One of the main issues raised by the use of artificial intelligence concerns the relationship between privacy, surveillance and security. Although these concepts are closely related, each refers to a different aspect of how AI is used. Privacy encompasses the protection of personal information and private life against unjustified interference; surveillance involves the monitoring of people’s activities; security, in this context, refers primarily to national security. Since Microsoft CEO Satya Nadella announced a “golden age of AI” in 2023, governments have been developing policies to address the implications of AI for privacy, surveillance and security. This contribution focuses on China, the European Union and the United States of America, the three powers competing for leadership in AI development, deployment and governance. All three acknowledge privacy concerns in their policy frameworks; in July 2025, for instance, the White House AI and Crypto Czar David Sacks called for the avoidance of “Orwellian uses of AI”. Their approaches to monitoring and privacy nonetheless differ considerably, particularly in the weight they attach to safeguards against state surveillance. The question examined here is: how have the different historical experiences of the United States, Europe and China shaped their approaches to AI, privacy, surveillance and national security?
Historical experiences
The United States
The United States’ relationship with privacy has been shaped in part by its twentieth-century anti-communist campaigns. The first Red Scare followed the Bolshevik Revolution in Russia and peaked in 1919–1920; fears of communism and the Soviet Union intensified again in the late 1940s and 1950s, particularly after the Soviet Union’s first atomic bomb test in 1949 and the establishment of the People’s Republic of China that same year. These fears contributed to the second Red Scare, associated with McCarthyism: in February 1950 Senator Joseph McCarthy claimed to possess a list of communists working in the State Department, while the FBI used surveillance and telephone interception to investigate suspected communist activity. In the same period, the Lavender Scare subjected gay and lesbian people, and those suspected of being so, to investigation and dismissal from federal employment on purported national security grounds.
After the attacks of 11 September 2001, President George W. Bush signed the USA Patriot Act on 26 October 2001, expanding government powers relating to communications surveillance, access to business records and searches with delayed notification.5 In moments of perceived emergency, therefore, the United States has expanded surveillance powers in the name of national security and the prevention of terrorist attacks, with significant consequences for personal privacy. AI extends the reach of these surveillance capabilities, and the tension between them and privacy safeguards persists. Privacy protection is not absent, however: the Fourth Amendment protects against unreasonable government searches and seizures, and the Foreign Intelligence Surveillance Act of 1978 establishes a statutory framework for foreign intelligence surveillance.
The European Union
EU legislation on artificial intelligence, particularly the AI Act adopted in 2024, aims to protect fundamental rights and human dignity, prevent discrimination and address risks arising from the use of AI by public authorities and private actors. These principles have roots in the post-war European legal tradition within which European integration developed. After the Second World War and the Holocaust, the European Convention on Human Rights was adopted in 1950 within the Council of Europe to protect fundamental rights and help prevent a recurrence of the abuses associated with totalitarian regimes. Article 8 of the Convention protects the right to respect for private and family life; the European Court of Human Rights has derived from it safeguards against secret surveillance and the interception of communications.
Within the EU, the Charter of Fundamental Rights protects both respect for private life (Article 7) and the protection of personal data (Article 8), and the General Data Protection Regulation, applicable since 25 May 2018, sets detailed rules on how public and private organisations collect, process and store personal data. The AI Act is meant to complement these protections. It prohibits certain practices involving biometric surveillance and social scoring and imposes transparency requirements and obligations for high-risk AI systems. The European model is not solely rights-oriented, however: the AI Act also treats innovation, and the development and deployment of safe and trustworthy AI, as central objectives. European AI legislation can therefore be understood in continuity with the post-war human rights tradition, while operating within the EU’s own legal framework.
China
While post-war European human rights instruments established limits on state interference with individual rights, the People’s Republic of China developed a system in which the state and the Communist Party play a central role in pursuing political, economic and social objectives. Under Mao, campaigns such as the Cultural Revolution, launched in 1966, sought to reshape society and enforce ideological conformity, and the Red Guards persecuted perceived political opponents and intellectuals. Political control and the management of information were central to this model. After Mao’s death, Deng Xiaoping’s policy of “reform and opening up”, launched in 1978, sought to strengthen China’s economy and industrial capacity, including by promoting technological development and attracting foreign trade and investment. China’s ambition to become a major technological and economic power through the development and adoption of new technologies can be described as a “state first” approach, in which national security, social stability and the technological and industrial objectives of the party-state carry particular weight in relation to individual rights.
With the growth of the digital economy, China combined the expansion of its technological capabilities with legal and technical mechanisms of political control. The Golden Shield Project, launched around 2000, built public security information systems for policing and surveillance, while the Great Firewall filters and restricts access to online content. Foreign social media platforms are restricted accordingly; Douyin, developed by ByteDance, the parent company of TikTok, serves the Chinese market as a separate platform.
China has also used AI and biometric technologies to identify and monitor individuals. In Xinjiang, Human Rights Watch documented the expansion of surveillance from 2016 onwards, including facial recognition at checkpoints and a police platform linking identifying information with other personal data; the platform flagged not only suspected criminal activity but also lawful, everyday behaviour. These practices reflect a balance between individual privacy and state control very different from the one underlying the EU’s restrictions on biometric surveillance. China does, however, have privacy legislation: the Personal Information Protection Law, in force since 1 November 2021, established a more comprehensive framework for personal information protection, formally strengthening privacy safeguards within the Chinese legal system. China’s history before the publication of the Global AI Governance Action Plan in 2025 suggests that the importance it attaches to political control, technological leadership and the deployment of new technologies in law enforcement, the economy and education derives, at least in part, from these historical experiences.
Current approaches to AI governance
The United States: America’s AI Action Plan
On 23 July 2025, the White House published America’s AI Action Plan, a policy document aimed at removing barriers to American leadership in AI.13 The plan rests on three pillars: accelerating innovation, building American AI infrastructure, and leading in international diplomacy and security. It sets out the ambition to lead in AI and usher in a new period of prosperity and technological development. Michael Kratsios, Director of the White House Office of Science and Technology Policy, described AI as a cornerstone of American innovation. This rhetoric, like the administration’s use of the term “AI race”, recalls the Cold War space race and nuclear arms race: in each case, the strategic potential of a major technology has led the United States to pursue technological leadership as a source of economic and geopolitical power. The ambition to compete with China and other countries for technological leadership also appears in Secretary of State Marco Rubio’s statement that the world should continue to “run on American technology”, while David Sacks presented leadership in innovation, infrastructure and global partnerships as the condition for winning the “AI race”.
To reach these goals, the plan envisages exporting American AI through partnerships between the Departments of Commerce and State and industry, promoting the construction of data centres, expediting permits, supporting the development of a workforce that includes electricians and heating, ventilation and air-conditioning technicians, and removing federal regulations regarded as obstacles to AI innovation and adoption. It also presents federal procurement requirements of ideological neutrality for AI models as a means of upholding free speech, thereby framing part of its technological strategy in the language of rights. Sacks’s call to combine AI leadership with support for American workers and the avoidance of Orwellian uses of AI expresses the administration’s stated commitment to preventing oppressive uses of the technology.
The European Union: the AI Act
The European Commission proposed the AI Act in April 2021. The Regulation entered into force on 1 August 2024, and its prohibitions have applied since 2 February 2025. It differentiates between AI uses according to their risks and sets requirements concerning transparency, traceability, non-discrimination and human oversight. The AI Act distinguishes between prohibited practices, high-risk systems subject to stringent requirements, systems subject to specific transparency obligations, and minimal-risk uses that remain largely unregulated; systems used exclusively for military, defence or national security purposes fall outside its scope (Article 2(3)).
The prohibited practices listed in Article 5 include harmful manipulation and the exploitation of vulnerabilities due to age, disability or a specific social or economic situation; certain forms of social scoring; the untargeted scraping of facial images to build facial recognition databases; emotion recognition in the workplace and in education; biometric categorisation to infer sensitive characteristics such as race, political opinions or sexual orientation; and real-time remote biometric identification in publicly accessible spaces for law enforcement purposes. This last prohibition is subject to narrowly defined exceptions, which require prior authorisation by a judicial or independent administrative authority, and how those exceptions are applied and supervised remains an open question.
High-risk systems include AI systems that are products, or safety components of products, subject to third-party conformity assessment under EU product legislation (Article 6(1)), and the uses listed in Annex III, in areas such as biometrics, migration, law enforcement, employment and education; these systems must meet substantive requirements and, where required, undergo conformity assessment and registration. Article 50 establishes transparency obligations for certain AI systems, including the marking and disclosure of AI-generated or manipulated content; the practical effectiveness of these obligations depends on their implementation and enforcement. The EU also seeks to combine protection against AI-related risks with support for innovation, including through regulatory sandboxes and measures assisting small and medium-sized enterprises. Implementation and enforcement are shared between the European AI Office and national competent authorities.
China: the Global AI Governance Action Plan
In July 2025, China published the Global AI Governance Action Plan, which describes AI as “a new frontier in human development” and calls for international cooperation to realise its potential while addressing its risks. Like the American plan, it stresses the transformative significance of the technology and prioritises infrastructure. But where the American plan emphasises national leadership and the global adoption of American technology, the Chinese plan stresses support for developing countries, helping the Global South to access and use AI and reducing technological disparities. It calls for sustainable AI development aligned with the United Nations 2030 Agenda for Sustainable Development and for the implementation of the Global Digital Compact to help bridge the digital divide. It promotes the application of AI in areas such as the economy, education, healthcare, agriculture and poverty alleviation, and states that public sectors “should become leaders and pacesetters” in its application and governance. The plan also calls for stronger privacy and data security safeguards, environmentally sustainable AI, coordination on standards through bodies such as the International Organisation for Standardisation, and dialogue between AI companies to exchange information and practices that support technological development and cooperation.
Conclusion
Different historical experiences have thus shaped distinct approaches to AI governance: the EU places particular emphasis on fundamental rights, the United States on market-led innovation and strategic leadership, and China on technological development within a framework of strong state direction. The same technology need not produce the same rules everywhere, because regulatory choices reflect different historical conceptions of the relationship between the individual, the market and the state.
