AI is being developed and used at an alarming rate by private companies, governments and public sector organisations. While this new technology has the potential for good, it can also cause great harm whether through surveillance, controlling the content we see or making unaccountable life-changing decisions. 

In its manifesto, Labour promised it would regulate AI. But Keir Starmer succumbed to pressure from Big Tech and pursued ‘growth’ over our rights. It’s time for the new Prime Minister and the Minister for AI, Kanishka Narayan, to introduce legislation that will regulate AI and ensure that works for all of us and does not harm our human rights.

How should we regulate AI?

We must ban AI that risks human rights violations. These include uses that: 

ONE
Allegedly ‘predict’ crime, assess a person’s ‘risk’ of criminal behaviour, and capture sensitive biometric data en masse using facial recognition technologies.

TWO
Make decisions about people in situations of particular vulnerability or where fundamental rights are at stake – including decisions concerning asylum, immigration, welfare, policing and access to essential public services.

THREE
Categorise biometric data infer highly sensitive characteristics; social scoring; or using AI algorthms to scan children’s faces online

.

Ban AI in immigration decisions

Find out more

.

AI and the public sector

A human rights approach

Find out more

We need to regulate other uses of AI including its use by government departments and how it is used by Big tech companies to determine the content we can see and share. We need:

ONE
Transparency about how AI is being used – especially by the state.

TWO
Accountability and the power to challenge automated decisions.

THREE
Regulation of large platforms to give people control over content, and create transparency about why some content is recommended or suppressed. 

FOUR
Effective appeals to AI moderation, and censorship online, independent researcher access and interoperability.

IN A NUTSHELL

ORG believe the status quo of the real-time-bidding  ecosystem is unsustainable. Our answer to the ICO call for views, which was also reflected in the ICO summary of public views, was that:

“tracking, profiling and targeting of people based on personal data exposes exposes women to unjust prosecutions for their attempt to exercise reproductive health rights; problem gamblers to being targeted with gambling ads that are meant to exploit their addiction; anyone to be excluded on the basis of their gender, sexual preferences, ethnicity or other sensitive characteristics; children and those in a more vulnerable status to be targeted and taken advantage of.”

Thus, we recognise the need to promote change in the online advertising sector, and support efforts to shift industry away from the dominant model of online advertising, i.e. behavioural advertising and the real-time-bidding ecosystem. It follows that we do not oppose in principle a reform of the cookie consent regime.

For this change to be meaningful and to address the issues outlined above, we identify the following, necessary conditions:

• Legislation must seek to promote new data practices that: do not identify or target users on the basis of their personal data; minimise the amount of data collected to deliver advertising; reduce the onward sharing of data within the adtech ecosystem; restores users’ agency.

• New exemptions must never allow behavioural profiling, i.e. tracking and/or targeting Internet users on the basis of their online activity or personal data.
• Data collected under any new exemption should be minimised, and must not become available for further use that exceeds the purposes of the exemptions.
• Legislative reform can work only if Internet users are given agency, ie.e meaningful and effective means to reject behavioural profiling and advertising. Likewise, law-breakers need be punished for non-compliance, privacy violations, and cohercion.

WHY THESE RED LINES ARE IMPORTANT

A reform is needed to curb mass violation of privacy and data protection rights from the adtech industry. It follows that legislative change ought to accommodate privacy-respecting advertising solutions, address the privacy issues of online advertising substantively, and reward advertisers who choose to employ them. On the other hand, the reform must not to legalise existing, unlawful practices: this would reward non-compliance and fail to promote the behavioural shift that is badly needed within the industry.

To achieve the above, any new exemption cannot cover data processing for behavioural advertising and profiling in any way. Minimising the amount of data collected, and preventing data from being further used beyond the purpose of such exemptions, is also necessary to address the broader issues of onward sharing, opacity and lack of security that characterise the real-time-bidding ecosystem.

Further, if individuals are not able to choose freely, the adtech industry will focus on force them to agree to behavioural advertising, rather than to innovate and develop new practices that take advantage of the new exemptions. A meaningful reform of PECR need to establish means that individuals can use to express their consent choices effectively. If such means are not provided, the adtech industry will, as their track record shows, coerce individuals into submitting to behavioural profiling, thus killing the adoption of new privacy-preserving advertising solutions.

It also follows that intermediaries that violate users’ privacy or prevent them from exercising their agency need be punished, so that they are put at a disadvantage against those advertisers who choose to deploy privacy-respecting solutions and to respect users’ agency.

ORG ANALYSIS: THE ICO ADVICE

ORG do not, in principle, oppose the exemptions envisioned by the ICO in their advice to government. We do, however, emphasise that new exemptions need not becoming a backdoor to legalise behavioural profiling and targeting. We are also mindful that the adtech industry has an established track record of non-compliance, law-breaking and mass violation of users’ rights. To address these issues:

• Wording will need to be clear and restrictive, to avoid expansive interpretation by the adtech industry and abuse by bad-faith actors, which are dominant.
• Safeguards will need to be put in place to prohibit reusing data covered by any new exemptions for reasons that exceed the purpose an exemption was granted for. Likewise, legislation must not allow to process this data for fingerprinting, re-identification, de-anonymisation, or data enhancement (i.e. the use of data broking services to link data processed under an exemption to other, commercially available personal data).
• A strict application of data minimisation and necessity will also be needed, to support these safeguards: the less data is available, the less granular the data is, and the more difficult it is to re-link such data to the original user; the more technically difficult it will be for the toxic advertising systems to re-introduce these data into their ecosystem.

We also note that:

• Legitimate interest is likely to become the basis for processing data under the new exemptions. The balancing test is a self-assessment with a regulatory backstop threat: in other words, controllers are asked to self-regulate, under the threat of regulatory intervention if they fail to do so. Widespread bad-faith across the industry means that the balancing test would likely be abused, and thus be insufficient to protect data in this scenario.
• Consent-based cookie tracking means that, where such consent was not given or withdrawn, continued processing of that data under another legal basis (such as legitimate interest) would have been unfair and thus breached the principle of fairness. However, fairness does not necessarily constitute a meaningful restriction against data reuse in a scenario where data processing can happen without users’ consent.

Hence, we believe legislation should enshrine prohibitions and prescriptive limits against further processing (data reuse, fingerprinting, re-identification, de-anonymisation, or data enhancement) in order to provide meaningful protection against data misuse. These additional safeguards should complement, and not derogate, principle-based provisions that UK data protection law already enshrines.

BEYOND THE ICO ADVICE: BROWER’S SIGNALS ARE NEEDED TO RESTORE USER AGENCY

Any new exemption can favour privacy-preserving advertising solutions only and insofar users are allowed to express their choices freely, and thus choose the more privacy-friendly option instead of the privacy-invasive one. However, the adtech industry has for years deployed tactics to coerce users to choose what is preferable for the adtech industry: for instance with deceptive cookie banners, dark patterns, consent spam, etc.

Thus, this new policy to be successful only if supported by legislative measures that restore users’ right to choose freely. The obvious way to achieve this would be giving legal enforceability to browsers signals: users would be able to express their choices within their browsers, and these choices would then be communicated automatically every time they visit a website. Browser signals would also give users an avenue to “individually enforce” their choices, as opposed to have to rely on the ICO chasing non-compliant actors and directly promoting change within the sector.

Binding privacy signals also make regulatory enforcement easier and, thus, more likely. Establishing the existence or absence “valid consent” or “coercion” requires a certain degree of discovery: regulators need to investigate data practices and assess if an interface is deceptive, if something is unfair, and later debate this assessment if the controller appeals the ICO decision. Binding privacy signals only require a binary assessment, i.e. has the browser communicated a given preference, and was it respected,. This makes their enforcement much more likely, and the prospect of a successful appeal against it less likely.

The need of browsers signals, as an alternative avenue and a supporting factor to the ICO’s direct regulatory enforcement should also be seen in light of the ICO track record and present state. In particular:

• As the ICO advice to government admits, most of the issues that were identified in the 2019 update adtech report still exists, i.e. the adtech industry hasn’t meaningfully addressed any of the radical violations of data protection law that were identified by the ICO and their report in 2019. Seven years have passed since then, but the ICO has yet to take any enforcement action against the adtech industry.
• The ICO are currently undergoing a transition from a corporate solo to a statutory board, a move of their headquarters to Manchester, turnover of their leadership, and an independent review due to the resignation of former Commissioner John Edwards following an internal HR investigation.

There is little to suggest an imminent step-change in the ICO regulatory enforcement against the adtech sector, and there is much to suggest the organisation will face substantial management distraction in the short-medium term instead. The combined effect of these factors make it dubious that the ICO will be able to support the implementation of these reforms via strong regulatory intervention. Thus, it would be wise to create alternative avenues, such as binding privacy signals, that can be “individually enforced” by the users themselves.

As we elaborate below, alignment of the UK proposals to the emerging EU framework would also increase regulatory risks for actors who were to breach the new exemptions, as infringements and bad practices would attract regulatory scrutiny not only within the UK but also elsewhere within EU/EEA countries.

ZOOMING OUT: THE INTERPLAY WITH THE EU DIGITAL OMNIBUS

Similarly to the UK, the European Union’s Data Omnibus is debating the introduction of limited exemptions to cookie consent requirements, and of a mechanism to formally give legal enforceability to browsers’ signals. The concurrence of this debate and its impact on the UK’s own initiative should not be understated. In particular:

• The UK should seek to align its new exemptions to those introduced in the EU. Concurring rather than competing regulatory frameworks would make an industry shift toward a more privacy-respecting alternative more compelling, as a new advertising system developed for the EU regulatory regime would automatically be deployable in the UK and vice-versa. On the other hand, diverging regulatory requirements would prevent a solution developed for a given regulatory regime to be deployed in the other, thus reducing the overall commercial viability and scalability of such systems.
• Concurring regulatory requirements would increase regulatory risks for non-compliant adtech players: if, for instance, they were to abuse new exemptions provided in the UK, such behaviour could be punished both in the UK and the EU, thus increasing the regulatory risk for non-compliance. On the other hand, if a regulatory requirement only exists in the UK but not the EU, non-compliance would expose law-breaker to a regulatory risk in the UK only, where the likelihood of enforcement is dubious for reasons stated before.

In light of the above, we suggest the government to re-assess the existing timeline for the use of Henry VIII powers to introduce such exemptions. In particular, we believe it would be beneficial to wait for the outcome of the EU data omnibus proposals to minimise the risk of regulatory divergence with the EU, and the potential effect of producing two competing and regimes that mutually undermine the viability of the other. This would not prevent the government from consulting on drafting and policy options, which would still be useful to promote public scrutiny and promote cross-border regulatory dialogue.

END REMARKS

The purposes and objectives of these reform can be shared, but the current status-quo and track record within the adtech sector requires realism: the industry is unaccustomed to comply with the law, if not openly rogue and against it. In turn, exceptional measures to force a shift of behaviour across the sector will be needed for this reform to prove effective and achieve its purpose.

Thus, we urge the Department to work on the issues listed above, and we remain available for further engagement on this subject.

Political criticism of the unregulated use of AI in immigration

Cross party MPs have contributed forewords to the report that criticise the Home Office’s lack of transparency and accountability.

Labour MP Bell Ribeiro-Addy stated:

“In spite of questions and requests, the Home Office has been reluctant to publish the documents that would explain how AI is used in asylum processing, what the problems are and how they are being addressed. That is a source of real frustration. It is also hard to understand if the Home Office genuinely believes its policies are effective and justifiable.”

She added:

“The Home Office has not explained how it will ensure there is accountability when they fail or justified why some of the most vulnerable people, with the least power, should bear the greatest risks.”

Her comments were echoed by SNP MP Pete Wishart who criticised the Home Office’s failure to inform asylum applicants when AI is used in their cases:

“There is also an important question of accountability. If an asylum seeker believes that an AI system has made a mistake, they need to be able to know that the technology was used and have the chance to challenge its output.”

He also challenged the government’s focus on using automation to ‘speed-up’ processes, saying:

“We should be careful not to assume that making the system faster necessarily makes it better. The asylum system needs to make good decisions as well as timely ones. A quicker wrong decision is not an improvement.”

“Migration is a human phenomenon and experience not a technical problem that can be fixed by artificial intelligence.

The public is rightly wary of how AI is will change our society, which makes government secrecy about its use across the immigration sector even more concerning.

We urgently need transparency, accountability and strict regulation to restrict how AI is used and to prevent its wider rollout.”

.

Sara Alsherif
ORG Programme Manager – Migrant Digital Justice

The story so far

Automated discrimination: Unpacking the Digital Hostile Environment uses desk and literature research, expert interviews, and analysis of Home Office documents obtained through freedom of information (FOI) requests. The report was commissioned by Open Rights Group and authored by Fabio Chiusi, a journalist, researcher, writer, and adjunct professor whose work focuses on the intersection of digital technology, artificial intelligence, and society.

1 For an investigation into the role of cybernetics in the conceptualisation and realisation of border surveillance assemblages, cfr. Iván Chaar-Lòpez (2024), ‘The Cybernetic Border. Drones, Technology and Intrusion’, Duke University Press, Sources: Chaar López, I. (2024) The cybernetic border: Drones, technology, and intrusion. Durham, NC: Duke University Press.

Digital Privacy

Ban AI in immigration decisions

Find Out More

The United Kingdom is betting on artificial intelligence to ‘fix’ immigration. Driven by a techno-solutionist ideology that reduces the complex human phenomenon of migration to a technical problem awaiting a technical fix, successive governments, including the current Labour administration, have committed to embedding AI across the immigration system and at the nation’s borders.

About the report

Based on desk and literature research, expert interviews, and analysis of Home Office documents obtained through freedom of information (FOI) requests, this paper argues that this is no longer rhetoric: AI is being woven into crucial parts of the immigration machinery, and is poised to shape all of it.

We document a rapidly expanding catalogue of deployments. Within the immigration system, AI is being trialled or used to estimate the age of people seeking asylum, summarise asylum interviews and country policy information, prioritise and assess cases through the opaque Identify and Prioritise Immigration Cases (IPIC) tool, sift through irregular entrants’ mobile phones, and automatically flag potential “sham” marriages with a red or green light. At the border, live facial recognition, AI-powered drones and satellites, and foreign-built autonomous surveillance towers are marshalled to “stop the boats”, while obscure programmes such as Cerberus promise to pre-empt unknown threats, marking a decisive shift from reactive to ‘predictive’, proactive enforcement.

This automated fortress raises grave and converging concerns. The systems rely on technologies renowned for bias, disproportionately harming the most vulnerable people on the move, and therefore encoding discrimination into the infrastructure of border control. They operate in near-total secrecy: officials routinely invoke ‘national security’ to stonewall FOI requests, redact disclosures. In at least one instance, the authorities have pressured a researcher to withdraw published findings.

Much of this technological arsenal is not British but supplied by US, Israeli, and other foreign defence and security giants, producing technological dependency, and techno-political lock-in, that reality sits awkwardly with the Government’s stated ambition to be an “AI maker”, not an “AI taker”. All of this unfolds within a regulatory vacuum that ministers have shown no intention of filling, having instead promised the world’s most “unfettered” environment for AI experimentation, even as the Government seeks to “modernise” the European Convention on Human Rights in ways that threaten the right to asylum itself.

Recommendations

AI will not fix the immigration system. But the deeper problem is the ideology that frames migration as a permanent emergency to be solved by algorithms, criminalising migrants and normalising an “automated Hostile Environment”.

This paper therefore sets out five recommendations:

1. Reject AI techno-solutionism and put people ahead of their data-driven reduction;

2. Recognise and fill regulatory gaps, banning undemocratic uses such as mass live surveillance of public spaces and strictly regulating high-risk applications before deployment;

3. Enhance structural transparency in the public interest, with stronger FOI laws, a narrower definition of national security and a robust public register of government AI tools;

4. Curb outsized corporate influence and reclaim digital sovereignty; and

5. Avoid ‘reverse solutionism’ by situating the critique of AI within a wider contestation of prejudicial, ideologically driven anti-immigration politics. Only then can AI become a tool of humanitarian assistance rather than one of blind, automated discrimination.

Digital Privacy

Ban AI in immigration decisions

Find Out More

Open Rights Group (ORG) has carried out a six month investigation into two generative AI tools, being used by the Home Office in every asylum decision.

Background

The Home Office uses two AI tools in asylum casework, both built on a large language model (GPT-4o via Azure AI Foundry):

• The Asylum Case Summarisation tool (ACS) summarises asylum interview transcripts for decision-makers.

• The Asylum Policy Search tool (APS) is a chat-style interface for searching country policy information.

Both generate new text rather than retrieving existing text; they can filter, reframe or omit facts relevant to a decision.

APS was fully rolled out to all asylum decision-makers from July 2025. ACS was rolled out to all asylum caseworkers from April 2026.

“Deciding whether someone can or cannot seek refuge in the UK is one of the most serious and life-changing decisions that the state can make about an individual. The processes that lead to that decision must be transparent, fair and accountable.

But the Home Office continues to test AI on people seeking asylum in the UK without even telling them.

We urge the Government to regulate AI and outright ban its use in asylum applications, where the risk to rights are so high.”

Sara Alsherif
ORG Programme Manager – Migrant Digital Justice

Our findings

Digital Privacy

Ban AI in immigration decisions

Find Out More

Executive summary

Deciding whether someone can or cannot seek refuge in the UK is one of the most serious and life-changing decisions that the state can make about an individual. The processes that lead to that decision must be transparent, fair and accountable.

Recommendations

Digital Privacy

Ban AI in immigration decisions

Find Out More

AI in immigration

Ban AI tools in Asylum Decision-making

.

Legal opinion on AI in Asylum

The lack of transparency over the use of AI in asylum decision-making is likely unlawful.

Find out more

ORG’s Investigation into USE OF CHATGPT in asylum DECISIONS

Find out more

Digital Privacy

Migrant Digital Justice

Find Out More

Taking on age verification

.

Regulate Age Verification Providers

The Online Safety Act has failed to regulate and protect privacy of children and adults.

Find out more

Age verification Facts

Visit ORG’s website on how age verification checks work.

Find out more

Protecting VPNs

The government has pulled back from threats to impose age verification requirements on access to Virtual Private Networks following pressure from ORG, companies and civil society. However calls to resist them continue. We continue to resist these efforts, as restrictions would weaken the privacy and security that millions of people rely on every day.

.

VPNs and Age Verification

Our briefing on proposals to age-gate the use of VPNs in the UK.

Find out more

Protect vpn use in the UK

Forcing people to verify their age when they buy a VPN will deter many people from using them.

Sign the petition

Free expression online

Fix the Online Safety Act

Find Out More

The Bill exempts from regulation under the Online Safety Act certain small, low risk user-to-user services.

In order to be exempt a service would have to (a) not be conducted for profit, (b) not present a material risk of significant harm to UK individuals and (c) qualify as a small service by reference to either active user numbers or operating expenses.

The Bill contains provision for Ofcom to serve notice on a service to disapply the exemption if Ofcom has evidence of a quantity of user-generated content on the service that presents a material risk of significant harm to UK individuals; and for a service in receipt of such a notice to be able to appeal to the First-tier Tribunal and then to the Upper Tribunal.

Draft Online Safety (Amendment) Bill

Draft Explanatory Notes

Free expression online

Fix the Online Safety Act

Find Out More