theory, this reform would mean:

Fines of up to 35 million euros or 7% of global turnover, the most severe in the Regulation. A huge change compared to the current approach: a deepfake would only have to comply with the transparency and labeling obligations of Article 50.

Also, the ban would apply to all AI systems regardless of when they were put into production: there would be no transitional period and no possible “grandfathering”.

But, as usually happens, whoever sniffed out this proposal has good intentions, but less street smarts than Venice:

AI models running “locally”

The vast majority of sexual deepfakes are not generated through commercial APIs (which already have safeguards, except those led by “crazy uncle types who live to annoy” like Elon), but from open-source models run locally.

So:

.- From the model provider’s perspective: open-source model developers (for example, the Hugging Face community) will argue—and quite rightly—that they make a general-purpose model available, not a system designed specifically to generate sexual deepfakes.

.- From the perspective of Domestic Users/Deployers: the Art. 5 ban would not apply to the use of these models in the domestic sphere (check the definition of “deployer”).

Ah, the irony!

The funny thing is that commercial actors like xAI/Grok, who are the most visible and the ones who caused the scandal, are ferociously cancellable (or slap-worthy, if we’re feeling dramatic) under the existing legal framework (DSA).

And all that, sparing ourselves the greater or lesser disruption this reform would cause within the industry.

As we’ve been saying throughout this turbulent 2026, we have to start by applying what we already have, and then we’ll see what else we pull out of the hat.

For our part, last Tuesday we pointed out a way to “actively mitigate the urge to generate” non-consensual sexual deepfakes that can be applied tomorrow.

Zero Party Data

Deepfakes vs GDPR: Prohibited biometric processing?

Today I’m going out on a limb and claiming that non-consensual deepfakes can be sanctioned, not just for lack of a legal basis (consent) but also as a prohibited form of biometric processing…

Read more

3 months ago · Jorge García Herrero

You’re reading ZERO PARTY DATA, the newsletter on current affairs and tech law by Jorge García Herrero and Darío López Rincón.

In the spare time this newsletter leaves us, we enjoy solving tricky situations related to personal data protection and artificial intelligence regulation. If you’ve got one of those, give us a wave. Or contact us by email at jgh(at)jorgegarciaherrero.com.

Thanks for reading Zero Party Data! Sign up!

Suscríbete ahora

🗞️News from the Data World 🌍

.- Banning social networks for minors under x years old leads to things like the Discord stuff, our second example:

It had to happen with so many politicians banging on about it: Discord jumps into the ring by requiring age verification for everyone starting in March. That Discord that got hit with an €800,000 fine from the CNIL for violating 5, 13, 28, 32 and going through life without a PIA.

What do we have?: Show your face for facial estimation, or ID.

-Everyone is a minor by default: it looks like they’ve learned from their mistakes here, and it’s not a bad practice to start from the assumption that everyone has x things disabled. Also the point about making it easy to appeal and try again.

-Options: scanning your ID or your face. It’s true they’ve taken the side road of facial estimation, but we’d still have to see if they convince people they can escape being biometric data under Art. 9 (<em>because of the nuance that the purpose isn’t unique identification, but “just” measuring the wrinkle to see if you’re young-old</em>). Although the point that they say they may end up forcing you to use both if there are doubts works against them on proportionality:

Then there’s the thing the AEPD likes: first assessing whether there’s truly a need. If the minimum age on Discord is 14, does mandatory ID sit right there and you offer it as an option? Don’t you have a less invasive alternative that makes the need fall on facial? Understanding that ID/DNI processing is limited to avoid undue risks, even if they don’t say anything (<em>and without keeping a copy, because hotels are being watched for their own thing</em>).

-Lawful basis. Who knows, but consent for sure not. The super-cool FAQs say nothing, and the privacy policy even less: “Additionally, we will need your date of birth and, in some cases, we will request additional information to verify your age.” Even if they’re an obligated entity under the DSA, it doesn’t stipulate an obligation to have an age verification system. By contract, I hope they don’t try it, so it’ll be a legitimate interest that tries to use the DSA as a legitimation base (and the question mark of whether there are real rights to object here, or we play at saying it’s overriding/denied). Since they say nothing, let’s hope it’s more worked out than the PIA from the 800k sanction.

Watch out with the DSA, which can almost be a demerit for Discord. We forget it, but the mythical 28 reminds: “Compliance with the obligations laid down in this Article shall not require providers of online platforms to process additional personal data in order to assess whether the recipient of the service is a minor.”

-Retention: one of the few things they clarify, even if without meaning to express it as such. The device storage point isn’t bad either, but it’s almost the only thing they offer as relevant data protection information. Full-on Art. 13:

-DPIA and real information?: I’m very afraid the image that illustrates this post is what we’re going to get. That classic attempt by a controller to dump everything onto the processor that swallows it because it won’t be considered as such. Hands up if you think here there’s neither processor nor joint controller: just independent controllers, period.

-Last-minute: after they got piled on, Discord clarifies the issue. They make it clearer that most adults won’t need to verify anything for the use most people make of it, but they add a point of doubt: “For the majority of adult users, we will be able to confirm your age group using information we already have. We use age prediction to determine, with high confidence, when a user is an adult. This allows many adults to access age-appropriate features without completing an explicit age check.”. Could there be another undeclared alternative that makes the others unnecessary? Please, more declassification of information.

One last reflection that ties directly into the paper of the week: leaving aside BigTech abuses, which nobody questions: Has anyone stopped to think about whether we’re effectively protecting our kids, or just repainting a house—a regulatory model—that has become obsolete? I repeat: check the paper of the week.

.- Amazon Ring’s SuperBowl puppy ad left any data person with a shred of self-respect speechless. The video itself closes this edition of the newsletter as the “Da-Ta-dum-bass”, but we thought it appropriate to contextualize it with another iconic tech vignette.

.- The TikTok thing: active week as you can see, in terms of regulatory friction with BigTech: a preliminary decision by the European Commission finding that TikTok has infringed the Digital Services Act due to the addictive design of its recommendation systems. NOTE: the focus is not on content, but on engagement by design: the continuous-engagement architecture that pushes users (in large numbers, minors with no trace of a prefrontal cortex in place—endless scrolling, especially) into automatic, perennial, and devastating consumption. Via Rosalía Anna D’Agostino.

The question is whether any social network or service crawling around the internet complies. Especially all those that copied TikTok’s formula to try to compete against this new vampire. There aren’t enough necks for so many creatures of the night.

And all the videogames built around the free to play, freemium, or assorted micropayment business model. Epic, knowing the topic from its Fortnite, gets hit again for a million and change over “addictive patterns”. Let’s not forget the AEPD doc on patterns of this kind, which is very on-point about quite a few of the ones used around here.

-We’d have to see who the champion DPA is, but the CNIL flexes with its almost 490 million in fines for 2025. It’s always an interesting source of documents. Especially with that full AI section they’ve got.

.- The European Commission, not content with the above, considers that Meta abuses its dominant position by blocking third-party access (including AI) to WhatsApp. Interim measures are being considered to avoid irreparable harm. The case foreshadows a new regulatory front: interoperability as a competitive requirement for AI ecosystems, not just messaging or little-back-yards-I-MEAN markets of Apple / Android. Via Thomas Höppner.

.- Almost at the final (Helm) horn, the EDPS and the EDPB put out a joint opinion on the Digital Omnibus changes to the GDPR. Short version in the press release/post.

📖 High density docs for data junkies ☕️

.- And more Meta, buying time on its possible €225 million fine. The one where the EDPB stepped in with a binding decision to force the Irish authority to raise the fine. The time it gains lines up with the CJEU determining that this type of EDPB decision is open to appeals. In this case, Meta’s appeal is accepted, the General Court’s order is annulled, and the ball is sent back so it can rule on the merits of the GDPR breach. Press release and ruling.

.- Google Chromebooks in Danish schools: illegal but unpunished. The Danish DPA decision is the kind of thing that makes you want to, I don’t know, get a shot in the very tip of the actual [they take it away]. After years of investigation, they conclude that the use of Google Workspace in schools is “probably illegal”, but they close the case without sanctions. The text finds serious breaches (international transfers, lack of control over sub-processors, deficient DPIA) with no practical consequences. Of course, any resemblance to the situation in classrooms in any Spanish autonomous community (squatted by Google and Microsoft) is pure coincidence. As an example: Andalusia.

.- Interesting and practical post (short and to the point, how we like it here) about that ICO guidance on pseudonymization and transfers. The ICO clarifies that pseudonymized data is still personal for joint controllers and processors, but may stop being so for independent third parties without access to the key.

💀Death by Meme🤣

🤖NoRobots.txt ot AI Stuff

.- Deepfake Pornography is Resilient to Regulatory and Platform Shocks It’s possible that the conclusions of this paper by Alejandro Cuevas and Manoel Horta Ribeiro corroborate something we said earlier: These results indicate that the compound intervention did not suppress SNCEI (pornographic deepfakes) activity overall but instead coincided with its redistribution across platforms, with substantial heterogeneity in timing and magnitude. Together, our findings suggest that deplatforming and regulatory signals alone may shift where and when SNCEI is produced and shared, rather than reducing its prevalence.

.- Long and extra, but accessible post by Nazir about tools to measure brand visibility in AI and LLM outputs. It focuses on prompt tracking as a new SEO metric. These tools redefine what we used to understand as “audience”: no longer human users, but probabilistic models that mediate access to information.

Brandon Sanderson via Guido van Rossum via Simon Willison.

📄Paper of the week

.- Having parents “validate” with their consent the collection and processing of their children’s personal data is a deranged approach in itself for many reasons: (i) That “take-it-or-leave-it” consent is tailored to platforms: not to the authorizing parents and certainly not to minors. (ii) I know few parents who even half understand how big platforms process their data. I know many more who engage in mindless, cringe sharenting. (iii) Kids today have a very unique and different concern for their privacy compared to ours: we have more life experience, but they have specific knowledge. However, nobody listens to them.

Some of these ideas, at length and clearly, much better written in Rethinking youth privacy by Danielle Citron and Ari Ezra Waldman.

🔗Useful tools

.- Oliver Schmidt-Prietz has perfectly understood that the added value has stopped being in the model, and has shifted to expert translation of law into reproducible operational flows, shifting power from vendors to practitioners. We’ll be watching closely for the publication of that GDPR plugin on github.

.- Bilal Ghafoor has prepared (and sends for free by DM on lkd upon request) a curious and detailed excel template that lets you track data subject access rights requests, with tracking of execution, response, and maximum deadline.

.- We do our own AI-shenanigans too, of course: as a sample a very cheeky legal report on OpenClaw.

🙄 Da - Ta - Dum Bass!!!

Pure horror-movie cinema: the now-famous Amazon Ring ad at the Super Bowl

If you think someone might like—or even find this newsletter useful—feel free to forward it.

Compartir

If you miss any document, comment, or bit of nonsense that clearly should have been included in this week’s Zero Party Data, write to us or leave a comment and we’ll consider it for the next edition.

Deja un comentario

Have these Romans gone mad? Well, I’m saying this with the backing of decisions from enforcement authorities.

But let’s start at the beginning:

Deepfakes are image, video, or audio outputs generated by artificial intelligence that plausibly recreate real people.

At a time when deepfakes are receiving maximum media attention (anybody said Grok?) and prompting announcements of a tightening of the applicable legal regime, we examine the issue in light of the most recent case law and decisions by authorities.

Just in Spain, during February we saw the launch of a new draft law regulating the Right to honor, personal and family privacy, and one’s own image explicitly including deepfake as an unlawful intrusion.

On Thursday, not to go any further, the proposal by the European Parliament to include the generation of non-consensual sexual deepfakes as a new prohibited purpose in the Artificial Intelligence Act was announced. This measure will fix nothing, for reasons we explain here.

Do all AI-generated images violate the GDPR?

Of course not.

We have good reasons to argue that image, video, or audio outputs that include “random” natural persons generated by generative AI models do not constitute processing of personal data by default, unless:

(i) the model has been specifically trained to include identified people in the output, or

(ii) they start from content as a template and are capable of generating an output that can be plausibly confused with those people.

In the second case, we would already be entering “deepfake territory”.

Deepfake as prohibited biometric processing

My thesis is that a good deepfake, a recent one, the kind that is almost impossible to distinguish from reality, is the result of biometric processing of the prohibited kind under Article 9 of the GDPR.

Yes, you read that right. No, I haven’t gone crazy.

Qualifications:

· Of course, the deepfake must include still image, video and/or voice of natural persons.

· I am not referring to the fact that they depict the cloned person in circumstances or a disposition related to a particular sexual orientation, political ideology, health data, etc… I am talking here about “biometrics.”

· I am not arguing that personal data protection is the best route, nor the only one to tackle the problem—for example of non-consensual sexual deepfakes. What I am saying is that, IMHO, today it is one route, with an unexplored sanctioning potential.

As I imagine you’re making funny faces, let’s get to it.

You’re reading ZERO PARTY DATA. The newsletter on current affairs, technopolies, and law by Jorge García Herrero and Darío López Rincón.

In the spare moments this newsletter leaves us, we specialize in solving complicated stuff in personal data protection. If you have one of those, give us a little wave. Or contact us by email at jgh(at)jorgegarciaherrero.com

Thanks for reading Zero Party Data! Sign up!

Suscríbete ahora

1 Is a deepfake personal data?

Without any doubt: When a deepfake includes a person’s face, body, movements or voice, its generation entails the processing of their personal data to the extent that the data subject is identified or identifiable.

And that is so even if they are not identified by direct identifiers (name, surname, public office, etc.).

According to CJEU case law it is sufficient that the processing allows the data subject to be identified or identifiable or else individualizable within a specific group of people.

2 Does the generation of a deepfake entail processing of biometric data?

Warning: In this muggle-friendly format I’ll spare you the bulk of the unbearable technological and legal mumbo jumbo I’ve had to swallow, and therefore, I am giving up on being completely rigorous in favor of being understandable.

Classifying the generation of deepfakes as biometric processing prohibited by the GDPR depends on two elements:

a. The technological architecture used by the generative AI system

b. How the concept of “unique identification” in Article 9 GDPR is interpreted.

2.1 From the technical point of view:

Not so much the systems from a few years ago, but certainly modern video deepfake generation systems (Diffusion Transformers, models like Sora or Veo) systematically extract biometric features during their operation.

Whereas in traditional architectures it could be maintained that latent representations did not constitute “biometric templates” in the strict sense, modern systems use identity embeddings from facial recognition models that are functionally equivalent. Both facial recognition (ArcFace, CosFace) systems and deepfake generation systems (and deepfake detection ones) use an identical technical infrastructure: 512-dimensional embedding vectors that encode unique facial features.

Of course, in video, although the mathematical operations are identical, the functional purpose differs:

· Identification is analysis (image → identity decision), whereas

· The generation process is the inverse: synthesis (identity embedding → image).

This, however, does not call into question that both processes enable the unique identification of the person who is the subject of a deepfake.

In the realm of orthodox biometric identification, vectors are used as “templates” against which a person’s metrics are compared to establish their identity.

In synthesis (generation), the model is technically carrying out a continuous process of “identification” both during the training phase and during inference.

The generator is essentially being ordered to produce a recreation that would be uniquely identified as the target person by any recognition system.

The integration of the purpose of “matching” into the “generative” purpose is eloquent regarding the relevance in both processes of the data that enable unique identification, satisfying the criteria of Article 4(14) of the GDPR.

That is, the processing of biometric data is undeniable.

If we are talking about audio deepfakes, the matter is even clearer: it entails biometric processing capable of identifying the data subject and, in fact, the processing of customers’ voices for the purpose of biometric identification is commonplace in the banking sector to prevent fraud.

2.2 From the legal point of view, “unique identification” is interpreted—so far—differently

The concept of “unique identification” of the data subject has traditionally been understood as authentication of identity (1:1) or as identification (1:n).

The issue—which I argue—is whether it would fit within the concept of “unique identification” in Article 9 that the data subject themselves is identified (in the deepfake), not (i) by the controller—as in the case of authentication/identification—but rather (ii) by third parties who see, hear, or have access to the synthetic deepfake:

· — The deepfake output “is identified” with the data subject.
· — Third parties “identify” the data subject uniquely.

Recital 51 of the GDPR establishes that the processing of photographs should not systematically be considered processing of special categories, “as they are only covered by the definition of biometric data where they are processed through specific technical means that allow the unique identification or authentication of a natural person.”

The orthodox or teleological interpretation—dominant until now—focuses on the purpose of the processing: if the purpose is not to identify in a system (1:n), or to authenticate (1:1), biometric processing under Article 9(1) is not deemed present.

If this criterion is maintained, deepfakes—whose purpose is to create synthetic content identifiable with a person, but not to verify identities—would not trigger the prohibition in Article 9.

And all this, without getting into:

.- The prior extraction of biometric data from the data subject’s original image or video—which occurs only in some cases, in video generation—but always in the case of voice—for the generation of the deepfake.

.- As I said before, the fact that the content and circumstances of the deepfake allude to the data subject’s special category data (it doesn’t matter whether they are true or false: according to the CJEU they are still personal data).

2.3 What has the AEPD said?

Data protection authorities have hardly spoken on this issue.

In fact, the first case was the AEPD’s decision on the Almendralejo case.

In it, a penalty was imposed for processing personal data without a legal basis (infringement of Article 6 GDPR) without ruling on the biometric issue put forward here.

However, the precedent seems unrepresentative because, despite the seriousness of the facts and the social alarm and media attention of the incident, the fine was moderate in view of the prior criminal penalty and the financial situation of the parents who had to shoulder the civil consequences of the conduct of the reported minor.

2.4 CJEU case law:

According to CJEU case law:

· The enhanced protection of sensitive data requires an extensive interpretation of them (and this in guarantee of the protection of a fundamental right—the right to personal data protection—but one must bear in mind that in a sexual deepfake, others will likely concur as well).

An eloquent manifestation of this extensive interpretation was the inclusion of authentication (1:1) processing as prohibited biometric processing just like identification, after no small number of doctrinal back-and-forths and positions by national authorities.

· Even if the data published about your life or sexual orientation are false, they are still “sensitive data” (special category).

· It is enough that sensitive information “can be inferred” from some data to consider them special category data, regardless of whether that is the controller’s purpose or even whether the inference is 100% accurate.

According to the above, one could speak of unique identification of the data subject in the “deepfake output”:

· …if the technology involved is the same, and
· …if the same technology not only allows the Controller to identify the data subject (1:n) but also allows the data subject to be identified by “everybody and their dog” with access to the deepfake.

That is, if the result of the processing allows the unique identification of the data subject—understood as any third-party observer unequivocally identifying the impersonated person—the processing could be understood as prohibited biometric processing.

2.5 The Italian Garante’s “warning.”

The Italian Garante has been the first European authority to admit (indeed: to warn) expressly in December 2025 a broad interpretation of “prohibited biometric processing”, publishing a “warning” to the effect that deepfakes could constitute processing of biometric data when the result allows the identification of the impersonated person by third parties, regardless of the system not operating as a traditional identity verifier.

“CONSIDERING that voice and images can, certainly, be included among the so-called identifiers, that is, that category of information that has a direct relationship with the identified person and, therefore, such vocal or visual identifier may be classified in the category of biometric data if certain specific criteria are met*. These consist in the nature of the data, which must refer to a physical, physiological, or behavioral characteristic of a person, and in the means and purposes of the processing carried out which* must consist of technical processing for the purpose of unique identification; in this case, it is, therefore, necessary not only to verify the existence of a legal basis in accordance with Art. 6 of the GDPR, but also of one of the conditions indicated in Art. 9(2) of the GDPR*. A necessary condition also in the case that the voice may be included within the scope of special categories of data.”*

(…)

“FOR ALL THE ABOVE REASONS, THE GARANTE:

a) pursuant to Art. 58(2)(a) of the Regulation, warns all natural or legal persons who use, as controllers or processors, content generation services based on artificial intelligence from real voices or images of third parties, that such processing of personal data, if carried out in the absence of an appropriate condition of lawfulness and without correct and transparent information being previously provided to data subjects, may, plausibly, infringe the provisions of the Regulation, in particular Arts. 5(1)(a), 6 and 9 of the Regulation, with all the consequences, including sanctions, provided for by the personal data protection legislation;

b) pursuant to Art. 154-bis(3) of the Code, orders publication in the Official Gazette of the Italian Republic.”

If you read the entire doc, you will see that it is addressed not only to users but also to platforms that make deepfake generation means available to them.

3 Background in comparative law

3.1 BIPA in Illinois (USA)

Under the Illinois Biometric Information Privacy Act (“BIPA”) the concept of “biometric identifier” explicitly includes “scan of hand or face geometry,” a term that precisely describes the technical process of extracting facial embeddings.

The critical distinction is that while photographs are excluded from the definition of biometric identifiers, face geometry scans derived from photographs are not.

Meta settled a “sanctioning agreement” for $650 million for extracting face geometry from photos uploaded to Facebook by its users (which constitutes collection of biometric identifiers under BIPA) without their consent.

The Illinois Attorney General published in February 2025 an open letter on Gen-AI models (specifically Grok), expressing concern that “the AI model may be scraping biometric data, in violation of BIPA, to create its deepfake images.”

Additionally, face-swap services like SwapFaces AI already market themselves as “BIPA Compliant,” implicitly assuming the applicability of the law.

3.2 The Chinese regulation is even clearer

The Provisions on the Administration of Deep Synthesis Services (effective since January 2023) explicitly regulate the generation and editing of biometric features in deepfakes.

Article 14 establishes that deep synthesis service providers offering functions for editing facial or voice biometric information “must require users to notify the person whose personal information is being edited and obtain their separate consent.”

Article 23(4) defines deep synthesis to include “technologies for generating or editing biometric characteristics in image and video content, such as face generation, face swapping, personal attribute editing, facial manipulation, or gesture manipulation.”

Therefore, and unlike the GDPR, China’s PIPL does not condition the classification of biometric data on the purpose of unique identification—the classification is based on potential harm, not on the purpose of the processing.

3.3 Brazil

Brazil (a country newly deemed adequate to the GDPR) published a few days ago in relation to the Grok case, the ANPD Technical Note 1/2026, which establishes that

“synthetic content generated by generative AI systems, when it refers to identified or identifiable natural persons, must be considered personal data”

and that:

“when such activity involves the use of biometric data, the resulting synthetic content will assume the status of sensitive personal data.”

4 What sanctioning effect would my interpretation have?

Depending on the circumstances of the specific deepfake, two, three, four… infringements of the prohibition on processing special category data could be found.

The GDPR does not allow multiplying the number of infringements found in these cases, but it does allow sanctioning the most serious infringement at its highest level. And we all know how high GDPR fines can go.

Here, yes, the stakes are sky-high, and public and media attention is at a maximum.

It is only a matter of time before someone reports correctly and some authority delivers the surprise.

Jorge García Herrero

Lawyer and DPO

As the expression that is on its way to becoming a national motto says: Spain never ceases to amaze you. From the creators of “I activate your mobile phone’s microphone without you noticing while you use your LALIGA app,” or “I block the RAE, Wikipedia or whatever I feel like from IPs until the match ends,” comes “report your bar for 50 bucks.” Careful: 50 bucks only if you’re one of the first 1,000 Judas snitches and if you meet all the requirements of the little scheme, which are not few.

It will go down in history as one of the great examples of how to turn a legitimate aim—protecting what’s yours—into something thoroughly murky and debatable.

Ownership of football broadcasting rights is important and must be protected, but we are reaching the uncanny valley of scaring even Valle Inclán himself.

We already know about the mic thing, the protection problems it had, but here we have them too (Jorge’s post on the matter). And on top of that, the twisting of the whistleblowing channel concept to absurdly encourage false reporting. And it’s not like they were very smart when putting the examples of the “good photos” you’re supposed to submit with the report. Exactly what many of those who consult this holy newsletter would have recommended.

In another application of that Spain amazes you mantra, we’re starting to see how people are using the issue. Not to mention the multiple negative cheers that the poor LALIGA community manager are having to read.

And at this point we already have it all: pissed-off people, hospitality representatives demanding a meeting right now, and Internautas already filing a complaint with the AEPD. We’ll see whether the AEPD issues some kind of note, blog post or informal warning—or nothing at all. We’ll see.

You’re reading ZERO PARTY DATA, the newsletter on current affairs and tech law by Jorge García Herrero and Darío López Rincón.

In the spare time this newsletter leaves us, we enjoy solving tricky situations related to personal data protection and artificial intelligence regulation. If you’ve got one of those, give us a wave. Or contact us by email at jgh(at)jorgegarciaherrero.com.

Thanks for reading Zero Party Data! Sign up!

Suscríbete ahora

🗞️News from the Data World 🌍

.- Continuing with magical and mysterious Spain, it turns out we’ve joined the select group of countries that are going to ban social networks up to age 16. Last week we talked about France going head-on with this, but apparently the issue was burning here too. Though in the classic local style where the news isn’t the approval in Congress, but the Prez scoring a three-pointer at a podium event outside the country. Remember they already scored a three-pointer with the unofficial name “porn-passport,” which got lost in the mist.

And the three-pointer implies the usual questions. Is he selling what’s already coming in the age verification provisions of the draft bill on minors in digital environments? Is it something new? Is it a new Falcon model? Sharp analysis by Camino García on LinkedIn.

And there’s another elephant in the room that nobody mentions: the fact that minors are still going to flock to sketchy social networks, VPNs or unsafe alternatives to get around whatever is implemented. Regulation is never thought through by putting on the minor’s hat, but that’s exactly the first thing that needs to be done. Think like a kid who tries to use everything they know or can find to get their way.

And the magic from the other side. The point about fighting hate crimes while casually dropping the marvel of the “hate and polarization footprint.” Nobody can come out badly from fun profiling with flags. From shutting down printing presses, to poor Durov carrying Sanxe. We could put it here, but you’ve probably already suffered it as an invasive Telegram SERVICE message.

For our part, we have questions.

What are the possibilities for age verification? What’s the trade-off between privacy and certainty in the chosen measure? This infographic from the Future of Privacy Forum is the one ring to rule them all:

📖 High density docs for data junkies ☕️

.- Long article by our beloved Gabriela Zanfir: main takeaways: 1) the proposal to redefine “personal data” towards a more relative approach could narrow the scope of the GDPR; 2) the debate over whether AI models themselves are personal data reorients regulation from the notion of “data” to that of “models”; 3) the proliferation of adjacent laws can dilute the attention and enforcement capacity of data protection authorities. Last but not least, the EDPB Opinion on models trained with personal data, together with German case law that has classified trained model weights as copies of works, could trigger a doctrinal shift where the category of “personal model” takes on a life of its own, requiring new specific rights and obligations.

-Did you say sovereignty over your data? Bye Bye Big Tech: How I Migrated to an Almost All-EU Stack (and Saved 500€/Year)

The author (@mkoerbi on Substack) details his personal migration from US Big Tech services to an almost entirely European ecosystem, prioritizing privacy, data sovereignty and cost. Productivity suites, storage, encrypted email and AI services—he shows that user experience and integration can be comparable or better. The narrative “more privacy = worse usability” stopped being true a while ago, and total cost drops thanks to simpler “bundles.”

.- An excellent long read to understand how the algorithm discriminates everything everywhere all at once. In this case, Google Maps with respect to restaurant searches in London. Because the map is not the same as the territory, bitch. By Lauren Leek.

💀Death by Meme🤣

🤖NoRobots.txt ot AI Stuff

.- Many US college students use AI text “humanization” tools to avoid being detected by anti-plagiarism software (Turnitin, GPTZero, etc.). These tools rewrite essays to reduce the likelihood of being flagged as AI. That is, there’s an arms race between detectors and humanizers; there’s no clear consensus on legitimate AI use in academic work; and non-native English-speaking students are disadvantaged (disproportionately labeled as suspicious) by these tools.

Lastly, and it seems to be the topic of the week, plagiarism detection tools go way, way too far.

.- Anthropic launches Anthropic Legal. LegalTech firms take a beating on the stock market the next day. I still keep thinking about this spot-on post by Sergio Maldonado.

🔗Useful tools

.- Open Visualization Academy. Open Visualization Academy positions itself as an educational platform on open data visualization. It offers courses, resources and practical examples to learn everything from chart fundamentals to advanced visual storytelling and dashboards.

.- Introducing Osprey V1.0: Open Source Infrastructure for Real-Time Abuse Mitigation. Osprey V1.0 is an open-source infrastructure for real-time trust & safety operations, initially developed by Discord and now maintained by ROOST. Osprey acts as a rules and investigation engine, allows encoding anti-abuse policies, correlating events, and supporting human reviewers in spam, harassment and similar incidents. Already in production (Bluesky, Discord, Matrix). By the ROOST team: Savannah Badalich, Aaron Rodericks, Jim Mackenzie.

📄Paper of the week

Do you remember that thing about “the United States are third world when it comes to privacy: that’s the tweet”? Well, this is the paper:

.- Privacy in Authoritarian Times: Surveillance Capitalism and Government Surveillance by Professor Daniel Solove.

And an extra little article for more context.

🙄 Da - Ta - Dum Bass!!!

ChatGPT is the true One Ring. It always tells you what you most long to hear.

If you think someone might like—or even find this newsletter useful—feel free to forward it.

Compartir

If you miss any document, comment, or bit of nonsense that clearly should have been included in this week’s Zero Party Data, write to us or leave a comment and we’ll consider it for the next edition.

Deja un comentario