Balkinization: Privacy Loss and Harm in an Era of Inference

Privacy Loss and Harm in an Era of Inference

Guest Blogger

For the Balkinization Symposium on Ignacio Cofone, The Privacy Fallacy: Harm and Power in the Information Economy Cambridge University Press (2023).

Elana Zeide

In his timely and incisive book, The Privacy Fallacy, Ignacio Cofone critiques the foundational assumptions of privacy regulation. He convincingly demonstrates that privacy law’s persistent emphasis on individual control and procedural compliance fails to grasp the true nature of privacy harm and overlooks the systemic realities of our modern information economy.

Cofone identifies what he terms the “privacy fallacy”—our legal system’s tendency to acknowledge privacy’s intrinsic value in theory while reducing it to merely instrumental protections focused on preventing discrete, tangible harms. This conceptual error manifests in privacy law’s continued reliance on notice-and-choice frameworks even as contemporary data practices render meaningful individual control increasingly illusory. This creates a significant disconnect between legal frameworks and the actual challenges of protecting privacy in modern data ecosystems.

Privacy scholars have long recognized that the dominant legal approaches to data privacy are fundamentally misaligned with the realities of our modern information economy. These models are grounded in notice, choice, and individual control. They assume consent remains meaningful, even as data-intensive technology has become increasingly complex and ubiquitous in daily life. Cofone illuminates how current laws reduce privacy protection to a series of individual choices that people cannot meaningfully make. These systems expect individuals to foresee and prevent privacy violations through consent mechanisms and individual rights, while simultaneously accepting that even courts struggle to identify privacy harms after they occur. As Cofone aptly notes, “If judges have a difficult time seeing privacy harm after it happens, how can one expect people to see it before it happens?”

He illustrates this problem through cases like TransUnion v. Ramirez, where TransUnion erroneously labeled thousands of people as potential terrorists in their credit reports. Despite the obvious reputational risks and emotional distress of being falsely designated as a terrorist, the Supreme Court dismissed the claims of most class members because they couldn’t prove their credit reports had been seen by third parties. This case highlights Cofone’s broader critique of privacy law’s failure to account for harms that do not result in direct, material consequences but nonetheless undermine individual dignity and trust.

A crucial contribution of Cofone’s analysis is his framework distinguishing between privacy loss (a descriptive condition), privacy harm (a normative wrong), and consequential harms (such as identity theft or reputational damage). This disaggregation allows courts and scholars to identify the impact of information practices without requiring proof of consequential damages that may be difficult or impossible to demonstrate.

Cofone’s conceptualization of privacy loss is valuable. He characterizes it as probabilistic and incremental, rather than discrete moments where information moves from “private” to “public.” When Google, for example, enhances its knowledge about someone’s willingness to pay for flights, a privacy loss has occurred through this improved statistical certainty - even if the person does not know about it and no concrete consequences materialize.

This approach captures how seemingly innocuous data collection enables sensitive inferences through correlation and aggregation. In complex data ecosystems, patterns in browsing history, app usage, or purchase data might reveal health conditions, sexual orientation, or political beliefs that were never explicitly disclosed. Traditional frameworks, focused on discrete information disclosure, overlook these modern mechanisms of gaining probabilistic knowledge about individuals indirectly.

After establishing this descriptive account of privacy loss, Cofone turns to the normative question of when such losses should trigger legal remedies. He defines privacy harms as “the wrong of producing unjustified privacy losses for others for private gain, violating privacy’s socially recognized value.” Like battery—which compensates individuals for physical injury while recognizing that the harm flows from violations of autonomy—privacy harms are distinct from their tangible consequences.

This separation of descriptive loss from normative harm addresses a fundamental limitation in privacy law: its reliance on concrete, consequential damages to recognize harm. His framework provides courts with a means to address privacy violations that operate invisibly, through mechanisms like inference and aggregation, which often escape traditional scrutiny. By emphasizing privacy as relational and collective rather than purely individualistic, Cofone shifts the focus to systemic harms embedded in modern data ecosystems.

To evaluate when privacy loss rises to the level of privacy harm, he examines three key contextual factors: the entities involved, the type of information at issue, and how it was collected, processed, or shared. For Cofone, privacy harms occur when data practices undermine key social values that privacy protects, including maintaining autonomy, fostering trust, enabling intimacy, and preserving democratic self-governance. He characterizes contemporary privacy harm as “informational exploitation” where entities with asymmetric power profit from personal information while disregarding individual wellbeing. He illustrates this through Grindr’s sharing of users’ sexual orientation and HIV status with third parties. The privacy harm arose from the platform’s exploitation of its position to profit from information in ways that violated both individual autonomy over sensitive personal information and the collective value of safe spaces for marginalized communities.

Anticipating critique that his notion of privacy harm is too vague, Cofone notes that courts rely on ill-defined social norms to assess whether someone’s behavior is “reasonable” or their actions “highly offensive.” While determinations of reasonableness are fact- and context-dependent in traditional cases, Cofone's framework poses a more fundamental challenge. He is not simply asking for courts to apply law to specific facts, but to make normative choices about legitimate and highly contested values. Privacy values can and do conflict.

Cofone’ framework requires more detail about how to resolve scenarios when privacy values conflict. His examples about for-profit companies using predictive analytics to increase online engagement or unnecessary spending are straightforward. But what about instances that are not as clear? Schools, for example, often monitor students' reading habits, communications, and digital activities to detect and prevent self-harm or violence, thereby advancing the important social value of harm prevention. At the same time, such practices conflict with other critical values, such as protecting students from surveillance that could chill their intellectual exploration and self-expression. In those instances which privacy value should prevail?"

Cofone’s conception of exploitation as the unjustified use of personal information raises important questions about its meaning and scope. The framework critiques corporate profit-seeking but offers less clarity outside the consumer context. Future work must address how exploitation applies to non-profits or public agencies who might prioritize goals like education, public health, or safety but still undermine privacy by disregarding individual autonomy or collective social values. Refining the definition and scope of exploitation is crucial to understanding how privacy harms arise in these broader and more complex scenarios.

Building on his distinctions between privacy and consequential harms, Cofone develops a hybrid enforcement model that leverages complementary institutional capacities. Regulatory agencies would address systemic practices through forward-looking oversight, setting standards for data minimization and privacy-by-design. This public oversight would be complemented by a dual liability scheme focused on outcomes rather than procedural violations.

For consequential harms—like financial loss, reputational damage, or discrimination—Cofone advocates strict liability, drawing parallels to environmental law and products liability. In both contexts, corporate actors control both the likelihood and magnitude of harm through their practices, while individuals have little meaningful ability to avoid or mitigate risks. For intrinsic privacy harms—the wrongful exploitation of personal information itself—he proposes a liability regime that would recognize these violations even absent concrete injury, while suggesting mechanisms like statutory damages caps to make the system workable.

Yet this framework’s reliance on outcome-based liability encounters significant challenges when addressing modern data ecosystems. Cofone’s theory captures how privacy violations unfold through probabilistic knowledge, but his liability scheme relies on identifying harms after they occur. For example, algorithmic tools curate and filter the choices individuals encounter, influencing which jobs, loans, or educational pathways they are likely to see and pursue. In doing so, they entrench systemic inequalities and create algorithmically disfavored castes—groups excluded from critical opportunities through the hidden, cumulative effects of automated curation. Neither the privacy loss nor the consequential harm is readily apparent, making it difficult to identify and address them after the fact. This suggests that meaningful redress may require stronger ex ante measures to prevent these harms from arising in the first place.

Yet rather than undermining Cofone’s analysis, these implementation difficulties highlight the importance of his theoretical moves toward outcome-based standards and systemic regulation. His treatment of privacy loss through probabilistic knowledge, combined with attention to power dynamics and exploitation, provides essential foundations for addressing how modern systems affect privacy through invisible mechanisms of inference and exclusion.

The Privacy Fallacy succeeds in its primary aim: demonstrating why current privacy frameworks fail to address modern privacy challenges and offering theoretical tools for building better alternatives. The book’s careful parsing of privacy loss and privacy harm provides conceptual clarity that future scholars and courts will find invaluable. The deeper contribution lies in how Cofone’s framework reveals privacy’s fundamentally social nature. By moving beyond individualistic models of privacy harm, the book opens new possibilities for understanding privacy as a collective good that requires collective solutions.

The challenge now is to develop concrete legal tools equal to the novel challenges posed by algorithmic power. This will require sustained attention to questions of structure, temporality, and opacity that go beyond even Cofone’s important reframing. His work offers an essential foundation for this project, even as it leaves us with critical questions still to resolve.

Elana Zeide is Assistant Professor of Law at the University of Nebraska. You can reach her by e-mail at zeide@unl.edu.

Posted 9:00 AM by Guest Blogger [link]