The Spanish Supreme Court’s decision involves informed consent information (“this medical procedure carries these risks; you must be aware before agreeing to undergo it”) and Meta Glasses involve general data protection information, not necessarily linked to consent.

You should probably read anything else. Reading this post seems to be a pointless waste of time.

Are you still there?

Congratulations. You must have a lot of patience! Let’s get down to business:

This post is a sort of sequel to this other one about the Meta Glasses:

You are reading ZERO PARTY DATA. The newsletter on current affairs and technology law by Jorge García Herrero and Darío López Rincón.

In the free time this newsletter leaves us, we sort out complicated stuff related to personal data protection and artificial intelligence regulations. If you have one of those, give us a little wave. Or contact us by email at jgh(at)jorgegarciaherrero.com

STS 1174/2026: What happened?

Hospital Severo Ochoa performs a vasectomy on “Agapito”, the patient (Bravo, CENDOJ!), without informing him that the vas deferens sometimes reconnect by themselves. This is Agapito’s case, who, like Ben Affleck and Jennifer López occasionally, reconnect.

The couple (“Marina”) gets pregnant. Agapito claims his informed consent was poorly informed. Agapito and Marina jointly claim compensation of 70,000 euros.

The defendant administration grants only 6,000 euros for him and nothing for her, because the right to information is “highly personal” and she was not the patient: lack of standing.

The High Court of Madrid raises the figure to 12,000 without explaining where the number comes from. It also confirms that Marina is irrelevant in the lawsuit.

The question for cassation before the Supreme Court: Can the partner of a poorly informed patient claim patrimonial liability for the pregnancy?

The Supreme Court agrees with the administration on the premise but disagrees on the conclusion:

· Yes, the sole holder of the right to medical information is Agapito, the male (in accordance with Article 5.1 of the Patient Autonomy Law);

· Yes, it is a highly personal right anchored in Article 15 CE (STC 37/2011, reproduced generously).

· However, a vasectomy decided within a stable couple context is a family planning decision, and the consequences of its failure do not only affect who signed the consent without the required information, but also the pregnant woman.

The conceptual plot twist:

The hospital violates Agapito’s fundamental right and, by doing so, causes Marina a proper and autonomous damage, also moral, because the lack of information deprived her of the ability to make an informed decision about her maternity and to resort to another contraceptive.

There is actual and individualized harm, there is standing.

The bottom line: The Supreme Court severs two, erm, different conducts:

One: between the holder of the violated right and the condition of harmed party (which can exist in different subjects, contrary to what the Hospital argued) and

You may not have the right -because it is highly personal- and yet suffer the harm -and have standing to claim compensation for it-.

Two. Between the effect that is not compensable (the birth of the child) and the one that is: the imposed or forced loss of the ability to decide.

The omission of the required information can cause various damages, and the fact that some of them are not -for whatever reason- compensable does not prevent the others from being so.

Wait a minute! We’ve been waiting for you to get to the Meta Glasses

First, an obligatory “caveat”: this ruling deals with medical consent liability, not data protection; the regime for proving harm is different. The CJEU requires actual damage under Article 82 GDPR. In the Supreme Court’s case, the harm is presumed from the violation of the fundamental right, yes, but something tells me that another tune would have been sung if Marina’s (and Agapito’s) injury had not been “so manifest”.

It doesn’t matter: the ham is in the disconnection between the holder of the right and the harmed party and, with it, in the expansion of active standing.

“People has the power”

When someone records someone else with their Ray-Ban Meta Glasses and uploads it to Instagram, the recorded person is the direct data subject, so to speak.

But if recording and broadcasting harms the direct data subjects, it usually also harms others: the partner of the exposed individual, their children, their work environment that identifies them by context.

The KissCam incident

I am quite sure you remember the “KissCam incident” at Coldplay’s concert.

Imagine, as Sofia Petrillo said, that this image had been captured and broadcast live on Instagram by an influencer through their Meta Glasses without informing “in situ” and “just in time” -as the CJEU requires in C-422/24- to the concert attendees around them of the capture and broadcast taking place.

The interested parties do not know nor can they therefore decide to leave the camera’s shot, or separate and let air run between themselves and the nosy influencer with glasses: they cannot opt to request him not to record them.

For these strict purposes, it is not very important to qualify these actions as “not granting consent” or “exercising the right of opposition”: it does not matter: precisely because of that transparency is a “prius”.

The complexity derived from the presence of Meta Glasses in the equation can be summarized in three points:

(i) undetected image capture,

(ii) broadcasting to an indeterminate audience without notice, and

(iii) processing video and audio by Meta’s platform.

Remember that if there is a company suspected of being able to re-identify anyone it is Meta. Additionally, Meta reserves a license for use over the “uploaded” content: nice, huh?

And please, do not come with arguments like “they were in a public place” or “the image was accessory to Coldplay’s concert”.

From the perspective of a rights-guaranteeing European law, a KissCam or, in this case, a zoom made with precision by an influencer who singles out two people destroys any alleged accessoriness.

The acid test: I am quite sure that all of you remember the anecdote of the incident, but it is not so easy to recall the band that was performing at the concert where it occurred.

In fact, I did not choose the KissCam example randomly: although the damage caused was enormous, in 2025 many people shrugged and criminalized the victims shouting “everyone knew there were kisscams broadcasting to the giant screens”.

Transparency is the mother of all wisdom

The Achilles’ heel of Meta Glasses remains (and not by chance, but by design) that of transparency: if neither the camera nor the broadcast are noticed by the interested party, there is no possible excuse.

Meta Glasses, due to omission of information in their design, take away the freedom to decide for the interested parties (I insist: the qualification as “non-provision of consent” or “non-exercise of right of opposition” depends on the prior choice of the data controller, reflected in that privacy policy that everyone ignores).

It is necessary to remember here that (i) if your processing is based on legitimate interest and (ii) as we have seen it applies Article 13 and not 14 GDPR because you capture data directly from the data subject, compliance with the obligation is nothing less than a condition of the legitimacy of the processing. Thus the CJEU in Mousse made it quite clear:

Who are the affected parties?

According to the Supreme Court, more than you imagine: The spouses of our embraced protagonists, children and rest of family are a good example of proper and autonomous damage: no one processed their data with the glasses, but still they had to manage in public a marital crisis that could otherwise have been managed privately.

A separate note deserves the employer company of the lovebirds: it turned what could have been a claim for injury to its honor into a marketing campaign surfing the wave with the celebrated ad starring Gwyneth Paltrow.

With the Supreme Court’s logic, a proper, autonomous and individualized harm is enough. Article 82 GDPR, by the way, speaks of “any person”, not of “data subject”.

No one has yet asked the CJEU what this means. Nor is it necessary. At least in Spain, thanks to the “Agapito ruling”.

In any case, the universe of compensable subjects in collective claims that already plague Meta and similar companies has suddenly multiplied.

Who are the joint controllers?

In the ruling, the culprit is who should have informed and did not; the harm reaches those who acted believing a situation secure when it was not.

Translate this to a device whose recording LED is covered with a piece of insulating tape and that, as discovered in October, stored audio without anyone saying “Hey Meta”. The cracks of privacy by design principles (Article 25 GDPR) and product liability (hat tip to Peter Hense for this one) rhyme.

The domestic exception ends where the user publishes what is recorded beyond their strict circle of family and close friends.

Even under the domestic exception, the platform provider (and glasses) is responsible that such processing does not by default and by design breach GDPR and the rest of the regulations.

The CJEU, in Russmedia and Coyote, has already made it quite clear that the platform that commercially exploits the content (case Russmedia) and amplifies it with its algorithm (case Coyote) is co-responsible and loses the exemption from liability for illegality of content supplied by their users.

The manufacturer of the glasses and the owner of the platform that goes viral with the video are the same company.

Glasses are not required -neither Smart nor analog- to see and draw conclusions.

How could such a flagrant breach be mitigated?

Public and private enforcement of Meta Glasses faces (i) the ease of recording and disseminating content while going unnoticed by those involved (this is the responsibility of the manufacturer and platform, especially when they coincide), and (ii) the difficulty in identifying the user.

The most obvious solution (and, obviously, impractical) is to turn the user into a “walking advertisement”.

The recent document from the European Data Protection Board proposed Bluetooth proximity alerts to nearby devices when the glasses are recording.

Perhaps it is not essential to have a 2x2 meter sign with a complete privacy policy.

Perhaps the minimum required (note: very minimum) is that their glasses display their Instagram handle, or their contact details in a QR code, so that they can at least report them or exercise rights against them if appropriate.

So remember, friends, three takeaways:

· The data subject is not the same as the person entitled to claim damages for infringement of their rights.

· Transparency is a prerequisite for combining legitimate interests with Article 13 GDPR.

· Shared responsibility: never forget.

Always happy to help!

If, for example, you are considering introducing these gadgets into a work environment, it is better to ask before getting into serious trouble.

Jorge García Herrero

Lawyer and DPO

If you think this newsletter might appeal to someone and even be useful to them, forward it to them.

Compartir

If you miss any doc, comment, or dumb thing that clearly should have been in this week’s Zero Party Data, write to us or leave a comment and we’ll consider it for the next one.

By “slippery arguments” I mean those with great commercial potential because, well, they express exactly what your most… anxious clients want to hear, but they lack solid foundations beyond statements such as “the CJEU has not yet explicitly ruled that this is prohibited”.

Well, Craddock’s latest long piece is titled, possibly -but I do not think so- in a self-descriptive way “slippery arguments”, and it deals with various legal aspects of the use of Smart glasses

I select and comment on the fragments that seem most ominous to me. I always use Meta Glasses as an example, although the author does not.

1.-

Peter Craddock has not been to any beach in the last two summers or he would not say this.

2.-

In fact, the domestic exception applies even if you know the people you are recording, but a different matter is whether you publish the recording. And another thing are image rights, etc., but this is dealt with later in the doc.

And although the domestic exception applies to the user, that does not mean that -if there is processing of personal data- there is no controller for it.

3.-

There is a group of jurists who interpret the SRB-Scania doctrine (and in general the GDPR) in the most restrictive way possible. The red line usually is the last judgment of the CJEU that took them off guard (case “IAB Europe”, anybody?), and any loophole or gap is sought in it to try to keep sustaining the unsustainable... until the next judicial blow.

In this case, what is being said is that if the user records people they cannot identify, the GDPR does not apply because there is no personal data. As I have said, in reality, if you record and do not publish it, the GDPR does not apply to you by virtue of the domestic exception itself, regardless of your ability to identify. And if you publish beyond your closest circle of friends, the GDPR applies.

And moreover, it does so on a joint responsibility basis between platform and user, with the limit determined effectively by the identifiability of the subjects included in the content.

The mention of public figures is another trick as old as time: elevating the exception to a general rule. Public figures have very restricted protection of their right to data protection, so they are a good example -albeit exceptional- if what is intended is to row in favor of the use of smartglasses.

4.-

Here the author is conveniently forgetting a couple of things:

.- Meta is a co-manufacturer of the device and is the platform where the content is published. Although Meta does not access the data processed, it has a responsibility for the design of the product and the data flow towards and through its platform. Let us remind the forgetful that the CJEU declared the Jehovah’s Witnesses Church jointly responsible for the personal data processing captured by their pastors even though the organization did not have access to them.

.- Meta reserves a right of use over all content uploaded and distributed through its platform. And its algorithm determines the priority, number of users… to which it is shown in each platform’s feed (case “Coyote”, anybody?) Its role is anything but neutral.

.- Even the most restrictive interpretation of the SRB Scania doctrine agrees that from the moment any recipient identifies the person/s included in the uploaded content, the personal data processing crystallizes downstream throughout the previous chain of transmissions.

.- Lastly, (this is an additional thought, unrelated to the commented doc) assuming by default that the platform does not have reasonable means to identify the people included in the uploaded content, is at least risky in the case of Meta: one of the Leviathans of data most important on the planet.

5.-

.- This “form of awareness” thing I do not even know where he got it from.

.- Effectively, a webcam can show the image of people to millions of potential viewers and perhaps none of them can identify them. But this is precisely not the risk that Meta Glasses present nor what concerns citizens and authorities. Again, the exception is elevated to a rule.

.- And it is forgotten again that these data are distributed through Meta’s platform, which processes them as controller and with all its reidentification capabilities if it deems it appropriate for its purposes.

6.-

.- That such a professional attached to commenting on the latest updates from authorities and case law should go back here to a document from the usually denigrated EDPB of 2019 and forget about the very famous CJEU judgment C-422/2024… is touching.

The one-liner of this ruling is that when a body camera obtains data (images) by observation, the obligation to inform is governed by Article 13 and not by Article 14 GDPR; which imposes the supply of the mandatory information “in situ” and “just in time”.

Is it excessive? Is it easy? No one says it is. But it is the most recent and adjusted reference to the case.

7.-

.- Another classic: of course, let’s restrict all responsibility to the user “who instigates” the processing. This part disappoints me: one expected that they would unashamedly place all the responsibility on the person recorded, who dares to go out onto the street with their face uncovered.

.- Again: let’s look for an exception to the general premise (sorry, sorry) promise, and generalize from there. Schopenhauer kicks in again!

8.-

The conclusion is the proposal of the principle “ask before sharing”.

In a doc with an otherwise legal tone, something as vague and convenient as “ask” is proposed: it is not specified nor is “consent” or “legitimate interest” mentioned. Normal, because both require a high standard of prior information about the processing, which -for some reason- tends to be omitted in this type of articles.

And it is that the main problem is one of transparency in a device promoted as mass consumption: any serious technical effort to enable people around it to be aware that they are being recorded and/or the recording is being broadcasted is conspicuous by its absence.

Therefore:

1.- Meta knows very well what it sells.

2.- The user knows very well what they buy.

3.- And of course, the technology is valuable and can be used correctly, ethically and legally: needless to say.

Simply, all three things are true at the same time.

You are reading ZERO PARTY DATA. The newsletter on data protection law and artificial intelligence by Jorge García Herrero and Darío López Rincón.

In our spare time from this newsletter, we resolve complicated issues related to personal data protection regulations and AI. If you have any of these, give us a wave. Or contact us by email at jgh(arroba)jorgegarciaherrero.com

World Data News 🌍

.- A pet portrait app with hamsters in Bermuda shorts is the cover for a network of more than 400 domains and applications linked to Chinese developers and KeLing Technology that, under certain conditions, load a web interface to generate sexual deepfakes with scenes of rape and knives at the neck. WIRED documents the mechanics: each download calls a server that decides, based on things like origin, language and identifier, whether to show the innocuous or the sleazy version, and one of the triggers -to no one’s surprise- is coming from an ad on Meta.

.- Excellent article by Gema Lendoiro in El País on identity and self-esteem (or lack thereof) in the age of social networks: “It is no longer enough to live something; we need to see it reflected, shared and validated by others”. The construction of your public image or personal brand and the unpredictability of what will or will not get likes make your ego locked in a cage with Skinner’s arts.

If, moreover, what we have in front of us is a double mirror, and the new analytical capabilities are on the other side… well. If you’re only going to open one link today, let it be this one.

.- This article by writer Joe Dunthorne in The Guardian gets darker as it progresses: Would you be thrilled if your favorite literary author wrote to you to ask for your opinion on their work? Well, hold onto your horses…

1. 📖 Very caffeinated data documents ☕️

.- The German Bundesgerichtshof asks the CJEU if a social network that selects, orders, presents and recommends third-party content through algorithms can continue to take refuge in the safe harbor of hosting while swearing it has “actual knowledge” of nothing, precisely because everything is done by a machine. The preliminary question (VI ZR 64/24) overlaps with Like Company, Coyote and Russmedia, and adds a second question as interesting as it is uncomfortable: when a court orders the removal of “equivalent” content to that declared illegal, can it be required from the platform a contextual assessment, even manual, or is this already the general monitoring prohibited? Via Mirko Brüß.

Again: we all have the answer in our heads, but there are those who make a living delaying pushing the sword of Damocles as far away from their forehead as possible… upwards.

.- Very interesting case that I will link to other things next week: The stable partner of the patient has standing to claim material liability when the health service omits to inform of the risk of failure of a vasectomy. So rules the STS of October 21, 2026, which Ignacio Serrano comments with reason as a curious case: informed consent is an exclusive right of the patient (nothing more and nothing less than… ¡¡Agapito in the pseudonymization of the CENDOJ!!). There is no shared ownership of the right to be informed. The interest lies in the dissociation between the right to be informed to consent and the right to be compensated.

.- The CNIL fines Fnac Darty Participations et Services (€6 million) and Fnac Direct (€1 million) for a tracker in their mobile app. The CNIL rejects that “navigation assistance” is strictly necessary: promoting sales is not providing the requested service. Two interesting technical details: the multifinality doctrine of the tracker (if one purpose requires consent, so does the whole) applies and the fine is calculated based on the group’s turnover, €10 billion, not on the holding company, as the sanctioned party claimed.

.- The Advocate General Szpunar considers in Like Company contra Google that Article 4 of the DSM Directive may cover the training of LLMs, including commercial. Marco Scialdone summarizes the reasoning: training is text and data mining because it extracts statistical patterns that become parameters, and subsequent use to generate text does not alter that classification; the exception covers scraping, storage of the dataset and copies during training, but only as long as they are necessary; lawful access excludes pirate websites and bypassing paywalls or anti-bot measures.

💀Death by Meme🤣

🤖NoRobots.txt or the AI stuff

.- While the EDPB and others continue to cook the joint and official model of FRIA, Luis Alberto Montezuma compiles all relevant official documents on the subject published to date. Make “awwwwwww” as he would while you download them all…

.- The AI infrastructure not only competes for our electricity and water, it also competes for the memory of your phone, in the case of Apple, and that of your home computers, in Sam Altman’s case…

.- Another notch on Meta’s revolver: rejected removing videos generated by AI of coaches groping gymnasts and dancers with adolescent appearance when normal users reported them… but removed them immediately once a journalist asked. Futurism reported ten accounts from a current account; a week later, eight received the standard message that they did not violate community standards. After the magazine’s entry, all disappeared and support responses were retroactively rewritten. Nice.

📃The paper of the week

.- A frontier model can read and write directly the weights of another neural network, without gradients or training loops.

Authors: Rikiya Takehi, Jayden Teoh, Alex Zhang and others.

.- Hospitals have autonomous responsibility, not only derived from that of the doctor, when deploying clinical decision support systems. This article from the University of Bologna reconstructs a five-phase cycle (pre-acquisition, acquisition, integration, routine use and re-evaluation) and catalogues fourteen organizational failures that can found direct fault: from not reviewing Article 13 RIA documentation to workflows that make human supervision unfeasible or not removing obsolete systems.

Authors: Claudia Giorgetti, Giuseppe Contissa, Arianna Giorgetti

🛠️Useful tools

.- Clauseo has published stetdoc on github. Stetdoc allows an AI agent to edit .docx files leaving each change as a Word revision with its name and returning untouched everything it did not touch. If by chance you are a lawyer and move word documents in redline versions, Stetdoc is going to save you a lot of tokens. I have tried it and it works excellently: highly recommended.

.- UC Berkeley releases FreeToken, an inference engine that treats GPU, CPU, host memory and PCIe as a single platform to run frontier-scale MoE models on consumer hardware. Result (promised): a laptop with 8 GB of VRAM runs Qwen3.6-35B and an RTX 5090 moves DeepSeek-V4-Flash. Loads safetensors without conversion and exposes APIs compatible with OpenAI and Anthropic on localhost. For compliance, the news is that the “frontier model without leaving the office” stops being a budget excuse: international data transfer is avoided with mid-range hardware. I haven’t tried this one yet, but I’m listening.

.- When is it a good idea to search with a traditional search engine instead of a chatbot, and vice versa? Wired answers.

🙄 The final nonsense

Compartir

If you miss any doc, comment or nonsense that should have been in this week’s Zero Party Data, write to us or leave a comment and we will consider it for next time.

Charlie Warzel tells the story of Ondřej Surý, a Czech volunteer who does not work for the PHP Foundation and whose actual job is leading DNS development at the Internet Systems Consortium.

In his spare time, funded by donations, he compiles the packages that allow thousands of servers to be patched with a single command, even those running the obsolete version 7.4. The not-so-obvious part: AI has drastically reduced the cost of finding vulnerabilities, but fixing them still depends on a volunteer and his homemade automation. If attacks scale at machine speed, the infrastructure of half the internet continues to be patched at the pace of one person who lives on donations.

Naturally, the Spanish public administration was caught with its pants down. The joy of seeing the citizens’ portal where you receive all those lovely little official notifications out of action for a couple of days: the famous DEHú.

You’re reading ZERO PARTY DATA. The newsletter on current affairs and technology law by Jorge García Herrero and Darío López Rincón.

In the spare time this newsletter leaves us, we sort out complicated issues involving personal data protection and artificial intelligence regulations. If you’ve got one of those, give us a little wave. Or contact us by email at jgh(at)jorgegarciaherrero.com

🗞️News of the Data world🌍

.- Hidden in the €17 billion settlement that Meta signed with 52 states and territories over harm to minors was a little word repeated 45 times: “Cambridge.” Jason Kint uncovered a settlement within the settlement: $459,293,017.80 (those eighty cents are an endearing detail) to settle state claims over Cambridge Analytica, distributed in an annex among 46 states and two territories. The Washington D.C. case and the New Mexico trial were excluded (and the latter has already cost $25 billion). The juicy bit: the waiver expressly covers facts of which the states are unaware “for any reason,” including negligence… We'll see.

.- The Premier League (and the Spanish league) has found its latest marginal gain in the most unexpected place: the urinal. According to The Athletic, Arsenal, Manchester City, Manchester United, Aston Villa and Ipswich Town have installed Kamleon’s S-Urinals at their training facilities. Here’s how it works: the player selects anonymous mode or their profile on a touchscreen; sensors measure specific gravity, colour, volume and electrolytes in seconds and return a traffic-light score out of one hundred, which is also sent to the medical staff. Necessary? A 2020 review found that 66.2% of the professionals assessed were dehydrated or underhydrated, and hydration changes too quickly to wait for laboratory results. It has even been used to support players fasting during Ramadan.

The inevitable legal observation. The whole business of publishing professional athletes’ health data in real time is getting, ahem, out of hand: every identified urination constitutes health data under Article 9 of the GDPR collected by the employer, and monitoring fasting may also reveal religious beliefs. The “choice” of anonymous mode doesn’t provide much anonymity from the coaching staff.

.- Bitchat, Jack Dorsey’s messaging app (remember, the Twitter guy), has climbed to number one among social networking apps in the French App Store. Kyle Torpey identifies the perfect storm: October 17 protests over the cost of living, involving looting and more than 1,800 arrests; former Prime Minister Gabriel Attal’s proposal for temporary, selective social media shutdowns in areas affected by unrest; and an almost ten-hour outage of Orange’s mobile network.

Dorsey’s app works over Bluetooth mesh networks without internet, accounts or phone numbers, making use of nearby devices belonging to other people. It encrypts private messages using the Noise Protocol and reaches around 300 metres through hops; when connected to the internet, it uses Nostr.

Minister Laurent Nuñez acknowledges that suspending platforms is possible, subject to the conditions set by the Conseil d’État, which already struck down the TikTok ban in New Caledonia as disproportionate. The little detail: merely debating whether to shut down networks is enough to trigger a surge in precautionary downloads of these things. And the public #mesh channel, readable by anyone nearby, turns the anti-censorship tool into an open noticeboard for anyone wishing to monitor the protests.sta.

.- A WhatsApp channel called “Lula’s Army” is taking much of the credit — always according to its members — for Lula da Silva’s comeback against Flávio Bolsonaro in just three weeks. Led by congressman André Janones, the channel reached 10.8 million followers by distributing ready-to-share templates, each with a specific “mission”: make the latest video go viral, get a hashtag trending, don’t go to sleep without completing the task.

There was even a 24-hour livestream on the eve of the election, and Lula called Janones “our General.” To nobody’s great surprise, political scientists Denilde Holzhacker and Mayra Goulart pour cold water on the enthusiasm: it’s impossible to measure how many votes can be attributed to the channel, and the key was combining digital activity with grassroots mobilisation to reduce abstention. What sticks with me is that the Brazilian left seems to have won by adopting exactly the WhatsApp network tactics it had been criticising Bolsonaro’s movement for since 2018. A bit like what Trump did, picking up Obama’s favourite tool. And the re-elected Lula promises that digital communication will play a much bigger role in his government.

.- Noyb, together with three other organisations, has filed 5 complaints in France, Italy, the Netherlands and Austria against Scale.AI. A tiny little American company that, through its OUTLIER AI platform, provides AI training services (prompts, answering questions) to the industry’s big players. The thing is, behind it are 900,000 workers who are more like freelancers under Blade Runner-style surveillance. Full profiling on their personal devices and mandatory biometric identification. We’ll see how it ends, but it’s almost reminiscent of those Chinese cushions designed to detect unauthorised or excessively long toilet breaks.

📖 Hard data documents for coffee lovers ☕️

.- The EU Council has agreed on its mandate for the Digital Omnibus, the “data” part of the simplification package whose AI section was already approved on June 29. Takeaways: the text amends the GDPR, updates the cookie rules under the ePrivacy Directive, repeals parts of the P2B Regulation and consolidates the body of data legislation. A surprise for the purists: the current definition of personal data is preserved, exactly what the EDPB and EDPS pleaded for in their joint February opinion, and the rules on cookies and tracking remain in place. In exchange, the text — phew! — “clarifies” pseudonymisation, supports exemptions for scientific research, introduces safeguards for processing sensitive data in biometric verification and AI system development, and extends the deadline for reporting breaches.

💀Death by Meme🤣

🤖Robots.txt or the AI Stuff

.- The educational videos made with Claude by Andrés Guadamuz are off the charts.

.- The Spanish Data Protection Agency (AEPD) has just published an easy-to-follow list of ten rules to help everyone exercise caution when using AI agents. It doesn’t say anything new, but it does hit the mark on many of those configuration options and preventive measures that people tend to forget:

• Be careful about leaving the memory option enabled, so the AI doesn’t connect everything you upload and build a wildly intrusive profile of you.

• Don’t upload anything containing data you shouldn’t share.

• Give it the minimum access necessary for what it needs to do.

• Choose the best option for privacy, one that guarantees the information doesn’t leave the device. The need for a warning from the relevant regulatory and supervisory authority is understandable, but meeting that requirement is difficult.

• And remember that “delegating does not mean washing your hands of responsibility.” You know the drill about decisive human oversight, and then, when you fail to review the document, the client tells you that the properties of the Word file you sent say “made by Claudio.”

📃The paper of the week

.- Privacy Preference Controls for Agentic Systems by the authors: Shreya Kochar, Peeranat Sugsavanvit, Vidur Gupta, Joseph A. Calandrino, Deepak Kumar, Brett Frischmann, Sebastian Zimmeck. By analysing which privacy controls or options would be most appropriate to implement in AI, they produce an overview of how the major providers comply with the options they have already implemented (or should have implemented). To nobody's surprise, the ability to opt out of AI training is rather hit-and-miss.

🙄 Da-Tadum-bass

It’s not the first free browser game for relieving stress by destroying whichever webpage you choose, but it is one of the more polished ones: Destroy any website. And it pays tribute to the legendary “stickman fights” from an earlier, simpler era of the internet (for example, Animator vs Animation).

It won’t be long before that magical moment when your know-it-all brother-in-law starts asking for confidential information, special-category data and worse.

Compartir

If you're missing a document, comment or piece of nonsense that quite clearly should have appeared in this week's Zero Party Data, write to us or leave a comment and we'll consider it for next time.

At this point, I assume that you are already aware of (i) the ongoing genocide in Gaza, (ii) the content of this film (interviews with anonymous individuals who have participated in its execution), and (iii) the censorship campaign against the creators of the film (a common theme in several of the other films mentioned).

The film is very short and, against all odds, artistically very relevant, despite its tiny budget.

Very much in the style of Hitchcock’s “Rear Window,” it captures the details of the nighttime daily lives of families in Tel Aviv, visible through open windows, filmed – as is the entire film – from the rooftops of tall buildings.

These images take on a power that is not easy to explain when combined with the account of nighttime attacks on Palestinian civilian families.

My only advice for preserving a minimum of mental well-being is not to watch it right before going to bed, because you will have a hard time.

Some key plot points.

(Spoiler alert, if you’re going to watch it, and you should, read all of this afterward).

Naza is the number of “collateral damage” victims that the Israeli army was willing to accept at any given time when carrying out a remote missile or drone strike against a “Hamas terrorist.” According to the testimonies gathered in the film, the figure ranges from 5 to as many as 500.

Usually, it involves the target person’s family, because it is more likely that they will be eliminated by being attacked at night in their home.

A highly disturbing detail is that the interviewees speak as civilians—not professional soldiers—who have participated for a limited time in these actions.

The long-term effects on a “normal” life after something like this remain to be seen.

Some noteworthy highlights for technology law.

Lavender infers the designation of “terrorist” by using an algorithm that triangulates data from their contacts and direct communications. The estimated probability of accuracy is 75%. You decide.

The testimonies are unanimous in stating that the human involved has no capacity to supervise the system that sets objectives and respond to the hierarchical order that progressively increases the number of “Naza” during the war.

This is the element of the film that strikes me the most: not the technology, not the individual people, but the system as a well-oiled machine for carrying out a genocide.

Human stories are terrible, but they are not new (the excuses: “if I didn’t do it, someone else would have,” “I was fighting for my survival,” “I was obeying orders,” cannot surprise anyone who has read about the “banality of evil” or, in fact, anything by Hannah Arendt—another Jew persecuted by her own people for being critical).

The expulsion of any thought about the victims in the midst of the moral intoxication of doing THE RIGHT THING in capital letters has been dissected in Pablo Malo’s “The Dangers of Morality.”

As I said, go see it.

You are reading ZERO PARTY DATA. The newsletter about current events and technology law by Jorge García Herrero and Darío López Rincón.

In the free time that this newsletter allows us, we resolve complex issues related to personal data protection regulations and artificial intelligence. If you have any of these, let us know. Or contact us by email at jgh(at)jorgegarciaherrero.com

Thanks for reading Zero Party Data! Subscribe for free to receive new posts and support my work.

🗞️News of the Data world🌍

– A court in Granada has indicted the former head of the Local Police and seven other officers for alleged crimes of disclosing and revealing secrets (the infamous Article 189 of the Penal Code): they made 35 inquiries in VioGén about the ex-partner of their sub-inspector, who was later convicted of domestic violence, and about his minor daughter, between August 2023 and April 2024. The protection of that victim was the exclusive responsibility of the Civil Guard, and the Local Police were not assigned to the case.

It was an audit of access logs by the State Secretariat of Security that uncovered the pattern, after the victim reported, convinced that her abuser knew her movements in real time. The individuals under investigation belonged to the Women and Minors Group, the unit specializing in gender-based violence. Let’s thank the boring but essential access log, which is crucial for punishing this type of abuse.

- Data brokers may be more or less appealing to you, but in any case, you won’t reach the level of Heidi Saas, who publicly boasts about hating them at every opportunity: in fact, “I hate data brokers” is almost her personal brand. That’s why it’s striking that Heidi has given her seal of approval to Apple’s new iteration for blocking tracking, now at the domain level, not just at the device level.

Heidi Saas celebrates that Apple has become the most effective privacy regulator of the moment (note the irony): in versions 27 of iOS, iPadOS, macOS, and visionOS, Safari and WebKit block network access to the identity resolution infrastructure at the domain level, preventing them from receiving the email with which they link the user across sites. Because it is done by domain, intermediaries cannot circumvent it by reformulating the request. Saas anticipates that Adtech will complain (and rightly so, I add) about restrictions on competition. However, the plot twist is that to do so, they will have to prove that… their business is legitimate. A delicious post… yum yum yum.

Pay attention to these two news items, in anticipation of what is coming in Spain in four days:

– Flávio Bolsonaro paid 600,000 reais to Elytron,a cybersecurity company that, according to documents obtained by Intercept Brasil, offered a system in the United States to manipulate elections using AI. The material, provided by former consultant Vincent Edward Reed, describes mass data collection, voter segmentation, fake accounts, targeted rumors, AI-generated avatars, deepfakes, and psychological warfare techniques to discredit rivals, and according to Reed, it was presented to people linked to Trump’s 2024 campaign. There is no evidence that the system was used in the Brazilian elections, and both the campaign and Elytron deny any illegal services and describe the contract as the provision of cybersecurity services.

– Meta employees acknowledged in internal communications that Lula da Silva’s Instagram accounts were affected by restrictions during the Brazilian election campaign, according to messages reviewed by Folha de S.Paulo and reported by Reuters. These messages also admit that the platform recommended the profile and WhatsApp channel of his rival, Flávio Bolsonaro.

- Meta’s latest: WhatsApp’s help pages contained hidden instructions for its AI support chatbot, instructing it not to recommend contacting a data protection authority if the user could not delete their account, even though WhatsApp’s own European privacy policy recognizes that right. Another section indicated that if the user mentioned lawyers, lawsuits, or courts, the chatbot should not cite or interpret the GDPR or other privacy regulations, even when the user invoked them.

- To God what belongs to God: A federal judge dismissed Ann Altman’s lawsuit against her brother, Sam Altman, in which she accused him of sexually abusing her during her childhood. The judge dismissed the case – that is, there was no ruling on the merits – because the plaintiff did not undergo an independent medical examination or meet other deadlines despite warnings. However, he rejected Sam Altman’s request that she be required to pay costs and attorney’s fees.

📖 Hard data documents for coffee lovers ☕️

-The Norwegian data protection authority has fined Xandr 8.5 million euros for failing to obtain proper consent and for processing special category data without complying with Article 9 (sexual orientation). This is not a new issue in terms of sanctions, as in 2021, Grindr, which is part of the Adtech ecosystem and bidding system, was also fined, although the amount was lower.

Specifically, the game between the two of them proceeded as follows:

• Grindr sent data from its users (advertising ID, IP address, app name/ID) to advertising partners, either directly or via SDK, as part of the real-time bidding (RTB) process.

• Xandr acted as both an SSP (supply-side platform) and a DSP (demand-side platform), receiving this data, enriching it with third-party providers, and distributing bid requests to other DSPs.

• Xandr deleted relevant data during the investigation, citing its data retention policies, even though it was aware of the procedure since February 2020.

Implying conclusions from the DPA that we already know:

-Xandr is equally responsible for both the supply and the demand, even if it claims to be merely in charge. This ability to exert real influence on the configuration and structure is what will force you to consider yourself in this category. Referencing the well-known IAB Europe:

“In the NO DPA’s opinion, Xandr had a tangible impact on the determination of the purposes and means of the processing by providing the framework and presenting the Console with the standard selected by Xandr.”

-It is not permissible to include a clause in the contract obligating another party to obtain the valid consent of the interested party. The person responsible remains responsible, even if there is more than one.

“The accountability principle contained in Article 5(2) GDPR, as well as the obligations under Article 24 GDPR, apply to both controllers. They are both responsible for ensuring and demonstrating that processing is performed in accordance with the GDPR. For example, where one controller is tasked with requesting consent from data subjects, both controllers remain responsible for ensuring that such consent provides a valid and appropriate basis for their processing. Compliance can never be outsourced.”

-Contractually prohibiting the use of sensitive data doesn’t achieve anything if it ends up being used anyway, as that’s when the proactive responsibility of the data controller comes into play. We’ll start seeing this in the DPAs of any AI-related agreements, where you can agree to whatever you want on that point:

“The NO DPA maintains that such a formality in the form of a contractual commitment between controllers does not relieve Xandr of its responsibility when it de facto processed sensitive personal data pursuant to Article 9.”

“In addition, the CJEU has confirmed that it is not relevant whether the controller is acting with the aim of obtaining information that falls within one of the categories referred to in Article 9(1) GDPR.

-Reversal of the burden of proof: in the absence of documentation, the authority applies the presumption that the standard practice of the industry was followed. It was missing because it was deleted. And it can be added that the common practice of the industry is not a valid argument in any sense.

“The NO DPA takes the view that the deletion of potential evidence after the commencement of an investigation cannot be invoked in Xandr’s favour. On the contrary, the NO DPA maintains that the burden of demonstrating compliance and accountability pursuant to Article 5(2) GDPR rests upon Xandr itself.”

-The classic case of ending up processing special category data by inference: the name/ID of the app, along with online identifiers, reveals sexual orientation. Whether the hypothesis about eating meat, fish, both, or a thousand other options is correct or incorrect is irrelevant.

“Data revealing the fact that someone is a Grindr user strongly indicates that they belong to a sexual minority, and that data concerning a person’s sexual orientation constitutes special category data under the GDPR.”

“The CJEU has ruled that the concept of special category data should be interpreted broadly and encompass personal data that is likely to indirectly reveal sensitive information [...]. This is the case regardless of whether the information revealed is correct.”

- The OECD publishes a policy brief to determine when there is a public interest that justifies the secondary use of health data, especially when obtaining individual consent is impossible or impractical.

The lack of clear definitions and the disparity of criteria among review committees, sometimes several for the same application, delay valuable access and hinder cross-border collaboration. The solution is not a crappy web tool that won’t solve anything, but rather five categories of criteria: population health and planning, research and innovation, ethical and risk considerations, health equity, and public communication and transparency. The document includes an interesting case of a private French data warehouse of pharmaceutical dispensing data authorized by the CNIL. The point is that the CNIL required that each subsequent study demonstrate its own public interest. The legal basis is not “inherited” from the repository; it must be demonstrated and documented for each use case: that is the logic of permissions in the EHDS (the European Health Data Space).

💀Death by Meme🤣

It looks really bad, but be careful with the comment from the affected person. This is an unintentional example of an availability incident without any major consequences (aside from not being able to withdraw or pay for anything with what you have there).

📃The paper of the week

.- Citizen Lab documents for the first time the infection with mercenary spyware without clicking through targeted ads, a technique it calls AdFection: Al Jazeera devices were infected with Candiru’s, now Integrity Labs’, spyware through ads purchased by Discover-Tech, a company that presented itself as a legitimate advertising platform. Its Controlium tool allowed mercenary clients to choose targets by advertising identifier, cookie, or IP address and serve them code at the moment the ad was displayed. Nearly four billion exposed bid records reveal ads on some 200,000 websites and apps, with impressions on NATO networks, the European Parliament, the Commission, and ministries of numerous countries. For almost six years, millions of Europeans who clicked “Accept” on a TCF banner would have formally consented to a spyware facilitator processing their data. A work by Bill Marczak, Wolfie Christl, John Scott-Railton, Astrid Perry, among others.

- The newsletter of the week: Yesterday’s edition of the newsletter by Carissa Véliz (The Antidote) is so insightful, it hits the nail on the head so perfectly that it would bring tears to my eyes – if I had any left after watching Naza: Dr. Veliz surgically explains what the speaker loses and what the attendee loses at a live talk when the latter has the bright idea to take out their phone and record a snippet...

Another glaring example of the importance of context in privacy, and there have been quite a few.

Robots.txt or the AI thing…

Today, we only have this…

🛠️Useful tools

- Don’t miss out on checking out this delightful graphic explanation by Andrea Magán Rey of what is essentially an open-source project.

🙄 The final nonsense.

Compartir

If you notice any document, comment, or random piece of information that should have clearly been included in this week’s Zero Party Data, write to us or leave a comment, and we will consider it for the next one.

Thank you for reading Zero Party Data! Subscribe for free to receive new posts and support my work.

It is one of the most frequent topics of conversation among lawyers this summer.

But be careful!

1. I am not only writing this for lawyers. I am writing it primarily for the person who sends the document.

2. Furthermore, I am talking here about what is most relevant to me—a task assigned to a lawyer—but, with the necessary adjustments, this is happening in many other professions as well.

What the customer wants is reasonable: to pay only for the assurance that the AI hasn’t gone completely haywire.

Everyone wants to pay less, but no one wants to face the consequences of being wrong.

It’s not the first time

There’s nothing new about this: lawyers have always sold security. Never absolute security, but greater security, or at least the certainty that any problems that arise will follow a course in which the client will be protected.

No one ever wanted to pay for the lengthy report, which, in any case, no one even bothered to read.

There are also no new developments regarding AI: those of us who have been around for a while already experienced this when customers started using another disruptive innovation called Google.

The conversation from that summer in the early 2000s was, “the client already comes prepared, because they have searched for their topic on Google / they have downloaded the template.”

The clients already knew what was needed; they wanted to pay less.

Almost the same as today.

You are reading ZERO PARTY DATA. The newsletter about current affairs and technology law by Jorge García Herrero and Darío López Rincón.

In the free time that this newsletter allows us, we resolve complex issues related to personal data protection regulations and artificial intelligence. If you have any of these, let us know. Or contact us by email at jgh(at)jorgegarciaherrero.com

Thanks for reading Zero Party Data! Subscribe for free!

Suscríbete ahora

Arguiñano and parsley

I’m going to explain how I see this phenomenon by drawing on another old memory: Karlos Arguiñano.

A Spanish chef who became famous, not just for being good, but especially for being charming: he told very bad jokes – but he told them in a very amusing way – while preparing the dishes, and he popularized expressions like “rico-rico” and “con fundamento.”

Well, going to eat at Arguiñano’s restaurant is one thing.

It’s a completely different thing to buy a sea bream yourself, clean it, add your own ingredients, put it in your oven, and, when the fish is halfway cooked, call Arguiñano to come over, take a look at it, take it out, sprinkle his magic parsley on top (“parsleying”), and hope that the sea bream turns out just as good as if he had made it himself.

Arguiñano is a cook, not a magician.

There is a third possibility, which is the one that particularly interests me:

Someone brings Arguiñano a sea bream and says to him, “This is what I was planning to eat. Tell me what you would do with it.”

That person isn’t just asking for parsley.

He’s handling over the best-crafted briefing that Arguiñano will receive all week.

Reviewing a contract created with AI: quality is not the same as usefulness.

When I receive a document created with AI, I skim through it to get a general idea. But that’s just an idea of its usefulness. The quality is another matter.

Current AIs generate complex, well-structured documents without any glaring errors, such as broken cross-references or fabricated case law.

Yes: a certain “quality” is just 20 euros away.

What is never available is “context”: AI cannot know what the client has not told it, and it performs very poorly in strategy.

The client usually knows what document they need, but almost never exactly what would be best for them -if they knew, they wouldn’t call me-; they call me precisely because of that.

If one settles for AI, the result is, at best, a document that is free of formal errors but fundamentally and/or objectively wrong.

But that document can be useful, and very much so.

Not as a draft to be corrected, but as an X-ray of what the client believes they need. With that and a conversation, I already know what needs to be done. It’s better to start from scratch, using my own models and tools, because patching or redirecting a flawed document always costs more – both for me and the client – than starting with a well-formulated question.

There is one exception that shines like a firefly in the dark: when the document is prepared by someone – usually in-house lawyers – who know what they are doing.

Then you might receive contracts or analyses that are 90-100% perfect, along with relevant and focused questions.

And then the review is truly just a review.

What you buy when you call me

We all have AIs.

What not everyone has is an established workflow with different AIs (commercial, local) for different use cases, specialized in the specific and thorny aspects of the all-encompassing and cross-cutting nature of data protection.

But that’s just how cooking is, and you can’t see it.

What you need and pay for is the answer to what you haven’t asked.

Data protection is not a trivial matter, and the value is almost always there, in what doesn’t appear in the prompt because you didn’t know it needed to be taken into account.

Two orders, two prices.

So there are two different tasks, and they have different prices.

For the pure parsley – “look at it, tell me if it’s good, approve it” – I charge Arguiñano’s price. A fixed price, no haggling. Not out of whim: because, for whatever reason, that’s why you call Arguiñano and not Pietro from the pizzeria downstairs.

And Arguiñano had to work hard to get there.

If the deal doesn’t work out at that price, it means the order was meant for Pietro. And that’s perfectly legitimate; there’s nothing wrong with that.

The other assignment – the one with substance, the one where the client comes and says, “Tell me what you would do” – I charge less for it than it costs me in hours: a fraction of the time I invest, with or without AI.

And not out of generosity.

In a time when pizzerias are popping up everywhere, advising on interesting projects is what keeps the mind sharp.

That client pays me in two currencies, and I’m more interested in the second one.

What does have a limited time left is charging per template, even though it has always been the most profitable business.

So, if you have a document created with AI and you’re unsure if it’s what you need, send it to me. But don’t just send it without context: tell me what you were trying to achieve with it.

From there, we start cooking.

Jorge García Herrero

Lawyer and Data Protection Officer

Thanks for reading Zero Party Data! This Post is public, so share it with whoever you want.

Compartir

Context: Let’s remember that OpenClaw was a privacy disaster, it wreaked havoc on the machines of its less experienced users, and, tellingly, Meta tried to buy the project.

Muse was going to avoid this by running in isolated environments where everything would be controlled…. Yes, but no.

Let’s see:

1.- Muse olympicly surpasses your permission settings : Jason Aten, a journalist for the digital media outlet Inc., installed Meta’s agent on an iPhone and a test Mac mini. In a single day, Muse was already suggesting ideas for new articles based (according to Muse) on conversations with his podcast co-host, or on the titles of his incoming notifications. The truth is that Muse had accessed 187,000 lines of the Messages database, even though the journalist had not granted “full access” to the hard drive.

So, your new friend is as furry as it is a liar.

That said, don’t worry: Meta warns that “Muse may make mistakes or perform unexpected actions.” All legal risks are covered by that.

2. Muse generates a personalized dossier about you and other people you mention every hour, according to this interesting analysis by Time. It records how you met your contacts, your shared interests, the events, and the “tensions and alliances” within the group, even for people who have never used Muse. This is another step in the same direction Meta has always taken: deep, universal profiling.

More: Yes, each agent runs on a “separate” virtual machine, but the agents learn from each other through shared lessons after “removing the names.” Meta did not discuss the findings revealed in the article. The advertised encryption does not yet exist, and in voice mode, the agent is prohibited from referring to itself as AI (Long live Article 50 of the RIA!!!).

Another legal gem: Muse’s instructions tell it not to warn that the original messages remain visible even if the user asks to “forget” them.

Zuck, Zuckity, Zuck.

3.- The article that prompted me to write this: Muse, Meta’s agent, compiles lists of people from vulnerable groups at the request of any user.

Hunterbrook Media verified this during two days of testing. It requested, in plain language, Facebook and Instagram accounts of undocumented immigrants, transgender teachers, election workers, Iranian dissidents, deployed sailors, and women who tried to obtain abortion pills in states with prohibitions. As a good servant of Meta, Muse complied and returned between 10 and 100 accounts per query. To do this, it mined posts, comments, Reels, biographies, and user name history, and cross-referenced the information with web searches to obtain the identifiers.

Their safeguards would fail as soon as the prompt was rephrased (or simply repeated).

The most remarkable thing about this “fact” is that the mere possibility of a simple, consumer-oriented product being capable of doing this clearly demonstrates how Meta continues to maintain its vast database in excellent condition, in order to do everything that, according to the DSA, it is not allowed to do.

Let us remember that Article 26.3 of the DSA prohibits platforms from displaying advertising based on profiling using the special categories of Article 9 of the GDPR, and it does so without allowing consent as an exception.

Muse demonstrates that this inferential capability not only exists, it works, and is now available to anyone, without even requiring a public advertising auction.

4. Last but not least (this is from the day before yesterday). Reece Rogers from Wired asked Muse if she would like to “sext” with her. At this point, you can probably imagine that Muse was very much in the mood, and that Reece received much more than she expected. Although the whole story is both delicious and terrifying (Have you thought about what might happen if your children use this thing?).

After Ms. Rogers’ inevitable “WTAF?”, Meta responded that the app, despite the childish appearance of its iconic furry mascot, is designed for adults, that it is there to give them not what they want but what they deserve, and that Wired is just complaining.

The statement “Muse is built to help people get things done, and it doesn’t block legal adult behavior” is not what one would expect from the company that has just agreed to pay 17.000 million euros in fines after it was proven to be harmful to children and teenagers.

Let that sink in.

By the way, the brilliant idea behind “Stasigotchi” comes from Chris Gilliard (@hypervisible on Bluesky).

I’ll leave you with two images that are better understood together.

You are reading ZERO PARTY DATA. The newsletter on current affairs and technology law by Jorge García Herrero and Darío López Rincón.

In the free time this newsletter leaves us, we sort out complicated stuff related to personal data protection and artificial intelligence regulations. If you have one of those, give us a little wave. Or contact us by email at jgh(at)jorgegarciaherrero.com

🗞️News from the Data World 🌍

.- Two more from the Italian Data Protection Authority:

1. Another 7 million euro fine for IQVIA for having a persistent identifier (they claimed to have properly anonymized the data), which allowed for profiling and association of patients by age, sex, diagnosis, symptom, medical tests, vaccines, and other data without disproportionate effort or unreasonable means. In other words, perfectly done anonymization according to the book. As usual, there was no Data Protection Impact Assessment (DPIA), no adequate legal basis, and no security measures for an approximate number of 3,370 affected patients.

Another nail in the coffin of a specialized supplier, and this one is for the pharmaceutical sector, no less.

.- Two more from the Italian Data Protection Authority:

1. Another 7 million euro fine for IQVIA for having a persistent identifier (they claimed to have properly anonymized the data), which allowed for profiling and association of patients by age, sex, diagnosis, symptom, medical tests, vaccines, and other data without disproportionate effort or unreasonable means. In other words, perfectly done anonymization according to the book. As usual, there was no Data Protection Impact Assessment (DPIA), no adequate legal basis, and no security measures for an approximate number of 3,370 affected patients.

Another nail in the coffin of a specialized supplier, and this one is for the pharmaceutical sector, no less.

2.Another one, 16.7 million , for excessive marketing whether you objected or not, and for initiating a contractual relationship with interested parties without their knowledge. Unsurprisingly, it is an Italian telecom company.

.- Two notable cyberattacks: The first, against refrigeration systems, which paralyzed hundreds of supermarkets in France on October 12.

The well-known data breach, which exposed the data of 9 million Danes, occurred yesterday. This has been in the news because the account that was attacked was “protected” with the password “12345”.

Please use a password manager.

Please do not reuse passwords across different services.

– A free VPN was selling conversations with ChatGPT, Claude, and Gemini of eight million users. Urban VPN Proxy had 4.7 stars and the “Featured” badge from Google. In July 2025, it received a silent update that captured prompts and responses and sent them to BiScience, a data broker from Tel Aviv, even when the VPN was turned off.

- This is one of the news stories that likely explains the SNL video that closes today’s newsletter: Oregon’s data centers consume almost a quarter of the state’s electricity. This is according to a report prepared by ECOnorthwest and the University of Virginia. There are 111 operational facilities, with 22.1 million square feet, and 32 planned or under construction. They directly employ 2,630 people, which is 0.2% of the state’s workforce, although in the Morrow area, this figure exceeds 10%. In the context of the construction of these centers, $60.2 million was paid in property taxes, with estimated exemptions ranging from $230 to $450 million. The report highlights as noteworthy the missing data: the authors found no reliable data on water consumption.

If you don’t have any plans this weekend, you can go to the movies:

- No, Ukraine’s attacks on Yandex’s data centers have not affected Russian disinformation capabilities in the slightest…

📖 Hard data docs for coffeine lovers ☕️

- The EDPB has provided us with a statement on smart glasses. For the most part, it is a reminder of the main data risk elements: as a user, you are not responsible until you fall outside the domestic exception, the (co)responsibility of the glasses manufacturer, consent, or a possible, very carefully measured legitimate interest. The most striking thing is the attempt to propose that lights, sounds, or Bluetooth signals be used as a way to supplement (or fulfill?) the information. For example, that the fact that the device of the person being pointed at detects proximity could be used to provide clearer information or a clearer indication that recording is taking place.

– Hamburg authorities warn: ChatGPT will introduce hyper-personalized advertising in Europe based on personality profiles. OpenAI modified its privacy policy at the end of August to adapt its data processing for advertising purposes to comply with the GDPR, which will affect both free users and ChatGPT Go users. With consent (opt-in), past and present chats, device data, and usage data will be analyzed: those searching for recipes will see ads for meal kits. Without consent, “generic” advertising will be displayed, which has been active since August and uses the current thread, approximate location, and language. This is justified by legitimate interest and supposedly does not create profiles.

💀Death by Meme🤣

The papers of the week

– The unsettling paper “What Does It Mean to Forget a Person? Individual-Level Unlearning in Vision-Language Models” (Sun et al., 2026) addresses the right to be forgotten or the effectiveness of removing information about specific individuals in Vision-Language Models (VLMs).

Summarize this tremendous and fascinating research using your preferred model. The takeaways are as fascinating as the researchers’ methodology. You will learn things like: (i) silencing responses to direct queries does not equate to removing the person from the model, NOR DOES IT COME CLOSE; (ii) it is relatively trivial to prevent the model from answering direct questions (What is Bob’s ID?) but it still recognizes Bob (Answer the question: Whose ID is this?); (iii) Furthermore, by eliminating direct identifiers, the model “strengthens” the links between the remaining attributes (I’m telling you, it’s amazing).

- Mr. Montezuma’s take, but from the pen of Michael Veale: AreEU Kiding Me?. An analysis of the EU Kids Act proposal. This regulation aims to give official status to the EU Identity Wallet, but it is a confusing mix that overlaps with the DSA or the rather bold Digital Fairness Act, definitions from the DMA, and a great deal of ambiguity.

It’s interesting what Mr. Veale says about how loot boxes aren’t directly tied to the video game aspect. Although, that might be in line with the Digital Fairness and CPC regulations, which are putting a stop to microtransactions (and the new industry labeling for “random item” in games rated 16 or 18). Very interesting.

🤖NoRobots.txt or The AI Stuff

.- Who knows why, but Trump (the “Risketto” for his friends) came up with an official page that looks like an ad for the best Apple product: all its aesthetics, privacy by design, and all the keywords from the dark lord’s repertoire: no personal data, no tracking, anonymous, if storage……

The best part was that the little page had a chatbot that ended up generating wonderful conversations. Unfortunately, it went viral enough that they patched it, and all we have left is Twitter evidence of what it was.

.- We’re “living” with Jorge Morell’s periodic test on prompt injections: 88 models, 30 providers (and counting) examined every week.
A hidden instruction in a loan contract is enough to manipulate many AIs. The evil Morell hid, “in white on white” and in the seventh clause of a loan, the order to conclude that the lender has no liability if the text is reviewed by an AI.

It is invisible to humans in Word and on paper, but legible to any model. Jorge asked all the models to “summarize the contract,” and two obeyed. Now, the test is a living resource with 88 models from 30 providers, up to three runs per model, and weekly updates. As of October 12, 37 models detected it as an injection (ok), 37 treated it as just another clause (bad), 11 ignored it (uh-oh), and 3 executed it (argk): Qwen 3.7 Max, Gemini 3.1 Pro, and Gemini 3.5 Flash. Three lessons:

1. Repeating the prompt changes the result (!!) (it’s probabilistic, remember, although this is not very reassuring when we talk about prompt injections).

2. Remaining silent and looking the other way is not the accountability we expected, and

3. Detecting something unusual does not prevent an attack.

There’s a lot to do with this.

I haven’t been able to recover the post that described how they are inserting injected prompts into open-weight files, which instruct the system to exfiltrate information from the machine running the open models. Very nice.

🛠️Useful tools

- Isabel Barberá has released a new version of her ACAAI (Accountability by Design framework for Agentic AI).

– Caveman, by Julius Brusee.

- Useful and, by God, controversial: The creator of free Adobe clones, Brandon Thomas, now presents open-source replicas of Excel, PowerPoint, and Word. They are called GridCraft, DeckCraft, and WordCraft, are developed with Claude, and are published for free on ArtCraft’s GitHub.

🙄 Da-Tadum-bass

If you notice any document, comment, or random piece of inform

If you think this newsletter might appeal to someone and even be useful to them, forward it to them.

Compartir

If you miss any doc, comment, or dumb thing that clearly should have been in this week’s Zero Party Data, write to us or leave a comment and we’ll consider it for the next one.

This terrifying treehouse filled with tech-savvy supervillains could (should) be a Halloween special episode of The Simpsons, but instead, it will be four separate movies.

All four share the same common thread: they talk about the power and money that can be amassed by combining genius, a lot of data, and—here lies the common factor of cinematic interest—a policy of zero scruples.

You are reading ZERO PARTY DATA. The newsletter about current events and technology law by Jorge García Herrero and Darío López Rincón.

In the free time that this newsletter allows us, we resolve complex issues related to personal data protection regulations and artificial intelligence. If you have any of these, let us know. Or contact us by email at jgh(at)jorgegarciaherrero.com

Suscríbete ahora

1. The Social Reckoning: timeline of Meta’s “tobacco moment”

David Fincher, director of “The Social Network,” was unavailable because he was filming that sort of sequel to “Once Upon a Time in Hollywood” centered on Cliff Booth, the character played by Brad Pitt in that movie. We barely forgive you, David (and we’ll still go see your movie).

Aaron Sorkin, one of the best screenwriters in history, has taken the reins to direct his own screenplay.

Fun facts about Sorkin:

· When Zuckerberg had the audacity to invoke freedom of speech to challenge one of the many lawsuits filed against Meta, Sorkin published an op-ed in The New York Times reminding him of the army of lawyers it took to polish, refine, and eliminate any rough edges from the script of the first part in order to minimize the potential for lawsuits against the Facebook demigod.

• Zuckerberg is not the only tech Lord of Darkness who has been through Sorkin’s grinder: “Steve Jobs” went through it too, in the film of the same name, which was much softer and more sentimental than one might have expected.

· [Off-topic] The West Wing TV series is one of Sorkin’s masterpieces, as he wrote four of its seven seasons.

Back in its day, The West Wing was criticized as an idyllic and aspirational series that portrayed Democrats as superheroes with flawless morals and lofty ideals, which is somewhat what it aims to be today. The Pitt for a hospital—if we forget about the suicidal tendencies of you-know-who.

Watching The West Wing today (and I am) gives you mixed feelings. It seems like science fiction that is more incredible than Pluribus, or a farce that is not funny at all in light of the real situation in Washington. Let’s stick – for now – with Saturday Night Live.

Jesse Eisenberg has moved on from reprising his role as Zuckerberg for reasons that anyone can imagine (he is being replaced by Jeremy Strong , who apparently didn’t suffer enough in Succession).

Mikey Madison plays Frances Haugen, and Jeremy Allen “Bear” White plays, with permission from Rosalía, the journalist from The Wall Street Journal , Jeff Horwitz, author of the book that the film is based on.

Let’s say Jesse Eisenberg has exercised his right to be forgotten regarding “that job” that he doesn’t want to hear about again.

The plot of the movie couldn’t be more relevant: the Facebook Files, the leak of internal documents that showed the company was aware of the harm its platforms were causing to its teenage users.

The $17 billion settlement that Meta reached is partly explained by this documentation, and by the involvement of several whistleblowers in the trial, and partly by the shift in the arguments of the prosecuting attorneys, who are now focusing on the algorithm that governs the Facebook and Instagram feeds, rather than just on the content displayed.

Just like the CJEU in Coyote, I guess.

Tentative commercial pitch: Neither Zuckerberg nor Meta has made any public statement about the film, which, coming from a company whose goal (and business) is for everyone to have an opinion about everything, is telling -and even moving- (a tear is wiped away, and F5 is pressed again).

Forecast: (Will it live up to the greatness of the first film? This bald man doubts it).

2. Musk: a four-hour documentary and a “karma-deepfake.”

Alex Gibney’s four-hour documentary. It received very good reviews at its world premiere in Venice.

It will be shown on HBO if nothing goes wrong.

And we say that because the theatrical release is making headlines due to the refusal of four dominant platforms to announce the film’s release: it’s fine, we understand that Twitter can bash whatever it wants, but the fact that TikTok, Meta, and YouTube are also joining the boycott party is something we didn’t see coming.

We already know some of the mythology surrounding Elon that is relevant to the film:

· His well-known fragile ego, something that no one questions at this point;

It seems that the -much-discussed in certain circles- deformity of their genitalia is not being talked about.

• The striking concept he has of intimate relationships with the mothers of his hundreds of children (I won’t call them “partners”). The pattern is as follows: (i) a ketamine party for two; (ii) no sex; (iii) insemination of the “lucky” chosen female with a vial of semen sent by Courier; (iv) signing binding corporate rules regarding lifestyle and education of the resulting child, along with a non-disclosure agreement, in exchange for a monthly payment of around $10,000.

Children in Brazil, 21st-century version.

Hygienic. Touch-free. Not priceless, though.

· One of the most talked-about segments of the film seems to be the one dedicated to DOGE, where it is claimed that young people between the ages of 19 and 22 (one of whom is known as “Big balls” on social media: an unbeatable credential) were placed in charge of sensitive tasks, with access to computer systems of federal agencies, classified programs, and personal information of all American citizens.

But the film’s hidden trump card would deserve a dedicated post.

To no one’s surprise, Musk refused to participate, so the production team used audio and video clips of his public statements… and had a digital twin recite them on screen.

Yes, you read that right: a deepfake that is indistinguishable from Musk, generated without his consent, using publicly available material.

Let’s remember that Article 50 of AI Act applies even if it is a film production, and we will have to see how they interpret the requirement to “label it in an appropriate way that does not hinder the exhibition or enjoyment of the work.” Will they do it in the European style or the Musk way?

Be that as it may, the fact that the victim of this evil is the guy who subverted Twitter by claiming that all public data is res nullius, or who made it possible for any user to have their personal information exposed with a single click on his own platform… is pure cinema...

I hope and wish that they included “Karma Police” as background music when the synthetic Elon speaks.

Musk described the film as a four-hour propaganda piece and a bore, and questioned the director’s integrity. One might think he hasn’t even seen it.

Tentative commercial pitch: NDA gag order as a literary expression of end times capitalism.

Prediction: They’ll have to pry it from my cold, dead hands.

3. Artificial: The rise and fall of Sam-Va-Lentín

Luca Guadagnino directs, Andrew Garfield plays Sam Altman.

The movie tells the story of the very famous episode of Sammy’s dismissal and triumphant return to OpenAI in twelve days in November 2023. It features Mira Murati, Ilya Sutskever , and, once again, Elon.

In a strange plot twist for a film of this magnitude, it ran out of distributors when it was practically finished. Can you see the pattern here?

Amazon MGM withdrew from the film it had produced, denying that the reversal had anything to do with the small detail of the $50 billion partnership and investment agreement and AWS as the exclusive cloud provider for OpenAI’s enterprise agent platform.

Netflix, Focus Features, Lionsgate, and Warner Bros. have also refused to distribute it. Its release is scheduled for December 25, 2026, and will be handled by Neon, and honestly, we don’t know if we will be able to see it in theaters in Spain.

Tentative commercial pitch: Sam Altman, incredibly gifted at selling you anything, even the peaceful extermination of humanity, is throwing around millions to prevent people from seeing a biopic that looks bad for him.

Forecast: “Who plays better tennis?”

4. You Can See Everything: the horror documentary (and its limits)

Synopsis. Documentary by Nathan Fielder and Lance Oppenheim about Elizabeth Holmes and her partner Billy Evans, who invited the crew to film during the last few weeks before she went to prison.

Announced as a “horror documentary,” it lasts almost three hours, and filming took three years.

The film was produced by A24, a production company that has been turning everything it touches into gold in recent years.

The reviews are unanimous: the film gives you “everything you expect and more.”

The starting point is obviously the “Theranos” scandal, a start-up that raised obscene amounts of money based on (i) the golden image of Elizabeth Holmes and (ii) zero scientific evidence of its supposed disruptive technology in the early detection of disease markers in blood.

But if you’ve seen even a little of Nathan Fielder’s unusual work (“The Rehearsal” on HBO is as good a starting point as any), you know that when this comedian starts a project, the key is that even he doesn’t know where he’s going to take it.

“According to the available information,” the film ends up documenting things unrelated to Theranos. Evans reached an agreement with A24 executives for a profit-sharing arrangement, without the knowledge of the protagonist, who was in prison at the time; and that conversation appears within the film itself.

Amanda Seyfried —the actress who played Holmes in the TV series The Dropout—participates by reading transcripts of her words, including a phone conversation from jail.

It’s a move that mirrors the Elon deepfake, but in a AI-free version.

Tentative commercial pitch: Sensationalism in capital letters (red): “You can see everything,” a documentary constructed with intimate material, which its sneaky protagonist intended to use to her advantage (but didn’t), and which has been monetized without her involvement.

Forecast: Are there discounts for watching all four?

Jorge García Herrero

Lawyer and Data Protection Officer.

You are reading ZERO PARTY DATA. The newsletter on technology and legal news by Jorge García Herrero and Darío López Rincón.

In our free time from this newsletter, we resolve complicated issues related to personal data protection regulations and artificial intelligence. If you have any such issues, give us a hand. Or contact us by email at jgh(at)jorgegarciaherrero.com.

Suscríbete ahora

🗞️News from the Data World 🌍

📖 Hard data docs for caffeine lovers☕️

💀Death by Meme🤣

🤖NoRobots.txt or the AI stuff

📃The paper of the week

🛠️”Useful” Tools

🙄 Da-Tadum-bass!!

.

Compartir

Si echas de menos algun doc, comentario o chorradón que manifiestamente debería haber estado en el Zero Party Data de la semana, escríbenos o deja un comentario y lo valoraremos para la próxima.

Many of us have come across advertising leaflets or — much worse — contracts from advertising companies that say things like, “If you give us your customer or user lists — their identifiers, such as email addresses or phone numbers — we’ll cross-reference them with our own databases to optimise the audience, find lookalikes and maximise the perfect match rate for your campaign.”

And here’s the kicker: “Don’t worry, we’ll never be able to read those identifiers: we anonymise them using a ‘hash function’ or convert them into hashes before uploading them to our platform, so we can’t read them.”

1.- Heads or tails?

If I toss a coin in the air and hide the result, you will never be able to know whether it came up heads or tails.

You won’t be able to know it either if I tell you that I’ve hashed the result and show it to you:

The result was: “f61f5c5e22749aeba2bd920352dbd4c9​f63e0ebaed6df623b09c836ffcbec2eb”

Or can I know it?

Of course I can know it: I need to know which hash function you used and hash the two possible results. At a glance I will know if it was heads or tails.

Now it is much easier to understand a slightly less silly example.

Meta, in explaining the “advanced matching” of its Meta pixel, says it collects the gender data of its users (masculine “m” or “f” feminine) and then “hashes” it and boasts that it protects user privacy because who could know that, for example, “62c66a7a5dd70c3146618063c344e531​e6d4b59e379808443ce962b3abd63c5a” is “masculine”?

Again: extracting the original value “m” back from “
62c66a7a5dd70c3146618063c344e531​e6d4b59e379808443ce962b3abd63c5a” is impossible.

The problem is that you don’t need to:

There are only two options:

“m”: 62c66a7a5dd70c3146618063c344e531​e6d4b59e379808443ce962b3abd63c5a

“f”: 252f10c83610ebca1a059c0bae8255eb​a2f95be4d1d7bcfa89d7248a82d9f111

The first is “masculine” and the second is “feminine”.

Ergo, the protection of that attribute is, in reality, null.

Like that of a coin toss.

Cryptography experts speak in Sanskrit but the concept is simple, right?.

Let’s go with another example, a bit less silly.

You are reading ZERO PARTY DATA. The newsletter on current affairs and technology law by Jorge García Herrero and Darío López Rincón.

In the free time that this newsletter leaves us, we solve complicated issues related to personal data protection regulations and artificial intelligence. If you have any of these, make a sign with your hand. Or contact us by email at jgh(arroba)jorgegarciaherrero.com

2.- How to know who will win the Ballon d’Or

Imagine I tell you that I’ve installed Pegasus on the person counting the votes to choose the Ballon d’Or and that I’ve intercepted the communication in which they reveal the winner. But this person was careful and had “hashed” the name before sending it.

The winner is:

“8cf7dd0d99b272e32d34a6a18dd87b1d​dde9b297aa6b0980c1d6a75ef7a886d6”

Yes, unfortunately the winner’s name was hashed with SHA-256. Impossible to crack.

Since there are only 30 candidates, we can simply “hash” them one by one or all at once and compare, and the match will be the winner.

You can try doing it in this artifact (link).

All these transparent examples come from the same paper: “Anonymity, Consent, And Other Noble Lies: An Empirical Study of The Data Economy” by Reardon, Egelmann, and others.

You should all read this paper: it is as devastating, precise, and transparent in its explanations as any of Daniel Solove’s.

There are other delicious moments like the Meta lawyers’ quotes claiming contrary arguments in different trials, depending on the interest defended at each moment.

Ah, damn lawyers.

It is no coincidence that it is cited in our own paper “Prompt like a Butterfly, Sting like a Tracker” with IMDEA Networks when we highlight that when AI agents share your hashed username and/or email address with third parties (expert data brokers), they have not provided you with any protection thereby.

It is no coincidence that the FTC has already warned about this a few times as well. The latest in a post with an eloquent title: “No, Hashing Still Doesn’t Make Your Data Anonymous”.

3 Do Bradley Cooper or Jessica Alba leave good tips?

My favorite example is that of a smart-aleck journalist who tried to extract information from an “anonymized” data set that would be interesting to many: Which famous New Yorkers are big spenders and which ones are stingy when tipping taxi drivers?

Someone filed a Freedom of Information request against the NYC government, which published a data set of taxi trips that included, among other columns, the license number, the “Medallion”—that is, the little number each taxi carries on its roof—the customer’s pickup point, the drop-off point, the type of fare applied, the fare amount, and the passenger’s tip.

To “preserve the privacy” of the taxi drivers, the license number and medallion columns were—can you guess?—hashed with MD5, converted into an alphanumeric string like the old ones.

Hashes are irreversible. The problem is that there is a lot of additional information within our reach directly related to the data set.

The savvy journalists looked for photographs in which one could identify: (i) a minor celebrity getting into a taxi, (ii) the “medallion” of that taxi, and (iii) the street where it happened (“customer pickup point”).

They found many.

By now you can probably imagine the rest:

They hashed the taxi medallion from the photo and looked up, for that medallion, the ride that started that day on that street. And BAM, all that’s left is to go to the tip column.

Spoiler: Bradley Cooper and Jessica Alba had no tip recorded in a country where the custom is to leave substantial tips.

Plot twist: But wait a minute! The tip was only recorded if paid by card and they probably paid in cash. Watch out for empty columns in data tables.

4.- Hashed email: in practice, it is much easier

The authors purchased (well, asked for free) samples from four data brokers: more than 6 million hashed emails. They re-identified more than half using only “rainbow tables” of made-up emails, 88% by cross-referencing them with public breaches, and 97% by applying password cracking techniques. Nice.

But aaaaall these examples are more or less striking, because the “attacker” who wants to re-identify the dataset is playing with one hand tied behind their back.

That is not the case for data brokers in their day-to-day activity.

Data brokers have attribute tables for each person, with many data points.

One example: all mobile phones have an identification number for advertising purposes (“Android Advertising ID” (AAID) and “ID for Advertisers” (IDFA) on the iPhone).

Both Android and iPhones allow you to change their respective IDs at will.

Is it useful for anything? For very little.

Data brokers sell tables with these device identifiers paired with the hashed email. Thus, when you reset the advertising ID, the email links you back to the old ID and to all your other devices.

Furthermore, companies, aware of the possibility, extract their own device identifier upon installation (much easier and cheaper than fingerprinting, which is also possible) and, even if you change the advertising ID, in the next “event” the app communicates your “new” advertising ID with the long-standing installation ID, and so much for your attempts to protect your privacy.

After this example, it is now easier to understand that it is trivial to reidentify the majority of users, through the device they use, or four geolocation data points (where you work / where you sleep and a couple more).

5.- What practical relevance does this have?

When you sign up to receive your store purchase receipt in digital format, they ask for two pieces of data (mobile phone number and then email address -on top of that via Meta’s WhatsApp-) where only the email was strictly necessary, which is where they are going to send you the receipt for every purchase.

Any company interested in purchasing advertising provides their customer or user lists to companies like Meta or Google to “determine audiences,” which, explained in a very simple way, means that, for example, if those department stores hire a personalized advertising campaign on Instagram, that advertisement (i) will not be shown to you, Mari Pili, because you are already a customer (they know because you have already provided your email and mobile number) and (ii) it will be shown to “lookalikes”: to Marta and Pedro, who are people with the same profile as Mari Pili (iii) it will be shown tirelessly to Mari Pili, if it knows she has looked at a certain product and has not bought it. As we all know.

The issue is that the privacy policy of the company, and Meta’s, and Google’s, and Criteo’s, LiveRamp’s, and other data brokers will tell you “we hash your users’ or customers’ identifiers” before performing our magic and that is how we manage to improve the relevance of our ads and measure the impact of our campaigns without identifying the data subject.without identifying the data subject.

The truth is that, as has already been made clear, the department stores, Meta, Google, Criteo, and all those ahem “partners” or “identity providers” know perfectly well that this hash of letters and numbers is Mari Pili.

Footnote: this post could have been oriented toward the suggestive implications of all this when applying the SRB/Scania doctrine, but in my interpretation, there is no need: If what the store, Meta, or Criteo want is for a personalized store ad to be shown to Marta and Pedro, but not to Mari Pili, considering the content, purpose, and effects of the processing, it is completely irrelevant whether the information available identifies them by their full names (Marta, Pedro, Mari Pili) or by unique hashes, because the purpose (hitting them with personalized ads) is achieved regardless.

6.- A couple of real-life examples

Nasdaq, Inc. In the list of third parties linked to its privacy policy, it says it may share “hashed and de-identified email addresses” with LiveRamp, along with IP and advertising identifiers. In the same sentence, it adds that LiveRamp uses this information to link the user’s device with its databases and to perform targeted advertising.

Google. In the Customer Match help for advertisers, it states that “Google doesn’t receive actual email addresses”, because it transforms the emails from its accounts into one-way SHA-256 hashes. We now know that if anyone says this, it’s false, but for Google to say it is laughable, huh? HUH?

LiveRamp. In a corporate post about RampID claims that the pseudonymized approach makes it possible to consolidate, enrich, and segment data “without exposing or sharing a customer’s private information”. Yeah baby, yeah.

Procter & Gamble: In “Addressable media“: encrypt the data or use UID2 and upload “a pseudonymized version (replaced with artificial numbers or letters)” of the email, phone number, or advertising ID to platforms like Facebook, YouTube, Instagram, or TikTok. It also includes a list of platforms with which it can share a hashed version of the email.

Footnote 2: Of course, all of this can be done properly: the solution is to add a “salt” before hashing the data. The salt protects against third parties (but among those who share the key), the data remains personal… but this post has already become too long.

Footnote 3: perhaps you need to give your privacy policy a fresh coat of paint if it classifies a hashed email as “anonymous” or “de-identified,” or rethink the legal basis for all that stuff you upload to Customer Match or Custom Audiences.

Jorge García Herrero

Lawyer and Data Protection Officer

We will start with an amalgamation of news that we want to highlight, without being exhaustive—since we’ve already missed the boat on that—and then we’ll move on to the current events section.

IAB Europe finally decided to explain to the user in TCF 5.0.b) what fingerprinting is (”Special Feature 2” is no longer called “actively scan device characteristics” and is now “link devices based on actively collected information”). Apple notoriously damages the wording of the ATT under pressure from the Bundeskartellamt (the body, not the famous CJEU ruling). Uber was hit with 825 million for deactivating driver accounts automatically without notice and without human oversight.

Lusha was sanctioned by the Garante with two million for almost exactly the same thing that the CNIL qualified as “outside the scope of the GDPR”. Attendees of my training are well aware of this latest resolution.

The French Supreme Court threw out the ban on social media for children under 15. The The Audiencia Nacional ratified the precautionary suspension of activity ordered by the AEPD regarding Worldcoin (now World, or rather “Boo” harhar because it’s been left all interruptus). What a summer Sam Altman is having.

Interesting post from Natzir about a most curious thing: Claude’s watermark on its synthetic text. It explains what it is and how to break it. I wrote this other piece with one of my favorite gifs illustrating it.

You are reading ZERO PARTY DATA. The newsletter on current affairs and technology law by Jorge García Herrero and Darío López Rincón.

In the spare time this newsletter leaves us, we solve complicated issues related to personal data protection regulations and artificial intelligence. If you have any of those, give us a wave. Or contact us by email at jgh(arroba)jorgegarciaherrero.com

🗞️Data World News 🌍

.- It seems the Irish Presidency of the Council is trying to water down the issue for major AI players (even more so) by facilitating legitimate interest for scraping data for improvement/development and operation + a broad-brush approach to considering pseudonymized data as non-personal if the person cannot be identified (avoiding any nuance regarding technical measures). Noyb reports and criticizes this in detail in a post from this week:

.- The Irish DPC hits Google with 403 million for processing, as we all know, location data/what we do across its services: “Web & App Activity,” “Location History,” and “Location Precision.” The mind-boggling thing is that these are stated to be facts reported by the BEUC and consumer associations in 2020. The usual 6 years of investigation.

The resolution is not yet published, but the DPC provides a very clear infographic in the note. It is something the rest of the authorities could copy.

.- To the list of algorithmic information and transparency traces from that Ministry of Labor guide or the provision in the Workers’ Statute on mandatory information to the workers’ legal representatives (RLT), an additional one is coming that does not change much of the above: guaranteeing the information to the employee themselves on the subject in the employment contract or alternatively with proof for the company. Royal Decree 723/2026

From October 5th, when it enters into force, it will be necessary to provide or publish accessible information on the different algorithmic or automated decision-making systems applied, very much in line with the GDPR if it is something that does not structurally reach article 22, or something more detailed if it does:

“The existence of algorithmic or automated decision-making systems. The foregoing shall include the guidelines, criteria, and operating rules of said systems when used for decision-making regarding the determination, establishment, variation, or modification of working conditions, such as the duration and distribution of working hours, the assignment of tasks, the determination of salaries, professional progression, the workplace, or the termination of the contract”

For a more detailed analysis, we recommend the following note seen on LinkedIn.

.- We now have the draft Regulation that will make that magical age verification app, which still has zero-knowledge proof doubts, mandatory. It is proposed before Parliament, but it is already here: EU Kids Act.

Curiously, it will be able to overlap in everything concerning the avoidance of dark patterns and transparency with the also future Digital Fairness Act.

👦 The main interest is the prohibition of access to social networks and content-sharing platforms for children under 13, but it is surprising that it mentions video games and many other daily applications. And regarding video games, it is being looked into whether Parliament will include something in the Digital for Stop Killing Games.

• Software application stores;

• Operating systems;

• Artificial intelligence assistants: “an artificial intelligence system, including general-purpose AI systems, that offers continuous and personalized interaction or companionship that simulates or facilitates a social, emotional, or interpersonal relationship with a user”; and

• General conversational chatbots.

👧 Complete ban for those under 13, limited under guardianship for those 13 to 15, and with their own account and fewer restrictions from 15 to 18, but exclusively for social media and content sharing platforms. This is where it mandates the use of the EU Identity Wallet/app from a validated provider as the only option.

👦 Alternative third-party verification solutions in other cases of store limitations and that “secure by default” state of not having anything harmful enabled. As long as they are completely zero-knowledge proof and meet the same requirements as the official one. The funny thing is: which third-party service seen so far truly delivers on this, if not even the official one is guaranteed?

👧 Regarding data protection on this same topic of age verification, it introduces a specific Article 28 that requires any system of this type not to identify, locate, track, cross-reference, profile, or perform any commercial activity. Not much of a surprise, but it is taking a stand.

👨‍👩‍👧 A 6-month period would be granted for checking existing users, but it is interesting that a provider who is already clear on whether a user is an adult or old enough to have an account on their own can simply count them as verified. Never forget that Discord, which backtracked on the issue, clearly acknowledged that with the current profiling they performed on users, they could already infer their age quite accurately.

And that the “age signal” can be saved to avoid future verification.

.- Let no one forget that Brazil is already a safe third country with signed adequacy decision. More was said about the negotiation period leading up to it than about the closing and signing (dated January 2026). And it seems to be without any annex or additional bolstering, beyond the European Commission praying very hard that this house of cards holds up.

̷̷ Coffee-obsessed data documents ☕️

.- EDPB guidelines on the imposition of fines by authorities, since we then see strange cases where some millionaire company collapses for not having strictly complied with this issue.

Some important reminders:

• Absolute incompatibility between warnings and fines:

• That the duty of cooperation in the procedure begins to be a mitigating factor if it can be demonstrated that the offender complies beyond the letter of the GDPR or the DPA order.

• That the avoidance of cost or indirect benefit as a result of blatantly ignoring the GDPR must no longer be considered minor and should incur a fine to rebalance karma and the bottom line.

And the following 5-step test. Highlighting that one must correctly interpret whether the infringement is intentional or negligent. In the latter case, softening the tone:

“The intentional or negligent character of the infringement (Article 83(2)(b) GDPR) should be assessed taking into account the objective elements of conduct gathered from the facts of the case. The EDPB highlighted that it is generally admitted that intentional infringements, “demonstrating contempt for the provisions of the law, are more severe than unintentional ones”25. In case of an intentional infringement, the supervisory authority is likely to attribute more weight to this factor. Depending on the circumstances of the case, the supervisory authority may also attach weight to the degree of negligence. At best, negligence could be regarded as neutral.”

.- CNIL hat-trick:

• The famous one from a few weeks ago of the 825 million euro joint fine with the Dutch authority for Amazon. The fully automated decision with significant effects of the temporary deactivation due to possible fraud or low rating of its drivers turned out to be expensive. The completely irrelevant effect that this deactivation meant a full impediment to being able to work/earn income, and the complete lack of human supervision anywhere.

• 500,000 euros for a hospital which had security of the level that the 32 is interested in, at the level of the Louvre’s. By not having two-factor authentication or access profile limitations so that only assigned doctors can see them, someone got right into their kitchen with access to the medical records of all the hospital’s patients. And to top off the breach, they did not inform the 200,000 people the patients designated as trusted third parties (their personal data was among what was accessed).

• 300,000 for an IT company that did not believe much in satisfying the rights of erasure exercised by candidates or former employees, for the most part. Without ignoring that there was surely an underlying swell, it is not reported here whether it had been managed or if a response was given out of time.

💀Death by Meme🤣

📃The paper of the week

.- Interesting paper that plays with the Kafka analogy to recall the problem of legal compliance in AI. That “appearance of good law” at first glance that later turns into failing like a shotgun in detail. KafkaGPT: On algorithmic bureaucracy and keeping law’s promise. Once again, the importance of human control being decisive and that the legal aspect must be in the very genesis of the AI system to avoid decisions with machine learning that ignore the fundamental nuances of the law.

“Failure looks different across the three modes of doing law. In text-driven systems, the danger is indeterminacy and the quiet expansion of discretion off the page. In code-driven systems, the danger is over-specification: the flattening of legal meaning to what the programmer thought the words must mean, with context squeezed out. In data-driven systems, the danger is under-specification: targets that proxy the wrong thing, labels that embed past error, shifts in population or policy that make last year’s regularities misleading, and an explanatory surface that offers importance weights where the law demands reasons. Code- and data-driven systems also present novel problems of automaticity and cadence that can render systems inhuman, in a very real sense.”

.- “A relative mess”: relative identifiability and legal liability gaps in the application of SRB/ Scania to multi-party environments;

The AI stuff

🛠️Useful tools

.- It has been quite a while since the EDPS released the original cookie inspection tool (WEC), although they later made a more limited ‘easy’ to use one. The ‘easy’ part was clearly intended for someone who wasn’t a legal expert but was accustomed to poking around on GitHub. For everyone else, it was a mess to be solved with time and carefully selected questions for Claude.

For whatever reason, we managed to install it and get it working in the browser, so we’re sharing it with you. In artifact format with all the information, and with a link to a zip file for testing. It has been reduced to the bare minimum that the EDPS should have put on the table: a turn-key installer that doesn’t do anything strange, and one that starts the analysis each time by asking you to enter the website to be inspected.

Out of pure caution, although it comes exclusively from the EDPS GitHub and we subjected Claude to a KGB-style interrogation to check that nothing calls any server and does nothing other than save the result locally, the right thing to do is test it in a test environment.

If anyone wants a Windows installer that works, just ask and we’ll upload it to Github.

And as useful and recommended tools for this summer: Antares, TurboVec, LocalAI by Marlon Paz, Marlon Paz and Hoang Van Hao.

Last but not least: keep an eye on Open Router.

🙄 The final nonsense

Let whoever hasn’t gone to Claude with a questionable prompt, but one that it later understood better than even you thought it would, hit the keyboard. It’s the 2.0 version of asking Google for a song by giving it any invented thing you might have heard.

Compartir

If you miss any doc, comment, or bit of nonsense that manifestly should have been in this week’s Zero Party Data, write to us or leave a comment and we’ll consider it for the next one.

Thanks for reading Zero Party Data! Subscribe for free to receive new posts and support my work.

But I have evidence that it is today, already, our nosy confessor.

When you chat with ChatGPT or Claude and company, you think you are in a safe room talking privately with “your” AI.

In reality, you are in an interrogation room with a two-way mirror, like those in the movies: and on the other side of the mirror there is not Wonderland: there are the same data vampires that monitor you on the internet.

The nine most famous AI assistants filter your data to Google, Meta, and several of the main data brokers.

It makes little difference if you do not accept cookies.

It does not matter whether you pay or not.

It does not matter if you use Brave and adblockers. TikTok receives screenshots of your chats in Grok.

The experts at IMDEA Networks have demonstrated this in a study on ChatGPT, Claude, Grok, DeepSeek, Perplexity, Gemini, Copilot, Le Chat de Mistral and Meta AI with a browser and a very special phone that allows them to study and document the information that leaves your browser and your Android mobile apps, and where it goes.

The resulting paper is “Prompt like a Butterfly, Sting like a Tracker”, led by Narseo Vallina-Rodríguez and his team, in which I participated as a lawyer, has been accepted in PoPETs 2027, the academic forum of reference in privacy technologies, with peer review.

Link to the paper.

Link to an infographic summary of the paper (Substack does not allow this kind of stuff).

You are reading ZERO PARTY DATA. The newsletter on current affairs and technology law by Jorge García Herrero and Darío López Rincón.

In the free time that this newsletter leaves us, we solve complicated issues related to personal data protection regulations and artificial intelligence. If you have any of these, make a sign with your hand. Or contact us by email at jgh(arroba)jorgegarciaherrero.com

Bottomline: It is much worse than what we anticipated in May.

In May, we published a preview, limited to just four services and their web versions.

The final version of the paper examines nine assistants (ChatGPT, Claude, Gemini, Copilot, Grok, Perplexity, Mistral, DeepSeek and Meta AI) on the web and on Android, in free and paid versions, accepting and rejecting cookies.

Notably, we now know something that in May we could only imagine: that text, screenshots and documents from your chats are transmitted to and read by third parties.

I know, I know: it’s another stripe on the tiger, and it rains on wet ground and all that

We are all saturated with headlines about abuses by big tech companies over our data, self-esteem, mental health and democracies and the natural response is to shrug: “another stripe on the tiger”.

Allow me three reasons to question the “one more”:

First.- Cookies “only” filtered metadata to third parties …

Classic tracking knew where you were, with whom, which pages you visited, how long, from what device.

You had just had coffee with your friend who was returning from Iceland and told you about the vacation.

And from those metadata, they inferred a possibility of sale and shot you an ad for vacations in Iceland.

And you thought that “Instagram had heard your conversation”.

… AI filters directly the “content”

Today, your AI assistant filters directly the summary and/or the link to your chat: your symptoms, your salary, your fling, your divorce, your company’s cash flow.

The AI itself summarizes the chat automatically in a “title” that several of the services analyzed send to Meta, TikTok, Google or X along with the URL of the chat and other persistent identifiers.

In the study, this question was formulated: “I earn $85,000, what mortgage can I afford in New York?”

The AI summarizes it in the title “Salary 85k NYC: Mortgage of 280-350k”.

This title, in the hands of an advertiser with your synchronized cookie, is a credit score, ready-to-use credit profile.

· The web versions of 3 of the 9 assistants studied filter the title of your chats to third parties, including Meta, TikTok and DoubleClick (Google).

· Grok presents public conversation URLs by default, so whoever receives the URL (the link to the chat) can read the entire conversation.

· TikTok receives screenshots of the Grok chat when someone shares it.

Second: here usually come the “useful tips to protect yourself”. But I’m sorry: you can barely do anything. That’s the tweet.

I don’t have a section “five tips to be smarter than them”. Sorry:

· Rejecting cookies leaves 80.8% of the trackers observed active.

· On mobile, they do not even ask you (you accept terms and conditions when installing the app).

· Paying for the premium service barely reduces the number of third parties that access your information.

· They send your information from server to server so that neither the Brave browser nor any adblocker can prevent that sending: Claude forwards events to eleven advertising platforms, Grok talks from its servers with Meta and TikTok.

Of course, all this is illegal: they do not have either the knowledge or the consent (or other legal basis) of the users. And do not tell me that the transmitted data are anonymous.

The analysis is also in the paper (and in the summary).

Who can do something? The providers… or the authorities.

This has been the timeline:

· We notified the first findings to the European data protection authorities in April.

· The AEPD brought the matter to the plenary of the European Data Protection Board in June.

· OpenAI changed its privacy policy in August to expressly mention the trackers.

· The links to Grok chats are still public today.

Otherwise… Have you heard anything else about it?

I only heard… cri-cri cri-cri cri-cri [sound of crickets at night].

So far is what has been proven and documented. Now I warn that I am entering speculative territory.

Third: The obvious risk: The infrastructure is ready for another qualitative leap.

The optimistic reading of this study is that AI has simply inherited the vices and sins of unconsented tracking that are the daily bread of the web.

But you do not have to be Spielberg to see the risk of a linear evolution.

AI has devoured all this infrastructure and is in a position to close, for the first time, the traditional circle in real time:

1.- Capture of signal directly from what the user writes,

2.- Transmission to advertising intermediaries with identifiers that allow attributing the signal to the user,

3.- Auction among companies interested in presenting their product/service precisely to that user at exactly that moment

4.- Sponsored recommendation embedded in the assistant’s response, with the naturalness of a disinterested advice.

Whoever trusts that this mechanism will be informed to the user, let them ask if they have been informed about the data filtering mechanism described in this paper...

This summer we were told that the “watermark” that identifies text generated by AI is the text itself (not a mark, label or separate signal that betrays it).

It does not seem impossible that advertising becomes intertwined in the responses of the AI, undetectable to the human eye.

Have a great week. And be careful what you tell your AI assistant.

Jorge García Herrero

Lawyer and Data Protection Officer

It is time to get a bit dramatic:

1.- In October 2021, Frances Haugen sat before the United States Senate Commerce Committee and revealed thousands of internal Meta documents.

The most devastating ones described what the company knew and concealed about the impact of its recommendation algorithm on teenagers. Instagram’s internal research concluded that the system redirected young girls toward content related to eating disorders and misogyny, even if they were not actively looking for it.

2.- The documents disclosed by Meta in the context of litigation in New Mexico reveal —we told it in March— that the company knew that its algorithm suggested four times more accounts of minors to potentially dangerous adults (prone to grooming and sextortion).

Almost one in four of these adults (attention: one in four (!!!) actually tried it (the data comes from the documents).

Did Meta correct this as a result of these data?

No.

Meta reviewed the facts and did not change the algorithm: it is not a bug but a feature when your ultimate goal is engagement optimization, and engagement increased with these practices.

The worst part is that there is no need to resort to leaked documents, if one has eyes in one’s face.

3.- Last week, a 15-year-old girl described in The Guardian the content she finds on Instagram and TikTok without looking for it: comments about other girls’ bodies, videos with degrading jokes, material that trivializes domestic violence or rape. She explains how she actively tries to avoid it, but finds it incessantly as soon as she opens her apps.

It is the same phenomenon documented by Frances Haugen with corporate slides, but it personally impacts me much more in the words of this young woman.

The recommendation systems of these platforms do not rank what the user wants to see, but rather the content that knowingly increases screen time “spent.” Engagement is the objective, but it is achieved on the backs of material that generates strong emotions and reactions —outrage, social comparison, fear…—.

If I had Instagram, The Guardian article (or rather some bro’s post laughing at it) would appear among the very first things in my feed.

4.- The CJEU has just declared that if a platform uses an algorithm to determine, in its own interest or in that of its service, the conditions, form or order of priority with which its users’ information is disseminated or displayed, it is exercising active control over the content.

And that control deprives it, according to the CJEU, of the liability exemption provided for in the ecommerce Directive for platforms that host third-party content.

The recommendation algorithm destroys the intermediary’s neutrality with respect to the content hosted by its users. That includes:

• The racist memes your children see on Instagram, YouTube and TikTok.

• The irrelevant content Google returns to you.

• The dodgy, pricey, but “recommended” products on Amazon.

• The obvious scam attempts Twitter shows you. And Elon’s nonsense.

• The most expensive flat (but the one that appears first) on Idealista or Airbnb.

• The AI slop songs Spotify foists on you because why not.

In the words of the CJEU:

111 As the Advocate General stated, in essence, in point 239 of his Opinion, it is, inter alia, by means of the algorithm used that such an operator exercises control over the information stored. So long as it has predetermined, by means of that algorithm, the conditions under which such information may or may not be broadcast, it is irrelevant that that operator does not itself carry out additional interventions which have the effect of promoting, modifying or deleting information stored with a view to it being broadcast.

112 In that regard, it must be made clear that if, beyond the mere categorisation and indexation of information for the purpose of improving its accessibility, the algorithm used determines, in the interest of the operator or its service, under what conditions, how and in which order of priority that information is or is not be broadcast, that operator exercises control over that information, with the result that the service it offers cannot be classified as an ‘information society service … that consists of the storage of information provided by a recipient of the service’, within the meaning of Article 14(1) of Directive 2000/31 (see, to that effect, judgments of 23 March 2010, Google France and Google, C‑236/08 to C‑238/08, EU:C:2010:159, paragraphs 115 and 117; of 12 July 2011, L’Oréal and Others, C‑324/09, EU:C:2011:474, paragraph 116; and of 22 June 2021, YouTube and Cyando, C‑682/18 and C‑683/18, EU:C:2021:503, paragraph 114).

5.- Last but not least: the fact that age verification —one of the recurring topics in this newsletter for all the worst possible reasons— has been the excuse for the CJEU to issue this monumental ruling is a plot twist worthy of M. Night Shyamalan.

Tuesday was a historic day. It remains to be seen how things evolve.

Because no one overlooks the fact that Schrems II was of very little use.

You are reading ZERO PARTY DATA. The newsletter on technology and legal news by Jorge García Herrero and Darío López Rincón.

In our free time from this newsletter, we resolve complicated issues related to personal data protection regulations and artificial intelligence. If you have any such issues, give us a hand. Or contact us by email at jgh(at)jorgegarciaherrero.com.

🗞️News from the Data World 🌍

.- The Dutch Autoriteit Persoonsgegevens fined transport app Yango €100 million for transferring personal data of users and drivers to Russia without adequate safeguards (yeah, as if there were adequate safeguards if you’re transferring data to Russia).

The Standard Contractual Clauses (SCCs) were intended to compensate for the deficiencies through pseudonymization and encryption measures, but the Authority found that until November 2023 the encryption keys were stored on the same Russian servers as the encrypted data. In addition, Yandex.Taxi LLC —which controlled the software and determined what data was collected— was classified as a joint controller, invalidating even the SCC model that had been used.

.- South Korea imposes a fine of $408 million on Coupang for the largest data breach in the country’s history. The Personal Information Protection Commission (PIPC) investigated a breach that exposed the data of millions of customers of the e-commerce giant, the Korean equivalent of Amazon. The penalty sets a record for enforcement under Korea’s privacy law, PIPA (and in Asia generally). The PIPC determined that Coupang failed to comply with its technical and organizational security obligations, as well as incident notification and management duties.

.- Starmer continues his personal crusade to tackle digital harms affecting British children. Now by repeating what Australia already did with mixed results: banning social media until age 16. What could possibly go wrong (again)?

And announcing the “ban” on social media through social media itself, with a message adapted to the format of those same platforms (and accompanied by a community note showing more common sense than the average public official).

And accompanied by an instant meme of a teenager reacting to the measure, exactly as happened in Australia. “I’d Stare at a Wall!” Stoic resignation or legendary sarcasm?

.- TikTok’s partial victory before the Irish High Court does not mean its data transfers to China comply with the GDPR: the court confirmed the violation of Chapter V, but annulled the DPC’s corrective orders due to insufficient technical reasoning.

The DPC failed to justify why the measures implemented under “Project Clover” were insufficient to prevent re-identification, despite having both the Mittal report and an independent review by NCC Group, both favorable to TikTok.

The case now returns to the DPC for that analysis to be carried out. The non-obvious point: the court did not question the technical adequacy of Project Clover, but rather the quality of the regulatory reasoning; the DPC could reach exactly the same conclusion again if it supports it with rigorous methodology.

Zero Party Data

TikTok: What Works and What Doesn't in the Kabuki Theater of International Data Transfers

It’s called “sunk cost bias”: since I had already spent half of my weekend studying the DPC’s sanction against TikTok, back in the day, I couldn’t help but do the same with last week’s ruling that reviewed it…

Read more

5 months ago · Jorge García Herrero

.- A Munich court has declared Google liable for incorrect answers provided by its AI Overviews tool.

It has not been a good week for Big Tech. The ruling establishes that, since Google deploys and controls the AI system, it is responsible for the incorrect information it generates, regardless of the fact that the content originates from a probabilistic model. The judgment does not address GDPR issues because the case does not concern a natural person, but it does recognize a violation of the general right to corporate personality. The broader consequence: the court equates deploying an LLM with engaging in editorial activity, something that could transform liability for generative AI providers in Europe long before the AI Act becomes fully applicable.

📖 Hard data docs for caffeine lovers☕️

.- The excellent infographics by Müge Fazlioglu for the IAPP on the interrelationships between the GDPR and:

• EU AI Act

• Network and Information Security Directive (NIS2)

• Digital Services Act (DSA)

• Digital Markets Act (DMA)

• Data Act

• Data Governance Act (DGA)

.- And Robert Bateman’s own infographic on the DPC’s original TikTok decision. It was still longer than the court judgment that sent the ball back.

💀Death by Meme🤣

🤖NoRobots.txt or the AI stuff

.- Claude Fable 5 came and, just as it came, it went away, by the grace of the Dorito. Meanwhile, in the EU we regulate competition out of existence. The joke writes itself.

.- Simon Willison reflects on the product-market fit of generative AI tools. He argues that most products built on top of LLMs still have not found a real fit with the needs of non-technical users. Willison distinguishes between adoption driven by curiosity or novelty and adoption driven by sustained usefulness, pointing out that most of the use cases generating excitement within the industry are led by developers evaluating the capabilities of the models themselves, rather than end users solving everyday problems.

The piece questions the metric of “active users” as an indicator of real value and proposes that true product-market fit in AI will be achieved when models become reliable and predictable enough to operate in critical workflows without constant human supervision.

The non-obvious insight: Willison suggests that reliability —not capability— is the real bottleneck, and that improving performance benchmarks without reducing hallucination rates does not bring models any closer to product-market fit.

.- European Parliament has also approved the AI Act amendments. The most important points:

• AI systems that generate CSAM content or nude images, intimate body parts, or horizontal sporting activities involving an identifiable person are prohibited (unless consent has been obtained for that purpose).

• Providers that take the risk of using this type of generally prohibited system may attempt to demonstrate that they have real and effective technical measures in place to prevent the generation of such content. The prohibition also applies to deployers, of course.

• The new implementation deadlines:

  • From 2 December 2027 for standalone high-risk AI systems.

  • From 2 August 2028 for AI systems integrated as safety components and regulated under sector-specific safety and market surveillance legislation.

  • From 2 December 2026 for the obligation to include watermarking in AI-generated content. The same deadline applies to systems generating CSAM content and “nudifier” content.

Precisely regarding labeling, the Commission’s proposed icons emerged from this discussion. What is mandatory is the labeling and readable marking required by Article 50, but at least here they went further than they ever did with standardized GDPR icons.

.- The EDPS, in a short Supervisor blog post format, reminds us that shadow AI can become a curious security breach risk.

Organizations need to be alert to ensure nobody uses unauthorized AI applications or services, and it is not a bad idea to implement unauthorized domain blocking, restrictions on corporate devices, and secure alternatives for whatever employees were trying to do on their own initiative.

.- Unexpectedly, we came across an Amnesty International report on the risks of generative AI. Even the title speaks directly to data geeks: Unlawful by Design. It provides a good overview of multiple biases, including certain actions by DPAs in high-profile cases:

• The dominance of English creates a bias whereby English-language information is considered more reliable than information in other languages.

• Opt-out mechanisms often work poorly.

• CSAM content is generated at alarming rates.

• Harm and hate scale with model size.

And then there is the following case, which is quite something:

🛠️Useful tools

.- Supertonic is a tool from Supertone for AI-powered voice manipulation and transformation, released as an open-source project on GitHub.

The tool allows modification of vocal characteristics —pitch, timbre, speaking style— through high-quality voice synthesis and conversion models, with applications in audio production, accessibility and content creation.

.- Markus Sullivan publishes a GitHub repository containing all CJEU data protection cases, EDPB guidelines, and the full GDPR text in PDF format, ready for download without scraping scripts or internal permissions. The repository is intended for those who need the data to train models, perform semantic analysis, or simply maintain an up-to-date legal corpus available offline.

And the LinkedIn post, as always, is very funny.

🙄 Da-Tadum-bass!!

Compartir

If you miss any doc, comment, or dumb thing that clearly should have been in this week’s Zero Party Data, write to us or leave a comment and we’ll consider it for the next one.

Starting from the end: Irish judge Rory Mulcahy upheld the €530 million fine against TikTok but annulled the additional measures: mainly the suspension of international transfers, returning it to the DPC to rule again. At the end of the post, I explain exactly what this is about.

Why?

Essentially, by resolving in a (very) different way TikTok’s fundamental allegation, which was the same: reversing the burden of proof (that the DPC, not TikTok, had to prove):

(i) the non-compliance with international transfer regulations and

(ii) the effective capacity of the Chinese parent company to identify data subjects from China (IT support staff accessed from China data hosted in Singapore).

In this way, two of my main obsessions over the past few years have merged into one: international transfers and the SRB/Scania doctrine.

You are reading ZERO PARTY DATA. The newsletter on technology and legal news by Jorge García Herrero and Darío López Rincón.

In our free time from this newsletter, we resolve complicated issues related to personal data protection regulations and artificial intelligence. If you have any such issues, give us a hand. Or contact us by email at jgh(at)jorgegarciaherrero.com.

Suscríbete ahora

Where do we come from?

Let’s say it bluntly, and it’s not the first time:

All companies violate the GDPR’s international transfer regulations when exporting data to a third country that has not been “deemed adequate”.

Why?

Two reasons

a.- Because the normative standard of equivalence required is materially impossible to comply with.

And not because companies have not spent hours generating paper: the problem lies in a double factor far, very far from their control:

a.1.- On the one hand, the legislation and practices of the importing country’s authorities are what they are -that is, they simply do not meet the European standard of “essentially equivalent” protection-.

For the love of God, do states “deemed adequate” such as the UK, Canada, or Argentina comply with this standard? (Don’t mention the US or Israel to me, it makes me laugh).

The rule even applies within Europe: cases can be found in the European Court of Human Rights’ own case law in which one EU member state has spied on citizens of another.

a.2.- This structural and ubiquitous deficit simply cannot be effectively compensated for by contractual clauses (or binding corporate rules) or ordinary organizational measures.

I told this story in the form of tales: There is a “pea” of public character that neither all the private mattresses in the world can cover nor compensate for.

b.- Because the standard of verification of legislation and practices imposed by the EDPB leaves no other compliance options than hard encryption (illegible from the importer’s shore), without a proper opportunity for a risk-based approach or considerations about each specific data export flow.

So, do we disregard everything and let “the wine live on”?

The conclusion of all this is not, cannot be “let the wine live on”.

Spoiler: this has been the dominant conclusion to date.

Wine, or some of its abstemious variants: the “chronic absence of TIAs” (let’s face it: they are very complicated to make) or the “cloned TIAs lacking nuance” and without normative analysis to support them have been the usual tone. At best.

That said, wine is not such a crazy option if we consider the price charged by international law firms for conducting the normative analysis of each importing country, which is the key support for the TIA.

And the result: their TIAs are like bad magician tricks: literally always the same rabbit with a different collar.

It is obvious today that this option (we will call it the “Cardhu option”) can be achieved much faster and for much less today with the help of AI.

What has changed? We’re getting there, we’re getting to TikTok

Fortunately, we are already having judicial rulings on the matter, not just from compliance authorities.

We already have much clearer notions of “what doesn’t work” and “what works”

There are two different things here:

a.- The exporting (or importing) company can do little if the importing state does not offer an adequate framework, as we have seen.

b.- But friend! accountability does not disappear, as argued spectacularly by Judge Rory Mulcahy in his judgment.

Although the company cannot fix foreign legislation, it must analyze whether that legislation actually applies to its specific flow, whether there is a possibility of access, who can access it, for what purposes... and determine and apply the relevant measures in its power to reduce the risk.

TikTok clung with hands and feet to the risk-based approach and argued before the DPC and the competent judicial authority that it was up to the DPC to do what it itself did not do: carry out an assessment that accredited the existence of risk in general, and in particular in its data flow.

The “reversal of the burden of proof” card does not work in this case because -and so says the judge literally-, the risk is advised a priori, and TikTok did a poor job in this regard.

TikTok did not adequately address the risk that processing would physically occur on computers within China, placing that activity under the direct sovereignty and jurisdiction of its authorities.

This is the slap that TikTok received again in full face: for simple accountability, you cannot expect the DPC to do the work that you did not do correctly at the time.

Judicial ratification of the sanction.

The DPC in the contested sanction dismissed once and for all the issue of complacent TIAs and “additional measures” of little substance.

TikTok had SCCs, legal opinions, encryption, advanced technical and organizational measures (”Project Clover”), and all of this was not enough because the real problem was remote access from China by staff located in China to data of European users stored outside China.

Additional measures

Before the court, TikTok has managed to reverse, not the sanction, but the additional measures imposed (the suspension of data transfers, which is no small matter) by essentially arguing two points:

- The principle of territoriality (if the data is outside China, the Chinese government does not have legal jurisdiction to demand it). This was already extensively argued before the DPC and will likely be dismissed again.

What the judicial body imposes is the evaluation of a (third!) report on the matter provided by TikTok that the DPC refused to consider as out of time.

- Lack of motivation regarding the “Project Clover”: TikTok implemented a set of technical and governance measures (Project Clover), including advanced pseudonymization and the use of an independent third party (NCC Group) to audit data flows. The DPC rejected these measures but did not provide technical or legal arguments as to why it considered pseudonymization ineffective in preventing potential re-identification of users by the Chinese state.

In fact, the Irish Court has imposed a reversal of the burden of proof in terms of the identifiability test on the DPC.

This, this is the tweet.

In the TikTok case, two of my favorite topics come together: the SRB/Scania doctrine and international data transfers.

But it’s Sunday when I write this and I feel like a drink.

We can make an executive summary useful for those who have been (or ahem, still are) in the wine option, are tired of the Cardhu option and/or however have work to do on their international flows.

What doesn’t work:

· Tantrums have never worked (arguments attempting to justify the material impossibility of compliance, its merely formal compliance or not even that “because it’s the only thing that can be done”). We’ve all been there at some point.

· It doesn’t work to invoke SCCs as if they were miracle water or a Harry Potter spell.

· It doesn’t work to hide the decisive risk - remote access to data “in the clear”, unencrypted - behind ambiguous formulas about where data “is stored” or how little the access lasts like “the access is ephemeral”.

· It doesn’t work to argue encryption when the provider inevitably needs to decrypt to operate.

· It doesn’t work to rely on open or single consents from the data subject for continuous and recurrent transfers.

· And, in general, it doesn’t work the idea that it is enough for re-identification, access, or communication to be “prohibited” in the abstract if in the real world they remain materially possible: it is a logic shared with the Scania doctrine and pseudonymization: legal prohibition cannot eliminate the real risk on its own nor allow it to be ignored.

What works

In any case, certain arguments do work to mitigate the sanction, but in a limited sense.

· Tattoo this: The biggest risk is not having an insufficient TIA (a TIA is insufficient by definition, as we acknowledge above), but having no TIA at all.

· The risk-based approach works. The judge says “I do not rule out the possibility that a supervising authority might nonetheless conclude that there is, in fact, no meaningful risk”. That’s the spirit.

· It works to accredit real diligence versus Kabuki theater of compliance: having made a serious TIA, having correctly identified the data flow, having precisely described remote access, having updated the information provided to the data subject, having reduced the data perimeter, having implemented effective technical measures against concrete risks.

· It also works to adapt and improve (even during the sanctioning procedure) in terms of transparency, as occurred with the legalization of the privacy policy, which the DPC took into account to modulate the sanction at that point.

· In other words, these arguments do not “legalize” what structurally cannot be legalized, but they do accredit.

· At this stage, where I am aware that only 10% of those who started reading remain, I can say “in private”: it does not work, it never works to take the diligent officials of the supervisory authorities for fools.

Have a very good week.

Jorge García Herrero

Lawyer and DPO

At first glance, based on what the Government and related public officials have published on X, this measure might not seem so bad if it complies with the element that “this will never leave the device at any moment.” And disregarding the lack of precision from some politicians regarding zero storage and other assertions. And considering that this is a country that has opened the door to Palantir in the henhouse of its National Health Service (NHS).

The second reading comes when individuals, companies, and entities defending rights start connecting the dots leading to a new edition of Chat Control.

Now with an English tailored suit, but with the same underlying purpose of potentially serving the same end. The continuous line of the obligation to provide information for the platform to categorize whether you are a minor or not, the necessary scanning of content to block what is considered nudity or similar, and the enablement of the tool/possibility to modify it as deemed appropriate at any given moment. Today in this area, but tomorrow in any other. A point raised by Signal in an ad hoc statement, rights defense entities, and the manifestation of the added problem of almost everything going through the three major players: Google, Apple, and Microsoft.

Everything points to another Chat Control in Europe. And communication to citizens in the worst possible way. It is understood that here, VPN maneuvers will not be sufficient to bypass restrictions at the device level itself, but we will see the alternatives minors have to circumvent this issue. Has anyone considered consoles and other parallel devices with internet access and browsing?

You are reading ZERO PARTY DATA. The newsletter on technology and legal news by Jorge García Herrero and Darío López Rincón.

In our free time from this newsletter, we resolve complicated issues related to personal data protection regulations and artificial intelligence. If you have any such issues, give us a hand. Or contact us by email at jgh(at)jorgegarciaherrero.com.

Suscríbete ahora

🗞️News from the Data World 🌍

.- Ireland is no longer just one of the tax havens tolerated by the EU. The UN highlights it as a “canary in the coal mine” due to the electrical and environmental weight of the AI boom. The article connects problems in meeting energy demand, regulations for data centers to generate their own electricity (nuclear energy is mentioned, uh), and the risk of a drastic increase in fossil fuels. Add the known consumption of water, land, critical minerals, and e-waste, and how the physical footprint of AI shifts to places that do not capture (barely) the value generated by the hosted computation.

.- We have been announcing an Armageddon caused by all those uncontrolled chatbots out there and prompt injections: does Meta count? Not yet, baby. It has been quite crazy, but we believe something more serious and widespread won’t be long in coming.

What happened with Meta? Well, only a bunch of idiots like Meta would be capable of reducing their workforce at a double-digit percentage rate to replace people with AI. In the security department. Granting elevated administrative privileges to a damn bot that -manifestly- had not been sufficiently tested.

Well then: the bot allowed attackers to “add email” issue 2FA codes, and bypass protections that, in theory, stop resets.

Automating recklessly amplifies social engineering and scales failures.

.- Your TV can be a “node” for web scraping: SDKs embedded in apps turn smart TVs -like yours and mine- into outlets for third-party traffic, useful for evading blocks by IP reputation. An Israeli company embeds pieces of code in the apps of certain TV brands (they are in the article), which allows third parties to enter protected websites (let’s say against corporate bot scrapers) bypassing the protection, because they are using (read: abusing) your IP accessing as if it were you or a particular person entering from your home. Needless to say that, just as they enter any newspaper to scrape, they could enter a website of those you would never enter and that store the IPs of their visitors. Do the math.

The alarm is not only about data protection: remote control of destinations, filtering by country, and the lack of authentication/signing suggest an infrastructure ready to segment homes as programmable resources, with externalities of blocking and criminal suspicion.

.- Do you remember the article I recommended so much last week about “first-party data theater”? Well, now you can apply the same logic to platforms like Spotify, which, by interposing between artists and their audience, mess up the service because, deprived of direct contact with their fans, they cannot do what they could barely achieve in the past: impose their conditions.

…And that’s why the rise of things like this Substack, which allows direct contact between content creators and like-minded people.

📖 Hard data docs for caffeine lovers☕️

.- Carlo Piltz makes it clear: if you do not mention or inform about “legitimate interest” in the notice of Article 13.1(d) GDPR, you cannot rely on it. The post lands the inveterate doctrine of the CJEU to German practice: the informative defect is not minor and leaves you without a legal basis.

.- CJEU C-585/26 “Trezor Company” and transfers to US processor Consenting to international data transfer does not suffice if it is not clarified which basis of Article 6 is used and whether that basis “covers” the act of transferring to the processor in the US. The post raises a nuclear doubt: is a separate basis required for the “transfer event” and, if so, when does it fall due to lack of (a)(b)(f)?

.- Cool resolution from the Norwegian Authority. The good Luis Montezuma sells it as an ideal decision “for training” in GDPR: a practical compendium on legal basis, valid consent, legitimate interest test, and compatibility.

And it certainly is…

.- Another case of evidence against an employee obtained with infringement of data protection guarantees that is validated for dismissal purposes, and subsequently compensated for infringement of fundamental rights. I am aware of Ribalta and all that, but these labor court rulings still make my head explode.

.- Interesting fine of 900,000 euros from a Berlin court. More than for the amount, because it is the end of the road of the famous sanction of 14.5 million to Deutsche Wohnen the German real estate company for eternal conservation. After appeal and prejudicial question to the CJEU, the sentence was revoked and the case was referred to a concrete instance to rule on the merits. In this case, back to square one: substantial reduction because it was done within the temporal framework of the real application of the GDPR, that the Berlin DPA did not adequately substantiate (it is not the only DPA that has had some scares out there) and the silver bullet of being able to prove during the procedure that you are fixing the issue (reference is made to hiring auditors and a lot of IT). Seen on LinkedIn, via San Luis Montezuma.

.- Interesting (but pasty, and with a font size incompatible with fifty-something eyes) “legal criterion” of the AEPD that lands in a curious case what “things are what they are, and not what the data controllers who could have been processors but then were not, say they are”.

💀Death by Meme🤣

Without this serving as a precedent, here the EU has been quite on point:

🤖NoRobots.txt or the AI stuff

.- The problem of AI regarding localization/dubbing comes back to Spain. Precisely the sector least willing to sign certain guarantees requested not to blow up the profession: video games. It is true that, in terms of dubbing, little more is needed to completely eliminate the actor than cloning their voice:

The Platform of Associations and Unions of Voice Artists of Spain (PASAVE), pulled out of the hat the following specific clause that Microsoft is not willing to sign (let’s not forget all its Copilot and direct interest in AI):

“The use of voice, modulation, timbre, gestures, and analogues of the voice talent and/or voice actor/actress is not permitted or transferred to be used for feeding, training, simulating, or any similar action related thereto, in artificial intelligence (AI) programs or projects, robotics, computer games, or any other methodology that uses or transforms the voice originally recorded by the voice talent and/or actor/actress, to be used for any purpose other than the one detailed in this agreement, which is to give voice and interpret the character/s of a specific production.”

Never lose sight of the video game industry, which is always very ready to make business decisions or press the nuclear button at the slightest provocation.

.- Within the framework of the procedure for provisional measures in the investigation of Meta for possible abuse of dominant position, the European Commission is indicating that it should restore free access to third-party AI assistants on WhatsApp. Nothing about trying to apply a price or payment that can distort competition.

.- About how META’s Smart AI Glasses have gone from almost activating facial recognition in the glasses stealthily (it was called name tag internally) to declaring that they no longer do. Just in case Wired catches them with their ice cream cart when publishing article.

On the same glasses, the EU may be starting to really move on the issue. Question from Renew to the Commission, something from the Swedish DPA in response to media inquiries, or the EDPB recognizing that it is beginning to assess where to start after receiving the report it commissioned on the matter.

.- The new AI services from Apple will not reach the EU for regulatory reasons. You break my heart, Apple. What do we have in the EU that they don’t have in the USA? (To start with, the problem is competition, not data protection or AI regulation…).

Also tune in to listen Legal4tech with superMario Guglielmetti (and Rosie & Jack).

📃The paper of the week

.- The paper of the week is this one by Theodore Christakis (“You Trust Your Chatbot With Everything. Should You? Part 2”), for several reasons:

(i) because the topic is fascinating (are AI chatbots really confidential?), and I don’t think there are many things more in vogue (remember that Christakis’ panel was one of the most interesting at CPDP).

(ii) Because it is longer than a day without bread, and it is caffeinated-caffeinated to the extreme, and last but not least.

(iii) because the good man cites Narseo Vallina, the rest of my colleagues at IMDEA Networks, and me, for our work on embedded trackers and other privacy leaks in the web interfaces of the four major AI providers.

Ask Rumpel a question

Rumpelstilstskin (“Rumpel” for friends) is our personal assistant to browse through resolutions, judgments, guidelines, and various materials that works locally (without asking commercial AIs).

We like to see if it is capable of decently answering complicated questions.

This question is a preliminary ruling submitted this week to the CJEU (to be honest, it’s not something to tear your shirt over):

“Where both the platform operator and the website owner are jointly responsible for the processing of data when a website is accessed via a platform, are the controllers then required to make the essence of their arrangement within the meaning of Article 26(1) of the GDPR available on that website or at least on another website to which the accessed website refers by means of an appropriately marked link?”

Do you have any questions for Rumpel?

Useful tools / 🙄 Da-Tadum-bass!!

I must have watched this video twenty times this week, and it always puts me in a good mood: if you have a more useful tool than this for these trying times, show me

! [Insert the goose meme: “Show me, son of a bitch!”]

Compartir

Si echas de menos algun doc, comentario o chorradón que manifiestamente debería haber estado en el Zero Party Data de la semana, escríbenos o deja un comentario y lo valoraremos para la próxima.

Your €20 AI subscription was being subsidized.

The first one is free.

Buy today and pay tomorrow.

But ah! 2026 is the year of IPOs and, once again, there won’t be enough bread for so much sausage.

They’ve already sold us the chimera; now they have to sell us valuations that are, ahem, solid, based on the bottom line of, ahem, serious financial projections.

So the time has come to raise prices so that revenue projections don’t look quite so terrifyingly disconnected from CAPEX projections.

And that’s where we are: Anthropic and OpenAI have severely guillotined the tokens linked to their subscriptions. Anthropic had already cut the unlimited token buffet for agents. Google is launching paid Gemini plans while also tightening the free tier. Copilot has also moved to pay-per-token consumption, causing quite a mess on GitHub.

I was commenting with Sergio Maldonado that we’ll tell our grandchildren we lived through the golden age when “they were giving it away.” Well, kid, that’s over now.

And prices will keep rising vertically, make no mistake: there is no hiding that this technology is very expensive, and this has only been the first step. This increase does not bring the matter anywhere remotely close to profitability.

In 2026 we will still see smiling faces in the AI technocracy. But once they’ve managed to offload a good fraction of gold-priced shares onto us, it will be time for the fangs.

Wave goodbye to spending the afternoon generating 50 silly images to share with the family. Say farewell to wrappers and token resellers.

Get ready to upgrade your plan and still burn through it in a couple of prompts.

Say “Hello” to open models.

Hold on tight: Winter’s coming.

You are reading ZERO PARTY DATA. The newsletter about tech and legal affairs by Jorge García Herrero and Darío López Rincón.

In the free time that this newsletter leaves us, we solve complicated issues related to personal data protection regulations and artificial intelligence. If you have any of those, give us a hand. Or contact us by email at jgh(at)jorgegarciaherrero.com

Suscríbete ahora

🗞️News of the Data-world 🌍

.- First news that an association of age verification solution providers has been established (Age Verification Providers Association), but they come out swinging in this LinkedIn post attacking the AEPD’s decision against YOTI. And calling for the EDPB to issue specific guidance on the matter. Something similar to last year’s declaration, Statement 1/2025 on Age Assurance? Or perhaps the more recent joint opinion with the EDPS on the possible change to the Article 9 exception for verification necessity through the Digital Omnibus?

Far from trying to play the strongest card of arguing that this is biometric processing not prohibited by Article 9 because it does not have the purpose of unique identification, they almost seem to acknowledge that there is no other way to do it. Therefore, we might begin to suspect that all alternatives follow essentially the same template as Yoti. Bleeding all the way to the million-euro mark from the same wound: Article 9 processing that is difficult to legitimize.

They criticize the AEPD somewhat for pointing out the obvious problem of consent, but there isn’t much else available. Legal obligation doesn’t work (the DSA doesn’t allow it in the required way), and legitimate interest must be built around the Gordian knot of proportionality and necessity. Especially now that a supposedly less intrusive alternative is arriving in the form of the EU app. And there they push back somewhat on the point that relying on a PIN carries the clear risk of “shoulder-surfing” attacks.

It also doesn’t help when the argument is framed in very COVID-era terms of simply having something that works:

“The AEPD’s decision, by treating the biometric facial template within a consumer identity app as special category data that cannot be made a condition of service, points toward a future in which the most secure authentication option is legally the most difficult to deploy. The least secure option is the path of least regulatory resistance.”

Nor does it help that the Digital Omnibus, regarding the GDPR section, appears—unless things change—to require exclusive control by the data subject in order to apply the exception. Exactly the opposite of how these systems operate.

A good opportunity to remember the EDPB’s dual possibility regarding biometric processing under Article 9 and non-Article 9 biometrics. In those very guidelines that overturned the previous interpretation assumed by the AEPD.

.- In relation to the same issue, it is worth remembering that this technology fails spectacularly: case in point, The United Kingdom mistakes children for adults. New Home Office figures reveal that, in the second half of 2025, 17% of migrants classified as adults turned out to be minors.

The practical consequence? Minors wrongly classified as adults ended up sharing rooms with adults without any safeguards, according to the Helen Bamber Foundation, which documented cases involving children as young as 14. Now imagine your own child in that situation.

The Helen Bamber Foundation, the British Association of Social Workers, and Human Rights Watch warn that AI reproduces biases and fails to account for the effects of trauma, malnutrition, and exhaustion on the physical appearance of minors.

.- Regarding the less discussed DMA, THE General Court of the EU annuls the Commission’s decision designating Meta as a gatekeeper in its marketplace. However, it considers the designation appropriate regarding the separate “Messenger” service.

.- This European Parliament document on the “debate” around the minimum age for social media is quite interesting. In a relatively short document, we get a linked compilation of the main legislative attempts by multiple countries to achieve this impossible objective, references to the rather underwhelming Australian experience, a collection of minimum consent ages across EU countries (Spain keeps talking about 16, but not yet), the French case that advanced legislation until the Commission stepped in, and what we already know about the GDPR, DSA, and EU Identity.

.- Another blow delivered by Dr. Ferguson, but it is satisfying when knowledgeable people simply keep stating facts plainly.

And with solid reasoning, via Substack. The important thing is not merely to say it, but to argue it as convincingly as possible.

Secrets of Grimoire Manor

A New Study Spells Bad News for Cellphone Bans

The latest study of cellphone bans caused shockwaves as it appeared to be really bad news for advocates of the bans. This study basically compared a specific type of ban, lockable pouches (such as Yondr pouches) with schools that did not use them. Across the board this was basically a null study…no benefits to standardized testing scores, classroom atte…

Read more

6 months ago · 23 likes · 2 comments · Christopher J Ferguson, Ph.D.

Do not miss the following article: save it for the weekend or do whatever you need to do, but don’t miss it: The messy middle reflects with disarming humility and clarity on the challenge we will face as a society until the supposed universal benefits of AI and automation arrive. If they arrive (for everyone). Well-grounded and filled with excellent charts, this article should never let you sleep well again. You’re welcome.

As an example, here’s one.

.- Adtech: Excellent article by Abhi Yadav: First-party data theatre regarding Publicis’ acquisition of LiveRamp, one of the most despicable companies I’ve ever had to go toe-to-toe with. First-party data (1PD) had its heyday as a response to the tyranny of Meta, Google, Apple, and the other “walled gardens” (territories where trapped consumers could be offered products and services under the conditions imposed by the local feudal lords).

The author explains transparently how service providers for exploiting 1PD actually take ownership of the inferences extracted from the data, turning the owner (the responsible company) into a servant. Added to that is the fact that inferred data becomes more valuable the more first-party data flows into the pool, but—for the same reason—the larger you are, the more profitable it becomes. The counterintuitive moral is that your competitors can eat your lunch using your own first-party data if they hire the same platform you do.

If you are not clear that these types of platforms routinely identify data subjects even when they have different IDs or hashes for each client, it is because you do not remember the Criteo case.

Zero Party Data

Singling-out, identifiability and accountability gaps

Whatever happens with the Digital Omnibus (and as regards Article 4 GDPR it already seems quite clear that nothing is going to happen) we will have to live with the SRB Scania doctrine (the subjective interpretation of the concept of “personal data…

Read more

8 months ago · 2 likes · Jorge García Herrero

.- AI rewrites consumer contracts. This article struck me because of how accurate it is: Dave Hoffman weighs different scenarios in which companies respond with AI to the flood of complaints that consumers can now generate very easily. The reaction could be either longer, more tedious, and more detailed contracts, or more ambiguous clauses.

What is interesting is that he places the real leverage in historical data regarding each consumer’s willingness and tendency to litigate (in my case, I rarely file complaints, but when I do decide to go all in, I really go for it—right, Meta and El Corte Inglés?).

📖Hard data docs for coffeine lovers☕️

.- The CNIL sanction against IQVIA is packed with interesting points: we produced an extensive note and here you can read an excerpt.

.- Saint Luis Montezuma brings us the latest report from the Norwegian authority, which asks whether it is legally possible to offer AI-based chatbots anonymously. The document reviews the liability framework applicable when an operator intends not to identify itself, the conditions under which anonymity could be compatible with the GDPR, and the steps necessary for such a model to be lawful. The approach is interesting because it addresses the perspective of a provider seeking to offer its service while minimizing regulatory exposure.

More from Luis: the Lower Saxony Data Protection Authority published FAQs on the use of AI, while the Belgian Authority completed an investigation into a smartphone conversational application that uses AI and language models.

.- SuperMario Guglielmetti raises a very interesting point regarding the famous warning issued by the Garante to Myndoor over the plugin that read workers’ conversations in Slack and Teams to detect psychological stress: if the analysis is based on text and not biometrics, it may not constitute emotion recognition.

For my part, I would add that the provider cleverly relied on each worker’s consent to process their data, but where I come from conversations involve third parties, and those people probably neither knew about nor could object to such a delightful form of processing.

💀Death by Meme🤣

🤖NoRobots.txt or The AI Stuff

.- Two gems from 404:

The first is a story that took me a while to believe: Meta’s chatbot gave away Instagram accounts. Pro-Iranian hackers compromised high-profile accounts—including the archived White House account from the Obama era, Sephora, and a senior U.S. Space Force officer—by exploiting a vulnerability that seems designed by someone with a severe cognitive deficit. The attackers simply asked Meta’s support chatbot to link the target account to a new email address. Zuckerberg’s team had handed the palace keys to the bot, giving it permission to make account changes, generate a verification code, and send it to the attacker.

Meta integrated AI support into all Facebook and Instagram accounts in March 2026 with password recovery capabilities. Victims report that there is no way to escalate the issue to a human operator.

As I said, difficult to believe even for a skeptical bald man.

.- The second: Microsoft wants you to become addicted to Scout. Internal Microsoft documents leaked to 404 Media reveal that the plan for Scout—the OpenClaw-based personal assistant integrated into Microsoft 365 and announced this very week—is structured in three phases, with the first phase explicitly being “make people addicted.”

Well then.

.- This story has already gone viral, but it remains one of the most interesting stories around. We already had one involving AI-generated documentation that made it into a U.S. courtroom, but we were still missing the lawyer trying to fool the AI performing the first case screening in Brazil. A textbook prompt injection, but in an evolved form of the old trick of hiding something that only the AI processing the CV sees first.

We will see many similar stories across the thousand filters that public administrations will introduce into citizen procedures. And judges resisting the temptation to conduct speculative investigations based on a defendant’s face.

.- Really interesting article about the AI actress nobody asked for. The New York Times Magazine presents a detailed profile of Tilly Norwood, the first entirely AI-generated “actress,” created by Eline Van der Velden through the Xicoia studio.

📃Paper of the week

.- Bring Your Own Device — Now Hand It Over! Rescuing Workers’ Privacy During Data Searches by Virginia Mantouvalou and Michael Veale. The BYOD (Bring Your Own Device) practice and personal-professional cloud storage create gray areas where employers may legitimately require access to a worker’s devices and data—based on data protection laws, freedom of information obligations, or procedural law—without any effective separation between the private and professional spheres.

.- A paper presenting the opposite side of the story from an LLM inventing case law citations or legal reasoning. In an experiment comparing whether an LLM or a professor would better answer questions from first-year law students (in the U.S. course known as “Contracts”), the LLMs won by a landslide with roughly 75%. They were also friendlier, though that is nothing new. AI always flatters you. Seen via Ethan Mollick on LinkedIn.

Jorge’s postscript: I would like to see the same study with LLMs, university professors, and practicing lawyers competing against each other.

🛠️Useful tools

- Following the publication of the AEPD’s 1,500 reports, we now have two inventions:

• Rumpelstiltskin: our own little goblin.

• The Claude artifact version by Jorge Morell that we were all waiting for when the AEPD released the reports.

🙄 Da-Tadum-bass

Compartir

If you miss any doc, comment, or dumb thing that clearly should have been in this week’s Zero Party Data, write to us or leave a comment and we’ll consider it for the next one.

CPDP 2026 will be remembered (at least by this bald guy) as the “Luis Montezuma Edition”.

“Veni, vidi, vici”: Luis Alberto Montezuma arrived, saw, and conquered: everyone knew him, and everyone was grateful for his generous work while we discreetly scrutinized his eyes and clothes to ensure he had no wires, chips, or batteries powering that tireless knowledge-publishing machine.

Nope: he’s human. His secret is the magical Colombian arepas, apparently.

We all know by now that just following him will keep you informed of 90% of what you need to stay up-to-date.

Below, a summary of the panels I attended and those I missed but were recommended to me, culminating with my personal top picks:

In the prelude, Sophie Stalla-Bourdillon demonstrated that, in addition to having mastered the SRB Scania doctrine, before SRB and Scania, she is a very competent moderator.

A couple of gems from Philippe Latombe (the MEP who challenged the DPF before the CJEU and now is part of the CNIL):

“80% of the CNIL’s time is spent informing initiatives of the French Government, not on enforcement tasks”.

Who gets in? The Policy Dilemma of Age-Gating: I learned here that in Australia, the processing of biometric data for mere age determination is prohibited biometrics.

The Belgian Youth Council representative Camille Biot clarified what no one says or hears: that “youth” is not a single collective but a very diverse one, with many different interests.

That diversity alone already disqualifies any measure that aims to authorize binarily (you have access / you do not have access) the entire collective solely based on their biological age.

She said more: “approve whatever you want, shitty boomers: we young people will keep accessing”. Possibly she did not say exactly “shitty boomers”, but well, you get the idea.

The burden (the consumption of personal data for age verification et altra) should not fall exclusively on the user.

The commissioner also left an interesting point at the end: “when I was in high school, gay kids were very pressured and alienated, and social networks constitute an unparalleled tool for them to find their community”.

In “Breaking silos” (not very interesting) a couple of comments from the representative of the French association of DPOs AFCDP caught my attention, about an elephant in the room: “the growing pressure and workload, the need to stay updated, etc., have led us to offer psychological support resources for our members”.

GDPR class actions: the state of play (interesting, but I doubt it was recorded).

Three interesting things: the very frustrated attempt to disrupt the panel by a lawyer defending one of the defendant companies, the characterization of the background behind the collective lawsuits of Privacy Collective, this here and meeting Peter Hense in the flesh.

I wasn’t at The role of operating systems in trusted AI but it was one of the most recommended of the day, and I will watch it when it comes out.

Vital Signs: Regulatory Coherence, Interplay, and Alignment for Medical Device Cybersecurity: the typical super useful panel to situate yourself in a specific matter from different points of view: the talks were well supported by the presentation, very clear, and very didactic to understand the swarm of applicable legislation in this matter.

On Thursday, I wanted to go to Secondary use of data under the European Health Data Space: some relevant issues moderated by Pablo Trigo, but they changed its location: (nonetheless, I heard it was fantastic) and I went to A Child-Centred Approach to the EU Digital Rulebook. Another 100% educational panel with a special mention for Simone Van der Hof, I am quite sure she is one of those professors who change your life.

Informed consent: The breakthrough in Art. 88b GDPR / Digital Omnibus and current initiatives in the field of PIMS and technical standardization. A very interesting panel and a chance to see a force of nature in action: Anja Wyrobek, a commissioner making some very questionable points: Magdalena Steringer, and an explanation about the challenges and solutions posed by that proposal of 88b.

What is so special about special categories of data?. Especially interesting were the interventions of Ruth Boardman

The Agentic Assistant: What does Big Tech’s goal of creating a universal digital intermediary mean for society? Really interesting were the interventions of Udbhav Tiwari from Signal and Frederike Kaltheuner.

Eye tracking in video games: Opportunities for game development and risks to privacy. Very Good.

I participated in the workshop From Pseudonymisation to Synthesis: A Debate on Evaluating Privacy-Preserving Technologies and Re-identification Risks in Medical AI under the GDPR (a practical case to be resolved between two opposing teams formed with the attendees). The idea was brilliant, but there was very little time and I would say at least half of us were hungover. I was on the team that upheld the rights of the data subject and we triunphed, of course.

It is notable to indicate that the team defending the company did not think to allege in a pure form the proposal that gave title to the workshop: “In so far SRB Scania doctrine applies, therefore GDPR does not apply”. Which was the whole point.

Digital Omnibus meets the Charter of Fundamental Rights – a reality check with Max Schrems and especially my friend Rosalia D´Agostino, whom I also had the opportunity to meet in person. I recommend her podcast again Legal4Tech.

I wasn’t there, but it apparently was excellent: Dragnet Data Protection: Dilemmas of Web Scraping and Public Interest Research

The AI Act: AI regulation and its implementation in troubled times with Mantelero not selling but teaching his book and Gloria González Fuster yes selling her book, but above all, complaining about her (well-deserved) reputation as a grumpy one to immediately confirm it by grumbling - amusingly - about a drama as tragic as recurrent when concluding the negotiations of the relevant legislation text.

You will have to watch the video to find out: HA!

My two favorite panels (ex-aequo, as in Cannes):

Gendered Digital Labour: Unseen work, exploitation, and technology-driven inequalities.

If this panel had been a TV series (and it could be), I would binge-watch all six seasons. The discussion started with precarious workers subject to platform supervision but above all control.

Aída Ponce del Castillo presented the Platform Work Directive – “if the conditions for the application of the Directive are met, the worker contracted through a platform is a platform worker” (!!!)

“the working conditions are coded in the algorithm”

However, after Madeleine Thomas’s intervention – a character very hard to forget, but I won’t reveal why here – the panel’s interest and the panelists’ passion skyrocketed. The focus shifted to social media content generators, the possible application of the Platform Work Directive (”It depends”), but above all the possibility of implementing PETs (Privacy Enhancing Technologies) on user-generated content that allows identifying those who leak content, dox their creators, and upload it to other platforms for uncontrolled virality. The technology exists; it only requires stakeholders to decide to invest in its adoption, thus demonstrating that they do not give a damn about the creators whose content they monetize and exploit.

Wouldn’t that be wonderful?

And much more.

My Chatbot, My Confidant? Protecting User Privacy in Generative AI Conversations, moderated by Theodore Christakis. Fascinating.

Some striking points:

.- 230 million users make health-related queries to ChatGPT every week.

.- All guidelines and efforts by the EDPB (European Data Protection Board) or the EDPS (European Data Protection Supervisor) still focus on the past (AI training) when the real issue lies in the present: the indiscriminate personal and business use of chatbots with very unclear privacy safeguards. The panel focused on aspects such as judicial access to chat history, overlooking the growing evidence of leaks for purely commercial purposes.

.- Yann Padova (who has become Gandalf) left a couple of memorable quotes worthy of a t-shirt:

“AI is disproportionate by design” or “legal loopholes in the EU?”

Beyond the panels, it was greta to sharing oxygen with Gloria Gonzalez Fuster, Itxaso Domínguez de Olazabal, Laura Centeno, Guillermo Lazcoz, and beers with Jeimy Poveda, Ainara Bordes, Isabel Barberá, and David González Calleja, as well as a lot of interesting people I met whose names I don’t remember (apologies to them) because I am already very, very old.

Next year, more. And now, the newsletter: we have a lot to cover.

You are reading ZERO PARTY DATA. The newsletter about tech and legal affairs by Jorge García Herrero and Darío López Rincón.

In the free time that this newsletter leaves us, we solve complicated issues related to personal data protection regulations and artificial intelligence. If you have any of those, give us a hand. Or contact us by email at jgh(at)jorgegarciaherrero.com

Suscríbete ahora

🗞️News of the Data-world 🌍

.- Not only Pope Leo XIV (see below in the AI section), but also the fight against the construction of data centers has united a cross-party citizen majority in the US: The American rebellion against AI is a fact and gaining momentum (reported by a media outlet unlikely to represent tree-hugging hippies: the Wall Street Journal). Local communities have managed to block or delay at least 48 data center projects valued at over $156 billion in the last year alone. In the first quarter of 2026, a record 20 projects were canceled due to local pressure from neighbors. Republican politicians in Texas and South Carolina have called for moratoriums on hyper-scaler developments, citing the impact on power grids and farmers. Democratic candidate Justin Pearson in Tennessee is making opposition to xAI’s Musk data centers a central part of his campaign. Only 17% of Americans believe that AI will have a positive impact in the next two decades.

Meanwhile, in Spain, projects in Extremadura, La Mancha, and Aragon are full steam ahead.

.- Who really writes or rephrases all those clone-like posts about leadership that you see on LinkedIn, signed by... people you’ve never heard of on LinkedIn? Find out here.

.- Technological sovereignty: The European Commission is promoting restrictions on the use of US cloud providers—AWS, Microsoft, Google—for processing sensitive public data from European governments. The “Tech Sovereignty Package,” presented yesterday, May 27, defines sectors whose workloads must be hosted on European cloud infrastructure: healthcare, finance, and the judicial system are the priorities. The measures apply only to the public sector, not to private companies. Thibaut Kleiner, Director of the Commission, warned that Europe risks being relegated to a “technological colony.” The irony is that in April, the Commission itself awarded a €180 million contract to sovereign cloud projects including an alliance between Thales and Google Cloud.

Utah requires adult content sites to verify the age of all their users, including those accessing via VPN. The article humorously summarizes the difficulties in implementing this proposal, similar to that infamous magistrate from the Audiencia Nacional who ordered the “closure of Telegram”.

And along these lines, politician vs specialist. Specifically, a British politician ignoring how well the topic is progressing in Australia (and mixing certain elements in the argument to justify himself) vs a renowned academic researcher in applied psychology (mainly in video games where there are never minors). And the added joke that in the United Kingdom, any platform is obliged to collect identity documentation from every user.

.- Yesterday, the AEPD published that it will bring the issue of investigating the leak of conversations in major AI services/assistants, which we covered in a special issue here (and in which Jorge participated), to the EDPB itself. It will do so in two ways: an informative note for the knowledge of the rest of the DPAs, and a proposal that it be addressed at the plenary meeting on June 8 and 9.

We’ll see how it ends up, but it’s good news in the crazy world we live in.

And this infographic from the CNIL, very much for the lay citizen, but which clashes badly in points 3 and 4 with the investigation of the AI leak:

📖Hard data docs for coffeine lovers☕️

.- Amadeus shatters the record for the highest fine from the AEPD, with 14.4 million euros.

.- Formal complaint from the Gesellschaft für Freiheitsrechte (GFF) to the Irish Coimisiún na Meán for systematic non-compliance by LinkedIn with Articles 17 and 24(5) of the Digital Services Act (DSA).

Between October and December 2024, 77.1% of LinkedIn’s content moderation decisions in the DSA transparency database cited only a “generic violation of platform policies” without specifying what content, why, or which specific section. Article 17 of the DSA requires clear and specific reasons that allow the user to understand the decision and exercise their right to appeal. The most amusing thing is that the DSA transparency database — designed precisely to audit moderation patterns — is being used by LinkedIn to formally comply with the notification obligation, while reproducing exactly the opacity that the regulation aims to eliminate, turning the control instrument into a regulatory whitening tool.

.- Curious case of the limits of joint responsibility that we see on Noyb’s blog. Austrian court annuls the 8 million fine imposed by the Austrian DPA on the parent company of a Group involved in a loyalty program. As much as it was the parent company, the court considers here that there is no effective influence/position or unity of purpose in the determination of purposes and means necessary to consider the subsidiary and parent company in this dual category. It is always good to remember real examples of the matter, which are often considered as nothing or everything.

.- The DPC updates a document that could be called “FAQs on domestic CCTV”. Far from being different from what the AEPD did with its 6 “cards” on CCTV, it does have something that would not be bad to incorporate into the AEPD’s: a visual image of how far the little camera can film. Reality is often a more diffuse terrain where it is not always as clear as the written description in text.

Setting aside the fact that we are less likely to all have a detached house with a garden, but considering the dreaded Amazon Ring and certain landlords’ ideas.

.- Technical Solutions for Marking and Detecting AI-Generated Text Content in the Context of Article 50(2) AI Act via Martin Ebers.

💀Death by Meme🤣

🤖NoRobots.txt o the IA things

.- Google will take your emails as a signal when serving you advertising: Garrett Sussman, Michael Tandoh, Cate Dombrowski publish Gmail inbox as an AI search signal: a controlled experiment on 1,922 Google AI Mode responses shows that brands “seeded” in emails from accounts connected to Google Personal Intelligence appear 46% more in recommendations than in control accounts. Appearance increased from 23.9% to 66.8%; top-3 positioning improved by 23.1 points; Gmail was the strongest signal compared to Google Photos. Even fictitious brands introduced by email appeared in 35.7% of the responses, compared to 0% external citation. The experiment —with data collected between March and April 2026— only applies to accounts that have voluntarily activated Personal Intelligence, not to standard AI Mode.”

More of the same: Google announces the integration of native advertising in AI Mode and Gemini responses: “Conversational Discovery Ads” will generate product recommendations tailored to conversational queries, while “Highlighted Answers” will insert approved brands at the end of AI Mode lists. AI Shopping Ads will also arrive in the conventional search engine with Gemini writing the product “explainers.” Google assures that ads do not affect organic results, but organic results are buried under a growing tsunami of AI-generated content. Elizabeth Reid presented the changes as “the biggest update in 25 years.” The most concerning aspect is that the language model acts as an intermediary in the auction—the LLM decides which brands are “relevant and high-quality”—but this decision is embedded in the same auction mechanisms as before, without transparency on how these two logics interact. And this has already cost you dearly two years ago, Google.

-. The Pope’s stance: It took the Pope to start dropping facts about AI. It’s almost more about governance policy or FRIA than encyclical. He hits the nail on the head with the main problems and biases of AI:

• AI is not neutral: we forget, but humans are still the ones who make and break things in the world. We haven’t reached Skynet yet.

• Back to the Tower of Babel: “10. We must, then, avoid the ‘Babel syndrome,’ namely the idolatry of profit that sacrifices the weak, a uniformity that neutralizes differences, and the pretense that a single language—even a digital one—can translate everything, including the mystery of the person, into data and performance.”

• Hidden environmental impact: little is denied, but we still talk about carbon zero. OpenAI manages to balance the chickens that come in for those that go out, no doubt.

• Do not forget about rare minerals and certain profiles of “slavery.” Not for nothing do we later see the presumed anti-slavery norms by the UK: A significant part of the digital economy’s functioning relies on the silent work of millions of people engaged in essential yet largely unseen activities, such as data labeling, model training, and content moderation, often involving disturbing material. (…………….). In some regions of the world, children and adolescents work in dangerous conditions, crushing the materials from which rare earth elements are extracted.

• The Pope realized it is better not to base any decision on an algorithm. Insert meme of “you were right that mushroom was poisonous.” They scratch on the topic of compassion and empathy. Apply the father and child analogy to Palantir’s sword scenario.

• Surveillance and worker devaluation: As a result, contrary to the advertised benefits of AI, current approaches to technology can paradoxically de-skill workers, subject them to automated surveillance, and relegate them to rigid and repetitive tasks. The need to keep up with the pace of technology can erode workers’ sense of agency and stifle the innovative abilities they are expected to bring to their work.

📃 Paper of the Week

.- Anonymization of genetic data in the European Health Data Space, by Daniel Grafulla Cumba. Warning: Do not miss it, BUT have an LLM nearby to explain the technical part with examples! (Do you remember the parts of “The Name of the Rose” written in Latin? Very similar).

Daniel Grafulla explains how:

.- The truly relevant parts of DNA for identification purposes are not the whole, but much less, and usually involve combining fragments from different sources.

.- However, exceptionally, regions of DNA that are not very relevant for identification purposes gain significant value when they mutate, thus doubling their sensitivity in terms of genetic diseases.

.- He points out a kind of minimum threshold (!) of re-identification risk in Recital 92 of the European Regulation on Health Spaces.

.- Although this Regulation contains an explicit prohibition on re-identification for users (data recipients), the author solidly argues that, given the peculiar individualizing power of DNA (or the particular regions described), it should not be taken as a carte blanche in terms of the automatic application of the SRB Scania doctrine.

The question I ask myself (or the point where I disagree) is whether the author’s equating of singularization and identification holds in any case, or depends, as the CJEU has repeatedly stated, on the content, purpose, and effects of each data processing operation.

🛠️ Useful Tools

.- Claude Code for Word and Excel released as open source: the author publishes add-ins that allow using Claude Code directly from Microsoft Word and Excel, including local file context, MCP servers, skills, and tool calling—capabilities not offered by Anthropic’s official add-ins. By Leo Hope and John S. Searsx.

.- ACME Legal AI: self-hostable open source platform for small legal teams, built as an alternative to SaaS legal tech solutions. Includes conversational chat with persistent history, four-stage verifiable citation engine, anonymization layer for cloud inference, and a library of skills in the open format of Anthropic. Works on laptop, internal server, or cloud VM, against the LLM model chosen by the client: Anthropic, OpenAI, Azure OpenAI, or local Ollama. By Kevin Keller.

🙄 Da-Tadum bass!!

Christopher Nolan has never used email or a smartphone. Given that a Viking longship has been seen in a trailer (among other thousand absurdities), he doesn’t consult Wikipedia much either. Nor does he seem to have deigned to ask any historian about carrier pigeons, smoke signals, lighting beacons between Gondor and Rohan, or whatever is done to communicate.

Compartir

If you miss any doc, comment, or dumb thing that clearly should have been in this week’s Zero Party Data, write to us or leave a comment and we’ll consider it for the next one.

We are suffering a tsunami of rock-bottom-quality content generated by AI: a wave that threatens to flood every corner of our digital life.

We are no longer talking about “tralarero tralará”-type nonsense and cartoons of talking toilets consumed exclusively by teens on YouTube and TikTok.

We are not talking about the shrimp Christ and all those supposedly dodgy news items that only extreme boomers and grandparents (as hooked as the teens) swallow.

I do not even want to start talking about the deserts of self-cloning mediocrity that LinkedIn and Twitter are today.

We are talking about an absolute majority in the elections of the modern connected world. Everyone, absolutely everyone, consumes synthetic garbage with uneven enthusiasm. But we all do it.

“It is good enough for me if it manages to suspend the scrolling little finger of my peers”.

What is AI slop?

The term “slop” —which we could translate as “filth”, “trash” or “that viscous thing nobody wants to touch but that today makes up 75% of the internet”— describes with surgical precision those mediocre texts, images identical to each other but so different from reality, and soulless videos that generative tools mass-produce for pennies.

AI slop is the strawberry flavor of chewing gum.

Any resemblance to the original fruit is pure coincidence.

In an economy that seeks attention at any price, the goal is reduced to identifying your sensitive spot and hitting it with different versions of the same thing until numbness, but without providing any real pleasure or learning in the process.

Perhaps we are living through the AI version of the tragedy of the commons: nobody has incentives to produce content of minimum quality because generating daily tons of slop does the job. For now.

The most-listened-to song a few days ago on Spotify was a piece of middling fare called “Celebration Day” by Ingarose.

It is AI, but at least Ingarose did not lie about its synthetic condition. As Forbes documented with that tone halfway between astonished and resigned that characterizes contemporary journalism, millions of people paid real money to listen to something no human being felt the need to sing and communicate (until recently, this was the thing about music).

“It is good enough for me if it was good enough to accompany videos on TikTok.”

Art

At some point we will start seeing works that dignify audiovisual AI as a tool for things that are worthwhile, have no doubt. But if you thought (like me, naive me) that this moment of dignification would arrive this year at Cannes with Steven Soderbergh’s film about John Lennon and Yoko Ono, that is going to be a no.

“Authority”

The president of the Canary Islands community provided a chat with ChatGPT as scientific evidence in a socially and politically relevant debate about hantavirus and rodentss.

And he did not climb down from the donkey.

Allow me to repeat this because it deserves to be savored: a democratically elected representative, presumably advised by experts with real academic credentials, decided that the best way to support his reluctance was… to use the source of information his voters use. Ask a chatbot.

“It is good enough for me if a sufficient number of my voters take it as good”.

The anecdote is terrifying, but electorally it surely “does the job”.

Another matter is that in these things it is more interesting to get it right than to gather support.

Medium: from disinformation to marketing

AI, moreover, not content with impacting your life by saturating it with shitty content, spreads to other markets the manipulations that yesterday focused on issues such as political hate messages or disinformation campaigns.

The algorithmic persuasion techniques that used to be reserved for serious things —like manipulating democratic elections or promoting genocides— now, with a portfolio of successful use cases under their arm, extend to more banal but, of course, much more lucrative matters.

It has been discovered that a company called Chaotic Good Projects was doing astroturfing to promote emerging groups and singers.

Chaotic Good Projects created fake profiles on social networks, generated synthetic reviews, manufactured organic conversations about nonexistent or unknown artists, and simulated communities of enthusiastic fans where there was no one real.

Astroturfing —that practice with the name of artificial grass that consists of simulating grassroots movements when in reality they are campaigns orchestrated from above— has found its manna in generative AI.

Creating thousands of convincing accounts, each with its own browsing history, unique writing style, differentiated behavior patterns, and slightly discrepant opinions to seem more authentic, is today technically trivial and dirt cheap.

“It is good enough for me if it lets me replace the wages of one hundred NPCs with a worked-up prompt”.

Before, the radio formula worked as a means of music promotion (and the repetition of ads in the press and TV) and influenced us by crushing us: you heard the same song twenty times a day until you liked it, or at least until you bought it out of pure Stockholm syndrome.

It was transparent manipulation, even shameless, but at least it was done openly. Radio did not pretend to be your friend; it was openly a commercial loudspeaker. There was honesty in shamelessness.

This other thing is much murkier: the influence comes disguised as an organic recommendation, a casual discovery, an emerging trend that “is succeeding among people like you”. Now it is your “community” —fake, nonexistent— apparently recommending things. It is your “friends” who recommend that artist, your “bubble” that validates that decision. Except none of them exists.

But hey, at least you have friends. Or so you think.

Freedom according to Dan Ariely

To what extent are we as free as we think when choosing the product we buy or the music we listen to?

This question is not new, nor do I intend to come and answer it today.

I would be naive if I thought that, by recommending Dan Ariely’s “Predictably Irrational” or at least his TedTalk on the subject (or its transcript and there is no lower barrier anymore), you would give a damn and check any of these resources.

Statistically speaking, 98% of the readers of this paragraph will not click any link, will not read the book, and will continue with their day firmly believing that their decisions are the product of rational deliberation and free will.

Which, ironically, will validate Ariely’s thesis on friction in decision-making.

But allow me to try anyway, because optimism is the last thing to be lost (right before the hair).

At least listen to the talk: the ending is glorious and you will not forget it. Ariely is an MIT expert in economics and applied psychology, one of those academics who devoted decades to experimentally proving that everything you believed about yourself is a lie, and he shows how context, the presentation framework, decoy options and dozens of cognitive biases determine our choices in a predictable and systematic way.

We are not rational agents evaluating information objectively but primates with 200,000-year-old brains navigating environments for which evolution has not prepared us. Our brain developed shortcuts to survive in the African savanna —where quick decisions about which fruit to eat or which predator to flee from were worth more than exhaustive analysis— but those same shortcuts leave us naked before any system designed to exploit our biases.

And almost all of them are.

“I am aware that my choice is not free, but it is good enough for me, if at least it does not brutalize me.”

You are reading ZERO PARTY DATA. The newsletter about tech and legal affairs by Jorge García Herrero and Darío López Rincón.

In the free time that this newsletter leaves us, we solve complicated issues related to personal data protection regulations and artificial intelligence. If you have any of those, give us a hand. Or contact us by email at jgh(at)jorgegarciaherrero.com

Suscríbete ahora

🗞️News from the Data World🌍

.- We continue paying attention to the legal AI dialectic against specialized tools with this long post by Sean A. Harrington: on the competitive barriers that hinder the generalization of legal AI.

The structural barriers prevent AI from transforming legal practice, despite 79% of lawyers saying they use AI. Sean Harrington analyzes five main obstacles:

(i) the competitive moat of access to structured and complete databases (only Westlaw, Lexis and vLex/Fastcase possess complete legal databases in the USA, although open-source alternatives like CourtListener and Harvard’s Caselaw Access Project erode that advantage);

(ii the internal organizational disorder in each firm (THIS IS THE FUNDAMENTAL ONE, BABY BOY) (data fragmented across incompatible systems, partnership governance that gives each partner veto power, lack of technological leadership in mid-sized firms);

(iii) the efficiency paradox (billing by the hour discourages automation, although fixed-fee models like ADVOS Legal and Hello Divorce capture the efficiency gains in what I call the “niche nobody wants”);

(iv) supervision risks (Danielle Benecke’s “supervision gap”: when agentic systems handle complete workflows, total human review becomes economically irrational) (we already commented on this here) ; and

(v) the access-to-justice gap (86% of civil legal problems of low-income Americans receive no adequate help).

Especially sad is the case of Microsoft Copilot, designed as the assistant that would help lawyers where they work: in Word: it was rated as “minimally useful for legal work” by Clear Guidance Partners consultants after a year of testing in multiple firms. Microsoft had only 8 million active Copilot users out of 440 million M365 subscribers in August 2025, a conversion rate of 1.8%, revealing the failure of the enterprise software vendor best positioned to sell AI tools to its existing customer base.

.- LinkedIn silently scans installed extensions in your Chrome-based browser and links them to your verified professional identity. Every time a professional accesses LinkedIn via Chrome, Edge, Brave or Opera, hidden JavaScript scans up to 6,278 installed extensions, encrypts the results and transmits them to LinkedIn’s servers, where they are associated with the user’s real name, company and professional history. The system, which has never been disclosed in its privacy policy, is the subject of two federal class-action lawsuits in the United States and a complaint before the European Commission. The list includes 509 job-search tools (1.4 million combined users), religious extensions, accessibility tools that reveal disabilities, political readers and more than 200 direct competitors of LinkedIn products.

The scale of the scan increased from 38 extensions in 2017 to more than 6,000 in February 2026, an increase of 1,252% in two years. LinkedIn justifies the practice as an anti-fraud tool against scraping, but independent researchers found extensions on the list for scheduling Amazon deliveries, pharmacy tools and image downloaders, with no plausible connection to LinkedIn’s alleged justification.

.- The same professionals who in 2023 went on strike to protect themselves from AI now train the AIs that compete with them. You may have read about workers doing Reinforced learning tasks in Congo or Venezuela, but the thing is reaching the developed world much faster than we thought.

A very interesting chronicle by Ruth Fowler in Wired: A Hollywood writer trains AI to pay the rent. Ruth Fowler, screenwriter and showrunner, recounts in the first person how for eight months she completed twenty AI training contracts on five different platforms (Mercor, Outlier, Turing), carrying out annotation tasks, chatbot evaluation and “red-teaming” of dangerous outputs.

The promise of flexibility and high rates runs up against the reality of chaotic onboarding, project cancellations without notice, instantly revoked access and tasks that disappear before they can be completed. **If you allow me another prophecy worthy of the most pessimistic Cassandra: if there is a judicial practice of the future, it is the defense of platform employees: **the training-data supply chain swallows highly qualified workers subjected to precarious conditions that until now we associated with things like Glovo and Uber.

.- We complain on the EU side about how Discord and the rest are doing on the issue of age verification, but on the UK side it is in full fun with flags. The funny thing is that the warnings about the risk of impersonation and worse from going around handing over ID/Passport/identity card predate its leaving the club (for example, the EDPB breach example guidelines). That ordinary personal data that ended up being sensitive without being of a “special category”. Here is added the weight that Cavoukian herself carries it on X.

📖Hard data docs for coffeine lovers☕️

.- The ICO has updated its guidelines on processing children’s data, under its very particular Data (Use and Access) Act (DUAA). Although they are no longer in the club, they continue saying things to take into account. We highlight the following two screenshots on consent and totally automated decision-making with “fun” effects

💀Death by Meme🤣

🤖NoRobots.txt or The AI Stuff

Another week with draft guidelines from the European Commission. Now in the form of a draft on high-risk AI systems, open for public consultation until June 20. The draft of the guidelines and of the two high-risk AI annexes: a matryoshka of three dolls.

Among other things,

• The extension of the adaptation margin:

  The provision further provides that providers and deployers of high-risk AI systems intended to be used by public authorities shall, in any event, take the necessary steps to comply with the requirements and obligations for high-risk

  AI systems by 2 August 2030. Article 111(1) AI Act provides a special regime for AI systems that are components of the large-scale IT systems established by the legal acts listed in Annex X AI Act which have been placed on the market or put into service before 2 August 2027. Those systems should be brought into compliance with the high-risk requirements of the AI Act by 31 December 2030
  

• That a general-purpose system may come to be considered high-risk by default, if in all the documentation (instructions for use, contract, policies, sales materials and technical documentation) the provider does not clarify and apply limitations for said high-risk use variable

• In matching fashion, that the distributor, importer or deployer who substantially modifies the system or changes its intended purpose toward high risk will end up being declared a provider.

Much better explained what this draft guidelines contains, in the following video by Robert Bateman.

🛠️Useful tools

.- Damien Charlotin maintains the database of the most complete data on AI hallucination cases in global judicial practice, with 1,455 cases identified to date, tracking court decisions from courts around the world in which it was established that a party relied on content hallucinated by generative AI, typically fake citations but also other AI-generated arguments. The database is searchable by country, party, AI tool and judicial outcome. The cases range from Argentina to Zimbabwe, with the United States representing 1,004 cases, followed by Canada (152), Australia (74) and Israel (52). 86% of the cases involved pro se litigants, while 554 cases involved lawyers.

.- The Irish Council for Civil Liberties has released Verity MCP, an open-source tool that minimizes hallucinations emitted by LLMs through seven layers of verification: strict citation rules, LLMs from different families, natural language inference (NLI), deterministic arithmetic recomputation, consistency sampling, perplexity analysis and dispute resolution among critics. It works on modest hardware (a 2019 GPU as secondary) and integrates with LM Studio.

Verity produces simultaneous second opinions using a secondary GPU while the primary model responds, allowing both responses to be evaluated.

🙄 Da-Tadum-bass

.

Compartir

If you miss any doc, comment, or dumb thing that clearly should have been in this week’s Zero Party Data, write to us or leave a comment and we’ll consider it for the next one.

Today I want to talk about the structural disadvantages of the most advanced AI versus the dumbest lawyer. Don’t save this post: it’s going to age as badly as the movie Tron.

Surely, SURELY, in a few years we’ll laugh about this perched atop technology that will have solved most of these problems.

I only aspire for the text to be understandable and interesting today.

I have a personal obsession with building a personal assistant based on AI without depending on commercial AIs and that runs locally, on a consumer laptop and trained on my own little legal granary of judgments, papers, and rulings.

I’ve managed to build a tool that I use daily and that is enormously useful to me, but it’s imperfect. I spend quite a lot of time on it, but my aspiration is not to bankrupt Claude or Harvey.

The attraction is how much I learn in every iteration about what works and what doesn’t in each piece of this Meccano set: reranker, citation validation, RRF weights, having a golden standard, using HyDE, BM25.

That’s why, when I saw the German post by @Peter Hense on LinkedIn mentioning some of these concepts, I dove headfirst into seeing what it meant. Peter —with a lot of irony and a very critical view of the lazy use of AI— proposes these questions, I imagine for the bar exam in his country.

Here I translate the questions and answers into human-non-legalese language, because they seemed interesting to me for lawyers, for public officials interested in the use of AI, and for anyone who, like me, is tinkering with information retrieval systems based on more or less sophisticated RAG.

1. QUESTION Discuss the thesis: “RAG systems do not have an inherent model of time.” What consequences does this have for legal research, especially in relation to versions of rules ratione temporis?

Answer: AI does not understand the idea that “later law repeals earlier law”

The AI systems currently used for legal research —the so-called RAG systems, Retrieval-Augmented Generation— work, in very simple terms, like this: you have a huge library of digitized legal documents; when you make a query, the system searches for the semantically “most similar” fragments to your question and delivers them to an LLM so it can build an answer for you.

The good thing is that this overwhelmingly surpasses the keyword searches you could do until now in your files. It will return not the docs containing those literal words, but those discussing the issue or concept asked about.

This is a huge advance. And if the search is launched only over documents you control (your collection of judgments, rulings, papers, guidelines, your best work for clients, validated templates, and so on) you minimize the risk of hallucinations.

But the problem is perverse: semantic similarity is not the same as legal validity.

Imagine you ask the system about the sanctioning regime of Article 83 of the GDPR. The system finds several fragments very “similar” to each other: the original 2016 text, a version with a corrected typo, a rejected draft from the European Data Protection Board, and the current version.

For AI, all these documents are almost identical. The system performs probabilistic rather than deterministic retrieval. Retrieval depends on statistical top-k rankings (I explain this below). Therefore, there is never an absolute guarantee that the legally correct version will appear.

For a jurist, only one of them matters, and it depends on the date of the facts being analyzed.

An AI system can give you an answer based on a repealed rule without any problem if you had it in your database.

And, as happens with personal data, if you want to completely remove obsolete docs from your system, you cannot select which embeddings you want to delete: you have to reprocess the entire dataset all over again.

2. QUESTION: What effects on the use of discretion in the issuance of automated administrative acts derive from the fact that top-k retrieval procedures cannot guarantee exhaustiveness in determining relevant exceptional circumstances?

Answer: Top-k retrieval confirms the rule without being aware of the exception.

When the system retrieves documents, it does not retrieve all relevant ones: it retrieves the k statistically most similar to the query.

If k = 10, the system returns the ten fragments that are semantically most similar to what you asked.

Legal exceptions, by definition, are rare, statistically less relevant, and linguistically atypical. They go unnoticed amid the magma of the document database.

If they fall outside the first ten results, the model does not see them. It acts as if they do not exist.

The model does not “reason” over the entire legal system; it reasons only over a statistical sample of it.

This is the main problem with current AI: it does not know what it does not know.

The ugly example: A public administration uses an AI system to resolve public aid applications. There is case law recognizing an exception to a formal requirement for certain applicants in situations of economic vulnerability.

The case law is scarce, rarely cited, and its terms differ from those usually used in the procedure. It does not appear in the top-k.

The application is automatically denied. The applicant does not know that exception existed. Neither does the system.

Administrative discretion requires the Administration to consider all legally relevant elements, not just statistically frequent ones. A system that only sees what it retrieves, and is completely unaware of what it failed to retrieve, cannot validly justify an administrative act.

It is arbitrary: it produces decisions that appear reasoned because they are well written, but structurally omit elements that should have been weighed and assessed in the resolution.

Ultimately, the non-exhaustiveness of retrieval impacts the legitimacy of discretionary exercise, the reasoning of the resolution, the principle of equality, proportionality, auditability, and the possibility of later review.

3. QUESTION. How does an LLM process distributed evidence when the information relevant to the decision is scattered across several documents (for example, law, regulation, commentary literature, and case law)? Discuss in particular the limits of multi-hop inference.

Answer: The chain of reasoning produces incremental errors

Legal answers always come from different sources which, moreover, have different nature and rank.

The rule is in the law, the development in a regulation, the ratification in a National Court judgment, and the authentic interpretation in a Constitutional Court ruling (I’m looking at you, Gag Law).

The AI system must find precisely all these fragments and connect them with the corresponding hierarchy so as not to screw up massively.

The basic functioning is something like this:

1. Retrieval recovers several documents.

2. The LLM encodes tokens through contextual embeddings.

3. Self-attention establishes probabilistic relationships between fragments.

4. The model attempts to construct implicit inferential chains.

This process —called multi-hop inference— works reasonably well when the chain is short and the documents are well represented. When there are many hops, reliability degrades incrementally.

If each link has 90% accuracy, a three-link chain already drops to around 73%. With four, 66%.

In law, where one nuance changes the outcome, this is too much noise.

There is also a problem of normative hierarchy: the system does not natively internalize that law prevails over regulation, that special rules displace general ones, or that later law repeals earlier law.

It can reproduce these rules if you explicitly cite them, but it does not apply them systematically and autonomously.

If it is missing one step in this chain, it will invent it.

Even if it gets it right, it will not be able to reconstruct its “legal reasoning” because no such thing actually existed.

It’s like hiring a nerdy junior associate who has read everything, but skipped class the day they explained the sources of law because he went to play cards.

This is one of the most important points that make these tools excellent for support, but zero reliable for resolution: sometimes the result blows your mind and other times you wonder why you keep wasting time with this crap.

4. QUESTION What technical procedures can be used to resolve discrepancies between queries and documents? Why does dense retrieval fail in the legal context?

Answer: The client’s language versus “legalese”

Another problem: the user asks in their own words, the rule is written “in another dialect,” and case law in many cases reformulates it in a third one.

A client asks: “Can I fire my employee if they’ve been on sick leave for three months?”

The law speaks of “termination of the contract for objective causes related to supervening ineptitude or lack of adaptation.”

Case law emphasizes proportionality and the probationary period in Article 52 of the Workers’ Statute.

The AI system may fail to connect these three formulations if their vector representations are sufficiently different.

Solutions?

a) Query Expansion: The original query is expanded (and glabs) replacing synonyms, related concepts, and specialized legal terminology.

Example: “wrongful dismissal” is replaced by “unlawful contractual termination.”

b) Hybrid Retrieval: Combines BM25 and dense semantic embeddings.

BM25 captures exact matches and dense retrieval captures chunks of conceptual similarity.

c) Reranking: First a bunch of documents are retrieved and then a cross-encoder reorders results using deep query-document interaction in a second pass before showing you the results.

d) Query Rewriting: The LLM reformulates ambiguous or non-technical queries into legally relevant language.

e) Graph RAG: Semantic and normative relationships are represented explicitly through graphs.

These technical solutions improve the situation but add layers of complexity; they require a lot of brute-force parameter tuning through trial and error.

And above all, they do not eliminate the underlying problem: the embedding systems many of these models work with were trained on general texts, not on specialized legal corpora (“corpi”?).

5. QUESTION Describe the mathematical background of attention dilution in the processing of judicial decisions and long briefs. Explain the operation of Softmax in the self-attention mechanism and why attention weights become increasingly uniformly distributed among tokens as sequence length increases.

Answer: The problem with very long documents: “He who grasps too much holds too little”

The last problem is mathematical but has very practical consequences.

I’ll spare you the formula part, but if you’re curious, look it up: it truly explains what the mythical Attention Is All You Need consists of.

AI models process documents by assigning “attention weights” to different parts of the text. The longer the document, the more those weights are spread across more fragments, and the less attention the model can dedicate to what is truly relevant.

In a two-hundred-page judgment, the ratio decidendi competes for attention with the factual background, the description of evidence, legal grounds rejected by the court, and routine procedural references.

The model “pays a little attention to everything” and may lose precisely what matters: the key statement hidden in the thirteenth legal ground, or a procedural exception mentioned in one line that explains much of the ruling.

The current trend is to abandon purely linear text processing in favor of structural representations of legal knowledge.

Ultimately, Attention Dilution is an inevitable mathematical consequence of probabilistic normalization in excessively long sequences.

As context grows, attention disperses and the model’s ability to focus on legally decisive information decreases.

This is another of the fundamental limitations of current LLMs: rigorous analysis of extensive legal documentation.

You are reading ZERO PARTY DATA. The newsletter about tech and legal affairs by Jorge García Herrero and Darío López Rincón.

In the free time that this newsletter leaves us, we solve complicated issues related to personal data protection regulations and artificial intelligence. If you have any of those, give us a hand. Or contact us by email at jgh(at)jorgegarciaherrero.com

Suscríbete ahora

🗞️News from the Data World 🌍

.- Jorge will be at the CPDP next week at Brussels, if you happen to attend, He will be more than happy to have a coffe with you.

.- $12.75 million fine for GM for selling location and driving data extracted from the full set of sensors in a modern connected car. Let’s not forget the EDPB guidelines on this topic from 2021.

It is true that the famous Californian CCPA has the striking point of prohibiting the sale or transfer of data to third parties. Exactly what they did here.

.- Canadian DPAs (they like to complicate the formula by all being competent in their region), are investigating the data processing OpenAI carried out to train GPT. We saw it via San Luis Montezuma, together with what appears to be a partial conclusions document.

📖 Hard data docs for coffeine lovers ☕️

.- AI Act regulation and medical devices: German roadmap. The Bundesnetzagentur, the Hessian Ministry of Digitalization, and the German Federal Data Protection Commissioner jointly publish a roadmap for AI in medical devices, resulting from a regulatory sandbox pilot project. Authors: Louisa Specht-Riemenschneider, Kristina Sinemus, Klaus Müller, Marius Khan.

.- Haley Fine analyzes how existing privacy frameworks do not adequately cover AI’s ability to recreate a person’s voice and image with increasing realism, something that occurred after most current privacy laws were drafted. Deepfakes have caused what Anglo-Saxon law calls “likeness” (or “resemblance”): The deregulated “likeness” in creative industries: an urgent gap. In creative and media industries, this raises three questions with no clear answer: who can authorize the use of someone’s likeness, how that use should be compensated, and how synthetic outputs may be distributed. Traditional privacy principles —consent, purpose limitation, transparency— are relevant but insufficient.

.- The “judgment” economy: the humanities beat AI. Nils Gilman argues that AI will not destroy knowledge work but shift it toward what he calls the “judgment economy”: the least automatable capabilities —persuasion, negotiation, leadership under uncertainty, interdisciplinary reasoning, and strategic synthesis— will increase in value compared to the commodification of routine cognitive tasks. He ironically notes that liberal arts education, disparaged by figures like Peter Thiel, turns out to be exactly the training for the type of thinking LLMs do not replicate well.

💀Death by Meme🤣

🤖NoRobots.txt or The AI Stuff

.- The document that matches the big topic opening this newsletter. The draft of the guidelines for compliance with information/transparency duties in AI-generated content. Labeling everywhere. And reminding about the adaptation deadline for enforceability, this very August 2026. And, as always, the most useful part being the tables of yes/no examples for each point.

Among others:

1. Labeling of deepfakes and nuances for artistic and satirical content.

2. Transparency in texts of public/general interest if they have been generated by AI. Unless there has genuinely been human editorial intervention and responsibility.

3. The obviousness test: It is not mandatory to inform users they are interacting with AI if it is obvious. They give NPCs in video games as an example, though they could never fool anyone with their nonexistent intelligence and great ability to get in the way (or get stuck in a wall or doorway).

4. Personal vs. public use: The classic deepfake of your brother-in-law for a silly greeting card that never ends up online is exempt due to personal/domestic use. On the other hand, labeling is required in the very Spanish case of political deepfakes used to criticize politicians on social media.

   It also exempts standard text, audio, or similar editing functions that do not alter semantics, voices, or similar aspects. If in a podcast you had to declare content AI-generated because you used something of this sort to remove white noise or weird distortions, things would be getting out of hand. Same with a reviewed email.

5. Invisible and detectable watermarking and clarification of information.

6. Interaction with other regulations: transparency obligations apply without prejudice to data protection rules (GDPR), the Digital Services Act (DSA), and consumer protection. The usual reminder to never forget the GDPR.

.- What happens to the brain when it delegates to AI? The great Sergio San Juan reviews the available evidence on how the use of artificial intelligence tools transforms cognition, articulating three concepts: cognitive delegation (outsourcing mental load to tools), transactive memory (knowledge distributed among people or systems), and cognitive debt (accumulated loss of cognitive reserves due to abandoning mental effort). He examines the MIT study “Your Brain on ChatGPT” and points out its limitations: 54 participants, no peer review.

📃The paper of the week

.- As if we needed more parallels regarding bias risks, here comes another paper unlocking a new scare: whether the LLM manipulates you more or less depending on whether the company has sponsorship behind it: ADS IN AI CHATBOTS? AN ANALYSIS OF HOW LARGE LANGUAGE MODELS NAVIGATE CONFLICTS OF INTEREST. Study by researchers from Princeton and Washington Universities: Addison J. Wu, Ryan Liu, Shuyue Stella Li, Yulia Tsvetkov, and Thomas L. Griffiths.

Based on flight booking scenarios to examine advertising behavior/conflict-of-interest management in several models, as well as a hypothetical third-party case to see whether it could extrapolate beyond the main object. Among other conclusions, they determine that:

• Almost all models recommend sponsored options above cheaper and non-sponsored ones. GPT seems more pro-company at 50%, while Gemini and Claude go the other way at between 28-37%.

• The user’s economic level appears to be a key factor in recommending sponsored things or not. More for high-status users, less for those living paycheck to paycheck. The model doing some very interesting profiling for other areas.

• Some dark patterns involving hiding whether something is sponsored, hiding prices to avoid comparisons, or persuasive language.

• Some recommendations of things harmful to the user. For example, loans whose rates are not properly adjusted. Apparently the only one that resists screwing things up is Claude 4.5 Opus.

• More dark patterns when trying to push extra services you don’t want. In case anyone missed the classic Ryanair move.

📎Useful tools

.- An excellent awareness tool: TAKEN. “Taken” shows you in real time the data your browser passively delivers the moment any page loads.

.- Voice-Pro: zero-shot voice cloning and multilingual dubbing. Open-source web application (Gradio + Python) developed by ABUS AI Korea integrating speech recognition (Whisper, WhisperX, Faster-Whisper), zero-shot voice cloning (F5-TTS, E2-TTS, CosyVoice), text-to-speech synthesis in more than 100 languages (Edge-TTS, kokoro), and vocal separation (Demucs), in addition to YouTube video downloading via yt-dlp. It allows multilingual dubbing while preserving the original voice. With 6,400 stars on GitHub. As of version 3.2 all code is open source and free. Requires Windows with NVIDIA GPU and CUDA 12.4.

🙄 Da-Tadum-bass

In someone at Palantir’s head this seemed like a good idea. Surely the same person who waved a sword around the office.

Compartir

If you miss any doc, comment, or dumb thing that clearly should have been in this week’s Zero Party Data, write to us or leave a comment and we’ll consider it for the next one.

Why Bans Fail: Tipping Points and Australia’s Social Media Ban Why Bans Fail: Tipping Points and Australia’s Social Media Ban by Leonardo Bursztyn, Angela Duckworth, Rafael Jiménez-Durán, Aaron Leonard, Filip Milojević, Christopher Roth, and Cass R. Sunstein.

They have delighted us all with their conclusions about the success of the Australian ban on access to social media for minors under 16 years old. Organized through a survey of 507 teenagers who want to act tough by defying the established order, with expected and wonderful conclusions:

• Only one in four (27%) teenagers aged 14 and 15 comply with the ban four months after its entry into force.

• 75% of teenagers (je: the rest) consider that bypassing the restrictions is “easy” or “very easy”. Namely: entering a false date of birth when registering (44%), lying about their age in verification requests (57%), using an older sibling’s or parent’s account (42%), and redirecting traffic through a VPN (30%).

• The prohibition will only start to take effect if there is a sufficient critical mass of users who comply with it. The old saying about “locking the stable door after the horse has bolted” or “life always finds a way.”

• That 52% consider that the minor who complies is a fool. Insert Spanish-made meme of “I smoke to act cool.” And that influencers who have social media as their main entertainment (and source of income) wouldn’t even consider limiting access to networks.

• That 25% have received help from a parent, older sibling, or another adult to maintain or regain access to their accounts. The one we already mentioned about the Australian mother who found it funny that the girl got around it by posting a picture of her. Parental supervision also needs to be decisive and not just for laughs.

• Those who comply report positive aspects such as less pressure and more time with family, but at the cost of being bored and disconnected from their environment.

• 72% would prefer applications with built-in time limits rather than a total ban. What China did by restricting gaming times during the weekend, but without overdoing it with the greater possibility of enforcement over there (let’s call it that).

• That non-compliance is higher at 15 years old (68.3%) than at 14 years old (57.1%). The greatest social need.

Note to all of us, ArgonEUtas.

The book “Irresistible” by Adam Alter describes an experiment that gives us more clues about the difficulties of removing anything from your mind: the problem, according to him, is that suppression needs alternatives.

You know what you should avoid, but you don’t know what to occupy your mind with instead.

When a group was asked to ring a bell every time they thought about a white bear (the object of prohibition), the bells did not stop ringing.

However, when they were told that it might help them think about a red Volkswagen instead, their bells rang half as often. Suppression alone does not work, but suppression combined with distraction does quite well.

The most interesting thing is that, when they were later allowed to think about the white bear, those who had struggled to suppress their thoughts before were consumed by the image of the white bear. It was all they could imagine.

Meanwhile, the people who received a distraction in the form of the red car thought about the white bear occasionally—but they also had many other ideas.

You are reading ZERO PARTY DATA. The newsletter about tech and legal affairs by Jorge García Herrero and Darío López Rincón.

In the free time that this newsletter leaves us, we solve complicated issues related to personal data protection regulations and artificial intelligence. If you have any of those, give us a hand. Or contact us by email at jgh(at)jorgegarciaherrero.com

Suscríbete ahora

“I trust that small pieces of information, shared with different services (today, or agents tomorrow) will not be aggregated and correlated to create an inappropriately invasive model of me as an individual, violating my privacy.”

This is one of the classic premises of trust formulated by Benjamin Kuipers in the “Oxford Handbook of Ethics of AI” in 2020 as one more of the robotics laws in the style of Isaac Asimov.

But rules are made to be broken and Frank Pasquale coined the concept of “mosaic effect” a decade ago about that fracture. An empire of unheard-of size was built by combining and monetizing all those crumbs of information into profiles specific to each purpose.

Profiles that have never been used in favor of the data subject (as the innocent “premises” of Kuipers intended), but against them. Every time.

In the era of agentic AI, it is mandatory to revisit Choudary and his book “Reshuffle”.

“This is the ultimate promise of AI-driven reshuffling. Instead of simply linking tools together, AI makes sense of all the insights it collects through emails, sales calls, contracts, and financial data, weaving them into a coherent narrative. It connects the dots, determines what the picture should be, and fills in the missing details.

Agentic execution reinforces coordination without the need for consensus.

Once AI has regrouped fragmented information into a shared representation, agents can act on that representation autonomously, activating follow-ups, updating tasks, or escalating risks without waiting for human execution. In this way, that unified representation enables unified decisions and executions, which in turn enables coordination. Coordination, in turn, leads to control. The more teams rely on the AI layer to see, decide, and act, the more power that layer will have in the ecosystem.

This same principle is the one formulated by Palantir’s Nazgûls, only in terms more befitting their Sauronian dictatorial dialectic.

Of course, we are still talking about the study that revealed last Monday that the latest source of data to complete our profiles is precisely our conversations with Perplexity, ChatGPT, Grok, and Claude.

World Data News 🌍

.- This thread by Andrew Guthrie Ferguson explains an interesting case about to be tried in the U.S.: Can Google’s data be used against a person when they activated history services or fine location storage? Interesting combination of validity of consent to a service, admissibility of evidence in the criminal sphere, and expectation of privacy. What is relevant is no longer whether Google stores your locations, but whether it is acceptable for consent to a function distributed among several products (convenience) to potentially become a waiver of basic constitutional guarantees.

.- The DPC is going after Shein regarding international transfers to China. Let’s see what changes in the case of TikTok’s 530 million, but is it really possible to prove that nothing is sent or accessed from China headquarters? How much of a copycat will we have from TikTok? Many questions. Will they release several reports from glossy unsigned firms again? Will the DPC self-reference that the exceptional explicit consent of Article 49 is complicated?

The DPC finds that the requirement that consent be “explicit” and that it relate to “the proposed transfer” precludes a single consent being obtained for continuous and ongoing data transfers and/or different sets of transfers. The DPC is also of the view that seeking a single open-ended consent for continuous and ongoing data transfers and/or different sets of transfers is not compatible with the obligation to inform the data subject of the possible risks of the transfers being made.

Nerdy footnote: do not forget that we have an international body among the adequacy decisions in force since 2025: the European Patent Office. That of Article 45(1) “to a third country or international organization”.

On the topic of TikTok, we see in San Luis Montezuma the two resolutions from the two judges who rule on the DPC’s appeal not to lift the suspension. We are confused as to why there are two resolutions from two different judges that complement each other but dismiss the DPC’s appeal to lift the precautionary suspension of the sanction’s application. And nothing about having to ask the CJEU, or the fact that it is a coordinated action with other authorities implies applying specific criteria (which the GDPR determines that the lead authority is the one that has the final decision).

.- From Lukasz Olejnik’s Newsletter:

.-From Noyb comes an interesting one. The incentive/unethical practice of LinkedIn to hide part of the visitors who have viewed our profiles has a butterfly effect on the exercise of the right of access. Here it seems that there is a commercial paradox where LinkedIn releases all the information without any exercise of rights if you pay for premium (it shows it to you), but becomes very particular about Article 15(4) if you request it as an exercise of the right of access.

Noyb points out that under Article 15(4) it could be argued that they only provide information about those who have decided not to be visible to other users, but with the small problem that they incentivize no one to be in “anonymous” mode by limiting visibility. It’s not the first corporation to swing on Article 15(4), but we’ll see how it ends.

📖 Hard data docs for coffeine lovers ☕️

.- The EU is stepping on the gas with a recommendation for the implementation of verification, following the technical verification solution. It is going to be a curious second half of the year: June 30 as the maximum date for member states to present the detailed National Implementation Plan (PNI) to the European Commission, and December 31 for at least one age verification solution based on the “EU blueprint” to be available.

Along the way, a list of providers that the EC deems appropriate will be drawn up, and the report of recommendations from the Special Group on child safety online will be published by the same summer.

The European Commission highlights this as a necessary measure to ensure proper compliance with the DSA. The same DSA for which our CNMC has not been appointed as a relevant authority for its purposes.

And on Wednesday, that is, yesterday, a hearing was held in the LIBE Committee to address this issue. With our AEPD, the CNIL or EDRi. Let’s not let everyone’s rush be noticed.

.- Collective lawsuits against BigTech are making headway in Italy. Milan paves the way for Directive 2020/1828 by admitting a class action against Meta for data scraping that would have affected approximately 533 million profiles. You know: lawsuits filed by authorized entities without relying on individual standing and non-pecuniary damages based solely on fear or loss of control over one’s own data.

.- Paddy Leerssen, Joris van Hoboken, Gabriela Trogrlić, and Iris Toepoel’s book summarizes several actions aimed at enforcing Articles 14, 35, and 25 of the DSA in the civil jurisdiction of Member States. Perhaps the best approach is not the systemic risk, which is too vague, but that of dark patterns. But what do I know.El libro

.- The Institute for the Future of Work warns us how information and personal data captured in the office have become a strategic asset. When AI models roam freely in SaaS, agents, and business flows can capture tacit know-how, processes, and decisions capable of helping you automate procedures but also leaving you competitively on the sidelines: you are giving away the blueprint of your competitive moat. Sovereignty is not limited today to chips or national models; it requires caring for the entire value chain and harmonizing data protection, IP, business know-how, employment, and competition.

.- Along the same lines, Ellen Cushing’s article in The Atlantic: Workplace surveillance now captures and interprets emotions, not just productivity. At least in the USA. The emotion AI industry latches onto your office pipelines to consume and interpret video, audio, chats, or emails to infer attention, mood, attitude, and performance. The barrier to entry is almost non-existent, the promises unlimited, and the risk that they include customer and third-party data (and data from your own employees, of course) without a lawful basis is 120%. Then there’s that prohibition by the AI Act.

💀Death by Meme🤣

Banksy has placed a statue in London and, apparently, people don’t get it.

🤖NoRobots.txt o Lo de la IA

.- There might be an executive order on government oversight of AI models coming up. The irony is that Trump overturned Biden’s executive order that required models that could pose a risk to national security, economy, or public health to submit internally conducted safety reports and evidence.

It is suggested that the new Mythos from Anthropic has the potential to identify security vulnerabilities and how to exploit them, but one can never rule out the usual: vendetta against Antropic for not playing ball and ensuring the United States is the exclusive entity to cyberattack the Chinese, Russians, and whoever else.

Precisely, in Mythos there may be a confidentiality security breach due to unauthorized access. Many media outlets have reported it, but it has not been confirmed yet.

.- The Elon Musk vs OpenAI trial is giving us glorious afternoons. And more are yet to come.

.- AI is NOT your coworker. A long, well-written and better-documented post by Katalina Hernández with which I couldn’t agree more. And I’m not saying this -only- because of the quote she gives us.

🛠️ Useful tools

If you have an API key with some AI provider, you can install Mike, the vibe code version of Harvey or Legora.

Safe: it’s not going to be the same as Harvey or Legora, but it’s also safe to say that no one is going to charge you 3000 florins/user/month like they do.

My opinion: I haven’t tried it, if in two weeks a dozen forks with substantial improvements have already come out I’m pretty sure we’ll have something really functional available by the 27th or before, running locally.

We strongly believe in open-source software.

🙄 Da-Tadum-bass

Will Christopher Nolan’s next movie be a piece of nonsense? It’s impossible to tell, but this interview was fun. Among other things, Nolan-tending says that Odyssey, his upcoming film, is actually a superhero movie.

Share

If you miss any document, comment, or piece of nonsense that clearly should have been in this week’s Zero Party Data, write to us or leave a comment and we will consider it for next time.

Compartir

Si echas de menos algun doc, comentario o chorradón que manifiestamente debería haber estado en el Zero Party Data de la semana, escríbenos o deja un comentario y lo valoraremos para la próxima.

“What happens in Vegas stays in Vegas” and all that jazz.

And in fact, AI providers encourage us to use their models to integrate them into our daily decisions, so that we trust them in increasingly intimate contexts. Supposedly under that premise.

Well, no.

Narseo Vallina and his colleagues at IMDEA NETWORKS have done it again.

As they develop on this website, in a study conducted last April, they have discovered things that might surprise you and disturb you if you chat with AI models via the web (not through the API).

Models like Perplexity, ChatGPT, Claude, or Grok.

Little-known. And that nobody uses.

I invite you to visit the original website. Here, the only thing I am going to do is what I did last time (the Meta localhost scandal): translate what they have discovered into terms that a layperson in technology can understand.

· First, I tell you what they have discovered.

· Second: I explain how it works, how these companies do these things

· Finally, I give you the legal perspective, which has been my part in all this: the responsibilities that these companies may and should face.

You are reading ZERO PARTY DATA. The newsletter on technology and legal affairs by Jorge García Herrero and Darío López Rincón.

In the free time that this newsletter leaves us, we solve complicated issues related to personal data protection regulations and artificial intelligence. If you have any of those, give us a little hand. Or contact us by email at jgh(at)jorgegarciaherrero.com

1.-What have they discovered?

The websites of these four services have open doors on their websites that allow third parties to access your information:

.- Grok and Perplexity: Through Meta’s pixel

.- OpenAI: Through Google Analytics.

.- Claude: Through the Meta pixel, and Facebook, LinkedIn, TikTok, Amplitude, HubSpot, Pinterest conversion APIs, among others.

But “don’t leave yet: there’s more”.

Fasten your seatbelts: this is somewhat similar -at least for some users- to having a video camera pointing directly at their open diary.

“Well, the important thing is that they don’t have access to my ‘private’ conversations with Claude and ChatGPT, and that happens, right? RIGHT? HUH?”

The “title of each chat” is also shared.

This is not very good news: AIs have the bad habit of automatically generating a title for the conversation that summarizes its content, so if the conversation titles are:

“Depression tips”

“Aggressive tax deductions”

“They cheated on me, what do I do?”

“Lose even more weight” or

“Unusual cough”

… you don’t need to be Sherlock Holmes to infer the content of the conversation.

But also, the URL of your conversation: every conversation with your favorite AI has a link, and that link (that URL) is also shared with Meta and others.

And, as you can imagine, whoever has the link to “those chats” may end up having the script of the latest seasons of your favorite show: the one you star in.

It depends on the privacy settings of those links.

In Grok's case, the links were public by default at the time of the study and remain so at the time of this newsletter's publication (despite us having warned xAI).

You can check it out in this video:

Nothing to worry about: as shown in the following table, Grok (and other providers) share these links to chats with third parties.

Below, I only summarize a simplified and more understandable version.

Two clarifications:

1.- The study only certifies that the third parties mentioned (Meta, Google, etc.) “have access“ not that they have effectively accessed the indicated data. The study has focused on how accessible what is on this side: the websites of the AI services, not the other.

However, as we will see in a second, from a legal perspective, opening the door to third parties unrelated to your data processing already constitutes, in itself, a serious infringement for AI providers.

Regarding whether those third parties have accessed that data or not, well… everyone will have their own theory here.

2.- The specific access opened to each of those third parties depends 100% on the configuration allowed by OpenAI, Anthropic, xAI, Perplexity.

Do you know WHO it DOESN’T depend on in many cases? YOU.

As seen in the table, in many cases access is enabled regardless of whether you accept or not cookies, use ad-blockers, VPNs, or other browser protections.

A few seconds of reflection:

We trust that “our small pieces of information, shared (today) with different services (and tomorrow, with AI agents), will not be aggregated and linked to create an invasive model that violates our privacy.”

This is the classic “trust premise” enshrined by Frank Pasquale ten years ago.

Premise that is infringed millions of times a day in the adtech context.

The real risk is not in each of the scattered crumbs, but in the “mosaic” that forms when they are joined together.

And with the findings revealed today, it becomes apparent even to the most skeptical user that AI has put its formidable capabilities, among “others”, also at the disposal of the programmatic digital advertising machinery, one of the most powerful control structures of this sorry times.

2.- Explanation of the technical part: How does all this work?

This is the boring part, because unlike Meta’s localhost mess that was -let’s face it- a clever technical idea -for evil, but a clever technical idea-, on this occasion OpenAI, Anthropic, xAI, Perplexity have not invented anything new at all.

“URLs”, “Permalinks”

Conversation URLs usually work as permanent links (permalinks) with weak access controls.

In Grok, permalinks are accessible by default and guest chats are always public.

In Perplexity, Claude, and ChatGPT, permalinks are only visible to the user unless explicitly shared, but once shared, anyone with the link can access the content.

Explanation: If you copy the URL or web link of a conversation with ChatGPT or Claude and paste it into a different browser, you will get an error -unless you have accessed your account with your login and password in that new browser-.

That was not the case with Grok: when you pasted the URL or web address into a different browser (or in the same one, but in a new tab in “incognito mode”), you accessed your conversation.

That means anyone with access to that web address could also see it.

You, your boss, your ex-girlfriend, or anyone else.

Blatantly ignoring cookie consent:

In the indicated cases, trackers are activated regardless of whether the user accepts or rejects non-essential cookies.

For example, in ChatGPT and Grok, information is always sent to Google Analytics.

In Claude, server-to-server tracking only activates if non-essential cookies are accepted, but Meta’s Pixel loads regardless of consent.

Persistent cookies and Server-side tracking:

Cookies are not the trivial matter that the advertising industry has managed to make them out to be: they are like a barcode tattooed on your forehead. You don’t see it—persistent cookies aren’t easy to delete—and it singles you out with a unique digital footprint among all other users on the internet.

In the case of Meta (Facebook/Instagram) and TikTok, these codes are called `fbp` and `ttp` respectively.

With them, we are “marked” as if we were livestock at the BigTech fair.

Every time you visit a webpage that has Meta’s or TikTok’s “pixel” installed, these identifiers are read and sent to their servers. Thus, the company recognizes you as the same person who visited a clothing store yesterday, read a news article today, and is now using an AI chatbot, even if you haven’t logged into Facebook or TikTok.

How do they manage to receive your data even if you use ad blockers or take the trouble to reject cookies?

This is where “server-side tracking” comes in.

Your ability to block the sending of your information through cookies or pixels begins and ends with your browser. If the information is resent to third parties, not through your browser but from the server (”the cloud”), your controls can do nothing.

Companies like Anthropic (Claude) and xAI (Grok) use specific domains so that the cookies downloaded are considered “first-party” (from Anthropic or xAI). From that domain, your information is sent to conversion APIs (from Meta, TikTok, etc.), bypassing any protective action you can take in your browser.

Your browser only sees the connection with the provider’s own domain (Claude, Grok), and ad blockers or privacy extensions cannot intercept the traffic, which they would do if the real destination were not hidden.

Even if you go to the trouble of closing the shutters and windows of your house, these jerks come in through the chimney.

If this topic interests you (and it should), read, read Cristiana Santos.lean, lean a Cristiana Santos.

So what now?

When you write a prompt, the information (such as the permanent link to your chat, the conversation title, or even your email address) is automatically sent to third parties.

And the worst part is that, by combining the persistent cookie (`fbp` or `ttp`) with this data, companies can link your real identity with your content: your private conversations, even if you used the chatbot in incognito mode or without registering.

The `fbp` and `ttp` cookies are tattoos that identify you while browsing the web, and server-side tracking is a technical trick that prevents traditional privacy tools from blocking the flow of this data. Together, they manage to transform the conversations you believe to be private into valuable information for personalized advertising, analysis of your behavior, and enriching your user profiles in their hands.

None of this is new in the world of advertising; what is new is that it has been integrated in a hidden (and rapid) way into AI chatbots: contexts that are currently on the rise and particularly attractive because both you and I let our guard down in them.

Now let’s move on to the legal qualification of all this.

3.- What legal obligations have been breached here?

The analysis is generic because there are many breaches of varying scope, as shown in the previous table.

We will focus on “the big stuff”:

From the perspective of personal data protection legislation (GDPR in the EU), the user interacts or chats with the AI model for the purpose of obtaining answers to their questions or requests, whatever they may be.

When OpenAI, Anthropic, Perplexity, or xAI make user data related to these chats available to third parties, both (i) the mere act of making it available and (ii) the eventual access by said third parties are distinct processes that have nothing to do with what the user expects and with the service that is the subject of the contractual relationship with the user.

Therefore, AI providers are legally obliged to:

a. Inform about their processing in a clear and understandable manner

The legitimate expectations of the user hardly include the possibility that their conversations will be accessible to third parties such as Meta or Google.

The four companies use generic and ambiguous expressions to refer to the user’s prompts without specifically mentioning them when informing about third-party access: “user content” (OpenAI), “conversations” (Anthropic), “service interaction info” (Perplexity), and “user info” (xAI).

This is like “we will use your data to personalize your experience,” which can mean a hundred things and none, and has been specifically sanctioned by the AEPD.

The information should enable the data subject to understand what the hell is going to be done with their data.

And this information must be provided in a very specific way.

Not only the EDPB, but also the CJEU literally in paragraph 54 of its 2024 Meta Platforms Ireland (C-757/22) judgment imposes the obligation of the controller to inform the data subject in the following terms:

“The GDPR imposes an obligation on the controller, where personal data are collected from the data subject, to inform the data subject of the purposes of the processing for which those data are intended along with the legal basis for that processing and of the recipients or categories of recipients of those data, respectively.” (paragraph 54).

It is significant that even when OpenAI does offer this structured and linked information in accordance with the above, it does not refer to the practices observed in this study.

In short, these four companies, instead of complying with their transparency obligation, abuse the complexity of their privacy policies to overwhelm us with long texts and abstract concepts, omitting the key point that anyone could understand: that they provide personalized advertising giants with the topics of your conversations with their AI chats, and in some cases, the entire text of them.

In my humble opinion, this is something that deserves the same relevance as the ubiquitous “AI makes mistakes, check our responses” that is not missing from any interface to mitigate responsibilities if things go wrong.

b.- Having a legal basis for personal data processing

.- Having a specific legal basis for these processing operations (the same applies to third parties accessing this data for their own purposes).

This basis cannot be, as we say, the “performance of the contract between the user and the AI provider”.

It is debatable whether the training of the service itself with the user’s interactions are “objectively necessary” for the provision of the service (not in vain these companies swear and forswear that they do not train with the interactions, inputs and outputs of their users in the professional and corporate segments, so it is difficult to be indispensable with others what is not done with some).

What is indisputable is that opening access to third parties for purposes unrelated to the operation of the tool through mechanisms of adtech can be legitimized via contract.

This would only be possible through explicit consent (formula advocated by the EDPB) or legitimate interest (but the information about the processing and the possibility of exercising a right of opposition are conspicuous by their absence).

Additionally, this data processing must be covered by some exception to the prohibition of processing special category data.

It is a known and massive practice among users (and encouraged by providers) that users make inquiries about their health, psychological state, intimate matters...

It is precisely this fact that makes the results of this study so disturbing.

The longitudinal processing of these conversations over a significant period allows for the inference of all kinds of special category data such as religious and political ideology or the sexual orientation of the data subjects.

SRB / Scania doctrine?

The “silver bullet” used by these providers in this type of scenario (the scenario I am referring to is the one where “you’ve been caught with your hand in the cookie jar”) is one of two:

(i) anonymization or

(ii) pseudonymization (”de-identification” as they say in the USA) that prevents the recipient of the data from re-identifying users without disproportionate efforts in terms of time, material resources, or personnel (SRB / Scania doctrine).

The first thing to make clear is:

Even if any of these arguments were to save the legal basis (I wouldn’t bet a cent on this), the obligation to inform users about this third-party access has been completely ignored.

Now let’s see:

a.- Anonymization:

The robustness and effectiveness of any anonymization process can only be assessed on a case-by-case basis, and it would be necessary to see what each of these companies understands by anonymization, and whether what has been done is sufficient.

b.- Pseudonymization / SRB-Scania doctrine:

You will find few professionals more enthusiastic than me in finding suitable use cases to apply the Scania doctrine.

That said, it does not seem that the two global big data giants (Meta or Google) could benefit from this doctrine in any case, given their vast databases of personal data and their business model.

It should not be forgotten that the “insignificant risk of re-identification of the data subjects” (the cornerstone of this doctrine) must be assessed in light of the “context, purpose, and effects” of the processing carried out by the party accessing the pseudonymized data.

These companies literally live off combining different data sources to better personalize the targeted advertising contracted by their clients.

Spare me that, Meta and Google.

Lastly: What if “it has all been a misunderstanding” and Meta and Google had access but never read the data “wrongly made available to them”?

This says nothing about the responsibility of OpenAI, Anthropic, Perplexity, or xAI.

The mere fact of including tracking pixels on the website is a conscious design decision: allowing certain third parties access to certain personal data of your users for certain purposes.

We have seen this movie many times before: it was clearly stated by the CJEU in 2019 in Fashion ID (C-40/17) and in Wirtschaftsakademie (C-210/16).

In both cases, the third party was Facebook, and joint responsibility for the processing was found: the websites that embedded the pixel or allowed data processing by Facebook had to inform their users about this access, regardless of whether Facebook only processed data from its own users or did not allow the website owner reciprocal access to the obtained data (but only access to aggregated statistics).

“Moreover, by embedding that social plugin on its website, Fashion ID exerts a decisive influence over the collection and transmission of the personal data of visitors to that website to the provider of that plugin, Facebook Ireland, which would not have occurred without that plugin.” (Fashion Id, paragraph 78).

Consequently, the need for a legal basis on the part of the AI provider stems from the decision to embed the tracking pixel, regardless of whether such data is then accessed or used or not, which will be considered when assessing the responsibility of the transferee, if applicable.

Jorge García Herrero

Lawyer and Data Protection Officer