Journal of Cyber Law (JOCL)

Journal of Cyber Law (JOCL)

Emotional Customer Data Ownership in AI-Based Marketing Systems:Conceptual Analysis and Cyber Law Challenges

Document Type : Original Article

Authors
1 Ph.D. in Business Management, University of Tehran, Tehran, Iran, and Department of Business Management, Nabi Akram Higher Education Institute, Tabriz, Iran
2 PhD in Business Management, University of Tehran, Tehran, Iran, and Department of Business Management, Nabi Akram Higher Education Institute, Tabriz, Iran
3 Department of Business Administration, Abrar Institute of Higher Education, Tehran, Iran
Abstract
The rapid expansion of affective artificial intelligence and emotional computing within marketing systems has given rise to a new domain of collection, processing, and commercial exploitation of customers’ emotional data. This data derived from the analysis of facial expressions, vocal tone, behavioral patterns, and physiological signals reveals profoundly sensitive information connected to the inner emotional world of individuals. However, existing legal frameworks in cyber law and data protection face fundamental challenges in defining the legal nature, ownership, and scope of protection of such data.
This study employs an interpretive-analytical method, relying on documentary research and doctrinal analysis of laws, regulations, case law, and specialized literature, to examine the conceptual foundations of emotional customer data ownership and its associated cyber law challenges. A systematic review of the literature and legal documents reveals five key findings: the ambiguous classification of emotional data within legal taxonomies; structural inadequacies in the principle of informed consent; the risk of invasive behavioral manipulation enabled by artificial intelligence; the gap between the pace of technological development and legal response mechanisms; and legal asymmetry between consumers and corporations.
A comparative analysis of three legal regimes Europe, the United States, and China with a focus on legislative developments in 2025 and 2026, demonstrates that none of these systems provides a comprehensive solution to the issue of emotional data ownership. Finally, a four-layer governance framework for emotional data is proposed, aiming to balance marketing innovation with the dignity, autonomy, and fundamental rights of consumers, while emphasizing the need to reconsider existing legal classifications of sensitive data.
Keywords
Subjects

Barrett, L.F., Adolphs, R., Marsella, S., Martinez, A.M., & Pollak, S.D.(2019).Emotional expressions reconsidered: Challenges to inferring emotion from human facial movements.Psychological Science in the Public Interest, 20(1), 1–68.https://doi.org/10.1177/1529100619832930
Bilge, T., & Polat, S.(2025).Affective computing and emotional data: Challenges and implications for AI systems, privacy, and governance.arXiv preprint arXiv:2509.20153.https://doi.org/10.48550/arXiv.2509.20153
Bognadovic. Z, Milovanovic. S, Labus. A, Zrakic. M(2022). Social recruiting: An application of social network analysis for preselection of candidates. Data Technologies and Applications. 56, 536-557.
Brookes, T. Mitchell B, (2018). Automated correspondence not necessarily a 'decision' which can be relied on. Retrieved from https://www.ashurst.com/en/news-and-insights/legal- updates/automatedcorrespondence-not-necessarily-a-decision-which-can-be-relied-on/
Condlin, R, (2017). Online Dispute Resolution: Stinky, Repugnant, or Drab. Cardozo Journal of Conflict Resolution, Vol.18, Issue.3, 2017.
California Privacy Protection Agency.(2026).Regulations on automated decisionmaking technology, risk assessments, cybersecurity audits, and corrections.California Code of Regulations, Title 11.https://cppa.ca.gov/regulations/
Chen, M., & Chen, M.(2025).Trust, privacy fatigue, and the informed consent dilemma in mobile app privacy pop-ups: A grounded theory approach.Journal of Theoretical and Applied Electronic Commerce Research, 20(3), 179.https://doi.org/10.3390/jtaer20030010
CMA (Competition and Markets Authority).(2026).Agentic AI: How AI agents may affect consumers and how traders should mitigate risk.United Kingdom Competition and Markets Authority Research Paper.https://www.gov.uk/government/publications/
Colorado General Assembly.(2024).Senate Bill 24-205: Consumer protections for artificial intelligence (Colorado Artificial Intelligence Act).Colorado Revised Statutes.https://leg.colorado.gov/bills/sb24-205
Crawford, K.(2021).The atlas of AI: Power, politics, and the planetary costs of artificial intelligence.Yale University Press.https://doi.org/10.12987/yale/9780300209570.001.0001
De Bruyn, A., Viswanathan, V., Beh, Y.S., Brock, J.K.-U., & von Wangenheim, F.(2020).Artificial intelligence and marketing: Pitfalls and opportunities.Journal of Interactive Marketing, 51, 91–105.https://doi.org/10.1016/j.intmar.2020.04.007
Davenport, T., Guha, A., Grewal, D., & Bressgell, T.(2020).How artificial intelligence will change the future of marketing.Journal of the Academy of Marketing Science, 48(1), 24–42.https://doi.org/10.1007/s11747-019-00696-0
Determann, L.(2024).No one owns data.Houston Law Review, 67(4), 1–87.https://doi.org/10.2139/ssrn.3632002
Draper, N.A., & Turow, J.(2024).Americans cannot consent to companies' use of their data.International Journal of Communication, 18, 1–28.https://ijoc.org/index.php/ijoc/article/download/21490/4264
European Commission.(2025).Guidelines on prohibited artificial intelligence practices under Article 5 of the AI Act and guidelines on the AI system definition.Brussels: European Commission.https://digital-strategy.ec.europa.eu/en/policies/regulatory-framework-ai
Floridi, L., Cowls, J., Beltrametti, M., Chatila, R., Chazerand, P., Dignum, V., Luetge, C., Madelin, R., Pagallo, U., Rossi, F., Schafer, B., Valcke, P., & Vayena, E.(2018).AI4People—An ethical framework for a good AI society: Opportunities, risks, principles, and recommendations.Minds and Machines, 28(4), 689–707.https://doi.org/10.1007/s11023-018-9482-5
Goldfarb, A., & Tucker, C.(2019).Digital economics.Journal of Economic Literature, 57(1), 3–43.https://doi.org/10.1257/jel.20171302
Grewal, D., Kroschke, M., Novak, T.L., & Roggeveen, A.L.(2020).Frontline cyborgs at your service: How human enhancement technologies affect customer experiences in retail, sales, and service settings.Journal of Interactive Marketing, 51, 9–25.https://doi.org/10.1016/j.intmar.2020.04.006
Häuselmann, A.(2023).EU law and emotion data.arXiv preprint arXiv:2309.10776.https://doi.org/10.48550/arXiv.2309.10776
Huang, M.-H., & Rust, R.T.(2021).A strategic framework for artificial intelligence in marketing.Journal of the Academy of Marketing Science, 49(1), 30–49.https://doi.org/10.1007/s11747-020-00749-9
Ienca, M., Fabris, J., Petchovsky, L., Marín-Pedreño, J., & Lavazza, A.(2022).Mental data protection and the GDPR.Journal of Law and the Biosciences, 9(1), lsac006.https://doi.org/10.1093/jlb/lsac006
Information Commissioner's Office.(2026).Consultation on automated decision-making and profiling guidance.United Kingdom Information Commissioner's Office.https://ico.org.uk/
Jobin, A., Ienca, M., & Vayena, E.(2019).The global landscape of AI ethics guidelines.Nature Machine Intelligence, 1(9), 389–399.https://doi.org/10.1038/s42256-019-0088-2
Joshi, R., Adjagbodjou, A., & Luria, M.(2026).Dark patterns in AI chatbots: A taxonomy to inform better design.Center for Democracy & Technology Research Report.https://cdt.org/
Kaminski, M.E., & Urban, J.M.(2024).The right to an explanation in the EU General Data Protection Regulation.European Data Protection Law Review, 10(1), 3–21.https://doi.org/10.21552/edpl/2024/1/2
King, T.C., Aggarwal, N., Taddeo, M., & Floridi, L.(2020).Artificial intelligence crime: An interdisciplinary analysis of foreseeable threats and solutions.Science and Engineering Ethics, 26(1), 89–120.https://doi.org/10.1007/s11948-019-00149-x
Kindt, E.(2018).Having yes, using no? About the new legal regime for biometric data and the legal consequences.Computer Law & Security Review, 34(2), 246–264.https://doi.org/10.1016/j.clsr.2017.11.004
Kalyan, S.K(2024). A survey of GPT-3 family large language models including ChatGPT and GPT-4. Natural Language Processing Journal, 6, 100048.
Lexology.(2026).Data Protection Day 2026: Year in review.Lexology Legal Intelligence.https://www.lexology.com/
Luguri, J., & Strahilevitz, L.J.(2021).Shining a light on dark patterns.Journal of Legal Analysis, 13(1), 43–109.https://doi.org/10.1093/jla/laaa006
Malgieri, G.(2022).Property and (intellectual) ownership of consumers' data: A new (economic) fair deal? European Journal of Consumer Law, 2022(2), 231–266.
Mathur, A., Acar, G., Friedman, M.J., Lucherini, E., Mayer, J., Chetty, M., & Narayanan, A.(2019).Dark patterns at scale: Findings from a crawl of 11K shopping websites.Proceedings of the ACM on Human-Computer Interaction, 3(CSCW), 1–32.https://doi.org/10.1145/3359183
McStay, A.(2020).Emotional AI: The rise of empathic media.SAGE Publications.
Popescu, A.D., & Gherghina, S.M.(2026).The impact of dark AI patterns on consumer purchase decisions and impulsive buying.European Research Studies Journal, 29(1), 490–499.https://doi.org/10.35808/ersj/4324
Puntoni, S., Reczek, R.W., Giesler, M., & Botti, S.(2021).Consumers and artificial intelligence: An experiential perspective.Journal of Marketing, 85(1), 131–151.https://doi.org/10.1177/0022242920953847
Purtova, N.(2018).The law of everything: Broad concept of personal data and future of EU data protection law.Law, Innovation and Technology, 10(1), 40–81.https://doi.org/10.1080/17579961.2018.1452176
Smuha, N.A.(2021).From a race to AI to a race to AI regulation: Regulatory competition for artificial intelligence.Law, Innovation and Technology, 13(1), 57–84.https://doi.org/10.1080/17579961.2021.1958481
Solove, D.J.(2021).The myth of the privacy paradox.The George Washington Law Review, 89(1), 1–51.https://doi.org/10.2139/ssrn.3536265
Solove, D.J., & Citron, D.K.(2018).Risk and anxiety: A theory of data-breach harms.Texas Law Review, 96(4), 737–786.https://doi.org/10.2139/ssrn.2934744
Talaviya, T., Shah, D., Shah, N., & Ramkumar, P.(2025).The EU AI Act: A practical guide to emotion recognition systems and the road to August 2026 compliance.Computer Law Review International, 26(1), 11–24.https://doi.org/10.9785/cri-2025-260101
Townsend, S.S.M., Kim, J., Erete, S., & Pierre, J.E.(2023).Emotion AI at work: Implications for workplace surveillance, privacy, and emotional labor.In Proceedings of the 2023 CHI Conference on Human Factors in Computing Systems (pp.1–19).Association for Computing Machinery.https://doi.org/10.1145/3544548.3580950
Veale, M., & Zuiderveen Borgesius, F.(2021).Demystifying the Draft EU Artificial Intelligence Act—Analysing the good, the bad, and the unclear elements of the proposed approach.Computer Law Review International, 22(4), 97–112.https://doi.org/10.9785/cri-2021-220402
Wachter, S., & Mittelstadt, B.(2019).A right to reasonable inferences: Re-thinking data protection law in the age of big data and AI.Columbia Business Law Review, 2019(2), 494–620.https://doi.org/10.7916/cblr.v2019i2.4851
Wilson Elser.(2026).Artificial intelligence legislative update: State and federal developments.Wilson Elser Legal Insight.https://www.wilsonelser.com/
Yeung, K.(2018).Algorithmic regulation: A critical interrogation.Regulation & Governance, 12(4), 505–523.https://doi.org/10.1111/rego.12158
Zhang, L., & Chen, J.(2024).The rise of data property rights in China: How does it compare with the EU Data Act? Journal of International Economic Law, 27(3), 462–485.https://doi.org/10.1093/jiel/jgae023
Zuiderveen Borgesius, F.(2020).Strengthening legal protection against discrimination by algorithms and artificial intelligence.The International Journal of Human Rights, 24(10), 1572–1593.https://doi.org/10.1080/13642987.2020.1743976