Protecting one’s rights online is no longer limited to choosing a good password. The GDPR regulates the collection and processing of personal data, but friction points are multiplying with artificial intelligence, age verification, and data transfers to third-party providers. Measuring the gap between users’ theoretical rights and their actual application helps identify areas where protection remains fragile.
GDPR Rights and AI Systems: A Overview of New Risks
The recommendations published by the CNIL in February 2025 on AI and the GDPR identify three levels where personal data may be exposed. Comparing these levels helps understand where the risk is most difficult for an individual to manage.
| Exposure Level | Nature of the Risk | User Control |
|---|---|---|
| Training Data Sets | Data integrated during model creation, without explicit consent | Almost none: users often do not know their data is included in the corpus |
| Model Memorization | The model may reproduce fragments of learned personal data | Low: depends on the AI provider’s policy |
| Prompts and Submitted Documents | The information entered may be reused to train the model | High if the user pseudonymizes their inputs and checks the terms of use |
The third level is the only one where an individual has a direct lever. Limiting personal information in queries, pseudonymizing attachments, and checking if the provider reuses inputs to train its models are the most accessible protective measures.
To delve deeper into applicable defense mechanisms, Mindtrap’s comprehensive guides detail the concrete steps to take in the event of a violation of digital rights.
Consent and Data Processing: The Gaps Between Text and Practice
The GDPR requires that consent be free, informed, specific, and unambiguous. In practice, most data collection interfaces rely on dark patterns that steer the choice towards acceptance. The “Accept All” button remains more visible than the settings option on most sites.
What the Right of Access Really Allows
Any concerned individual can request a complete copy of the data held about them from a company. The company has one month to respond. However, exercising this right often encounters incomplete responses or deliberately complex forms.
The right to object to processing remains the most underutilized lever by individuals. It allows one to refuse processing based on the legitimate interest of the company, which covers a significant portion of marketing uses. Few users know they can invoke it without a specific justification in this context.
Company Compliance: A Challenge of Technical Measures
GDPR compliance is not limited to displaying a privacy policy. It requires documented technical and organizational measures:
- Encryption of personal data at rest and in transit, including in backups and testing environments
- Maintaining an up-to-date record of processing activities, specifying the legal basis, retention period, and recipients for each category of data
- Conducting impact assessments (DPIAs) before any processing likely to result in a high risk to the rights of the individuals concerned
Companies that settle for documentary compliance without implementing these technical measures expose themselves to sanctions. Effective protection relies on the architecture of systems, not on declarations.
Online Age Verification and Privacy Protection
Age verification illustrates a direct conflict between two protection objectives. Controlling minors’ access to certain content requires collecting identity data, which creates a new risk for the privacy of all users.
The CNIL recommends a double anonymity model for age verification. The principle: the verification provider does not know which service is being accessed, while the service does not receive the user’s identity. This mechanism separates the act of verification from the act of browsing.
The European Data Protection Board published a statement on age assurance in February 2025, confirming this direction. In contrast, systems that centralize verification and identification with the same actor create a single point of failure. A hack of this provider would simultaneously expose users’ identities and their browsing history.
Protection of Minors and Design of Digital Platforms
The Digital Services Act shifts the responsibility for protecting minors to the very design of platforms. Interface mechanisms become a subject of regulation, not just the content they host.
Push notifications, algorithmic recommendation systems, and variable reward mechanics are directly targeted. Their ability to capture minors’ attention for extended periods raises a fundamental rights issue that simple parental control does not resolve.
This design approach (privacy by design) aligns with GDPR principles applied to AI systems: the protection of personal data must be integrated from the development phase, not added later as optional settings.
Protecting Personal Information Against Generative AIs
The CNIL’s recommendations on AI provide an operational framework for users concerned about their rights:
- Never enter identifying personal data (full name, social security number, address) in a generative AI prompt
- Systematically pseudonymize any document before submitting it to an AI tool, replacing names, birth dates, and identifiers with fictitious values
- Check in the terms of use if the provider commits not to reuse inputs for training its models
- Exercise the right of access with the provider to obtain the list of retained data and their retention period
The data entered in a prompt constitutes processing under the GDPR. The AI provider acts as a processor or controller depending on the case, which opens access, rectification, and deletion rights identical to those applicable to any other digital service.
Protecting online rights relies less on individual vigilance and more on the technical architecture of services. The double anonymity model for age verification and the CNIL’s recommendations on AI show a convergence: the strongest guarantees are those that work without requiring user action at every interaction.
