Privacy Law and Data Protection: The Best Books, in Order
Privacy law is unusual in that its hardest problem is definitional: courts and regulators have spent a century trying to say what the interest actually is before deciding how to protect it. This path treats that as the starting point rather than a preliminary, then moves to the American statutory and enforcement architecture, then to the history and the surveillance economy that made data protection urgent, and finally to the argument that disclosure-and-consent regimes have failed and design rules should replace them. Two warnings that apply to every book below. Nothing here is legal advice, and none of it is a substitute for a lawyer in your jurisdiction. And the field dates fast: the publication year is given for each book because a 2004 or 2011 treatment predates the GDPR, the CCPA and most of what regulators now do, and remains valuable for its concepts rather than its rules.
What Privacy Is, and Why It Is Hard to Define
BeginnerGet a working conceptual vocabulary — informational privacy, contextual integrity, the aggregation problem — before touching any statute, so that later rules read as answers to identifiable questions.
▸ Study plan for this stage
Pace: Three to four weeks. Véliz's Privacy is Power (224 pages) is short and forceful — two or three evenings. Richards's Why Privacy Matters follows directly and takes about a week. Solove's Understanding Privacy (272 pages) is the analytical centre of the stage and deserves ten days with notes, because
- Privacy law's hardest problem is definitional, and it comes first rather than as a preliminary: courts and regulators have spent a century trying to state what the protected interest actually is, and most doctrinal confusion downstream is a residue of that.
- Solove's move in Understanding Privacy (2008) is to abandon the search for a single essential definition and instead map privacy as a family of distinct harms — surveillance, aggregation, insecurity, secondary use, exclusion, disclosure, distortion, intrusion. Each harm implies a different remedy, w
- The aggregation problem: individually innocuous pieces of information become sensitive when combined. It is the single concept that most often defeats rules written around whether a given datum is private.
- Nissenbaum's contextual integrity (2009) holds that information norms are specific to the context in which information was shared, so a flow violates privacy when it breaches the norms of that setting — not when the information is merely public or merely private. It is the framework most cited in mo
- Richards, a law professor, argues in Why Privacy Matters (2021) that privacy is about power and about rules for information flows rather than about secrecy. That reframing is the direct answer to the nothing-to-hide reflex, and it does the same work as Véliz with a lawyer's precision.
- Véliz's Privacy is Power (2020) is advocacy and says so: an Oxford philosopher arguing that the trade in personal data should be banned outright. Reading a clearly stated position first makes the more measured books easier to place.
- Informational privacy is only one branch. Decisional privacy, bodily privacy and the constitutional line of cases sit alongside it, and conflating them is a common source of argument at cross purposes.
- The practical payoff of this stage: when you meet a statute later, you should be able to say which harm from Solove's taxonomy it is aimed at and which contexts it is protecting. Rules read as answers to identifiable questions rather than as arbitrary lists.
- Why does Solove abandon the search for a single definition of privacy, and what does his taxonomy let a regulator do that a definition would not?
- Explain the aggregation problem with an example of your own, and say why a rule that classifies data as sensitive or non-sensitive fails to address it.
- State contextual integrity precisely. How does it decide whether a particular disclosure is a violation, and what does it require you to know about the originating context?
- How does Richards answer the claim that someone with nothing to hide has nothing to fear? Reconstruct the argument rather than the slogan.
- Véliz is explicitly advocating a position. Where does the argument depend on a normative premise rather than an empirical one, and would you accept that premise?
- Take one contemporary data practice and analyse it twice: once with Solove's taxonomy and once with contextual integrity. Where do the two frameworks disagree?
- Write out Solove's taxonomy on one page with a one-line example for each harm drawn from your own experience of digital services. Keep it beside you for the rest of the path.
- Take three information flows — a health record shared with an insurer, a purchase history sold to a broker, a school photograph posted publicly — and analyse each under contextual integrity, naming the originating norms explicitly.
- Summarise Véliz's and Richards's positions in one paragraph each, marking clearly which claims are empirical and which are normative.
- Pick a privacy dispute currently in the news and write 300 words identifying which of the four books would frame it best and why.
Next up: With a vocabulary for what the interest is, the next stage shows what the United States actually built to protect it — and why the architecture looks so strange to anyone arriving from a comprehensive data protection regime.
A short, forceful book by an Oxford philosopher (2020) arguing that personal data trading should be banned outright. Start here because it is the most readable statement of why anyone should care, and because its position is clearly stated rather than hidden — it is advocacy, and says so.
A law professor's answer (2021) to the nothing-to-hide reflex, arguing privacy is about power and rules for information flow rather than secrecy. Read second: it does the same job as Veliz with a lawyer's precision and sets up the doctrinal books to come.
Solove's taxonomy (2008) abandons the search for one essential definition and instead maps privacy as a family of distinct harms — surveillance, aggregation, exclusion, disclosure. The single most useful framework on this path, and the one later chapters keep referring back to.
Nissenbaum's contextual integrity (2009): information norms are context-specific, so a flow is a violation when it breaches the norms of the setting it came from, not when it is merely public or private. Read last in this stage — it is the most demanding of the four and the one most cited in modern regulation.
The American Legal Architecture
IntermediateLearn how United States privacy law is actually assembled — sectoral statutes, the common-law torts, constitutional doctrine, and an enforcement regime built largely by one agency.
▸ Study plan for this stage
Pace: Four to five weeks for around 1,265 pages. Solove's The Digital Person (283 pages) takes a week. Nothing to Hide (256 pages) is shorter and can follow in four or five days. Privacy Law Fundamentals (300 pages) is a reference in outline form rather than a narrative — spend a week working through it w
- The United States has no general federal privacy statute and instead assembles protection from sectoral statutes covering particular industries and data types, the common-law privacy torts, constitutional doctrine, state law, and an enforcement practice built largely by one agency.
- Solove's argument in The Digital Person (2004) is that commercial databases changed the shape of the problem: the threat is less Orwellian surveillance than a Kafkaesque condition in which decisions are made about you from records you cannot see, correct or contest.
- That reframing explains the American statutory pattern — rules about access, correction and notice rather than about collection — and remains the best account of why the architecture took the shape it did, even though it predates almost every modern statute.
- Nothing to Hide (2011) applies the same taxonomy to government surveillance and argues that the security-versus-privacy trade is usually framed dishonestly, by comparing a concrete security benefit against a vague and aggregated privacy cost.
- Privacy Law Fundamentals is a practitioner reference by Solove and Paul Schwartz — statutes, leading cases and enforcement actions in outline. Use it as a map to look things up rather than a book to read through, and always with the current edition.
- Hoofnagle's subject (2016) is the institution that in practice writes American privacy law: an agency acting through consent decrees under a general prohibition on unfair and deceptive practices, building a body of de facto rules case by case.
- The consequence is the stage's central lesson: a country can lack a comprehensive privacy statute and still have enforceable privacy obligations, because enforcement discretion applied consistently over time becomes a body of law.
- The gap between what a statute says and what regulated firms actually do is where the last stage of this path lives. Notice, as you read, how much of the American regime depends on disclosure and consent.
- Why does the United States regulate privacy sectorally, and what does that produce in practice — which data is well protected and which is not?
- Explain Solove's contrast between the Orwellian and Kafkaesque framings. Which better describes the harms you actually encounter, and what different remedies does each imply?
- How does Nothing to Hide argue the security trade-off is misframed? Identify the asymmetry in how the two sides of the balance are usually described.
- How does an agency build binding practice out of consent decrees, and what are the rule-of-law objections to lawmaking by settlement?
- Pick one sectoral statute and map it onto Solove's taxonomy: which harms does it address, which does it ignore, and why was it drawn that way?
- What can American privacy law not do that a comprehensive regime can, and what can it do that a comprehensive regime finds difficult?
- Draw the American privacy landscape on one page: sectoral statutes down one side, the common-law torts and constitutional doctrine along another, and the enforcement agency in the middle. Mark the gaps.
- Take one enforcement action described by Hoofnagle and write out the theory of the case — what was unfair or deceptive, and what obligations the settlement created for the whole market.
- Choose an everyday service and identify which statutes, if any, actually apply to its handling of your data. Most readers are surprised by the answer.
- Read one privacy policy in full against Solove's taxonomy and mark which harms it addresses and which it merely discloses.
- Write a short note, clearly labelled as an exercise and not as advice, describing how you would begin to research whether a given practice is lawful — and where you would have to stop and ask a lawyer.
Next up: The architecture makes more sense once you know what it was reacting to, so the next stage covers where the notice-and-consent model came from and what commercial system it is now failing to govern.
Solove's 2004 account of how commercial databases changed the problem from Orwellian surveillance to something closer to Kafka: decisions made about you from records you cannot see. Predates almost every modern statute, and remains the best explanation of why the American approach took the shape it did.
A short 2011 book on the security-versus-privacy trade, arguing the trade is usually framed dishonestly. Read after The Digital Person because it applies the same taxonomy to government surveillance. Catalogued here under its full title including the subtitle about the false tradeoff.
The compact reference by Solove and Paul Schwartz — statutes, leading cases and FTC actions in outline form. This is a practitioner text revised every couple of years, so check which edition you are buying; the record here is an early one.
The book (2016) on the institution that in practice writes American privacy law through consent decrees rather than legislation. Read last in this stage: it explains why the United States can lack a general privacy statute and still have enforceable privacy obligations.
How the Problem Got This Big
IntermediatePlace the current regime historically, and understand the commercial system that generates the data protection law is trying to govern.
▸ Study plan for this stage
Pace: Five to six weeks for roughly 1,780 pages, and this is the heaviest stage on the path. Westin's Privacy and Freedom (487 pages) is the foundation and repays close reading of its early conceptual chapters — ten days. Igo's The Known Citizen (592 pages) is a work of history and should be read at a his
- Westin's definition (1967) — privacy as the claim of individuals to determine for themselves when, how and to what extent information about them is communicated to others — is the source of the notice-and-consent model in nearly every data protection law since.
- Reading Westin as a source rather than as a settled truth is the point of placing him here: the final stage of this path attacks the framework he supplied, and the attack is unintelligible without the original.
- Igo's history (2018) shows that privacy as an American right was constructed rather than inherited, through census controversies, Social Security numbering, psychological testing, wiretap litigation and the confessional turn in popular culture. It is the corrective to treating privacy as a timeless
- The reflexive dimension in Igo: instruments that measure a public help constitute one, and the same is true of privacy — the technologies and controversies that made privacy visible also defined what people thought they were entitled to.
- Zuboff's argument (2018) is that behavioural data has become a raw material extracted at scale and refined into prediction products sold in behavioural futures markets, and that this constitutes a distinct economic logic rather than an intensification of advertising.
- Zuboff has been widely criticised for overreach and imprecision — for treating a contested empirical claim as established, for the sweep of its historical analogies, and for underspecifying the mechanisms. It is included because it names the economic engine that most law books leave as background, a
- The structural point of the stage: data protection law was designed around a model of discrete, consented disclosures between identifiable parties, and the commercial system it now governs operates by inference and aggregation at a scale that model never contemplated.
- Once you can see that mismatch, the consent-based regime's failures stop looking like enforcement problems and start looking like design problems — which is exactly the claim the last stage makes.
- State Westin's definition and identify precisely which assumptions it makes about the individual's knowledge, capacity and bargaining position.
- How did Americans come to regard privacy as a right? Name three episodes from Igo and say what each one added to the concept.
- What is Zuboff's central empirical claim, and what evidence would be needed to establish it? Distinguish the claim from the rhetoric around it.
- Name two substantial criticisms of The Age of Surveillance Capitalism and say how much of the book's argument survives them.
- Why does inference from aggregated data defeat a consent-based regime? Answer in terms of what the individual could plausibly know at the moment of consenting.
- Set Westin's model against the system Zuboff describes. Which specific assumptions of the model have failed?
- Write out Westin's model as a set of numbered premises, then mark each premise as still true, partly true or false in the current environment.
- Build a timeline from Igo of the episodes that shaped American privacy expectations, and annotate each with the technology or institution that triggered it.
- Summarise Zuboff's argument in 400 words with no adjectives. Stripping the rhetoric is the fastest way to see what is actually being claimed.
- Take one consent flow you personally encounter and list everything you would have needed to know for the consent to be meaningful. The length of the list is the argument.
- Compare Zuboff's account with Schneier's shorter treatment of the same ground and note where a technical framing and a political-economy framing genuinely differ.
Next up: If consent cannot carry the weight the whole regime places on it, the alternative is to regulate how products are built rather than what they disclose — which is the argument the final stage makes and then tests.
The 1967 book that defined privacy as the individual's claim to control information about themselves, and stands behind the notice-and-consent model in nearly every data protection law since. Read it as the source of the framework the last stage of this path attacks.
A historian's account (2018) of how Americans came to think of privacy as a right at all, through census controversies, Social Security numbers, psychological testing and the talk-show confessional. The corrective to treating privacy as a timeless value.
Zuboff's long, polemical 2018 argument that behavioural data has become a raw material extracted for prediction markets. Widely criticised for overreach and imprecision, and included anyway because it names the economic engine most law books treat as background. For a shorter and more technical treatment of the same terrain, Bruce Schneier's Data and Goliath covers it in a third of the pages.
Regulating Design, and Working Across Jurisdictions
IntermediateEngage the leading critique of consent-based regimes, and get oriented in comparative data protection where GDPR-style regimes, not American law, set the global baseline.
▸ Study plan for this stage
Pace: Three to four weeks. Hartzog's Privacy's Blueprint (322 pages) is the central text of the stage and of the modern field — ten days, read closely. Waldman's Industry Unbound follows as the empirical companion and takes about a week. Determann's Field Guide to Data Privacy Law (232 pages) is a working
- Hartzog's argument (2018) is that privacy policies and consent boxes cannot do the work assigned to them, and that law should instead constrain how products are designed — defaults, affordances, dark patterns, and what a system makes easy or hard.
- Design regulation shifts the burden from the individual to the builder, which is the same move product safety law made a century earlier. That analogy is doing real work in the argument and is worth examining rather than accepting.
- Waldman's study (2021) is empirical: interviews with the engineers, lawyers and privacy professionals who actually convert legal obligations into internal practice, and a finding that much of what results is compliance theatre — documentation, training and process that satisfy an auditor without cha
- That makes Waldman the evidence for Hartzog's claim, which is why it is read second. A design-regulation argument stands or falls on whether disclosure-based rules produce real change internally, and this is a study of exactly that.
- Waldman's earlier Privacy as Trust makes the positive case for a relational model, where the question is what obligations a party accepting information owes rather than what the individual consented to.
- Comparative reality check: GDPR-style comprehensive regimes, not American law, set the global baseline in practice, because multinational firms tend to build to the strictest applicable standard rather than maintain separate architectures.
- Cross-border transfer rules, vendor and processor contracts, and data localisation are where compliance actually consumes effort, and Determann's field guide is written for people who have to do that work rather than theorise about it.
- Everything in this stage dates. Concepts persist and rules do not, which is why the practical instruction is always to check the current text of the law in the relevant jurisdiction and take professional advice before acting.
- State Hartzog's argument in its strongest form. What exactly would a design obligation require of a product team that a disclosure obligation does not?
- What does Waldman find that companies actually do with privacy law internally, and which of his findings would most trouble a regulator relying on documented compliance?
- How would you distinguish genuine privacy-protective design from compliance theatre in a product you could inspect from outside?
- What is the relational model of Privacy as Trust, and how does it differ from both consent and design regulation as a basis for obligation?
- Why do comprehensive regimes end up setting a global baseline even for firms not primarily subject to them?
- Which parts of this stage are concepts that will still hold in five years, and which are rules that will not?
- Take one product you use and write a design-regulation critique of it: defaults, friction, dark patterns, what is easy and what is deliberately hard. Then write the privacy policy version of the same critique and compare their usefulness.
- Using Waldman, list the internal artefacts a company produces to demonstrate compliance and mark for each whether it could exist without any change to the product.
- Sketch the data flows of a small hypothetical service across two jurisdictions and identify, with Determann in hand, where a transfer or vendor question would arise. Label the output clearly as an exercise, not as advice.
- Write a one-page comparison of the three regulatory strategies this path has covered — sectoral enforcement, comprehensive data protection, and design obligation — with the strongest objection to each.
- Finish by rewriting your Solove taxonomy page from the first stage, marking beside each harm which of the three strategies addresses it best. That single page is the path's actual deliverable.
Next up: That closes the path: a vocabulary for what privacy is, the American architecture and the history that produced it, the commercial system straining it, and the design-based alternative — with the reminder that none of this is legal advice and the rules, unlike the concepts, will have moved by the time you need them.
The central argument of the modern field (2018): privacy policies and consent boxes cannot work, and the law should instead constrain how products are designed. If you read only one book from this stage, read this one.
Waldman's 2021 empirical study of what companies actually do with privacy law internally — interviews with the engineers and privacy professionals who convert legal obligations into compliance theatre. The evidence for Hartzog's claim, so read it second. Waldman's earlier Privacy as Trust makes the positive case for a relational model.
A short, practical multi-jurisdiction handbook for people who have to comply rather than theorise — the closest thing here to an operating manual for cross-border data transfers and vendor contracts. Deliberately last, and the book on this path with the shortest shelf life: buy the current edition, because the record catalogued here is several editions old and the rules have changed since.
Discussion
Keep reading
Paths that share books, cover the same subject, or open a related topic.
