Stanford HAI brief argues foundation models create privacy risks that existing frameworks such as GDPR do not address

This issue brief examines the privacy dangers that foundation models create for individuals and for society, and the governance tools that could respond to them. It focuses on large, general-purpose models that sit beneath many consumer digital products and services, and it opens with two scenarios: a fraudster cloning a person's voice from an old online video to defeat a bank's security, and a chatbot revealing personal details drawn from pseudonymous posts.

The brief concentrates on consumer-focused foundation models and argues that their reliance on enormous datasets exposes people to a wider set of privacy problems than smaller systems built on limited or proprietary data. It describes risks arising at every stage of a model's life: mass scraping of personally identifiable information for training, memorization and repetition of sensitive details in outputs, and intimate information that users disclose without realizing it through chat interfaces. It adds that these models can also be attacked through prompt injection, data poisoning and model inversion, which can get around privacy safeguards and expose personal data.

Regarding rules, the brief states that privacy frameworks already in place, the EU's GDPR among them, are basically incompatible with how such models are built, and that the EU and the United States alike lack comprehensive rules able to change developer conduct. As a result, the public mostly depends on developers choosing to protect privacy. The brief encourages policymakers to weigh measures that keep personal data out of training pipelines, require privacy and security by design, make models and their training data more transparent and interpretable, and limit outputs that infringe privacy. It also says lawmakers must confront ethical and legal questions about who can access and control personal data as adoption grows.