Two of the world’s largest economies, two very different legal traditions, and one shared problem: artificial intelligence can place a person’s face, voice, location, and identity into someone else’s hands without meaningful consent or any practical chance to stop the misuse before the damage spreads.
In China, the Supreme People’s Court took action just this week, and characteristically top-down. On September 7, 2026, it released judicial guidelines addressing AI-generated deepfakes, voice cloning, algorithmic discrimination, and false information — barring recognizable digital replicas of a person’s face or voice without consent, and exposing both users who deliberately induce infringing output and providers who ignore notice of it to liability.
In the United States, the signal came differently — not from a legislature, and not from the majority. In Chatrie v. United States, decided June 29, 2026, the Supreme Court held, in a non-AI case involving an alleged privacy invasion concerning a geofence warrant for cellphone location data, that the police activity was a Fourth Amendment search, reasoning through the familiar language of reasonable privacy expectations. Justice Gorsuch, concurring in the judgment, pressed a distinct theory: digital data implicates rights of possession, control, and exclusion — property, not merely privacy. The majority didn’t adopt that theory, but it didn’t foreclose it either.
These developments do not establish that China and the United States have adopted the same jurisprudence. China is working through consent, personality interests, and platform duties; Gorsuch is reasoning from property and the Fourth Amendment. Yet the two systems may be converging at an operational level: both increasingly treat digital identity as something a person should be able to control, exclude others from using, and protect before intangible harm becomes irreversible.
The Structural Gap
That convergence is occurring because older doctrines fit AI-driven identity harms imperfectly. Privacy torts, defamation, contract, and statutory data protections remain important, but each depends on elements machine-speed misuse makes difficult to establish: publication, falsity, a duty arising from a relationship, or a concrete, measurable injury.
Standing doctrine compounds the problem. TransUnion LLC v. Ramirez (2021) held that a statutory violation alone does not establish the concrete injury federal standing requires — narrowing the path for plaintiffs whose injuries are diffuse or hard to quantify. AI-generated impersonation is exactly that kind of injury: a synthetic voice or likeness can circulate widely before the target can even identify its source.
China’s guidance and Gorsuch’s concurrence answer this gap through different vocabularies — consent and platform duty on one side, property-like control on the other — but they share a concern for timing: protection has to attach before the victim can prove the full downstream harm, not after.
Why Property Concepts Matter
Property law offers a powerful framework because it centers control rather than aftermath. The core incidents of ownership include the ability to possess, transfer, alter, and exclude. In Chatrie, Gorsuch focused on a user’s ability to edit, export, or delete information, and the right to exclude others from it — the familiar sticks in the bundle of rights that mark an owned interest.
A property framework wouldn’t make personal information identical to a house or a copyrighted work, and current law doesn’t uniformly recognize a general property right in personal data. The more modest and defensible proposition is that property concepts can supply rules of control and exclusion where privacy doctrine alone is too reactive. Under such a model, a documented interest in a person’s digital identity could support action at the point of unauthorized use, rather than only after damages mature. Documentation wouldn’t create ownership by itself — it would supply the evidence of identity, authority, and notice that platforms and courts need to act.
One Owner, an Entire Ecosystem
The practical attraction of property isn’t merely standing; it’s enforcement architecture. Privacy litigation is typically bilateral — one claimant, one defendant. AI-generated content moves through an ecosystem of model developers, hosts, platforms, and downstream republishers, and a remedy aimed only at the first wrongdoer may arrive too late.
Copyright illustrates how an ownership interest can support ecosystem-wide enforcement: the DMCA’s notice-and-takedown structure lets a claimant reach intermediaries directly. But the analogy has limits — the DMCA works because Congress defined the protected subject matter, the notice elements, and the intermediary incentives. Digital identity has no comparable federal structure yet. Property theory therefore supplies only part of the answer; scaling it requires rules identifying who may assert the interest, what counts as adequate notice, and what safeguards protect lawful uses like news reporting and parody.
Regulatory Scaffolding, Not a Rival Model
The EU’s GDPR and AI Act belong in this picture as scaffolding, not as alternatives to ownership. GDPR gives data subjects rights of access, correction, erasure, and restriction of processing — regulatory rights that nonetheless function like ownership by giving individuals enforceable control over their own data. The AI Act adds system-level obligations for specified uses and risks, guaranteeing baseline protection that doesn’t depend on any individual financing their own litigation. Its limitation is speed: rulemaking cannot always provide the immediate, claimant-directed response a spreading synthetic identity requires.
The strongest architecture is complementary — regulation setting minimum conduct and institutional responsibility, individually held rights supplying the authority to act in a specific case. Whether the law ultimately labels that interest data protection, personality, publicity, or property matters less than whether it exists at all.
The Missing Piece: Notice
Ownership or control alone doesn’t finish the job. Scalable enforcement requires a reliable notice mechanism — an intermediary shouldn’t be expected to adjudicate every disputed claim from scratch, but it also shouldn’t be able to ignore a substantiated notice identifying the claimant, the content, and the requested action.
China’s guidance makes this explicit: a provider may face liability if, after notice that its system generated infringing content, it fails to act. That isn’t a property rule, but it’s the operational bridge between an individually held right and platform responsibility — one that would need its own guardrails against misrepresentation and its own protections for legitimate expression to function at scale.
Enforcement Built on an Ownership Nexus
Two 2026 cases from the Northern District of California show both the force and the limits of pre-existing rights. In Google LLC v. SerpApi, LLC, the court dismissed Google’s DMCA claims in part because the pleading failed to allege that its technological measure operated with the authority of the copyright owner — a legally cognizable right, pleaded with a clear nexus to the claimant’s authority, is what the enforcement mechanism actually required.
Greene v. Google LLC illustrates the point from the other direction: the court remanded a voice-misappropriation claim to state court, holding it wasn’t preempted by copyright merely because copyrighted recordings were used as inputs — preserving a boundary between copyright in recordings and state-law interests in voice and identity.
Neither case establishes a general law of digital ownership. Together, they show why the identity interest has to be defined before enforcement begins — a statute built to enforce an established right is a poor substitute for deciding, mid-emergency, whether the asserted right exists at all.
What Property-Based Enforcement Would Require
A workable model proceeds in sequence: a recognized interest, reliable proof of authority, standardized notice, proportionate intermediary duties, and a chance to contest removal. Each link depends on the one before it. For the person whose face, voice, or data appears in AI-generated content without consent, the immediate objective isn’t a damages award years later — it’s control: stopping distribution, preserving evidence, and preventing recurrence.
But property should be understood as an organizing principle, not a doctrinal shortcut. Courts and legislatures would still need to define the scope of the interest, reconcile it with publicity and personality rights, and protect legitimate speech. The case for property is strongest when it clarifies those questions, not when it assumes them away.
The Emerging Global Principle
The larger significance is not that China and the United States have reached the same answer. They haven’t. It is that both systems increasingly regard digital identity as more than an interest in secrecy — a face, a voice, a behavioral record that can be copied, commercialized, and weaponized, in ways protection limited to privacy after the fact cannot fully address.
China’s guidance emphasizes consent and notice-based platform responsibility; Chatrie preserves privacy doctrine while opening space for property reasoning; European regulation supplies enforceable individual control backed by system-level duties. Across all three, the emerging principle is control over identity — the ability to authorize use, exclude misuse, and obtain relief before machine-speed distribution makes the injury irreversible.
The race, then, is not simply to enact the first comprehensive AI statute. It is to build the first legal architecture that can translate control over digital identity into remedies that are fast, legitimate, and scalable. Property rights may not be the only vocabulary capable of doing that work. They may, however, provide the clearest grammar for the task.
SELECTED AUTHORITIES AND PRIOR WRITING
- Supreme People’s Court guidance reported by Xinhua, Sept. 7, 2026, addressing deepfakes, voice cloning, algorithmic discrimination, AI-generated false information, provider notice, and user liability.
- Chatrie v. United States, No. 25-112, 609 U.S. ___ (June 29, 2026).
- TransUnion LLC v. Ramirez, 594 U.S. 413 (2021).
- Douglas M. DePeppe, We Lawyers Were Mistaken: Online Privacy Is a Property Matter, Medium (July 31, 2021), https://medium.com/@depepped44/we-lawyers-were-mistaken-online-privacy-is-a-property-matter-f6dc912ae327.
- Douglas M. DePeppe, The Strategic Advantages of Data Ownership Enabled by Blockchain, Medium (Mar. 22, 2022), https://medium.com/@depepped44/ownership-of-data-through-the-lens-of-blockchain-the-strategic-advantages-623108c71c60.
- Douglas M. DePeppe, The Game-Changing Moment of Data Ownership Has a Legal Gap, Medium (Mar. 9, 2023), https://medium.com/@depepped44/the-game-changing-moment-of-data-ownership-has-a-legal-gap-3b63305b93f8.
- Google LLC v. SerpApi, LLC, No. 4:25-cv-10826-YGR (N.D. Cal. July 20, 2026).
- Greene v. Google LLC, No. 3:26-cv-01773-CRB (N.D. Cal. July 23, 2026).
- Douglas M. DePeppe, Frontier AI Meets Frontier Cyberlaw, Lexology (2026).
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
