Regulating the mosaic theory requires moving beyond binary definitions of "sensitive data." Traditional privacy laws often focus on specific identifiers like SSNs or medical records. However, AI thrives on pattern recognition. Even if a company only collects benign data—such as ZIP codes, purchase histories, or gait patterns—an LLM or predictive model can fuse these fragments to infer a user's religion, health status, or political leanings without ever touching a protected database.
Governments should shift their focus from data types to data inferences. Instead of just auditing what companies collect, regulators must audit what the models produce. This means implementing strict limitations on the secondary use of inferred data. If an algorithm deduces a pregnancy or a neurological condition from unrelated metadata, that inference should carry the same legal weight and protection as the original sensitive data point.
Technological safeguards like differential privacy and federated learning can help, but law must lead. Authorities could mandate impact assessments that specifically test for re-identification risks. We need standards that treat high-dimensional correlation as a regulated output. If the aggregation creates a vulnerability, the process itself becomes the point of regulation.
