"Three Privacy Problems AI Creates" is a framework attributed to Nita Farahany that argues AI produces three categories of privacy harm—inference explosion, agent cascade, and synthetic data generation—which traditional privacy law was not built to address. The framing holds that existing privacy regimes (the GDPR, California's CCPA, and FTC Section 5) assume the data being protected is data a person knowingly provided, and that each of the three problems falls outside that assumption.
Origin
The framework was introduced in Class 18 of Farahany's introductory course (November 2, 2025). It adapts Rethinking Privacy in the AI Era: Policy Provocations for a Data-Centric World, a Stanford HAI white paper by Jennifer King and Caroline Meinhardt dated February 22, 2024, and Ryan Calo's Senate testimony (July 2024). King is a privacy and data policy fellow at Stanford HAI and is also affiliated with Stanford Law School's Center for Internet and Society; Meinhardt is a Stanford HAI researcher (Source: papers.ssrn.com; hai.stanford.edu). The starting premise is that traditional privacy law assumes a person is protecting data they provided, and that AI creates three categories of privacy harm that do not fit that model.
Inference explosion
The first problem is that a small number of disclosed items can yield a much larger number of inferred ones—framed as roughly three things shared producing about 30 things AI infers, without consent. Farahany illustrates this with several examples:
- A gym selfie can be used to infer the exact gym location, income (from the gym brand), a health-consciousness score for insurers, social patterns (who else was present and when), work schedule flexibility, and relationship status (a visible wedding ring).
- A pregnancy-vitamin purchase can be matched against an algorithm of the kind Target used to identify pregnancy through a roughly 25-product pattern, estimate a due date within two weeks, and, in the framing's terms, know before the family knows.
- A mental health appointment recorded in a calendar can be used to infer mental health status, workplace stress level, insurance utilization patterns, and crisis timing.
Stanford HAI describes this as "intimate inference from ambient data," and the framework characterizes the resulting insight asymmetry as companies knowing intimate details before a person tells anyone.
Farahany argues the GDPR does not handle this well. Under Article 15 (access), companies argue inferences are proprietary analytical output rather than the subject's data. Under Article 22 (automated decision-making), minimal human involvement is argued to take the activity outside scope. Under Article 17 (erasure), deleting source data does not change the model's learned patterns.
Agent cascade
The second problem is that a single request can trigger data flow across seven or more AI systems with no point at which a human is notified or asked to consent. The framework works through the example of asking an AI assistant to book a therapist appointment:
- The AI assistant accesses the calendar (availability), location history (convenient locations), insurance data (coverage), and past health searches (needs).
- It contacts therapy-platform AIs, sharing insurance ID (income inference), preferred times (work flexibility), location needs (transportation), and urgency level (crisis severity).
- Platform AIs share with insurance AIs (pre-authorization, risk scoring), scheduling AIs (provider calendar optimization), billing AIs (rate determination), and analytics AIs (population health models).
- All systems update their models. A "mental health risk score" becomes permanent, a "treatment compliance probability" is calculated, and an employer's "population health metrics" come to include the person's data.
In the framing, consent was given to "book an appointment" but the result is cascading data sharing across multiple AI systems, each making additional inferences, each updating its models, and each potentially sharing with systems the person will never know about.
Farahany argues state privacy law does not handle this well. Under California's CCPA opt-out, companies argue agent-to-agent sharing is "service provision" rather than a "sale." A risk-benefit test is characterized as an internal process rather than an individual right, and cascades cross state lines instantly while rights do not follow.
A peer-reviewed treatment of the same problem under EU law reaches a partly different conclusion. Ana Beduschi argues that the cascade does not break the GDPR's allocation of responsibility, because only natural or legal persons can be controllers or processors and agents remain tools deployed by them; what changes is that the controller defines the purpose while the agent, in practice, shapes the means by selecting methods, task sequences and adaptive strategies (Data protection in the era of agentic artificial intelligence (Beduschi)). On her analysis the strain falls instead on the data-subject rights the cascade implicates: access shifts from explaining one output to reconstructing an evolving decision process; portability may extend beyond stored data to data about the agent's operations; and erasure runs into personal data that has already shaped an agent's evolving decision-making and "cannot simply be deleted." That reading places the enforcement difficulty in rights exercise rather than in controller identification.
Synthetic data generation
The third problem is that AI can invent "facts" about a person that the person never sees, with hallucination described as indistinguishable from memorization. The framework's example is a three-minute LLM conversation about a person's work followed by a request for a professional bio: the model confidently invents skills never mentioned, projects never worked on, accomplishments not achieved, and plausible-but-false background details. If that bio is scraped into training data, the false "facts" become permanent in the person's digital record.
Farahany argues FTC Section 5 does not handle this well. Under its deceptive-practices framing, companies disclose that an AI-generated analytical metric is "not factual," and synthetic data is argued not to be deception in the traditional sense because the AI does not "claim" the score is true. The framework also raises the GDPR Article 16 right to rectification of inaccurate data and questions whether a person can correct something that was never "collected" but rather "generated," or correct information that has not yet been spread but will be.
Why current law struggles
The framework argues the three problems share a structural feature that traditional privacy law was not designed to handle, locating the difficulty in what Stanford HAI calls the "privacy self-management" model. That model is described as assuming human comprehension at scale (while in practice nobody reads 47-page privacy policies), treating consent as binary rather than graduated or contextual, ignoring power asymmetries where take-it-or-leave-it is not really a choice, being unable to handle AI-to-AI interactions (with no human to notify), and covering only "collected" data rather than inferences or synthetic data. Farahany frames privacy law as having developed for a world where a person handed someone their information and it was filed away, and likens its application to AI to maritime law trying to regulate airplanes.
Proposed interventions
Stanford HAI proposes three interventions:
- Privacy by default — flipping from opt-out to opt-in, which limits the raw data available for inferences. The framework cites cookie-consent fatigue as an example of the friction-without-control failure mode.
- Supply chain transparency — mandatory documentation of training-data sources, with algorithmic disgorgement when documentation fails (a remedy the FTC has used).
- Data intermediaries / fiduciary duties — trusts or cooperatives acting as a person's agent, enabling collective bargaining at scale, with platforms bound by fiduciary duties to the person's interests.
Ryan Calo's statutory proposals are:
- Mandating true data minimization with hard limits (for example, that therapy apps cannot collect location data at all).
- Treating inferences as personal data with the same rights as voluntary disclosures.
- Prohibiting data misuse beyond mere deception (for example, using loneliness to sell things).
Regulatory attention to the agent cascade
Of the three problems, the agent cascade is the one data-protection regulators began addressing directly after the framework was set out, though as exploratory guidance rather than enforcement.
The UK Information Commissioner's Office published a report on the data protection implications of agentic AI in January 2026, as part of its Tech Futures series. On the question of legal basis, the report warns that explicit consent — a commonly relied-upon basis — may be difficult to obtain in the agentic context unless individuals have a genuine choice, giving as an example a system that can be used without special category data if the user prefers (Source: ico.org.uk; summarized by the law firm Covington at insideprivacy.com). The consent difficulty the ICO identifies is a narrower version of the framework's claim: not that no human is asked, but that the choice offered is not genuine.
Spain's Agencia Española de Protección de Datos has published its own guide to the data protection issues arising when controllers and processors deploy agentic AI systems (Source: aepd.es). Academic treatment has followed, including Ana Beduschi's 2026 article "Data protection in the era of agentic artificial intelligence," which works through how each aspect of data protection and AI regulation applies to agentic systems (Source: sciencedirect.com).
Relationships
- depends-on: Inside My AI Law & Policy Class 18: Data Privacy in an AI World (Farahany, November 2025) — the class in which the framework was introduced
- depends-on: AI and Privacy — the general problem the framework partitions
- instance-of: AI Governance (umbrella)
- related: Agentic AI — the agent cascade problem is specific to multi-agent delegation
- supports: Three Theories of Consent Failure (Information / Capacity / Design) — argues the "you consented when you clicked I agree" model of privacy self-management cannot carry the weight AI places on it