  Privacy is a key principle for developing ethical AI technologies, but how
does including AI technologies in products and services change privacy risks?
We constructed a taxonomy of AI privacy risks by analyzing 321 documented AI
privacy incidents. We codified how the unique capabilities and requirements of
AI technologies described in those incidents generated new privacy risks,
exacerbated known ones, or otherwise did not meaningfully alter the risk. We
present 12 high-level privacy risks that AI technologies either newly created
(e.g., exposure risks from deepfake pornography) or exacerbated (e.g.,
surveillance risks from collecting training data). One upshot of our work is
that incorporating AI technologies into a product can alter the privacy risks
it entails. Yet, current approaches to privacy-preserving AI/ML (e.g.,
federated learning, differential privacy, checklists) only address a subset of
the privacy risks arising from the capabilities and data requirements of AI.
