The Surveillance Ratchet
Surveillance infrastructure exceeds its limits in two directions.
Horizontally, it finds new purposes. Cameras installed to catch car thieves are used to verify school enrolment. Routers installed for connectivity identify who is standing in the room. The data stays the same; the questions asked of it multiply. This is function creep - the system expands outward, use case by use case, until its original justification is a footnote in its operational history.
Vertically, it deepens. Data collected through a grocery app's terms of service - location, purchase patterns, financial inferences - is used not merely to personalise recommendations but to calculate the maximum price this specific person, at this specific moment, will pay. The data stays the same; the extraction intensifies. This is surveillance pricing - the system drills downward into individual vulnerability, converting consumer data into a pricing instrument that the consumer never understood they were consenting to.
Both directions share a structural feature: consent is either fictional or absent entirely. And GDPR was designed to prevent both. May 2026 offers a useful field test of how that is going.
The Cameras Ran Out of Criminals
The Electronic Frontier Foundation documented, this month, what happens when surveillance infrastructure outlives its stated purpose.
Automatic licence plate reader systems across the United States - sold to local governments as tools for recovering stolen vehicles and solving violent crime - are now routinely used for school residency verification, employment background checks, and noise complaint investigations. Buford City Schools in Georgia ran over 375 residency verification searches between January 2025 and March 2026, querying more than 5,800 camera networks nationwide to determine whether families lived within district boundaries. The school district had a problem - children attending from outside the boundary - and a database that could solve it. That the database was built to catch car thieves was, at that point, an administrative detail.
Twenty-six police agencies used the same infrastructure to investigate noise complaints, querying more than 6,500 camera networks for incidents involving loud exhausts and house parties. None of these uses required new authorisation, new legislation, or new infrastructure. The cameras were already there. The data was already flowing. The original justification — crime — was broad enough in practice to accommodate whatever the operator found useful next.
Meanwhile, researchers at the Karlsruhe Institute of Technology demonstrated that standard Wi-Fi routers can identify specific individuals with 99.5% accuracy by analysing how their movement patterns affect signal propagation. No camera. No microphone. No device worn by the target. The target need not be aware that a router is present, or that the router is producing data about them. Wi-Fi signal information is transmitted in unencrypted plain text - a feature of the protocol, not a vulnerability that can be patched. Every Wi-Fi router is a potential sensor - a monoculture that nobody designed as surveillance, but that surveillance can retroactively claim. What changed is only what someone chose to do with the signal.
The pattern is horizontal expansion: infrastructure installed for one purpose develops a range of applications that nobody voted for and no individual consented to. The cameras ran out of criminals and found other things to count.
The Price That Knew Your Name
Maryland has become the first US state to prohibit AI-driven surveillance pricing in grocery stores - the practice of algorithmically adjusting prices based on individual consumer profiles, location data, behavioural patterns, and real-time demand signals. Separately, the Federal Trade Commission sanctioned Cox Media Group for approximately $1 million over false claims that its AI could target advertising by listening through consumers' device microphones - and explicitly rejected Terms and Conditions as valid consent for the practices in question.
The distinction that matters here is between surveillance pricing and dynamic pricing. Dynamic pricing adjusts prices based on aggregate demand: flights cost more during holidays because demand is high. Surveillance pricing adjusts prices based on individual signals - this specific person, at this specific moment, with these specific financial characteristics, will pay up to this amount. One responds to market conditions. The other extracts value from individual vulnerability.
The FTC's finding mirrors the trajectory of EU consent doctrine: broad T&C provisions cannot legitimise practices that consumers would not reasonably expect and have no practical ability to understand or control. The FTC, operating under entirely different legal authority, has reached the same conclusion as the Article 29 Working Party - from a consumer protection rather than data protection starting point, through different legal pathways arriving at the same destination.
The pattern is vertical deepening: the same data, collected through the same interface, applied with increasing intensity to purposes the consumer never understood. The consent architecture says "I agree" and the contract says "to everything, forever, for any purpose we think of."
Two Failure Modes, One Principle
GDPR addresses both directions through the same mechanism: purpose limitation.
Article 5(1)(b) establishes the rule: personal data must be collected for specified, explicit, and legitimate purposes, and not further processed in a manner incompatible with those purposes.
For function creep - the horizontal axis - this means each new use of existing data requires its own compatibility assessment. Data collected for law enforcement cannot simply migrate to school administration because the infrastructure permits it.
For surveillance pricing - the vertical axis - this means that data collected for one level of personalisation cannot be repurposed for a qualitatively different form of exploitation without fresh justification.
Where surveillance pricing involves profiling that produces significant effects on individuals - and grocery pricing affects food access, which is about as significant as effects get - Article 22's heightened requirements apply: the right not to be subject to such decisions, the right to human intervention, the right to contest. The right to contest a pricing decision made in milliseconds, by a model trained on data the consumer never knowingly provided, at the point of purchase, remains governance optimism at its most architecturally ambitious.
The Clause - the one that says data must be collected for specified, explicit, and legitimate purposes - is entirely clear on both failure modes. Purpose limitation does not say secondary uses are impermissible. It says they require justification, proportionality, and in most cases fresh consent that is specific, informed, and freely given. The legal architecture is there. What is inconsistently present is the enforcement that gives it operational meaning.
The Maryland law adds something GDPR's principle-based framework does not: an outright ban, regardless of consent. This reflects a recognition that is gaining ground on both sides of the Atlantic - that the signature doesn't mean yes when it is produced in cognitive real estate contexts, where the interface is designed to produce agreement rather than understanding.
The Ratchet
Nobody made a discrete decision to build a surveillance architecture. The licence plate readers were installed for crime. The Wi-Fi routers were installed for connectivity. The grocery app was installed for convenience. Each individual application appeared reasonable in isolation.
The aggregate is visible only from sufficient distance: infrastructure that monitors, identifies, and prices - that knows where your car was last Tuesday, how you walk through a room, and how much you are willing to pay for milk - assembled incrementally, each extension seeming proportionate to the problem it solved, the total disproportionate to anything anyone agreed to.
This is what a ratchet does. It moves in one direction. Each click is small. The mechanism does not reverse.
Function creep does not announce itself. Surveillance pricing does not explain itself. Both accumulate. GDPR's purpose limitation was designed for exactly this pattern - for the moment when someone asks whether the second use was compatible with the first. The question is whether anyone is asking it before the ratchet clicks again.
Amendment 221
On May 21, 2026 - one week before this was written - the House Transportation and Infrastructure Committee voted on a bipartisan amendment that would have effectively required the removal of police LPR systems nationwide. Amendment 221, sponsored by Rep. Scott Perry (R-PA) and Rep. Jesús García (D-IL), would have restricted licence plate reader use to tolling purposes for recipients of federal highway funding. Since nearly every government entity accepts that funding, the practical effect would have been to dismantle Flock Safety's network - the country's largest LPR operation, spanning more than five thousand law enforcement agencies.
The amendment was defeated. There was even no substantive debate on the amendment itself. Both the Republican chairman and the Democratic ranking member voted against it. Flock had, in the interim, significantly expanded its lobbying presence in Washington. The Trump administration's Justice Department had publicly supported warrantless LPR use.
The ratchet clicked.