Data Privacy Concerns Grow as AI Continues to Advance

Artificial intelligence is becoming more capable at an extraordinary pace. It can understand behaviour, predict preferences, personalise content and increasingly make decisions with little direct input from users. That progress is creating a problem that technology companies can no longer treat as a secondary concern:

how much personal information should companies be allowed to collect in the pursuit of engagement, advertising and growth?

For smartphone users, the concern is familiar. Every search, location signal, interaction, video watched and notification clicked can help an app understand what keeps a person coming back. Technology companies often describe this as retention. The argument is straightforward: if users find an application useful and engaging, they will spend more time using it. But users increasingly see another side of the equation. More time inside an app can mean more advertisements viewed, more behavioural data generated and, ultimately, more revenue for the platform. The business model becomes particularly controversial when algorithms are designed not simply to serve useful information, but to maximise the amount of attention a person gives the platform.

Recent legal action against Meta illustrates why the debate has become so serious. In August 2026, Meta agreed to pay up to $18 billion to settle lawsuits brought by nearly all US states over allegations that Facebook and Instagram were designed in ways that encouraged addictive use among children. The settlement includes measures such as limits on teen usage, restrictions on overnight access and changes to notifications. Meta did not admit wrongdoing. The figure is striking, but the more important issue is what the case says about the economics of attention. If a platform earns money from advertising, there is an obvious commercial incentive to understand what makes people stay. The difficult question is where optimisation ends and manipulation begins. The privacy problem becomes even more complicated as AI becomes better at interpreting large amounts of seemingly harmless information.

A smartphone's location history, for example, may reveal where someone lives, works, worships, receives healthcare or spends their free time. A browsing history can reveal interests and concerns that a user may never have consciously disclosed. This is not merely theoretical. The US Federal Trade Commission accused cybersecurity company Avast of collecting detailed web-browsing information through its antivirus software and browser extensions and selling or licensing that information for advertising purposes. In 2024, the FTC finalised an order requiring Avast to pay $16.5 million and prohibiting it from selling or licensing browsing data for advertising. The Avast case is particularly uncomfortable because cybersecurity software is supposed to protect users from surveillance, not become another source of it.

And the problem does not stop with smartphones. Wearable devices can collect information such as heart rate, sleep patterns, exercise activity and location. Smart speakers can process voice commands. Connected televisions can track viewing behaviour. Electric and connected vehicles can generate detailed information about journeys and driving behaviour.

The FTC has already taken action involving connected cars. In January 2025, the agency accused General Motors and its OnStar subsidiary of collecting and sharing consumers' precise location and driving-behaviour data without adequately informing consumers or obtaining the required affirmative consent. The case continued into 2026, when the FTC finalised an order imposing a five-year ban on GM sharing consumers' geolocation and driver-behaviour data with consumer reporting agencies, alongside additional requirements covering how the company handles such information.

That illustrates a larger shift in the definition of personal data. Your personal information is no longer limited to your name, telephone number or email address. Your movements, habits, interests, health signals and behaviour can themselves become an extremely valuable digital identity. AI makes those datasets even more powerful because it can find connections that humans might miss. This is one reason Europe has moved aggressively to regulate how digital platforms treat users, particularly children.

The European Union's Digital Services Act places specific obligations on online platforms concerning the protection of minors. The rules ban targeted advertising to minors, while large platforms must also provide users with options for non-personalised feeds. The significance goes beyond advertising. A recommendation algorithm can determine what users see next, how long they remain on a platform and what information repeatedly appears in front of them. The EU now gives users of very large platforms the ability to choose a non-personalised feed rather than relying entirely on algorithmic recommendations.

Australia has gone further in one area. Since 10 December 2025, Australia's social-media age-restriction rules have required covered platforms to take reasonable steps to prevent Australians under 16 from creating or keeping accounts. The Australian government describes the measure as a world-first social-media minimum-age requirement. The policy is controversial, and questions remain about enforcement, age verification and whether restricting access is the best solution. There are also legitimate privacy questions around the technologies platforms may use to establish a user's age. But Australia has demonstrated something important: governments are increasingly willing to challenge the assumption that every user should simply accept the engagement model created by Big Tech.

Other countries should pay attention. For Africa, the issue is particularly important because digital services are expanding across smartphones, financial applications, connected devices and emerging AI products. African consumers are increasingly interacting with digital services that can generate valuable behavioural information. As wearables, connected vehicles and AI-powered applications become more common, the amount and variety of data generated by individuals will also increase.

The opportunity is enormous. So is the responsibility. Governments should establish clear rules covering what companies can collect, why they can collect it, how long they can retain it, who they can share it with and whether users can meaningfully withdraw consent. Companies should also be required to explain AI-powered personalisation in language ordinary users can understand. A privacy policy that nobody reads is not necessarily meaningful consent.

There is also a need to distinguish security from surveillance. A cybersecurity company may legitimately need certain information to detect threats. A vehicle manufacturer may need location information to provide navigation. A social-media platform may need behavioural signals to recommend content. But collecting information for a legitimate function does not automatically justify using that information for every other commercial purpose. The central question should be simple:

Does the user reasonably expect this data to be collected and used in this way?

As AI becomes more powerful, that question will become harder, not easier to answer. The next generation of privacy regulation therefore cannot focus only on data breaches and hackers. It must also address the quieter form of data exploitation that occurs when companies collect enormous amounts of information, combine it with other datasets and use AI to predict what people will do next. The technology itself is not the enemy. Personalisation can make products more useful. AI can help doctors, improve cybersecurity, optimise transport and make digital services easier to use. But technology becomes dangerous when the commercial incentive to maximise engagement becomes more important than the user's autonomy.

The growing regulatory pressure on Big Tech suggests that governments and consumers are increasingly questioning this model. The Meta settlement, EU rules for minors and Australia's under-16 restrictions all point toward a broader shift in how societies think about online platforms and their responsibilities. The future of digital privacy will not be decided simply by whether companies can collect more data. It will be decided by whether society allows them to use that data without meaningful limits, transparency or accountability. And as AI continues to advance, that debate is becoming one of the most important technology and cybersecurity questions of the decade.