Deepfakes, Phrenology, Surveillance, and More! A Taxonomy of AI Privacy Risks

TL;DR

This paper develops a taxonomy of AI privacy risks based on 321 documented incidents, highlighting new and exacerbated risks from AI capabilities and the limitations of current privacy-preserving methods.

Contribution

It introduces a comprehensive taxonomy of 12 AI privacy risks, emphasizing how AI technologies create or worsen privacy concerns and exposing gaps in existing privacy-preserving approaches.

Findings

Identified 12 high-level privacy risks associated with AI technologies.

AI capabilities can create new privacy risks or worsen existing ones.

Current privacy-preserving methods address only a subset of AI privacy risks.

Abstract

Privacy is a key principle for developing ethical AI technologies, but how does including AI technologies in products and services change privacy risks? We constructed a taxonomy of AI privacy risks by analyzing 321 documented AI privacy incidents. We codified how the unique capabilities and requirements of AI technologies described in those incidents generated new privacy risks, exacerbated known ones, or otherwise did not meaningfully alter the risk. We present 12 high-level privacy risks that AI technologies either newly created (e.g., exposure risks from deepfake pornography) or exacerbated (e.g., surveillance risks from collecting training data). One upshot of our work is that incorporating AI technologies into a product can alter the privacy risks it entails. Yet, current approaches to privacy-preserving AI/ML (e.g., federated learning, differential privacy, checklists) only address a subset of the privacy risks arising from the capabilities and data requirements of AI.