In May 2014, the Court of Justice of the European Union ruled on a case brought by a Spanish lawyer named Mario Costeja González. He had asked Google to remove links to a 1998 newspaper notice about a debt he had long since paid. Google refused. The court ruled in his favour — establishing that EU citizens have a right to request delisting of outdated, irrelevant personal information. Google was ordered to comply.
The ruling didn't erase the original newspaper article. It required Google's search index — an AI-driven ranking and retrieval system — to stop surfacing it as a prominent result for his name. The distinction matters: the right applied to the automated system processing the data, not the data's original publication.
The General Data Protection Regulation took effect on 25 May 2018 across all EU member states. It is not a voluntary industry standard or a set of recommendations. It is binding law with fines of up to €20 million or 4% of global annual revenue — whichever is higher. For Google, Apple, or Meta, that second figure runs into billions of euros.
GDPR applies to any organisation that processes the personal data of EU residents, regardless of where the organisation is headquartered. A company in California, Singapore, or São Paulo that collects data from someone in Berlin is subject to GDPR. This extraterritorial reach was new and deliberate.
The regulation defines personal data broadly: any information that can identify a living individual directly or indirectly. That includes names, IP addresses, location data, cookie identifiers, biometric data, and inferred characteristics — the kind of outputs AI profiling systems produce.
GDPR created a specific set of individual rights. These are not aspirational goals. They are enforceable entitlements that organisations must honour within defined time limits (generally 30 days).
Article 22 is the provision that most directly targets AI. It gives individuals the right not to be subject to a decision based solely on automated processing that produces legal or similarly significant effects. Loan approvals, job application screening, insurance pricing, parole risk scoring — if these are done by an algorithm with no human review, Article 22 may apply.
When automated decision-making is allowed (because you consented, or it is necessary for a contract, or it is permitted by law), the organisation must provide meaningful information about the logic involved, allow you to express your point of view, and ensure human review is available. A black-box algorithm that renders a verdict with no explanation is not compliant.
Ireland's Data Protection Commission fined Meta €1.2 billion in May 2023 under GDPR for transferring EU user data to US servers without adequate protection. It was the largest GDPR fine issued to that point. The case directly implicated the AI systems Meta uses for ad targeting and content ranking — those systems require the data transfers to function.
GDPR does not apply outside the EU/EEA by default. A US citizen using a US-based service has no GDPR rights. GDPR also has broad exemptions for national security, law enforcement, and journalistic purposes. And enforcement is patchy — complaints to Data Protection Authorities (DPAs) can take years to resolve.
Perhaps most importantly, GDPR says little about AI systems that infer new information about you from seemingly innocuous inputs. If a retailer infers your political views from your purchase history, that inference may not be "personal data about your political views" in the traditional sense — it is a derived output. Courts and regulators are still working out how the law applies to inference engines.
GDPR is the most comprehensive privacy law governing AI data practices in existence. It grants six enforceable rights, imposes real financial penalties, applies globally to EU residents' data, and specifically addresses automated decision-making through Article 22. Its limits — no coverage outside the EU, exemptions, slow enforcement — matter as much as its protections.
You will describe a scenario involving personal data or AI decision-making, and the AI tutor will help you identify which GDPR rights apply, what the organisation's obligations are, and what limits may prevent you from exercising those rights.
Complete at least 3 exchanges to finish this lab.
In February 2021, Facebook's parent company agreed to pay $650 million to settle a class action lawsuit under the Illinois Biometric Information Privacy Act (BIPA). The lawsuit — Patel v. Facebook — alleged that Facebook's face-recognition "Tag Suggestions" feature had collected biometric identifiers (facial geometry) from photos without obtaining written consent, as BIPA requires.
The settlement covered approximately 1.6 million Illinois users. Users in California, New York, or Texas who were affected by the same feature received nothing — because those states had no equivalent law. The same AI system. The same data collection. Different legal outcomes based entirely on geography.
Unlike GDPR's comprehensive framework, US federal privacy law is sectoral: different rules apply to different industries. The result is a collection of narrow statutes that often have gaps between them through which AI systems readily pass.
With no federal standard, states have legislated independently. The result is a growing patchwork that compliance teams at large companies now navigate state by state.
Multiple federal privacy bills have been introduced in Congress. The American Data Privacy and Protection Act (ADPPA) passed out of committee in 2022 with bipartisan support but stalled on the floor, partly due to disputes over whether it would preempt stronger state laws like CCPA. California's congressional delegation opposed federal preemption that would weaken Californians' existing protections.
Industry groups generally prefer federal law to a patchwork of 50 state laws — provided the federal standard is weaker than the strongest state laws. Civil liberties groups prefer maintaining stronger state laws. Neither side has built sufficient coalition to move legislation.
In practice, Americans' data rights depend heavily on which state they live in. An Illinois resident has stronger biometric protections than a Florida resident. A California resident can opt out of data sales; a resident of most other states cannot. AI systems process data from all 50 states simultaneously — the legal patchwork they navigate is entirely a product of legislative history, not any coherent theory of privacy rights.
Illinois BIPA creates a private right of action — individuals can sue without waiting for a regulator. Violations carry statutory damages of $1,000 per negligent violation or $5,000 per intentional or reckless violation. Because AI systems can collect biometric data at scale, individual violations aggregate quickly. In addition to Facebook, BIPA cases have been brought against Clearview AI (facial recognition database), various employers using fingerprint timeclocks, and retail stores using gait analysis and facial matching. The Illinois Supreme Court ruled in 2023 in Cothron v. White Castle that each individual biometric scan constitutes a separate violation — a ruling that dramatically increased potential liability for companies using biometric AI.
You will describe a data collection or AI decision scenario, and the tutor will help you identify which US statute — if any — applies, what rights it creates, and what gaps exist. Many scenarios will fall through the patchwork entirely.
Complete at least 3 exchanges to finish this lab.
In March 2019, the US Department of Housing and Urban Development filed a formal complaint against Facebook alleging that its ad-targeting algorithm violated the Fair Housing Act. HUD charged that Facebook's system allowed advertisers to exclude users from seeing housing ads based on race, religion, national origin, sex, familial status, and disability — demographic categories derived from user data and behavioural inference.
Facebook had already settled with the National Fair Housing Alliance and other civil rights groups in March 2019 for a separate but related case, agreeing to overhaul its ad-targeting system for housing, employment, and credit. In August 2019, Facebook settled with HUD, agreeing to build a new system that limited demographic targeting for those ad categories and created a searchable Ad Library for housing-related ads. The case was notable because the discrimination was not programmed intentionally — it emerged from the AI's optimisation logic.
Several decades-old laws written long before AI existed nonetheless apply to algorithmic decision-making. Regulators and courts are now actively applying them.
US civil rights law recognises two theories of discrimination. Disparate treatment requires proving intent — someone was deliberately treated worse because of a protected characteristic. Disparate impact does not require intent: if a neutral policy or practice has a disproportionately negative effect on a protected group, and there is no business necessity justification, it can be unlawful.
This matters enormously for AI. An algorithm trained on historical data will encode the patterns in that data. If historically Black applicants were denied loans at higher rates — even for illegitimate reasons — a model trained on those approvals will learn to reject similar-looking applicants. The algorithm wasn't told to discriminate; it learned to from the training data. Disparate impact doctrine says that does not matter: the effect counts.
In 2023, the Consumer Financial Protection Bureau issued guidance making clear that creditors using AI models to make lending decisions cannot cite "too complex to explain" as a reason for adverse action notices. If an AI denies credit, the applicant must receive a specific, accurate reason — not a generic one. This directly challenges black-box AI models that cannot generate human-readable explanations of individual decisions.
The Equal Employment Opportunity Commission released guidance stating that employers who use AI hiring tools from third-party vendors are not insulated from liability under Title VII. If the tool screens out disproportionate numbers of candidates based on a protected characteristic, the employer is liable — and may not be able to use "we just used the vendor's algorithm" as a defence. The vendor may also face liability.
Under ECOA and the FCRA, when a creditor takes adverse action based on a credit report or algorithmic score, the applicant must receive a notice listing the specific reasons. Historically, lenders used standardised reason codes. The CFPB's 2023 guidance updated this: AI-generated reasons must be accurate and specific to the individual, not generic. A notice that says "credit score too low" when the actual reason was an AI-detected pattern in purchase history is non-compliant.
This creates a direct tension between commercially deployed black-box AI models and US credit law. Several major lenders have faced CFPB investigations over the adequacy of AI-generated adverse action explanations. The requirement is creating pressure to use more interpretable models or to layer explainability systems on top of complex ones.
Algorithmic discrimination is still discrimination. Existing civil rights law does not have an "AI exception." Regulators at HUD, CFPB, EEOC, and FTC have all signalled active enforcement. The legal risk for organisations deploying AI in housing, credit, and employment without bias auditing and explainability is no longer theoretical.
You will describe a scenario involving an AI system that may be producing discriminatory outcomes, and the tutor will help you identify which civil rights statute applies, whether disparate impact or disparate treatment is the relevant theory, and what enforcement options might exist.
Complete at least 3 exchanges to finish this lab.
On 13 March 2024, the European Parliament voted 523 to 46 to adopt the EU Artificial Intelligence Act — the first binding comprehensive AI regulation in the world. It entered into force on 1 August 2024, with most provisions phasing in over two years. The Act's passage followed three years of negotiation, significant redrafting after generative AI systems like ChatGPT appeared mid-process, and intense lobbying from both technology companies and civil society organisations.
The Act uses a risk-based architecture: it assigns AI systems to risk categories and applies different requirements based on those categories. Some systems are banned outright. Others face heavy obligations. Most face light-touch rules. And a small class of systems face requirements tied specifically to transparency — the right to know you are interacting with an AI.
Article 5 of the AI Act prohibits "the placing on the market, putting into service or use" of AI systems that evaluate or classify people based on their social behaviour over a period of time, where that scoring leads to detrimental treatment in unrelated contexts. This is a direct legal response to China's social credit systems — but it also applies to private-sector scoring systems that aggregate behavioural data to assign trustworthiness ratings used in making decisions about housing, services, or employment.
The prohibition is comprehensive: it does not matter whether a European or non-European company developed the system, or whether the system operates online or offline. If it targets EU residents, the ban applies.
The AI Act prohibits real-time remote biometric identification (facial recognition) in publicly accessible spaces for law enforcement purposes, with three narrow exceptions: targeted search for a missing child, imminent threat of terrorist attack, or prosecution of serious crime where a court or independent authority has authorised it. Post-hoc (recorded) biometric identification for serious crime investigation is permitted with judicial authorisation.
This directly responds to the rapid expansion of facial recognition in policing. In the UK, the Metropolitan Police and South Wales Police have faced legal challenges over their use of live facial recognition. Under the AI Act, EU law enforcement agencies face strict conditions; commercial deployment for crowd surveillance is banned outright.
Violations involving prohibited systems: up to €35 million or 7% of global annual turnover. Violations involving high-risk AI requirements: up to €15 million or 3% of turnover. Providing incorrect information to regulators: up to €7.5 million or 1.5% of turnover. These exceed even GDPR penalties for the most serious categories.
The original EU AI Act drafts focused on specific-use AI systems. The rapid rise of large language models — ChatGPT, Gemini, Claude — created a new problem: foundation models that are not built for a specific risk-level use case but can be deployed in any context, including high-risk ones. After significant debate, the Act added rules for GPAI models:
All GPAI providers must publish technical documentation, comply with copyright law, provide a detailed summary of training data. GPAI models with systemic risk (defined by training compute threshold: over 10²⁵ FLOPs, currently reaching only the largest frontier models) face additional requirements: adversarial testing ("red-teaming"), incident reporting to the European Commission, and cybersecurity protections. This is the first time legislation has placed specific compliance burdens on the largest foundation model developers.
The Act's provisions phase in gradually: prohibited practices from February 2025; high-risk AI requirements for systems in Annex I from August 2026; full implementation by August 2027. As with GDPR, the extraterritorial reach is significant: any AI system used within the EU, regardless of where its developer or deployer is based, is subject to the Act. This is expected to create a "Brussels effect" similar to GDPR — where global companies build their systems to the highest (EU) standard rather than maintaining different versions for different jurisdictions.
The EU AI Act is the first law written specifically for AI rather than adapted from existing frameworks. Its risk-based architecture bans the most dangerous uses outright, imposes heavy obligations on consequential applications, and creates transparency requirements for consumer AI. Its global reach — through the Brussels effect and extraterritorial scope — means it will shape AI development far beyond Europe's borders.
You will describe an AI system and its use case, and the tutor will help you classify it under the EU AI Act's risk architecture: prohibited, high-risk, limited-risk, or minimal-risk. Then you'll work through what compliance looks like at that tier — or why the system cannot be deployed at all.
Complete at least 3 exchanges to finish this lab.