12 Jun 2024 Search

It’s easy to mock generative AI for weird stuff like telling people to put glue on pizza, inspiring a reporter to write a story about making glue pizza, then summarizing the story. But there is a serious side to the AI issue. Protecting the content of a web site from AI training is not just about trying to avoid market competition with copied and scrambled versions of your own content. it’s not fair use, seriously, just read the actual four factors of fair use or ask a librarian. It’s just not a thing. When you put parts of your personal life on your web site, the blurry compressed version of it that AI spews out has other, more personal, risks too. Nonconsensual Nude Apps are just the beginning. AI companies, operating at large scale with little human moderation, process people’s personal info in irresponsible or illegal ways. MSN boosted an AI-generated article stating that an Irish DJ and talk-show host was on trial over alleged sexual misconduct.

AI-specific laws are still in progress, and copyright cases are still making their way through the court system. I still don’t know if all the stuff I did to block AI training on a web site is going to be enforceable—it depends on how well web site Terms of Service hold up in court as contracts. But in the meantime we do have a tool that is already in place and tested. An Opt-Out Preference Signal like Global Privacy Control is a way to signal, in a legally enforceable way, that you opt out of the sale or sharing of your personal information.

GPC already protects residents of California, Colorado, Connecticut, and other states in the USA, and enforcement is coming on line in other jurisdictions as well. Sounds like a useful tool, right? But there’s one missing piece. The GPC standard covers a signal sent from the client to the server. When you visit a site as a user, this is just fine. But when you need protection for a blog, a portfolio, or a profile page, your personal info is on a server, but the company looking to exploit it is running a client—a crawler or scraper. That’s where we need to borrow some basics from the methods for blocking AI training on a web site and add a meta tag and HTTP header that work like GPC, from server to client.

The header is pretty easy. I just did it. Have a look at this site’s HTTP headers in developer tools or do a

curl -I -q https://blog.zgp.org/ | grep X-Robots-Tag

and there it is.

X-Robots-Tag: noai, noimageai, SPC

And here’s the meta tag.

<meta name=”robots” content=”noai, noimageai, SPC”>

TODO items

  • Colorado has a process for registering OOPSs, so I will need to write this up and submit it so it’s valid there. In other jurisdictions the OOPS is valid as long as it expresses the deliberate opt-out of the user, which mine does.

  • Just to make it extra clear, I need to put something in my Web Site User Agreement, the way a lot of sites do for noai

  • continue to GPC all the things!

Remember that laws are downstream of norms here. People generally believe in moral rights and some kind of copyrights for people who do creative work, and people generally believe in some kind of privacy right to control use of your personal information. And you shouldn’t be at a disadvantage when you choose to share personally relevant content on your own site compared to people who share on a big service. The details will get worked out. Big AI will probably be able to make bogus legal arguments, delay, and lobby for a while, but in the long run the law will reflect norms more than it reflects billable hours spent trying to push a disliked business model uphill. Comments and suggestions welcome.