Ethics and Human Rights

AI ethics is the study of moral questions raised by the design, deployment and governance of AI systems. Algorithmic bias refers to systematic and unfair differences in a system's outputs or error rates across individuals or groups, and algorithmic fairness is the research area that defines, measures and attempts to reduce such differences (Mehrabi et al., 2021; Dwork et al., 2012).

AI systems are used to score credit, allocate health care, screen applicants, assess criminal risk and moderate content. Errors in these settings are not evenly distributed, and statistical learning can reproduce or amplify patterns in historical data. Mehrabi et al. (2021) survey real-world applications that have shown bias, catalogue sources of bias that can affect AI applications, and propose a taxonomy of fairness definitions. The central technical finding of the fairness literature is that several intuitively appealing fairness criteria cannot all be satisfied at once, so "fairness" is a set of value-laden choices, not a single measurable property (Kleinberg et al., 2016; Chouldechova, 2017).

Ethics debates extend beyond group fairness to transparency, accountability, privacy, labour, environmental cost and concentration of power. Jobin et al. (2019) mapped the corpus of AI ethics principles and guidelines and reported a global convergence emerging around five principles (transparency, justice and fairness, non-maleficence, responsibility and privacy), with substantive divergence on interpretation and implementation. This article focuses on bias and fairness; privacy is treated in [SAFE-PRIV-001], and legal regimes in [GOV-LAW-001].

The papers below, from 2011 to 2021, are among the widely cited works in algorithmic fairness. Dwork et al. (2012) formalised individual fairness ("fairness through awareness"). Bolukbasi et al. (2016) showed that word embeddings trained on Google News articles exhibit gender stereotypes and that gender bias is captured by a direction in the embedding space. Public attention intensified with the 2016 ProPublica analysis of the COMPAS recidivism-risk tool, which found that Black defendants were almost twice as likely as white defendants to be wrongly labelled higher risk (44.9% versus 23.5%) while white defendants were more often mislabelled lower risk (47.7% versus 28.0%) (Angwin et al., 2016). The developer of COMPAS disputed the methodology (as reported in the same article). Within roughly nine months, Kleinberg et al. (arXiv, September 2016) and Chouldechova (arXiv, February 2017) showed formally that the competing criteria at the heart of that dispute cannot generally be satisfied together. Hardt et al. (2016) proposed equality of opportunity as a criterion. Caliskan et al. (2017) showed that word-association tests applied to corpora reproduce human-like biases, and Buolamwini and Gebru (2018) documented intersectional accuracy disparities in commercial facial-analysis systems. Obermeyer et al. (2019) analysed a health-care algorithm in wide use in the United States. Bender et al. (2021) discussed risks of ever-larger language models.

#4.1 Sources of bias

Mehrabi et al. (2021) distinguish biases arising in data (for example unrepresentative samples), in algorithms (design and optimisation choices) and in user interaction. Two concrete mechanisms illustrate this. Representation: Buolamwini and Gebru (2018) found that two widely used face benchmarks were overwhelmingly composed of lighter-skinned subjects (79.6% in IJB-A and 86.2% in Adience), and that in three commercial gender-classification systems darker-skinned women were the most misclassified group, with error rates up to 34.7% versus a maximum of 0.8% for lighter-skinned men (systems as tested in 2018; the authors' results are not a statement about current systems). Proxy labels: Obermeyer et al. (2019) found that one widely used algorithm used health costs as a proxy for health needs; because less money was spent on Black patients with the same level of need, Black patients assigned the same risk score were sicker, and the authors estimated that the bias reduced the number of Black patients identified for extra care by more than half. Reformulating the algorithm to stop using cost as a proxy removed the bias in predicting who needs extra care.

#4.2 Formal fairness criteria

Let $Y$ be the true outcome, $\hat Y$ the decision, $S$ a risk score and $A$ a protected attribute.

• Demographic (statistical) parity: $\Pr(\hat Y=1\mid A=a)=\Pr(\hat Y=1\mid A=b)$.
• Equalised odds / equality of opportunity: $\Pr(\hat Y=1\mid Y=y, A=a)=\Pr(\hat Y=1\mid Y=y, A=b)$ for $y\in\{0,1\}$ (equalised odds), or for $y=1$ only (equality of opportunity) (Hardt et al., 2016).
• Calibration within groups: $\Pr(Y=1\mid S=s, A=a)=s$ for each group.
• Individual fairness: similar individuals receive similar outcomes; formally, a mapping $M$ from individuals to distributions over outcomes is Lipschitz with respect to a task-specific similarity metric $d$ (Dwork et al., 2012).

#4.3 Impossibility results

Kleinberg et al. (2016) formalise three fairness conditions for probabilistic classification and prove that, except in highly constrained special cases, no method satisfies all three simultaneously. Chouldechova (2017) shows that criteria such as predictive parity and error-rate balance cannot all hold when prevalence differs across groups, and that disparate impact can arise when a recidivism instrument fails to satisfy error-rate balance. The practical consequence is that choosing a criterion is a normative decision that statistics alone cannot make.

#4.4 Mitigation

Approaches are conventionally grouped into pre-processing (re-weighting or debiasing data or representations, for example removing a gender direction from embeddings; Bolukbasi et al., 2016), in-processing (constrained or regularised training) and post-processing (adjusting decisions or thresholds, as in Hardt et al., 2016). Mehrabi et al. (2021) review such methods. Methods that reduce one disparity metric can worsen another.

• Criminal justice. Risk-assessment instruments such as COMPAS were analysed by journalists and academics (Angwin et al., 2016; Chouldechova, 2017); the dispute illustrates incompatible fairness criteria.
• Health care. A proxy-label bias in a deployed risk algorithm and its correction (Obermeyer et al., 2019).
• Computer vision. Subgroup performance auditing of commercial gender classifiers (Buolamwini & Gebru, 2018).
• Language technology. Embedding debiasing and association tests (Bolukbasi et al., 2016; Caliskan et al., 2017). Bender et al. (2021) discuss risks of large language models. [VERIFICATION NEEDED: the specific risks (training-data documentation, encoded bias) were not checked against the paper text.]
• Policy instruments. UNESCO's Recommendation on the Ethics of Artificial Intelligence was adopted in November 2021 by UNESCO's 193 member states (as stated on the UNESCO page) and lists ten principles including fairness and non-discrimination, transparency and explainability, and human oversight and determination. The NIST AI Risk Management Framework 1.0 (NIST AI 100-1, 26 January 2023) is a US framework "intended for voluntary use" (NIST page, read 2026-10-18); that page also states it is being revised as part of the White House AI Action Plan, so check for a newer version. For binding law see [GOV-LAW-001], [GOV-EU-001] and [GOV-US-001].

• No single metric. Impossibility results mean trade-offs are unavoidable when base rates differ (Kleinberg et al., 2016; Chouldechova, 2017).
• Measurement. Audits require demographic data that may be unavailable or sensitive to collect, creating tension with privacy (see [SAFE-PRIV-001]).
• Label and proxy bias. Biased labels or proxies can make a model "accurate" with respect to a flawed target (Obermeyer et al., 2019).
• Context dependence. Whether an observed disparity is unjust depends on the decision context and values, which is a normative question outside the statistical framework.
• Principles versus practice. Jobin et al. (2019) report substantive divergence in how convergent principles are interpreted and implemented, so agreement on principles does not settle practice.
• Generative models. Fairness research developed mainly for classifiers; extensions to open-ended generation lack agreed metrics. [VERIFICATION NEEDED: current consensus on evaluating bias in generative models; not surveyed.]

As of 2026-10-18:

• That machine-learning systems can exhibit group-level performance and outcome disparities, and that they have in documented cases (Buolamwini & Gebru, 2018; Obermeyer et al., 2019), is Well Supported.
• The impossibility of simultaneously satisfying certain fairness criteria is Established (mathematical results under stated conditions: Kleinberg et al., 2016; Chouldechova, 2017).
• Which fairness criterion is appropriate in a given setting is Contested, because it is a normative judgement.
• Whether specific mitigation techniques generalise across settings is Preliminary; reviews list many methods but outcomes vary (Mehrabi et al., 2021).
• The COMPAS dispute is documented in a journalistic source (Tier 4) and an academic analysis; the accuracy of ProPublica's headline interpretation was disputed by the developer.

This section contains no registered forecasts. Observed trends and open questions:

• Near-term (0-3 years). Bias measurement is extending to language-model and multimodal systems, and legal requirements touching on bias are appearing (see [GOV-EU-001] and [GOV-LAW-001]). [VERIFICATION NEEDED: specific audit obligations not checked in this audit.]
• Medium-term (3-10 years). Open questions include how to audit systems whose behaviour is context-dependent and how to reconcile fairness with privacy.
• Long-term (10+ years). Integration of fairness with broader alignment questions about whose values AI systems should reflect (see [SAFE-ALIGN-001]).

• Foundational Concepts:
  • FOUND-001 Artificial Intelligence: The field and its aims.
  • TECH-ML-001 Machine Learning: Learning from data and the sources of bias.
• Related Methods & Technologies:
  • TECH-DATA-001 Training Data, Contamination and Provenance: Data representation and documentation.
  • SAFE-PRIV-001 Privacy and Data Protection in AI: Data protection and the data needed to audit bias.
  • SAFE-ROBUST-001 Technical Safety and Robustness: Performance under distribution shift.
• Advanced Implications & Future Trajectories:
  • SAFE-ALIGN-001 The AI Alignment Problem: Whose values and which objectives.
  • GOV-LAW-001 Global AI Governance & Regulation: Legal responses.

Copyright and intellectual property (IP) in AI concerns two sets of legal questions: whether copying protected works to train AI models, or models reproducing such works in outputs, infringes the rights of the owners; and whether AI-generated material, or AI-assisted inventions, can themselves be protected by copyright or patent. The answers are set by national law and are being decided case by case.

Generative models (see [CAP-GENAI-001]) are trained on very large collections of text, images, code, music and video, much of it protected. Rights holders have sued developers in several countries. The disputes turn on different doctrines in each system: the open-ended, four-factor fair use defence in US law; closed lists of exceptions (for example text-and-data-mining exceptions) in EU member states and the UK; and, in the UK, whether a trained model is an "infringing copy". Because the questions are new and first-instance courts have not agreed, the law is unsettled. A second set of questions concerns authorship: US law, as applied by the courts so far, requires a human author.

Privacy aspects of training data are covered in [SAFE-PRIV-001]; dataset provenance in [TECH-DATA-001]; creative-industry effects in [APP-MEDIA-001].

Before generative AI, copyright disputes over machine copying concerned search engines and digitisation, decided largely under US fair use. An early US ruling on fair use for AI training data was Thomson Reuters v. Ross Intelligence, decided on 11 February 2025 by Judge Bibas (sitting by designation in the District of Delaware) in favour of Thomson Reuters, in a case involving a non-generative legal-search tool; the Third Circuit affirmed on 29-30 September 2026, reported as the first federal appellate decision on fair use in AI training. In June 2025 two judges in the Northern District of California reached more favourable conclusions for developers on training itself (Bartz v. Anthropic, 23 June 2025; Kadrey v. Meta, 25 June 2025). In 2025 outside the US, the UK High Court decided Getty Images v Stability AI (4 November 2025), a Munich court decided GEMA v OpenAI (11 November 2025) and the Hamburg appeal court decided Kneschke v LAION (10 December 2025). Section 6 summarises each.

#4.1 Where copying occurs

Copyright analysis distinguishes (a) copying in building the training set (downloading and storing works); (b) training, in which model parameters are adjusted; (c) memorisation inside the model, where parameters may encode portions of works; and (d) outputs that may reproduce or resemble protected works. Technical evidence of extractable memorisation (Carlini et al., 2021; Nasr et al., 2023; see [SAFE-SEC-001] and [SAFE-PRIV-001]) bears on (c) and (d); it does not by itself determine the legal characterisation.

#4.2 US fair use

17 U.S.C. section 107 lists four factors for fair use: the purpose and character of the use, including whether it is commercial; the nature of the copyrighted work; the amount and substantiality of the portion used; and the effect of the use on the potential market for or value of the work (U.S. Copyright Office, Title 17). Courts weigh the factors case by case. In AI cases, the debate centres on whether training is "transformative" and on market harm, including a "market dilution" theory in which AI outputs compete with the authors' works without copying them.

#4.3 EU text-and-data-mining exception and AI Act duties

The EU AI Act requires providers of general-purpose AI models to "put in place a policy to comply with Union law on copyright and related rights", including honouring rights holders' text-and-data-mining opt-outs under Article 4(3) of the 2019 copyright directive, and to "draw up and make publicly available a sufficiently detailed summary about the content used for training" using an AI Office template (Regulation (EU) 2024/1689, Art. 53(1)(c)-(d); quoted wording checked against the Official Journal text, read 2026-10-18). Application dates of the AI Act were amended in 2026; see [GOV-EU-001].

Each item gives jurisdiction, court, date and status as of 2026-10-18. Items marked "secondary" rely on law-firm or press summaries; items marked "primary" cite a court document that was read.

United States

• Thomson Reuters v. Ross Intelligence (D. Del., No. 1:20-cv-613, Judge Bibas, 11 February 2025): partial summary judgment for Thomson Reuters on direct infringement of 2,243 Westlaw headnotes and rejection of the fair use defence; the tool was not generative AI (secondary). On interlocutory appeal (3d Cir. No. 25-2153; argument reported for 11 June 2026) the Third Circuit panel (Montgomery-Reeves, Restrepo, Bove, JJ.) affirmed. The opinion carries a docket stamp of 30 September 2026 (primary, docket stamp only); press reports date a first, sealed version to 29 September 2026. Per press reports of the opinion, it held the headnotes copyrightable, held ROSS's use "minimally transformative at best" and not fair use, found market harm including to a market for licensing headnotes as AI training data, and distinguished ROSS's non-generative system from LLMs (secondary: Courthouse News, LawNext). ROSS has said it will seek en banc rehearing and Supreme Court review (secondary); the case returns to the district court on remaining claims. [VERIFICATION NEEDED: opinion text beyond the docket stamp was not read; precedential status and whether rehearing was sought.]
• Bartz v. Anthropic PBC (N.D. Cal., No. C 24-05417 WHA, Judge Alsup, Order on Fair Use, 23 June 2025; primary, order read): the court held that using the books to train Claude was "exceedingly transformative" and a fair use; that Anthropic's digitising of print books it had purchased was also a fair use (for a different reason, format shifting of lawfully owned copies); and it denied summary judgment on the central library built from pirated copies, ordering a trial on that library and damages. The class action then settled for USD 1.5 billion (plus interest) and the court (Judge Araceli Martinez-Olguin, successor to Judge Alsup) gave final approval on 20 July 2026, with a fee award of about USD 101.6 million (Authors Guild report; Jurist; secondary). Reports give roughly 480,000 works; counts vary. Because it settled, it sets no binding precedent. [VERIFICATION NEEDED: the approval order itself was not read.]
• Kadrey v. Meta Platforms (N.D. Cal., No. 23-cv-03417-VC, Judge Chhabria, order of 25 June 2025; primary, order read): summary judgment for Meta on fair use for these thirteen authors on the record before the court. The court said plaintiffs had presented no meaningful evidence of market dilution, and wrote that the ruling "stands only for the proposition that these plaintiffs made the wrong arguments and failed to develop a record in support of the right one", not that Meta's use of copyrighted material to train its models is lawful. A separate claim about distribution during torrenting continued; a summary judgment hearing on it was reported as set for 25 February 2027 (secondary).
• New York Times v. Microsoft and OpenAI (S.D.N.Y., No. 1:23-cv-11195, Judge Stein; coordinated with other cases in MDL No. 25-md-03143, In re OpenAI, Inc. Copyright Infringement Litigation): no ruling on fair use reported. Cross-motions for summary judgment were filed on 4 September 2026 (secondary: litigation trackers and press); reply dates are reported as 6 or 20 November 2026 and no trial date is set. The US Department of Justice has filed a statement of interest supporting OpenAI's fair use position (secondary). [VERIFICATION NEEDED: briefing schedule; dockets were not opened.]
• Thaler v. Perlmutter (D.C. Cir. No. 23-5233, 18 March 2025): the Copyright Act requires human authorship; rehearing was denied on 12 May 2025 and the Supreme Court denied certiorari on 2 March 2026 (No. 25-449) (primary: Supreme Court docket page). Certiorari denial is not a merits ruling. The U.S. Copyright Office report Copyright and Artificial Intelligence has three parts: Digital Replicas (31 July 2024), Copyrightability (29 January 2025) and Generative AI Training (pre-publication version of 9 May 2025; the Office's index page, read 2026-10-18, still describes a final version as to come) (U.S. Copyright Office, 2025).
• Thaler v. Vidal (Fed. Cir., No. 2021-2347, 5 August 2022; 43 F.4th 1207): inventors under the Patent Act must be natural persons (secondary: case reporter listing and commentary).

United Kingdom

• Getty Images v Stability AI [2025] EWHC 2863 (Ch) (High Court, Mrs Justice Joanna Smith, 4 November 2025; primary, judgment text read via the National Archives). Getty's training claim was abandoned because there was no evidence that training took place in the UK, and its outputs claim was abandoned because the relevant prompts were blocked (para 9). The court dismissed the secondary-infringement claim: an "article" may be intangible, but an AI model that does not store or reproduce any copyright works is not an "infringing copy" under ss. 22-23 CDPA, and Stable Diffusion is such a model (para 758(viii)). Getty succeeded in part on trade mark infringement (iStock watermarks under s. 10(1) and 10(2) for v1.x; Getty Images watermarks under s. 10(2) for v2.x), failed under s. 10(3), and the court declined to decide passing off (para 758). At a consequentials hearing in December 2025 Getty was granted permission to appeal on the secondary-infringement point (sources give 16 or 17 December 2025; secondary: CMS, Burges Salmon). I found no listed Court of Appeal hearing date or decision. [VERIFICATION NEEDED: appeal listing and outcome; whether Stability sought permission on the trade mark findings.]
• Thaler v Comptroller-General of Patents, Designs and Trade Marks [2023] UKSC 49 (UK Supreme Court, 20 December 2023): an inventor under the Patents Act 1977 must be a natural person (neutral citation and date: Supreme Court case page; holding: secondary summary).
• Government policy. On 18 March 2026 the UK Government published its report on copyright and AI under section 136 of the Data (Use and Access) Act 2025, with an economic impact assessment under section 135. It states that a broad copyright exception with an opt-out "is no longer the government's preferred way forward", and sets out further evidence-gathering and monitoring rather than legislation; it also proposes removing protection for wholly computer-generated works while keeping protection for AI-assisted works (primary, gov.uk report page; first 100,000 characters read).

Germany

• GEMA v OpenAI (Regional Court Munich I, 42 O 14139/24, 11 November 2025): per commentary, memorisation of song lyrics in model parameters was held to be reproduction, the TDM exception did not cover it, and outputs of lyrics infringed; OpenAI as model operator was held responsible. First instance. OpenAI's appeal is reported as pending at the Higher Regional Court Munich (reported docket 6 U 3662/25 e) (secondary: Morgan Lewis, William Fry, Bird & Bird). [VERIFICATION NEEDED: appeal docket and hearing date.]
• Kneschke v LAION (Regional Court Hamburg, 27 September 2024; Higher Regional Court Hamburg, 10 December 2025, 5 U 104/24): both courts ruled for LAION. The appeal court reportedly relied on the TDM exception in section 44b of the German Copyright Act for the automated image-description matching and, additionally, on the scientific-research exception in section 60d for a non-commercial research body; it held that a rights holder's reservation must be machine-readable and that the plaintiff's natural-language reservation was not, and it limited its reasoning to dataset creation, not later training (secondary: Morgan Lewis, ELBKANZLEI; judgment text not read). It admitted a further appeal; that appeal is pending at the Federal Court of Justice (I ZR 281/25), which heard it on 3 September 2026, is reported to have signalled a referral of questions to the CJEU, and has a pronouncement date reported as 17 December 2026 (secondary: BFF report). [VERIFICATION NEEDED: BGH outcome and whether a CJEU referral is made.]
• Like Company v Google Ireland (CJEU, C-250/25): a Hungarian referral from April 2025 asks whether LLM training and chatbot outputs involve reproduction and communication to the public and whether the TDM exception applies. A public hearing was reported for 10 March 2026; I found no judgment (secondary). [VERIFICATION NEEDED: current status on curia.europa.eu.]

• Divergent first-instance outcomes. US district courts reached different results on training (Bartz, Kadrey for developers on the records before them; Ross against, on a non-generative tool, now affirmed by the Third Circuit); UK and German courts differ on the status of models. No court of final appeal has decided the central training question for generative AI.
• Source of the works matters. In Bartz, the court distinguished training use from the building of a permanent library from pirated copies, which the fair use ruling on training did not excuse; this has practical consequences for data acquisition.
• Market harm theories. Whether outputs that compete without copying (market dilution) defeat fair use is open (Kadrey, primary: the judge described the theory as potentially winning but unproven on that record).
• Opt-out mechanics. The Hamburg appeal court's reported requirement of machine-readable reservations affects how rights holders can exclude their works; the UK Government has said an opt-out exception is no longer its preferred option.
• Licensing. Reported settlements and licences do not establish legal rules.
• Authorship. Human-authorship requirements leave the status of works with substantial but partial AI contribution to case-by-case analysis; the Copyright Office's Part 2 report (29 January 2025) concludes that, given currently available technology, prompts alone do not provide sufficient human control to make users the authors of AI output, while human-authored input, and human selection, arrangement or modification of AI output, can be protected, assessed case by case (primary, report text read).
• Criminal, contract and terms-of-service issues (for example scraping terms) are outside this draft.

As of 2026-10-18:

• There is no settled rule on whether training generative models on copyrighted works is lawful. This is Contested and varies by jurisdiction.
• The Third Circuit affirmed the rejection of a fair-use defence in Ross (non-generative AI) on 29-30 September 2026; the panel reportedly distinguished generative models, so this does not directly resolve generative training, and ROSS has said it will seek rehearing and Supreme Court review. Well Supported as to the Third Circuit's ruling; its reach for generative AI is Contested (opinion text beyond the docket stamp not read).
• The proposition that US copyright requires human authorship is Well Supported by appellate authority (Thaler v. Perlmutter), with certiorari denied; this is a statement about works generated without human authorial contribution, not about AI-assisted works generally.
• The proposition that inventors must be natural persons under UK and US patent law is Well Supported by apex or appellate rulings (Thaler cases; secondary).
• Statutory transparency and opt-out duties for general-purpose AI model providers exist in EU law (AI Act Art. 53).
• In the UK, no statutory text-and-data-mining reform for AI training has been enacted; the Government's March 2026 report defers action.

This section contains no registered forecasts; outcomes of pending litigation are not predicted. Observed open points:

• Near-term (0-3 years). Appeals in Getty (UK), possible rehearing or certiorari in Ross, the appeal in GEMA and the Federal Court of Justice decision in Kneschke (Germany), the CJEU case Like Company, and district-court proceedings such as NYT (summary judgment pending) may clarify whether models contain copies and how fair use applies.
• Medium-term (3-10 years). Legislative responses (licensing, opt-out registries, transparency duties) are possible but not established.
• Long-term (10+ years). The status of increasingly autonomous AI creation under authorship rules is unresolved.

• Foundational Concepts:
  • CAP-GENAI-001 Generative AI: The systems whose training and outputs are at issue.
• Related Methods & Technologies:
  • TECH-DATA-001 Training Data, Contamination and Provenance: Data sourcing and documentation.
  • SAFE-PRIV-001 Privacy and Data Protection in AI: Parallel questions on personal data in training sets.
  • SAFE-SEC-001 AI Security: Extraction attacks and memorisation.
  • SAFE-ETHICS-001 AI Ethics, Bias and Fairness: Ethical dimensions of creative labour and consent.
  • APP-MEDIA-001 AI in Media and Creative Industries: Industry effects.
• Advanced Implications & Future Trajectories:
  • GOV-LAW-001 Global AI Governance & Regulation: Overview of legal responses.
  • GOV-EU-001 The EU AI Act: Copyright-related duties and dates.
  • GOV-US-001 United States AI Policy: US policy context.

Privacy in AI concerns how AI systems collect, learn from, retain and reveal information about individuals. Data protection law is the legal regime governing the processing of personal data; in the EU, the GDPR defines personal data as "any information relating to an identified or identifiable natural person" and processing as "any operation or set of operations which is performed on personal data" (Regulation (EU) 2016/679, Art. 4(1)-(2)).

Machine-learning systems interact with personal data at several stages: collection and curation of training sets, training (which may encode information in model parameters), deployment (inputs, logs, outputs) and downstream decisions about people. Two technical facts drive much of the debate. First, models can memorise and reveal training data (Carlini et al., 2021; Nasr et al., 2023). Second, a trained model can leak information even when the training data are never released (Shokri et al., 2016; Fredrikson et al., 2015). These facts raise the legal question of when a model itself contains personal data, which authorities and courts are only beginning to address.

Related topics are treated elsewhere: attacks that exploit leakage in [SAFE-SEC-001], copyright in training data in [SAFE-IP-001], bias and fairness in [SAFE-ETHICS-001], and EU AI-specific regulation in [GOV-EU-001].

Dwork et al. (2006) introduced differential privacy as a formal definition of privacy for data analysis; Dwork and Roth (2014) consolidated the theory. Fredrikson et al. (2015) showed model-inversion attacks that exploit confidence values, and Shokri et al. (2016) formalised membership inference against black-box models. McMahan et al. (2017; arXiv 2016) proposed federated learning, and Abadi et al. (2016) showed how to train deep networks with differential privacy. Bourtoule et al. (arXiv 2019; published 2021) introduced SISA training to make "machine unlearning" cheaper. With large language models, Carlini et al. (2021) extracted training sequences from GPT-2, Carlini et al. (2022) quantified how memorisation scales, and Lee et al. (2021) showed that deduplicating training data reduces verbatim emission.

On the legal side, the GDPR has applied since 25 May 2018 (Art. 99). The Italian authority's decision on OpenAI (order No. 755 of 2 November 2024, announced 20 December 2024) and its annulment by the Court of Rome in 2026 are discussed in Section 6. The European Data Protection Board (EDPB) adopted Opinion 28/2024 on AI models and personal data in December 2024; the Opinion's cover states "Adopted on 17 December 2024", while the EDPB document page lists 18 December 2024 (EDPB, 2024).

#4.1 How models leak information

• Memorisation and extraction. Carlini et al. (2021) recovered hundreds of verbatim sequences from GPT-2, including (public) names, phone numbers and email addresses, even for sequences that appeared in only one training document, and found larger models more vulnerable. Nasr et al. (2023) report extracting gigabytes of training data from open-source, semi-open and closed models such as ChatGPT; for the aligned ChatGPT they developed a divergence attack, and they conclude that current alignment techniques do not eliminate memorisation. Carlini et al. (2022) describe three log-linear relationships: memorisation grows significantly with model capacity, example duplication and prompt context length; they add that generalising across model families is more complicated. Lee et al. (2021) report that over 1% of unprompted output of models trained on the datasets they studied was copied verbatim from training data, and that deduplication allowed them to train models that emit memorised text ten times less frequently.
• Membership inference. Given a record and black-box access to a model, decide whether the record was in the training set (Shokri et al., 2016).
• Model inversion. Reconstruct input features from model outputs (Fredrikson et al., 2015).

#4.2 Differential privacy

A randomised algorithm $\mathcal M$ is $(\varepsilon,\delta)$-differentially private if for all datasets $D, D'$ differing in one record and all output sets $S$,

Smaller $\varepsilon$ means stronger protection and, generally, lower accuracy. Abadi et al. (2016) report training deep neural networks with non-convex objectives under differential privacy "under a modest privacy budget, and at a manageable cost" in software complexity, training efficiency and model quality (abstract). Differential privacy bounds what can be inferred about any single record; it does not prevent all harms from the model's use.

#4.3 Federated learning and unlearning

Federated learning trains a shared model from decentralised data without centralising raw data (McMahan et al., 2017); it reduces data movement but does not by itself guarantee that updates reveal nothing. Machine unlearning aims to remove the influence of a data point from a trained model. Bourtoule et al. (2019) state that having models unlearn is "notoriously difficult" and propose SISA training to limit each point's influence; they report speed-ups over retraining from scratch of 4.63x (Purchase) and 2.45x (SVHN) for simple tasks and 1.36x for ImageNet. Whether approximate unlearning of a deployed large language model satisfies a legal erasure request is unsettled: no court ruling on the point was found in the sources reviewed. EDPB Opinion 28/2024 (para. 102(d), 107(b)) lists accepting regurgitation or memorisation claims, assessing "relevant unlearning techniques", and "post-training techniques that attempt to remove or suppress personal data" as possible mitigating measures to be assessed case by case; it does not hold that unlearning satisfies Art. 17. No regulator decision treating unlearning as Art. 17 compliance was located (searched narrowly; absence is not proof).

EU legal framework (as of 2026-10-18; jurisdiction: EU/EEA).

• Automated decisions. GDPR Art. 22(1) gives data subjects the right not to be subject to "a decision based solely on automated processing, including profiling" that produces legal effects or similarly significantly affects them, subject to exceptions in Art. 22(2) (contract, authorising law with safeguards, explicit consent). In SCHUFA Holding (Scoring), Case C-634/21, judgment of 7 December 2023, the Court of Justice of the EU (First Chamber) ruled that Art. 22(1) "must be interpreted as meaning that the automated establishment, by a credit information agency, of a probability value based on personal data relating to a person and concerning his or her ability to meet payment commitments in the future constitutes 'automated individual decision-making' within the meaning of that provision, where a third party, to which that probability value is transmitted, draws strongly on that probability value to establish, implement or terminate a contractual relationship with that person" (operative part, read on EUR-Lex).
• EDPB Opinion 28/2024 (cover: "Adopted on 17 December 2024"; requested by the Irish supervisory authority on 4 September 2024 under Art. 64(2) GDPR) addresses AI models. From the Opinion text: whether a model is anonymous is for supervisory authorities to assess case by case, because models trained with personal data "cannot, in all cases, be considered anonymous"; for anonymity both the likelihood of direct (including probabilistic) extraction of personal data of training-data subjects and the likelihood of obtaining such data from queries "should be insignificant", taking into account "all the means reasonably likely to be used". The Opinion recalls that legitimate interest (Art. 6(1)(f)) is assessed by a three-step test (legitimate interest, necessity, balancing against data subjects' interests and rights), with attention to data subjects' reasonable expectations. For unlawfully processed development data it distinguishes three scenarios: (1) personal data retained in the model and processed by the same controller, where the effect on later processing is assessed case by case; (2) retained and processed by another controller, who should assess whether the model was developed lawfully as part of its accountability duties; (3) the model is anonymised before deployment, in which case the GDPR would not apply to the model's subsequent operation if it is demonstrated that it entails no processing of personal data. An opinion of the Board is not itself binding law; it guides national authorities.
• Enforcement on a generative AI provider. On 20 December 2024 the Italian data protection authority (Garante) announced a EUR 15 million fine on OpenAI (order No. 755 of 2 November 2024), citing failure to notify a March 2023 data breach, processing of user data for training without an adequate legal basis, breach of transparency duties and lack of age-verification mechanisms, and ordering a six-month institutional communication campaign. The Garante's own page states the decision was later temporarily removed from its website after the Court of Rome, in judgment No. 4153/2026 published 18 March 2026, upheld OpenAI's challenge (Garante, 2024). The judgment text (R.G. 4785/2025, decided 18 March 2026) shows that the court annulled the order on its first ground: OpenAI Ireland Ltd, recognised as OpenAI's single EU establishment from 15 February 2024, brought the one-stop-shop mechanism (Arts. 60-61 GDPR) into play while the proceeding was still open, so the Garante lacked competence to adopt the November 2024 order; the remaining grounds were treated as absorbed and the court did not rule on the alleged GDPR violations (Tribunale di Roma, 2026). Whether the Garante appealed was not checked.
• AI-specific law. The AI Act (Regulation (EU) 2024/1689) operates alongside the GDPR. Its application dates were amended in 2026 (see [GOV-EU-001]); this article does not restate them.

Technical practice. Deduplication, differential privacy and access controls are research and engineering measures; which providers use which measures is generally not publicly documented and is not asserted here.

• Is a model personal data? The EDPB position is case by case (EDPB, 2024). Whether parameters that can in some cases emit personal data are themselves personal data is not resolved by a court ruling in the sources reviewed (the CJEU has not been found to have ruled on the point; searched narrowly).
• Erasure and unlearning. Exact removal from a trained model generally requires retraining; approximate unlearning methods lack agreed verification standards (Bourtoule et al., 2019). Legal sufficiency is unsettled.
• Legal basis for web-scale training. Legitimate interest has been recognised by the EDPB as potentially available but requires a demonstrated necessity and balancing (EDPB, 2024). The Garante's 2024 order found no adequate legal basis for OpenAI's training; that order was annulled on competence grounds without a ruling on the merits (Tribunale di Roma, 2026). Other national authorities' conclusions were not surveyed here.
• Cross-border competence. The Rome judgment illustrates that which authority has competence (one-stop-shop) can be decisive, independent of the merits; the court held that creation of a single EU establishment during a pending proceeding moved competence to the lead authority.
• Privacy versus fairness. Auditing for bias may require sensitive attributes (see [SAFE-ETHICS-001]).
• Accuracy cost of formal privacy. Differential privacy reduces utility as $\varepsilon$ shrinks (Abadi et al., 2016).
• Reform. The Commission's Digital Omnibus proposal amending Regulation (EU) 2016/679 and other acts (interinstitutional file 2025/0360 (COD), transmitted 20 November 2025) was still in the legislative process: a Council Secretariat note of 22 June 2026 (doc. 10729/26) sought a mandate for negotiations with the European Parliament. Secondary reports from September-October 2026 say neither Parliament nor Council had yet fixed a final position, and no adoption was found. [VERIFICATION NEEDED: status at 2026-10-18 against the Legislative Observatory and Council press releases; only secondary reports after 22 June 2026.]

As of 2026-10-18:

• That language models can memorise and emit training data, including personal information, is Well Supported (Carlini et al., 2021; Nasr et al., 2023; Carlini et al., 2022).
• That differential privacy provides a formal bound on per-record leakage is Established; its practical cost for large models is Preliminary.
• GDPR Art. 22 is in force; the CJEU held in SCHUFA (C-634/21) that a credit-agency score can itself be an automated decision where a third party draws strongly on it; the extent of its application to other AI outputs is not settled by that ruling.
• Whether models are personal data, whether unlearning satisfies erasure, and the lawful basis for large-scale scraping are Contested or unresolved.
• The one court outcome reviewed here (Garante v. OpenAI) annulled the fine on competence grounds, leaving the merits undecided (Tribunale di Roma, 2026).

This section contains no registered forecasts. Observed open questions:

• Near-term (0-3 years). Pending court and regulator decisions on model status, legal basis and one-stop-shop competence.
• Medium-term (3-10 years). Technical standards for verifying anonymity or unlearning could shape what regulators accept; none is established.
• Long-term (10+ years). Persistent personal agents with long-term memory raise new data-protection questions (see [TECH-LLM-001]).

• Foundational Concepts:
  • SAFE-ETHICS-001 AI Ethics, Bias and Fairness: The ethical framing of privacy among AI principles.
• Related Methods & Technologies:
  • SAFE-SEC-001 AI Security: Extraction and inference attacks.
  • TECH-DATA-001 Training Data, Contamination and Provenance: Data provenance.
  • TECH-LLM-001 Large Language Models: Memorisation behaviour.
  • SAFE-IP-001 Copyright and Intellectual Property: Parallel legal questions about training data.
• Advanced Implications & Future Trajectories:
  • GOV-LAW-001 Global AI Governance & Regulation: Overview of regulation.
  • GOV-EU-001 The EU AI Act: AI-specific EU law and application dates.