Strycharz researches how companies use data and algorithms to influence people online. She argues that while the digital environment is becoming more personalised, it is simultaneously becoming more opaque. Consumers often do not know which data is being collected about them, how that data is processed, how their online profiles are constructed, or how companies use those profiles to influence them in targeted ways. According to Strycharz, the system has become so complex that consumers not only lack sufficient information, but can barely understand what is happening. As a result, fundamental rights are coming under pressure: the right to make decisions freely, the right to privacy, and the right to fair treatment.

A concrete example of digital vulnerability comes from a book by a former Facebook employee. It describes how Facebook monitored users who deleted their selfies from the platform. When a teenage girl removed a selfie, Facebook interpreted this as a signal that she was insecure or had low self-esteem. Beauty brands could then send targeted advertisements for make-up and personal care products to those girls, without them knowing that a simple action had been used to make predictions about their emotional state. Strycharz emphasises that digital vulnerability is not limited to traditionally vulnerable groups such as children or elderly people: everyone is vulnerable when data is used in the right way.

The development of AI amplifies this problem further. Whereas five years ago it was expensive and technically complex to tailor the content of an advertisement to an individual, this can now be done almost automatically. An advertiser can instruct an AI system to craft a message that matches someone’s personality, for instance suited to an extroverted or introverted person. Research shows that such personalised messages are more effective, and AI systems simultaneously require a continuous supply of new data to improve their predictions.

Strycharz identifies three priorities for stronger consumer protection. First, companies should collect less data. The privacy regulation GDPR contains the principle of data minimisation, which states that organisations may not collect more data than is strictly necessary. Companies should stop storing data simply because it might be useful for an AI system at some point in the future. Second, complying with the law alone is not enough. Companies should also ask themselves whether their practices are fair to users, not only whether they are legally permitted.