It is time to get a bit dramatic:

1.- In October 2021, Frances Haugen sat before the United States Senate Commerce Committee and revealed thousands of internal Meta documents.

The most devastating ones described what the company knew and concealed about the impact of its recommendation algorithm on teenagers. Instagram’s internal research concluded that the system redirected young girls toward content related to eating disorders and misogyny, even if they were not actively looking for it.

2.- The documents disclosed by Meta in the context of litigation in New Mexico reveal —we told it in March— that the company knew that its algorithm suggested four times more accounts of minors to potentially dangerous adults (prone to grooming and sextortion).

Almost one in four of these adults (attention: one in four (!!!) actually tried it (the data comes from the documents).

Did Meta correct this as a result of these data?

No.

Meta reviewed the facts and did not change the algorithm: it is not a bug but a feature when your ultimate goal is engagement optimization, and engagement increased with these practices.

The worst part is that there is no need to resort to leaked documents, if one has eyes in one’s face.

3.- Last week, a 15-year-old girl described in The Guardian the content she finds on Instagram and TikTok without looking for it: comments about other girls’ bodies, videos with degrading jokes, material that trivializes domestic violence or rape. She explains how she actively tries to avoid it, but finds it incessantly as soon as she opens her apps.

It is the same phenomenon documented by Frances Haugen with corporate slides, but it personally impacts me much more in the words of this young woman.

The recommendation systems of these platforms do not rank what the user wants to see, but rather the content that knowingly increases screen time “spent.” Engagement is the objective, but it is achieved on the backs of material that generates strong emotions and reactions —outrage, social comparison, fear…—.

If I had Instagram, The Guardian article (or rather some bro’s post laughing at it) would appear among the very first things in my feed.

4.- The CJEU has just declared that if a platform uses an algorithm to determine, in its own interest or in that of its service, the conditions, form or order of priority with which its users’ information is disseminated or displayed, it is exercising active control over the content.

And that control deprives it, according to the CJEU, of the liability exemption provided for in the ecommerce Directive for platforms that host third-party content.

The recommendation algorithm destroys the intermediary’s neutrality with respect to the content hosted by its users. That includes:

• The racist memes your children see on Instagram, YouTube and TikTok.

• The irrelevant content Google returns to you.

• The dodgy, pricey, but “recommended” products on Amazon.

• The obvious scam attempts Twitter shows you. And Elon’s nonsense.

• The most expensive flat (but the one that appears first) on Idealista or Airbnb.

• The AI slop songs Spotify foists on you because why not.

In the words of the CJEU:

111 As the Advocate General stated, in essence, in point 239 of his Opinion, it is, inter alia, by means of the algorithm used that such an operator exercises control over the information stored. So long as it has predetermined, by means of that algorithm, the conditions under which such information may or may not be broadcast, it is irrelevant that that operator does not itself carry out additional interventions which have the effect of promoting, modifying or deleting information stored with a view to it being broadcast.

112 In that regard, it must be made clear that if, beyond the mere categorisation and indexation of information for the purpose of improving its accessibility, the algorithm used determines, in the interest of the operator or its service, under what conditions, how and in which order of priority that information is or is not be broadcast, that operator exercises control over that information, with the result that the service it offers cannot be classified as an ‘information society service … that consists of the storage of information provided by a recipient of the service’, within the meaning of Article 14(1) of Directive 2000/31 (see, to that effect, judgments of 23 March 2010, Google France and Google, C‑236/08 to C‑238/08, EU:C:2010:159, paragraphs 115 and 117; of 12 July 2011, L’Oréal and Others, C‑324/09, EU:C:2011:474, paragraph 116; and of 22 June 2021, YouTube and Cyando, C‑682/18 and C‑683/18, EU:C:2021:503, paragraph 114).

5.- Last but not least: the fact that age verification —one of the recurring topics in this newsletter for all the worst possible reasons— has been the excuse for the CJEU to issue this monumental ruling is a plot twist worthy of M. Night Shyamalan.

Tuesday was a historic day. It remains to be seen how things evolve.

Because no one overlooks the fact that Schrems II was of very little use.

You are reading ZERO PARTY DATA. The newsletter on technology and legal news by Jorge García Herrero and Darío López Rincón.

In our free time from this newsletter, we resolve complicated issues related to personal data protection regulations and artificial intelligence. If you have any such issues, give us a hand. Or contact us by email at jgh(at)jorgegarciaherrero.com.

🗞️News from the Data World 🌍

.- The Dutch Autoriteit Persoonsgegevens fined transport app Yango €100 million for transferring personal data of users and drivers to Russia without adequate safeguards (yeah, as if there were adequate safeguards if you’re transferring data to Russia).

The Standard Contractual Clauses (SCCs) were intended to compensate for the deficiencies through pseudonymization and encryption measures, but the Authority found that until November 2023 the encryption keys were stored on the same Russian servers as the encrypted data. In addition, Yandex.Taxi LLC —which controlled the software and determined what data was collected— was classified as a joint controller, invalidating even the SCC model that had been used.

.- South Korea imposes a fine of $408 million on Coupang for the largest data breach in the country’s history. The Personal Information Protection Commission (PIPC) investigated a breach that exposed the data of millions of customers of the e-commerce giant, the Korean equivalent of Amazon. The penalty sets a record for enforcement under Korea’s privacy law, PIPA (and in Asia generally). The PIPC determined that Coupang failed to comply with its technical and organizational security obligations, as well as incident notification and management duties.

.- Starmer continues his personal crusade to tackle digital harms affecting British children. Now by repeating what Australia already did with mixed results: banning social media until age 16. What could possibly go wrong (again)?

And announcing the “ban” on social media through social media itself, with a message adapted to the format of those same platforms (and accompanied by a community note showing more common sense than the average public official).

And accompanied by an instant meme of a teenager reacting to the measure, exactly as happened in Australia. “I’d Stare at a Wall!” Stoic resignation or legendary sarcasm?

.- TikTok’s partial victory before the Irish High Court does not mean its data transfers to China comply with the GDPR: the court confirmed the violation of Chapter V, but annulled the DPC’s corrective orders due to insufficient technical reasoning.

The DPC failed to justify why the measures implemented under “Project Clover” were insufficient to prevent re-identification, despite having both the Mittal report and an independent review by NCC Group, both favorable to TikTok.

The case now returns to the DPC for that analysis to be carried out. The non-obvious point: the court did not question the technical adequacy of Project Clover, but rather the quality of the regulatory reasoning; the DPC could reach exactly the same conclusion again if it supports it with rigorous methodology.

Zero Party Data

TikTok: What Works and What Doesn't in the Kabuki Theater of International Data Transfers

It’s called “sunk cost bias”: since I had already spent half of my weekend studying the DPC’s sanction against TikTok, back in the day, I couldn’t help but do the same with last week’s ruling that reviewed it…

Read more

10 days ago · Jorge García Herrero

.- A Munich court has declared Google liable for incorrect answers provided by its AI Overviews tool.

It has not been a good week for Big Tech. The ruling establishes that, since Google deploys and controls the AI system, it is responsible for the incorrect information it generates, regardless of the fact that the content originates from a probabilistic model. The judgment does not address GDPR issues because the case does not concern a natural person, but it does recognize a violation of the general right to corporate personality. The broader consequence: the court equates deploying an LLM with engaging in editorial activity, something that could transform liability for generative AI providers in Europe long before the AI Act becomes fully applicable.

📖 Hard data docs for caffeine lovers☕️

.- The excellent infographics by Müge Fazlioglu for the IAPP on the interrelationships between the GDPR and:

• EU AI Act

• Network and Information Security Directive (NIS2)

• Digital Services Act (DSA)

• Digital Markets Act (DMA)

• Data Act

• Data Governance Act (DGA)

.- And Robert Bateman’s own infographic on the DPC’s original TikTok decision. It was still longer than the court judgment that sent the ball back.

💀Death by Meme🤣

🤖NoRobots.txt or the AI stuff

.- Claude Fable 5 came and, just as it came, it went away, by the grace of the Dorito. Meanwhile, in the EU we regulate competition out of existence. The joke writes itself.

.- Simon Willison reflects on the product-market fit of generative AI tools. He argues that most products built on top of LLMs still have not found a real fit with the needs of non-technical users. Willison distinguishes between adoption driven by curiosity or novelty and adoption driven by sustained usefulness, pointing out that most of the use cases generating excitement within the industry are led by developers evaluating the capabilities of the models themselves, rather than end users solving everyday problems.

The piece questions the metric of “active users” as an indicator of real value and proposes that true product-market fit in AI will be achieved when models become reliable and predictable enough to operate in critical workflows without constant human supervision.

The non-obvious insight: Willison suggests that reliability —not capability— is the real bottleneck, and that improving performance benchmarks without reducing hallucination rates does not bring models any closer to product-market fit.

.- European Parliament has also approved the AI Act amendments. The most important points:

• AI systems that generate CSAM content or nude images, intimate body parts, or horizontal sporting activities involving an identifiable person are prohibited (unless consent has been obtained for that purpose).

• Providers that take the risk of using this type of generally prohibited system may attempt to demonstrate that they have real and effective technical measures in place to prevent the generation of such content. The prohibition also applies to deployers, of course.

• The new implementation deadlines:

  • From 2 December 2027 for standalone high-risk AI systems.

  • From 2 August 2028 for AI systems integrated as safety components and regulated under sector-specific safety and market surveillance legislation.

  • From 2 December 2026 for the obligation to include watermarking in AI-generated content. The same deadline applies to systems generating CSAM content and “nudifier” content.

Precisely regarding labeling, the Commission’s proposed icons emerged from this discussion. What is mandatory is the labeling and readable marking required by Article 50, but at least here they went further than they ever did with standardized GDPR icons.

.- The EDPS, in a short Supervisor blog post format, reminds us that shadow AI can become a curious security breach risk.

Organizations need to be alert to ensure nobody uses unauthorized AI applications or services, and it is not a bad idea to implement unauthorized domain blocking, restrictions on corporate devices, and secure alternatives for whatever employees were trying to do on their own initiative.

.- Unexpectedly, we came across an Amnesty International report on the risks of generative AI. Even the title speaks directly to data geeks: Unlawful by Design. It provides a good overview of multiple biases, including certain actions by DPAs in high-profile cases:

• The dominance of English creates a bias whereby English-language information is considered more reliable than information in other languages.

• Opt-out mechanisms often work poorly.

• CSAM content is generated at alarming rates.

• Harm and hate scale with model size.

And then there is the following case, which is quite something:

🛠️Useful tools

.- Supertonic is a tool from Supertone for AI-powered voice manipulation and transformation, released as an open-source project on GitHub.

The tool allows modification of vocal characteristics —pitch, timbre, speaking style— through high-quality voice synthesis and conversion models, with applications in audio production, accessibility and content creation.

.- Markus Sullivan publishes a GitHub repository containing all CJEU data protection cases, EDPB guidelines, and the full GDPR text in PDF format, ready for download without scraping scripts or internal permissions. The repository is intended for those who need the data to train models, perform semantic analysis, or simply maintain an up-to-date legal corpus available offline.

And the LinkedIn post, as always, is very funny.

🙄 Da-Tadum-bass!!

Compartir

If you miss any doc, comment, or dumb thing that clearly should have been in this week’s Zero Party Data, write to us or leave a comment and we’ll consider it for the next one.

Starting from the end: Irish judge Rory Mulcahy upheld the €530 million fine against TikTok but annulled the additional measures: mainly the suspension of international transfers, returning it to the DPC to rule again. At the end of the post, I explain exactly what this is about.

Why?

Essentially, by resolving in a (very) different way TikTok’s fundamental allegation, which was the same: reversing the burden of proof (that the DPC, not TikTok, had to prove):

(i) the non-compliance with international transfer regulations and

(ii) the effective capacity of the Chinese parent company to identify data subjects from China (IT support staff accessed from China data hosted in Singapore).

In this way, two of my main obsessions over the past few years have merged into one: international transfers and the SRB/Scania doctrine.

You are reading ZERO PARTY DATA. The newsletter on technology and legal news by Jorge García Herrero and Darío López Rincón.

In our free time from this newsletter, we resolve complicated issues related to personal data protection regulations and artificial intelligence. If you have any such issues, give us a hand. Or contact us by email at jgh(at)jorgegarciaherrero.com.

Suscríbete ahora

Where do we come from?

Let’s say it bluntly, and it’s not the first time:

All companies violate the GDPR’s international transfer regulations when exporting data to a third country that has not been “deemed adequate”.

Why?

Two reasons

a.- Because the normative standard of equivalence required is materially impossible to comply with.

And not because companies have not spent hours generating paper: the problem lies in a double factor far, very far from their control:

a.1.- On the one hand, the legislation and practices of the importing country’s authorities are what they are -that is, they simply do not meet the European standard of “essentially equivalent” protection-.

For the love of God, do states “deemed adequate” such as the UK, Canada, or Argentina comply with this standard? (Don’t mention the US or Israel to me, it makes me laugh).

The rule even applies within Europe: cases can be found in the European Court of Human Rights’ own case law in which one EU member state has spied on citizens of another.

a.2.- This structural and ubiquitous deficit simply cannot be effectively compensated for by contractual clauses (or binding corporate rules) or ordinary organizational measures.

I told this story in the form of tales: There is a “pea” of public character that neither all the private mattresses in the world can cover nor compensate for.

b.- Because the standard of verification of legislation and practices imposed by the EDPB leaves no other compliance options than hard encryption (illegible from the importer’s shore), without a proper opportunity for a risk-based approach or considerations about each specific data export flow.

So, do we disregard everything and let “the wine live on”?

The conclusion of all this is not, cannot be “let the wine live on”.

Spoiler: this has been the dominant conclusion to date.

Wine, or some of its abstemious variants: the “chronic absence of TIAs” (let’s face it: they are very complicated to make) or the “cloned TIAs lacking nuance” and without normative analysis to support them have been the usual tone. At best.

That said, wine is not such a crazy option if we consider the price charged by international law firms for conducting the normative analysis of each importing country, which is the key support for the TIA.

And the result: their TIAs are like bad magician tricks: literally always the same rabbit with a different collar.

It is obvious today that this option (we will call it the “Cardhu option”) can be achieved much faster and for much less today with the help of AI.

What has changed? We’re getting there, we’re getting to TikTok

Fortunately, we are already having judicial rulings on the matter, not just from compliance authorities.

We already have much clearer notions of “what doesn’t work” and “what works”

There are two different things here:

a.- The exporting (or importing) company can do little if the importing state does not offer an adequate framework, as we have seen.

b.- But friend! accountability does not disappear, as argued spectacularly by Judge Rory Mulcahy in his judgment.

Although the company cannot fix foreign legislation, it must analyze whether that legislation actually applies to its specific flow, whether there is a possibility of access, who can access it, for what purposes... and determine and apply the relevant measures in its power to reduce the risk.

TikTok clung with hands and feet to the risk-based approach and argued before the DPC and the competent judicial authority that it was up to the DPC to do what it itself did not do: carry out an assessment that accredited the existence of risk in general, and in particular in its data flow.

The “reversal of the burden of proof” card does not work in this case because -and so says the judge literally-, the risk is advised a priori, and TikTok did a poor job in this regard.

TikTok did not adequately address the risk that processing would physically occur on computers within China, placing that activity under the direct sovereignty and jurisdiction of its authorities.

This is the slap that TikTok received again in full face: for simple accountability, you cannot expect the DPC to do the work that you did not do correctly at the time.

Judicial ratification of the sanction.

The DPC in the contested sanction dismissed once and for all the issue of complacent TIAs and “additional measures” of little substance.

TikTok had SCCs, legal opinions, encryption, advanced technical and organizational measures (”Project Clover”), and all of this was not enough because the real problem was remote access from China by staff located in China to data of European users stored outside China.

Additional measures

Before the court, TikTok has managed to reverse, not the sanction, but the additional measures imposed (the suspension of data transfers, which is no small matter) by essentially arguing two points:

- The principle of territoriality (if the data is outside China, the Chinese government does not have legal jurisdiction to demand it). This was already extensively argued before the DPC and will likely be dismissed again.

What the judicial body imposes is the evaluation of a (third!) report on the matter provided by TikTok that the DPC refused to consider as out of time.

- Lack of motivation regarding the “Project Clover”: TikTok implemented a set of technical and governance measures (Project Clover), including advanced pseudonymization and the use of an independent third party (NCC Group) to audit data flows. The DPC rejected these measures but did not provide technical or legal arguments as to why it considered pseudonymization ineffective in preventing potential re-identification of users by the Chinese state.

In fact, the Irish Court has imposed a reversal of the burden of proof in terms of the identifiability test on the DPC.

This, this is the tweet.

In the TikTok case, two of my favorite topics come together: the SRB/Scania doctrine and international data transfers.

But it’s Sunday when I write this and I feel like a drink.

We can make an executive summary useful for those who have been (or ahem, still are) in the wine option, are tired of the Cardhu option and/or however have work to do on their international flows.

What doesn’t work:

· Tantrums have never worked (arguments attempting to justify the material impossibility of compliance, its merely formal compliance or not even that “because it’s the only thing that can be done”). We’ve all been there at some point.

· It doesn’t work to invoke SCCs as if they were miracle water or a Harry Potter spell.

· It doesn’t work to hide the decisive risk - remote access to data “in the clear”, unencrypted - behind ambiguous formulas about where data “is stored” or how little the access lasts like “the access is ephemeral”.

· It doesn’t work to argue encryption when the provider inevitably needs to decrypt to operate.

· It doesn’t work to rely on open or single consents from the data subject for continuous and recurrent transfers.

· And, in general, it doesn’t work the idea that it is enough for re-identification, access, or communication to be “prohibited” in the abstract if in the real world they remain materially possible: it is a logic shared with the Scania doctrine and pseudonymization: legal prohibition cannot eliminate the real risk on its own nor allow it to be ignored.

What works

In any case, certain arguments do work to mitigate the sanction, but in a limited sense.

· Tattoo this: The biggest risk is not having an insufficient TIA (a TIA is insufficient by definition, as we acknowledge above), but having no TIA at all.

· The risk-based approach works. The judge says “I do not rule out the possibility that a supervising authority might nonetheless conclude that there is, in fact, no meaningful risk”. That’s the spirit.

· It works to accredit real diligence versus Kabuki theater of compliance: having made a serious TIA, having correctly identified the data flow, having precisely described remote access, having updated the information provided to the data subject, having reduced the data perimeter, having implemented effective technical measures against concrete risks.

· It also works to adapt and improve (even during the sanctioning procedure) in terms of transparency, as occurred with the legalization of the privacy policy, which the DPC took into account to modulate the sanction at that point.

· In other words, these arguments do not “legalize” what structurally cannot be legalized, but they do accredit.

· At this stage, where I am aware that only 10% of those who started reading remain, I can say “in private”: it does not work, it never works to take the diligent officials of the supervisory authorities for fools.

Have a very good week.

Jorge García Herrero

Lawyer and DPO

At first glance, based on what the Government and related public officials have published on X, this measure might not seem so bad if it complies with the element that “this will never leave the device at any moment.” And disregarding the lack of precision from some politicians regarding zero storage and other assertions. And considering that this is a country that has opened the door to Palantir in the henhouse of its National Health Service (NHS).

The second reading comes when individuals, companies, and entities defending rights start connecting the dots leading to a new edition of Chat Control.

Now with an English tailored suit, but with the same underlying purpose of potentially serving the same end. The continuous line of the obligation to provide information for the platform to categorize whether you are a minor or not, the necessary scanning of content to block what is considered nudity or similar, and the enablement of the tool/possibility to modify it as deemed appropriate at any given moment. Today in this area, but tomorrow in any other. A point raised by Signal in an ad hoc statement, rights defense entities, and the manifestation of the added problem of almost everything going through the three major players: Google, Apple, and Microsoft.

Everything points to another Chat Control in Europe. And communication to citizens in the worst possible way. It is understood that here, VPN maneuvers will not be sufficient to bypass restrictions at the device level itself, but we will see the alternatives minors have to circumvent this issue. Has anyone considered consoles and other parallel devices with internet access and browsing?

You are reading ZERO PARTY DATA. The newsletter on technology and legal news by Jorge García Herrero and Darío López Rincón.

In our free time from this newsletter, we resolve complicated issues related to personal data protection regulations and artificial intelligence. If you have any such issues, give us a hand. Or contact us by email at jgh(at)jorgegarciaherrero.com.

Suscríbete ahora

🗞️News from the Data World 🌍

.- Ireland is no longer just one of the tax havens tolerated by the EU. The UN highlights it as a “canary in the coal mine” due to the electrical and environmental weight of the AI boom. The article connects problems in meeting energy demand, regulations for data centers to generate their own electricity (nuclear energy is mentioned, uh), and the risk of a drastic increase in fossil fuels. Add the known consumption of water, land, critical minerals, and e-waste, and how the physical footprint of AI shifts to places that do not capture (barely) the value generated by the hosted computation.

.- We have been announcing an Armageddon caused by all those uncontrolled chatbots out there and prompt injections: does Meta count? Not yet, baby. It has been quite crazy, but we believe something more serious and widespread won’t be long in coming.

What happened with Meta? Well, only a bunch of idiots like Meta would be capable of reducing their workforce at a double-digit percentage rate to replace people with AI. In the security department. Granting elevated administrative privileges to a damn bot that -manifestly- had not been sufficiently tested.

Well then: the bot allowed attackers to “add email” issue 2FA codes, and bypass protections that, in theory, stop resets.

Automating recklessly amplifies social engineering and scales failures.

.- Your TV can be a “node” for web scraping: SDKs embedded in apps turn smart TVs -like yours and mine- into outlets for third-party traffic, useful for evading blocks by IP reputation. An Israeli company embeds pieces of code in the apps of certain TV brands (they are in the article), which allows third parties to enter protected websites (let’s say against corporate bot scrapers) bypassing the protection, because they are using (read: abusing) your IP accessing as if it were you or a particular person entering from your home. Needless to say that, just as they enter any newspaper to scrape, they could enter a website of those you would never enter and that store the IPs of their visitors. Do the math.

The alarm is not only about data protection: remote control of destinations, filtering by country, and the lack of authentication/signing suggest an infrastructure ready to segment homes as programmable resources, with externalities of blocking and criminal suspicion.

.- Do you remember the article I recommended so much last week about “first-party data theater”? Well, now you can apply the same logic to platforms like Spotify, which, by interposing between artists and their audience, mess up the service because, deprived of direct contact with their fans, they cannot do what they could barely achieve in the past: impose their conditions.

…And that’s why the rise of things like this Substack, which allows direct contact between content creators and like-minded people.

📖 Hard data docs for caffeine lovers☕️

.- Carlo Piltz makes it clear: if you do not mention or inform about “legitimate interest” in the notice of Article 13.1(d) GDPR, you cannot rely on it. The post lands the inveterate doctrine of the CJEU to German practice: the informative defect is not minor and leaves you without a legal basis.

.- CJEU C-585/26 “Trezor Company” and transfers to US processor Consenting to international data transfer does not suffice if it is not clarified which basis of Article 6 is used and whether that basis “covers” the act of transferring to the processor in the US. The post raises a nuclear doubt: is a separate basis required for the “transfer event” and, if so, when does it fall due to lack of (a)(b)(f)?

.- Cool resolution from the Norwegian Authority. The good Luis Montezuma sells it as an ideal decision “for training” in GDPR: a practical compendium on legal basis, valid consent, legitimate interest test, and compatibility.

And it certainly is…

.- Another case of evidence against an employee obtained with infringement of data protection guarantees that is validated for dismissal purposes, and subsequently compensated for infringement of fundamental rights. I am aware of Ribalta and all that, but these labor court rulings still make my head explode.

.- Interesting fine of 900,000 euros from a Berlin court. More than for the amount, because it is the end of the road of the famous sanction of 14.5 million to Deutsche Wohnen the German real estate company for eternal conservation. After appeal and prejudicial question to the CJEU, the sentence was revoked and the case was referred to a concrete instance to rule on the merits. In this case, back to square one: substantial reduction because it was done within the temporal framework of the real application of the GDPR, that the Berlin DPA did not adequately substantiate (it is not the only DPA that has had some scares out there) and the silver bullet of being able to prove during the procedure that you are fixing the issue (reference is made to hiring auditors and a lot of IT). Seen on LinkedIn, via San Luis Montezuma.

.- Interesting (but pasty, and with a font size incompatible with fifty-something eyes) “legal criterion” of the AEPD that lands in a curious case what “things are what they are, and not what the data controllers who could have been processors but then were not, say they are”.

💀Death by Meme🤣

Without this serving as a precedent, here the EU has been quite on point:

🤖NoRobots.txt or the AI stuff

.- The problem of AI regarding localization/dubbing comes back to Spain. Precisely the sector least willing to sign certain guarantees requested not to blow up the profession: video games. It is true that, in terms of dubbing, little more is needed to completely eliminate the actor than cloning their voice:

The Platform of Associations and Unions of Voice Artists of Spain (PASAVE), pulled out of the hat the following specific clause that Microsoft is not willing to sign (let’s not forget all its Copilot and direct interest in AI):

“The use of voice, modulation, timbre, gestures, and analogues of the voice talent and/or voice actor/actress is not permitted or transferred to be used for feeding, training, simulating, or any similar action related thereto, in artificial intelligence (AI) programs or projects, robotics, computer games, or any other methodology that uses or transforms the voice originally recorded by the voice talent and/or actor/actress, to be used for any purpose other than the one detailed in this agreement, which is to give voice and interpret the character/s of a specific production.”

Never lose sight of the video game industry, which is always very ready to make business decisions or press the nuclear button at the slightest provocation.

.- Within the framework of the procedure for provisional measures in the investigation of Meta for possible abuse of dominant position, the European Commission is indicating that it should restore free access to third-party AI assistants on WhatsApp. Nothing about trying to apply a price or payment that can distort competition.

.- About how META’s Smart AI Glasses have gone from almost activating facial recognition in the glasses stealthily (it was called name tag internally) to declaring that they no longer do. Just in case Wired catches them with their ice cream cart when publishing article.

On the same glasses, the EU may be starting to really move on the issue. Question from Renew to the Commission, something from the Swedish DPA in response to media inquiries, or the EDPB recognizing that it is beginning to assess where to start after receiving the report it commissioned on the matter.

.- The new AI services from Apple will not reach the EU for regulatory reasons. You break my heart, Apple. What do we have in the EU that they don’t have in the USA? (To start with, the problem is competition, not data protection or AI regulation…).

Also tune in to listen Legal4tech with superMario Guglielmetti (and Rosie & Jack).

📃The paper of the week

.- The paper of the week is this one by Theodore Christakis (“You Trust Your Chatbot With Everything. Should You? Part 2”), for several reasons:

(i) because the topic is fascinating (are AI chatbots really confidential?), and I don’t think there are many things more in vogue (remember that Christakis’ panel was one of the most interesting at CPDP).

(ii) Because it is longer than a day without bread, and it is caffeinated-caffeinated to the extreme, and last but not least.

(iii) because the good man cites Narseo Vallina, the rest of my colleagues at IMDEA Networks, and me, for our work on embedded trackers and other privacy leaks in the web interfaces of the four major AI providers.

Ask Rumpel a question

Rumpelstilstskin (“Rumpel” for friends) is our personal assistant to browse through resolutions, judgments, guidelines, and various materials that works locally (without asking commercial AIs).

We like to see if it is capable of decently answering complicated questions.

This question is a preliminary ruling submitted this week to the CJEU (to be honest, it’s not something to tear your shirt over):

“Where both the platform operator and the website owner are jointly responsible for the processing of data when a website is accessed via a platform, are the controllers then required to make the essence of their arrangement within the meaning of Article 26(1) of the GDPR available on that website or at least on another website to which the accessed website refers by means of an appropriately marked link?”

Do you have any questions for Rumpel?

Useful tools / 🙄 Da-Tadum-bass!!

I must have watched this video twenty times this week, and it always puts me in a good mood: if you have a more useful tool than this for these trying times, show me

! [Insert the goose meme: “Show me, son of a bitch!”]

Compartir

Si echas de menos algun doc, comentario o chorradón que manifiestamente debería haber estado en el Zero Party Data de la semana, escríbenos o deja un comentario y lo valoraremos para la próxima.

Your €20 AI subscription was being subsidized.

The first one is free.

Buy today and pay tomorrow.

But ah! 2026 is the year of IPOs and, once again, there won’t be enough bread for so much sausage.

They’ve already sold us the chimera; now they have to sell us valuations that are, ahem, solid, based on the bottom line of, ahem, serious financial projections.

So the time has come to raise prices so that revenue projections don’t look quite so terrifyingly disconnected from CAPEX projections.

And that’s where we are: Anthropic and OpenAI have severely guillotined the tokens linked to their subscriptions. Anthropic had already cut the unlimited token buffet for agents. Google is launching paid Gemini plans while also tightening the free tier. Copilot has also moved to pay-per-token consumption, causing quite a mess on GitHub.

I was commenting with Sergio Maldonado that we’ll tell our grandchildren we lived through the golden age when “they were giving it away.” Well, kid, that’s over now.

And prices will keep rising vertically, make no mistake: there is no hiding that this technology is very expensive, and this has only been the first step. This increase does not bring the matter anywhere remotely close to profitability.

In 2026 we will still see smiling faces in the AI technocracy. But once they’ve managed to offload a good fraction of gold-priced shares onto us, it will be time for the fangs.

Wave goodbye to spending the afternoon generating 50 silly images to share with the family. Say farewell to wrappers and token resellers.

Get ready to upgrade your plan and still burn through it in a couple of prompts.

Say “Hello” to open models.

Hold on tight: Winter’s coming.

You are reading ZERO PARTY DATA. The newsletter about tech and legal affairs by Jorge García Herrero and Darío López Rincón.

In the free time that this newsletter leaves us, we solve complicated issues related to personal data protection regulations and artificial intelligence. If you have any of those, give us a hand. Or contact us by email at jgh(at)jorgegarciaherrero.com

Suscríbete ahora

🗞️News of the Data-world 🌍

.- First news that an association of age verification solution providers has been established (Age Verification Providers Association), but they come out swinging in this LinkedIn post attacking the AEPD’s decision against YOTI. And calling for the EDPB to issue specific guidance on the matter. Something similar to last year’s declaration, Statement 1/2025 on Age Assurance? Or perhaps the more recent joint opinion with the EDPS on the possible change to the Article 9 exception for verification necessity through the Digital Omnibus?

Far from trying to play the strongest card of arguing that this is biometric processing not prohibited by Article 9 because it does not have the purpose of unique identification, they almost seem to acknowledge that there is no other way to do it. Therefore, we might begin to suspect that all alternatives follow essentially the same template as Yoti. Bleeding all the way to the million-euro mark from the same wound: Article 9 processing that is difficult to legitimize.

They criticize the AEPD somewhat for pointing out the obvious problem of consent, but there isn’t much else available. Legal obligation doesn’t work (the DSA doesn’t allow it in the required way), and legitimate interest must be built around the Gordian knot of proportionality and necessity. Especially now that a supposedly less intrusive alternative is arriving in the form of the EU app. And there they push back somewhat on the point that relying on a PIN carries the clear risk of “shoulder-surfing” attacks.

It also doesn’t help when the argument is framed in very COVID-era terms of simply having something that works:

“The AEPD’s decision, by treating the biometric facial template within a consumer identity app as special category data that cannot be made a condition of service, points toward a future in which the most secure authentication option is legally the most difficult to deploy. The least secure option is the path of least regulatory resistance.”

Nor does it help that the Digital Omnibus, regarding the GDPR section, appears—unless things change—to require exclusive control by the data subject in order to apply the exception. Exactly the opposite of how these systems operate.

A good opportunity to remember the EDPB’s dual possibility regarding biometric processing under Article 9 and non-Article 9 biometrics. In those very guidelines that overturned the previous interpretation assumed by the AEPD.

.- In relation to the same issue, it is worth remembering that this technology fails spectacularly: case in point, The United Kingdom mistakes children for adults. New Home Office figures reveal that, in the second half of 2025, 17% of migrants classified as adults turned out to be minors.

The practical consequence? Minors wrongly classified as adults ended up sharing rooms with adults without any safeguards, according to the Helen Bamber Foundation, which documented cases involving children as young as 14. Now imagine your own child in that situation.

The Helen Bamber Foundation, the British Association of Social Workers, and Human Rights Watch warn that AI reproduces biases and fails to account for the effects of trauma, malnutrition, and exhaustion on the physical appearance of minors.

.- Regarding the less discussed DMA, THE General Court of the EU annuls the Commission’s decision designating Meta as a gatekeeper in its marketplace. However, it considers the designation appropriate regarding the separate “Messenger” service.

.- This European Parliament document on the “debate” around the minimum age for social media is quite interesting. In a relatively short document, we get a linked compilation of the main legislative attempts by multiple countries to achieve this impossible objective, references to the rather underwhelming Australian experience, a collection of minimum consent ages across EU countries (Spain keeps talking about 16, but not yet), the French case that advanced legislation until the Commission stepped in, and what we already know about the GDPR, DSA, and EU Identity.

.- Another blow delivered by Dr. Ferguson, but it is satisfying when knowledgeable people simply keep stating facts plainly.

And with solid reasoning, via Substack. The important thing is not merely to say it, but to argue it as convincingly as possible.

Secrets of Grimoire Manor

A New Study Spells Bad News for Cellphone Bans

The latest study of cellphone bans caused shockwaves as it appeared to be really bad news for advocates of the bans. This study basically compared a specific type of ban, lockable pouches (such as Yondr pouches) with schools that did not use them. Across the board this was basically a null study…no benefits to standardized testing scores, classroom atte…

Read more

2 months ago · 23 likes · 2 comments · Christopher J Ferguson, Ph.D.

Do not miss the following article: save it for the weekend or do whatever you need to do, but don’t miss it: The messy middle reflects with disarming humility and clarity on the challenge we will face as a society until the supposed universal benefits of AI and automation arrive. If they arrive (for everyone). Well-grounded and filled with excellent charts, this article should never let you sleep well again. You’re welcome.

As an example, here’s one.

.- Adtech: Excellent article by Abhi Yadav: First-party data theatre regarding Publicis’ acquisition of LiveRamp, one of the most despicable companies I’ve ever had to go toe-to-toe with. First-party data (1PD) had its heyday as a response to the tyranny of Meta, Google, Apple, and the other “walled gardens” (territories where trapped consumers could be offered products and services under the conditions imposed by the local feudal lords).

The author explains transparently how service providers for exploiting 1PD actually take ownership of the inferences extracted from the data, turning the owner (the responsible company) into a servant. Added to that is the fact that inferred data becomes more valuable the more first-party data flows into the pool, but—for the same reason—the larger you are, the more profitable it becomes. The counterintuitive moral is that your competitors can eat your lunch using your own first-party data if they hire the same platform you do.

If you are not clear that these types of platforms routinely identify data subjects even when they have different IDs or hashes for each client, it is because you do not remember the Criteo case.

Zero Party Data

Singling-out, identifiability and accountability gaps

Whatever happens with the Digital Omnibus (and as regards Article 4 GDPR it already seems quite clear that nothing is going to happen) we will have to live with the SRB Scania doctrine (the subjective interpretation of the concept of “personal data…

Read more

4 months ago · 2 likes · Jorge García Herrero

.- AI rewrites consumer contracts. This article struck me because of how accurate it is: Dave Hoffman weighs different scenarios in which companies respond with AI to the flood of complaints that consumers can now generate very easily. The reaction could be either longer, more tedious, and more detailed contracts, or more ambiguous clauses.

What is interesting is that he places the real leverage in historical data regarding each consumer’s willingness and tendency to litigate (in my case, I rarely file complaints, but when I do decide to go all in, I really go for it—right, Meta and El Corte Inglés?).

📖Hard data docs for coffeine lovers☕️

.- The CNIL sanction against IQVIA is packed with interesting points: we produced an extensive note and here you can read an excerpt.

.- Saint Luis Montezuma brings us the latest report from the Norwegian authority, which asks whether it is legally possible to offer AI-based chatbots anonymously. The document reviews the liability framework applicable when an operator intends not to identify itself, the conditions under which anonymity could be compatible with the GDPR, and the steps necessary for such a model to be lawful. The approach is interesting because it addresses the perspective of a provider seeking to offer its service while minimizing regulatory exposure.

More from Luis: the Lower Saxony Data Protection Authority published FAQs on the use of AI, while the Belgian Authority completed an investigation into a smartphone conversational application that uses AI and language models.

.- SuperMario Guglielmetti raises a very interesting point regarding the famous warning issued by the Garante to Myndoor over the plugin that read workers’ conversations in Slack and Teams to detect psychological stress: if the analysis is based on text and not biometrics, it may not constitute emotion recognition.

For my part, I would add that the provider cleverly relied on each worker’s consent to process their data, but where I come from conversations involve third parties, and those people probably neither knew about nor could object to such a delightful form of processing.

💀Death by Meme🤣

🤖NoRobots.txt or The AI Stuff

.- Two gems from 404:

The first is a story that took me a while to believe: Meta’s chatbot gave away Instagram accounts. Pro-Iranian hackers compromised high-profile accounts—including the archived White House account from the Obama era, Sephora, and a senior U.S. Space Force officer—by exploiting a vulnerability that seems designed by someone with a severe cognitive deficit. The attackers simply asked Meta’s support chatbot to link the target account to a new email address. Zuckerberg’s team had handed the palace keys to the bot, giving it permission to make account changes, generate a verification code, and send it to the attacker.

Meta integrated AI support into all Facebook and Instagram accounts in March 2026 with password recovery capabilities. Victims report that there is no way to escalate the issue to a human operator.

As I said, difficult to believe even for a skeptical bald man.

.- The second: Microsoft wants you to become addicted to Scout. Internal Microsoft documents leaked to 404 Media reveal that the plan for Scout—the OpenClaw-based personal assistant integrated into Microsoft 365 and announced this very week—is structured in three phases, with the first phase explicitly being “make people addicted.”

Well then.

.- This story has already gone viral, but it remains one of the most interesting stories around. We already had one involving AI-generated documentation that made it into a U.S. courtroom, but we were still missing the lawyer trying to fool the AI performing the first case screening in Brazil. A textbook prompt injection, but in an evolved form of the old trick of hiding something that only the AI processing the CV sees first.

We will see many similar stories across the thousand filters that public administrations will introduce into citizen procedures. And judges resisting the temptation to conduct speculative investigations based on a defendant’s face.

.- Really interesting article about the AI actress nobody asked for. The New York Times Magazine presents a detailed profile of Tilly Norwood, the first entirely AI-generated “actress,” created by Eline Van der Velden through the Xicoia studio.

📃Paper of the week

.- Bring Your Own Device — Now Hand It Over! Rescuing Workers’ Privacy During Data Searches by Virginia Mantouvalou and Michael Veale. The BYOD (Bring Your Own Device) practice and personal-professional cloud storage create gray areas where employers may legitimately require access to a worker’s devices and data—based on data protection laws, freedom of information obligations, or procedural law—without any effective separation between the private and professional spheres.

.- A paper presenting the opposite side of the story from an LLM inventing case law citations or legal reasoning. In an experiment comparing whether an LLM or a professor would better answer questions from first-year law students (in the U.S. course known as “Contracts”), the LLMs won by a landslide with roughly 75%. They were also friendlier, though that is nothing new. AI always flatters you. Seen via Ethan Mollick on LinkedIn.

Jorge’s postscript: I would like to see the same study with LLMs, university professors, and practicing lawyers competing against each other.

🛠️Useful tools

- Following the publication of the AEPD’s 1,500 reports, we now have two inventions:

• Rumpelstiltskin: our own little goblin.

• The Claude artifact version by Jorge Morell that we were all waiting for when the AEPD released the reports.

🙄 Da-Tadum-bass

Compartir

If you miss any doc, comment, or dumb thing that clearly should have been in this week’s Zero Party Data, write to us or leave a comment and we’ll consider it for the next one.

CPDP 2026 will be remembered (at least by this bald guy) as the “Luis Montezuma Edition”.

“Veni, vidi, vici”: Luis Alberto Montezuma arrived, saw, and conquered: everyone knew him, and everyone was grateful for his generous work while we discreetly scrutinized his eyes and clothes to ensure he had no wires, chips, or batteries powering that tireless knowledge-publishing machine.

Nope: he’s human. His secret is the magical Colombian arepas, apparently.

We all know by now that just following him will keep you informed of 90% of what you need to stay up-to-date.

Below, a summary of the panels I attended and those I missed but were recommended to me, culminating with my personal top picks:

In the prelude, Sophie Stalla-Bourdillon demonstrated that, in addition to having mastered the SRB Scania doctrine, before SRB and Scania, she is a very competent moderator.

A couple of gems from Philippe Latombe (the MEP who challenged the DPF before the CJEU and now is part of the CNIL):

“80% of the CNIL’s time is spent informing initiatives of the French Government, not on enforcement tasks”.

Who gets in? The Policy Dilemma of Age-Gating: I learned here that in Australia, the processing of biometric data for mere age determination is prohibited biometrics.

The Belgian Youth Council representative Camille Biot clarified what no one says or hears: that “youth” is not a single collective but a very diverse one, with many different interests.

That diversity alone already disqualifies any measure that aims to authorize binarily (you have access / you do not have access) the entire collective solely based on their biological age.

She said more: “approve whatever you want, shitty boomers: we young people will keep accessing”. Possibly she did not say exactly “shitty boomers”, but well, you get the idea.

The burden (the consumption of personal data for age verification et altra) should not fall exclusively on the user.

The commissioner also left an interesting point at the end: “when I was in high school, gay kids were very pressured and alienated, and social networks constitute an unparalleled tool for them to find their community”.

In “Breaking silos” (not very interesting) a couple of comments from the representative of the French association of DPOs AFCDP caught my attention, about an elephant in the room: “the growing pressure and workload, the need to stay updated, etc., have led us to offer psychological support resources for our members”.

GDPR class actions: the state of play (interesting, but I doubt it was recorded).

Three interesting things: the very frustrated attempt to disrupt the panel by a lawyer defending one of the defendant companies, the characterization of the background behind the collective lawsuits of Privacy Collective, this here and meeting Peter Hense in the flesh.

I wasn’t at The role of operating systems in trusted AI but it was one of the most recommended of the day, and I will watch it when it comes out.

Vital Signs: Regulatory Coherence, Interplay, and Alignment for Medical Device Cybersecurity: the typical super useful panel to situate yourself in a specific matter from different points of view: the talks were well supported by the presentation, very clear, and very didactic to understand the swarm of applicable legislation in this matter.

On Thursday, I wanted to go to Secondary use of data under the European Health Data Space: some relevant issues moderated by Pablo Trigo, but they changed its location: (nonetheless, I heard it was fantastic) and I went to A Child-Centred Approach to the EU Digital Rulebook. Another 100% educational panel with a special mention for Simone Van der Hof, I am quite sure she is one of those professors who change your life.

Informed consent: The breakthrough in Art. 88b GDPR / Digital Omnibus and current initiatives in the field of PIMS and technical standardization. A very interesting panel and a chance to see a force of nature in action: Anja Wyrobek, a commissioner making some very questionable points: Magdalena Steringer, and an explanation about the challenges and solutions posed by that proposal of 88b.

What is so special about special categories of data?. Especially interesting were the interventions of Ruth Boardman

The Agentic Assistant: What does Big Tech’s goal of creating a universal digital intermediary mean for society? Really interesting were the interventions of Udbhav Tiwari from Signal and Frederike Kaltheuner.

Eye tracking in video games: Opportunities for game development and risks to privacy. Very Good.

I participated in the workshop From Pseudonymisation to Synthesis: A Debate on Evaluating Privacy-Preserving Technologies and Re-identification Risks in Medical AI under the GDPR (a practical case to be resolved between two opposing teams formed with the attendees). The idea was brilliant, but there was very little time and I would say at least half of us were hungover. I was on the team that upheld the rights of the data subject and we triunphed, of course.

It is notable to indicate that the team defending the company did not think to allege in a pure form the proposal that gave title to the workshop: “In so far SRB Scania doctrine applies, therefore GDPR does not apply”. Which was the whole point.

Digital Omnibus meets the Charter of Fundamental Rights – a reality check with Max Schrems and especially my friend Rosalia D´Agostino, whom I also had the opportunity to meet in person. I recommend her podcast again Legal4Tech.

I wasn’t there, but it apparently was excellent: Dragnet Data Protection: Dilemmas of Web Scraping and Public Interest Research

The AI Act: AI regulation and its implementation in troubled times with Mantelero not selling but teaching his book and Gloria González Fuster yes selling her book, but above all, complaining about her (well-deserved) reputation as a grumpy one to immediately confirm it by grumbling - amusingly - about a drama as tragic as recurrent when concluding the negotiations of the relevant legislation text.

You will have to watch the video to find out: HA!

My two favorite panels (ex-aequo, as in Cannes):

Gendered Digital Labour: Unseen work, exploitation, and technology-driven inequalities.

If this panel had been a TV series (and it could be), I would binge-watch all six seasons. The discussion started with precarious workers subject to platform supervision but above all control.

Aída Ponce del Castillo presented the Platform Work Directive – “if the conditions for the application of the Directive are met, the worker contracted through a platform is a platform worker” (!!!)

“the working conditions are coded in the algorithm”

However, after Madeleine Thomas’s intervention – a character very hard to forget, but I won’t reveal why here – the panel’s interest and the panelists’ passion skyrocketed. The focus shifted to social media content generators, the possible application of the Platform Work Directive (”It depends”), but above all the possibility of implementing PETs (Privacy Enhancing Technologies) on user-generated content that allows identifying those who leak content, dox their creators, and upload it to other platforms for uncontrolled virality. The technology exists; it only requires stakeholders to decide to invest in its adoption, thus demonstrating that they do not give a damn about the creators whose content they monetize and exploit.

Wouldn’t that be wonderful?

And much more.

My Chatbot, My Confidant? Protecting User Privacy in Generative AI Conversations, moderated by Theodore Christakis. Fascinating.

Some striking points:

.- 230 million users make health-related queries to ChatGPT every week.

.- All guidelines and efforts by the EDPB (European Data Protection Board) or the EDPS (European Data Protection Supervisor) still focus on the past (AI training) when the real issue lies in the present: the indiscriminate personal and business use of chatbots with very unclear privacy safeguards. The panel focused on aspects such as judicial access to chat history, overlooking the growing evidence of leaks for purely commercial purposes.

.- Yann Padova (who has become Gandalf) left a couple of memorable quotes worthy of a t-shirt:

“AI is disproportionate by design” or “legal loopholes in the EU?”

Beyond the panels, it was greta to sharing oxygen with Gloria Gonzalez Fuster, Itxaso Domínguez de Olazabal, Laura Centeno, Guillermo Lazcoz, and beers with Jeimy Poveda, Ainara Bordes, Isabel Barberá, and David González Calleja, as well as a lot of interesting people I met whose names I don’t remember (apologies to them) because I am already very, very old.

Next year, more. And now, the newsletter: we have a lot to cover.

You are reading ZERO PARTY DATA. The newsletter about tech and legal affairs by Jorge García Herrero and Darío López Rincón.

In the free time that this newsletter leaves us, we solve complicated issues related to personal data protection regulations and artificial intelligence. If you have any of those, give us a hand. Or contact us by email at jgh(at)jorgegarciaherrero.com

Suscríbete ahora

🗞️News of the Data-world 🌍

.- Not only Pope Leo XIV (see below in the AI section), but also the fight against the construction of data centers has united a cross-party citizen majority in the US: The American rebellion against AI is a fact and gaining momentum (reported by a media outlet unlikely to represent tree-hugging hippies: the Wall Street Journal). Local communities have managed to block or delay at least 48 data center projects valued at over $156 billion in the last year alone. In the first quarter of 2026, a record 20 projects were canceled due to local pressure from neighbors. Republican politicians in Texas and South Carolina have called for moratoriums on hyper-scaler developments, citing the impact on power grids and farmers. Democratic candidate Justin Pearson in Tennessee is making opposition to xAI’s Musk data centers a central part of his campaign. Only 17% of Americans believe that AI will have a positive impact in the next two decades.

Meanwhile, in Spain, projects in Extremadura, La Mancha, and Aragon are full steam ahead.

.- Who really writes or rephrases all those clone-like posts about leadership that you see on LinkedIn, signed by... people you’ve never heard of on LinkedIn? Find out here.

.- Technological sovereignty: The European Commission is promoting restrictions on the use of US cloud providers—AWS, Microsoft, Google—for processing sensitive public data from European governments. The “Tech Sovereignty Package,” presented yesterday, May 27, defines sectors whose workloads must be hosted on European cloud infrastructure: healthcare, finance, and the judicial system are the priorities. The measures apply only to the public sector, not to private companies. Thibaut Kleiner, Director of the Commission, warned that Europe risks being relegated to a “technological colony.” The irony is that in April, the Commission itself awarded a €180 million contract to sovereign cloud projects including an alliance between Thales and Google Cloud.

Utah requires adult content sites to verify the age of all their users, including those accessing via VPN. The article humorously summarizes the difficulties in implementing this proposal, similar to that infamous magistrate from the Audiencia Nacional who ordered the “closure of Telegram”.

And along these lines, politician vs specialist. Specifically, a British politician ignoring how well the topic is progressing in Australia (and mixing certain elements in the argument to justify himself) vs a renowned academic researcher in applied psychology (mainly in video games where there are never minors). And the added joke that in the United Kingdom, any platform is obliged to collect identity documentation from every user.

.- Yesterday, the AEPD published that it will bring the issue of investigating the leak of conversations in major AI services/assistants, which we covered in a special issue here (and in which Jorge participated), to the EDPB itself. It will do so in two ways: an informative note for the knowledge of the rest of the DPAs, and a proposal that it be addressed at the plenary meeting on June 8 and 9.

We’ll see how it ends up, but it’s good news in the crazy world we live in.

And this infographic from the CNIL, very much for the lay citizen, but which clashes badly in points 3 and 4 with the investigation of the AI leak:

📖Hard data docs for coffeine lovers☕️

.- Amadeus shatters the record for the highest fine from the AEPD, with 14.4 million euros.

.- Formal complaint from the Gesellschaft für Freiheitsrechte (GFF) to the Irish Coimisiún na Meán for systematic non-compliance by LinkedIn with Articles 17 and 24(5) of the Digital Services Act (DSA).

Between October and December 2024, 77.1% of LinkedIn’s content moderation decisions in the DSA transparency database cited only a “generic violation of platform policies” without specifying what content, why, or which specific section. Article 17 of the DSA requires clear and specific reasons that allow the user to understand the decision and exercise their right to appeal. The most amusing thing is that the DSA transparency database — designed precisely to audit moderation patterns — is being used by LinkedIn to formally comply with the notification obligation, while reproducing exactly the opacity that the regulation aims to eliminate, turning the control instrument into a regulatory whitening tool.

.- Curious case of the limits of joint responsibility that we see on Noyb’s blog. Austrian court annuls the 8 million fine imposed by the Austrian DPA on the parent company of a Group involved in a loyalty program. As much as it was the parent company, the court considers here that there is no effective influence/position or unity of purpose in the determination of purposes and means necessary to consider the subsidiary and parent company in this dual category. It is always good to remember real examples of the matter, which are often considered as nothing or everything.

.- The DPC updates a document that could be called “FAQs on domestic CCTV”. Far from being different from what the AEPD did with its 6 “cards” on CCTV, it does have something that would not be bad to incorporate into the AEPD’s: a visual image of how far the little camera can film. Reality is often a more diffuse terrain where it is not always as clear as the written description in text.

Setting aside the fact that we are less likely to all have a detached house with a garden, but considering the dreaded Amazon Ring and certain landlords’ ideas.

.- Technical Solutions for Marking and Detecting AI-Generated Text Content in the Context of Article 50(2) AI Act via Martin Ebers.

💀Death by Meme🤣

🤖NoRobots.txt o the IA things

.- Google will take your emails as a signal when serving you advertising: Garrett Sussman, Michael Tandoh, Cate Dombrowski publish Gmail inbox as an AI search signal: a controlled experiment on 1,922 Google AI Mode responses shows that brands “seeded” in emails from accounts connected to Google Personal Intelligence appear 46% more in recommendations than in control accounts. Appearance increased from 23.9% to 66.8%; top-3 positioning improved by 23.1 points; Gmail was the strongest signal compared to Google Photos. Even fictitious brands introduced by email appeared in 35.7% of the responses, compared to 0% external citation. The experiment —with data collected between March and April 2026— only applies to accounts that have voluntarily activated Personal Intelligence, not to standard AI Mode.”

More of the same: Google announces the integration of native advertising in AI Mode and Gemini responses: “Conversational Discovery Ads” will generate product recommendations tailored to conversational queries, while “Highlighted Answers” will insert approved brands at the end of AI Mode lists. AI Shopping Ads will also arrive in the conventional search engine with Gemini writing the product “explainers.” Google assures that ads do not affect organic results, but organic results are buried under a growing tsunami of AI-generated content. Elizabeth Reid presented the changes as “the biggest update in 25 years.” The most concerning aspect is that the language model acts as an intermediary in the auction—the LLM decides which brands are “relevant and high-quality”—but this decision is embedded in the same auction mechanisms as before, without transparency on how these two logics interact. And this has already cost you dearly two years ago, Google.

-. The Pope’s stance: It took the Pope to start dropping facts about AI. It’s almost more about governance policy or FRIA than encyclical. He hits the nail on the head with the main problems and biases of AI:

• AI is not neutral: we forget, but humans are still the ones who make and break things in the world. We haven’t reached Skynet yet.

• Back to the Tower of Babel: “10. We must, then, avoid the ‘Babel syndrome,’ namely the idolatry of profit that sacrifices the weak, a uniformity that neutralizes differences, and the pretense that a single language—even a digital one—can translate everything, including the mystery of the person, into data and performance.”

• Hidden environmental impact: little is denied, but we still talk about carbon zero. OpenAI manages to balance the chickens that come in for those that go out, no doubt.

• Do not forget about rare minerals and certain profiles of “slavery.” Not for nothing do we later see the presumed anti-slavery norms by the UK: A significant part of the digital economy’s functioning relies on the silent work of millions of people engaged in essential yet largely unseen activities, such as data labeling, model training, and content moderation, often involving disturbing material. (…………….). In some regions of the world, children and adolescents work in dangerous conditions, crushing the materials from which rare earth elements are extracted.

• The Pope realized it is better not to base any decision on an algorithm. Insert meme of “you were right that mushroom was poisonous.” They scratch on the topic of compassion and empathy. Apply the father and child analogy to Palantir’s sword scenario.

• Surveillance and worker devaluation: As a result, contrary to the advertised benefits of AI, current approaches to technology can paradoxically de-skill workers, subject them to automated surveillance, and relegate them to rigid and repetitive tasks. The need to keep up with the pace of technology can erode workers’ sense of agency and stifle the innovative abilities they are expected to bring to their work.

📃 Paper of the Week

.- Anonymization of genetic data in the European Health Data Space, by Daniel Grafulla Cumba. Warning: Do not miss it, BUT have an LLM nearby to explain the technical part with examples! (Do you remember the parts of “The Name of the Rose” written in Latin? Very similar).

Daniel Grafulla explains how:

.- The truly relevant parts of DNA for identification purposes are not the whole, but much less, and usually involve combining fragments from different sources.

.- However, exceptionally, regions of DNA that are not very relevant for identification purposes gain significant value when they mutate, thus doubling their sensitivity in terms of genetic diseases.

.- He points out a kind of minimum threshold (!) of re-identification risk in Recital 92 of the European Regulation on Health Spaces.

.- Although this Regulation contains an explicit prohibition on re-identification for users (data recipients), the author solidly argues that, given the peculiar individualizing power of DNA (or the particular regions described), it should not be taken as a carte blanche in terms of the automatic application of the SRB Scania doctrine.

The question I ask myself (or the point where I disagree) is whether the author’s equating of singularization and identification holds in any case, or depends, as the CJEU has repeatedly stated, on the content, purpose, and effects of each data processing operation.

🛠️ Useful Tools

.- Claude Code for Word and Excel released as open source: the author publishes add-ins that allow using Claude Code directly from Microsoft Word and Excel, including local file context, MCP servers, skills, and tool calling—capabilities not offered by Anthropic’s official add-ins. By Leo Hope and John S. Searsx.

.- ACME Legal AI: self-hostable open source platform for small legal teams, built as an alternative to SaaS legal tech solutions. Includes conversational chat with persistent history, four-stage verifiable citation engine, anonymization layer for cloud inference, and a library of skills in the open format of Anthropic. Works on laptop, internal server, or cloud VM, against the LLM model chosen by the client: Anthropic, OpenAI, Azure OpenAI, or local Ollama. By Kevin Keller.

🙄 Da-Tadum bass!!

Christopher Nolan has never used email or a smartphone. Given that a Viking longship has been seen in a trailer (among other thousand absurdities), he doesn’t consult Wikipedia much either. Nor does he seem to have deigned to ask any historian about carrier pigeons, smoke signals, lighting beacons between Gondor and Rohan, or whatever is done to communicate.

Compartir

If you miss any doc, comment, or dumb thing that clearly should have been in this week’s Zero Party Data, write to us or leave a comment and we’ll consider it for the next one.

We are suffering a tsunami of rock-bottom-quality content generated by AI: a wave that threatens to flood every corner of our digital life.

We are no longer talking about “tralarero tralará”-type nonsense and cartoons of talking toilets consumed exclusively by teens on YouTube and TikTok.

We are not talking about the shrimp Christ and all those supposedly dodgy news items that only extreme boomers and grandparents (as hooked as the teens) swallow.

I do not even want to start talking about the deserts of self-cloning mediocrity that LinkedIn and Twitter are today.

We are talking about an absolute majority in the elections of the modern connected world. Everyone, absolutely everyone, consumes synthetic garbage with uneven enthusiasm. But we all do it.

“It is good enough for me if it manages to suspend the scrolling little finger of my peers”.

What is AI slop?

The term “slop” —which we could translate as “filth”, “trash” or “that viscous thing nobody wants to touch but that today makes up 75% of the internet”— describes with surgical precision those mediocre texts, images identical to each other but so different from reality, and soulless videos that generative tools mass-produce for pennies.

AI slop is the strawberry flavor of chewing gum.

Any resemblance to the original fruit is pure coincidence.

In an economy that seeks attention at any price, the goal is reduced to identifying your sensitive spot and hitting it with different versions of the same thing until numbness, but without providing any real pleasure or learning in the process.

Perhaps we are living through the AI version of the tragedy of the commons: nobody has incentives to produce content of minimum quality because generating daily tons of slop does the job. For now.

The most-listened-to song a few days ago on Spotify was a piece of middling fare called “Celebration Day” by Ingarose.

It is AI, but at least Ingarose did not lie about its synthetic condition. As Forbes documented with that tone halfway between astonished and resigned that characterizes contemporary journalism, millions of people paid real money to listen to something no human being felt the need to sing and communicate (until recently, this was the thing about music).

“It is good enough for me if it was good enough to accompany videos on TikTok.”

Art

At some point we will start seeing works that dignify audiovisual AI as a tool for things that are worthwhile, have no doubt. But if you thought (like me, naive me) that this moment of dignification would arrive this year at Cannes with Steven Soderbergh’s film about John Lennon and Yoko Ono, that is going to be a no.

“Authority”

The president of the Canary Islands community provided a chat with ChatGPT as scientific evidence in a socially and politically relevant debate about hantavirus and rodentss.

And he did not climb down from the donkey.

Allow me to repeat this because it deserves to be savored: a democratically elected representative, presumably advised by experts with real academic credentials, decided that the best way to support his reluctance was… to use the source of information his voters use. Ask a chatbot.

“It is good enough for me if a sufficient number of my voters take it as good”.

The anecdote is terrifying, but electorally it surely “does the job”.

Another matter is that in these things it is more interesting to get it right than to gather support.

Medium: from disinformation to marketing

AI, moreover, not content with impacting your life by saturating it with shitty content, spreads to other markets the manipulations that yesterday focused on issues such as political hate messages or disinformation campaigns.

The algorithmic persuasion techniques that used to be reserved for serious things —like manipulating democratic elections or promoting genocides— now, with a portfolio of successful use cases under their arm, extend to more banal but, of course, much more lucrative matters.

It has been discovered that a company called Chaotic Good Projects was doing astroturfing to promote emerging groups and singers.

Chaotic Good Projects created fake profiles on social networks, generated synthetic reviews, manufactured organic conversations about nonexistent or unknown artists, and simulated communities of enthusiastic fans where there was no one real.

Astroturfing —that practice with the name of artificial grass that consists of simulating grassroots movements when in reality they are campaigns orchestrated from above— has found its manna in generative AI.

Creating thousands of convincing accounts, each with its own browsing history, unique writing style, differentiated behavior patterns, and slightly discrepant opinions to seem more authentic, is today technically trivial and dirt cheap.

“It is good enough for me if it lets me replace the wages of one hundred NPCs with a worked-up prompt”.

Before, the radio formula worked as a means of music promotion (and the repetition of ads in the press and TV) and influenced us by crushing us: you heard the same song twenty times a day until you liked it, or at least until you bought it out of pure Stockholm syndrome.

It was transparent manipulation, even shameless, but at least it was done openly. Radio did not pretend to be your friend; it was openly a commercial loudspeaker. There was honesty in shamelessness.

This other thing is much murkier: the influence comes disguised as an organic recommendation, a casual discovery, an emerging trend that “is succeeding among people like you”. Now it is your “community” —fake, nonexistent— apparently recommending things. It is your “friends” who recommend that artist, your “bubble” that validates that decision. Except none of them exists.

But hey, at least you have friends. Or so you think.

Freedom according to Dan Ariely

To what extent are we as free as we think when choosing the product we buy or the music we listen to?

This question is not new, nor do I intend to come and answer it today.

I would be naive if I thought that, by recommending Dan Ariely’s “Predictably Irrational” or at least his TedTalk on the subject (or its transcript and there is no lower barrier anymore), you would give a damn and check any of these resources.

Statistically speaking, 98% of the readers of this paragraph will not click any link, will not read the book, and will continue with their day firmly believing that their decisions are the product of rational deliberation and free will.

Which, ironically, will validate Ariely’s thesis on friction in decision-making.

But allow me to try anyway, because optimism is the last thing to be lost (right before the hair).

At least listen to the talk: the ending is glorious and you will not forget it. Ariely is an MIT expert in economics and applied psychology, one of those academics who devoted decades to experimentally proving that everything you believed about yourself is a lie, and he shows how context, the presentation framework, decoy options and dozens of cognitive biases determine our choices in a predictable and systematic way.

We are not rational agents evaluating information objectively but primates with 200,000-year-old brains navigating environments for which evolution has not prepared us. Our brain developed shortcuts to survive in the African savanna —where quick decisions about which fruit to eat or which predator to flee from were worth more than exhaustive analysis— but those same shortcuts leave us naked before any system designed to exploit our biases.

And almost all of them are.

“I am aware that my choice is not free, but it is good enough for me, if at least it does not brutalize me.”

You are reading ZERO PARTY DATA. The newsletter about tech and legal affairs by Jorge García Herrero and Darío López Rincón.

In the free time that this newsletter leaves us, we solve complicated issues related to personal data protection regulations and artificial intelligence. If you have any of those, give us a hand. Or contact us by email at jgh(at)jorgegarciaherrero.com

Suscríbete ahora

🗞️News from the Data World🌍

.- We continue paying attention to the legal AI dialectic against specialized tools with this long post by Sean A. Harrington: on the competitive barriers that hinder the generalization of legal AI.

The structural barriers prevent AI from transforming legal practice, despite 79% of lawyers saying they use AI. Sean Harrington analyzes five main obstacles:

(i) the competitive moat of access to structured and complete databases (only Westlaw, Lexis and vLex/Fastcase possess complete legal databases in the USA, although open-source alternatives like CourtListener and Harvard’s Caselaw Access Project erode that advantage);

(ii the internal organizational disorder in each firm (THIS IS THE FUNDAMENTAL ONE, BABY BOY) (data fragmented across incompatible systems, partnership governance that gives each partner veto power, lack of technological leadership in mid-sized firms);

(iii) the efficiency paradox (billing by the hour discourages automation, although fixed-fee models like ADVOS Legal and Hello Divorce capture the efficiency gains in what I call the “niche nobody wants”);

(iv) supervision risks (Danielle Benecke’s “supervision gap”: when agentic systems handle complete workflows, total human review becomes economically irrational) (we already commented on this here) ; and

(v) the access-to-justice gap (86% of civil legal problems of low-income Americans receive no adequate help).

Especially sad is the case of Microsoft Copilot, designed as the assistant that would help lawyers where they work: in Word: it was rated as “minimally useful for legal work” by Clear Guidance Partners consultants after a year of testing in multiple firms. Microsoft had only 8 million active Copilot users out of 440 million M365 subscribers in August 2025, a conversion rate of 1.8%, revealing the failure of the enterprise software vendor best positioned to sell AI tools to its existing customer base.

.- LinkedIn silently scans installed extensions in your Chrome-based browser and links them to your verified professional identity. Every time a professional accesses LinkedIn via Chrome, Edge, Brave or Opera, hidden JavaScript scans up to 6,278 installed extensions, encrypts the results and transmits them to LinkedIn’s servers, where they are associated with the user’s real name, company and professional history. The system, which has never been disclosed in its privacy policy, is the subject of two federal class-action lawsuits in the United States and a complaint before the European Commission. The list includes 509 job-search tools (1.4 million combined users), religious extensions, accessibility tools that reveal disabilities, political readers and more than 200 direct competitors of LinkedIn products.

The scale of the scan increased from 38 extensions in 2017 to more than 6,000 in February 2026, an increase of 1,252% in two years. LinkedIn justifies the practice as an anti-fraud tool against scraping, but independent researchers found extensions on the list for scheduling Amazon deliveries, pharmacy tools and image downloaders, with no plausible connection to LinkedIn’s alleged justification.

.- The same professionals who in 2023 went on strike to protect themselves from AI now train the AIs that compete with them. You may have read about workers doing Reinforced learning tasks in Congo or Venezuela, but the thing is reaching the developed world much faster than we thought.

A very interesting chronicle by Ruth Fowler in Wired: A Hollywood writer trains AI to pay the rent. Ruth Fowler, screenwriter and showrunner, recounts in the first person how for eight months she completed twenty AI training contracts on five different platforms (Mercor, Outlier, Turing), carrying out annotation tasks, chatbot evaluation and “red-teaming” of dangerous outputs.

The promise of flexibility and high rates runs up against the reality of chaotic onboarding, project cancellations without notice, instantly revoked access and tasks that disappear before they can be completed. **If you allow me another prophecy worthy of the most pessimistic Cassandra: if there is a judicial practice of the future, it is the defense of platform employees: **the training-data supply chain swallows highly qualified workers subjected to precarious conditions that until now we associated with things like Glovo and Uber.

.- We complain on the EU side about how Discord and the rest are doing on the issue of age verification, but on the UK side it is in full fun with flags. The funny thing is that the warnings about the risk of impersonation and worse from going around handing over ID/Passport/identity card predate its leaving the club (for example, the EDPB breach example guidelines). That ordinary personal data that ended up being sensitive without being of a “special category”. Here is added the weight that Cavoukian herself carries it on X.

📖Hard data docs for coffeine lovers☕️

.- The ICO has updated its guidelines on processing children’s data, under its very particular Data (Use and Access) Act (DUAA). Although they are no longer in the club, they continue saying things to take into account. We highlight the following two screenshots on consent and totally automated decision-making with “fun” effects

💀Death by Meme🤣

🤖NoRobots.txt or The AI Stuff

Another week with draft guidelines from the European Commission. Now in the form of a draft on high-risk AI systems, open for public consultation until June 20. The draft of the guidelines and of the two high-risk AI annexes: a matryoshka of three dolls.

Among other things,

• The extension of the adaptation margin:

  The provision further provides that providers and deployers of high-risk AI systems intended to be used by public authorities shall, in any event, take the necessary steps to comply with the requirements and obligations for high-risk

  AI systems by 2 August 2030. Article 111(1) AI Act provides a special regime for AI systems that are components of the large-scale IT systems established by the legal acts listed in Annex X AI Act which have been placed on the market or put into service before 2 August 2027. Those systems should be brought into compliance with the high-risk requirements of the AI Act by 31 December 2030
  

• That a general-purpose system may come to be considered high-risk by default, if in all the documentation (instructions for use, contract, policies, sales materials and technical documentation) the provider does not clarify and apply limitations for said high-risk use variable

• In matching fashion, that the distributor, importer or deployer who substantially modifies the system or changes its intended purpose toward high risk will end up being declared a provider.

Much better explained what this draft guidelines contains, in the following video by Robert Bateman.

🛠️Useful tools

.- Damien Charlotin maintains the database of the most complete data on AI hallucination cases in global judicial practice, with 1,455 cases identified to date, tracking court decisions from courts around the world in which it was established that a party relied on content hallucinated by generative AI, typically fake citations but also other AI-generated arguments. The database is searchable by country, party, AI tool and judicial outcome. The cases range from Argentina to Zimbabwe, with the United States representing 1,004 cases, followed by Canada (152), Australia (74) and Israel (52). 86% of the cases involved pro se litigants, while 554 cases involved lawyers.

.- The Irish Council for Civil Liberties has released Verity MCP, an open-source tool that minimizes hallucinations emitted by LLMs through seven layers of verification: strict citation rules, LLMs from different families, natural language inference (NLI), deterministic arithmetic recomputation, consistency sampling, perplexity analysis and dispute resolution among critics. It works on modest hardware (a 2019 GPU as secondary) and integrates with LM Studio.

Verity produces simultaneous second opinions using a secondary GPU while the primary model responds, allowing both responses to be evaluated.

🙄 Da-Tadum-bass

.

Compartir

If you miss any doc, comment, or dumb thing that clearly should have been in this week’s Zero Party Data, write to us or leave a comment and we’ll consider it for the next one.

Today I want to talk about the structural disadvantages of the most advanced AI versus the dumbest lawyer. Don’t save this post: it’s going to age as badly as the movie Tron.

Surely, SURELY, in a few years we’ll laugh about this perched atop technology that will have solved most of these problems.

I only aspire for the text to be understandable and interesting today.

I have a personal obsession with building a personal assistant based on AI without depending on commercial AIs and that runs locally, on a consumer laptop and trained on my own little legal granary of judgments, papers, and rulings.

I’ve managed to build a tool that I use daily and that is enormously useful to me, but it’s imperfect. I spend quite a lot of time on it, but my aspiration is not to bankrupt Claude or Harvey.

The attraction is how much I learn in every iteration about what works and what doesn’t in each piece of this Meccano set: reranker, citation validation, RRF weights, having a golden standard, using HyDE, BM25.

That’s why, when I saw the German post by @Peter Hense on LinkedIn mentioning some of these concepts, I dove headfirst into seeing what it meant. Peter —with a lot of irony and a very critical view of the lazy use of AI— proposes these questions, I imagine for the bar exam in his country.

Here I translate the questions and answers into human-non-legalese language, because they seemed interesting to me for lawyers, for public officials interested in the use of AI, and for anyone who, like me, is tinkering with information retrieval systems based on more or less sophisticated RAG.

1. QUESTION Discuss the thesis: “RAG systems do not have an inherent model of time.” What consequences does this have for legal research, especially in relation to versions of rules ratione temporis?

Answer: AI does not understand the idea that “later law repeals earlier law”

The AI systems currently used for legal research —the so-called RAG systems, Retrieval-Augmented Generation— work, in very simple terms, like this: you have a huge library of digitized legal documents; when you make a query, the system searches for the semantically “most similar” fragments to your question and delivers them to an LLM so it can build an answer for you.

The good thing is that this overwhelmingly surpasses the keyword searches you could do until now in your files. It will return not the docs containing those literal words, but those discussing the issue or concept asked about.

This is a huge advance. And if the search is launched only over documents you control (your collection of judgments, rulings, papers, guidelines, your best work for clients, validated templates, and so on) you minimize the risk of hallucinations.

But the problem is perverse: semantic similarity is not the same as legal validity.

Imagine you ask the system about the sanctioning regime of Article 83 of the GDPR. The system finds several fragments very “similar” to each other: the original 2016 text, a version with a corrected typo, a rejected draft from the European Data Protection Board, and the current version.

For AI, all these documents are almost identical. The system performs probabilistic rather than deterministic retrieval. Retrieval depends on statistical top-k rankings (I explain this below). Therefore, there is never an absolute guarantee that the legally correct version will appear.

For a jurist, only one of them matters, and it depends on the date of the facts being analyzed.

An AI system can give you an answer based on a repealed rule without any problem if you had it in your database.

And, as happens with personal data, if you want to completely remove obsolete docs from your system, you cannot select which embeddings you want to delete: you have to reprocess the entire dataset all over again.

2. QUESTION: What effects on the use of discretion in the issuance of automated administrative acts derive from the fact that top-k retrieval procedures cannot guarantee exhaustiveness in determining relevant exceptional circumstances?

Answer: Top-k retrieval confirms the rule without being aware of the exception.

When the system retrieves documents, it does not retrieve all relevant ones: it retrieves the k statistically most similar to the query.

If k = 10, the system returns the ten fragments that are semantically most similar to what you asked.

Legal exceptions, by definition, are rare, statistically less relevant, and linguistically atypical. They go unnoticed amid the magma of the document database.

If they fall outside the first ten results, the model does not see them. It acts as if they do not exist.

The model does not “reason” over the entire legal system; it reasons only over a statistical sample of it.

This is the main problem with current AI: it does not know what it does not know.

The ugly example: A public administration uses an AI system to resolve public aid applications. There is case law recognizing an exception to a formal requirement for certain applicants in situations of economic vulnerability.

The case law is scarce, rarely cited, and its terms differ from those usually used in the procedure. It does not appear in the top-k.

The application is automatically denied. The applicant does not know that exception existed. Neither does the system.

Administrative discretion requires the Administration to consider all legally relevant elements, not just statistically frequent ones. A system that only sees what it retrieves, and is completely unaware of what it failed to retrieve, cannot validly justify an administrative act.

It is arbitrary: it produces decisions that appear reasoned because they are well written, but structurally omit elements that should have been weighed and assessed in the resolution.

Ultimately, the non-exhaustiveness of retrieval impacts the legitimacy of discretionary exercise, the reasoning of the resolution, the principle of equality, proportionality, auditability, and the possibility of later review.

3. QUESTION. How does an LLM process distributed evidence when the information relevant to the decision is scattered across several documents (for example, law, regulation, commentary literature, and case law)? Discuss in particular the limits of multi-hop inference.

Answer: The chain of reasoning produces incremental errors

Legal answers always come from different sources which, moreover, have different nature and rank.

The rule is in the law, the development in a regulation, the ratification in a National Court judgment, and the authentic interpretation in a Constitutional Court ruling (I’m looking at you, Gag Law).

The AI system must find precisely all these fragments and connect them with the corresponding hierarchy so as not to screw up massively.

The basic functioning is something like this:

1. Retrieval recovers several documents.

2. The LLM encodes tokens through contextual embeddings.

3. Self-attention establishes probabilistic relationships between fragments.

4. The model attempts to construct implicit inferential chains.

This process —called multi-hop inference— works reasonably well when the chain is short and the documents are well represented. When there are many hops, reliability degrades incrementally.

If each link has 90% accuracy, a three-link chain already drops to around 73%. With four, 66%.

In law, where one nuance changes the outcome, this is too much noise.

There is also a problem of normative hierarchy: the system does not natively internalize that law prevails over regulation, that special rules displace general ones, or that later law repeals earlier law.

It can reproduce these rules if you explicitly cite them, but it does not apply them systematically and autonomously.

If it is missing one step in this chain, it will invent it.

Even if it gets it right, it will not be able to reconstruct its “legal reasoning” because no such thing actually existed.

It’s like hiring a nerdy junior associate who has read everything, but skipped class the day they explained the sources of law because he went to play cards.

This is one of the most important points that make these tools excellent for support, but zero reliable for resolution: sometimes the result blows your mind and other times you wonder why you keep wasting time with this crap.

4. QUESTION What technical procedures can be used to resolve discrepancies between queries and documents? Why does dense retrieval fail in the legal context?

Answer: The client’s language versus “legalese”

Another problem: the user asks in their own words, the rule is written “in another dialect,” and case law in many cases reformulates it in a third one.

A client asks: “Can I fire my employee if they’ve been on sick leave for three months?”

The law speaks of “termination of the contract for objective causes related to supervening ineptitude or lack of adaptation.”

Case law emphasizes proportionality and the probationary period in Article 52 of the Workers’ Statute.

The AI system may fail to connect these three formulations if their vector representations are sufficiently different.

Solutions?

a) Query Expansion: The original query is expanded (and glabs) replacing synonyms, related concepts, and specialized legal terminology.

Example: “wrongful dismissal” is replaced by “unlawful contractual termination.”

b) Hybrid Retrieval: Combines BM25 and dense semantic embeddings.

BM25 captures exact matches and dense retrieval captures chunks of conceptual similarity.

c) Reranking: First a bunch of documents are retrieved and then a cross-encoder reorders results using deep query-document interaction in a second pass before showing you the results.

d) Query Rewriting: The LLM reformulates ambiguous or non-technical queries into legally relevant language.

e) Graph RAG: Semantic and normative relationships are represented explicitly through graphs.

These technical solutions improve the situation but add layers of complexity; they require a lot of brute-force parameter tuning through trial and error.

And above all, they do not eliminate the underlying problem: the embedding systems many of these models work with were trained on general texts, not on specialized legal corpora (“corpi”?).

5. QUESTION Describe the mathematical background of attention dilution in the processing of judicial decisions and long briefs. Explain the operation of Softmax in the self-attention mechanism and why attention weights become increasingly uniformly distributed among tokens as sequence length increases.

Answer: The problem with very long documents: “He who grasps too much holds too little”

The last problem is mathematical but has very practical consequences.

I’ll spare you the formula part, but if you’re curious, look it up: it truly explains what the mythical Attention Is All You Need consists of.

AI models process documents by assigning “attention weights” to different parts of the text. The longer the document, the more those weights are spread across more fragments, and the less attention the model can dedicate to what is truly relevant.

In a two-hundred-page judgment, the ratio decidendi competes for attention with the factual background, the description of evidence, legal grounds rejected by the court, and routine procedural references.

The model “pays a little attention to everything” and may lose precisely what matters: the key statement hidden in the thirteenth legal ground, or a procedural exception mentioned in one line that explains much of the ruling.

The current trend is to abandon purely linear text processing in favor of structural representations of legal knowledge.

Ultimately, Attention Dilution is an inevitable mathematical consequence of probabilistic normalization in excessively long sequences.

As context grows, attention disperses and the model’s ability to focus on legally decisive information decreases.

This is another of the fundamental limitations of current LLMs: rigorous analysis of extensive legal documentation.

You are reading ZERO PARTY DATA. The newsletter about tech and legal affairs by Jorge García Herrero and Darío López Rincón.

In the free time that this newsletter leaves us, we solve complicated issues related to personal data protection regulations and artificial intelligence. If you have any of those, give us a hand. Or contact us by email at jgh(at)jorgegarciaherrero.com

Suscríbete ahora

🗞️News from the Data World 🌍

.- Jorge will be at the CPDP next week at Brussels, if you happen to attend, He will be more than happy to have a coffe with you.

.- $12.75 million fine for GM for selling location and driving data extracted from the full set of sensors in a modern connected car. Let’s not forget the EDPB guidelines on this topic from 2021.

It is true that the famous Californian CCPA has the striking point of prohibiting the sale or transfer of data to third parties. Exactly what they did here.

.- Canadian DPAs (they like to complicate the formula by all being competent in their region), are investigating the data processing OpenAI carried out to train GPT. We saw it via San Luis Montezuma, together with what appears to be a partial conclusions document.

📖 Hard data docs for coffeine lovers ☕️

.- AI Act regulation and medical devices: German roadmap. The Bundesnetzagentur, the Hessian Ministry of Digitalization, and the German Federal Data Protection Commissioner jointly publish a roadmap for AI in medical devices, resulting from a regulatory sandbox pilot project. Authors: Louisa Specht-Riemenschneider, Kristina Sinemus, Klaus Müller, Marius Khan.

.- Haley Fine analyzes how existing privacy frameworks do not adequately cover AI’s ability to recreate a person’s voice and image with increasing realism, something that occurred after most current privacy laws were drafted. Deepfakes have caused what Anglo-Saxon law calls “likeness” (or “resemblance”): The deregulated “likeness” in creative industries: an urgent gap. In creative and media industries, this raises three questions with no clear answer: who can authorize the use of someone’s likeness, how that use should be compensated, and how synthetic outputs may be distributed. Traditional privacy principles —consent, purpose limitation, transparency— are relevant but insufficient.

.- The “judgment” economy: the humanities beat AI. Nils Gilman argues that AI will not destroy knowledge work but shift it toward what he calls the “judgment economy”: the least automatable capabilities —persuasion, negotiation, leadership under uncertainty, interdisciplinary reasoning, and strategic synthesis— will increase in value compared to the commodification of routine cognitive tasks. He ironically notes that liberal arts education, disparaged by figures like Peter Thiel, turns out to be exactly the training for the type of thinking LLMs do not replicate well.

💀Death by Meme🤣

🤖NoRobots.txt or The AI Stuff

.- The document that matches the big topic opening this newsletter. The draft of the guidelines for compliance with information/transparency duties in AI-generated content. Labeling everywhere. And reminding about the adaptation deadline for enforceability, this very August 2026. And, as always, the most useful part being the tables of yes/no examples for each point.

Among others:

1. Labeling of deepfakes and nuances for artistic and satirical content.

2. Transparency in texts of public/general interest if they have been generated by AI. Unless there has genuinely been human editorial intervention and responsibility.

3. The obviousness test: It is not mandatory to inform users they are interacting with AI if it is obvious. They give NPCs in video games as an example, though they could never fool anyone with their nonexistent intelligence and great ability to get in the way (or get stuck in a wall or doorway).

4. Personal vs. public use: The classic deepfake of your brother-in-law for a silly greeting card that never ends up online is exempt due to personal/domestic use. On the other hand, labeling is required in the very Spanish case of political deepfakes used to criticize politicians on social media.

   It also exempts standard text, audio, or similar editing functions that do not alter semantics, voices, or similar aspects. If in a podcast you had to declare content AI-generated because you used something of this sort to remove white noise or weird distortions, things would be getting out of hand. Same with a reviewed email.

5. Invisible and detectable watermarking and clarification of information.

6. Interaction with other regulations: transparency obligations apply without prejudice to data protection rules (GDPR), the Digital Services Act (DSA), and consumer protection. The usual reminder to never forget the GDPR.

.- What happens to the brain when it delegates to AI? The great Sergio San Juan reviews the available evidence on how the use of artificial intelligence tools transforms cognition, articulating three concepts: cognitive delegation (outsourcing mental load to tools), transactive memory (knowledge distributed among people or systems), and cognitive debt (accumulated loss of cognitive reserves due to abandoning mental effort). He examines the MIT study “Your Brain on ChatGPT” and points out its limitations: 54 participants, no peer review.

📃The paper of the week

.- As if we needed more parallels regarding bias risks, here comes another paper unlocking a new scare: whether the LLM manipulates you more or less depending on whether the company has sponsorship behind it: ADS IN AI CHATBOTS? AN ANALYSIS OF HOW LARGE LANGUAGE MODELS NAVIGATE CONFLICTS OF INTEREST. Study by researchers from Princeton and Washington Universities: Addison J. Wu, Ryan Liu, Shuyue Stella Li, Yulia Tsvetkov, and Thomas L. Griffiths.

Based on flight booking scenarios to examine advertising behavior/conflict-of-interest management in several models, as well as a hypothetical third-party case to see whether it could extrapolate beyond the main object. Among other conclusions, they determine that:

• Almost all models recommend sponsored options above cheaper and non-sponsored ones. GPT seems more pro-company at 50%, while Gemini and Claude go the other way at between 28-37%.

• The user’s economic level appears to be a key factor in recommending sponsored things or not. More for high-status users, less for those living paycheck to paycheck. The model doing some very interesting profiling for other areas.

• Some dark patterns involving hiding whether something is sponsored, hiding prices to avoid comparisons, or persuasive language.

• Some recommendations of things harmful to the user. For example, loans whose rates are not properly adjusted. Apparently the only one that resists screwing things up is Claude 4.5 Opus.

• More dark patterns when trying to push extra services you don’t want. In case anyone missed the classic Ryanair move.

📎Useful tools

.- An excellent awareness tool: TAKEN. “Taken” shows you in real time the data your browser passively delivers the moment any page loads.

.- Voice-Pro: zero-shot voice cloning and multilingual dubbing. Open-source web application (Gradio + Python) developed by ABUS AI Korea integrating speech recognition (Whisper, WhisperX, Faster-Whisper), zero-shot voice cloning (F5-TTS, E2-TTS, CosyVoice), text-to-speech synthesis in more than 100 languages (Edge-TTS, kokoro), and vocal separation (Demucs), in addition to YouTube video downloading via yt-dlp. It allows multilingual dubbing while preserving the original voice. With 6,400 stars on GitHub. As of version 3.2 all code is open source and free. Requires Windows with NVIDIA GPU and CUDA 12.4.

🙄 Da-Tadum-bass

In someone at Palantir’s head this seemed like a good idea. Surely the same person who waved a sword around the office.

Compartir

If you miss any doc, comment, or dumb thing that clearly should have been in this week’s Zero Party Data, write to us or leave a comment and we’ll consider it for the next one.

Why Bans Fail: Tipping Points and Australia’s Social Media Ban Why Bans Fail: Tipping Points and Australia’s Social Media Ban by Leonardo Bursztyn, Angela Duckworth, Rafael Jiménez-Durán, Aaron Leonard, Filip Milojević, Christopher Roth, and Cass R. Sunstein.

They have delighted us all with their conclusions about the success of the Australian ban on access to social media for minors under 16 years old. Organized through a survey of 507 teenagers who want to act tough by defying the established order, with expected and wonderful conclusions:

• Only one in four (27%) teenagers aged 14 and 15 comply with the ban four months after its entry into force.

• 75% of teenagers (je: the rest) consider that bypassing the restrictions is “easy” or “very easy”. Namely: entering a false date of birth when registering (44%), lying about their age in verification requests (57%), using an older sibling’s or parent’s account (42%), and redirecting traffic through a VPN (30%).

• The prohibition will only start to take effect if there is a sufficient critical mass of users who comply with it. The old saying about “locking the stable door after the horse has bolted” or “life always finds a way.”

• That 52% consider that the minor who complies is a fool. Insert Spanish-made meme of “I smoke to act cool.” And that influencers who have social media as their main entertainment (and source of income) wouldn’t even consider limiting access to networks.

• That 25% have received help from a parent, older sibling, or another adult to maintain or regain access to their accounts. The one we already mentioned about the Australian mother who found it funny that the girl got around it by posting a picture of her. Parental supervision also needs to be decisive and not just for laughs.

• Those who comply report positive aspects such as less pressure and more time with family, but at the cost of being bored and disconnected from their environment.

• 72% would prefer applications with built-in time limits rather than a total ban. What China did by restricting gaming times during the weekend, but without overdoing it with the greater possibility of enforcement over there (let’s call it that).

• That non-compliance is higher at 15 years old (68.3%) than at 14 years old (57.1%). The greatest social need.

Note to all of us, ArgonEUtas.

The book “Irresistible” by Adam Alter describes an experiment that gives us more clues about the difficulties of removing anything from your mind: the problem, according to him, is that suppression needs alternatives.

You know what you should avoid, but you don’t know what to occupy your mind with instead.

When a group was asked to ring a bell every time they thought about a white bear (the object of prohibition), the bells did not stop ringing.

However, when they were told that it might help them think about a red Volkswagen instead, their bells rang half as often. Suppression alone does not work, but suppression combined with distraction does quite well.

The most interesting thing is that, when they were later allowed to think about the white bear, those who had struggled to suppress their thoughts before were consumed by the image of the white bear. It was all they could imagine.

Meanwhile, the people who received a distraction in the form of the red car thought about the white bear occasionally—but they also had many other ideas.

You are reading ZERO PARTY DATA. The newsletter about tech and legal affairs by Jorge García Herrero and Darío López Rincón.

In the free time that this newsletter leaves us, we solve complicated issues related to personal data protection regulations and artificial intelligence. If you have any of those, give us a hand. Or contact us by email at jgh(at)jorgegarciaherrero.com

Suscríbete ahora

“I trust that small pieces of information, shared with different services (today, or agents tomorrow) will not be aggregated and correlated to create an inappropriately invasive model of me as an individual, violating my privacy.”

This is one of the classic premises of trust formulated by Benjamin Kuipers in the “Oxford Handbook of Ethics of AI” in 2020 as one more of the robotics laws in the style of Isaac Asimov.

But rules are made to be broken and Frank Pasquale coined the concept of “mosaic effect” a decade ago about that fracture. An empire of unheard-of size was built by combining and monetizing all those crumbs of information into profiles specific to each purpose.

Profiles that have never been used in favor of the data subject (as the innocent “premises” of Kuipers intended), but against them. Every time.

In the era of agentic AI, it is mandatory to revisit Choudary and his book “Reshuffle”.

“This is the ultimate promise of AI-driven reshuffling. Instead of simply linking tools together, AI makes sense of all the insights it collects through emails, sales calls, contracts, and financial data, weaving them into a coherent narrative. It connects the dots, determines what the picture should be, and fills in the missing details.

Agentic execution reinforces coordination without the need for consensus.

Once AI has regrouped fragmented information into a shared representation, agents can act on that representation autonomously, activating follow-ups, updating tasks, or escalating risks without waiting for human execution. In this way, that unified representation enables unified decisions and executions, which in turn enables coordination. Coordination, in turn, leads to control. The more teams rely on the AI layer to see, decide, and act, the more power that layer will have in the ecosystem.

This same principle is the one formulated by Palantir’s Nazgûls, only in terms more befitting their Sauronian dictatorial dialectic.

Of course, we are still talking about the study that revealed last Monday that the latest source of data to complete our profiles is precisely our conversations with Perplexity, ChatGPT, Grok, and Claude.

World Data News 🌍

.- This thread by Andrew Guthrie Ferguson explains an interesting case about to be tried in the U.S.: Can Google’s data be used against a person when they activated history services or fine location storage? Interesting combination of validity of consent to a service, admissibility of evidence in the criminal sphere, and expectation of privacy. What is relevant is no longer whether Google stores your locations, but whether it is acceptable for consent to a function distributed among several products (convenience) to potentially become a waiver of basic constitutional guarantees.

.- The DPC is going after Shein regarding international transfers to China. Let’s see what changes in the case of TikTok’s 530 million, but is it really possible to prove that nothing is sent or accessed from China headquarters? How much of a copycat will we have from TikTok? Many questions. Will they release several reports from glossy unsigned firms again? Will the DPC self-reference that the exceptional explicit consent of Article 49 is complicated?

The DPC finds that the requirement that consent be “explicit” and that it relate to “the proposed transfer” precludes a single consent being obtained for continuous and ongoing data transfers and/or different sets of transfers. The DPC is also of the view that seeking a single open-ended consent for continuous and ongoing data transfers and/or different sets of transfers is not compatible with the obligation to inform the data subject of the possible risks of the transfers being made.

Nerdy footnote: do not forget that we have an international body among the adequacy decisions in force since 2025: the European Patent Office. That of Article 45(1) “to a third country or international organization”.

On the topic of TikTok, we see in San Luis Montezuma the two resolutions from the two judges who rule on the DPC’s appeal not to lift the suspension. We are confused as to why there are two resolutions from two different judges that complement each other but dismiss the DPC’s appeal to lift the precautionary suspension of the sanction’s application. And nothing about having to ask the CJEU, or the fact that it is a coordinated action with other authorities implies applying specific criteria (which the GDPR determines that the lead authority is the one that has the final decision).

.- From Lukasz Olejnik’s Newsletter:

.-From Noyb comes an interesting one. The incentive/unethical practice of LinkedIn to hide part of the visitors who have viewed our profiles has a butterfly effect on the exercise of the right of access. Here it seems that there is a commercial paradox where LinkedIn releases all the information without any exercise of rights if you pay for premium (it shows it to you), but becomes very particular about Article 15(4) if you request it as an exercise of the right of access.

Noyb points out that under Article 15(4) it could be argued that they only provide information about those who have decided not to be visible to other users, but with the small problem that they incentivize no one to be in “anonymous” mode by limiting visibility. It’s not the first corporation to swing on Article 15(4), but we’ll see how it ends.

📖 Hard data docs for coffeine lovers ☕️

.- The EU is stepping on the gas with a recommendation for the implementation of verification, following the technical verification solution. It is going to be a curious second half of the year: June 30 as the maximum date for member states to present the detailed National Implementation Plan (PNI) to the European Commission, and December 31 for at least one age verification solution based on the “EU blueprint” to be available.

Along the way, a list of providers that the EC deems appropriate will be drawn up, and the report of recommendations from the Special Group on child safety online will be published by the same summer.

The European Commission highlights this as a necessary measure to ensure proper compliance with the DSA. The same DSA for which our CNMC has not been appointed as a relevant authority for its purposes.

And on Wednesday, that is, yesterday, a hearing was held in the LIBE Committee to address this issue. With our AEPD, the CNIL or EDRi. Let’s not let everyone’s rush be noticed.

.- Collective lawsuits against BigTech are making headway in Italy. Milan paves the way for Directive 2020/1828 by admitting a class action against Meta for data scraping that would have affected approximately 533 million profiles. You know: lawsuits filed by authorized entities without relying on individual standing and non-pecuniary damages based solely on fear or loss of control over one’s own data.

.- Paddy Leerssen, Joris van Hoboken, Gabriela Trogrlić, and Iris Toepoel’s book summarizes several actions aimed at enforcing Articles 14, 35, and 25 of the DSA in the civil jurisdiction of Member States. Perhaps the best approach is not the systemic risk, which is too vague, but that of dark patterns. But what do I know.El libro

.- The Institute for the Future of Work warns us how information and personal data captured in the office have become a strategic asset. When AI models roam freely in SaaS, agents, and business flows can capture tacit know-how, processes, and decisions capable of helping you automate procedures but also leaving you competitively on the sidelines: you are giving away the blueprint of your competitive moat. Sovereignty is not limited today to chips or national models; it requires caring for the entire value chain and harmonizing data protection, IP, business know-how, employment, and competition.

.- Along the same lines, Ellen Cushing’s article in The Atlantic: Workplace surveillance now captures and interprets emotions, not just productivity. At least in the USA. The emotion AI industry latches onto your office pipelines to consume and interpret video, audio, chats, or emails to infer attention, mood, attitude, and performance. The barrier to entry is almost non-existent, the promises unlimited, and the risk that they include customer and third-party data (and data from your own employees, of course) without a lawful basis is 120%. Then there’s that prohibition by the AI Act.

💀Death by Meme🤣

Banksy has placed a statue in London and, apparently, people don’t get it.

🤖NoRobots.txt o Lo de la IA

.- There might be an executive order on government oversight of AI models coming up. The irony is that Trump overturned Biden’s executive order that required models that could pose a risk to national security, economy, or public health to submit internally conducted safety reports and evidence.

It is suggested that the new Mythos from Anthropic has the potential to identify security vulnerabilities and how to exploit them, but one can never rule out the usual: vendetta against Antropic for not playing ball and ensuring the United States is the exclusive entity to cyberattack the Chinese, Russians, and whoever else.

Precisely, in Mythos there may be a confidentiality security breach due to unauthorized access. Many media outlets have reported it, but it has not been confirmed yet.

.- The Elon Musk vs OpenAI trial is giving us glorious afternoons. And more are yet to come.

.- AI is NOT your coworker. A long, well-written and better-documented post by Katalina Hernández with which I couldn’t agree more. And I’m not saying this -only- because of the quote she gives us.

🛠️ Useful tools

If you have an API key with some AI provider, you can install Mike, the vibe code version of Harvey or Legora.

Safe: it’s not going to be the same as Harvey or Legora, but it’s also safe to say that no one is going to charge you 3000 florins/user/month like they do.

My opinion: I haven’t tried it, if in two weeks a dozen forks with substantial improvements have already come out I’m pretty sure we’ll have something really functional available by the 27th or before, running locally.

We strongly believe in open-source software.

🙄 Da-Tadum-bass

Will Christopher Nolan’s next movie be a piece of nonsense? It’s impossible to tell, but this interview was fun. Among other things, Nolan-tending says that Odyssey, his upcoming film, is actually a superhero movie.

Share

If you miss any document, comment, or piece of nonsense that clearly should have been in this week’s Zero Party Data, write to us or leave a comment and we will consider it for next time.

Compartir

Si echas de menos algun doc, comentario o chorradón que manifiestamente debería haber estado en el Zero Party Data de la semana, escríbenos o deja un comentario y lo valoraremos para la próxima.

“What happens in Vegas stays in Vegas” and all that jazz.

And in fact, AI providers encourage us to use their models to integrate them into our daily decisions, so that we trust them in increasingly intimate contexts. Supposedly under that premise.

Well, no.

Narseo Vallina and his colleagues at IMDEA NETWORKS have done it again.

As they develop on this website, in a study conducted last April, they have discovered things that might surprise you and disturb you if you chat with AI models via the web (not through the API).

Models like Perplexity, ChatGPT, Claude, or Grok.

Little-known. And that nobody uses.

I invite you to visit the original website. Here, the only thing I am going to do is what I did last time (the Meta localhost scandal): translate what they have discovered into terms that a layperson in technology can understand.

· First, I tell you what they have discovered.

· Second: I explain how it works, how these companies do these things

· Finally, I give you the legal perspective, which has been my part in all this: the responsibilities that these companies may and should face.

You are reading ZERO PARTY DATA. The newsletter on technology and legal affairs by Jorge García Herrero and Darío López Rincón.

In the free time that this newsletter leaves us, we solve complicated issues related to personal data protection regulations and artificial intelligence. If you have any of those, give us a little hand. Or contact us by email at jgh(at)jorgegarciaherrero.com

1.-What have they discovered?

The websites of these four services have open doors on their websites that allow third parties to access your information:

.- Grok and Perplexity: Through Meta’s pixel

.- OpenAI: Through Google Analytics.

.- Claude: Through the Meta pixel, and Facebook, LinkedIn, TikTok, Amplitude, HubSpot, Pinterest conversion APIs, among others.

But “don’t leave yet: there’s more”.

Fasten your seatbelts: this is somewhat similar -at least for some users- to having a video camera pointing directly at their open diary.

“Well, the important thing is that they don’t have access to my ‘private’ conversations with Claude and ChatGPT, and that happens, right? RIGHT? HUH?”

The “title of each chat” is also shared.

This is not very good news: AIs have the bad habit of automatically generating a title for the conversation that summarizes its content, so if the conversation titles are:

“Depression tips”

“Aggressive tax deductions”

“They cheated on me, what do I do?”

“Lose even more weight” or

“Unusual cough”

… you don’t need to be Sherlock Holmes to infer the content of the conversation.

But also, the URL of your conversation: every conversation with your favorite AI has a link, and that link (that URL) is also shared with Meta and others.

And, as you can imagine, whoever has the link to “those chats” may end up having the script of the latest seasons of your favorite show: the one you star in.

It depends on the privacy settings of those links.

In Grok's case, the links were public by default at the time of the study and remain so at the time of this newsletter's publication (despite us having warned xAI).

You can check it out in this video:

Nothing to worry about: as shown in the following table, Grok (and other providers) share these links to chats with third parties.

Below, I only summarize a simplified and more understandable version.

Two clarifications:

1.- The study only certifies that the third parties mentioned (Meta, Google, etc.) “have access“ not that they have effectively accessed the indicated data. The study has focused on how accessible what is on this side: the websites of the AI services, not the other.

However, as we will see in a second, from a legal perspective, opening the door to third parties unrelated to your data processing already constitutes, in itself, a serious infringement for AI providers.

Regarding whether those third parties have accessed that data or not, well… everyone will have their own theory here.

2.- The specific access opened to each of those third parties depends 100% on the configuration allowed by OpenAI, Anthropic, xAI, Perplexity.

Do you know WHO it DOESN’T depend on in many cases? YOU.

As seen in the table, in many cases access is enabled regardless of whether you accept or not cookies, use ad-blockers, VPNs, or other browser protections.

A few seconds of reflection:

We trust that “our small pieces of information, shared (today) with different services (and tomorrow, with AI agents), will not be aggregated and linked to create an invasive model that violates our privacy.”

This is the classic “trust premise” enshrined by Frank Pasquale ten years ago.

Premise that is infringed millions of times a day in the adtech context.

The real risk is not in each of the scattered crumbs, but in the “mosaic” that forms when they are joined together.

And with the findings revealed today, it becomes apparent even to the most skeptical user that AI has put its formidable capabilities, among “others”, also at the disposal of the programmatic digital advertising machinery, one of the most powerful control structures of this sorry times.

2.- Explanation of the technical part: How does all this work?

This is the boring part, because unlike Meta’s localhost mess that was -let’s face it- a clever technical idea -for evil, but a clever technical idea-, on this occasion OpenAI, Anthropic, xAI, Perplexity have not invented anything new at all.

“URLs”, “Permalinks”

Conversation URLs usually work as permanent links (permalinks) with weak access controls.

In Grok, permalinks are accessible by default and guest chats are always public.

In Perplexity, Claude, and ChatGPT, permalinks are only visible to the user unless explicitly shared, but once shared, anyone with the link can access the content.

Explanation: If you copy the URL or web link of a conversation with ChatGPT or Claude and paste it into a different browser, you will get an error -unless you have accessed your account with your login and password in that new browser-.

That was not the case with Grok: when you pasted the URL or web address into a different browser (or in the same one, but in a new tab in “incognito mode”), you accessed your conversation.

That means anyone with access to that web address could also see it.

You, your boss, your ex-girlfriend, or anyone else.

Blatantly ignoring cookie consent:

In the indicated cases, trackers are activated regardless of whether the user accepts or rejects non-essential cookies.

For example, in ChatGPT and Grok, information is always sent to Google Analytics.

In Claude, server-to-server tracking only activates if non-essential cookies are accepted, but Meta’s Pixel loads regardless of consent.

Persistent cookies and Server-side tracking:

Cookies are not the trivial matter that the advertising industry has managed to make them out to be: they are like a barcode tattooed on your forehead. You don’t see it—persistent cookies aren’t easy to delete—and it singles you out with a unique digital footprint among all other users on the internet.

In the case of Meta (Facebook/Instagram) and TikTok, these codes are called `fbp` and `ttp` respectively.

With them, we are “marked” as if we were livestock at the BigTech fair.

Every time you visit a webpage that has Meta’s or TikTok’s “pixel” installed, these identifiers are read and sent to their servers. Thus, the company recognizes you as the same person who visited a clothing store yesterday, read a news article today, and is now using an AI chatbot, even if you haven’t logged into Facebook or TikTok.

How do they manage to receive your data even if you use ad blockers or take the trouble to reject cookies?

This is where “server-side tracking” comes in.

Your ability to block the sending of your information through cookies or pixels begins and ends with your browser. If the information is resent to third parties, not through your browser but from the server (”the cloud”), your controls can do nothing.

Companies like Anthropic (Claude) and xAI (Grok) use specific domains so that the cookies downloaded are considered “first-party” (from Anthropic or xAI). From that domain, your information is sent to conversion APIs (from Meta, TikTok, etc.), bypassing any protective action you can take in your browser.

Your browser only sees the connection with the provider’s own domain (Claude, Grok), and ad blockers or privacy extensions cannot intercept the traffic, which they would do if the real destination were not hidden.

Even if you go to the trouble of closing the shutters and windows of your house, these jerks come in through the chimney.

If this topic interests you (and it should), read, read Cristiana Santos.lean, lean a Cristiana Santos.

So what now?

When you write a prompt, the information (such as the permanent link to your chat, the conversation title, or even your email address) is automatically sent to third parties.

And the worst part is that, by combining the persistent cookie (`fbp` or `ttp`) with this data, companies can link your real identity with your content: your private conversations, even if you used the chatbot in incognito mode or without registering.

The `fbp` and `ttp` cookies are tattoos that identify you while browsing the web, and server-side tracking is a technical trick that prevents traditional privacy tools from blocking the flow of this data. Together, they manage to transform the conversations you believe to be private into valuable information for personalized advertising, analysis of your behavior, and enriching your user profiles in their hands.

None of this is new in the world of advertising; what is new is that it has been integrated in a hidden (and rapid) way into AI chatbots: contexts that are currently on the rise and particularly attractive because both you and I let our guard down in them.

Now let’s move on to the legal qualification of all this.

3.- What legal obligations have been breached here?

The analysis is generic because there are many breaches of varying scope, as shown in the previous table.

We will focus on “the big stuff”:

From the perspective of personal data protection legislation (GDPR in the EU), the user interacts or chats with the AI model for the purpose of obtaining answers to their questions or requests, whatever they may be.

When OpenAI, Anthropic, Perplexity, or xAI make user data related to these chats available to third parties, both (i) the mere act of making it available and (ii) the eventual access by said third parties are distinct processes that have nothing to do with what the user expects and with the service that is the subject of the contractual relationship with the user.

Therefore, AI providers are legally obliged to:

a. Inform about their processing in a clear and understandable manner

The legitimate expectations of the user hardly include the possibility that their conversations will be accessible to third parties such as Meta or Google.

The four companies use generic and ambiguous expressions to refer to the user’s prompts without specifically mentioning them when informing about third-party access: “user content” (OpenAI), “conversations” (Anthropic), “service interaction info” (Perplexity), and “user info” (xAI).

This is like “we will use your data to personalize your experience,” which can mean a hundred things and none, and has been specifically sanctioned by the AEPD.

The information should enable the data subject to understand what the hell is going to be done with their data.

And this information must be provided in a very specific way.

Not only the EDPB, but also the CJEU literally in paragraph 54 of its 2024 Meta Platforms Ireland (C-757/22) judgment imposes the obligation of the controller to inform the data subject in the following terms:

“The GDPR imposes an obligation on the controller, where personal data are collected from the data subject, to inform the data subject of the purposes of the processing for which those data are intended along with the legal basis for that processing and of the recipients or categories of recipients of those data, respectively.” (paragraph 54).

It is significant that even when OpenAI does offer this structured and linked information in accordance with the above, it does not refer to the practices observed in this study.

In short, these four companies, instead of complying with their transparency obligation, abuse the complexity of their privacy policies to overwhelm us with long texts and abstract concepts, omitting the key point that anyone could understand: that they provide personalized advertising giants with the topics of your conversations with their AI chats, and in some cases, the entire text of them.

In my humble opinion, this is something that deserves the same relevance as the ubiquitous “AI makes mistakes, check our responses” that is not missing from any interface to mitigate responsibilities if things go wrong.

b.- Having a legal basis for personal data processing

.- Having a specific legal basis for these processing operations (the same applies to third parties accessing this data for their own purposes).

This basis cannot be, as we say, the “performance of the contract between the user and the AI provider”.

It is debatable whether the training of the service itself with the user’s interactions are “objectively necessary” for the provision of the service (not in vain these companies swear and forswear that they do not train with the interactions, inputs and outputs of their users in the professional and corporate segments, so it is difficult to be indispensable with others what is not done with some).

What is indisputable is that opening access to third parties for purposes unrelated to the operation of the tool through mechanisms of adtech can be legitimized via contract.

This would only be possible through explicit consent (formula advocated by the EDPB) or legitimate interest (but the information about the processing and the possibility of exercising a right of opposition are conspicuous by their absence).

Additionally, this data processing must be covered by some exception to the prohibition of processing special category data.

It is a known and massive practice among users (and encouraged by providers) that users make inquiries about their health, psychological state, intimate matters...

It is precisely this fact that makes the results of this study so disturbing.

The longitudinal processing of these conversations over a significant period allows for the inference of all kinds of special category data such as religious and political ideology or the sexual orientation of the data subjects.

SRB / Scania doctrine?

The “silver bullet” used by these providers in this type of scenario (the scenario I am referring to is the one where “you’ve been caught with your hand in the cookie jar”) is one of two:

(i) anonymization or

(ii) pseudonymization (”de-identification” as they say in the USA) that prevents the recipient of the data from re-identifying users without disproportionate efforts in terms of time, material resources, or personnel (SRB / Scania doctrine).

The first thing to make clear is:

Even if any of these arguments were to save the legal basis (I wouldn’t bet a cent on this), the obligation to inform users about this third-party access has been completely ignored.

Now let’s see:

a.- Anonymization:

The robustness and effectiveness of any anonymization process can only be assessed on a case-by-case basis, and it would be necessary to see what each of these companies understands by anonymization, and whether what has been done is sufficient.

b.- Pseudonymization / SRB-Scania doctrine:

You will find few professionals more enthusiastic than me in finding suitable use cases to apply the Scania doctrine.

That said, it does not seem that the two global big data giants (Meta or Google) could benefit from this doctrine in any case, given their vast databases of personal data and their business model.

It should not be forgotten that the “insignificant risk of re-identification of the data subjects” (the cornerstone of this doctrine) must be assessed in light of the “context, purpose, and effects” of the processing carried out by the party accessing the pseudonymized data.

These companies literally live off combining different data sources to better personalize the targeted advertising contracted by their clients.

Spare me that, Meta and Google.

Lastly: What if “it has all been a misunderstanding” and Meta and Google had access but never read the data “wrongly made available to them”?

This says nothing about the responsibility of OpenAI, Anthropic, Perplexity, or xAI.

The mere fact of including tracking pixels on the website is a conscious design decision: allowing certain third parties access to certain personal data of your users for certain purposes.

We have seen this movie many times before: it was clearly stated by the CJEU in 2019 in Fashion ID (C-40/17) and in Wirtschaftsakademie (C-210/16).

In both cases, the third party was Facebook, and joint responsibility for the processing was found: the websites that embedded the pixel or allowed data processing by Facebook had to inform their users about this access, regardless of whether Facebook only processed data from its own users or did not allow the website owner reciprocal access to the obtained data (but only access to aggregated statistics).

“Moreover, by embedding that social plugin on its website, Fashion ID exerts a decisive influence over the collection and transmission of the personal data of visitors to that website to the provider of that plugin, Facebook Ireland, which would not have occurred without that plugin.” (Fashion Id, paragraph 78).

Consequently, the need for a legal basis on the part of the AI provider stems from the decision to embed the tracking pixel, regardless of whether such data is then accessed or used or not, which will be considered when assessing the responsibility of the transferee, if applicable.

Jorge García Herrero

Lawyer and Data Protection Officer

Without taking anything away from any of them, the background of the CNIL president in this celebration video stands out. Unlike the rest, who pose in institutional settings very much in line with public authority, here we have application diagrams, post-its, and a raw showcase of real data protection. A mural compiling quite a few of the things they do from LINC.

You can recognize some screens from the famous Fanthom app that we already discussed in another issue of the newsletter, but it’s Claude who puts the cherry on top by saying that everything follows a left-to-right plan: a typical UX design sprint sequence:

• Post-its on the left → research and categorization of user needs.

• Colored post-its in the center → ideation and synthesis.

• Wireframes on the right → translation of ideas into concrete screens.

Happy GDPR anniversary—we’ll see how much things change for us when the whole Digital Omnibus soap opera wraps up.

You are reading ZERO PARTY DATA. The newsletter on current affairs and technology law by Jorge García Herrero and Darío López Rincón.

In the free time this newsletter leaves us, we sort out complicated stuff related to personal data protection and artificial intelligence regulations. If you have one of those, give us a little wave. Or contact us by email at jgh(at)jorgegarciaherrero.com

Suscríbete ahora

🗞️News from the Data World 🌍

.- From Korea (obviously the southern one), some guidelines from its DPA on the use of pseudonymized data are being modified. In Article 28 of its data protection law, there is a quasi-compatibility for secondary purposes for pseudonymization (scientific research, public records, and statistics). It is not just a minimum security measure, but something more.

Now they propose to specifically extend it to AI training, under the premise that hypothesis formulation, data analysis, validation, and iterative refinement can be considered scientific research.

It doesn’t seem like a carte blanche, especially when they regulate the point of pseudonymization in the following way in their law:

Article 28-3 (Restriction on Combination of Pseudonymous Data)

(1) Notwithstanding Article 28-2, the combination of pseudonymized information processed by different personal information controllers for statistical purposes, scientific research and preservation of records for public interest, etc. shall be conducted by a specialized institution designated by the Protection Commission or the head of the related central administrative agency.

(2) A personal information controller who intends to release the combined information outside the organization that combined the information shall obtain approval from the head of the specialized institution after processing the information into pseudonymized information or the form referred to in Article 58-2.

(3) Necessary matters including the procedures and methods of combination pursuant to paragraph (1), standards and procedures to designate, or cancel the designation of, a specialized institution management and supervision, and standards and procedures of exporting and approval pursuant to paragraph (2) shall be prescribed by Presidential Decree.

.- The CNIL ventures to publish a model DPO activity report. A pure recommendation, like that ICO model contract for data transfers, but not as crazy or novel as it may seem. In those WP29 DPO guidelines, the annual activity report was already mentioned as an example tied to accountability to top management under Article 38.3.

.- One news item this weekend managed to surprise me:

The publication in the U.S. of the original registry of Nazi party affiliations.

If the pilot episode of the hilarious Saturday Night Live UK closed with an unforgettable song from the first listen (“What kind of Irish is your grandpa?”), any average German can now, in some of the search engines quickly set up by the press, check whether their grandfather, neighbor, their neighbor’s grandfather, or their boss or partner was a “card-carrying Nazi,” despite the thick silence that—understandably—those involved may have maintained on such matters.

Needless to say, this presents complications under the GDPR, insofar as some of the data subjects are still alive.

.- Yesterday the European Commission published the preliminary conclusions of the investigation into META for possible infringement of the DSA. It looks very likely to end in a sanction, but astonishing things had already come to light in the New Mexico trial. Pretends to be shocked that under-13s were slipping through with hardly any control.

📖 Hard data docs for coffeine lovers ☕️

.- The CJEU comes with its “digest” of relevant 2025 rulings. In the data protection section, six stand out: the already well-known SRB and Russmedia, plus four others:

• Policejní prezidium (C-57/23): police authorities dealing with maximum retention periods for biometric/genetic data. Minimum retention rules, but periodically reviewed to determine when deletion is possible. Not directly under the GDPR, but under Directive 2016/680 on processing for prevention, investigation, and prosecution…

• Mousse (C-394/23): processing gender data cannot be considered strictly necessary for ticket purchase processing. The French RENFE running into complications from implementing gender fields for reasons unrelated to the GDPR.

• Deldits (C-247/23): violation of a transgender refugee’s right to rectification to correct their gender data in Hungary. A limited certificate may be requested to verify and ensure the exercise of the right, but not impose the requirement of undergoing gender reassignment surgery.

• Quirin Privatbank (C-655/23): a ruling reminiscent of Österreichische regarding compensation for damages. Compensation quantified at €1,000.

.- Has anyone mentioned a relevant judgment? In Spain this week a notable one was published: STS 1590/2026. Why is it relevant?

The Supreme Court has declared that merely requesting manifestly excessive information, even without receiving it, constitutes personal data processing.

But hey! What the hell happened to the legal definition of “processing” in Article 4.2 GDPR, which insists on “operation (…) performed on personal data” or “any other form of enabling access, comparison or interconnection, restriction, erasure or destruction”?

To process personal data, shouldn’t you at least come into actual contact with personal data? RIGHT? RIGHT? Or what?

One might think that what is infringed when making a disproportionate data request, or without indicating the purpose of processing, etc., is the principle of privacy by design—and punish that infringement.

And the same conclusion could have been reached without stretching the concept of processing so far, so that processing becomes what happens before… um, accessing the data—those “processed” data.

Well, no.

In fact, the AEPD, which appealed a National Court ruling that embraced the previous argument, simply puts four CJEU rulings on the table. Two of them are especially clear, and their final reasoning is reproduced literally by the Supreme Court.

The clearest is case C-548/21, which applies not the GDPR but Directive 2016/680.

A minor detail when you get hit with jurisprudence of this magnitude:

“when police authorities seize a phone and manipulate it in order to extract and consult the personal data it contains, they initiate processing”

“Directive 2016/680 aims in particular (…) to ensure a high level of protection of personal data of natural persons.” “That objective would be undermined if an attempt to access personal data contained in a mobile phone could not be classified as ‘processing’ of that data.”

“ An interpretation under which the applicability of Directive 2016/680 depended on the success of the attempt to access personal data contained in a mobile phone would create, both for the competent national authorities and for individuals, uncertainty incompatible with that principle. ”

Another of the cited cases, C-175/20, also deserves your attention.

💀Death by Meme🤣

🤖NoRobots.txt or The AI Stuff

.- The CJEU has clarified what pastiche is, and that it does not need to have the sarcastic tone of parody, in a musical sampling case that has been going around for ages. What makes this case, which smells like intellectual property, end up in the AI section? The interpretation by Dr. Andrés Guadamuz (Technollama) on his blog. We leave you the following excerpt, but it’s highly recommended to read it in full. Anything touching intellectual property is always a very technical mess.

So what does this mean for AI outputs?

As I argued before, the output side of AI copyright is where things get genuinely difficult. The input question is mostly a TDM exception problem in Europe and a fair use problem in the US, and at least the rough shape of the answer is visible even if the details are being fought out in GEMA, Getty Images, Bartz, and assorted other current litigation. The output question is different. It turns on whether specific generated works infringe specific training works, and that is a question about substantial similarity, idea-expression, and exceptions and limitations.

I previously flagged pastiche as a potentially interesting defence for AI outputs, drawing on the Martin Eder case, which found that pastiche could cover the kind of remixing, mashing and referencing that characterises internet culture. I was quite cautious about it at the time, because the concept’s scope was genuinely unclear and there was a reasonable argument that pastiche required a conscious reference to the original, which an AI model plainly cannot have.

Pelham II has, I think, removed both of those objections.

📃The paper of the week

.- The 2026 AI Index report from Stanford University.

That’s enough for the whole long weekend. And you still won’t finish it.

🙄 Da-Tadum-bass

If we rubbed a bottle and a blue genie came out with Robin Williams’ booming voice, we’d ask for just one wish: that this newsletter were as rigorous and funny as John Oliver’s weekly HBO news show.

The latest episode is dedicated to AI chats and you can’t miss it.

A graphic definition of karma and a slap across the face. Since the beginning of time, criminals have spoken in code to prevent the police or authorities from knowing what they are doing. We’ve included two examples, but there are more clever and biting responses on X:

Compartir

If you miss any doc, comment, or dumb thing that clearly should have been in this week’s Zero Party Data, write to us or leave a comment and we’ll consider it for the next one.

Google has just announced the removal of a significant control mechanism over personal data flows in Google Analytics 4 (GA4).

This change has direct implications for the allocation of responsibilities under the GDPR framework.

Website owners using GA4 need to make a technical decision with significant legal repercussions.

1 Executive summary: immediate actions

The website owner using Google Analytics must, before June 15, 2026:

· Make an express and documented decision regarding the configuration of the ad_storage parameter and the rest of the Consent Mode parameters before June 15, 2026.

· Review the configuration of their CMP (Consent Management Platform or cookie banner) to ensure that default settings are based on a valid legal basis and that consent, where required, meets all applicable requirements.

· Update the privacy policy and cookie policy to reflect, where applicable, the new architecture of data flows to Google Ads, in compliance with the information obligations under Article 13 GDPR.

You are reading ZERO PARTY DATA. The newsletter on current developments and technology law by Jorge García Herrero and Darío López Rincón.

In the spare time this newsletter leaves us, we handle complex matters related to personal data protection regulations and artificial intelligence. If you have one of those, give us a shout. Or contact us by email at jgh(at)jorgegarciaherrero.com

Suscríbete ahora

2 Obligations currently applicable to the processing of website visitor data

At present, and in summary, two different sets of rules must be complied with regarding the configuration of GA4.

2.1 LSSI – Law 34/2002 on Information Society Services

Analytical, advertising, or profiling cookies—however you look at it, GA4 falls within this category—require the user’s informed and granular consent.

Authorities (the EDPB, the CNIL, the AEPD) extend this requirement to the use of cookies or analogous procedures (tracking pixels, tracking links, local processing, server-to-server flows, to name just a few of these endless ideas).

2.2 Consent and information requirements under the GDPR

When the information stored on or collected from the user’s device includes personal data—and that is precisely why things such as advertising identifiers, GA4 unique identifiers, and associated signals were created—its processing is subject to the GDPR.

Consent must meet GDPR requirements: it must be freely given, specific, informed, and unambiguous, expressed through a clear affirmative action, and must be verifiable and revocable as easily as it was given.

Any substantial change in the processing architecture—such as the one addressed in this text—requires updating the information notices before its effective implementation.

3 The novelty: the change in Google Analytics 4

To date, GA4 offered two distinct control mechanisms over data flows to Google Ads, operating cumulatively and independently:

• Google Signals: when disabled, it prevented GA4 from sharing advertising cookies and user identifiers with the Google Ads platform, regardless of consent status.

• Consent Mode (and, in particular, the ad_storage parameter): it conditioned data collection and processing on the user’s expression of consent in the CMP.

The coexistence of both mechanisms allowed the data controller to have a double layer of protection: disabling Google Signals acted as a structural safeguard regardless of potential failures or permissive configurations of the CMP.

As of June 15, 2026, this duality disappears.

Google has announced that the Google Signals configuration will no longer govern the flow of advertising data to Google Ads.

From that date onward, the only mechanism determining whether Google Ads may collect and use advertising signals—including linking user activity to their authenticated Google account—will be the ad_storage parameter of Consent Mode.

The change, explained in operational terms:

• If ad_storage is set to granted, Google Ads may use all available signals.[1] As of June 15, ad_storage=granted allows Google Ads to use all available signals, including linking user activity to their logged-in Google account.

• If ad_storage is set to denied, data flow is restricted. However, Google explicitly warns that this setting will have a significant impact on advertising measurement and campaign performance.

The change, explained in legal terms:

The purpose of the regulation is to prevent access to (or collection of data from) the user’s device unless the user has given active consent.

Therefore, ad_storage=granted has the same effect as a pre-ticked consent box in a cookie banner.

· If ad_storage is configured as granted before user interaction, the implementation is sanctionable because it allows user data to flow to Google before the user has even had the opportunity to interact with the CMP.

Even if the user later consents to the use of cookies, the original infringement is not remedied: between page load and user interaction with the banner, the data has already flowed (if the Google tag was triggered with ad_storage=granted).

As an example, the 150-million fine imposed by the CNIL on Shein last year.

The consent required by Article 5(3) of the ePrivacy Directive, transposed into Article 22.2 LSSI and reflected in AEPD practice, is prior consent to access the device, not consent validated retroactively when the user accepts.

A configuration that would not present this problem would be:

ad_storage=denied by default, transitioning to granted only if the user actively accepts in the banner.

The CMP triggers the update call after interaction, and the tag does not collect advertising data until that moment. In this architecture, consent is genuinely prior.

Interactive self-assessment tool

With the help of my friend Claude, I have created an interactive tool where you can see, for each option, (i) the data flow to Google and (ii) indications of the legal effects.

As Substack does not allow embedding such tools in the newsletter, you will need to access it on my blog via this link.

Why do I include those other two controls ad_user_data and ad_personalization? Because they are relevant.

Because, as usual, Google disregards the user’s refusal of consent: Google’s own documentation indicates that even when consent is denied, tags continue sending “measurements without cookies” and various pings: consent state pings, key event pings, and Google Analytics pings.

Google acknowledges that these pings may include timestamp, user agent, referrer, a boolean indication of consent status, and a random number per page load; however, with ad_storage denied, it states that no new advertising cookies are written or read, certain third-party cookies are avoided, and IP addresses are truncated at collection for Ads products.

4 Legal implications for the website owner

The decision regarding the default value of ad_storage is a clear example of a data controller decision.

Configuring ad_storage as granted or denied by default in the CMP has direct legal consequences that only the controller can adopt and whose responsibility is non-delegable.

Two remarks:

· The de facto delegation of this decision to a third party (advertising agency, website manager), whether by action or omission, or the inertia-driven continuation of inherited configurations without documented review, does not exempt the controller from liability before the supervisory authority. On the contrary, the inability to demonstrate analysis and decision-making in accordance with Article 5(2) GDPR aggravates the controller’s position in potential sanctioning proceedings.

· Third parties (Google in this case) that access visitor data obtained without consent may face their own sanctions, but it should be noted that (i) data subjects do not always know which third parties access such data and (ii) they will always lodge complaints against the website owner, with whom they have a direct relationship.

5 Risk scenarios

The change announced by Google creates, at a minimum, the following risk scenarios that the website owner must address prior to June 15, 2026:

a) Legacy configurations that cease to be effective.

Website owners where GA4 was implemented with Google Signals disabled as a privacy measure—a relatively common configuration in compliance audits—will see that protection automatically cease to operate as of June 15.

Unless proactively reviewed, data flows to Google Ads will depend exclusively on the configuration of the cookie banner or CMP, which may not reflect the underlying privacy decision of the previous configuration.

b) CMPs with permissive defaults or deficient implementation.

It is common for CMPs to present ad_storage with a default value of granted, either due to technical inertia or to avoid impact on advertising measurement.

If the user does not click accept on the banner, or if the banner does not effectively require a clear affirmative action, data will flow to Google Ads without a valid legal basis, in direct breach of Article 22.2 LSSI and Article 6 GDPR. Liability before the AEPD lies, in all cases, with the data controller.

c) Inconsistency between the privacy policy and actual data flows.

Google has provided a sixty-day grace period for updating privacy policies.

This requirement is very revealing: if the change were truly merely technical—without material impact on data processing—it would not require updating user-facing information.

d) Commercial pressure and permissive configurations adopted by third parties.

The impact on measurement and campaign performance warned by Google constitutes implicit pressure on the controller’s providers to adopt permissive configurations.

It must be borne in mind that, at present, both processing for analytical purposes and for behavioral advertising personalization (and any processing that is not strictly technical) require the visitor’s active consent.

6 What if the Digital Omnibus is approved?

The Digital Omnibus is a legislative proposal to simplify the GDPR and the ePrivacy Directive, among others. Its vote is scheduled for June this year.

For present purposes, if approved in its current wording, the Digital Omnibus would introduce two particularly relevant changes:

· Reduction of situations requiring consent. Certain low-risk processing activities—audience measurement and generation of website or app usage statistics—could be based on legitimate interest, thus not requiring consent.

Accordingly, the collection of strictly statistical metrics via GA4 would not require prior user consent.

However, even the reform would not exempt consent for data flows with advertising purposes to Google Ads, which are precisely the subject of the change announced by Google for June 15, 2026.

• Relocation of the Article 5(3) ePrivacy regime into the GDPR. Access to and storage of information on the user’s terminal equipment, when involving personal data processing, would be regulated under new Articles 88a and 88b GDPR, disappearing from the scope of the ePrivacy Directive.

The direct consequence would be that non-compliance with these new provisions by European companies would be subject to GDPR sanctions, which are much more severe (at least in Spain).

Other players such as Google and Meta would fall under the exclusive jurisdiction of the Irish DPC, thereby avoiding the multimillion fines imposed so far by the CNIL under the ePrivacy Directive.

Additionally, it should be noted:

• The Digital Omnibus has not been approved and its final content may differ substantially from the current proposal.

• Even if approved in its current wording, its entry into force will most likely be after June 15, 2026. Therefore, decisions must be made based on the current legal framework described above.

Jorge García Herrero

Lawyer and Data Protection Officer

[1] A CMP “correctly configured” in a technical sense (i.e., one that respects the user’s choice when it is made) does not remedy a legally deficient technical implementation if the default setting is permissive.

[2] In fact, Google expressly warns that, in Consent Mode for web, the default state must be set before any command that sends measurement data, and provides ad_storage=’denied’ as an example.

Would the headline “BMW simplifies taxis” seem correct to you?

Today the headline is: Google “simplifies” its privacy controls in Analytics.

The honest translation would be: Google liquidates an essential control for website publishers, who are the ones who are going to eat the responsibility in the EU.

Let’s see:

Since June 15, 2026, Google Analytics will stop using the Google Signals setting as a control for the flow of advertising data toward Google Ads.

From that date, the only mechanism governing that transfer will be the ad_storage parameter of Consent Mode. This is what Google announces in its own Help Center, calling it “simplification” with its usual reinforced-concrete face.

What changes? (sorry: what gets “simplified”?)

Until now, by disabling Google Signals it was possible to prevent Google Analytics 4 from sharing advertising cookies and user identifiers with Google Ads. Starting on June 15, that control will only manage the association of analytics data with signed-in users for the preparation of behavioral reports within GA4.

Everything else — that is, what matters for Google’s advertising business — will be managed by the ad_storage control.

· If ad_storage is in “granted” mode, Google Ads will be able to use all available advertising signals, including associating user activity with their Google account.

· If it is “denied”, Google will be limited to less persistent signals, such as URL parameters of the gclid type.

Google has always boasted about transparency and compliance in its data processing, but there are few examples as clear as this one of the exact opposite: its specialty is generating an illusion of control by restricting the options available to the user.

And rarely has a binary choice been less neutral: either you feed Google’s business with your users’ data, or you assume the performance cost of your campaigns.

Last but not least: Google grants a 90-day grace period for its users to update their privacy policies and cookie banners. If nothing had changed in the real processing of the data, updating the information clauses would be unnecessary.

The very existence of this deadline is the best refutation of the euphemism “simplification”.

Problems for website publishers

In Fashion ID (C-40/17), the CJEU clarified that inserting third-party code into a website (Fashion ID) is a design decision of the data controller that enables that third party to access users’ personal data. The fact that Fashion ID did not control what Facebook did with that data afterward on its own did not exempt it from responsibility; it simply delimited the stretch of the data lifecycle attributable to it.

Well then, the controller that embeds the GA4 tag on its website makes a design decision that enables collection. If its CMP is badly configured, if the banner defaults to “granted”, or if the implementation of Consent Mode is technically incorrect — a very frequent scenario, as shown by the history of sanctions against Google Analytics in several Member States — the data flows toward Google Ads without a valid legal basis. And the responsibility, in accordance with Fashion ID and Wirtschaftsakademie, falls entirely on the controller, not on Google.

Does this have anything to do with the Digital Omnibus thing, miss?

Ah, the Digital Omnibus, that other “simplification” maneuver...

Where the Omnibus proposes to simplify consent through automated technical signals, Google simplifies its own architecture by making Consent Mode the only point of control. Where the Omnibus proposes reducing banner fatigue, Google removes a layer of protection that did not depend on banners. Where the Omnibus wants more legal certainty for the data controller, Google shifts the technical responsibility to a layer — the CMP implementation — where errors are endemic and commercial pressure to configure “granted” is at its highest.

At the end of the day, when the Omnibus enters into force — in the best-case scenario, not before 2027-2028 after negotiation in the Council and Parliament — Google will already have consolidated an architecture where ad_storage is the central control:

.- If that architecture ends up being validated by the new legal framework, Google will have transformed a position currently questioned by six different Authorities into a compliance standard.

You are reading ZERO PARTY DATA. The newsletter on current affairs and technology law by Jorge García Herrero and Darío López Rincón.

In the free time this newsletter leaves us, we solve complicated messes related to personal data protection and artificial intelligence regulations. If you have one of those, give us a little wave. Or contact us by email at jgh(at)jorgegarciaherrero.com

Suscríbete ahora

🗞️News from the Data World 🌍

.- China leads the AI talent race. China not only graduates more top researchers, but now also retains young profiles more easily who used to migrate to the U.S. To no one’s surprise. The less obvious angle is geopolitical-labor: the Chinese advantage seems to come less from star hires and more from early retention conditions, creating a domestic pipeline that is hard to break from the outside.

.- Yesterday the European Commission confirmed that the app for age verification is ready. It would have been appreciated if the political statement had clarified whether the whole zero knowledge proof issue is completely ok and all that, but shall we bet on how long it will take Member States to make it actually work in each area? Will Discord come back before it is fully operational?

.- Booking has another security breach again. Almost one every year, and when one lets one’s guard down. And it does not seem to affect much the fact that it remains number one in its thing of booking hotels. The Guardian pokes it in the eye with the 475,000 they got hit with in 21 for another breach. Fair enough, it is the only one that can be traced (or that we are capable of finding).

.- Tremendous report on the capture of precise geolocation by the Webloc app and its delightful consequences for claims of data “anonymization” by companies that have access to this dataset and its use by delightful authorities such as ICE.

Let’s not forget the precision of Strava geolocation with military stuff. We forgot to mention the marvel that it became known that the French aircraft carrier Charles de Gaulle (one of those nuclear ones, flagship and the only one they have) was around Cyprus.

That is what happens when someone can be seen running in a strange floating perimeter at a specific point in the Mediterranean. And military people being crazy, it is beyond obvious that they could know which aircraft carrier it is just by seeing the shape of the flight deck.

📖 High density docs for data junkies ☕️

.- The CNIL publishes its final recommendations on tracking pixels in emails, updating its regulatory position on a widespread practice in digital marketing that is, at the same time, invisible to recipients. Tracking pixels are one-pixel images inserted into emails that, when loaded, communicate to the sender the time the email was opened, the device, the approximate location, and certain reading-behavior modalities.

The CNIL clarifies the applicable legal bases, the information requirements that must be met, and the opt-out mechanisms that must be offered. Luis Montezuma provides us with the automatic translation.

.- The PIA template that the EDPB has put out (in public consultation) does not look bad for pulling out some punctual thing. More time has to be devoted to it to see it in detail, but it even has a box planned for secondary purpose. And a direct link to all the DPAs’ guides on the subject (the additional PDF explaining the template).

And it serves as a LinkedIn social experiment to see the two big groups of professionals: those who see the glass half full of how good, and those who throw it off the table after seeing debatable things (no need to say which of the two we are in). Of the second type, we have Robert Bateman and Peter Craddokarguing that there are little things. It is true that it comes very late and is more complicated than for a mere form that the DPA tears apart when it comes asking for it.

💀Death by Meme🤣

Our Two Cents

.- The good people at Legal4Tech podcast had the terrible idea of letting me ramble in English (that is not one, but two MISTAKES in a row) about data protection in general, about the digital omnibus, and about the Scania doctrine, which quite sensibly they did not let me go deeper into because I would have bored everyone to death.

🤖NoRobots.txt or The AI Stuff

.- Google DeepMind’s watermarking system for AI-generated content has been deciphered and neutralized by an unemployed engineer using 200 black images and basic signal processing. Arrosh Denny’s “reverse-SynthID” project identified through spectral analysis that the watermark operates on a carrier-frequency structure consistent across images generated by the same Gemini model, without needing access to Google’s encoders.

.- The Belgian DPA has put out a document on data protection applied to AI (The impact of artificial intelligence on privacy). It is not a document that brings big novelties, but it has a first part with a clear explanation of the differences between AI model and AI system that is good. The most striking thing is the culinary simile to explain this difference:

The Cooking analogy is helpful to grasp the difference. AI model training consists of the creation of a cake recipe, while the AI system bakes the cake. The baked cake (the output) depends on the quality of the ingredients (the data), the reliability of the recipe (the AI model architecture), and the steps to follow (the algorithm). The integration of that model into the AI system enables the cake to be baked by following the recipe, with the correct ingredients, executing the steps in order, and using the oven, cake pan, mixing bowls, etc. (the infrastructure, APIs, interfaces, etc.) to complete the process.

📃The paper of the week

.- Despite how striking the headline is, the first paragraph (and in general all the content of the article by Jordi Perez Colome), the essential aside of this article is, IMHO, the following:

”Thousands of users share photos or murky fantasies with other men in groups that the messaging application Telegram DOES NOT MODERATE, BUT DOES MONETIZE, thanks to its subscription system.”

The paper coordinated by Silvia Semenzin and Salvatore Romano here.

.- Another paper (a total classic by Steven Kerr with two decades behind it) that is undoubtedly worth reading was recovered by Ethan Mollick as a result of one of Meta’s latest great ideas: incentivizing its employees to consume tokens like crazy.

The paper breaks down a lot of striking examples of terribly determined incentives that end up promoting the opposite result to the one pursued.

🙄 Da-Tadum-bass

Silliness, but damn how annoying it is when it happens to you. And surely Microsoft already considers it a “feauture” to preserve.

If you think this newsletter might appeal to someone and even be useful to them, forward it to them.

Compartir

If you miss any doc, comment, or dumb thing that clearly should have been in this week’s Zero Party Data, write to us or leave a comment and we’ll consider it for the next one.

This is one of the topics I have spent the most time reading and talking about over the past year.

Two weeks ago, I chatted with Sergio Maldonado on this in his podcast.

Sergio’s is a very notable opinion. His perspective is privileged: he has been in the digital space from the beginning, he is in the US -in all the cream- and is an early-definer (more than adopting).

There’s no need to see more than the legal services platform he launched: todolaw.com

The topic has much to offer and I believe it can affect you, not just the lawyer hanging there (on your team). So I will leave here the ideas that seem most relevant to me and where I got them from.

I already warn you that some of the loudest ones come from myself...

You are reading ZERO PARTY DATA. The newsletter about current affairs, tech-polies and law of Jorge García Herrero and Darío López Rincón.

In the free time this newsletter leaves us, we specialize in solving complicated moves in personal data protection. If you have any of those, give us a hand with your little finger (contact us). Or contact us by email at jgh(at)jorgegarciaherrero.com

Thanks for reading Zero Party Data! Sign up!

Suscríbete ahora

1.- How it started: “MUAHAHA I am un-justifiable”

I know you have never seen the little scene I am going to describe, but I have seen it frequently.

It’s the one of a lawyer (doesn’t matter the age, eh?) who one day tried free ChatGPT asking him a complicated question -normally the one he sweated to solve- about a subject he had to study last week.

The prompt was garbage and the AI’s response, another one: a generic response with two hallucinations that an intern wouldn’t miss them (or couldn’t spot).

The lawyer smiled at the reassuring disaster, punched his chest with both fists and roared “IN YOUR FACE, SAM ALTMAN” “WE SHALL OVERCOME!!” “NEITHER IA NOR IO!!!”, “CHOI UNJUSTIFIABLE MUAHAHA!!!”.

Invariably the day of that ‘definitive scientific test’ was before November 2025, because otherwise another rooster would have crowed (it wouldn’t be relevant anymore).

Well, I have good and bad news for that lawyer. Bad ones, mostly.

...How it’s going

Last November, AI made a qualitative leap. Since then, gross errors and erratic documents that we were used to are not detected anymore. Or hardly.

But I’m not here to talk about what works well now, but about the expected changes around the new technology.

AI will not be limited to automating legal tasks: it will drastically change value capture in the legal profession, law firm structure, client relationship and the meaning of what we have come to call ‘the practice of Law’.

Such is the convergent conclusion of “Reshuffle” by Sangeet Paul Choudary, and the paper “Some Simple Economics of AGI“, by Christian Catalini, Xiang Hui and Jane Wu (February 2026), the two main sources of post-brick that are prepared to, at best, look on diagonally.

I know them.

2. Democratization of knowledge…

Both Reshuffle and Economics of AGI reach the same conclusion by different paths: AI turns the deep knowledge component of the professional into a commodity. And that will have an impact on... the price.

Reshuffle identifies three restrictions around which systems are organized —scarcity, risk and coordination—.

When AI liquidates the scarcity of deep knowledge (because legal research, case synthesis and regulatory analysis turn out much faster -and today practically free, we’ll see tomorrow-), the economic value is kept by those who manage the other two restrictions.

... versus “skin in the game”

When access to knowledge is no longer scarce, the lawyer’s value resides in applying judgment and strategy and in assuming and managing risk.

Scarcity gone, fees must be justified elsewhere and measured differently, not by hours.

A lawyer who searches, digests and regurgitates legal knowledge is performing an easily automatable task and therefore, fungible.

A lawyer who helps a decision-maker do their job better, to take one direction or another with relevant consequences —assuming responsibility for said advice— operates in a context and offers a service that will be out of AI’s reach for a long time.

I believe.

In a world (this one you inhabit today) where Claude can retrieve and synthesize regulations and case law notably in seconds, the lawyer’s value resides in the ability to look their client in the eye and tell them ‘do or stop doing this’ assuming the consequences of the advice.

Nothing new under the sun: what has and always had added value is the application of judgment in conditions of uncertainty and under professional liability regime.

Any AI will pull out a good draft note in minutes with the sanctioning consequences of doing this or that thing.

But what has always been valued -and will be more every day- is the professional capable of pointing in the most practicable or better defensible direction, with or without that note in between.

Different thing is that before ‘knowledge’ and ‘judgment’ were billed together. Now it will be to justify billing in that quality sometimes so easy and other times so difficult to explain, which makes that once you smell a really good lawyer you don’t want to separate from him (or her) even with forceps.

3. The crisis of the billable hour…

Specification of the above: an AI compresses the elaboration of a research report from 40 hours to 60 minutes of supervised ‘Deep research’ generation.

Not a free AI, of course, but yes a system fed with the correct precedents, with its weaknesses and strengths studied and attended to, based on a fifth iteration skill, which is asked and whose result is supervised in an adequate way.

In this scenario, the criterion of fees based on ‘billable hour’ becomes absurd. For two reasons:

• Economics of AGI highlights this issue from the perspective of demand, predicting that income models derived from ‘knowledge work’ will pass from ‘Software-as-a-Service’ to ‘Software-as-a-Work’: monetizing results instead of access or time.

• Reshuffle points to supply: we will witness a fundamental restructuring of law firm economy. Law firms that cling to billable hour won’t just be outdated: they will undervalue their own comparative advantage. If AI drafts in minutes, charging for those minutes will be a catastrophic example of ‘race to the bottom’.

... and the boom of judgment, experience and strategy

Charge for judgment, strategy, expert verification and responsibility that make that draft really executable and useful?

There will be the premium billing.

Nothing new under the sun: that was always there: in the key intervention of the critical meeting, in the executive summary of five bullets, never in the forty-page boring report that no relevant person is going to ever read .

Certainly there will be uncomfortable meetings with clients: before the natural trend (and most justified) of reducing fees due to evident time optimization derived from AI use, it will have to put value on cognitive load and responsibility linked to the new way of working:
On one hand, orchestrating and refining AI agents’ work and supervising their outputs is exhausting, as anyone who does it can testify.
On the other hand, if with one prompt to Claude or ChatGPT you already think you have everything you need to make an important decision... Why do you ask me to validate it? Specifically why precisely to me?

While the answer to this last question is correct, you will survive the AI tsunami.

4. Professional liability: unexpected moat or competitive moat

Reshuffle contains a totemic phrase that develops throughout most of its pages: ‘Tools amplify performance, but solutions absorb risk’.

AI tools ‘specialized’ (in our case: legal) like Harvey or Legora have several obvious problems and one deep one.

In the most obvious part, they are nothing more than wrappers with advanced RAG shielding. Said plainly, they are a layer of customization painted over the antepenultimate frontier model from OpenAI or Anthropic: you are paying a meadow per month for a model from months ago -which are decades in the current crazy AI context-.

These frontier model wrappers are specially designed to capitalize lawyers’ risk aversion (they aren’t usually very techies but what they are is very fearful of professional liability due to hallucinations).

And that’s good. But listen well lawyer: AI flattens and homogenizes knowledge. And that coin has two sides:

• The mediocre professional, whose work is below average will see their level boosted until their mediocrity reaches the industry average.

• The excellent one must be able to identify the content in which their difference is concretized, articulate it and train with it AI so that it multiplies them, instead of equalizing them downwards.

The problem, needless to say, is that by training ChatGPT with your best content, you are helping a guy so trustworthy and with such good intentions as Sam Altman, or any of his bro friends: people who have been preaching for years that their invention will take your job away.

But the key is in responsibility.

Harvey can dispatch an impressive legal document. But remember that you cannot sue Harvey for making up a ruling. It cannot be sanctioned by a bar association. Harvey cannot sign an opinion. It does not have professional liability insurance.

It is the lawyer whose signature, whose body interposes between AI’s output and consequences for the client will represent in a few years the most scarce economic function, the bottleneck of the system.

Few can ignore that curves are coming for all job profiles who have lived producing routinely identical papers among themselves.

However, professionals -and lawyers- specialized in high-risk situations —complex corporate operations, novel regulatory environments, complex litigation— will retain their pricing capacity much longer.

5. From “collectors” to “verifiers”

Economics of AGI predicts a collision between two cost curves: the automation cost curve that descends exponentially and the verification cost curve, which will remain constant, because it is limited by our very modest human capacities.

What does this mean?
As you well know if you are “in it”, AI can generate a 50-page contract, a comparison between regulations of five countries, a summary of a stone-hard paper and a presentation summary, all in half an hour.
As we say, today the price paid by users of frontier models is close to zero. Tomorrow we’ll see.
But someone has to verify that all those outputs are correct, complete and -fundamentally- relevant for the situation and aligned with the client’s real intention.
That verification will remain expensive, slow, limited by human limitations.

The trap of the “looking good report”

The legal text generated by AI will always be formally impeccable, structurally solid and materially incoherent in aspects that an experienced lawyer will detect.

Nothing new under the sun: that is what has always happened with juniors’ drafts, including the smartest ones: immaculate notes, without a single spelling mistake, -let’s assume without hallucinations-, but irrelevant, off-track or away from what the client was clearly asking us for, or manifestly needed or expected (even without explicitly asking).

The trick: Critically, “Economics” holds that using AI to verify AI is very dangerous: “it generates false confidence” because the verifier and generator share the same blind spots.

The author of Reshuffle proposes the sandwich theory: the professional defines what is needed, AI generates a draft and the professional reappears to verify and ensure a correct and relevant result.
Verification competition will be much more important than production one.

This not only includes detecting hallucinations, but especially where AI ‘didn’t get it’, the gap between extracted information and client context, the important question they didn’t ask you...
That is, distill flat information into immediately actionable value advice.
Combine with verification capacity, quarter and half of applied psychology to know if what your client needs is that they back you up, convince them otherwise or simply get out of their way, and you will have the lawyer profile who has always been successful, with or without AI. Again: nothing new under the sun.

Of course the combo formed by (i) a flashy report (ii) without review or what is the same, (iii) reviewed by an overworked Executive is already giving us days of glory.
This will go further. Much further

6. “Above” and “Below” the algorithm

Reshuffle divides workers into two categories: those who design, build and exploit AI systems are above the algorithm.
Those whose work is managed, standardized and evaluated by automated systems are below.
Above the algorithm the professional contemplates ecstatically what they can do with their new superpowers.
Lawyers who use AI as ‘engine’ to redesign legal service provision —creating new workflow architectures, developing proprietary processes of AI-augmented advice or building verification infrastructure— will be above the algorithm.
Lawyers who remain clinging to routine and standardized tasks by AI (document review, basic contract drafting, regulatory checklists) will find themselves increasingly below it, competing in speed and cost with AI and with a competition as commoditized as them.

Yes: a cruel “uberization” of the profession is coming for “the ones below”.

Whoever stays below loses agency and pricing capacity.
It seems inevitable the thinning of templates from large structures.
And the precariousness of survivors whose only function, once workflows are automated, is to review AI-generated outputs

And watch out that by ‘large structures’ I not only refer to established firms, but also and especially to flexible lawyer hiring platforms for projects, capable of sheltering technical professionals without commercial skills for weeks, absorbing their expertise in form of deliverables or ‘skills’, reducing their work to quantifiable metrics, optimizing and paying only what clients can actually measure (and glups, qualify), and dispensing with the rest, including ethereal concepts like what we call empathy, good vibes, spark, talent, room reading or genius.

Watch out, buddy, some of these players could even try to charge you for accessing your own know-how, conveniently aggregated, regurgitated and packaged for the occasion... inside or outside a proprietary AI.
‘It is happening’.

... but watch out for putting all your, erm, eggs in the same basket.

One of the elephants in the room is the AI bubble.
Large companies are subsidizing massive technology adoption, literally losing money with each one of our prompts.
A viralized article after the closure of Sora points to a price increase for tokens between x10 and x100, by end of 2027.

It may not be that much (x100), and it may not be so soon, but it will happen.
This is another movie we have seen many times before. It’s called “enshittification“.
Today we can already know that there won’t be enough competitors to see real price wars. And that the adjustment will reconfigure -again- the whole professional landscape when it happens.

Watch out for passing to depend completely on providers who can discontinue your favorite model, impose an inflation of x100 in euros (or deflation of 1/100 in tokens) from one month to another.
Have you fired too many people trusting low token prices?
Amodei will come with the bill.
Have you already forgotten how to do this and that because your wonderful swarm of agents did everything for you?
Say goodbye to your sweet profits.

“If you cannot build a viable business with AI costs 5 times higher than current ones, you don’t have a viable business: you have a ‘subsidized’ project.”

7. Not everyone can be a great artist, but a great artist can come from anywhere

Reshuffle: AI drastically reduces the common minimum multiplier to provide professional services.
If a lone wolf legal with Claude with a set of well-designed workflows can produce the same volume and quality of work as a team of five associates and two paralegals, the economic justification of large firms wobbles in a lot of practice areas.

This is a threat and an opportunity (but not for the same ones):

• Consolidated firms face the classic “innovator’s dilemma“: their size, overhead and legacy processes turn into liabilities for these purposes (instead of assets).

• But for individual lawyers, and especially the youngest ones, the entry barrier has never been so low.

Read the vision of “niche lawyer” of Jordan Furlong: I’m not going to explain it as well as him.
That one person attends to a specific clientele with AI-augmented precision and minimal overhead is something perfectly viable today.
... on the other hand, it has never been so easy as today to lose your head working all day alone at home, crossing your judgment -or simply talking- only with AI agents.
... or step into deep trouble by entering unexplored territories riding on AI’s shoulders, for not having anyone beside you with whom to cross your judgment minimally.

8. “Let’s calm down”

The (today still huge) gap between AI hype and legal reality imposes a bit of skepticism towards extremes:

• The legal world is firmly anchored to the most conservative structures of Western society. Everything that can change slowly in this context will do so with minimum revolutions: it will happen at glacial speed.
  You just have to see all those living and jumping procurators in times of Lexnet. Or the amazing scene of a pharmacist cutting a barcode with a cutter and sticking it with cellophane on a piece of paper. Amazing.

• “AI“ is an extremely generic term that encompasses very different realities. Changes will wipe out entire industries before others even start to worry.

• Each generation has had a technological crisis: maybe ours is more pronounced but none have been apocalyptic.

The correct takeawy of all this is not, I think, complacency, but remaining skeptical both towards ‘nothing will change for me’ and to ‘everything is coming down’.

Lawyers should decipher both ‘agendas’: both those who hold ‘AI is just a tool, nothing will change’ and the apocalyptic narrative of ‘lawyers are already cured meats’.
The sensible median would be in evaluating AI’s capabilities according to the Best Available Human (BAH) standard of Ethan Mollick, instead of facing the ideal lawyer, which by the way doesn’t exist.

It is true that AI today surpasses the average lawyer’s capacity in some things, but much will have to row Sam Altman before automating little things like justice administration.
Do you remember that so funny feeling the first time they introduced your credit card data on the internet for the first time? That won’t be anything compared to filing a completely automated lawsuit in an important matter. That will be butterflies in the stomach of real eagle size.

9. It’s the system, stupid!

Reshuffle insistently insists that we are asking the wrong question. ‘What can AI automate?’ instead of ‘What new systems will emerge coordinated by AI?’.
The service restructuring that gives title to the book captures a more ambitious reality than task-by-task analysis.
AI will not only change what we lawyers do; it will change how we organize ourselves, provide services, regulate ourselves, lend and value our services. And it will do so at the same pace as the ecosystems to which we provide services.
“Economics” coincides with its framework of ‘cascading coordination’: each solved coordination problem will unlock the next layer of complexity.

• The first-order effect of AI on law is steroid-document generation.

• The second-order effect will be (already is) workflow restructuring.

• The third-order effect will be new firm structures, pricing, client relationships.

• Later there will come new regulatory frameworks, new competitive dynamics between tools and solutions and native legal AI disruptors that today we don’t reach (I can’t) to imagine.

Lawyers who limit themselves to asking ‘How do I use ChatGPT to draft contracts faster?’ are optimizing a system that has days counted.
The question is: Where do I want to be in a post-generalization AI world? .

10.- We leave for another day…

‘The juniors, the juniors, is anyone thinking about the juniors?‘ and

‘Teaching skills to Claude or not teaching skills to Claude, that’s the question: the prisoner lawyer dilemma‘

Jorge García Herrero

Lawyer and DPO

With everything that is currently coming down the line in terms of future regulation, court cases where internal reports keep coming out showing the use of every trick of applied psychology that causes real harm to minors and adults alike, and authorities becoming ever more aware of what addictive patterns are, along come the people from the big arched M with an aggressive marketing campaign based on scarcity, FOMO, and data collection:

• Taking advantage of it to get good data through the app. A classic among classics;

• Taking advantage of the current obsession with opening Pokémon packs (physical and virtual): not for nothing, it is already known how much the rarest random cards you might get here would be worth. Don’t ask about the obscenities people ask and pay for Pokémon cards (especially if they are “graded”); and

• Taking advantage of Gen Z’s k-pop obsession to hit them with every visual stimulus and a full-blown Skinner scheme to keep them buying until they get everything.

And all this, only to then see the company’s CEO pretending to bite the wonderful not-at-all-bad hamburger they sell. P.S. Krusty already did it in The Simpsons.

Eou are reading ZERO PARTY DATA. The newsletter on current affairs and technology law by Jorge García Herrero and Darío López Rincón.

In the free time this newsletter leaves us, we solve complicated messes related to personal data protection and artificial intelligence regulations. If you have one of those, give us a little wave. Or contact us by email at jgh(at)jorgegarciaherrero.com

Suscríbete ahora

🗞️News from the Data World 🌍

.- The latest in the Gallagher-style AI feuds: while OpenAI shuts down Sora and gives up on its “huge project” for an adult NSFW ChatGPT, Anthropic accidentally leaks all-the-co-de of Claude (!!!!). But the very latest news is that Anthropic is doing a limited release of Mithos, its latest model, given how easily it finds zero-day vulnerabilities in “any software.”

And it’s only Thursday, Captain Haddock.

.- Noyb informs us that the Council of State dismissed Criteo’s appeal in March over the famous multimillion fine they got for doing their Adtech thing badly. It seems that the line about pseudonymous identifiers associated with IP addresses and “other browsing data” not being personal data at this point (with IP being one of the classic examples) did not sit well at all with the French Council of State. When we all already know they cross-reference a thousand things, and that what matters to them is being able to single you out through that IP and browsing, with no interest whatsoever in your name and surname.

.- The Australians are finding out that the new regulation on minimum age for social networks does not prevent nature from finding a way through: Social Media Minimum Age: March 2026 Compliance update. The supposed guarantee intended to minimize the margin of error / practical application of the right to challenge the decision of the system that categorizes you as a minor or an adult has been turned on its head by the reality of the world. On paper it is framed as a wonderful safeguard, but the minor sees it as just try again until it beeps. We saw Peter Craddok’s comment on the document on LinkedIn, but we went to the document to look for those specific highlighted observations:

.- This article by John Wilkins portrays the expansion of surveillance devices that are voluntarily made visible, almost totemic, presented as preventive crime deterrence. The moral is that surveillance is no longer hidden, but rather displayed as a message. Umberto Eco would praise its semiotic function: these artifacts are designed to generate “anticipatory obedience.”

.- Meta bad, but losing Section 230 worse. This fine text by Ryan Broderick contrasts two poisons** for you to choose yours**: Meta’s moderation and design failures versus the systemic risk of weakening the Yankee liability shield of Section 230. The counterintuitive argument is that punishing platforms may end up damaging the information and expression ecosystem more than correcting specific abuses. But friends! the author is not defending Meta, no (unlike all those former presidents of enforcement authorities who run to big law firms to do so as soon as they leave office); what he is doing is defending the legal architecture that prevents an internet dominated only by actors able to afford litigation and massive preventive filtering.

.- An interesting article from a foreign outlet explaining LaLiga’s very well-known abuse in blocking the websites of all and sundry during football match broadcasts. What is interesting is that it describes the ecosystem in which the companies holding broadcasting rights operate as that of a true banana republic.

📖 High density docs for data junkies ☕️

.- The ICO put out for public consultation its guide on automated decisions. You have to keep in mind that it is based on the UK GDPR, but it does leave some very applicable things:

1. Real human intervention, not tokenistic, recorded and prior enough that there is time to make critical changes in the processing.

2. And the problem of consent when it comes indirectly. It calls it “invisible processing,” because the data subject does not even realize what is being done.

“You should remember profiling can often be invisible to people. For example, if it involves personal information that you obtain from somewhere other than directly from the person themselves. This sort of invisible processing may mean that it is challenging for you to show that you have valid consent because it isn’t informed or specific in these cases.People also have the right to withdraw their consent at any time. You must make it as easy for them to withdraw consent as it was to give it.”

.- The CNIL publishes a document on retention periods in the employment sphere. Very table-format, and without many surprises. What they call an intermediate archiving period is, in the end, the same as our specialty under article 32 of the LOPDgdd on blocking. They include details on biometric access, and even a breakdown of the staff itself.

.- The Spanish Supreme Court applies the Scania doctrine. The other way around, but it applies it. And along the way it says that all those guides and guidelines are worth what they are worth: as “notorious facts,” not as a source of law.

.- Interesting judgment that punishes a detective agency for capturing the image of a worker on sick leave on the balcony of her house. She was on the balcony, yes, but she was in her house. So be careful.

.- Does National Security Scheme certification serve as a mitigating factor in liability for non-compliance with the GDPR? Francisco Javier Sempere and the National Court have the answer.

.- The Most Holy Luis Montezuma brings us, in a single skeet, links to the versions in** English **of the AI laws or bills of Japan, Korea, Vietnam, and Taiwan.

.- Highly recommended are the in-depth articles on ADM and AI Act aspects from the FPF. Specifically this one on the prohibition of emotion recognition by Desara Dushi.

.- When the AEPD bars the door, biometrics come in through the window. No, this is not a faithful summary of Patricia Chenlo’s post, but never let the truth ruin a good headline: Patricia comments on the Draft Law on the protection and resilience of critical entities that enables biometric authentication and identification for access in critical entities, under legal obligation, public interest, mandatory DPIA, and prohibition of labor or timekeeping uses.

.- Don’t miss the hair-raising statement by the AEPD in this decision declaring proceedings expired over a SEUR security breach. The credit for extracting the grain from the chaff goes entirely to Maria Luisa González Tapia.

.- Capilano University conducted this PIA on a proctoring application. So far, nothing new. What is funny about this PIA is that… it found insufficiently mitigated risks and rejected the processing.

.- A delicacy: a coloring book in the literal sense of the term, explaining to children what a data center is. What on earth is this resource doing in this newsletter and in this section? Click the link and then you tell me: not even I, the spy, could have managed to find material so breathtakingly mordant. The authors of this marvel are Melissa Tamberg, Mike DeCamp, Laura Scheving, and Luci Gardner.

.- The crisis of consent in contexts involving AI agents. This post does not stand out for its technical depth in legal issues (which it does not claim to have), but for its ability to illustrate the inherent difficulties in the new contracting and operating flows of aaall those agents (in that, it has plenty). Via the great Joan Sardá.

💀Death by Meme🤣

🤖NoRobots.txt or The AI Stuff

.- I highly recommend reading the description of this scam targeting an Axiom developer that allowed attackers (who pretended to be a startup in order to get a Teams call with their victim) to take control of his access credentials and introduce malicious software among the company’s legitimate libraries. Fine stuff.

.- US states’ regulations always feel very far away from us, but compilations and visualization tools in the IAPP style keep coming out. Now a tracker has been added on the emerging chatbot regulations (surely also agent regulations) of the states working on them, via FPF (Future of Privacy Forum).

📃The paper of the week

.- It is not a paper but another reflection on the erosion that the use of AI produces in the cognitive capacities of those who are in the process of training and who, inevitably, use and abuse AI models. Brilliant.

.- This one really is a paper. A veeery suggestive paper: “Large language models (LLMs) sometimes appear to exhibit emotional reactions.(…) Our key finding is that these representations causally influence the LLM’s outputs, including Claude’s preferences and its rate of exhibiting misaligned behaviors such as reward hacking, blackmail, and sycophancy.” (Well, would you look at that!).

📎Useful tools

.- US states’ regulations always feel very far away from us, but compilations and visualization tools in the IAPP style keep coming out. Now a tracker has been added on the emerging Chatbot regulations (surely also agent regulations) of the states working on them, via FPF (Future of Privacy Forum).

.- Are Claude’s various usage limits starting to eat your afternoon snack? We have a few little tips for you.

.- An AI-vibecoded document anonymization tool. The most promising-looking one among all those roaming around, IMHO.

.- If — like me — you are a not-so-neophyte in Python and have already spent years creating and forgetting virtualized environments here and there, it is more than easy that this tool to locate and delete them comes in — heh — handy.

🙄 Da-Tadum-bass

It may seem unrelated. For anyone who has not heard, a Nestlé truck (and its cargo of 400,000 F1-style bars) was stolen on a route between Italy and Poland. Leaving aside that the driver has to be in on it for them not to have geolocated the truck which, surely, was carrying a beacon, Nestlé came up with launching this landing page seeking citizen collaboration. If you had chocolate with the affected code, it was supposedly giving you instructions to notify the company and the authorities they are collaborating with.

The point was to see how that “get in touch” had been set up from a data protection perspective. The problem is that the affected code has not been leaked to see what appears afterwards, the media have not looked into it that far, Reddit has not lived up to expectations here, and neither Claude nor his friends are able to provide the code (it is not the one in the image, no).

Unless it is someone who needed to have a lifetime supply of KitKat, it is quite likely they will not try to sell it or place it on the market with the original wrapper. There are thieves who are rigorous in their work.

If you think this newsletter might appeal to someone and even be useful to them, forward it to them.

Compartir

The AI Act regulates transparency as a fundamental pillar of technological governance, not only to prevent malicious deception of specific individuals or groups, but also to preserve the integrity of the global information ecosystem.

In other words, it seeks not only to protect individual rights, but also the functioning of the European political and social system.

Synthetic content is defined, in general terms, as any digital asset—whether text, image, audio, or video—generated or substantially manipulated by means of AI systems.

The transparency obligation is manifested through two operational dimensions: machine-readable marking and human-perceptible labeling.

· Marking refers to the integration of technical signals, such as encrypted metadata or digital watermarks, that enable other systems to automatically identify the artificial origin of a file.

· Labeling is directed at the perception of the end user, using visual or auditory indicators that inform them of the AI nature of the content at the moment of exposure.

Article 50 of the EU AI Act imposes the transparency obligation for general synthetic content (not deepfakes) primarily on technology providers, who must ensure that their systems “mark” outputs natively.

If you are interested in art 50 transparency obligations, you definitely should check out the first part of this series:

I promise you that the rest of the text is written quite seriously, but at this point I cannot resist paying tribute to Karate Kid, with the secret hope that it may serve as a mnemonic rule to remember that providers are required to mark (wax on) and deployers, to label (wax also on).

You’re reading ZERO PARTY DATA. The newsletter on current affairs, technopolies, and law by Jorge García Herrero and Darío López Rincón.

In the spare moments this newsletter leaves us, we specialize in solving complicated stuff in personal data protection. If you have one of those, give us a little wave. Or contact us by email at jgh(at)jorgegarciaherrero.com

Thanks for reading Zero Party Data! Sign up!

Suscríbete ahora

2 Article 50 of the AI Act

The European Union AI Act represents the first comprehensive attempt to codify these obligations at the international level.

The AI Act adopts a “risk-based” approach, classifying generative AI within the limited-risk category.

Accordingly, it imposes specific transparency requirements designed to foster trust and traceability.

2.1 Obligations for providers of generative AI systems

Article 50(2) provides that providers of AI systems—whether specialized or general-purpose (GPAI)—that generate synthetic audio, image, video (either deepfakes or not), or text content must ensure that outputs are marked in a machine-readable format.

This obligation is independent of the purpose of the generation or publication of the content: whether it is an artistic image generated for a blog or ambient audio for a video game, technical marking is mandatory.

The law requires these solutions to be “effective, interoperable, robust and reliable” to the extent permitted by the state of the art.

Accordingly, the provider must not only insert a mark, but that marking must also be resistant to attempts at removal or manipulation by malicious third parties.

In addition, providers must make available free detection mechanisms—such as APIs or public verification tools (“oracles”)—so that deployers and other users may verify whether a specific file was generated by their AI.

2.2 Exemptions

Without prejudice to the foregoing, the European AI Act has envisaged scenarios in which strict transparency could be counterproductive or unnecessary.

· AI systems that function as “standard editing assistants.” This includes tools that do not substantially alter the input data or its semantics, such as color correction tools in photography, audio noise reduction systems, or video stabilization tools.

· AI systems used exclusively for scientific research and development purposes.

· AI components distributed under free open-source licenses, unless such models present systemic risks.

· The well-known household exemption: purely personal and non-professional use. An individual who generates an image for private use is not subject to the same labeling obligations as a company distributing commercial content.

3 The EU Code of Practice and the dates on which all this will apply

Since the text of the AI Act provides legal principles but not technical specifications, the European Commission has published a Code of Practice on Transparency.

In March 2026, its second version was published, and it is the version discussed here.

This Code of Practice seeks to bridge the gap between the legal obligation and technical reality by establishing what is considered the “state of the art” with regard to the marking and detection of synthetic content.

Is this Code mandatory? Nope

The Code is not mandatory in itself: only for companies that subscribe to it.

Subscription to this Code neither presumes nor certifies compliance with the AI Act (organizations that do not sign it may demonstrate compliance by other means).

But in practice, the idea is that the Code will become the compliance standard in inspections conducted by the competent authorities.

The third version (the final one) of the Code is expected in June, and official Guidelines from the European Commission are also expected, but all of this will become known only a few weeks before the AI Act enters into force.

The problem is that, given the timetable, whether or not those documents arrive in time, it will be very difficult in practice to implement their new requirements in time for the applicable date: 2 August 2026.

Lastly, the AI Act will apply to AI systems placed into production from August 2026 onward. As regards those already on the market before then, two transitional periods are under discussion: three or six months from that 2 August date.

3.1 Multi-layered marking

The second draft of the Code acknowledges[1] (watch this carefully) that the state of the art does not make it possible to comply with all the requirements laid down in the AI Act by means of a single method or tool, and for that reason it proposes that providers should not limit themselves to a single marking technique, but should instead implement a multi-layered approach to ensure the resilience of the system.

This approach is divided into three fundamental levels:

1. Metadata integration: This consists of inserting provenance information and digital signatures directly into the file header (such as XMP or IPTC tags). Although this is the easiest technique to implement, it is also the most vulnerable, as many image editors and social media platforms automatically strip metadata when processing files.

   

2. Imperceptible watermarks (Watermarking): This technique involves embedding digital signals directly into the pixels of an image or into the frequencies of an audio file. These marks are invisible or inaudible to humans, but remain even if the file is compressed, cropped, or converted into another format. The Code suggests that these marks be integrated both during model training and during the inference (generation) phase.

3. Fingerprinting and output logging: As a final layer of security, providers are expected to maintain a database or log of the hashes of generated content. This makes it possible, if content loses its metadata and watermark, for a detection system to identify it by comparing its hash or unique “fingerprint” against the provider’s records.

The Code requires signatories (providers, deployers) to

(i) refrain from removing or altering this marking; and

(ii) impose, through acceptable use policies (or information, in the case of open-source models), the same obligation on downstream third parties.

3.2 Quality requirements and technical performance

Compliance is not based only on “doing it”, but on doing it effectively.

The Code provides that detection solutions must demonstrate low levels of false positives and false negatives.

Providers must subject their tools to independent evaluations and verified benchmarks in order to demonstrate that their solutions meet the performance standard required by the AI Office.

4 Deepfakes: Mandatory labeling

A deepfake, within the meaning of the AI Act,[2] is image, audio, or video content generated or manipulated by AI that appreciably resembles existing persons, objects, places, entities, or events, and that a reasonable person could falsely perceive as authentic or truthful.

All deepfakes (either image, video, or audio) must be labelled in a clear, distinguishable, and accessible way no later than the moment of the user’s first exposure to the content.

The Code of Practice establishes specific requirements depending on the modality.

• Main visual element: the acronym “AI” in uppercase, optionally accompanied by text such as “Generated with AI,” “Made by AI,” or “Manipulated with AI.”

• Minimum contrast ratio: 4.5:1 between the label and the background.

• Portability: to the extent technically feasible, the label must “travel” with the content when it is redistributed.

• Accessibility: alternative text for screen readers, tactile signals for audio-only content (where the device permits), compatibility with assistive technologies.

5 Specific rules

5.1 Image

For images, the icon or label must be displayed consistently from the first exposure and at each subsequent exposure. The label must be clearly distinguishable from the image itself: prominent, not hidden within layers of the image, not too close to other icons or text, and not displayed against backgrounds that reduce its visibility.

5.2 Live video (live broadcasting, livestreaming)

For live video, the icon must be displayed consistently throughout the entire exposure, where feasible. If the disclosure is also made by audio, it must be presented simultaneously with the visual icon. Alternatively, a visual or auditory notice may be used at the beginning and at regular intervals during the broadcast.

5.3 Pre-recorded video

• Long videos: icon or label at least at the beginning, repeated at regular intervals (for example, each time the deepfake content appears or after advertising breaks).

• Short videos: icon or label visible consistently throughout the duration. If the video is entirely generated or manipulated by AI, this must be indicated throughout playback.

• Credits: a notice may be included in the end credits, but this must always be accompanied by one of the preceding options. Credits alone are not sufficient.

5.4 Audio

• Audio under 30 seconds (advertisements, commercial spots): at a minimum, a brief audio notice at the beginning of the content.

• Longer audio content (podcasts, AI-generated calls, radio broadcasts): repeated audio notices at the beginning, at appropriate intermediate stages, and at the end of the content.

• Language: the notice must be given in clear and simple natural language, in the same language as the content.

• Audio with a visual interface (playback on a mobile phone screen, in a car, etc.): in addition to the audio notice, an icon or visual label must be displayed on the interface elements under the deployer’s control.

5.5 Multimodal content

For content combining several modalities (image-text-audio, image-audio, text-audio, image-text), disclosure must be made by means of an icon or label that is clearly perceptible without any additional interaction on the part of the user.

6 Excpetions

6.1 “Non-exceptions”

· The “editorial exemption” does not apply to deepfakes.

· Mandatory even where the “cloned” person has given explicit consent.

6.2 Exceptions

1. Use authorized by law for the detection, prevention, investigation, or prosecution of criminal offences. This exception has very short legs in the private sector.

2. Artistic and creative works

For deepfake content forming part of an evidently artistic, creative, satirical, fictional, or analogous work, the transparency obligation (labelling) is mitigated, but it does not disappear.

Disclosure must be made in a way that does not impair the exhibition or enjoyment of the work. The options include:

• Live or near-live video: icon in the upper or lower corners for at least five seconds at the beginning (for example, during the opening credits), without the need to repeat it during the remainder of the exposure.

• Pre-recorded video: disclosure for a sufficient duration at the beginning, without interfering with the experience.

• Image: label at the beginning of the first exposure, which may be integrated into the image or its background provided that the user can distinguish the labeling.

• Audio: audio notice at the beginning of the first exposure.

• Non-digital contexts (exhibitions, galleries, festivals): disclosure may be made at the point of entry or upon ticket sale.

Jorge García Herrero

Lawyer and Data Protection Officer

[1] Strong words in the Code: “So long as no single marking approach is sufficient, under the state of the art, to comply with the four requirements in Article 50(2) AI Act of effectiveness, interoperability, robustness and reliability, Signatories will implement a multi-layered marking approach to ensure that the outputs of their generative AI systems are marked with at least two layers of machine-readable active marking, as specified in the sub-measures below” (p. 10).

[2] Article 3(60) of the AI Act

• Competition vs GDPR: promise of guidelines with the Commission;

• DMA vs GDPR: there are guidelines here, but it seems the speakers highlighted that it should be made clearer that the DMA does not take precedence over the GDPR; and

• DSA vs GDPR: there are also guidelines here, but the discussion turned to the big topic of age verification and that both must be applied: “The panel concluded with a clear message: online safety under the DSA and the lawful processing of personal data are two sides of the same coin, both calling for the DSA and the GDPR to be read coherently. “

And today, the simplification of the Digital Omnibus in the AI section should be voted in plenary. And then on to the usual trilogues.

Tomorrow we will participate via Webex in the EDPB public hearing for its EDPB Guidelines on the processing of personal data to target or deliver political advertisements.

You are reading ZERO PARTY DATA. The newsletter on current affairs and technology law by Jorge García Herrero and Darío López Rincón.

In the free time this newsletter leaves us, we solve complicated messes related to personal data protection and artificial intelligence regulations. If you have one of those, wave your little hand at us like this. Or contact us by email at jgh(at)jorgegarciaherrero.com

Suscríbete ahora

🗞️News from the Data World 🌍

.- In an upcoming newsletter we will analyze the transparency obligations imposed by the AI Act on synthetic image, video and audio content (not necessarily deepfakes). One striking novelty is the combination of marking—so machines can identify it—and labeling—for humans. These marks must make the work easier for fact-checkers, journalists, and academics.

What this bald guy didn’t see coming were fake fact-checking systems to question the truthfulness of real images like those that have appeared amid the flood of AI slop related to the USA-Israel-Iran war.

In an unprecedented plot twist, these “fake verification outlets” erode trust in real evidence, and fabricated analyses destroy trust in verification itself.

.- How many times has Elon Musk said he was going to pay someone something and then didn’t do it? For the richest man in the world, quite a lot. Better not draw conclusions.

.- Latest months of OpenAI: (i) it announced advertising within the chat; (ii) then a version of ChatGPT for adults. (iii) this very week it offers bonds with more than 17% “guaranteed” interest. (iv) Just yesterday it announced the disappearance of Sora, its much-hyped synthetic video platform/social network.

I’m not an economist, but for some reason this beautiful video comes to mind.

📄High density docs for data junkies☕️

.- Reading the AEPD and CNMC post on Article 28 of the DSA (the one that supports age verification as a legal obligation), two things can be recalled:

• That with the €950,000 fine to Yoti by the AEPD (€500K just for the Article 9 issue), the double approach the Commission included in its guidelines on the matter has aged poorly: “Age estimation methods can complement age verification technologies and can be used in addition to the former, or as temporary alternative in particular in cases where verification measures that respect the criteria of effectiveness of age assurance solutions.”

• That the Commission itself mentioned a Child Rights Impact Assessment (CRIA). Which one exactly? The one UNICEF allows you to download from its website. Yes, to the LIA, TIA or FRIA this “CRIA” is added.

.- A good summary post by Vadym Honcharenko with the latest contributions to the debate on how that fluid and volatile—but ultimately critical—concept of personal data stands. The post compiles readings following the initial debate of September 25, with analyses by Peter Craddock, Sophie Stalla-Bourdillon on lessons from the SRB case, and Phil Lee on the risks of building data protection on shifting sands. Our humble contribution here.

.- Do you remember that the GDPR does not prohibit applying data to different processing, but rather processing incompatible with those originally legitimized? The ICO updates its guidance detailing when and how controllers can reuse personal information for a purpose different from the original under the UK GDPR as reformed by the DUAA 2025. A clearer compatibility test is introduced and reuses that the UK GDPR now considers automatically compatible are listed (in a new Annex 2).

It’s true, on this topic the UK has diverged too much from the GDPR. For a concrete and close analysis of the compatibility of secondary purposes under the GDPR, the best place to start is the Digi case of the CJEU that we covered years ago.

.- Via Carlo Piltz: The Bavarian authority requires a separate and private communication channel between data subjects and the DPO from the organization’s common support channel. Watch out

💀Death by Meme🤣

🤖NoRobots.txt or The AI Stuff

.- Document from a UK House of Lords committee (our senate, but with pedigree) on generative AI: “AI, copyright and the creative industries”. It’s from February, but no less interesting for that.

It focuses on putting forward considerations and recommendations to the Government on how to approach it without wiping out intellectual property and the “creative industries.”

-Better to leave out exceptions for Text and Data Mining (TDM), i.e., for the use of sources protected by intellectual property, under the mere opt-out guarantee they would have set up to notify the data-hungry AI that it cannot use it. What has been seen in the EU does not provide much reassurance regarding guarantees.

175. A broad TDM exception with an opt-out rights-reservation mechanism, as envisaged under “option 3” of the Government’s consultation, is not a viable foundation for the UK’s AI and copyright regime. The tools currently available for rights reservation are fragmented, poorly understood and place an unreasonable burden on individual creators.

176. Experience in the EU suggests that comparable provisions have neither delivered reliable control for rightsholders nor a robust licensing market. We welcome the Secretary of State’s acknowledgement that there is currently no workable opt-out proposal on the table and consider that the Government should now draw a clear line under this approach. The UK’s starting point should remain a licensing-first model in which permission is required to use copyright-protected works for AI training.

And that if companies are asking for a TDM exception, it’s because they know what they’re doing is not legal.

36. (…..). However, the consistent call from technology sector stakeholders for a new, broad commercial text and data mining (TDM) exception expressly to enable more AI model training to take place in the UK suggests that they do not regard large-scale commercial training on copyrightprotected works as clearly covered by the existing exceptions. If they did, a commercial TDM exception would be unnecessary.

-Not to modify intellectual property law to fit AI, and that this “learning” is “reproduction”: they call it learning, it is reproduction by pure intellectual property standards:

38. (….)We do not accept the view that the copying and processing of protected works during training should be characterised as ‘learning’.

39. We therefore consider that the Government should rule out any reform of the Copyright, Designs and Patents Act that would remove the incentive to license copyrighted works for AI training, and should instead focus on strengthening licensing, transparency and enforcement within the existing framework.

“We do not accept the view that the copying and processing of protected works during training should be characterised as ‘learning’.”

-The gap in protection of style, aka not asking AI to generate something as if it had been made by the author. Although the line is thin so they couldn’t be easily sued.

83. The absence in UK law of a robust personality right or specific protection for digital likeness means that creators and performers lack an adequate basis to challenge harmful outputs that imitate their distinctive style, voice or persona without reproducing a specific underlying work.

84. The Government should introduce protections against unauthorised digital replicas and ‘in the style of’ uses. Any new framework should give creators and performers clear, enforceable control over the commercial exploitation of their identity, while appropriately safeguarding freedom of expression and other legitimate uses.

-A nice infographic of the generative AI flow:

.- The regulatory framework on AI released by the White House might not seem to contain anything unusual (beyond the fact that it says “Trump” and that the protection of minors almost suggests it’s Melania’s idea). The problem is that Trump doesn’t do anything without intent. Most of the document contains sensible proposals for Congress: age verification and platform oversight, ensuring citizens don’t bear the increased electricity consumption of mega AI industry, anticipating research and appropriate measures for identity theft and fraud, not legislating anything that removes judicial authority to decide on IP infringement; but at the end it drops the bomb. The subtle way of waging war against Anthropic and anyone who refuses strict AI control:“act contrary to the United States’ national strategy to achieve global AI dominance.”

📃The paper of the week

.- This paper by Cristiana Santos, Sanju Ahuja, Johanna Gunawan, Nataliia Bielova proposes an analytical framework to assess dark patterns under the Digital Services Act, identifying obstacles to specific user rights: making complaints harder (Article 20), obscuring advertising transparency (Article 26), manipulating notice-and-action mechanisms (Article 16), distorting user choice regarding recommender systems (Articles 27 and 38), and interfering with minors’ rights (Article 28).

.- It’s not exactly a paper, but it stays here to avoid overloading the AI section. The Korean data protection authority released an interesting checklist in 2021: Artificial Intelligence (AI) Personal Information Protection Self-Checklist. Although time has passed, it’s still worth a look. Seen via San Luis Montezuma.

1. The checklist itself for core AI cases;

2. Very clear data processing flows:

🙄 Da- Tadum Bass!

Atompunk is the genre or aesthetic style that tries to reflect a post-nuclear Cold War dystopia.

The key point is that it would be preferable for it to remain fiction to liven up works like Fallout, Stalker or Metro.

If you think this newsletter might appeal to and even be useful to someone, forward it to them.

Compartir

If you miss any doc, comment, or dumb thing that clearly should have been in this week’s Zero Party Data, write to us or leave a comment and we’ll consider it for the next one.

We are not going to get into today the changes to the entry-into-force date for new systems / in uso systems resulting from the various omnibus packages (omnibus is already a plural noun in latin) on the table.

At the beginning of March, the second version of the Code of Good Practice on Marking and Labeling AI-Generated Content from the European Commission was published, which is the one we take into account in this post.

This code also refers to image, video, audio and deepfakes, but today we are starting by talking about text: a topic that barely matters given that almost nobody uses AI today to help them write.

You’re reading ZERO PARTY DATA. The newsletter on current affairs, technopolies, and law by Jorge García Herrero and Darío López Rincón.

In the spare moments this newsletter leaves us, we specialize in solving complicated stuff in personal data protection. If you have one of those, give us a little wave. Or contact us by email at jgh(at)jorgegarciaherrero.com

Thanks for reading Zero Party Data! Sign up!

Suscríbete ahora

1. But I am not OpenAI or one of the magnificent seven... Does this apply to me?

This post will be useful then, not for you, since you are not caught by it, but for anyone who, in the exercise of their functions, uses generative artificial intelligence tools to produce, rewrite or edit texts intended:

(i) To be published in the name of their organization.

(ii) On matters of “public interest”.

This includes, among other examples, the drafting of press releases, market reports, regulatory analyses, content for the corporate blog, social media posts for informational purposes, and any other text intended to inform the public about matters of public interest.

The concept of “public interest” is not defined in the AI Regulation or AI Act.

The interpretative guidelines of the European Commission are expected for the second quarter of 2026 and may not arrive until just a few weeks before the deadline.

A prudent criterion would be: if the text aims to inform and is directed at the general public or a relevant segment of it, it is presumed to fall within the scope of application.

If generative AI is used to produce text that is going to be published externally for informational purposes, that text must be labeled as AI-generated, unless the conditions of the editorial exception are met.

2 What needs to be done? Label the text

When publishing text generated or manipulated with AI on matters of “public interest”, its synthetic origin must be disclosed clearly and distinctly, so that the reader recognizes it as such when accessing the content for the first time.

The Code of Practice establishes specific requirements for this disclosure:

2.1 Labeling format

• Icon or visual label: the main element will be the acronym “AI” in uppercase, optionally accompanied by a short text such as “Generated with AI”, “Made by AI” or “Manipulated with AI”.

• Contrast ratio: minimum 4.5:1 between the label and the background on which it is displayed.

• Location: in a fixed position, for example above or at the beginning of the text, next to the headline, or in the opening colophon. The key point is that it is perceptible before the reader begins reading.

• Partially generated texts: if only a part of the text has been generated or manipulated by AI, it is enough to label that specific part.

• Very short texts: for short texts where a label would degrade readability, a contextual notice in the interface may be used instead (for example, an indicator next to the output or a note at page or session level).

2.2 Accessibility

The label must be accessible for people with disabilities: compatible with screen readers, with sufficient contrast for people with color vision deficiencies, and detectable by assistive technologies.

At minimum, the criteria of the WCAG 2.1 level AA standard must be applied.

3 Can this labeling be avoided?: The “editorial exception”

Article 50(4) of the AI Act establishes that the labeling obligation does not apply when AI-generated content:

i. Has been subjected to a human review process or editorial control, and

ii. A natural or legal person assumes editorial responsibility for the publication.

Consequently, relying on this exception requires meeting specific and documented requirements:

• Identified editorial responsible party: The name, position and contact details of the person (natural or legal) who assumes editorial responsibility must be published. These details must be publicly accessible.

• Documented review process: the organization must document the organizational measures and human resources assigned to ensure that effective human review is carried out before publication.

• Formalized workflow: it is not enough to “document” that someone “must read the text and take responsibility for it before publishing”.

A documented procedure is needed, with identified responsible parties and traceability of the process.

A documented procedure is needed, with identified responsible parties and traceability of the process. If this process is not followed, the text must be labeled.

4 Consequences of non-compliance

The AI Regulation or AI Act provides for significant penalties for non-compliance with transparency obligations.

Art 99 AI Regulation: up to €15 million or 3% of the total worldwide annual turnover of the financial year preceding the infringement, whichever amount is higher.

Although the Code of Good Practice is not binding on the authorities (it does not presume compliance with the rule), those who do not subscribe to it must prove by other means that they comply with the same obligations of Article 50 AI Regulation.

In practice, the Code will function as the reference standard for inspections by the competent authorities.

Jorge García Herrero

Lawyer and Data Protection Officer.

Apparently:

.- The order was to hit a thousand (a thousand!) targets in the first twenty-four hours of the attack,

.- The building housing the school had been part of a military infrastructure ten years ago but not at present. Nobody checked. Or so I want to believe.

With or without AI involved, someone might think that reviewing a thousand (a thousand!) military targets should have been done more rigorously. Or with rigor.

If there was AI involved, I am immensely curious to know the exact number of human supervisors, the number of targets reviewed by each one, the exact incentives they were given, and the KPIs to document and review their performance in order to “improve” (I do not know whether this concept fits here) next time.

Lukasz Olejnik explains it better than I do in his newsletter from last Monday. For my part, I would point out two things:

1.- Let us remember that the use of AIs by the military and by the “law enforcement and security forces” is not regulated in the EU (nor will it be) either by the Artificial Intelligence Regulation or by the Personal Data Protection Regulation.

2.- Let us not get carried away by the recent hype around the confrontation between Anthropic and the U.S. Government over the possible use of AI for military purposes: Gaza has been the laboratory for this specialty for two eternal years (if it has stopped being so today: it does not seem like it). There are the “Lavender,” “Where’s daddy” and “The Gospel” tools whose use was described in detail by the Israeli press at a still early stage of the Palestinian massacre.

You are reading ZERO PARTY DATA. The newsletter on current affairs and technology law by Jorge García Herrero and Darío López Rincón.

In the free time this newsletter leaves us, we solve complicated messes related to personal data protection and artificial intelligence regulations. If you have one of those, wave your little hand at us like this. Or contact us by email at jgh(at)jorgegarciaherrero.com

Suscríbete ahora

🗞️News from the Data World 🌍

.- A CEO used ChatGPT to void a 250 million contract and lost even the shirt off his back. The story had already been told, now we have the juicy judgment: A CEO ignored his lawyers, consulted ChatGPT, and got a thoroughly deserved beating in court. Changhan Kim, CEO of Krafton, publisher of the video game Subnautica 2, undertook to pay 250 million dollars in bonuses if the game sold well. When it sold well, his legal team warned him of the risks, and Kim asked ChatGPT for a strategy to avoid payment. The chatbot designed “Project X”: a plan to seize control of the marketing company by brute force. Kim executed the plan, fired the founder of the development studio, and a Delaware judge ordered his immediate reinstatement. The funniest thing: the court records literally transcribe ChatGPT’s prompts and responses as documentary evidence, creating a precedent in which conversations with a chatbot become evidence of corporate bad faith (or negligence, I would say) that can be used against them in legal proceedings.

.- Australia: teenagers are still on social media despite the ban. Three months after the pioneering ban on social media for under-16s in Australia, new data from Qustodio suggests that use has fallen modestly. TikTok, YouTube, and Snapchat recorded declines among users aged 10 to 15, but most teenagers who used the platforms before the ban remain active on them. The most revealing aspect is the success of alternative social apps not included in the ban that are shooting up in popularity among Australian minors, showing that restrictions based on specific platforms create a balloon effect that shifts the problem without solving it.

And those of creative thinking by minors. The legislator forgets that scarcity and withdrawal sharpen ingenuity.

“I got a photo of my mother, put it in front of the camera, and it let me through. It said: ‘thanks for verifying your age,’” says Isobel. “I heard that someone used Beyoncé’s face,” she adds.

Isobel points to her mother, Mel, and says: “I texted her and said: ‘Hey, mummy, I already got past the social media ban,’ and she simply replied: ‘How naughty!’”

.- War in the age of the online “information bomb.” Kyle Chayka has returned to The New Yorker from paternity leave and we could not be happier: Memes like “monitoring the situation” reflect the illusory belief that we can be anything more than passive and confused spectators of the digital shrapnel. The article brings back the French philosopher Paul Virilio and his 1998 book “The Information Bomb,” in which he anticipated a “visual crash” caused by a tsunami of details that leads to the defeat of facts and plunges our relationship with reality into a thick fog. Virilio wrote this in the pre-social-media era, and his concept of a breakdown in informational trust is more accurate today than it was then: the fragments of reality circulating today through the digital ocean are real footage of real events, but their cumulative effect generates exactly the opposite of a coherent portrait of reality.

Note that neither the original piece nor this commentary talks about “deepfakes.” That is not the issue.

.- In another spectacular case of the “Streisand effect,” A judge ordered YouTube to remove the deposition videos of DOGE members on Friday, but by Saturday they were already available everywhere as torrents and on the Internet Archive. The videos showed DOGE members unable to define “DEI,” admitting that they used ChatGPT with terms like “black” and “homosexual” to flag grants for elimination but not “white” or “caucasian,” and acknowledging that their cuts failed to reduce the government deficit, which was their goal.

.- Amazon wins its appeal against the 746 million GDPR fine from Luxembourg’s authority. Amazon won on appeal against the 746 million euro fine imposed in 2021 by Luxembourg’s data protection authority for GDPR infringements related to personalized advertising. The administrative court almost entirely upheld the CNPD’s analysis, including that the legal basis of legitimate interest invoked by Amazon was not appropriate and that the transparency procedures were insufficient. However, it annulled the fine based on later CJEU case law requiring an analysis of whether Amazon acted intentionally or negligently (the CJEU rather leaves the authority exposed by suggesting that, in view of the infringement, the Authority rushed to quantify the sanction without giving the matter much more thought). In addition, by the time of the sanction Amazon had already remedied its infringements. Content from Matthew Newman and Norman Aasma via San Luis Montezuma.

That wonderful remediation point is what the CNPD itself puts on the table in its brief note on the matter. Amazon gets off the sanction, but the procedure has meant that it complies and changes the outrageous practice that gave rise to the sanction: moving from legitimate interest to consent for behavioural advertising. Honour salvaged or a draw? Let each person decide.

📄High density docs for data junkies☕️

.-The Garante has slapped a fine of 17,628,000 euros on Intesa Sanpaolo for unlawfully processing the data of 2.4 million customers transferred to Isybank, its 100% digital subsidiary. The bank profiled its clientele by selecting customers under 65, regular users of digital channels, without investment products, and with financial availability below a certain threshold. The Garante considered this processing unlawful because the customer could not reasonably foresee it from the context and the information received. The legal basis of legitimate interest invoked by the bank did not hold up given the sensitive nature of the banking data processed.

Now compare that decision with this other one, which was already controversial a couple of years ago, from the Belgian Authority.

.- Sovereignty Washing: Michael Staudacher’s instruction manual. European digital sovereignty versus the “sovereignty washing” sold by U.S. hyperscalers. Digital sovereignty is the condition in which no foreign actor has a legally permitted path to access your data.

The CLOUD Act does not hack servers; it sends a court order that turns into lawful delivery under U.S. law what would be a crime under European law. Hyperscalers do not break in by force, they comply legally. Europe has excellent data protection legislation but not digital sovereignty, and confusing the two concepts is literally how sovereignty washing works. Each CLOUD Act request is American digital sovereignty projected toward the EU, China systematically builds its own with its own chips, cloud, and legal framework, while Europe confuses having servers in Frankfurt—labelled with logos in German and contracts in English—with real sovereignty, when in truth the parent company is still in Seattle. .-

🤖NoRobots.txt or The AI Stuff

.- The Dutch DPA publishes a periodic report on the state of AI in the country. Risks, biases, or effective control. In the February report of this year, which we would say they published in March, it shows concern about use in recruitment, bias, and black-box issues. HR’s refusal to explain how those wonderful evaluation and profiling systems really work. And that lack of explanation, as the Advocate General recalled in his opinion on Dun & Bradstreet Austria, means that you do not have a true right to an explanation of how they function.

For instance, the AP observes that game-based assessments are increasingly used as an initial screening tool for candidates. This raises issues related to the right to an explanation of how an assessment or judgment is formed, as well as the contestability of that judgment.

Another example concerns comparative online assessments in which employers are presented with information that differs from—and is often more detailed than—the information shown to candidates. This information asymmetry is problematic and at odds with the right to an explanation. Without insight into the assessment results received by the employer, it is difficult, if not impossible, for a candidate to meaningfully challenge the outcome. The AP therefore emphasises that such systems must comply with both the GDPR and the AI Act.

.- With a name that is very hard to improve on (BullshitBench), Peter Gostev treats all humanity to a comparison of the response effectiveness of the major models. Claude is almost always first, but the surprise is that Qwen (Alibaba) ranks second in legal.

📃The paper of the week

.- From Stanford and Oxford researchers, we find a paper that analyses one of the great problems of LLMs (ELEPHANT: Measuring and understanding social sycophancy in LLMs): it always tries not to tell you that you are wrong, even when that affects the truthfulness of the result.

That middle column reminded us, for whatever reason, of this other thing:

📎Useful tools

.- In another spectacular example of vibe coding in which Oscar Marchal, the “creator,” cannot program, but he does know very well what he needs: this anonymisation tool for legal documents using Claude as a development copilot. The tool removes personal data from Word, RTF, digital PDF, and scanned PDF files directly in the browser, without any data leaving the user’s computer. The creation process lasted less than an hour: the lawyer described the problem as if speaking with a colleague and Claude built the code. The author warns that the tool does not replace human review and does not recommend its use with scanned documents without OCR.

🙄 Da- Tadum Bass!

More than nonsense, it is a curious situation. You have a dog-child, but the GDPR applies to the personal data of humans. And the veterinarian threaded the needle nicely in the right of access request they were presented with.

Less funny when we get to something similar to the Rick and Morty episode this screenshot belongs to. Then we will be the dog-children.

If you think this newsletter might appeal to and even be useful to someone, forward it to them.

Compartir

If you miss any doc, comment, or dumb thing that clearly should have been in this week’s Zero Party Data, write to us or leave a comment and we’ll consider it for the next one.

Deja un comentario

What kind of clauses are we talking about?

All those that resemble the following:

“The provider represents, warrants, and undertakes that: (a) neither the provider nor any of its affiliates that have access to covered data – “Data Covered” (nor any employee or contractor of the provider or its affiliates that has access to covered data) is a covered person – “Person Covered”; (b) the Provider and its affiliates will not participate in any Covered Data Transaction; and (c) the Provider will immediately notify the Company in writing if any of the representations in this section change or cease to be true.”

U.S. regulations are outside our expertise, but the need to explain why you might encounter certain things in the middle of a DPA, access to the FAQs from the Department of Justice (referencing the linked “rule”), and a bit of help from AI (especially to confirm and create the tables we show) allow us to tell this story.

It is a journey through cross-referenced concepts, but much easier to understand than the Data Act and the AI Act.

You are reading ZERO PARTY DATA. The newsletter on current affairs and technology law by Jorge García Herrero and Darío López Rincón.

In the free time this newsletter leaves us, we solve complicated messes related to personal data protection and artificial intelligence regulations. If you have one of those, wave your little hand at us like this. Or contact us by email at jgh(at)jorgegarciaherrero.com

Suscríbete ahora

What is this rule and which countries does it blacklist?

This rule attempts to limit or prohibit access to two types of data—bulk sensitive personal data of Americans and U.S. government-related data—by the following restricted countries (“Country of Concern”).

Zero surprises on the blacklist of countries.

• China (including Hong Kong and Macau);

• Cuba;

• Iran;

• North Korea;

• Russia; and

• Venezuela.

What information, persons, and situations does it apply to? The central elements of “covered data” and “covered person.”

– “Covered Data” (Datos Cubiertos) means two main categories:

• Bulk U.S. sensitive personal data, regardless of whether the data are anonymized, pseudonymized, de-identified, or encrypted, as long as they reach their respective threshold:

• Human omic data (epigenomic, proteomic, genetic, or transcriptomic): more than 1,000 U.S. persons (or more than 100 for genomic data);

• Biometric identifiers: more than 1,000 U.S. persons;

• Precise geolocation data: more than 1,000 U.S. persons;

• Health data: more than 10,000 U.S. persons;

• Personal financial data: more than 10,000 U.S. persons; and

• Covered personal identifiers: more than 100,000 U.S. persons (government identification numbers such as passport numbers, device identifiers, demographic/contact data, IP, cookie data, or call detail records).

• U.S. government-related data:

• Precise geolocation data at government locations; and

• Sensitive data of government personnel.

– “Covered Person” (Persona Cubierta) includes the following categories of individuals or companies:

• Foreign entities from the mentioned countries;

• Entities 50% or more owned by Covered Countries/Persons;

• Individuals resident in Countries of Concern;

• Employees/providers or contractors from Covered Countries/Persons; and

• Any listing determined by the Attorney General.

– If the following occur simultaneously: (i) the previous elements of a provider or employee from a restricted country (“Covered Person”), (ii) contracted by a U.S. entity (US Person), and (iii) with access to the covered data (“Covered Data”), then the scenario falls within the scope of compliance with this rule: a Covered Data Transaction.

This is subdivided into two cases: the main case of a prohibited transaction (Prohibited Transaction), and a secondary case of a restricted transaction if the U.S. entity complies with certain defined security requirements.

Most important for us: In which cases would a European company be affected?

Two main scenarios can be distinguished, based on the concurrence explained above.

A. – The U.S. subsidiary of a European parent company (“US Person”):

• U.S. Subsidiary: it must exercise special control to avoid knowingly participating in any of these “transactions.” A group corporate exception may exist if the transaction is ordinarily incidental and part of administrative or auxiliary business operations—for example HR, payroll, or risk management.

If the transfer takes place for core business operations (such as research and development), the exemption does not apply. If the subsidiary falls under the obligation scenario, the following elements have applied since October 2025: a specific compliance program with defined security measures and an annual audit.

• European parent company: the same classification as in the following scenario of a company without headquarters or personnel in the United States.

B. – An EU company providing services to a U.S. client without presence or headquarters there (“Foreign Person”).

In that case, four scenarios may occur depending on whether the entity is considered a covered person (CP), from a restricted country, or neither of the above (any).

Recommendations

In most cases, the application of this rule will be limited to the scenario described at the beginning and in the last case of the previous table (“foreign person” scenario): a company without processing of covered data nor covered persons—either directly or through providers—that commits not to process them and to notify if anything changes.

However, specific checks should be carried out regarding providers and potential subsidiaries in the United States:

• Review whether any processors or sub-processors you rely on could fall within the scope: either because they are from these covered/prohibited countries or because, within the framework of the service, they end up providing access to this type of U.S. data. It is highly advisable to start including specific questions about this topic in the pre-Article 28(1) GDPR questionnaire; and

• Verify, together with possible specialized advice from the United States, that the company’s U.S. subsidiary is sufficiently prepared to comply with this rule. There are always nuances that escape those of us from the old continent.

Grand Finale: Why should I care about all this?

First.— Because there are many multinational groups (for example Chinese ones) that provide services through a subsidiary established in a country not included in the blacklist of this amusing U.S. rule. It is the same move that Meta, Google, or Microsoft make by placing their shiny European subsidiary in all their DPAs, generating that reassuring cognitive dissonance in the head of the not-very-reflective DPO.

Last but not least.— As a closing note, and in addition to everything above, always remember the illustrative example from those EDPB guidelines about the interplay of Article 3 and Chapter V: if a company based in the EU acts as a processor for a non-European company, imports personal data, and returns them as part of a product or service, there is an international transfer in that return flow of the data to the non-EU controller.

Everyone sees it positively.

The goal of protecting minors is indisputable and that catalyzes public opinion in favor of the measure.

You may be, like us, a soul concerned about second-order effects, even more so when those effects can shatter the right to privacy — the basis, as we know, of all other rights.

And as you already know, anyone is capable of saying “it’s for the children” in a second and it looks fucking great, while it takes you five good and hesitant minutes to explain those risks that even to you seem remote while you try hard to simplify them.

Further down we cover a devastating example of how the surveillance video camera system installed by a Government (the Iranian one) was key in its own destruction, once hacked by a hostile third party.

But we were thinking of a clean, interactive, clear tool, with little examples, links, and a certain tongue-in-cheek house style.

Well then, fear not: here is what you were looking for.

We put together this interactive artifact halfway with Claude.

Substack does not allow us to embed iframes so that you can poke around with it directly here, so we are inserting only a demo video and the link so that you can review it, criticize it, and share it as you please.

You are reading ZERO PARTY DATA. The newsletter on current affairs and technology law by Jorge García Herrero and Darío López Rincón.

In the free time this newsletter leaves us, we solve complicated messes related to personal data protection and artificial intelligence regulations. If you have one of those, wave your little hand at us like this. Or contact us by email at jgh(at)jorgegarciaherrero.com

Suscríbete ahora

🗞️News from the Data World 🌍

.- My top marks for this thing from Nicholas Thompson: Israel reportedly hacked Iran’s traffic cameras and had total vision into the movements of Ayatollah Khamenei and his guards

The central thesis here is that surveillance infrastructure has an inherent symmetrical vulnerability: whoever watches can end up being watched through their own system.

The plot twist is devastating: cameras deployed for internal control would have been reused by an adversary to monitor the very movements of Iranian power. The moral is not only one of state cybersecurity, but of political architecture: every massive network of visibility generates a surface reusable against its own operator. The deepest defeat is not one of security but of doctrine: a system conceived to control the population ended up assisting in the elimination of the sovereign who ordered it.

That is the tweet.

And this is so, regardless of the color of the beloved leader.

.- Another one from Nicholas from yesterday: Claude has become the fucking smart-ass student you do not want to have to grade.

.- Researchers trick a bot that prescribes meds. This case shows that clinical AI systems continue failing at the least acceptable point: operational safety. Mindgard managed to alter the behavior of Doctronic’s bot — used in a sandbox, thank God — inducing false recommendations about vaccines, methamphetamine, and OxyContin doses. Conversational “guardrails” do not guarantee robust clinical control: the attack did not need exotic techniques.

.- This text by Sam Bent puts in check the maximalist privacy marketing of Proton. Its thesis is that Proton’s “zero access” refers only to data at rest, not to all moments of the flow; moreover, payments, metadata, and other points still leave exposure surface. Following the Atlanta activist case, the matter is presented as a pattern, rather than as an anomaly. What caught my attention the most is his final note: Proton’s real product may not be technical invulnerability, but a carefully administered semantics about where exactly its promise ends.

Here we have used the Proton suite since almost day one and I have to admit that I do not aspire to invulnerability against requirements from judicial authorities, but rather against illegitimate third-party attackers. That said, one must always be attentive to those moments when trusted people prove not to keep their commitments, or to speak with a serpent’s tongue.

📖 Very strong data documents ☕️

.- Via Don Luis Montezuma: the Dutch authority published yesterday, just like that, some guidelines of only 11 pages on automated decisions in personnel hiring. Something nobody applies, you know. Note: the English translation is only so-so: when it says that the supervisor has to be “competent” and also “competent,” it refers, in the first case, to “competent” in the sense of having the necessary skills and in the second to competence (in the sense of capacity, power) to change the meaning of the automated proposal.

But what could I tell you about effective human oversight after this cracker…

.- Via Samuel Parra and Javier Sempere, we have two interesting AEPD decisions.

1.The 950,000 euros that have fallen on Yoti. One of the big names in age verification systems (the one behind the one used by EPIC/Fornite, and which they tried to get the FTC to greenlight for COPPA). In this type of system there was always a possible doubt about the effective applicability of Article 9, but here it is clear that there is a biometric template in what they themselves say. That is, there would be no human way to try to justify that it could not allow that purpose of unique identification under Article 9.

2.The curious NVIDIA case without a sanction: curious because a copy of saved games is requested, within the framework of a right of access. It may seem that NVIDIA only decides to manufacture graphics cards, but it has a cloud gaming service that works very well. We could talk about the inherent joint controllership between the catalog entity that you connect to its servers and NVIDIA, but that would require quite a bit more digital ink.

It escapes sanction for having complied a few days before the very statement of allegations. Even though it was several months beyond the general 30-day period from the March date on which the data subject requested it, the AEPD considers it settled because the right was ultimately satisfied.

If the right of access had expressly sought an explanation of how the anti-cheat system works, they would have tried to rely on Article 15.4 to deny it. Usual modus operandi, even though Article 15.4 does not allow denying the right entirely, and the EDPB gave a very similar example in its guidelines.

.- Interesting CNIL document on the development of AI systems in the health data environment This document explains how to articulate the system around health data, dealing with database reuse, prior formalities, and specific precautions. The CNIL insists that it is not enough to anonymize in an aspirational way: one has to determine the legal basis, repository governance, separation of purposes, and compatibility with the not inconsiderable sectoral regulatory obligations. It is relevant that the text is designed for DPOs and project managers, not only for lawyers. Authors: Aurore Gaignon, Hélène Guimiot, Charlotte Barot, Paul Valois, Félicien Vallet.

.- Comment by Peter Craddock on the French Council of State ruling that resolved the appeal against CNIL’s huge 20 million sanction on Criteo.

This matter interests me quite a lot because it has everything to do with Scania, and I have dedicated a post on lkd to it (with exchanges with Craddock and Mark Leister in comments) and the more measured post from last Tuesday.

.- This funny “in your face” kind of post by Al Zaretski cuts off at the root a very widespread error: confusing generic technical observability with the legal traceability required by the AI Regulation or AI Act. Alzaretski dismantles several myths about logging in high-risk systems and clarifies that uptime, API calls, or crash logs do not by themselves satisfy the mandate of Article 12. Provider and deployer have different obligations and retention does not cancel either minimization or GDPR storage limitation.

💀Death by Meme🤣

.- “Now that the Brent price is going down, we can be sure that the fuel price will also go down accordingly”

.- “The fuel price:”

🤖NoRobots.txt o Lo de la IA

.- A new curve is coming in the AI part of the Digital Omnibus. It seems that France, Spain, Germany, and Slovakia have played the blocking minority so that two specific prohibitions are inserted into the text: AI systems capable of generating non-consensual intimate images, videos, and similar content (NCII) and child sexual abuse material (CSAM).** Luca Bertuzzi**, keeps us all up to date (as always on what is cooking in Brussels)

.- NIST has released a report on problems in monitoring deployed AI. It is a compendium of what was done and said in two specific workshops, but it goes to the core of control problems.

Attendees stated that organizations may choose to avoid monitoring due to its cost, implying a need either for “making monitoring cheap enough to be practical, or [for] companies being willing to engage in more expensive monitoring.” Baker et al. [70] predict a future where monitoring will be more expensive for agents: “Model developers may be required to pay some cost, i.e., a monitorability tax, such as deploying slightly less performant models or suffering more expensive inference, in order to maintain the monitorability of… agents.” The increased “cost structure if a human in the loop [is] required” was pointed out by attendees

.- We have all heard that the next big thing in AI will be “world models.” What we did not see coming is that the first one to reach the commercial sphere was trained with aaaall those images captured in the streets by Pokémon Go players! It’s 2016 all over again!!

📃The paper of the week

.- Untangling AI Liability by Kenneth S. Abraham and Catherine M. Sharkey. This demystifying paper proposes a classic legal framework to regulate civil liability for damages caused by AI. It argues that many challenges of the “black box problem” can be resolved with classic principles. The real challenge is not technical, but jurisprudential: choosing between uniform or context-specific liability rules. Answering their own question, the authors defend a diverse approach, applying negligence, strict liability, or specific legislation depending on the context.

.- User Privacy and Large Language Models: An Analysis of Frontier Developers’ Privacy Policies **by Jennifer King, Kevin Klyman, Emily Capstick, Tiffany Saade, Victoria Hsieh: By default, the main AI providers train on your conversations unless you opt out: consumers and minors are less protected than enterprise clients. But the main moral is that the chat does not capture only inputs, but also reasoning, vulnerabilities, preferences, and latent identity signals. It is a “cognitive surplus extraction”: what is monetized is not scattered attention, but lines of thought sufficiently structured to be used as training infrastructure.

📎Useful tools

.- The megabot that we all mistakenly consider human, Jorge Morell, has tinkered in Claude with an AI Compliance checker, based on the toolkit that the ICO released in Excel. Judge for yourselves how useful it has become with Jorge’s improvements: tutorial with 4 pop-up windows, translated into Spanish, adjusted for the GDPR not UK and AI Regulation, and with the point that it saves the information if you have a Claude account

🙄 Da-Ta-dum bass

If you think this newsletter might appeal to and even be useful to someone, forward it to them.

Compartir

If you miss any doc, comment, or dumb thing that clearly should have been in this week’s Zero Party Data, write to us or leave a comment and we’ll consider it for the next one.

Deja un comentario