Michael Veale

Michael Veale is a technology policy academic who focuses on information technology and the law. He is Professor of Technology Law and Policy in the Faculty of Laws at University College London (UCL).

Education Veale holds a PhD from University College London in the application of law and policy to the social challenges of machine learning, a BSc in Government and Economics from the London School of Economics and a MSc in Sustainability, Science and Policy from Maastricht University.

Academic career Veale joined the Faculty of Laws at UCL in 2019 as lecturer in Digital Rights and Regulation, was appointed associate professor in 2021 and full professor in 2025. He primarily teaches Internet law and privacy and data law. Veale was previously a Digital Charter Fellow at the Alan Turing Institute, the UK's National Centre for AI and Data Science, and the UK Government's Department for Digital, Culture, Media and Sport.

Veale has authored and co-authored reports on data and technology policy for the Royal Society, the Law Society of England and Wales and the Commonwealth Secretariat.

Scholarship Veale's scholarship concerns information technology, law and society. His work has highlighted tensions between the practice and functioning of technologies including machine learning, encryption and Web technologies, and the laws that govern them. Veale's work has been influential among governments, legislators and NGOs. Work with Lilian Edwards on a right to an explanation in data protection law has led to legislative amendments in the UK Parliament, and has been cited by the US Federal Trade Commission, the Article 29 Data Protection Working Party, the Council of Europe, the United Nations special rapporteur on Extreme Poverty and Human Rights Philip Alston, the European Parliament, European Commission, and the Information Commissioner's Office. His work on the legality of cookie consent banners has also been cited by the Irish Data Protection Commissioner, Facebook and a range of media outlets. During the COVID-19 pandemic, Veale co-authored the Decentralized Privacy-Preserving Proximity Tracing protocol for Bluetooth contact tracing apps which formed a basis for Apple and Google's partnership protocol, Exposure Notification.

Digital rights activism Veale is a noted digital rights activist. He is a member of the Advisory Councils of the Open Rights Group and Foxglove, both of which are UK-based NGOs which campaign in favour of privacy and digital rights, and advises the Ada Lovelace Institute.

Right of access to personal data Veale has been involved in a variety of actions concerning the right to access personal data under data protection law.

It has been reported that Veale is party to a complaint to the Irish data protection authority concerning Apple's refusal to provide access to users' personal data in the form of recordings made by Siri,

Complaints from Veale around the refusal by Facebook and Twitter to provide access to data concerning the extent of their Web tracking operations have also reportedly led to investigations by the Irish Data Protection Commission. The commission's Annual Report lists these complaints as 2 of 27 cross-border inquiries commenced since 25 May 2018, concerning Twitter's use of advertising URL shortening and Facebook's 'Hive' database.

Following the release of the choose-your-adventure style movie Bandersnatch by Netflix in 2019, Veale obtained his and posted his viewing data from Netflix by invoking his right of access under the European Union General Data Protection Regulation (GDPR), leading to an array of coverage of the issue and debates around the use of such information in profiling.

AdTech In September 2018, Veale, Johnny Ryan (then-Chief Policy and Industrial Relations Officer at Brave), and Jim Killock (executive director of the Open Rights Group) filed a complaint with the UK Information Commissioner's Office (ICO) and the Irish Data Protection Commission (DPC), notifying the data protection authorities about systemic breaches of data protection law by the AdTech industry. They drew specific attention to mass surveillance of Internet users for the purposes of behavioural advertising, and the use of the data gathered and inferred to power real-time-bidding (RTB) auction systems. They suggested that the collection and processing of personal data by players in the adtech industry was without legitimate basis and conducted without legally valid consent, contrary to the GDPR. A later academic paper by Veale outlined their argument.

In May 2019, the Irish DPC opened a formal investigation into the AdTech industry.

In June 2019, the ICO responded to the complaint in a report, agreeing that the collection of personal data was "taking place unlawfully". It also agreed that there were "systemic concerns" about the AdTech industry's use of personal data. One of the ICO's deputy commissioners, Simon McDougall, warned the AdTech industry that there was a need for reform, saying "We have significant concerns about the lawfulness of the processing of special category data which we’ve seen in the industry, and the lack of explicit consent for that processing". He also noted that the existing justifications offered by players in the AdTech industry appeared to be insufficient. McDougall also criticised the industry's failure to conduct proper Data Protection Impact Assessments (DPIAs) as required under the GDPR, describing the DPIAs the ICO had reviewed as "generally immature" and lacking "appropriate detail". Veale criticised the ICO's response, stating that: When an industry is premised and profiting from clear and entrenched illegality that breach individuals' fundamental rights, engagement is not a suitable remedy. The ICO cannot continue to look back at its past precedents for enforcement action, because it is exactly that timid approach that has led us to where we are now.The ICO subsequently appeared to take no further action until May 2020, when it announced it was suspending its investigation to avoid putting "undue pressure" on the advertising industry during the COVID-19 pandemic. In letters to the complaints, the ICO stated that it was closing the complaint but claimed it intended to "recommence our industry wide investigation into RTB in due course".

In November 2020, Killock and Veale challenged the ICO's decision to closing their complaint in the Upper Tribunal.

Contact-tracing during the COVID-19 pandemic Veale was part of the research team that developed the Decentralised Privacy-Preserving Proximity Tracing protocol (DP-3T) for contact tracing during the COVID-19 pandemic. NHSX maintained that their contact-tracing app was capable of centralised contact-tracing despite these concerns. On 18 June 2020, the UK government announced it would abandon its centralised contact-tracing app, and switch to using Apple and Google's decentralised contact-tracing technology, which is based substantially on the DP-3T protocol.

Artificial intelligence and education Veale has been a noted critic of the impact of artificial intelligence on education. A 2025 position paper led by Veale as Vice Dean (Education Innovation) of UCL Laws on responding to the pedagogical and assessment integrity challenges posed by AI to legal education received broad media attention.