-
Co-designing for Compliance: Multi-party Computation Protocols for Post-Market Fairness Monitoring in Algorithmic Hiring
Authors:
Changyang He,
Nina Baranowska,
Josu Andoni Eguiluz Castaneira,
Guillem Escriba,
Matthias Juentgen,
Anna Via,
Frederik Zuiderveen Borgesius,
Asia Biega
Abstract:
Post-market fairness monitoring is now mandated to ensure fairness and accountability for high-risk employment AI systems under emerging regulations such as the EU AI Act. However, effective fairness monitoring often requires access to sensitive personal data, which is subject to strict legal protections under data protection law. Multi-party computation (MPC) offers a promising technical foundati…
▽ More
Post-market fairness monitoring is now mandated to ensure fairness and accountability for high-risk employment AI systems under emerging regulations such as the EU AI Act. However, effective fairness monitoring often requires access to sensitive personal data, which is subject to strict legal protections under data protection law. Multi-party computation (MPC) offers a promising technical foundation for compliant post-market fairness monitoring, enabling the secure computation of fairness metrics without revealing sensitive attributes. Despite growing technical interest, the operationalization of MPC-based fairness monitoring in real-world hiring contexts under concrete legal, industrial, and usability constraints remains unknown. This work addresses this gap through a co-design approach integrating technical, legal, and industrial expertise. We identify practical design requirements for MPC-based fairness monitoring, develop an end-to-end, legally compliant protocol spanning the full data lifecycle, and empirically validate it in a large-scale industrial setting. Our findings provide actionable design insights as well as legal and industrial implications for deploying MPC-based post-market fairness monitoring in algorithmic hiring systems.
△ Less
Submitted 7 May, 2026; v1 submitted 2 February, 2026;
originally announced February 2026.
-
Filtering for Copyright Enforcement in Europe after the Sabam cases
Authors:
Stefan Kulk,
Frederik Zuiderveen Borgesius
Abstract:
Sabam, a Belgian collective rights management organisation, wanted an internet access provider and a social network site to install a filter system to enforce copyrights. In two recent judgments, the Court of Justice of the European Union decided that the social network site and the internet access provider cannot be required to install the filter system that Sabam asked for. Are these judgments g…
▽ More
Sabam, a Belgian collective rights management organisation, wanted an internet access provider and a social network site to install a filter system to enforce copyrights. In two recent judgments, the Court of Justice of the European Union decided that the social network site and the internet access provider cannot be required to install the filter system that Sabam asked for. Are these judgments good news for fundamental rights? This article argues that little is won for privacy and freedom of information.
△ Less
Submitted 8 January, 2026;
originally announced January 2026.
-
Behavioral Targeting, a European Legal Perspective
Authors:
Frederik Zuiderveen Borgesius
Abstract:
Behavioral targeting, or online profiling, is a hotly debated topic. Much of the collection of personal information on the Internet is related to behavioral targeting, although research suggests that most people don't want to receive behaviorally targeted advertising. The World Wide Web Consortium is discussing a Do Not Track standard, and regulators worldwide are struggling to come up with answer…
▽ More
Behavioral targeting, or online profiling, is a hotly debated topic. Much of the collection of personal information on the Internet is related to behavioral targeting, although research suggests that most people don't want to receive behaviorally targeted advertising. The World Wide Web Consortium is discussing a Do Not Track standard, and regulators worldwide are struggling to come up with answers. This article discusses European law and recent policy developments on behavioral targeting.
△ Less
Submitted 23 December, 2025;
originally announced January 2026.
-
Segmentação Comportamental, Do Not Track e o desenvolvimento jurídico europeu e holandês
Authors:
Frederik Zuiderveen Borgesius
Abstract:
This paper discusses legal developments in Europe and the Netherlands. Recent decisions show that European data protection law, or privacy law, applies to behavioral targeting in most cases. Dutch law explicitly presumes that data protection law applies to behavioral targeting. This means that companies have to comply with data protection law's fair information principles. For example, companies m…
▽ More
This paper discusses legal developments in Europe and the Netherlands. Recent decisions show that European data protection law, or privacy law, applies to behavioral targeting in most cases. Dutch law explicitly presumes that data protection law applies to behavioral targeting. This means that companies have to comply with data protection law's fair information principles. For example, companies must refrain from secret or excessive data collection. Perhaps the principles could provide inspiration for future W3C projects. Could technology design foster fair information processing?
△ Less
Submitted 23 December, 2025;
originally announced January 2026.
-
Google Spain v. Gonzáles: Did the Court forget about freedom of expression?
Authors:
Stefan Kulk,
Frederik Zuiderveen Borgesius
Abstract:
When reviewing a job application letter, going on a first date, or considering doing business with someone, the first thing many people do is entering the person's name in a search engine. A search engine can point searchers to information that would otherwise have remained obscure. If somebody searched for the name of Spanish lawyer Mario Costeja González, Google showed search results that includ…
▽ More
When reviewing a job application letter, going on a first date, or considering doing business with someone, the first thing many people do is entering the person's name in a search engine. A search engine can point searchers to information that would otherwise have remained obscure. If somebody searched for the name of Spanish lawyer Mario Costeja González, Google showed search results that included a link to a 1998 newspaper announcement implying he had financial troubles at the time. González wanted Google to stop showing those links and started a procedure in Spain. After some legal wrangling, the Spanish Audiencia Nacional (National High Court) asked the Court of Justice of the European Union (CJEU) for advice on the application of the Data Protection Directive, which led to the controversial judgment in Google Spain. In its judgment, the CJEU holds that people, under certain conditions, have the right to have search results for their name delisted. This right can also extend to lawfully published information.
△ Less
Submitted 15 December, 2025;
originally announced December 2025.
-
Can the GPC standard eliminate consent banners in the EU?
Authors:
Sebastian Zimmeck,
Harshvardhan J. Pandit,
Frederik Zuiderveen Borgesius,
Cristiana Teixeira Santos,
Konrad Kollnig,
Robin Berjon
Abstract:
In the EU, the General Data Protection Regulation and the ePrivacy Directive mandate consent for the use of personal data for the purpose of behavioural advertising and tracking technologies. However, the ubiquity of consent banners has led to widespread consent fatigue and questions about the effectiveness of these mechanisms in protecting data subjects' data. To simplify digital laws and make th…
▽ More
In the EU, the General Data Protection Regulation and the ePrivacy Directive mandate consent for the use of personal data for the purpose of behavioural advertising and tracking technologies. However, the ubiquity of consent banners has led to widespread consent fatigue and questions about the effectiveness of these mechanisms in protecting data subjects' data. To simplify digital laws and make the EU more competitive, the EU Commission recently proposed the Digital Omnibus, introducing a new Article 88b GDPR to express data subjects' choices in a technical way. While the Digital Omnibus is under legislative negotiation, California residents and residents of other US states can already exercise their rights via Global Privacy Control (GPC), a privacy signal to automatically broadcast a legally binding opt-out request to websites. In light of the Digital Omnibus, we evaluate to which extent GPC can be adapted to the EU legal framework to reduce consent banners, mitigate consent fatigue, and improve data protection for EU users.
GPC is based on a technical specification, currently being standardised at the World Wide Web Consortium. By sending a GPC signal, data subjects can express their refusal or withdrawal of consent under the GDPR to the use of their personal data for cross-context ad targeting and, in some cases, to express their objection under the GDPR against the use of their data for such purposes. Our evaluation identifies friction between the GPC specification and current EU data protection law. In the longer term, it would be possible for the EU legislator to amend EU laws, as proposed in the current Digital Omnibus, in such a way that internet users can use automated signals to express choices about personal data use and online tracking. In the shorter term, websites and companies who conduct online tracking can already honour GPC.
△ Less
Submitted 6 May, 2026; v1 submitted 9 December, 2025;
originally announced December 2025.
-
De mythe van geïnformeerde toestemming: online privacybescherming kan beter [Informed Consent: We Can Do Better to Defend Privacy]
Authors:
Frederik Zuiderveen Borgesius
Abstract:
We need to rethink our approach to defend privacy on the internet. Currently, policymakers focus heavily on the idea of informed consent as a means to defend privacy. For instance, in many countries the law requires firms to obtain an individual's consent before they use data about her; with such informed consent requirements, the law aims to empower people to make privacy choices in their best in…
▽ More
We need to rethink our approach to defend privacy on the internet. Currently, policymakers focus heavily on the idea of informed consent as a means to defend privacy. For instance, in many countries the law requires firms to obtain an individual's consent before they use data about her; with such informed consent requirements, the law aims to empower people to make privacy choices in their best interests. But behavioural studies cast doubt on this approach's effectiveness, as people tend to click OK to almost any request they see on their screens. To improve privacy protection, this article argues for a combined approach of protecting and empowering the individual. This article discusses practical problems with informed consent as a means to protect privacy, and illustrates the problems with current data privacy rules regarding behavioural targeting. First, the privacy problems of behavioural targeting, and the central role of informed consent in privacy law are discussed. Following that, practical problems with informed consent are highlighted. Then, the article argues that policymakers should give more attention to rules that protect, rather than empower, people.
△ Less
Submitted 5 December, 2025;
originally announced December 2025.
-
Informed Consent: We Can Do Better to Defend Privacy
Authors:
Frederik Zuiderveen Borgesius
Abstract:
We need to rethink our approach to defend privacy on the internet. Currently, policymakers focus heavily on the idea of informed consent as a means to defend privacy. For instance, in many countries the law requires firms to obtain an individual's consent before they use data about her; with such informed consent requirements, the law aims to empower people to make privacy choices in their best in…
▽ More
We need to rethink our approach to defend privacy on the internet. Currently, policymakers focus heavily on the idea of informed consent as a means to defend privacy. For instance, in many countries the law requires firms to obtain an individual's consent before they use data about her; with such informed consent requirements, the law aims to empower people to make privacy choices in their best interests. But behavioural studies cast doubt on this approach's effectiveness, as people tend to click OK to almost any request they see on their screens. To improve privacy protection, this article argues for a combined approach of protecting and empowering the individual. This article discusses practical problems with informed consent as a means to protect privacy, and illustrates the problems with current data privacy rules regarding behavioural targeting. First, the privacy problems of behavioural targeting, and the central role of informed consent in privacy law are discussed. Following that, practical problems with informed consent are highlighted. Then, the article argues that policymakers should give more attention to rules that protect, rather than empower, people.
△ Less
Submitted 5 December, 2025;
originally announced December 2025.
-
Open Data, Privacy, and Fair Information Principles: Towards a Balancing Framework
Authors:
Frederik Zuiderveen Borgesius,
Jonathan Gray,
Mireille van Eechoud
Abstract:
Open data are held to contribute to a wide variety of social and political goals, including strengthening transparency, public participation and democratic accountability, promoting economic growth and innovation, and enabling greater public sector efficiency and cost savings. However, releasing government data that contain personal information may threaten privacy and related rights and interests…
▽ More
Open data are held to contribute to a wide variety of social and political goals, including strengthening transparency, public participation and democratic accountability, promoting economic growth and innovation, and enabling greater public sector efficiency and cost savings. However, releasing government data that contain personal information may threaten privacy and related rights and interests. In this Article we ask how these privacy interests can be respected, without unduly hampering benefits from disclosing public sector information. We propose a balancing framework to help public authorities address this question in different contexts. The framework takes into account different levels of privacy risks for different types of data. It also separates decisions about access and re-use, and highlights a range of different disclosure routes. A circumstance catalogue lists factors that might be considered when assessing whether, under which conditions, and how a dataset can be released. While open data remains an important route for the publication of government information, we conclude that it is not the only route, and there must be clear and robust public interest arguments in order to justify the disclosure of personal information as open data.
△ Less
Submitted 5 December, 2025;
originally announced December 2025.
-
Personal Data Processing for Behavioural Targeting: Which Legal Basis?
Authors:
Frederik Zuiderveen Borgesius
Abstract:
The European Union Charter of Fundamental Rights only allows personal data processing if a data controller has a legal basis for the processing. This paper argues that in most circumstances the only available legal basis for the processing of personal data for behavioural targeting is the data subject's unambiguous consent. Furthermore, the paper argues that the cookie consent requirement from the…
▽ More
The European Union Charter of Fundamental Rights only allows personal data processing if a data controller has a legal basis for the processing. This paper argues that in most circumstances the only available legal basis for the processing of personal data for behavioural targeting is the data subject's unambiguous consent. Furthermore, the paper argues that the cookie consent requirement from the ePrivacy Directive does not provide a legal basis for the processing of personal data. Therefore: even if companies could use an opt-out system to comply with the e-Privacy Directive's consent requirement for using a tracking cookie, they would generally have to obtain the data subject's unambiguous consent if they process personal data for behavioural targeting.
△ Less
Submitted 25 November, 2025;
originally announced November 2025.
-
Scoping Electronic Communication Privacy Rules: Data, Services and Values
Authors:
Joris van Hoboken,
Frederik Zuiderveen Borgesius
Abstract:
We use electronic communication networks for more than simply traditional telecommunications: we access the news, buy goods online, file our taxes, contribute to public debate, and more. As a result, a wider array of privacy interests is implicated for users of electronic communications networks and services. This development calls into question the scope of electronic communications privacy rules…
▽ More
We use electronic communication networks for more than simply traditional telecommunications: we access the news, buy goods online, file our taxes, contribute to public debate, and more. As a result, a wider array of privacy interests is implicated for users of electronic communications networks and services. This development calls into question the scope of electronic communications privacy rules. This paper analyses the scope of these rules, taking into account the rationale and the historic background of the European electronic communications privacy framework. We develop a framework for analysing the scope of electronic communications privacy rules using three approaches: (i) a service-centric approach, (ii) a data-centric approach, and (iii) a value-centric approach. We discuss the strengths and weaknesses of each approach. The current e-Privacy Directive contains a complex blend of the three approaches, which does not seem to be based on a thorough analysis of their strengths and weaknesses. The upcoming review of the directive announced by the European Commission provides an opportunity to improve the scoping of the rules.
△ Less
Submitted 25 November, 2025;
originally announced November 2025.
-
Behavioural Sciences and the Regulation of Privacy on the Internet
Authors:
Frederik Zuiderveen Borgesius
Abstract:
This chapter examines the policy implications of behavioural sciences insights for the regulation of privacy on the Internet, by focusing in particular on behavioural targeting. This marketing technique involves tracking people's online behaviour to use the collected information to show people individually targeted advertisements. Enforcing data protection law may not be enough to protect privacy…
▽ More
This chapter examines the policy implications of behavioural sciences insights for the regulation of privacy on the Internet, by focusing in particular on behavioural targeting. This marketing technique involves tracking people's online behaviour to use the collected information to show people individually targeted advertisements. Enforcing data protection law may not be enough to protect privacy in this area. I argue that, if society is better off when certain behavioural targeting practices do not happen, policymakers should consider banning them.
△ Less
Submitted 25 November, 2025;
originally announced November 2025.
-
Freedom of expression and 'right to be forgotten' cases in the Netherlands after Google Spain
Authors:
Stefan Kulk,
Frederik Zuiderveen Borgesius
Abstract:
Since the Google Spain judgment of the Court of Justice of the European Union, Europeans have, under certain conditions, the right to have search results for their name delisted. This paper examines how the Google Spain judgment has been applied in the Netherlands. Since the Google Spain judgment, Dutch courts have decided on two cases regarding delisting requests. In both cases, the Dutch courts…
▽ More
Since the Google Spain judgment of the Court of Justice of the European Union, Europeans have, under certain conditions, the right to have search results for their name delisted. This paper examines how the Google Spain judgment has been applied in the Netherlands. Since the Google Spain judgment, Dutch courts have decided on two cases regarding delisting requests. In both cases, the Dutch courts considered freedom of expression aspects of delisting more thoroughly than the Court of Justice. However, the effect of the Google Spain judgment on freedom of expression is difficult to assess, as search engine operators decide about most delisting requests without disclosing much about their decisions.
△ Less
Submitted 17 November, 2025;
originally announced November 2025.
-
Access to Personal Data and the Right to Good Governance during Asylum Procedures after the CJEU's YS. and M. and S. judgment
Authors:
Evelien Brouwer,
Frederik Zuiderveen Borgesius
Abstract:
In the YS. and M. and S. judgment, the Court of Justice of the European Union ruled on three procedures in which Dutch judges asked for clarification on the right of asylum seekers to have access to the documents regarding the decision on asylum applications. The judgment is relevant for interpreting the concept of personal data and the scope of the right of access under the Data Protection Direct…
▽ More
In the YS. and M. and S. judgment, the Court of Justice of the European Union ruled on three procedures in which Dutch judges asked for clarification on the right of asylum seekers to have access to the documents regarding the decision on asylum applications. The judgment is relevant for interpreting the concept of personal data and the scope of the right of access under the Data Protection Directive, and the right to good administration in the EU Charter of Fundamental Rights. At first glance, the judgment seems disappointing from the viewpoint of individual rights. Nevertheless, in our view the judgment provides sufficient grounds for effective access rights to the minutes in future asylum cases.
△ Less
Submitted 17 November, 2025;
originally announced November 2025.
-
New Data Security Requirements and the Proceduralization of Mass Surveillance Law after the European Data Retention Case
Authors:
Frederik Zuiderveen Borgesius,
Axel Arnbak
Abstract:
This paper discusses the regulation of mass metadata surveillance in Europe through the lens of the landmark judgment in which the Court of Justice of the European Union struck down the Data Retention Directive. The controversial directive obliged telecom and Internet access providers in Europe to retain metadata of all their customers for intelligence and law enforcement purposes, for a period of…
▽ More
This paper discusses the regulation of mass metadata surveillance in Europe through the lens of the landmark judgment in which the Court of Justice of the European Union struck down the Data Retention Directive. The controversial directive obliged telecom and Internet access providers in Europe to retain metadata of all their customers for intelligence and law enforcement purposes, for a period of up to two years. In the ruling, the Court declared the directive in violation of the human rights to privacy and data protection. The Court also confirmed that the mere collection of metadata interferes with the human right to privacy. In addition, the Court developed three new criteria for assessing the level of data security required from a human rights perspective: security measures should take into account the risk of unlawful access to data, and the data's quantity and sensitivity. While organizations that campaigned against the directive have welcomed the ruling, we warn for the risk of proceduralization of mass surveillance law. The Court did not fully condemn mass surveillance that relies on metadata, but left open the possibility of mass surveillance if policymakers lay down sufficient procedural safeguards. Such proceduralization brings systematic risks for human rights. Government agencies, with ample resources, can design complicated systems of procedural oversight for mass surveillance - and claim that mass surveillance is lawful, even if it affects millions of innocent people.
△ Less
Submitted 17 November, 2025;
originally announced November 2025.
-
Het 'right to be forgotten' en bijzondere persoonsgegevens: geen ruimte meer voor een belangenafweging? [The 'Right to Be Forgotten' and Sensitive Personal Data: No Room for Balancing?]
Authors:
Frederik Zuiderveen Borgesius
Abstract:
An attorney submitted a 'right to be forgotten' delisting request to Google, regarding a blog post about a criminal conviction of the attorney in another country. The Rotterdam District Court ruled that Google may no longer link to the blog post when people search for the attorney's name. The court granted the attorney's request because the blog post concerns a criminal conviction. Personal data r…
▽ More
An attorney submitted a 'right to be forgotten' delisting request to Google, regarding a blog post about a criminal conviction of the attorney in another country. The Rotterdam District Court ruled that Google may no longer link to the blog post when people search for the attorney's name. The court granted the attorney's request because the blog post concerns a criminal conviction. Personal data regarding criminal convictions are, under Dutch law, special categories of data (sometimes called sensitive data). The reasoning of the court on special categories of data creates problems for freedom of expression. This paper, in Dutch, explores how these problems can be reduced. Google has appealed the decision; the judgment of the Court of Appeals is expected in March 2017.
△ Less
Submitted 10 November, 2025;
originally announced November 2025.
-
An assessment of the Commission's Proposal on Privacy and Electronic Communications
Authors:
Frederik Zuiderveen Borgesius,
Joris van Hoboken,
Ronan Fahy,
Kristina Irion,
Max Rozendaal
Abstract:
This study, commissioned by the European Parliament's Policy Department for Citizens Rights and Constitutional Affairs at the request of the LIBE Committee, appraises the European Commission's proposal for an ePrivacy Regulation. The study assesses whether the proposal would ensure that the right to the protection of personal data, the right to respect for private life and communications, and rela…
▽ More
This study, commissioned by the European Parliament's Policy Department for Citizens Rights and Constitutional Affairs at the request of the LIBE Committee, appraises the European Commission's proposal for an ePrivacy Regulation. The study assesses whether the proposal would ensure that the right to the protection of personal data, the right to respect for private life and communications, and related rights enjoy a high standard of protection. The study also highlights the proposal's potential benefits and drawbacks more generally.
△ Less
Submitted 3 November, 2025;
originally announced November 2025.
-
Breyer case of the Court of Justice of the European Union: IP addresses and the personal data definition
Authors:
Frederik Zuiderveen Borgesius
Abstract:
The Breyer case of the Court of Justice of the European Union (CJEU) primarily concerns the question whether a website visitor's dynamic IP address constitutes personal data for a website publisher, when another party (an internet access provider) can tie a name to that IP address. In essence, the Court finds that an IP address constitutes personal data for the website publisher, if that publisher…
▽ More
The Breyer case of the Court of Justice of the European Union (CJEU) primarily concerns the question whether a website visitor's dynamic IP address constitutes personal data for a website publisher, when another party (an internet access provider) can tie a name to that IP address. In essence, the Court finds that an IP address constitutes personal data for the website publisher, if that publisher has the legal means to obtain, from the visitor's internet access provider, additional information that enables the publisher to identify that visitor. In this case note, I summarise the facts and the judgment, and add a few comments.
△ Less
Submitted 3 November, 2025;
originally announced November 2025.
-
Tackling the Algorithmic Control Crisis -- the Technical, Legal, and Ethical Challenges of Research into Algorithmic Agents
Authors:
B. Bodo,
N. Helberger,
K. Irion,
F. Zuiderveen Borgesius,
J. Moller,
B. Van der Velde,
N. Bol,
B. van Es,
C. de Vreese
Abstract:
Algorithmic agents permeate every instant of our online existence. Based on our digital profiles built from the massive surveillance of our digital existence, algorithmic agents rank search results, filter our emails, hide and show news items on social networks feeds, try to guess what products we might buy next for ourselves and for others, what movies we want to watch, and when we might be pregn…
▽ More
Algorithmic agents permeate every instant of our online existence. Based on our digital profiles built from the massive surveillance of our digital existence, algorithmic agents rank search results, filter our emails, hide and show news items on social networks feeds, try to guess what products we might buy next for ourselves and for others, what movies we want to watch, and when we might be pregnant. Algorithmic agents select, filter, and recommend products, information, and people. Increasingly, algorithmic agents don't just select from the range of human created alternatives, but also they create. Burgeoning algorithmic agents are capable of providing us with content made just for us, and engage with us through one-of-a-kind, personalized interactions. Studying these algorithmic agents presents a host of methodological, ethical, and logistical challenges. The objectives of our paper are two-fold. The first aim is to describe one possible approach to researching the individual and societal effects of algorithmic recommenders, and to share our experiences with the academic community. The second is to contribute to a more fundamental discussion about the ethical and legal issues of "tracking the trackers", as well as the costs and trade-offs involved. Our paper will contribute to the discussion on the relative merits, costs and benefits of different approaches to ethically and legally sound research on algorithmic governance. We will argue that besides shedding light on how users interact with algorithmic agents, we also need to be able to understand how different methods of monitoring our algorithmically controlled digital environments compare to each other in terms of costs and benefits. We conclude our article with a number of concrete suggestions for how to address the practical, ethical and legal challenges of researching algorithms and their effects on users and society.
△ Less
Submitted 29 October, 2025;
originally announced October 2025.
-
Discrimination, intelligence artificielle et decisions algorithmiques
Authors:
Frederik Zuiderveen Borgesius
Abstract:
Artificial intelligence (AI) has a huge impact on our personal lives and also on our democratic society as a whole. While AI offers vast opportunities for the benefit of people, its potential to embed and perpetuate bias and discrimination remains one of the most pressing challenges deriving from its increasing use. This new study, which was prepared by Prof. Frederik Zuiderveen Borgesius for the…
▽ More
Artificial intelligence (AI) has a huge impact on our personal lives and also on our democratic society as a whole. While AI offers vast opportunities for the benefit of people, its potential to embed and perpetuate bias and discrimination remains one of the most pressing challenges deriving from its increasing use. This new study, which was prepared by Prof. Frederik Zuiderveen Borgesius for the Anti-discrimination Department of the Council of Europe, elaborates on the risks of discrimination caused by algorithmic decision-making and other types of artificial intelligence (AI).
△ Less
Submitted 20 October, 2025;
originally announced October 2025.
-
Mensen aanwijzen maar niet bij naam noemen: behavioural targeting, persoonsgegevens, en de nieuwe Privacyverordening
Authors:
Frederik Zuiderveen Borgesius
Abstract:
Information about millions of people is collected for behavioural targeting, a type of marketing that involves tracking people's online behaviour for targeted advertising. It is hotly debated whether data protection law applies to behavioural targeting. Many behavioural targeting companies say that, as long as they do not tie names to data they hold about individuals, they do not process any perso…
▽ More
Information about millions of people is collected for behavioural targeting, a type of marketing that involves tracking people's online behaviour for targeted advertising. It is hotly debated whether data protection law applies to behavioural targeting. Many behavioural targeting companies say that, as long as they do not tie names to data they hold about individuals, they do not process any personal data, and that, therefore, data protection law does not apply to them. European Data Protection Authorities, however, take the view that a company processes personal data if it uses data to single out a person, even if it cannot tie a name to these data. This paper argues that data protection law should indeed apply to behavioural targeting. Companies can often tie a name to nameless data about individuals. Furthermore, behavioural targeting relies on collecting information about individuals, singling out individuals, and targeting ads to individuals. Many privacy risks remain, regardless of whether companies tie a name to the information they hold about a person. A name is merely one of the identifiers that can be tied to data about a person, and it is not even the most practical identifier for behavioural targeting. Seeing data used to single out a person as personal data fits the rationale for data protection law: protecting fairness and privacy.
△ Less
Submitted 20 October, 2025;
originally announced October 2025.
-
Privacy, freedom of expression, and the right to be forgotten in Europe
Authors:
Stefan Kulk,
Frederik Zuiderveen Borgesius
Abstract:
In this chapter we discuss the relation between privacy and freedom of expression in Europe. In principle, the two rights have equal weight in Europe - which right prevails depends on the circumstances of a case. We use the Google Spain judgment of the Court of Justice of the European Union, sometimes called the 'right to be forgotten' judgment, to illustrate the difficulties when balancing the tw…
▽ More
In this chapter we discuss the relation between privacy and freedom of expression in Europe. In principle, the two rights have equal weight in Europe - which right prevails depends on the circumstances of a case. We use the Google Spain judgment of the Court of Justice of the European Union, sometimes called the 'right to be forgotten' judgment, to illustrate the difficulties when balancing the two rights. The court decided in Google Spain that people have, under certain conditions, the right to have search results for their name delisted. We discuss how Google and Data Protection Authorities deal with such delisting requests in practice. Delisting requests illustrate that balancing privacy and freedom of expression interests will always remain difficult.
△ Less
Submitted 15 October, 2025;
originally announced October 2025.
-
The Perfect Match? A Closer Look at the Relationship between EU Consumer Law and Data Protection Law
Authors:
Natali Helberger,
Frederik Zuiderveen Borgesius,
Agustin Reyna
Abstract:
In modern markets, many companies offer so-called 'free' services and monetize consumer data they collect through those services. This paper argues that consumer law and data protection law can usefully complement each other. Data protection law can also inform the interpretation of consumer law. Using consumer rights, consumers should be able to challenge excessive collection of their personal da…
▽ More
In modern markets, many companies offer so-called 'free' services and monetize consumer data they collect through those services. This paper argues that consumer law and data protection law can usefully complement each other. Data protection law can also inform the interpretation of consumer law. Using consumer rights, consumers should be able to challenge excessive collection of their personal data. Consumer organizations have used consumer law to tackle data protection infringements. The interplay of data protection law and consumer protection law provides exciting opportunities for a more integrated vision on 'data consumer law'.
△ Less
Submitted 15 October, 2025;
originally announced October 2025.
-
Discrimination, artificial intelligence, and algorithmic decision-making
Authors:
Frederik Zuiderveen Borgesius
Abstract:
Artificial intelligence (AI) has a huge impact on our personal lives and also on our democratic society as a whole. While AI offers vast opportunities for the benefit of people, its potential to embed and perpetuate bias and discrimination remains one of the most pressing challenges deriving from its increasing use. This new study, which was prepared by Prof. Frederik Zuiderveen Borgesius for the…
▽ More
Artificial intelligence (AI) has a huge impact on our personal lives and also on our democratic society as a whole. While AI offers vast opportunities for the benefit of people, its potential to embed and perpetuate bias and discrimination remains one of the most pressing challenges deriving from its increasing use. This new study, which was prepared by Prof. Frederik Zuiderveen Borgesius for the Anti-discrimination Department of the Council of Europe, elaborates on the risks of discrimination caused by algorithmic decision-making and other types of artificial intelligence (AI).
△ Less
Submitted 15 October, 2025;
originally announced October 2025.
-
The European Union general data protection regulation: what it is and what it means
Authors:
Chris Jay Hoofnagle,
Bart van der Sloot,
Frederik Zuiderveen Borgesius
Abstract:
This paper introduces the strategic approach to regulating personal data and the normative foundations of the European Union's General Data Protection Regulation ('GDPR'). We explain the genesis of the GDPR, which is best understood as an extension and refinement of existing requirements imposed by the 1995 Data Protection Directive; describe the GDPR's approach and provisions; and make prediction…
▽ More
This paper introduces the strategic approach to regulating personal data and the normative foundations of the European Union's General Data Protection Regulation ('GDPR'). We explain the genesis of the GDPR, which is best understood as an extension and refinement of existing requirements imposed by the 1995 Data Protection Directive; describe the GDPR's approach and provisions; and make predictions about the GDPR's implications. We also highlight where the GDPR takes a different approach than U.S. privacy law. The GDPR is the most consequential regulatory development in information policy in a generation. The GDPR brings personal data into a detailed regulatory regime, that will influence personal data usage worldwide. Understood properly, the GDPR encourages firms to develop information governance frameworks, to in-house data use, and to keep humans in the loop in decision making. Companies with direct relationships with consumers have strategic advantages under the GDPR, compared to third party advertising firms on the internet. To reach these objectives, the GDPR uses big sticks, structural elements that make proving violations easier, but only a few carrots. The GDPR will complicate and restrain some information-intensive business models. But the GDPR will also enable approaches previously impossible under less-protective approaches.
△ Less
Submitted 3 October, 2025;
originally announced October 2025.
-
Price discrimination, algorithmic decision-making, and European non-discrimination law
Authors:
Frederik Zuiderveen Borgesius
Abstract:
Our society can benefit immensely from algorithmic decision-making and similar types of artificial intelligence. But algorithmic decision-making can also have discriminatory effects. This paper examines that problem, using online price differentiation as an example of algorithmic decision-making. With online price differentiation, a company charges different people different prices for identical p…
▽ More
Our society can benefit immensely from algorithmic decision-making and similar types of artificial intelligence. But algorithmic decision-making can also have discriminatory effects. This paper examines that problem, using online price differentiation as an example of algorithmic decision-making. With online price differentiation, a company charges different people different prices for identical products, based on information the company has about those people. The main question in this paper is: to what extent can non-discrimination law protect people against online price differentiation? The paper shows that online price differentiation and algorithmic decision-making could lead to indirect discrimination, for instance harming people with a certain ethnicity. Indirect discrimination occurs when a practice is neutral at first glance, but ends up discriminating against people with a protected characteristic, such as ethnicity. In principle, non-discrimination law prohibits indirect discrimination. The paper also shows, however, that non-discrimination law has flaws when applied to algorithmic decision-making. For instance, algorithmic discrimination can remain hidden: people may not realise that they are being discriminated against. And many types of unfair - some might say discriminatory - algorithmic decisions are outside the scope of current non-discrimination law.
△ Less
Submitted 28 September, 2025;
originally announced September 2025.
-
Opinions can be Incorrect! In our Opinion. On the accuracy principle in data protection law
Authors:
Dara Hallinan,
Frederik Zuiderveen Borgesius
Abstract:
The GDPR contains an accuracy principle, as most data privacy laws in the world do. In principle, data controllers must ensure that personal data they use are accurate. Some have argued that the accuracy principle does not apply to personal data in the form of opinions about data subjects. We argue, however, from a positive law perspective, that the accuracy principle does apply to opinions. We fu…
▽ More
The GDPR contains an accuracy principle, as most data privacy laws in the world do. In principle, data controllers must ensure that personal data they use are accurate. Some have argued that the accuracy principle does not apply to personal data in the form of opinions about data subjects. We argue, however, from a positive law perspective, that the accuracy principle does apply to opinions. We further argue, from a normative perspective, that the accuracy principle should apply to opinions.
△ Less
Submitted 28 September, 2025;
originally announced September 2025.
-
Digital welfare fraud detection and the Dutch SyRI judgment
Authors:
Marvin van Bekkum,
Frederik Zuiderveen Borgesius
Abstract:
In 2020, a Dutch court passed judgment in a case about a digital welfare fraud detection system called Systeem Risico Indicatie (SyRI). The court ruled that the SyRI legislation is unlawful because it does not comply with the right to privacy under the European Convention of Human Rights. In this article we analyse the judgment and its implications. This ruling is one of first in which a court has…
▽ More
In 2020, a Dutch court passed judgment in a case about a digital welfare fraud detection system called Systeem Risico Indicatie (SyRI). The court ruled that the SyRI legislation is unlawful because it does not comply with the right to privacy under the European Convention of Human Rights. In this article we analyse the judgment and its implications. This ruling is one of first in which a court has invalidated a welfare fraud detection system for breaching the right to privacy. We show that the immediate effects of the judgment are limited. The judgment does not say much about automated fraud detection systems in general, because it is limited to the circumstances of the case. Still, the judgment is important. The judgment reminds policymakers that fraud detection must happen in a way that respects data protection principles and the right to privacy. The judgment also confirms the importance of transparency if personal data are used.
△ Less
Submitted 28 September, 2025;
originally announced September 2025.
-
Personalised Pricing: The Demise of the Fixed Price?
Authors:
Joost Poort,
Frederik Zuiderveen Borgesius
Abstract:
An online seller or platform is technically able to offer every consumer a different price for the same product, based on information it has about the customers. Such online price discrimination exacerbates concerns regarding the fairness and morality of price discrimination, and the possible need for regulation. In this chapter, we discuss the underlying basis of price discrimination in economic…
▽ More
An online seller or platform is technically able to offer every consumer a different price for the same product, based on information it has about the customers. Such online price discrimination exacerbates concerns regarding the fairness and morality of price discrimination, and the possible need for regulation. In this chapter, we discuss the underlying basis of price discrimination in economic theory, and its popular perception. Our surveys show that consumers are critical and suspicious of online price discrimination. A majority consider it unacceptable and unfair, and are in favour of a ban. When stores apply online price discrimination, most consumers think they should be informed about it. We argue that the General Data Protection Regulation (GDPR) applies to the most controversial forms of online price discrimination, and not only requires companies to disclose their use of price discrimination, but also requires companies to ask customers for their prior consent. Industry practice, however, does not show any adoption of these two principles.
△ Less
Submitted 21 September, 2025;
originally announced September 2025.
-
Microtargeted propaganda by foreign actors: An interdisciplinary exploration
Authors:
Ronan Ó Fathaigh,
Tom Dobber,
Frederik Zuiderveen Borgesius,
James Shires
Abstract:
This article discusses a problem that has received scant attention in literature: microtargeted propaganda by foreign actors. Microtargeting involves collecting information about people, and using that information to show them targeted political advertisements. Such microtargeting enables advertisers to target ads to specific groups of people, for instance people who visit certain websites, forums…
▽ More
This article discusses a problem that has received scant attention in literature: microtargeted propaganda by foreign actors. Microtargeting involves collecting information about people, and using that information to show them targeted political advertisements. Such microtargeting enables advertisers to target ads to specific groups of people, for instance people who visit certain websites, forums, or Facebook groups. This article focuses on one type of microtargeting: microtargeting by foreign actors. For example, Russia has targeted certain groups in the US with ads, aiming to sow discord. Foreign actors could also try to influence European elections, for instance by advertising in favour of a certain political party. Foreign propaganda possibilities existed before microtargeting. This article explores two questions. In what ways, if any, is microtargeted propaganda by foreign actors different from other foreign propaganda? What could lawmakers in Europe do to mitigate the risks of microtargeted propaganda?
△ Less
Submitted 21 September, 2025;
originally announced September 2025.
-
Dark and Bright Patterns in Cookie Consent Requests
Authors:
Paul Graßl,
Hanna Schraffenberger,
Frederik Zuiderveen Borgesius,
Moniek Buijzen
Abstract:
Dark patterns are (evil) design nudges that steer people's behaviour through persuasive interface design. Increasingly found in cookie consent requests, they possibly undermine principles of EU privacy law. In two preregistered online experiments we investigated the effects of three common design nudges (default, aesthetic manipulation, obstruction) on users' consent decisions and their perception…
▽ More
Dark patterns are (evil) design nudges that steer people's behaviour through persuasive interface design. Increasingly found in cookie consent requests, they possibly undermine principles of EU privacy law. In two preregistered online experiments we investigated the effects of three common design nudges (default, aesthetic manipulation, obstruction) on users' consent decisions and their perception of control over their personal data in these situations. In the first experiment (N = 228) we explored the effects of design nudges towards the privacy-unfriendly option (dark patterns). The experiment revealed that most participants agreed to all consent requests regardless of dark design nudges. Unexpectedly, despite generally low levels of perceived control, obstructing the privacy-friendly option led to more rather than less perceived control. In the second experiment (N = 255) we reversed the direction of the design nudges towards the privacy-friendly option, which we title "bright patterns". This time the obstruction and default nudges swayed people effectively towards the privacy-friendly option, while the result regarding perceived control stayed the same compared to Experiment 1. Overall, our findings suggest that many current implementations of cookie consent requests do not enable meaningful choices by internet users, and are thus not in line with the intention of the EU policymakers. We also explore how policymakers could address the problem.
△ Less
Submitted 21 September, 2025;
originally announced September 2025.
-
Adtech and Real-Time Bidding under European Data Protection Law
Authors:
Michael Veale,
Frederik Zuiderveen Borgesius
Abstract:
This article discusses the troubled relationship between contemporary advertising technology (adtech) systems, in particular systems of real-time bidding (RTB, also known as programmatic advertising) underpinning much behavioral targeting on the web and through mobile applications. This article analyzes the extent to which practices of RTB are compatible with the requirements regarding a legal bas…
▽ More
This article discusses the troubled relationship between contemporary advertising technology (adtech) systems, in particular systems of real-time bidding (RTB, also known as programmatic advertising) underpinning much behavioral targeting on the web and through mobile applications. This article analyzes the extent to which practices of RTB are compatible with the requirements regarding a legal basis for processing, transparency, and security in European data protection law. We first introduce the technologies at play through explaining and analyzing the systems deployed online today. Following that, we turn to the law. Rather than analyze RTB against every provision of the General Data Protection Regulation (GDPR), we consider RTB in the context of the GDPR's requirement of a legal basis for processing and the GDPR's transparency and security requirements. We show, first, that the GDPR requires prior consent of the internet user for RTB, as other legal bases are not appropriate. Second, we show that it is difficult - and perhaps impossible - for website publishers and RTB companies to meet the GDPR's transparency requirements. Third, RTB incentivizes insecure data processing. We conclude that, in concept and in practice, RTB is structurally difficult to reconcile with European data protection law. Therefore, intervention by regulators is necessary.
△ Less
Submitted 1 September, 2025;
originally announced September 2025.
-
Protected Grounds and the System of Non-Discrimination Law in the Context of Algorithmic Decision-Making and Artificial Intelligence
Authors:
Janneke Gerards,
Frederik Zuiderveen Borgesius
Abstract:
Algorithmic decision-making and similar types of artificial intelligence (AI) may lead to improvements in all sectors of society, but can also have discriminatory effects. While current non-discrimination law offers people some protection, algorithmic decision-making presents the law with several challenges. For instance, algorithms can generate new categories of people based on seemingly innocuou…
▽ More
Algorithmic decision-making and similar types of artificial intelligence (AI) may lead to improvements in all sectors of society, but can also have discriminatory effects. While current non-discrimination law offers people some protection, algorithmic decision-making presents the law with several challenges. For instance, algorithms can generate new categories of people based on seemingly innocuous characteristics, such as web browser preference or apartment number, or more complicated categories combining many data points. Such new types of differentiation could evade non-discrimination law, as browser type and house number are not protected characteristics, but such differentiation could still be unfair, for instance if it reinforces social inequality.
This paper explores which system of non-discrimination law can best be applied to algorithmic decision-making, considering that algorithms can differentiate on the basis of characteristics that do not correlate with protected grounds of discrimination such as ethnicity or gender. The paper analyses the current loopholes in the protection offered by non-discrimination law and explores the best way for lawmakers to approach algorithmic differentiation. While we focus on Europe, the conceptual and theoretical focus of the paper can make it useful for scholars and policymakers from other regions too, as they encounter similar problems with algorithmic decision-making.
△ Less
Submitted 1 September, 2025;
originally announced September 2025.
-
De spanning tussen het non-discriminatierecht en het gegevensbeschermingsrecht: heeft de AVG een nieuwe uitzondering nodig om discriminatie door kunstmatige intelligentie tegen te gaan?
Authors:
Marvin van Bekkum,
Frederik Zuiderveen Borgesius
Abstract:
Organisations can use artificial intelligence to make decisions about people for a variety of reasons, for instance, to select the best candidates from many job applications. However, AI systems can have discriminatory effects when used for decision-making. To illustrate, an AI system could reject applications of people with a certain ethnicity, while the organisation did not plan such ethnicity d…
▽ More
Organisations can use artificial intelligence to make decisions about people for a variety of reasons, for instance, to select the best candidates from many job applications. However, AI systems can have discriminatory effects when used for decision-making. To illustrate, an AI system could reject applications of people with a certain ethnicity, while the organisation did not plan such ethnicity discrimination. But in Europe, an organisation runs into a problem when it wants to assess whether its AI system accidentally discriminates based on ethnicity: the organisation may not know the applicants' ethnicity. In principle, the GDPR bans the use of certain 'special categories of data' (sometimes called 'sensitive data'), which include data on ethnicity, religion, and sexual preference. The proposal for an AI Act of the European Commission includes a provision that would enable organisations to use special categories of data for auditing their AI systems. This paper asks whether the GDPR's rules on special categories of personal data hinder the prevention of AI-driven discrimination. We argue that the GDPR does prohibit such use of special category data in many circumstances. We also map out the arguments for and against creating an exception to the GDPR's ban on using special categories of personal data, to enable preventing discrimination by AI systems. The paper discusses European law, but the paper can be relevant outside Europe too, as many policymakers in the world grapple with the tension between privacy and non-discrimination policy.
△ Less
Submitted 1 September, 2025;
originally announced September 2025.
-
The EU Digital Services Act: what does it mean for online advertising and adtech?
Authors:
Pieter Wolters,
Frederik Zuiderveen Borgesius
Abstract:
What does the Digital Services Act (DSA) mean for online advertising? We describe and analyse the DSA rules that are most relevant for online advertising and adtech (advertising technology). We also highlight to what extent the DSA's advertising rules add something to the rules in the General Data Protection Regulation (GDPR) and the ePrivacy Directive. The DSA introduces several specific requirem…
▽ More
What does the Digital Services Act (DSA) mean for online advertising? We describe and analyse the DSA rules that are most relevant for online advertising and adtech (advertising technology). We also highlight to what extent the DSA's advertising rules add something to the rules in the General Data Protection Regulation (GDPR) and the ePrivacy Directive. The DSA introduces several specific requirements for online advertising. First, the DSA imposes transparency requirements in relation to advertisements. Second, very large online platforms (VLOPs) should develop a publicly available repository with information about the ads they presented. Third, the DSA bans profiling-based advertising (behavioural advertising) if it uses sensitive data or if it targets children. Besides these specific provisions, the general rules of the DSA on illegal content also apply to advertising. Advertisements are a form of information, and thus subject to the general DSA rules. Moreover, we conclude that the DSA applies to some types of ad tech companies. For example, ad networks, companies that connect advertisers to publishers of apps and websites, should be considered platforms. Some ad networks may even qualify as VLOPs. Hence, ad networks must comply with the more general obligations in the DSA. The application of these general rules to advertisements and ad networks can have far-reaching effects that have been underexplored and deserve further research. We also show that certain aspects of the DSA are still unclear. For instance, we encourage the European Commission or regulators to clarify the concepts of 'online platform' and 'recipients' in the context of ad networks and other adtech companies.
△ Less
Submitted 24 February, 2025;
originally announced March 2025.
-
Discrimination and AI in insurance: what do people find fair? Results from a survey
Authors:
Frederik Zuiderveen Borgesius,
Marvin van Bekkum,
Iris van Ooijen,
Gabi Schaap,
Maaike Harbers,
Tjerk Timan
Abstract:
Two modern trends in insurance are data-intensive underwriting and behavior-based insurance. Data-intensive underwriting means that insurers analyze more data for estimating the claim cost of a consumer and for determining the premium based on that estimation. Insurers also offer behavior-based insurance. For example, some car insurers use artificial intelligence (AI) to follow the driving behavio…
▽ More
Two modern trends in insurance are data-intensive underwriting and behavior-based insurance. Data-intensive underwriting means that insurers analyze more data for estimating the claim cost of a consumer and for determining the premium based on that estimation. Insurers also offer behavior-based insurance. For example, some car insurers use artificial intelligence (AI) to follow the driving behavior of an individual consumer in real-time and decide whether to offer that consumer a discount. In this paper, we report on a survey of the Dutch population (N=999) in which we asked people's opinions about examples of data-intensive underwriting and behavior-based insurance. The main results include: (i) If survey respondents find an insurance practice unfair, they also find the practice unacceptable. (ii) Respondents find almost all modern insurance practices that we described unfair. (iii) Respondents find practices for which they can influence the premium fairer. (iv) If respondents find a certain consumer characteristic illogical for basing the premium on, then respondents find using the characteristic unfair. (v) Respondents find it unfair if an insurer offers an insurance product only to a specific group. (vi) Respondents find it unfair if an insurance practice leads to the poor paying more. We also reflect on the policy implications of the findings.
△ Less
Submitted 22 August, 2025; v1 submitted 22 January, 2025;
originally announced January 2025.
-
Automated decision-making and artificial intelligence at European borders and their risks for human rights
Authors:
Yiran Yang,
Frederik Zuiderveen Borgesius,
Pascal Beckers,
Evelien Brouwer
Abstract:
Many countries use automated decision-making (ADM) systems, often based on artificial intelligence (AI), to manage migration at their borders. This interdisciplinary paper explores two questions. What are the main ways that automated decision-making is used at EU borders? Does such automated decision-making bring risks related to human rights, and if so: which risks? The paper introduces a taxonom…
▽ More
Many countries use automated decision-making (ADM) systems, often based on artificial intelligence (AI), to manage migration at their borders. This interdisciplinary paper explores two questions. What are the main ways that automated decision-making is used at EU borders? Does such automated decision-making bring risks related to human rights, and if so: which risks? The paper introduces a taxonomy of four types of ADM systems at EU borders. Three types are used at borders: systems for (1) identification and verification by checking biometrics, (2) risk assessment, and (3) border monitoring. In addition, (4) polygraphs and emotion detectors are being tested at EU borders. We discuss three categories of risks of such automated decision-making, namely risks related to the human rights to (1) privacy and data protection, (2) nondiscrimination, and (3) a fair trial and effective remedies. The paper is largely based on a literature review that we conducted about the use of automated decision-making at borders. The paper combines insights from several disciplines, including social sciences, law, computer science, and migration studies.
△ Less
Submitted 8 October, 2024;
originally announced October 2024.
-
The GDPR's Rules on Data Breaches: Analysing Their Rationales and Effects
Authors:
Frederik Zuiderveen Borgesius,
Hadi Asghari,
Noël Bangma,
Jaap-Henk Hoepman
Abstract:
The General Data Protection Regulation (GDPR) requires an organisation that suffers a data breach to notify the competent Data Protection Authority. The organisation must also inform the relevant individuals, when a data breach threatens their rights and freedoms. This paper focuses on the following question: given the goals of the GDPR's data breach notification obligation, and we assess the obli…
▽ More
The General Data Protection Regulation (GDPR) requires an organisation that suffers a data breach to notify the competent Data Protection Authority. The organisation must also inform the relevant individuals, when a data breach threatens their rights and freedoms. This paper focuses on the following question: given the goals of the GDPR's data breach notification obligation, and we assess the obligation in the light of those goals. We refer to insights from information security and economics, and present them in a reader-friendly way for lawyers. Our main conclusion is that the GDPR's data breach rules are likely to contribute to the goals. For instance, the data breach notification obligation can nudge organisations towards better security; such an obligation enables regulators to perform their duties; and such an obligation improves transparency and accountability. However, the paper also warns that we should not have unrealistic expectations of the possibilities for people to protect their interests after a data breach notice. Likewise, we should not have high expectations of people switching to other service providers after receiving a data breach notification. Lastly, the paper calls for Data Protection Authorities to publish more information about reported data breaches. Such information can help to analyse security threats.
△ Less
Submitted 8 October, 2024;
originally announced October 2024.
-
Digital Discrimination in Dating Apps and the Dutch Breeze case
Authors:
Tim de Jonge,
Frederik Zuiderveen Borgesius
Abstract:
In 2023, the Netherlands Institute for Human Rights, the Dutch non-discrimination authority, decided that Breeze, a Dutch dating app, was justified in suspecting that their algorithm discriminated against dark-skinned users. Consequently, the Institute decided that Breeze must prevent this discrimination based on ethnicity. This paper analyses the decision and explores three questions.What are the…
▽ More
In 2023, the Netherlands Institute for Human Rights, the Dutch non-discrimination authority, decided that Breeze, a Dutch dating app, was justified in suspecting that their algorithm discriminated against dark-skinned users. Consequently, the Institute decided that Breeze must prevent this discrimination based on ethnicity. This paper analyses the decision and explores three questions.What are the main points of the Breeze decision? Is the discrimination based on ethnicity in Breeze's matching algorithm illegal? We also explore a more general question: how can dating apps mitigate or stop discrimination in their matching algorithms? We illustrate the legal and technical difficulties dating apps face in tackling discrimination and highlight some promising solutions. We analyse the Breeze decision in-depth, combining insights from computer science and law. We discuss the implications of this judgment for scholarship and practice in the field of fair and non-discriminatory machine learning.
△ Less
Submitted 16 September, 2025; v1 submitted 24 September, 2024;
originally announced September 2024.
-
Non-discrimination law in Europe: a primer for non-lawyers
Authors:
Frederik Zuiderveen Borgesius,
Nina Baranowska,
Philipp Hacker,
Alessandro Fabris
Abstract:
This brief paper provides an introduction to non-discrimination law in Europe. It answers the questions: What are the key characteristics of non-discrimination law in Europe, and how do the different statutes relate to one another? Our main target group is computer scientists and users of artificial intelligence (AI) interested in an introduction to non-discrimination law in Europe. Notably, non-d…
▽ More
This brief paper provides an introduction to non-discrimination law in Europe. It answers the questions: What are the key characteristics of non-discrimination law in Europe, and how do the different statutes relate to one another? Our main target group is computer scientists and users of artificial intelligence (AI) interested in an introduction to non-discrimination law in Europe. Notably, non-discrimination law in Europe differs significantly from non-discrimination law in other countries, such as the US. We aim to describe the law in such a way that non-lawyers and non-European lawyers can easily grasp its contents and challenges. The paper shows that the human right to non-discrimination, to some extent, protects individuals against private actors, such as companies. We introduce the EU-wide non-discrimination rules which are included in a number of EU directives, and also explain the difference between direct and indirect discrimination. Significantly, an organization can be fined for indirect discrimination even if the company, or its AI system, discriminated by accident. The last section broadens the horizon to include bias-relevant law and cases from the GDPR, the EU AI Act, and related statutes. Finally, we give reading tips for those inclined to learn more about non-discrimination law in Europe.
△ Less
Submitted 17 April, 2024; v1 submitted 12 April, 2024;
originally announced April 2024.
-
AI, insurance, discrimination and unfair differentiation. An overview and research agenda
Authors:
Marvin S. L. van Bekkum,
Frederik Zuiderveen Borgesius,
Tom Heskes
Abstract:
Insurers underwrite risks: they calculate risks and decide on the insurance price. Insurers seem captivated by two trends enabled by Artificial Intelligence (AI). First, insurers could use AI for analysing more and new types of data to assess risks more precisely: data-intensive underwriting. Second, insurers could use AI to monitor the behaviour of individual consumers in real-time: behaviour-bas…
▽ More
Insurers underwrite risks: they calculate risks and decide on the insurance price. Insurers seem captivated by two trends enabled by Artificial Intelligence (AI). First, insurers could use AI for analysing more and new types of data to assess risks more precisely: data-intensive underwriting. Second, insurers could use AI to monitor the behaviour of individual consumers in real-time: behaviour-based insurance. For example, some car insurers offer a discount if the consumer agrees to being tracked by the insurer and drives safely. While the two trends bring many advantages, they may also have discriminatory effects on society. This paper focuses on the following question. Which effects related to discrimination and unfair differentiation may occur if insurers use data-intensive underwriting and behaviour-based insurance?
△ Less
Submitted 12 March, 2025; v1 submitted 22 January, 2024;
originally announced January 2024.
-
Fairness and Bias in Algorithmic Hiring: a Multidisciplinary Survey
Authors:
Alessandro Fabris,
Nina Baranowska,
Matthew J. Dennis,
David Graus,
Philipp Hacker,
Jorge Saldivar,
Frederik Zuiderveen Borgesius,
Asia J. Biega
Abstract:
Employers are adopting algorithmic hiring technology throughout the recruitment pipeline. Algorithmic fairness is especially applicable in this domain due to its high stakes and structural inequalities. Unfortunately, most work in this space provides partial treatment, often constrained by two competing narratives, optimistically focused on replacing biased recruiter decisions or pessimistically p…
▽ More
Employers are adopting algorithmic hiring technology throughout the recruitment pipeline. Algorithmic fairness is especially applicable in this domain due to its high stakes and structural inequalities. Unfortunately, most work in this space provides partial treatment, often constrained by two competing narratives, optimistically focused on replacing biased recruiter decisions or pessimistically pointing to the automation of discrimination. Whether, and more importantly what types of, algorithmic hiring can be less biased and more beneficial to society than low-tech alternatives currently remains unanswered, to the detriment of trustworthiness. This multidisciplinary survey caters to practitioners and researchers with a balanced and integrated coverage of systems, biases, measures, mitigation strategies, datasets, and legal aspects of algorithmic hiring and fairness. Our work supports a contextualized understanding and governance of this technology by highlighting current opportunities and limitations, providing recommendations for future work to ensure shared benefits for all stakeholders.
△ Less
Submitted 27 June, 2025; v1 submitted 25 September, 2023;
originally announced September 2023.
-
Targeted and Troublesome: Tracking and Advertising on Children's Websites
Authors:
Zahra Moti,
Asuman Senol,
Hamid Bostani,
Frederik Zuiderveen Borgesius,
Veelasha Moonsamy,
Arunesh Mathur,
Gunes Acar
Abstract:
On the modern web, trackers and advertisers frequently construct and monetize users' detailed behavioral profiles without consent. Despite various studies on web tracking mechanisms and advertisements, there has been no rigorous study focusing on websites targeted at children. To address this gap, we present a measurement of tracking and (targeted) advertising on websites directed at children. Mot…
▽ More
On the modern web, trackers and advertisers frequently construct and monetize users' detailed behavioral profiles without consent. Despite various studies on web tracking mechanisms and advertisements, there has been no rigorous study focusing on websites targeted at children. To address this gap, we present a measurement of tracking and (targeted) advertising on websites directed at children. Motivated by lacking a comprehensive list of child-directed (i.e., targeted at children) websites, we first build a multilingual classifier based on web page titles and descriptions. Applying this classifier to over two million pages, we compile a list of two thousand child-directed websites. Crawling these sites from five vantage points, we measure the prevalence of trackers, fingerprinting scripts, and advertisements. Our crawler detects ads displayed on child-directed websites and determines if ad targeting is enabled by scraping ad disclosure pages whenever available. Our results show that around 90% of child-directed websites embed one or more trackers, and about 27% contain targeted advertisements--a practice that should require verifiable parental consent. Next, we identify improper ads on child-directed websites by developing an ML pipeline that processes both images and text extracted from ads. The pipeline allows us to run semantic similarity queries for arbitrary search terms, revealing ads that promote services related to dating, weight loss, and mental health; as well as ads for sex toys and flirting chat services. Some of these ads feature repulsive and sexually explicit imagery. In summary, our findings indicate a trend of non-compliance with privacy regulations and troubling ad safety practices among many advertisers and child-directed websites. To protect children and create a safer online environment, regulators and stakeholders must adopt and enforce more stringent measures.
△ Less
Submitted 10 December, 2023; v1 submitted 9 August, 2023;
originally announced August 2023.
-
Using sensitive data to prevent discrimination by artificial intelligence: Does the GDPR need a new exception?
Authors:
Marvin van Bekkum,
Frederik Zuiderveen Borgesius
Abstract:
Organisations can use artificial intelligence to make decisions about people for a variety of reasons, for instance, to select the best candidates from many job applications. However, AI systems can have discriminatory effects when used for decision-making. To illustrate, an AI system could reject applications of people with a certain ethnicity, while the organisation did not plan such ethnicity d…
▽ More
Organisations can use artificial intelligence to make decisions about people for a variety of reasons, for instance, to select the best candidates from many job applications. However, AI systems can have discriminatory effects when used for decision-making. To illustrate, an AI system could reject applications of people with a certain ethnicity, while the organisation did not plan such ethnicity discrimination. But in Europe, an organisation runs into a problem when it wants to assess whether its AI system accidentally discriminates based on ethnicity: the organisation may not know the applicants' ethnicity. In principle, the GDPR bans the use of certain 'special categories of data' (sometimes called 'sensitive data'), which include data on ethnicity, religion, and sexual preference. The proposal for an AI Act of the European Commission includes a provision that would enable organisations to use special categories of data for auditing their AI systems. This paper asks whether the GDPR's rules on special categories of personal data hinder the prevention of AI-driven discrimination. We argue that the GDPR does prohibit such use of special category data in many circumstances. We also map out the arguments for and against creating an exception to the GDPR's ban on using special categories of personal data, to enable preventing discrimination by AI systems. The paper discusses European law, but the paper can be relevant outside Europe too, as many policymakers in the world grapple with the tension between privacy and non-discrimination policy.
△ Less
Submitted 28 November, 2022; v1 submitted 17 May, 2022;
originally announced June 2022.
-
Demystifying the Draft EU Artificial Intelligence Act
Authors:
Michael Veale,
Frederik Zuiderveen Borgesius
Abstract:
In April 2021, the European Commission proposed a Regulation on Artificial Intelligence, known as the AI Act. We present an overview of the Act and analyse its implications, drawing on scholarship ranging from the study of contemporary AI practices to the structure of EU product safety regimes over the last four decades. Aspects of the AI Act, such as different rules for different risk-levels of A…
▽ More
In April 2021, the European Commission proposed a Regulation on Artificial Intelligence, known as the AI Act. We present an overview of the Act and analyse its implications, drawing on scholarship ranging from the study of contemporary AI practices to the structure of EU product safety regimes over the last four decades. Aspects of the AI Act, such as different rules for different risk-levels of AI, make sense. But we also find that some provisions of the Draft AI Act have surprising legal implications, whilst others may be largely ineffective at achieving their stated goals. Several overarching aspects, including the enforcement regime and the risks of maximum harmonisation pre-empting legitimate national AI policy, engender significant concern. These issues should be addressed as a priority in the legislative process.
△ Less
Submitted 13 June, 2022; v1 submitted 8 July, 2021;
originally announced July 2021.