Abstract

The rapid proliferation of Artificial Intelligence (AI) within digital media platforms has facilitated the unprecedented collection, processing, and analysis of personal user data, posing a profound threat to individual privacy. Through mechanisms such as recommender algorithms, facial recognition, profiling, and generative AI, these technologies have introduced novel dimensions of privacy infringement, presenting complex challenges to existing legal frameworks. This study investigates the legal challenges arising from AI-driven privacy violations in digital media platforms, employing a comparative analysis of the legal approaches adopted by Iran, the European Union (EU), and the United States (US). Utilizing a descriptive-analytical and comparative methodological framework, the research draws upon library resources, legal instruments, and judicial precedents. The findings reveal that the European Union employs a comprehensive, rights-based approach through the General Data Protection Regulation (GDPR) and the Artificial Intelligence Act (AI Act), establishing robust mechanisms including the right to be forgotten, Data Protection Impact Assessments (DPIA), algorithmic transparency, and privacy by design. Conversely, the United States maintains a sectoral, patchwork, and market-oriented approach, which, while fostering innovative flexibility, undermines effective privacy protection. In Iran, despite the presence of certain jurisprudential and constitutional capacities, significant legal lacunae persist due to the absence of a comprehensive data protection law, specialized AI regulations, and an independent supervisory authority. Consequently, this study proposes that Iran, by intelligently adapting the European model to its indigenous legal foundations, should enact comprehensive data protection legislation and specific AI regulations to ensure the effective safeguarding of citizens’ privacy in the digital era.