HOW THE POOR DATA PRIVACY REGIME CONTRIBUTES TO MISINFORMATION SPREAD AND DEMOCRATIC EROSION

Disinformation campaigns reduce trust in democracy, harm democratic institutions, and endanger public health and safety. While disinformation and misinformation are not new, their rapid and widespread dissemination has only recently been made possible by technological developments that enable never-before-seen levels of mass communication and persuasion.Today, a mix of social media, algorithms, personal profiling, and psychology enable a new dimension of political messaging—a dimension that disinformers exploit for their political gain. These enablers share a root cause—the poor data privacy and security regime in the U.S.At its core, democracy requires independent thought, personal autonomy, and trust in democratic institutions. A public that thinks critically and acts independently can check the government’s power and authority. However, when the public is misinformed, it lacks the autonomy to freely elect and check its representatives and the fundamental basis for democracy erodes. This Article addresses a root cause of misinformation dissemination —the absence of strong data privacy protections in the U.S.—and its effects on democracy. This Article explains, from a technological perspective, how personal information is used for personal profiling, and how personal profiling contributes to the mass interpersonal persuasion that disinformation campaigns exploit to advance their political goals.


I. INTRODUCTION
Since 2014, there has been a wave of disinformation by which foreign and domestic actors have launched information operations against democracies. These operations aim to influence, disrupt, corrupt, or usurp the decision-making of a targeted audience. 2 From Russian election interference to COVID-19 conspiracies and election fraud, disinformation and misinformation harm citizens' presumptive trust in democracy and democratic institutions. While misinformation is not new, 3 information is used for personal profiling, and how profiling contributes to the interpersonal persuasion that disinformation campaigns exploit to advance their political goals. While I provide various examples of disinformation campaigns and narratives, this Article is not a comprehensive analysis or summary. 11 Rather, this Article concentrates on the enablers of disinformation campaigns by foreign and domestic actors and the effect of the disinformation; it argues that Congress needs to strengthen trust and faith in our democracy and public institutions by enacting stronger data privacy and security protections.
Part II of this Article discusses disinformation campaigns. Part III details the enablers of disinformation campaigns. Part IV uses a case study to show that disinformation campaigns benefit from the current data privacy and security regime because the current regime is insufficient, causing societal polarization, and contributing to an erosion of democracy. Part IV also proposes reforms to the data privacy and security regime that, if enacted, could work to substantially curb disinformation spread online, and subsequently, preserve our democracy.
Before beginning, some definitions and caveats are in order. Disinformation is the purposeful dissemination of false information intended to mislead, deceive, or harm. 12 Related but different, misinformation is the inadvertent dissemination of false information. 13 Disinformers may produce misinformers, and shared misinformation typically originates from a disinformer. 14 While disinformation is closely linked to and often confused with misinformation, the two are notably different. However, this Article uses the terms interchangeably because it is more concerned about the spread of false information, without much regard to whether the false information is disseminated purposefully or inadvertently, and the enablers of this spread.
Even though disinformation campaigns have targeted countries around the world, this Article focuses on the U.S. for two reasons. First, there are welldocumented and publicly available investigations, research, and examples related to misinformation and its effects on the U.S. 15 Second, the enablers of misinformation dissemination are prevalent in the U.S. 16 While it is important to recognize that the U.S. is both a disseminator and recipient of disinformation spreads on social media," and how "[i]t is no surprise that a lot of the false misinformation spread on social media is deliberately spread by our enemies to sow disagreement internally in the country."); The exploitation of the poor data privacy and security regime by disinformation campaigns is not the sole cause of democratic erosion. 11 While misinformation exists in various subject matters (e.g., anti-vaccine misinformation), this Article primarily focuses on political misinformation. 12 See Harsin, supra note 3, at 8 (disinformation is a broad term that encompasses content commonly known as fake news, propaganda, parody, satire, manipulated content, false content, etc. This Article focuses on fabricated, misleading, or manipulated content). 13 Id. 14 Id. 15 See, e.g., Robert Mueller, Report on the Investigation into Russian Interference in the 2016 Presidential Election, DEPT. OF JUST. 14-35 (Mar. 2019), https://www.justice.gov/storage/ report.pdf (hereinafter "Mueller Report"). 16 See infra Part I. [Vol. 22:308 campaigns, and has deployed disinformation campaigns against foreign states to advance its own national interests, this Article focuses specifically on the American people as recipients of misinformation.

II. DISINFORMATION CAMPAIGNS
Coordinated disinformation campaigns, which have the goal of persuading, influencing, and manipulating people, are more prevalent today because the world is more interconnected than ever before. 17 Foreign and domestic actors can use these disinformation campaigns to achieve political goals. 18 In the 2016 Presidential Election, for example, Russia engaged in a targeted disinformation campaign intended to erode trust in democracy and assist Trump's campaign. 19 And in the 2020 election cycle, disinformation campaigns rapidly spread false information about in-person and mail-in voting. 20 This Part explains how disinformation campaigns work, and how they result in the further spread of misinformation downstream. Section A discusses the rise of disinformation online. Section B explains the structure of disinformation campaigns. Section C turns to research to explain why and how disinformation spreads. This Part does not analyze why actors produce and distribute disinformation, but rather presumes these motivations and interests exist and are political in nature.

A. The Rise of Disinformation Online
Coordinated disinformation campaigns are not new. 21 Foreign and domestic actors have spread false news and propaganda to Americans for decades. 22 Similarly, the U.S. government and affiliates have launched information operations 17 See generally Soroush Vosoughi, et al., The Spread of True and False News Online, SCI.
against foreign states. 23 The dissemination of disinformation, however, changed with the advent of the internet and social media. This Section discusses the evolution of disinformation and its growth in the digital landscape.
There is a long history of disinformation campaigns in the United States. In the 19th century, the Associated Press spread false news stories that led to the Rutherford B. Hayes presidency and the end of the post-Civil War Reconstruction. 24 Britain led a fake news campaign to draw the U.S. into World War II. 25 During the Cold War, the Soviet Union targeted the West with disinformation run out of Department A-the nerve center for the global network of disinformation efforts run by the KGB. 26 One example of the false narratives they pushed was when the Soviet Union tried to blame the U.S. for the HIV/AIDS epidemic, by attempting to persuade the world the U.S. released HIV as a biological weapon. 27 Domestic concern about foreign influence in elections has a similarly long history. 28 George Washington and Alexander Hamilton warned that foreign powers would seek to influence election outcomes to advance their own political interests. 29 Over two centuries later, these concerns regarding foreign interference are still valid. In  Other foreign actors, such as Iran, built disinformation campaigns that resembled the Russian efforts. 36 Iran sought to manipulate the political discourse in the U.S. by promoting Iranian-friendly policy positions, such as anti-Israeli and pro-Palestinian narratives. 37 Using stolen voter information, Iran also targeted voters with threatening emails appearing to originate from the Proud Boys (a neofascist all-male right-wing group), which instructed recipients to "[v]ote for Donald Trump or else." 38 Domestic actors have also launched disinformation campaigns against Americans to advance their own political goals. For example, following the death of George Floyd, far-right websites portrayed the Black Lives Matter protests as violent riots instigated by "[A]ntifa terrorists." 39 In addition, some conservatives shared false claims that rioters who attacked the U.S. Capitol on January 6, 2021, were members of Antifa and Black Lives Matter. 40 There is evidence such campaigns are coordinated because the disinformation often originates from only a handful of sources. A Knight Foundation study revealed, for example, that 65% of false information on Twitter originated from ten disinformation websites. 41 One of the largest disinformation disseminators is the website Infowars. 42 Alex Jones leads it. 33  Alex Jones, a conservative personality who disseminates his messages via various online platforms and pushes countless conspiracy theories and falsehoods. 43 In defending himself against defamation claims, Jones stated in court filings that his comments were "opinion, not statements of fact," and that his website, Infowars, is a "freewheeling" website that publishes content loaded with hyperbole. 44 In other words, rather than defending himself by trying to show he believed in the truth of his claims, Jones merely argued they were opinions and not fact. Such admissions highlight the fact that Alex Jones knowingly and deliberately disseminates and perpetuates disinformation, and his listeners believe it. 45 The pervasiveness of misinformation is a serious concern. Misinformation does not just undermine democracy and democratic institutions by perpetuating falsehoods; 46 it can also jeopardize public health and safety. For example, nefarious actors spread disinformation during the COVID-19 pandemic, including falsehoods about how the virus is transmitted and about the origins of the virus. 47 False and misleading information regarding the pandemic led to unnecessary transmissions, hospitalizations, and deaths. 48 The pervasiveness of misinformation also prompts the question of how and why it spreads, especially when some are apt to dismiss the misinformation as a falsity. Before turning to how and why misinformation spreads, it is important to explain the anatomy of disinformation and disinformation campaigns.

B. The Anatomy of Disinformation and Disinformation Campaigns
Disinformation and disinformation campaigns are frequently structured in a common manner. To understand this structure, this Section explores what do disinformers do, and how they do it. The common structure of disinformation Raw Materials Production Distribution Consumption Figure 1: Disinformation Supply Chain.
The first stage of the disinformation supply chain is the "raw materials." Although deceitful information is an important ingredient, disinformation is not always based on complete fabrication. That is, disinformation may carry some level of true information 50 which is then pieced together to distort reality or create false impressions. 51 For example, much of the disinformation disseminated by Trump's 2020 campaign relied on some kernel of truth. 52 The Trump campaign produced multiple short videos by editing clips of Joe Biden to create a false narrative about Biden's cognitive decline or mental state. 53 The videos were not complete fabrications, because Biden had in fact made the statements as shown in the viral clips. But the Trump campaign misled and deceived viewers by applying false captions that purposefully mischaracterized Biden's mental capacity. 54 Thus, some level of true information is often the first ingredient of disinformation.
The second stage of the supply chain is "production" whereby foreign and domestic actors frequently manufacture disinformation. 55 This can include both creating content and purchasing advertisements on platforms such as Facebook. The end-products may include fabricated content, content employing a misleading context, manipulated content, or content with headlines that misrepresent what is actually portrayed (this is sometimes referred to as "false connection"). UNIV., Oct. 2018 at 4, https://web.stanford.edu/~gentzkow/research/fake-news-trends.pdf?mod= article_inline [hereinafter "Trends Report"] (measuring the trends in false content, fake news websites, and fake news stories on Facebook and Twitter); Brennen, supra note 47, at 1 (describing his study that found "most (59%) of the misinformation in our sample involves various forms of reconfiguration, where existing and often true information is spun, twisted, recontextualized, or reworked."). 51  Genuine content is shared with false contextual information.
Genuine information or imagery is manipulated.
Slogans or statements coupled with images, or videos that convey a message.
The creation of false personas or account using real (stolen) or fake identities. Distribution is the third stage of the supply chain. Disinformers have various distribution networks, 61 and individuals may consume the disinformation via traditional channels of communication (e.g., newspapers, cable news, etc.) or digital ones (e.g., mobile news applications, social media, etc.). 62 Often, disinformers disseminate the disinformation via one channel of communication before it spreads to other channels. 63 The kind of spread often takes the form of misinformation, i.e. the inadvertent sharing or resharing of false information. 64 There are four pathways by which misinformation can spread. 65 I plot these pathways on an x-y plane wherein each quadrant of the graph represents one of the pathways (see Figure 3). The x-axis represents the extent to which traditional media is used to disseminate the misinformation. The y-axis plots the extent to which 56   Quadrant I reflects misinformation that spreads widely and deeply on social media with some traditional media spread. An example is the QAnon conspiracy theory, which alleges the world is run by a cabal of Satan-worshiping pedophiles who operate a global child sex-trafficking ring. 67 While the traditional media discussed QAnon in the weeks leading up to and following the 2020 U.S. presidential election, the QAnon conspiracy theory began on fringe online message boards as early as 2016 before spreading to mainstream social media. 68 Facebook and Twitter then saw QAnon discussions develop on their platforms as early as 2018-two years before traditional media reported on QAnon. 69 Quadrant II reflects misinformation that spreads equally through both digital and traditional media. Mail-in voter fraud conspiracies are an example. Ahead of the 2020 U.S. presidential election, President Trump, the Republican National Committee, and conservative websites claimed that mail-in ballots would lead to voter fraud resulting in a "rigged election." 70 These same actors continued to bolster 66  such claims post-election. 71 These false claims were shared broadly on social media and covered extensively by the traditional media. 72 Quadrant III represents misinformation that circulates via digital media and traditional media, but does not spread widely, if at all. Quadrant III misinformation often remains in the "fringe" sections of online forums, blogs, etc. One example is the Hunter Biden "PornHub" narrative constructed by Gateway Pundit. 73 Before discussing the narrative itself, I advise the reader that Gateway Pundit is not a credible source of information. 74 Its content has consistently been debunked, and Newsguard, a journalism trust rating organization, gave Gateway Pundit a failing score of 20/100 for trustworthiness. 75 Gateway Pundit claimed that it discovered Hunter Biden's personal account on PornHub.com, which allegedly contains videos showing Hunter Biden engaged in "depraved activities" with "seedy people in seedy places." 76 The publisher argued that this discovery was proof of the clear cover-ups by the Biden family to hide depraved behavior, but as of March 15, 2021, none of Gateway Pundit's allegations have been substantiated. 77 This false narrative falls into Quadrant III because the allegations have not spread widely via digital or traditional media channels.
Quadrant IV represents misinformation that circulates widely via traditional media, but digital media acts only as an auxiliary pathway. Sinclair Broadcast Group ("Sinclair"), the owner of 193 local television affiliates, provides an example 71 See, e.g., Christina Cassidy & Mary Clare Jalonick, Senate Hearing Elevates Baseless Claims of Election Fraud, ASSOCIATED PRESS (Dec. 16, 2020), https://apnews.com/article/election-2020joe-biden-donald-trump-senate-elections-elections-c827ef1b2d0415383dff4aa881d7d3fe (recapping a Senate Homeland Security and Governmental Affairs Committee hearing where Republican senators continued to perpetuate false claims of voter fraud). 72 See Benkler, supra note 5, at 6-13 (quantifying and comparing the spread of mail-in voter fraud disinformation via social and mass media). 73  of such disinformation. 78 Sinclair was criticized for requiring its local news anchors to express specific narratives on-air that were designed to strengthen Sinclair's position on various issues." 79 For instance, in 2008, Sinclair ran an ad attempting to tie then-Senator Barack Obama to Weather Underground terrorist Bill Ayers; the ad declared that Obama was "friends with Ayers" and his political career began in Ayers home. 80 This false narrative, among many others propagated by Sinclair, began on traditional media (e.g., local television stations). In this quadrant, the false narrative may spread via digital media, but the misinformation originates from and primarily spreads through traditional media.

C. The Research of Disinformation
By illustrating the creation of disinformation as a supply chain and conceptualizing how false information spreads via traditional and digital media, one can better understand the different ways that disinformation spreads. Studies suggest, for example, that disinformation spreads faster and wider than the truth. 81 This Section briefly examines some recent studies that demonstrated this phenomenon.
Some studies show how disinformation spreads more quickly than the truth. As a postdoctoral associate at MIT Media Lab, Soroush Vosoughi investigated the spread of false information. 82 This research suggested that false information spreads more quickly than the truth-approximately six times faster. 83 In the study, true information on Twitter took about six times longer to reach 1,500 accounts than false information did. 84 78 See generally Dominic Rushe, Trump Defends Rightwing TV Network Sinclair after 'Fake News' Script Goes Viral, GUARDIAN (Apr. 2, 2018), https://www.theguardian.com/media/ 2018/apr/02/sinclair-trump-video-script-fake-news-president-defends-tv-news-twitter (describing how Sinclair Broadcast Group required its anchors to read an identical script criticizing fake news). 79 83 See Benkler, supra note 5, at 3. 84 Id. at Figure 2F.
Furthermore, disinformation appears to spread wider than true information. 85 A study comparing fake and true news on Facebook during the 2016 U.S. presidential election found that the top fake stories drew more user engagement than true news stories by a margin of 7.3-8.7 million, measured by the number of shares, reactions, and comments on the stories. 86 This trend continued into the 2020 U.S. presidential election, during which President Trump's false attacks on mail-in voting generated approximately 3.8 million interactions on Facebook. 87 Breitbart, a conservative website that has been repeatedly criticized for reporting false or misleading narratives, had more engagement on its voting-related stories than any other publisher from April through July 1, 2020. 88 Research also suggests that disinformation frequently reaches users that other content does not. 89 Here, the disinformation distribution contributes to the breadth of the consumption. The Vosoughi study suggested that the users who spread false information had significantly fewer followers, followed significantly fewer people, were significantly less active on Twitter, verified significantly less often, and had been on Twitter for significantly less time. 90 Therefore, in order for disinformation to reach more users, the false information is shared more often to reach the widespread target audience compared to true information. 91 (discussing an internal Facebook study that found Facebook's "algorithms exploit the human brain's attraction to divisiveness"). 86  In addition, the Vosoughi study suggested the quantity of disinformation has increased since 2006 and generally spikes around major news events. 96  With the rise in production of disinformation and its spread, this prompts a new question that is not often explored by researchers and scholars: what enables the disinformation campaigns to spread false or misleading information more effectively than true information? The next Part explores the enablers of disinformation.

III. THE ENABLERS
The rise of social media amplifies the negative consequences of misinformation; but for these recent technology advancements, the ability to persuade a large mass of people with disinformation campaigns in order to achieve political goals would not be possible. This Part argues that social media platforms enable misinformation to spread much more effectively because they 1) are widespread, 2) are addictive, and 3) personalize content, leading to echo chambers and rapid misinformation spread. Finally, it argues that this is only possible because of the weak data privacy regime in the United States.

A. Social Media Platforms Are Widespread and Addictive
Social media's broad reach explains why these platforms enable the spread of disinformation. While studies vary, on average about two-thirds of American adults say that they get news from social media. 98 Facebook has approximately 2.7 billion monthly active users. 99 Twitter reports that it has 187 million "monetizable" daily active users. 100 This data shows that social media reaches billions of people every 94 Id. 95  day, and similarly, it suggests that social media platforms are successful at maintaining user engagement. Further, many social media platforms have features, like "single sign-on" capabilities, that allow other developers to build on top of the platform. These technologies make social media more "sticky" in that users are less likely to delete their accounts because of the widespread integrations. 101 In addition to the broad reach, social media is addictive and stimulates humans in a subconscious and hormonal way. 102 For instance, social media use can trigger a release of oxytocin-the human stimulant of empathy, generosity, and trust. 103 Users may experience symptoms similar to other addictions, including withdrawal, relapse, and mood modification. 104 Some researchers argue that social media's features can be a form of operant conditioning. 105 Users associate behaviors with consequences; when an action is followed by a pleasant consequence, it is likely to be repeated. 106 So, when a user posts a picture and receives a "Like", they are likely to repeat this engagement because the user's action receives positive reinforcement. More specifically, the positive reinforcement is a dopamine hit-meant to "hook" the user to the platform. 107 Indeed, social media platforms have designed their products and features to reinforce engagement by "hooking" the user. 108 Recognizing that engagement increases when users have an emotional response to the content, social media has developed methods to detect their users' emotions. 109 Further, emotional detection may inform what content the user sees. 110 Thus, two contributing factors to why social media helps disinformation spread so effectively are its breadth and addictive nature. This means that unlike other 101 See, e.g., Jessica Dolcourt, Facebook Introduces Single Sign-On for Mobile Apps, Services, CNET (Nov. 3, 2010), https://www.cnet.com/news/facebook-introduces-single-sign-on-for-mobile -apps-services/ (describing Facebook's launch of the single sign-on feature); Jason Aten, Google Suffered a Major Outage. It Turns Out This Simple Step Could Have Prevented It, INC. (Dec. 14, 2020), https://www.inc.com/jason-aten/google-suffered-a-major-outage-it-turns-out-this-simplestep-could-have-prevented-it.html (describing the thirty minutes on December 14, 2020, where Google's services were down or inaccessible, including its SSO feature that crippled any third-party website that utilized Google's SSO). 102  traditional media platforms, disinformation can spread more to a much broader social graph, and users may feel emotional or hormonal responses to the content they see.

B. Social Media Platforms Profile Users and Personalize Content
This Section discusses how social media platforms profile their users. It first discusses how the platforms construct personal profiles, before detailing how they use them. Social media platforms create personal profiles of their users, and then use those profiles to present personalized content to those users. 111 For example, a Twitter user's timeline used to show tweets in reverse-chronological order (from most recent to the oldest). 112 But since 2017, Twitter has used machine learning (i.e., artificial intelligence) to determine what content appears on each user's timeline on an individualized. 113 Though Twitter and other social media platforms do not use the terms "personal profiles" or "personal profiling," the technologies that power social media platforms do exactly that. 114 First, Twitter and other social media platforms collect, procure, and generate data about each user. 115 This data includes how the users interact with the platform, such as their clicks, shares, retweets, views, scrolling patterns, reading rates, and more. 116 With this user data, the platforms construct personal profiles about each user. 117 Such profiles can reveal a user's habits, social relationships, tastes, political preferences, thoughts, opinions, and more. 118 Once personal profiles are created, the platforms leverage a user's personal profile to automatically curate, and even generate, content. 119 The curated or autogenerated content is then presented to the user. 120  Attracting and keeping users' attention is critical to the social media's business models. 122 For instance, investors gauge Facebook's performance by evaluating its user engagement metrics, such as its daily and monthly active users. 123 Facebook monetizes user engagement via advertising, and its advertising business generates approximately 98.5% of its annual revenues. 124 And content curation or personalization promotes user engagement on social media platforms. 125 To maintain or increase user engagement, social media platforms leverage the personal profiles by applying algorithms to identify and present content that is interesting or engaging to the user. 126 How does using personal profiles to curate content help spread disinformation? When users see content tailored to their interests, they are much more likely to fall into a rabbit hole of disinformation. This may become a negatively-reinforcing cycle because as users interact with disinformation, they become more likely to see further disinformation. 127 This contributes to the "echo chamber" effect-where information is more likely believed opposing viewpoints are presented less frequently. 128 This phenomenon is even more concerning when one considers the research on how humans utilize their analytical judgment. Under a psychological theory known as the "dual process theory," humans have two systems of thinking: (1) they process ideas automatically using little effort, and (2) they process ideas using analytical processing that requires significant effort. 129 Humans tend to default to the former system (often called "System 1") because they are "cognitive misers." 130 In other words, humans tend to solve problems in simple and straight-forward ways rather than use more effort-intensive ways (i.e., critically analyze an issue). 131 Therefore, it is much easier to believe disinformation when it is presented repeatedly than it is 121 Id. at 232. 122 See id.; see also Deibert, supra note 102, at 33. 123 See generally Facebook, Inc., Annual Report (Form 10-K) (Jan. 30, 2020) (stating that Facebook's total revenue was $70.70 billion, of which $69.66 billion came from its advertising business) [hereinafter "Facebook 10-K"]. 124  to critically question its validity. In addition, humans are more susceptible to disinformation because of the tendency to default to System 1.
Second, humans are susceptible to confirmation bias. This is the tendency to believe information that confirms your existing beliefs and to reject contradictory information. 132 So, when a user sees the same curated disinformation repeatedly, in the user's mind, it confirms that the disinformation is true-in this way using personal profiling to curate content can actually help make disinformation more believable.
Both dual process theory and confirmation bias lead to lazy thinking, where information is not challenged critically, analytically, or logically. This type of lazy thinking is a key factor in users' vulnerability to misinformation. 133 While some scholars and policymakers argue users have or should have the analytical judgment to decipher truth from fiction, 134 the January 6, 2021, attack on the U.S. Capitol by Trump supporters, who legitimately believed his election fraud claims, suggests otherwise. 135 President Trump's tweets are a great example here. Prior to the suspension of President Trump's account, his posts and shares contained misinformation, and these tweets would go viral-reaching millions of people around the world. 136 With Twitter's algorithmic design that prioritizes tweets by relevance and popularity, President Trump's tweets spread rapidly because of the aforementioned technical and human factors. 137 As the Brookings Institute highlighted, "Since [humans are] more likely to react to content that taps into our existing grievances and beliefs, inflammatory tweets will generate quick engagement." 138 As user engagement increases, so does its popularity and relevance to specific users-this is where the algorithmic design amplifies the message's spread. 139 Further, this cyclical pattern contributes to societal polarization because the curation taps into existing 132 Shane, supra note 129. 133  Here, social psychology helps explain how platforms influence society as a whole. The law of group polarization explains how extremism, radicalization, cultural shifts, and the like occur and how they are fueled by social media. 141 Group polarization happens when people who have a broadly similar opinion regarding a topic come together, but some have more extreme views than others. 142 Oftentimes, group decisions trend towards the more extreme view or perspective, and the group members who originally had a less extreme view become more radicalized. 143 While historically, it took significant time to radicalize the masses, social media platforms have shortened the timespan because more extreme views are shared more quickly, widely, and broadly. 144 To conclude, social media platforms enable disinformation to spread very effectively. They do so because of their size, stickiness, and addictive nature. And most prominently, they do so by using personal data to profile users and curate the content each user sees. Such content curation leads to users who interact with some disinformation seeing much more, which helps confirm in their minds that this disinformation is true. This is done automatically at an unprecedented scale using the algorithms that power social media's key features.

C. This Is Only Possible Due to a Weak Data Privacy Regime
As argued by the previous Section, social media platforms' ability to use personal data for content curation leads to an environment in which disinformation can spread very effectively. This Section argues that this is permitted by the weak data privacy regime in the United States. Indeed, the lack of limits on these platforms' abilities to use personal data is a root cause of the disinformationfriendly environment they create.
The present data privacy and security regime in the U.S. is a patchwork of federal and state laws, rules, and regulations. 145 Data privacy and security protections are found in federal constitutional law, state constitutional law, and sector-specific legislation. 146 The U.S. Constitution, for example, provides certain

Charles Arthur, Social Media Polarises and Radicalises -and MPs Aren't Immune to its
Effects, GUARDIAN (Mar. 11, 2019), https://www.theguardian.com/commentisfree/2019/mar/11/ whatsapp-facebook-extreme-polarise-radicalise-mps-politicians. 141  privacy rights, but only against state actors. 147 Certain federal statutes, such as the Health Insurance Portability and Accountability Act ("HIPAA") and the Gramm-Leach-Bliley Act ("GLBA") protect consumer privacy, but only within specific industries. 148 At the state level, the California Consumer Privacy Act ("CCPA") is generally considered the most comprehensive data privacy and security state statute in the U.S. 149 A common thread amongst the constitutional, statutory, and regulatory privacy and security protections is the reasonable expectations of privacy standardwhether an individual has an objectively reasonable expectation of privacy with respect to the data at issue. 150 While the reasonable expectation of privacy standard stems from federal constitutional law, this standard is generally considered a foundational inquiry to any assessment of privacy protections. 151 With constitutional protections, the reasonable expectation of privacy standard is found throughout Fourth Amendment jurisprudence. 152 With statutory protections, the rights and protections are often, if not always, based on this standard. 153 For example, one has a reasonable expectation of privacy with respect to one's personal health information, and accordingly, Congress enacted HIPAA to protect the privacy and security of this information. 154 Statutory protections also promote the reasonable expectation of privacy-individuals expect their personal health information to be protected because HIPAA exists today. 155 The 116th Congress proposed several comprehensive data privacy and security bills that were inspired by the reasonable expectation of privacy-what information do individuals expect some level of privacy and how should it be protected? While the 116th Congress proposed these bills, none were enacted. 156   There are three types of digital personal information: user-inputted, queried, and autogenerated data (see Figure 4). 159 User-inputted data is information that the user provides to the data collector (e.g., entering one's date of birth on Facebook). 160 Queried data is procured from a data supplier (i.e., purchasing credit reporting data), and autogenerated data is created and collected via automation (e.g., behavioral analytics). 161

Description
Source of Data Example(s)

User-Inputted Data
The data that a user provides the data collector.
User Name, Address, Phone Number, Zip Code

Queried Data
The data that a data collector sources.

Internal Systems or Third Parties
Credit Report and Score

Autogenerated Data
The data that is created and collected via automation.

Internal Systems or Third Parties
Behavioral Analytics, User Interactions The current data privacy and security regime is weak because (i) the current patchwork of protections is not comprehensive and all-encompassing, and (ii) it is only beginning to recognize these three data types. I discuss these in turn.
Unlike the patchwork data privacy and security regime in the U.S., the European Union has the Global Data Protection Regulation ("GDPR") that provides broad data privacy and security protections. GDPR contains provisions that effectively limit the ability to micro-target on social media platforms. 163 For instance, GDPR substantially limits the collection of personal information from any device in Europe. 164 Further, social media platforms can be held jointly liable for 158 See generally Katz and COVID, supra note 115. 159 Id. at 47. 160 Id. 161 Id. 162 Id. at 48. 163 Feb. 18, 2018), https://www.cfr.org/blog/ could-europes-new-data-protection-regulation-curb-online-disinformation. 164 Id. [Vol. 22:308 third parties on whose behalf they furnish data if those third parties do not comply with GDPR's requirements. 165 Generally, one of GDPR's main objectives is to limit the misuse of personal information. 166 This includes the use of personal information to profile users-thus, limiting the ability to curate the personalized content to the specific user. By limiting access to the personal information that enables the personalized and targeted content, which perpetuate polarizing echo chambers, comprehensive and robust data privacy laws can "render disinformation a weapon without a target." 167 Furthermore, the legal system in the U.S. is only beginning to recognize the three data types. Each data type carries a different set of privacy expectations. The present regime is weak because it barely recognizes how each type of data can and should be protected.
Take, for example, the third-party doctrine; while the third-party doctrine only applies to government actors under the Fourth Amendment, the doctrine generally provides that a person has no legitimate expectation of privacy in information he voluntarily turns over to third parties. 168 By definition, information that an individual voluntarily turns over to third parties is user-inputted data.
However, Supreme Court recognized that even though a third party holds cellsite location information ("CSLI"), "the unique nature of cell phone location records" places the data within the Fourth Amendment's protection. 169 The Court reached this conclusion because CSLI is highly personal, voluminous in nature, and inexpensive for the state to obtain, the third-party doctrine should not extend to all cases where a third party holds information on the data subject. 170 It is important to point out that CSLI is not user-inputted data, but rather autogenerated data, because, like in Carpenter, the user does not affirmatively act to submit the data to the third party.
Before continuing, I note two important observations regarding Carpenter. First, even though the Court considered the third-party doctrine, it should have been irrelevant in scenarios like Carpenter, where the data at issue is autogenerated, because definitionally, the doctrine should only apply to user-inputted data. Second, Carpenter demonstrated that the Court is beginning to recognize the three data types because it afforded autogenerated data greater privacy protection than user-inputted data. While the Court did not use the terms "user-inputted" or "autogenerated" data nor did it distinguish data types in its reasoning, the Court 165  effectively and properly recognized that privacy expectations differ. And in essence, assigning a higher level of protection to autogenerated data versus userinputted data provides for a more robust data privacy regime.
Consider this, if the same CSLI at issue in Carpenter was user-inputted, not autogenerated, then the third-party doctrine would easily apply. Thus, the distinction between data types is important in determining the appropriate level of privacy protection.
Turning back to personal profiling and the platforms' algorithms, both require substantial amounts of PI from all three data types. However, personal profiling relies heavily on autogenerated data, which should receive the greatest protection under a more robust data privacy regime.
Notwithstanding the fact that no comprehensive data privacy and security protections exist today, a regime that is only beginning to recognize the three distinct data types falls short in providing truly effective privacy protections. Because the current data privacy and security regime is weak for the foregoing reasons, social media platforms can continue to collect and use the substantial amount of PI from all three data types with little to no limitations. Thus far, this Article has worked to familiarize the reader with the definition and structure of disinformation campaigns. This foundation will help facilitate an understanding of how disinformation campaigns exploit platforms' personal profiling and algorithms.

IV. CASE STUDY: HOW THE WEAK REGIME HELPED ENABLE THE 2020 ELECTION DISINFORMATION AND HARMED AMERICAN DEMOCRACY
The previous Part explored why disinformation spreads so effectively and how social media platforms enable this by curating content using personal information. It also argued that the weak data privacy and security regime is a root cause. By using the 2020 U.S. presidential election as a case study, this Part demonstrates these dynamics in action. In doing so, it also explores how disinformation campaigns can erode democracy and harm our democratic institutions. Donald Trump's preand post-election campaign about widespread voter fraud and the 2020 presidential election being rigged against him is a fitting example of a disinformation campaign enabled by personal profiling and weak data privacy. 171 To quickly summarize, President Trump, conservative media outlets, and some Republicans falsely claimed that widespread voter fraud led to Joe Biden's win; [Vol. 22:308 they claimed that Democrats rigged the presidential election. 172 While the election fraud disinformation contained some level of truth in its messaging, the messaging was largely not true for the matter asserted because there was no verifiable or reliable evidence of systemic election fraud. 173 Accordingly, the end-product (e.g., disinformation messaging) was false or misleading. 174 President Trump disseminated his election fraud disinformation campaign 175 through traditional and digital media pathways. While President Trump relied on Twitter to spread his false messaging, traditional media reported heavily on his false claims. 176 As President Trump and other conservatives distributed their election fraud disinformation through social media, 177 Trump's White House staff distributed messaging via official press communications, and third-party platforms (e.g., Fox News) distributed the campaign via their platforms and channels. 178

A. Social Media Platforms and Personal Profiling Helped This Disinformation Spread Effectively
The election fraud campaign's main message spread quickly and widely. 179 For example, one of Trump's election disinformation tweets collected at least 1.1 million favorites and 884,500 retweets. 180 The live broadcast of President Trump's 172

See generally Maryclaire Dale, Trump's Legal Team Cried Vote Fraud, but Courts Found
None, ASSOCIATED PRESS (Nov. 22, 2020), https://apnews.com/article/election-2020-donald-trumppennsylvania-elections-talk-radio-433b6efe72720d8648221f405c2111f9 (describing the Trump campaign's legal challenges regarding the election results). 173 See id. 174 See supra Figure 1. 175 For the remainder of this Part, I refer to this campaign generally and employ the past tense even though the false messaging continues to spread as of the time of writing. 176 See supra Figure 3; 181 Here, the social media platforms' rapid cycle and huge social graph added fuel to the spread.
Personal profiling and content curation by social media platforms also contributed to this spread. 182 Individuals who interacted with the misinformation by liking, retweeting, or sharing the content were more likely to see more of the same content. 183 As Twitter's engineers explicitly stated, "The [algorithmic] model's score predicts how interesting and engaging a Tweet would be specifically to you." 184 This depends on personal data-for a social media platform to "predict how interesting and engaging" content will be, the platform tracks users' behaviors, interactions, and engagements with the content. 185 If a voter interacted or engaged with content related to Trump's election fraud campaign on a social media platform, by algorithmic design, the voter was more likely to see additional content on the same topic.
Social media platforms can recommend "interesting and engaging" content because the platforms can collect the different types of user data. 186 For instance, autogenerated data, such as a user's likes, shares, and retweets, is used to build a personal profile for each user; this data feeds the algorithms that determine what content is shown. The lack of data privacy protections allows the platform to collect such data and couple it with other information inputted by the user or procured from third parties in order to present more content that is "interesting and engaging." So, the platforms that prioritized the election fraud disinformation were able to do so because the platform could collect the vast amount of personal information. There were little to no comprehensive data privacy protections to prevent that from happening.

B. This Disinformation Hurt American Democracy
The danger with the Election Fraud Campaign's misinformation is an erosion of democracy, its principles, and its institutions. The January 6, 2021, attack on the U.S. Capitol was just one manifestation of this danger as it showed the sheer number of people who legitimately believed the misinformation's core narrative. But disinformation about the 2020 election had other erosive effects: it tainted the 1324032541544927233?s=20 (collecting nearly 200,000 retweets and 623,300 favorites-"They are finding Biden votes all over the place . . . ."). 181  marketplace of ideas, delegitimized of the press, and damaged trust in the integrity of a democratic election.
First, the election fraud campaign's misinformation tainted the marketplace of ideas. The idea behind this model is that truth will ultimately prevail over false information in the marketplace of ideas. 187 Though some amount of false or misleading information is inevitable and expected, the presupposition of the marketplace model is that the false or misleading information is fairly countered with true information. 188 However, from the individual's perspective, the election fraud campaign's misinformation flooded the marketplace of ideas because the enablers allowed for it. 189 In general, misinformation overwhelms the marketplace of ideas when the misinformation is prioritized because it is more "interesting and engaging." Significant content curation may lead to false or unbalanced perceptions. By presenting users only with content they are predisposed to find interesting or engaging, social media platforms actually promotes lazy thinking. 190 When users are shown content that is interesting or engaging, like the election fraud disinformation, they are more likely to believe the curated content because humans are cognitive misers: due to confirmation bias, users are more likely to believe the curated content is true because it is familiar, feels right, and is understandable. 191 Put another way, from a user's perspective the marketplace of ideas is overwhelmed by one narrative of information. The opposing narrative is deprioritized or curated out. Consequently, the user sees a disproportionate amount of content that supports the first narrative rather than the opposing one. As a result, the user may form a misperception or false belief (e.g., that the 2020 election was stolen from President Trump).
Second, the election fraud disinformation campaign delegitimized the press. This was not a new trend; President Trump and others attacked traditional media long before the election fraud campaign began. This delegitimization erodes the trust and faith that individuals place in the democratic institution tasked with informing the public (the press). An informed citizenry, empowered by the freedoms of the press, is a foundational requirement of a vibrant democracy. Thus, a delegitimization of the press harmed American democracy.
The spread of disinformation over social media platforms has helped enable this delegitimization, and it has benefited from it. This delegitimization of traditional media leaves a void that digital media has filled. Social media platforms allow 187 See generally Lee Levine, et al., Newsgathering and the Law, § 1.01 (5th Ed. Matthew Bender & Company 2018) (describing the marketplace model); Abrams v. United States, 250 U.S. 616, 630 (1919) (Holmes, J., dissenting) ("the ultimate good desired is better reached by free trade in ideas-that the best test of truth is the power of the thought to get itself accepted in the competition of the market . . . ."). 188 See Bobbitt, supra note 171. 189 See supra Part II. 190 See id. 191 See id.
individuals to easily distribute information, regardless of whether it is true or false. 192 Because President Trump had for so long attempted to delegitimize the press, in the eyes of some Americans, it was difficult for the press to effectively combat his election fraud campaign. 193 President Trump consistently and pervasively called traditional media "fake news" and the "enemy of the people." 194 These attacks had dangerous effects on what and whom individuals believed. Countless comments from Trump supporters suggest that they believe the false information from President Trump, his campaign, and the Trump White House. 195 In effect, President Trump eroded democracy and its principles by delegitimizing traditional media and pumping misinformation regarding the pandemic into the civic discourse. This disinformation campaign handicapped the press's role in checking government and officials, limiting its ability to hold the government to account. Here, millions of voters refused to believe anything the press reported, which in turn, hurt the democratic function of the press. Third, the tainting of the marketplace of ideas and delegitimization of the press led some voters to lose faith in the integrity of a democratic election. 196 Many of the January 6 insurrectionists demonstrated this loss of trust and faith when they 192 Id. 193 See Wayne Rash, As the U.S. Prepares for COVID 19 Disinformation Stokes Panic and attacked the U.S. Capitol while falsely claiming election fraud. 197 The election fraud disinformation campaign's core narrative was that the 2020 U.S. presidential election was tainted by rampant voter fraud. Social media platforms' algorithmic design and content curation perpetuated this false narrative by presenting it to users whose personal profiles suggested that they would find this false narrative interesting or engaging.
Believing the misinformation and rejecting the truth has dangerous consequences. 198 The Trump campaign challenged the election results in the courts, but the courts that ruled on merits of the Trump campaign's claims flatly rejected its baseless allegations. 199 Still, many of Trump's followers pressed forward, despite the courts' rejections. 200 Although a majority of Americans are confident in the result of the 2020 Presidential election, "most Trump voters think Biden's victory is due to voter fraud." 201 In summary, the election fraud disinformation tainted the marketplace of ideas with the help of the enablers while delegitimizing the press that is tasked as the check on government; consequently, many individuals wrongly believe(d) that an election was not fair. 202 All of this-the disinformation campaign, its false narratives, and its effects-culminated in the January 6, 2021, attack on the U.S. Capitol. 203 This insurrection demonstrated the dangerous consequences of disinformation campaigns. Hundreds, maybe thousands, of individuals who believed the election fraud campaign's core message gathered in Washington D.C., marched to the U.S. Capitol, attacked law enforcement, and forced their way inside the Capitol building. 204 As harmful as it was, the election fraud disinformation campaign is far from the only example. 205 Accordingly, the 116th and 117th Congresses have explored legislative and regulatory changes to combat the disinformation on digital platforms, such as regulating the content itself; how a platform identifies, detects, or moderates misinformation; and changes to § 230 of the Communications Decency Act ("CDA" or "Section 230"). 206 The next Part examines these proposals and recommends a path forward.

C. Legal Solutions to Disinformation Campaigns
This Part begins by examining various proposals from practitioners, scholars, and policymakers regarding policy reforms to combat the issue of misinformation. It argues that their proposals are insufficient or ineffective. It then argues that comprehensive data privacy and security protections are necessary to mitigate the damage caused by foreign and domestic actors and their disinformation campaigns.

Regulating the Content Is Insufficient
Since Russia's disinformation campaign during the 2016 U.S. presidential election, the federal government has sought to curb misinformation on social media platforms. 207 Specifically, Congress and scholars have explored amending Section 230, regulating content itself, and setting rules for how platforms identify, detect, or moderate misinformation. 208 While any effort by Congress or industry practitioners to help mitigate misinformation online is welcome, none of the regulatory, legislative, or technological proposals will sufficiently combat the problem. This Section discusses three proposals in particular. It argues that these proposals are insufficient because none of them address the poor data privacy and 204 Id.; see Rebecca Harrington, et al., 420 People Have Been Charged in the Capitol [Vol. 22:308 security regime in the U.S., which is a critical root cause that enables disinformation to spread, and instead focus on the content itself.
First, the 116th Congress explored amending Section 230. Section 230 grants broad immunity to digital media platforms, preventing them from being held liable for the content that third parties post or upload. 209 Both Republicans and Democrats in the 116th Congress agreed that Section 230 reform may be necessary, but policymakers cannot agree on what these changes should be. 210 Many Republicans have argued that Section 230 allows digital media platforms to infringe on free speech, and President Trump even called for its outright repeal. 211 Senator Ted Cruz (R-TX) for instance, argues that social media platforms "collectively pose the single greatest threat to free speech in American and the greatest threat we have to free and fair elections." 212 Accordingly, Congressional Republicans have proposed limits to the right of who the platforms can exclude, narrowing content moderation rights to specific types of speech not protected by the First Amendment, and removing protection for discriminatory content moderation decisions. 213 Senator Lindsey Graham (R-SC), however, does not support the repeal of Section 230 and argues instead that social media platforms should self-regulate. 214 Democratic senators also criticize and propose reforming Section 230. They argue that the industry's business model incentivizes platforms to keep their users engaged as much as possible, 215 and also that the platforms should increase their efforts in identifying and labeling misinformation. 216 Some Democratic proposals have included removing protection for any kind of paid speech (e.g., advertising) and increasing the responsibility of platforms in identifying and removing offensive, abusive, or illegal content. 217 Both parties' proposals for Section 230 reform would likely be insufficient and ineffective at combatting the spread of disinformation. Proposals that include or rely on industry self-regulation are flawed because social media platforms are not incentivized to make changes to their products that would decrease user 209 47 U.S.C. § 230. 210  engagement. 218 Indeed, their business model incentivizes platforms to keep their users engaged as much as possible. 219 Further, the Democrats' proposals to mitigate misinformation, such as identifying and labeling the misinformation, are reactive where a proactive solution is needed. While platforms can identify and label misinformation, as both Twitter and Facebook did in the 2020 U.S. presidential election, 220 users can ignore the labels as they can perceive the labels as contradictory to their beliefs. 221 In addition, Senator Cruz and other conservatives are mistaken in their belief that the First Amendment protects third parties' speech on the social media platforms. This is because the First Amendment does not apply between two nongovernment actors-the user and the platform.
Second, scholars have proposed misinformation identification, detection, and removal solutions. For example, Professor Huan Liu and Ph.D. Candidate Kai Shu, data scientists at Arizona State University, propose an "intelligent fake news detection system" that utilizes advanced data mining. 222 In their research, Shu and Liu compiled several fake news detection platforms that identify, detect, or remove misinformation. 223 They assert that "detecting fake news in the early stage is important to prevent its further propagation on social media." 224 While it is true that detecting disinformation may help, it is only a partial solution. This is because this solution only affects how disinformation is consumed. Mitigating disinformation consumption is limited in effectiveness because disinformers can still distribute it. 225 Accordingly, while the false information may not reach millions of impressions because the consumption was mitigated, it still may reach a significant number of people because disinformers are free to continue distributing content. Thus, a complete solution must target both distribution and consumption.
Third, many individuals across government, the technology sector, and academia propose content moderation or censorship. According to Mark 218 See PROA, supra note 145, at 17 ("the fundamental issue with self-regulation is the conflict Zuckerberg, Facebook's founder and chief executive, in the first half of 2020, Facebook removed over 250 million pieces of content that violated Facebook's policies, including content that promoted terrorism, violence, cyberbullying, child nudity, etc. 226  Automation is required for this content moderation and censorship to operate at scale. Mass content moderation and censorship requires artificial intelligencepowered misinformation detection, identification, and removal solutions, such as the fake news detection solutions compiled by Shu and Liu. 228 While content moderation and censorship would help mitigate the effects of misinformation, these proposed solutions are similarly insufficient because these mostly mitigate consumption and not distribution of misinformation. 229 Moreover, disinformers would identify and circumvent the automation that powers the content moderation and censorship, similar to how fraudsters evolve their strategies to commit fraud against the world's largest companies. 230 While these proposals would likely reduce the number of user impressions, the misinformation itself would still be distributed to those users who find the content interesting or engaging. Content moderation and censorship are reactive mitigation strategies that disinformation campaigns can circumvent.
In brief, measures that merely react to misinformation, such as identification, labeling, and removal, and measures that conflict with social media platforms' monetization models are likely ineffective or insufficient at combating the misinformation. Instead, an effective solution must include proactive measures. This might include mitigating the technological capabilities that power misinformation dissemination rather than moderating the content itself, for instance.
Not all proposed reforms would be ineffective. During the 117th Congress, Representatives Anna Eshoo (D-CA) and Tom Malinowski (D-NJ) proposed the Protecting Americans from Dangerous Algorithms Act ("Algorithms Act"). 231 The 226 Id. at 2. 227 Tracy & McKinnon, supra note 208. 228 See Detecting Fake News, supra note 126. 229 See supra Figure 1. 230  Algorithms Act would remove immunity under Section 230 in cases "where a platform's algorithm has amplified or recommended a post directly relevant to a case involving acts of international terrorism or civil rights violations." 232 This proposed reform would be effective because, unlike the content moderation proposals previously mentioned, the Algorithms Act targets an enabler of the misinformation spread.
While Section 230 reform, misinformation detection, and content moderation and censorship would add some value in the fight against misinformation campaigns, none of these solutions address a critical root cause of the dissemination. A more successful strategy at combating disinformation campaigns must focus on impairing algorithms that curate content based on personal data by enacting comprehensive data privacy and security reform.

The Preservation of Democracy Requires Data Privacy Protection Now
To thwart misinformation distribution, an effective solution must proactively address the personal profiling and the algorithmic design that enables content curation. This Section proposes legislative reforms that Congress can pass to address this problem, balancing their benefits and costs.
As argued throughout this Article, the current data privacy regime lacks comprehensive federal data privacy and security protections. Social media platforms can collect and use many types of user data with almost no constraints. This data forms the personal profiles that platform algorithms use to curate the content that users find engaging. This dynamic enables disinformation to spread more effectively. 233 So, Congress must target these the personal profiling and content curation algorithms by strengthening the data privacy and security regime. By effectively disabling or limiting the algorithms that result in content curation, Congress would create greater protections for individuals and American democracy. But how strong should the data privacy and security protections be? To what extent should such protections be enacted? And why must it be Congress and not industry self-regulation?
If social media platforms were prohibited from collecting user-inputted, queried, or autogenerated data, then the platforms' ability to construct personal profiles would be grossly limited. However, a full prohibition of data collection is impractical because websites need to collect some data to deliver their products and services. Accordingly, similar to Europe's GDPR, more data privacy and security protections, controls, and limitations are necessary in order to curb disinformation spread. 234 232 Id. 233 See supra Part II. 234 See generally Natasha Lomas, US Privacy, Consumer, Competition and Civil Rights Groups Urge Ban on 'Surveillance Advertising', TECHCRUNCH (Mar. 22, 2021), https://techcrunch.com/ 2021/03/22/us-privacy-consumer-competition-and-civil-rights-groups-urge-ban-on-surveillanceadvertising/ (proposing a ban on mass tracking and profiling of web users and pointing out "less toxic non-tracking alternatives"). [Vol. 22:308 This raises the question as to why the industry has not proposed comprehensive reform to data privacy and security controls and protections. The answer to this question is simple: because data is the internet's currency-it is how digital media platforms monetize their products and services. 235 Any increase in user privacy threatens social media's revenues. For example, Apple proposed and implemented a privacy change to iOS that makes it more difficult for third-party applications to track iPhone users and collect user data. 236 Facebook rang the alarm; it said that Apple's change would hurt its bottom line because the change limits the kind of personalized targeting that Facebook is able to do. 237 Facebook estimated that its annual revenue would decline by half as a result. 238 This example illustrates why industry self-regulation is unlikely to help protect user privacy. No industry would adopt self-regulation with such a damaging effect on its profitability.
Since social media platforms cannot be counted on to regulate themselves, government must act. 239 However, Congress must move beyond its focus on insufficient and ineffective reactive solutions, such as Section 230 reform and content moderation and censorship. One major challenge is that policymakers fundamentally lack the technological knowledge necessary to address the root of the problem. 240 For example, Senator Orrin Hatch (R-UT) asked Facebook CEO Mark Zuckerberg, "How do you sustain a business model in which users don't pay for your service?" 241 This question demonstrated a fundamental lack of understanding regarding social media's monetization models.
To effectively mitigate the effects of misinformation, Congress must address the root causes and contributing factors. To do this, it must first better its understanding of technology, technological systems, and industry incentive structures for the reasons stated herein. However, this bettered understanding cannot come from the social media platforms themselves because their interests and incentives are not aligned with combating the rise in misinformation. Comprehensive data privacy and security controls and protections must be at the core of any Congressional proposal for it to be effective. Like how some states have 235 See generally, Katz and COVID, supra note 115, at 54; PROA, supra note 145, at 17. 236 Reed Albergotti & Elizabeth Dwoskin, Apple Makes a Privacy Change, and Facebook and enacted GDPR-inspired data privacy and security legislation, Congress should rely on GDPR when drafting the federal legislation. The remainder of this Section details a non-exhaustive list of several components of an overall proposal that would curb the distribution of disinformation.
First, where possible and logical, Congress should replace the reasonable expectation of privacy standard-a standard directly and indirectly present in various areas of privacy law-with a stronger standard that affords the data subject (i.e., user) greater control and protection. 242 For instance, a right of control would be a stronger standard than the reasonableness test. 243 The right of control standard would ask whether an individual's right to control her data, its privacy, and its security was violated or infringed. 244 Unlike the reasonable expectation of privacy standard, where objective and subjective privacy expectation fluctuate and wane over time, 245 the right of control standard would not weaken when privacy expectations shift because this standard relies on tangible control, not intangible expectations. 246 Here, a right of control would thwart misinformation distribution by flipping the decision-making power from social media platforms to the users; users would decide who collects, uses, and stores their personal information and to what extent.
Second, comprehensive data privacy and security legislation should include a private right of action-allowing users to sue social media platforms for violations of data privacy and security protections, such as the right to control. 247 A private right of action would alter market incentive structures, which in turn, would drive systemic change across social media platforms. 248 This is because such actions would serve a deterrent function-platforms will look to avoid potential litigation and liability by proactively mitigating its risks, including the risk of a data breach. 249 Data minimization is one mitigation strategy to reduce liability exposure; data minimization involves collecting, using, and storing only the personal information necessary to complete the transaction between the platform and the user. 250 A private right of action, which would likely result in the increase of data minimization practices, would curb the distribution of misinformation by limiting the collection of some personal information that would have otherwise been collected for a platform's algorithms. 242 Katz and COVID, supra note 115, at 79. 243 Id. 244 Id. 245 United States v. Jones, 565 U.S. 400, 427 (Alito, J., concurring) (arguing that the reasonable expectation of privacy standard is flawed because it presumes stability and fails to address how technological advances may erode privacy expectations). 246 Id. 247 PROA, supra note 145. 248 Id. 249 Id. at 9. 250 See id.
Third, legislation should recognize the different data types (user-inputted data, automatically generated data of the user's activity, and data procured from thirdparties) and distinguish the data privacy and security protections, controls, and limitations accordingly. 251 Moreover, protections, controls, and limitations must recognize the various activities associated with data (i.e., what a data collector or processor does with the data); this includes data collection, use, processing, and storage.
By distinguishing data types, when all things being equal (e.g., the content of the data itself), social media platforms would still have the ability to collect and store certain data, such as the user-inputted data, but face stricter protections and limitations for other types, such as autogenerated data. 252 Take, for example, the hypothetical posed in Part II, Section C. If the CSLI at issue in Carpenter was userinputted, not autogenerated, then the third-party doctrine would easily apply, but CSLI is autogenerated data that holds a higher level of privacy expectations. 253 Accordingly, CSLI should be afforded a higher level of privacy protection.
The level of protection, control, or limitation should also depend on what is happening with the data-whether it is being collected, used, processed, or stored. For instance, the collection of user-inputted data should be less restrictive than the collection of autogenerated data because, with the former, the user is affirmatively providing the data to the data collector. In addition, a form of control may be providing proper notice to the user regarding (i) what data is being procured about him or her, (ii) how will that data be used, and (iii) where and how that data will be stored, if at all. And an example of a limitation could be restricting the collection and use of autogenerated data for the purposes of advertising or content curation.
These types of protections, controls, and limitations are foreign, either. Individuals already maintain some level of control with respect to their credit reports-a form of queried data. Typically, an individual must authorize the data collector (e.g., lender) to obtain or procure the credit data from a data bureau (e.g., Experian). Congress can expand controls like these to other types and forms of data.
With reforms like the foregoing proposals, misinformation that erode the trust and faith in democratic elections, institutions, and principles would be limited in their reach and effect. A private right of action would disrupt the industry incentive structure that is currently focused on user engagement through content curation, and a stronger privacy standard (right to control) and distinctions among the data types would afford the user greater control and protection.
Unfortunately, it is unclear whether the federal government can enact comprehensive data privacy and security reforms. As previously mentioned, the 116th Congress introduced various proposals regarding data privacy and security, but as of June 2021, none of these proposals have advanced out of committee 251 See Part II.C. 252 See Part II.C. 253 Id.