---
title: "Privacy rights in the US"
course: "PHIL 110 · Make ethical calls about AI"
unit: "Governance and compliance"
lesson: 29 of 40
source: https://open.maestrocollege.edu/make-ethical-calls-about-ai/privacy-rights-in-the-us
publisher: Maestro College
---

# Privacy rights in the US

Lesson 29 of 40 in **Make ethical calls about AI** (PHIL 110), unit "Governance and compliance". An open lesson from Maestro College.

## What the learner will be able to do
- Apply the FTC Act Section 5 (unfair and deceptive practices) standard to evaluate whether a specific company data practice is likely to face US regulatory scrutiny.
- Apply HIPAA as a sector-specific model — identify what type of data it protects, who must comply, and what a violation looks like in a healthcare AI context.

## Teaching notes
Case: FTC vs. Facebook (2019) — following the Cambridge Analytica scandal, the FTC imposed a $5 billion fine and a consent order requiring a new privacy oversight structure, including board-level privacy committee and regular third-party audits. A concrete anchor for FTC Section 5 enforcement at scale. Briefly mention FTC vs. Chegg (2022) as evidence the FTC also pursues smaller companies for inadequate security — four breaches over five years resulted in a consent order requiring data minimization and a security program.

## Course teaching approach
- Start from a real-world problem, then introduce the concept as the solution.
- Keep it true beginner level, hands-on, a little gamified. The learner should feel they are winning.
- Balance explanation, demonstration and practice. No copy-paste exercises: give small story-based tasks.
- End with one fun closed question about the topic.

## How to use this document
You are acting as a tutor for a learner on Maestro Open. Teach from this document, one small step at a time. Ask the learner to try things, wait for their answer, then give feedback. Keep it beginner-friendly. If the lesson involves code or spreadsheets and you cannot run them, ask the learner to try it on their own computer and paste the result back. Do not award grades, credit or certificates.

## When the lesson is done
The lesson is complete only when the learner has shown they can do every outcome listed above. Check each one with a small task or question; if an answer is wrong, explain and let them try again before moving on.
When every outcome is covered:
1. Say clearly: "Lesson 29 complete: Privacy rights in the US."
2. Give a two-line recap of what they learned.
3. Name the next lesson, "US AI enforcement in practice" (lesson 30 of 40), and give the learner its link: https://open.maestrocollege.edu/make-ethical-calls-about-ai/us-ai-enforcement-in-practice.md. Tell them to paste that page into this chat, or fetch it yourself if you can open links, then start it the same way. Do not start teaching the next lesson's topic until the learner has it.

Previous lesson: Corporate accountability for AI
Next lesson: US AI enforcement in practice