Quick Tech Takes • Privacy Legislation & Tech's AI Data Race

Corporate Counsel at Google, Kat Mauler, joins Niki for a D.C. insider take on the latest tech headlines. They talk AI’s insatiable appetite for data and the landmark bipartisan data privacy bill making waves this week. Added bonus, zombie attacks in the Terms & Conditions and the sad trombone sounds of Amazon’s “Just Walk Out” tech. 

“You always want tech to move ahead of regulators. If tech moved at the speed of government, we would be much less competitive.” - Kat Mauler

• Follow Kat on LinkedIn 
• Read The Verge article on AI and copyright laws 
• Learn more about the American Data Privacy bill in the WaPo 

• Learn More at www.techedup.com
• Check out video on YouTube
• Follow Niki on LinkedIn

Transcript

Copy

[music plays]

Niki: I'm Niki Christoff and welcome to Tech'ed Up. Today in the studio I'm joined by Kat Mauler. She's a Washington lawyer, a friend, and former colleague who's worked at Uber and is currently at Google. 

We're breaking down the latest headlines and, this week, that's privacy and AI. 

Kat, welcome to the studio this morning.

Thank you for having me. How are you doing? 

Kat: Good. So far, so good. 

Niki: So far, so good. [both chuckling] 

We've made it to the early morning hours. So, today we're talking about a couple of headlines. The first one is very exciting in our industry, even though it's a long time coming: privacy. There's a bill finally moving on Capitol Hill.

Kat: It's really exciting to see a national progress towards a larger national privacy bill.  There's been sort of a patchwork of state laws, but that becomes really difficult and tricky to enforce, to comply with, to follow, and to have those principles carried forth. So, seeing the national law making progress is really exciting.

Niki: Well, and as Washingtonians, we're used to things taking a long time. So, I don't know if you recall the infrastructure week was coming for, like, many years, so it's kind of the same with privacy.  Ever since Europe passed GDPR, which is their comprehensive bill. We've been, I mean, lobbyists from the tech industry, as well as privacy advocates and consumer advocates, have been clamoring for a federal bill, like you said, so that everybody's got the same laws. Every citizen is covered the same. 

But what's happened instead is well, y’know, the gears of government have kind of ground to a halt here in Washington until now, which again, we're going to talk about what's on the table. People are just subject to whatever their states are doing. And so if you're an internet company, obviously it's very difficult to comply with 50 different state laws.

Kat: Yeah, I think that's right, especially because data doesn't always follow the jurisdictional borders of state lines. GDPR is, I think, six years on now? So we have a lot of information about how that's been received, implementation, obviously, and then, sort of, GDPR style laws in numerous other regions.

So you can see how that's been adopted and accepted and it really has, sort of, set a standard as, in terms of what principles apply. In this new national law, a lot of those same principles are still carried through loking for consumer privacy rights. Data minimization, which is a really consistent principle, both across privacy and cybersecurity.

Niki: And just so people know, that's like, the company's taking the least amount of data they need. 

Kat: That's right. The idea of privacy by design. So, instead of having there be lots of regulations or rules that apply to what data there is, although there are also those, there's the desire to just collect as little as possible so that you wind up having most of that not be a problem in the first place.

And this, this law also includes preemption, which would be great. In fact, it's an expanded version of preemption from what we've seen before in the national, proposals. 

Niki: So, what that means for people who aren't lawyers, [Kat: laughs] I know, you're like an actual lawyer and I'm a reformed lawyer.

So, preemption: meaning the federal law would take precedence over any state laws. 

Kat: That's right. I thought that Infrastructure Week was a very special kind of nerd, [both chuckle] but I guess now that I'm hearing myself, Privacy Week might also be a very special kind of nerd. [both chuckle]  

No, the preemption is important because the idea is that it will contain specific guidance as to how the federal law replaces any state laws or works together with existing state laws so that there's clear guidance for all the companies trying to operate in the space.

Niki: And just to go back, which maybe we should have started with this, but what was announced just this week is the American Privacy Rights Act. 

It's led by Kathy McMorris Rogers, who's a Republican out of Washington. She's actually, this is important, I think, retiring. So, she's not running for re-election, which means she's trying to get some things done before she goes.

The other person who's really pushing this forward is Senator Maria Cantwell, Democrat, also of Washington. So, it's bipartisan. They've been working on this along with a number of other, I would say, kind of moderate common sense folks in Congress to get something done because it's bad for business, but it's also bad for consumers not to have a bill, but…

What do you think the likelihood is that this passes in this election year?

Kat: It's tricky because, this is an election year not just in the U. S. but, globally. I think like 49 percent of all individuals globally will have an opportunity to vote this year. So it's interesting to watch to see what things are going to become political footballs. 

I'm wondering whether this is something that's getting kicked in to be discussed in this year when many folks want their legacy upon retirement to include privacy legislation or want to touch AI as a legislative or regulatory matter.

I hope that this becomes a  sexy discussion point that has real legs. We'll see how that goes. 

Niki: This is so funny! Yes, for lawyers who work in tech, just to go back to GDPR, a former colleague of mine at Salesforce who was really involved in the law had like a cocktail party when GDPR was passed!  

[both laughing]

Niki: Which was so, I was like, “Wow, this is just nerding out big time!”

[both laughing]

Niki: Okay, sorry, I didn't mean to interrupt you, [chuckling] but you're hoping privacy laws become sexy this year. 

[both laughing]

Kat: We need like a takedown theme for the cocktail party, [laughing] but it's interesting because you can see some of the; When you, when you look at Republicans and Democrats responding to this proposal on the Hill - it doesn't always match up with where the states land.

You can see some of the states that have privacy legislation or that don't: California, Texas, Virginia, Florida. Many of the states have existing laws that operate in ways that the corresponding parties don't necessarily agree with on the Hill. So, you can see some of the, sort of, laboratories of democracy working through the way that this will get treated on the state level. Nationally though, it may be that there's some departure from party or that there's a different set of principles at play. 

Niki: So, what's an example of that? Like Republicans? 

Kat: So, a good example is, for example in, in Florida a lot of the, a lot of the rule turns around whether algorithms consider political party in application and trys to exempt, for example, smaller businesses.

On the Hill, I think we'll see the same desire to have carve-outs for small businesses. This new proposal does include that. It also includes, for example, a carve-out for non-profits that are specifically dealing with fraud. We'll have to watch to see which lawmakers fall to which side but it'll be really interesting to see how this becomes, potentially, an election year issue or doesn't. 

Niki: Right. And, and speaking of how the parties are dealing with this in general.  It's almost strange bedfellows across the tech industry right now when you're getting folks who care, like, Republicans used to be very pro-business, very pro-innovation, that included Silicon Valley. Now they are deeply skeptical of the politics internally at these companies and have a lot of thoughts on the partisanship. And then on the Dem side, there's a huge desire to sort of pull back on data collection. 

This is going to get us to our next topic - to pull back on that and put consumers first. And also, it's an election year and consumers are really frustrated about their privacy and don't feel in control. 

That said, we were talking about the European law, I mean, I just click straight through all those boxes. Who knows? I mean, it's, I'm not going to say, “No, don't collect my information” if I really want to get to the website.

So, is it even, does it have teeth? 

Kat: I think that's right. I mean, I don't, I'm not sure that all people that are clicking through are reading all of those disclosures. 

Niki:  No people who are clicking through are reading! Right.

[both laugh] 

Niki: It's a null set.

[both laugh] 

Kat: I love people who read them. There's one Terms of Service that I saw one time that included, like, zombie attacks? [Niki: laughs] 

And it's just in, I think, it might be, it might be AWS, but there's a Terms of Service that includes provisions around zombie attacks. I wonder if that's still there. [chuckling] 

Niki: Just to see if anyone read it. 

Kat: Just to see - what if there's a zombie attack? 

[both laugh]

Niki: So, right, everybody just clicks through it. I think the other, y’know, issue is a bill that was rushed through was the California law, which it's very hard to undo a law once it's passed in California. And it had unintended consequences. It was sort of sloppily drafted. 

I'll give an example. In California, you can request your data and you do it by household. Well, if you're in a domestic violence situation, that means your partner can request your data, [Kat: mm-hmm] which is something they just didn't think about because they were pushing it through. So, this stuff is really complicated. 

I'm sort of excited, like you, that it's finally moving. And I do think since it's on voter’s minds, we might see something get done, but you just never know.

Kat: I think that's right. But California also passed another law to sort of address some of those issues. At the federal level, it's much harder to make those kinds of adjustments or changes. So, it may be a good thing that it's moved slowly so that it can be sort of done right once it's done, but it'll be exciting to see there be something that's helpful, clear, and inclusive.

Niki: Right. Measure twice, cut once. 

Kat: That's right. 

Niki: All right. So, we'll see what happens to the American Privacy Rights Act. 

The next topic is, I just want to make it clear, I'm not talking on behalf of Google on this, but Google was mentioned in a headline this week around these large language models. So, ChatGPT, for example, all the artificial intelligence tools that consumers are using, they've got to keep up scraping and finding data. There's only so much data on the Internet. 

And so do you want to talk about that for a minute? What's happening? 

Kat: I think that this is another example of where there's, there will be some evolution along the copyright lines when it comes to AI use. And similar to the privacy  experience in the EU, the AI Act already includes some language around copyright and how, and how, that applies or how it doesn't  

In the U.S. right now, it looks like it will be much more of a common law approach where there's, there's already a few cases that are, that are moving, including an Open AI  lawsuit, but, but I think it will look much more towards fair use and whether there's been sufficient transformation, um.

So it'll be interesting to kind of watch which approach bears more fruit both in terms of reasonable legal principles, but also in terms of where companies have clear direction in terms of what they're allowed to do or disallowed from doing.

Niki: Right. So, what we're reading about is OpenAI has allegedly created some sort of scraping model that is transcribing YouTube videos. And the issue is that the copyright protections of those videos are not owned by Google, which owns YouTube, they're owned by the creators, and so, Google can make sure there's no copyright violations within their own walled garden but how do they keep a third party from doing this? 

And it looks like Open AI is just saying, “We're gonna scrape this data and this content because we need to feed the beast of ChatGPT-4 or whatever, and then we'll take our chances in court with copyright.” And maybe that's because potentially the individuals would have to sue? 

And so, I know from when I was working at Google, if you even use snippets of copyrighted music, that it just almost automatically takes down the video. But what do you do when it's an external party scraping? And it's not just Open AI to YouTube. It's also people are trying to get works of fiction and nonfiction. They're just trying to feed more and more and more data into these models so that they're useful. 

Kat: I think that Google is taking a proactive approach. I'm definitely not speaking on Google's behalf, but I think it will be really interesting to watch how companies approach this.

There will be in the same way that there's a competition for the tech and the quality of the models, there will be a competition for access to that data. So I, I anticipate seeing there be  multiple approaches, there will certainly be attention to the legal evolution as we go. We'll sort of see how the, the models, the approaches,and the laws evolve.

Niki: And lawsuits buy time. [Kat: Right] So, if you, if you can sort of ask for forgiveness instead of permission. It's extremely unlikely that we would have some sort of federal AI law that would address this particular issue. People right now on the Hill are more focused on bias rather than collecting data (I think) and copyright.

But we'll see what happens because if you are fighting it out in court that buys a lot of time. 

Kat: I think that's right. And again, the EU has already started to address this by requiring water, watermarks and clarity around where there's copyrighted materials that are included or copyrighted data that's included. So, so we'll sort of see, we'll sort of see how those, how those evolve.

Niki: Right. They're very top-down. They're dictating ahead of time. I mean, if I may, this is like a little bit of, I don't know if it's a hot take or not, but when I started using ChatGPT, I thought, “Oh, this is kind of great!” I used it to write a letter that I, a business letter that I needed. And it seems to be getting dumber the more people use it 

[both laugh]

Niki:  I'm serious!! I feel like now I'm like, “This seems, this seems flatter,” like it's just not, the content doesn't seem as great to me, and I'm just wondering, like, “Maybe they're just scraping too far to the edges of the earth to see what people are doing?!”  But it doesn't feel as dynamic as even just six months ago, and so I don't know, that that's completely anecdotal and based on what I use it for, and so I understand that they're trying to get more data because they're trying to get high-quality data.

And this is another thing, this feels completely made up to me, but somebody threw out, I think it was Sam Altman of OpenAI, said “There'll be no more quality data left to collect after 2026,” which just feels like invented. I don't even know how you would know that.

Kat: I love the idea of non-quality data! What does that mean? [chuckling]

The idea that first-mover’s data is so much more interesting and when everybody else is like, follow suit, it's just not [chuckling]  it's not as good. 

Niki: Well, not only that!  If you're scraping the Internet, I mean, there's a lot of data!  Actually, so one of the companies running into a problem is Facebook, Meta. So, they've got access to their own user data but who wants to create a large language model based on Facebook posts? [laughs]It's not, y’know, that's not, I wouldn't say high-quality data, probably. 

Kat: We'll see!  And especially in this election year, it'll be interesting to watch how all of that gets treated. Who is using that data and how that gets used?

Niki: Yes. That's another great point! Okay. 

So that's the second topic that we wanted to talk about today is this idea that, it's breaking in the news, because you're starting to see companies just in the United States, they've got their walled gardens of their products and services. They're allowed and permitted to use that data in certain ways for now. And then, now you've got this, like, cutthroat competition to take each other's data, which is interesting to see tech fighting tech on this! 

Back in the day, it was newspapers who were incredibly angry that Google was y’know, basically taking and crawling and then posting their stories and that destroyed the newspaper industry because they had to shift to digital and they thought that they were It was just very complicated. I don't think the intention was to put the newspaper industry out of business, but that's what happened. 

And so, now you're seeing suddenly it's tech on tech with a not dissimilar issue, which is “We need data!” So, it's useful. It's not for nefarious purposes. It's so that these tools are useful to people.

But where are the edges of that legally? 

Kat: I think that's where a lot of this, kind of, becomes interesting, where you have copyright provisions, you have free speech, but you also have the privacy rules that are evolving literally as we speak. All of those apply and all of those are, sort of, in existence outside of this new technology. I also think it's, it's, sort of, always been tech on tech. 

We, we together lived through some of the live fast and break [Niki: Oh we did!] we did fast and break things,  right? 

Niki: We did!! You and I sat next to each other at Uber. You were in the legal department and I was in the public policy and communications department during an era where we had to get an emotional support animal for the office.

Kat: We, we, we saw some of the regulations evolve as some things broke. [Niki: laughs] And so, but I do think that there's, I think that, that there were lessons learned there on all sides. I think that consumers are sort of, more savvy. Maybe I'm just older and much more sort of skeptica, more likely to read terms of service. Maybe it's just because I'm a lawyer but I do think that there's a lot more eyes open about how data is being used, where it's being used, what the benefits and what the costs are. Lawmakers and regulators are much more interested in moving more quickly. 

You always want tech to move ahead of regulators.

If tech moved at the speed of government , we would be much less competitive. 

Niki: I think that's a huge understatement!!

[both laugh]

Kat: Whether it's because an election year, if it's because there's a new technology that's coming out that has significant global implications. But you are seeing regulators move much more quickly and much more willing to learn as they go.

I wouldn't say that we're shifting into a regulatory move fast and break things world 

Niki: Oh, interesting!! 

Kat: but I do think that there's a shift from tech companies being willing to push the envelope as much as they may have been 10 years ago. And now regulators are much more willing to, sort of, figure things out live.

So it'll just be really, it'll be interesting to watch. I don't know, I guess maybe it's because I'm in DC, maybe because I'm a lawyer, but I'm really enjoying watching all of this. [chuckling] 

Niki: Yeah, no!  I think, Kat, I think that's a really brilliant observation! Which is, you're right, we're seeing, it used to be, y’know, again, we were in the trenches as we were like, “We’ll, figure this out, y’know, let's just go, go, go and then see what happens and we'll sort it out.” 

And I think you're right. I think the government is moving toward that, too, for the same reasons. Just like we were moving to try to create new tech for consumers, they're moving to try to protect consumers, which is their job, [Kat: right] to protect citizens.

But, if you don't take a lot of care with it… They should pass permanent law, but you have to be, it'll be interesting to see how that plays out. 

Kat: And I think that companies learn from it too. Y’know, when you're a disruptor, there will always be a, sort of, a harsh legal reckoning that you have to figure out whether it's proactively or not. We're seeing this in y’ know, I think crypto is a good example where we're seeing a lot of that now that you may have some experience! But we're seeing this in a lot of sectors.

There appears to be less of an appetite to to roll over some of the regulatory guardrails than we may have seen, we may have seen in the past.

Niki: Right. I think that's right. The whole ethos has sort of changed. So, it's an interesting dynamic. We'll be watching. 

Kat: Maybe we're all just older! 

Niki: I mean, the two of us, right. We just keep getting that way. [both chuckle]

Although I'm, like, Gen X and I always want to build chicken wire over my house, like “Enemy of the State.” I'm using VPNs. I'm refusing terms of service. I really  I've sort of become a privacy hawk in some ways, although who cares about what I'm looking at? There's literally nothing interesting in what I'm doing, [chcukling] but I just don't like the idea of it. I think that might be generational. 

Kat: We're the same. We have a black box for, for phones and keys, which part of it has to do with looking our kids in the eyes, but part of it is also just wanting to have more and more space away, 

Niki:  Righ?! A little more space away. 

Okay, final topic. You actually flagged this for me and it is fascinating. It's sort of a bizarre little news story from the week.

[Kat: laughs] 

Kat: So, we've long watched the Amazon Just Walk Out technology and there was some discussion this week about how part of it is technology and part of it is just lots of cameras and lots of eyeballs watching consumers move through the stores. 

I thought it was really fascinating to see that, that this was the approach in the first place. I wonder whether initially, the desire was to have there be more tech around this and fewer people watching, but that's now been shut down. So, apparently we either don't have the appetite to continue with those stores or to continue with paying workers to watch?

Niki: Right! So, I was living over in Logan Circle. There was one of these just walk out Amazon stores. You buy banana- no, you don't buy it. You grab a banana, walk out and it somehow charges you. 

I didn't think it seemed magical and techie. I thought it seemed completely creepy. And not only did I never go in that store, but I walked just like on the other side of the street because [chuckling] I did not know how they were scanning things

[both laugh] 

Niki: And I didn't want to know how they were doing it! 

And then the idea that they might be paying folks overseas to be watching and writing down like “banana” [chuckling], they tie it to your Amazon account is. They've, Amazon has said that is not what was happening except in small cases, but I did think it was sort of an interesting story. 

Kat: Yeah, sort of interesting. I, when it comes to privacy and groceries, I have been using Instacart pretty religiously since COVID and having children.

So, I like the tech reminds me that I may have forgotten the bananas, but I, I, I'm not sure how I feel about being watched while I shop. 

Niki: I agree. I am also an Instacart devotee and I, I like that it reminds me of things and it reminds me of what my past purchases are, but that to me is really different than knowing that I just walked out with a banana and charging my credit card.

I don't know why [chuckling] I'm using bananas as an example!! 

[both laugh] 

Kat:  It's not like a signature Amazon treat?! 

Niki: I think that it is. And also it's even to me, it's like, [laughing] don't you have to weigh those even at the normal grocery store? I don't know.  [chuckling] It seemed sort of hard to believe. I didn't know how they were doing it. 

[both laugh] 

Niki:  I was baffled, now we're over it. It's like the segue. Amazon’s Just Walk Out, dead to us. 

[both laughing] 

Kat: I actually really like that as a tagline for tech in general: “I was baffled, now it's dead to me.” [laughing] 

[cross-talk]

[both laugh] 

Niki: Yeah, well, people, feel free to use im people!  I don't, if they, if anybody wants to transcribe our podcasts and make large language models smarter, by all means.

Kat, thank you so much for coming in. You're back in two weeks and we'll see what's breaking at that time. 

Kat: Thank you.