Original title: Enhancing Privacy, Neglecting Harms: An Analysis of Real-World Digital Privacy Incidents
Shannon Veitch, C. Shem, Lena Csomor, Oleksandr Dudiy +6 · September 2026
Engineers build privacy-enhancing technologies to help people control their personal information. Yet even as these tools spread, individuals still suffer privacy harmsThe actual damage or negative consequences people suffer from privacy violations.. To understand this gap, researchers gathered news articles covering a sample of 257 real-world privacy incidents. They analyzed these reports to build a new model tracing how information travels and causes harm. Their model reveals that user consentPermission you give for your data to be used, but the study shows it often doesn't prevent harm. usually fails to stop violations because harms arise from complex web-like interactions between multiple entities and actions. Crucially, privacy tools often focus on making useful digital features work securely. However, this focus still allows the dangers built into those very features to hurt users. On top of that, the researchers discovered a frustrating roadblock: the organizations best suited to put protections in place have the least motivation to actually do it. By exposing these blind spots, the study suggests better ways to design future privacy tools.
Imagine you let a friend borrow your car. You control who takes it, but the friend can still drive recklessly and cause an accident. In this paper, giving permission to use data is like lending the car, and the privacy harm is the accident — it comes from how the data is handled, not just who has it.
Most privacy technologies focus on letting you decide who sees your data. But this study shows that the harm often comes from what happens after — how the data is used, not just who accesses it. That means consent and control alone aren't enough, and the companies best able to fix the damage have little reason to.
The abstract doesn't specify limitations beyond the sample of 257 news articles, which may not cover all types of privacy incidents or represent every population. The model describes the problem but does not provide a tested solution, and it does not evaluate specific privacy technologies.
Ask anything about this paper. Answers come from its abstract, and say so when the abstract doesn't cover your question.
Enhancing Privacy, Neglecting Harms: An Analysis of Real-World Digital Privacy Incidents — Shannon Veitch, C. Shem, Lena Csomor et al.
Abstract licence: CC0
Explanation generated by Synthesis from the abstract — it is not the original paper. This is a preprint, so it hasn't necessarily been peer reviewed.