Week in Review: Cameras, Classifiers, and What Happens to Your Data When the Company Dies
Facial recognition on the Tube. A four-year-unpatched criminal records portal. An airline's emails and 30 million recorded calls sold for $10 million....
privacy
152 articles on privacy.
ChatGPT for Teens Means ChatGPT Is Now Guessing Everybody's Age
OpenAI began rolling out ChatGPT for Teens on 18 August, with a global rollout expected to complete in two weeks. Users who state they are 13 to 17 go...
800 Pubs Just Told Meta's Glasses to Switch the Camera Off
J D Wetherspoon has asked customers across more than 800 UK venues to disable recording on Meta smart glasses, describing the devices as enabling surr...
Google Bought a Dead Airline's Data for $10 Million, and Picked the Company That Anonymised It
In a bankruptcy auction revealed in an 14 August court filing, Google won Spirit Airlines' enterprise dataset for $10 million: 100 million emails, 500...
Chat Control Is Back Until 2028, and the AI Act's Big Date Came and Mostly Went
Member states approved the temporary CSAM scanning derogation in early August, restoring voluntary message scanning until April 2028 after a Parliamen...
The Age Checks Are Being Mandated Just as AI Makes Them Trivially Beatable
A convincing fake ID now costs about $15 and takes half an hour. Generative-AI document fraud detections rose 90% year over year, the fastest-growing ...
Washington's Attorney General Counted, and 83% of People Said They Have No Control
Washington released its first-ever Data Privacy Report on 14 August. In 2025 the state logged 209 breaches affecting more than 8 million residents — a...
Flock Wrote Its Own Rulebook, and the Word 'Warrant' Is Not In It
After at least fifty officers were accused of using its plate network to stalk people they knew, Flock Safety announced reforms: seven-day default ret...
Framework, Trezor, and a Freight Company: A Week Where Nobody's Own Systems Were Breached
Framework told all its customers their data was taken. Trezor told 14,000 buyers their names and home addresses are out. Ceva Logistics leaked custome...
Seven Months Inside the UK Criminal Records Office, on Software Last Patched in 2019
The ICO has reprimanded ACRO Criminal Records Office after attackers spent seven months inside its website and content management system. The portal w...
ICE Pulled a $125 Million Sole-Source Contract and Nobody Should Feel Relieved
ICE withdrew its no-bid $125 million surveillance-data award to Thomson Reuters and will compete it instead, with a solicitation expected 24 August. I...
Somebody Finally Mapped the Pipe: DecryptAds Puts 284 Million Ad Supply-Chain Records in the Open
For years the answer to 'who exactly received my location when that app loaded an ad?' has been that nobody outside the industry could know. DecryptAd...
Live Facial Recognition Arrives on the London Underground
British Transport Police switched on live facial recognition inside a Tube station for the first time on 11 August, at Victoria. Every face that walks...
Claude Is Now Watermarking Its Text — Invisibly, Worldwide, and Not Because America Asked
Anthropic has begun embedding imperceptible machine-readable watermarks in text generated by Claude, plus C2PA-signed provenance metadata on generated...
Fortnight in Review: A Delete Button That Works, an Age Gate That Won't, and Seams Coming Apart
Two weeks that produced the best privacy mechanism America has ever shipped and the worst architecture Congress has advanced, in the same news cycle. ...
Privacy Claims Doubled in Six Months — and State Attorneys General Are Why
Pennsylvania sued TikTok over its age rating and youth safeguards. Utah joined a federal suit against Hims & Hers over data privacy. Insurers report t...
Pass-the-Passkey: 20+ Ways to Beat Passkeys Without Touching the Cryptography
SpecterOps researchers documented more than 20 attack techniques against passkeys across Windows 11, Microsoft Entra ID, browsers, and password manage...
Vegas Week: Hackers Spent August Explaining Why Age Verification Is a Breach Waiting to Happen
Black Hat USA ran August 1–6 and DEF CON 34 ran August 6–9, in the same week the Senate advanced four bills that require knowing every internet user's...
The Week the Watchers Got Breached — 100,000 UK Police, Swiss Federal Servers, and a Law Firm Wave
Hackers calling themselves ExfilSquad took names, organizations, and email addresses for more than 100,000 police officers and criminal justice profes...
The Youth AI Privacy Act Has One Genuinely Good Idea and One Fatal Design Flaw
S. 4199 would bar AI companies from training on minors' chat logs or disclosing them to other firms. That provision is correct and overdue. But by pro...
Four Bills, One Committee, One Direction — the Senate Just Advanced the Age-Gated Internet
On August 5 the Senate Commerce Committee advanced KOSA, the SCREEN Act, the Youth AI Privacy Act, and the CHATBOT Act in a single sitting. Every one ...
Four Ad Libraries Ship Your Precise Location by Default — and the App Developer Usually Doesn't Know
An EFF investigation found that BidMachine, InMobi, Verve's HyBid, and Huawei's Petal Ads can collect or transmit device location by default once the ...
The EU AI Act's Big Day Arrived — and the Biometric Surveillance Rules Weren't On It
August 2, 2026 was supposed to be the day high-risk AI obligations became enforceable across the EU — police facial recognition, employment screening,...
California's Delete Button Went Live Today — 600 Data Brokers, 300,000 Requests, $200 a Day
As of August 1, every data broker registered in California must check the state's DROP platform at least once every 45 days and delete the personal in...
Courts Are Deciding Nobody Is Liable for the Trackers on Your Health Insurer's Website
A federal judge dismissed claims against Blue Shield of California over Google Analytics and the Meta Pixel running on its site, reasoning that only t...
The FTC Wants to Police What AI Models Refuse to Say — and Privacy Advocates Want It Withdrawn
The FTC's proposed policy statement on the 'suppression of accuracy in artificial intelligence systems' closed its comment period on July 31. Issued u...
ICE Outsourced Finding People — 13 Private Firms, 50,000 Names a Month, and AI Doing the Looking
Immigration and Customs Enforcement has issued open-ended skip-tracing contracts to 13 private companies worth up to $1.2 billion over two years. Each...
Enforcement Arrives, Data Keeps Leaking: The Privacy Week of July 19–26, 2026
In eight days: California opened its first proactive privacy audit, nine states lost their grace periods, an AI agent breached Hugging Face, 55 millio...
The GDPR Rewrite Stalled — Cyprus Pulled Its Text, and Ireland Inherited the Mess
The Cyprus Presidency withdrew its Digital Omnibus compromise text on June 30 after it became clear no qualified majority existed. Ireland took over t...
Cancer Diagnostics, Payroll Files, and Tax Returns: The Week Enterprise Data Kept Falling Out
Abbott Laboratories lost 30 million rows from its Cancer Diagnostics business, including over a million Social Security numbers, to ShinyHunters. Esté...
830 Towers Becoming 2,300 — and a Thousand Police Departments Cleared to Fly
A GAO report shows DHS plans to nearly triple border surveillance towers to 2,300 by 2034, funded by $1 billion in new spending — while CBP has failed...
The Grace Period Is Over: Nine States Can Now Fine You for a First Privacy Violation
Twenty state privacy laws are in effect, and as of July 2026 nine of their cure periods have lapsed — a first violation now means enforcement, not a w...
California's Privacy Regulator Just Opened Its First Audit — and It Picked the Gig Economy
CalPrivacy announced its first formal CCPA compliance audit on July 21, targeting app-based transportation, delivery, and task platforms. It will exam...
55 Million Suno Users Were Breached in November. They Found Out From Have I Been Pwned in July.
AI music platform Suno was compromised in November 2025 — names, addresses, phone numbers, purchase histories, and partial card data for 55.3 million ...
An AI Agent Breached Hugging Face — and Machine-Speed Attacks Stopped Being a Demo
Hugging Face confirmed that an attacker chained two code-execution flaws in its dataset pipeline, stole cloud credentials, moved laterally into intern...
Three Weeks After Chatrie: What the Supreme Court's Geofence Ruling Actually Changed — and What It Didn't
The Supreme Court ruled 6-3 that geofence warrants are Fourth Amendment searches, extending Carpenter into the cloud. But the Court pointedly declined...
Show Your ID to Speak: How 'Protecting Children Online' Became a Global Age-Verification Dragnet
In the name of child safety, the EU is rolling out an age-verification app, Brussels is preparing an EU-wide social media ban for kids, Australia has ...
Surveillance by Default: The Week the Machinery Won Without Winning the Argument
This week's ledger isn't about a breach — it's about architecture. Europe's message-scanning regime survived a vote a majority cast against it. Americ...
How Chat Control Survived a Vote It Lost: The EU's Message-Scanning Regime Lives On Until 2028
On July 9, a majority of the European Parliament voted to end the EU's mass message-scanning regime — 314 against, 276 for. It survived anyway. Becaus...
100,000 Cameras and a Reckoning: How Flock Safety Became America's Most-Cancelled Surveillance Company
Flock Safety's automatic license plate readers now number more than 100,000 across the United States, quietly logging where your car goes and building...
The Squeeze on GrapheneOS: What Happens to the Private Phone When Google Stops Making the Only Phone It Runs On
GrapheneOS is the gold standard for a hardened, de-Googled Android phone — and for years it ran on exactly one hardware line: Google's Pixel. In 2026 ...
The Guards Left the Keys Out: CISA's GitHub Leak, a Worm in the npm Supply Chain, and the County That Paid $1M in Secret
This week's ledger is about guardians failing at their own jobs. CISA — the agency that lectures America on credential hygiene — published a postmorte...
$2.60 Per Genome: 42 States Settle With 23andMe for $18 Million Over the Breach That Broke It
Forty-two state attorneys general announced an $18 million settlement with 23andMe's bankruptcy estate over the 2023 credential-stuffing breach that e...
Paid in Shares of the Company That Scraped You: Seventh Circuit Throws Out the Clearview AI Settlement
The settlement was one of the strangest in privacy law: instead of cash, everyone whose face Clearview AI scraped would get a 23% equity stake in Clea...
Two Minutes, No Suspicion Required: Fourth Circuit Says Border Agents Can Manually Search Your Phone at Will
In United States v. Belmonte Cardozo, the Fourth Circuit held that a manual search of your cellphone at the border is 'routine' — meaning a CBP office...
Your Doorbell Is a Battlefield Sensor: Russia Turned Europe's Civilian Cameras Into a Spy Network
Dutch intelligence services revealed that Russian state hackers have been quietly compromising civilian IP cameras across Europe — including smart doo...
Brussels Calls the Feed What It Is: EU Finds Facebook and Instagram's Addictive Design Breaks the Law
After a two-year investigation, the European Commission has preliminarily found that Meta's infinite scroll, autoplay, and engagement-tuned recommende...
Chat Control Rises From the Dead: Parliament Fails to Block Message Scanning Until 2028 — By 47 Votes
In March, the European Parliament killed Chat Control 1.0. In April, it expired. Today it came back: a motion to reject the extension won the vote 314...
6.99 Million Driver's Licenses, 35 GB of Accenture's Keys, and a 24-Billion-Record Dump: The Breach Ledger Catches Up
AssuranceAmerica sat on a breach for nearly four months before telling 6.99 million people their driver's license numbers were gone — the largest lice...
The Other Shoe: How the Supreme Court's FTC Ruling Just Put Every EU-US Data Transfer on the Clock
On June 29, the Supreme Court handed privacy advocates a landmark win in Chatrie. The same day, it quietly detonated the legal foundation under transa...
One Zero-Day, a Dozen Victims: The Oracle Breach Wave Hits Insurance Regulators, Nissan, and 9 Million Medtronic Patients
ShinyHunters exploited a zero-day in Oracle's enterprise software and the disclosures are now landing in a wave: America's insurance regulators lost 3...
July 1 Brings Neural Data Protections, LLM Training Disclosures, and Two New Privacy States
Today, Arkansas becomes a comprehensive-privacy state, Utah adds a right to correct your data, and Connecticut's beefed-up CTDPA starts protecting neu...
The KIDS Act Passes the House 267-117 — The Anonymity Tax Heads to the Senate
Last night the House passed the Kids Internet and Digital Safety Act, the first time any version of KOSA has cleared the lower chamber. The duty of ca...
Chatrie v. United States: The Supreme Court Just Put the Fourth Amendment Between You and the Geofence Dragnet
In a 6-3 decision authored by Justice Kagan, the Supreme Court held that police conduct a Fourth Amendment search when they obtain historical location...
Chat Control's Endgame: Tomorrow, Brussels Decides Whether Every European Message Gets Scanned
On June 29, negotiators from the EU Parliament, Council, and Commission sit down for the fifth and final scheduled trilogue on the Child Sexual Abuse ...
The June Breach Ledger: A Record Korean Fine, a Nintendo Ransom, and 1.4 Million Medical Records
While the policy fights over age verification and facial recognition grabbed the headlines, the back half of June 2026 delivered a brutal run of breac...
Loyalty Tax: The Washington Post Allegedly Charged Its Most Devoted Readers More — by Watching How They Read
A class action says The Washington Post turned readers' habits — which columnists they follow, when they check election news — into a 'pricing profile...
The KIDS Act: How a Child-Safety Bill Became a Mandate to Card Every American Online
House leaders bundled KOSA, COPPA 2.0, and a dozen other bills into one giant package — the Kids Internet and Digital Safety Act. In the deal-making, ...
It's Law Now: Britain Bans Under-16s From Social Media — and Builds the Age-Check Machine to Enforce It
We've tracked the Children's Wellbeing and Schools Bill since it was a 'Trojan horse for mass surveillance.' On June 17, 2026, Keir Starmer confirmed ...
You Didn't Consent to Ring's Camera, But It Remembers Your Face Anyway
Amazon's Ring rolled out a feature called 'Familiar Faces' that uses AI to recognize and remember people who walk past its doorbell cameras. A new cla...
A 93% Match and an Overnight in Jail: How Florida's Facial Recognition Wrongly Branded Robert Dillon a Child Predator
Jacksonville Beach police ran a grainy photo through a facial recognition system called FACESNXT, got a '93% match,' and built a child-luring case aro...
When the Escape Hatch Becomes the Target: Europe Declares War on the VPN
Age-verification laws drove millions of Europeans to download VPNs. Now Brussels has noticed — and the European Parliament's research arm is calling t...
Curfews, Kill-Switches and the Under-16 Ban: What Starmer's Social Media Crackdown Actually Does
Keir Starmer has announced that Britain will bar under-16s from TikTok, YouTube, Instagram and the rest — complete with overnight curfews, anti-doomsc...
When the Blueprint Becomes the Battleground: Washington, New York, and the Fight Over 3D-Gun Files
Washington and New York have moved to regulate not just 3D-printed guns but the digital files used to make them. Banning a physical weapon is one thin...
When the Best Model in the World Vanishes in Three Days: The Case for Local AI
Anthropic's Fable 5 launched on June 9 and was pulled days later after a Commerce Department directive. Whatever you think of the policy, the lesson i...
The Domino Effect, 2026 Update: Five More Countries Mandate Age Checks for Social Media
Australia's under-16 ban came into force in December 2025. Six months later, Brazil, Greece, Turkey, and Malaysia have followed with their own age-che...
Spotify's Spam Flood: 57,000 AI Podcasts and the Collapse of Platform Trust
Spotify removed 57,000 AI-generated podcast episodes pushing illegal pharmacies and crypto scams — and the accounts it actioned jumped from 87 in 2024...
Brussels Pries Open WhatsApp: Meta Has Days to Let Rival AI Back In
Meta quietly evicted every AI assistant but its own from WhatsApp. On June 10, the European Commission gave it roughly a working week to reverse cours...
Scanning Before the Lock Clicks: The UK's Plan to Search Your Phone Before Encryption
The UK keeps circling back to the same idea: have your phone inspect your messages before encryption ever protects them. Client-side scanning is sold ...
The Same Day: A UK Cop Accused of Faking Evidence With AI, and a £140m Bet on Police AI
A Derbyshire officer is under criminal investigation for allegedly using AI to fabricate evidence across multiple cases. Days earlier, the UK announce...
Build the Database and It Will Be Abused: Cops Are Using Flock Cameras to Stalk Their Exes
An Institute for Justice study found at least 18 police officers caught using automated license-plate-reader networks to stalk romantic interests. One...
London Blocks a £50m Palantir Police Deal — But a Block Is Not a Ban
In May 2026 the Mayor of London's policing office blocked the Met's £50m plan to buy AI software from Palantir. It was a procurement decision, not a p...
Bill C-34 and the 'Missing Piece' Theory: What Canada's Digital Bills Actually Say
A viral theory holds that four Liberal bills — C-8, C-9, C-22, and C-34 — are snapping together into a Canadian digital-ID surveillance grid, with C-3...
When Transparency Becomes an Attack Surface: Maine's Breach Portal Goes Dark
Maine pulled its public data-breach database offline this month after someone planted fake disclosures naming VRChat and Discord. The episode exposes ...
Google Sues the Factory Behind Your Fake Toll Texts
Google has taken a Chinese-language phishing-as-a-service operation called Lighthouse to court, blaming it for the flood of fake USPS, E-ZPass, and to...
New York's FAIR News Act: When 'Made With AI' Becomes the Law
New York's FAIR News Act would force news organizations to label content substantially made with generative AI — covering weather, sports, and enterta...
Sovereignty Is a Login Screen: France's Linux Migration and the Day Microsoft Cut Off a Prosecutor
France is moving 2.5 million government computers off Windows and onto Linux, and the timing is not an accident. The push gathered force after US sanc...
Two Minutes to Break a Child-Safety Promise: The EU's Age-Verification App Meets Reality
Brussels unveiled a privacy-preserving app to keep children safe online and prove age without exposing identity. Within roughly two minutes, a securit...
The $130 Billion Question: Who Decides Where America's AI Gets Built?
The federal AI buildout promises 75-plus data centers worth $130 billion-plus, fast-tracked onto American soil. But the same number turns up in a stra...
To Protect Kids Online, Congress Wants to ID Everyone. That's the Trade Nobody Voted For.
A House subcommittee just took up 19 federal digital-media bills, including a revised Kids Online Safety Act and an App Store Accountability Act that ...
Connecticut Just Quietly Passed One of the Strongest State Privacy Updates of 2026
Connecticut's Governor signed SB 4 and SB 5 into law, significantly amending the state's consumer data privacy act and creating a new data broker law....
Five Eyes Warns China Is Recruiting Insiders Through LinkedIn. Your Job Profile Is Intelligence Data.
The Five Eyes intelligence agencies issued a rare joint bulletin warning that Chinese military intelligence is using LinkedIn, Indeed, and Upwork to i...
Amazon's Ring Is Scanning the Faces of People Who Never Bought a Ring. Now It's a Class Action.
A new class action over Ring's 'Familiar Faces' feature gets at the core problem with neighborhood facial recognition: the people being scanned never ...
Trump's New AI Executive Order Makes Frontier Model Security Review Voluntary. That's the Problem.
The June 2 executive order 'Promoting Advanced Artificial Intelligence Innovation and Security' creates a voluntary pre-release cybersecurity review f...
The 'Your Phone Is Listening' Ad Tool Was a Scam — and the FTC Just Proved It
Cox Media Group marketed 'Active Listening' — an AI service it claimed could target ads based on conversations overheard by smart devices. The FTC fou...
A Whistleblower Says DOGE Copied Every American's Social Security Record to an Uncontrolled Cloud
Chuck Borges, the former chief data officer at the Social Security Administration, alleges that DOGE copied the government's master Social Security da...
China Breached the FBI's Wiretap System. The Targets' Phone Numbers Were Inside.
The FBI has told Congress that a Chinese intrusion into one of its internal surveillance systems is a 'major cyber incident.' The system — part of the...
California Just Fined GM $12.75M for Collecting Too Much Data — Not for Leaking It
California's $12.75 million settlement with General Motors is the largest CCPA penalty in state history — and the first built on the data-minimization...
Amnesty International: Generative AI Is 'Unlawful by Design' — Built on Mass Privacy Violations
Amnesty International's May 28 report 'Unlawful by Design' concludes that OpenAI, Google, Meta, and DeepSeek built generative AI through systematic, u...
Palantir Built ICE a Deportation Map Using Your Medicaid Records. Here's How It Works.
ICE's ELITE tool — built by Palantir — populates a real-time map of deportation targets using data including Medicaid records from 80 million patients...
The Digital Euro Is Coming. Here's What a €3,000 Holding Cap and a Centralised Ledger Actually Mean for Your Privacy.
The European Central Bank's digital euro is scheduled for a 2029 debut with a €3,000 individual holding cap and a centralised ledger that grants autho...
FarSight: The Drone Surveillance System That Identifies You by Your Walk, Not Just Your Face
Researchers have built a drone surveillance system called FarSight that identifies individuals at long range by fusing facial recognition, gait analys...
The EU's Digital ID Wallet Deadline Is December 2026. Most Member States Aren't Close.
Every EU member state must offer a functional European Digital Identity Wallet by end of 2026. As of April, only four had reached public sandbox stage...
70+ Civil Liberties Groups Want Meta to Stop Its Facial Recognition Smart Glasses. An Internal Memo Explains Why They're Worried.
A coalition of 70+ organisations including the ACLU and EFF is demanding Meta halt its 'Name Tag' facial recognition feature for Ray-Ban and Oakley sm...
The EFF Says the SECURE Data Act Is Privacy Theater — Are They Right?
We covered the SECURE Data Act when it passed committee, calling it a meaningful step toward federal privacy law. The Electronic Frontier Foundation j...
The FTC Just Banned a Data Broker From Selling Sensitive Location Data. Here's Why That Matters.
The FTC secured a settlement banning Kochava's subsidiary from selling sensitive location data linked to millions of mobile devices — including data r...
Canada Found OpenAI Broke Privacy Law Training GPT-4. The Fix Doesn't Apply to the Models That Broke It.
A joint investigation by Canadian privacy commissioners found that OpenAI's collection of personal data to train GPT-3.5 and GPT-4 was 'overbroad and ...
GDPR Breach Notifications Hit 443 Per Day — What Eight Years of Data Tells Us
European data protection authorities are now receiving 443 personal data breach notifications every single day — a 22% increase over last year and the...
Your Scattered Public Data Can Be Assembled Into a Digital Twin of You — Researchers Just Proved It
Researchers used LLMs, GANs, and cross-platform image matching to reconstruct detailed personal profiles from fragmented public social media data — ac...
GM Sold Your Location to Data Brokers While Claiming It Didn't. California Just Fined Them $12.75 Million.
General Motors earned $20 million selling OnStar driver location and behaviour data to Verisk Analytics and LexisNexis while its privacy policy told c...
Vietnam Just Enacted Its First National Data Protection Law — Southeast Asia's Privacy Landscape Is Changing Fast
Vietnam has enacted its first comprehensive national data protection law, joining a wave of privacy legislation sweeping Southeast Asia. The law intro...
New York Is Coming for Your Face and Your AI Training Data — Two Bills Just Passed
New York's Senate passed the Biometric Identifier Privacy Act, requiring opt-in consent before companies can collect your facial geometry, fingerprint...
Colorado Just Scrapped Its AI Law and Started Over — Here's What Changed and Why It Matters
Colorado was supposed to be the state that gave America its GDPR-equivalent for artificial intelligence. Instead, the governor just signed a bill repe...
Cox Media Group Sold 'Active Listening' AI Ads — It Was a Lie, and the FTC Just Fined Them $930K
Cox Media Group pitched advertisers on an AI service that supposedly listened to consumers through their smart devices and used those overheard conver...
Georgia Just Made Chatbots Tell You They're AI — And It's More Significant Than It Sounds
Governor Brian Kemp signed SB 540 into law, making Georgia the latest state to require chatbots to disclose they're artificial intelligence. It sounds...
20 States, One Mess: What Every American Needs to Know About the Privacy Laws Now in Effect
Indiana, Kentucky, and Rhode Island joined the club on January 1, 2026 — bringing the total to 20 states with comprehensive consumer privacy laws. Ark...
The Warrant-Free Surveillance Loophole That AI Just Made Catastrophically Worse
The government doesn't need a warrant to buy your location data, browsing history, or financial transactions — because it buys them from commercial da...
The AI Police State Is Already Here: How Axon, Flock Safety, and Motorola Are Watching You
Facial recognition. Behavioral analytics. Vehicle scanning 20 billion times a month. Predictive policing algorithms that flag you before any crime occ...
The SECURE Data Act Could Rewrite American Privacy Law — Here's What It Actually Says
House Republicans dropped the SECURE Data Act on April 22 — the most serious federal privacy legislation in years. It would give every American the ri...
Your Kid's School Uses Canvas. Here's What to Actually Do This Week.
About 8,809 institutions worldwide were named in the May 2026 Canvas breach — roughly 7,400 U.S. schools across all 50 states. If your child's school ...
The Take It Down Act Is Law — Now the FTC Is Telling Big Tech to Actually Comply
The Take It Down Act requires platforms to remove non-consensual deepfake intimate imagery within 48 hours of a victim's request. A year after Preside...
Google Is Paying $135 Million Over Android Data It Collected Without Your Permission — Here's How to Claim Your Share
A class action lawsuit alleges Google's Android OS secretly transferred user data to Google's servers in the background — even when phones were idle —...
'Netflix Watches You': Texas Just Sued the Streaming Giant for Spying on Users and Children
Texas Attorney General Ken Paxton filed suit against Netflix this week, alleging the company runs a secret surveillance program — collecting 5 petabyt...
Your Cannabis Dispensary Was Watching You — and Selling What It Saw
Stiiizy, California's largest cannabis retailer, secretly embedded tracking tools across its websites to monitor customer behavior, then sold that dat...
AI Is About to Make Warrantless Government Surveillance Exponentially Worse
Congress has temporarily extended FISA's Section 702 surveillance program twice this spring without the reforms privacy advocates have demanded for ye...
Anthropic Told the Pentagon No — Then the Government Tried to Destroy the Company
When Anthropic refused to let the Department of Defense use its AI for mass surveillance of Americans, the Pentagon labeled it a national security thr...
The FTC Finally Stopped a Data Broker From Selling Your Location Data — Here's What Kochava Was Doing
For nearly four years, the FTC fought data broker Kochava in court over its sale of precise location data from hundreds of millions of mobile devices....
275 Million Students, 3.65 Terabytes, One Extortion Deadline: The Canvas Breach Is Higher Ed's Worst Nightmare
ShinyHunters claims it stole 3.65 terabytes of data from Instructure's Canvas platform — 275 million users, 8,800 schools, and billions of private mes...
Pennsylvania Sues Character.AI After Chatbot Faked a Medical License — and This Is Just the Beginning
A Character.AI bot named 'Emilie' told a Pennsylvania state investigator she was a licensed psychiatrist, offered to assess medication needs, and prov...
ICE's $28.7 Billion AI Surveillance Machine: Palantir, Clearview, and the End of Anonymous Public Life
ICE's FY2026 budget is ten times its total surveillance spending over the previous 13 years combined. Palantir's ImmigrationOS tracks self-deportation...
Your Hardware Run Is Now a Police Record: Home Depot's Secret License Plate Surveillance Network
Home Depot installed Flock Safety license-plate readers at all 233 of its California stores without telling customers — then shared that data with law...
The 2026 Digital Therapy Wrap-Up: A Year of Breaches, Subpoenas, Suicide Lawsuits, and the Bots That Replaced Your Therapist
Talkspace transcripts in court. Hims & Hers breached. Character.AI and Google paying out on teen suicide cases. OpenAI fighting seven wrongful death l...
The World's Strongest Privacy Law Is Being Quietly Dismantled: How Big Tech Rewrote the EU's Digital Omnibus
The EU invented GDPR. It set the global standard for data protection, inspired privacy laws on six continents, and put real fines on companies like Me...
Mexico's Third Attempt at Mandatory Biometric Phone Registration — And Why This Time It Might Actually Stick
Mexico passed legislation on January 9, 2026 requiring all 130 million phone lines to be linked to a biometric version of the national ID — facial rec...
Britain Built a Surveillance System and Called It Child Safety: The Online Safety Act's Age Verification Problem
On March 25, 2026, the UK's ICO and Ofcom published a joint statement formalizing age verification requirements under the Online Safety Act. Platforms...
When Police Cast a Net Instead of Catching a Suspect: The Supreme Court, Geofence Warrants, and the End of the Fourth Amendment as We Knew It
The Supreme Court heard arguments in Chatrie v. United States on April 27, 2026 — the first major Fourth Amendment case the justices have taken up sin...
A Billion Identities in Your Pocket: Google Wallet Just Became India's Biometric ID Distribution Network
On April 28, 2026, Google announced that India's Aadhaar biometric credentials can now be stored in Google Wallet — making a US tech giant the distrib...
Your Therapist Now Has a Subpoena: How Talkspace Turned 8 Billion Words of Mental Health Confessions Into Court Evidence and AI Training Data
Every word Jennifer Kamrass typed to her Talkspace therapist ended up in court — produced by the employer she was suing. Talkspace says it has 'one of...
Your Developer Tools Are the Attack Surface: The Vercel Breach and the AI Supply Chain Problem
Vercel — the platform hosting millions of web applications — was breached through a chain that started with an infostealer on an employee of an AI com...
Congress Punted on FISA 702 — Your Emails and Texts Are Still Being Swept Up Without a Warrant
Congress failed to pass a 5-year or 18-month renewal of Section 702 of the Foreign Intelligence Surveillance Act — the warrantless surveillance progra...
$375 Million and Counting: Juries Are Starting to Hold Social Media Platforms Accountable for Teen Harm
Two landmark verdicts in April 2026 have cracked open a decade of platform immunity: a New Mexico jury ordered Meta to pay $375 million over child exp...
A Security Researcher Walked Through a Conference and Identified Every Stranger He Saw Using Meta's Glasses
At RSAC 2026 in San Francisco, ESET's Jake Moore paired Meta Ray-Ban smart glasses with commercial facial recognition software and identified people i...
New York Wants to Put a Surveillance Agent Inside Every 3D Printer
New York's 2026-2027 budget bill would require all 3D printers sold in the state to include mandatory censorware that scans every print job for forbid...
BrowserGate: LinkedIn Is Allegedly Scanning Your Browser Extensions — and Sharing What It Finds
A privacy investigation by German group Fairlinked alleges LinkedIn secretly injects JavaScript to scan over 6,000 browser extensions on visitors' com...
770%: The Staggering Rise of Government Requests for Your Social Media Data
New research from Proton reveals that US government requests for social media and tech company user data have surged 770% in the past decade — with 3....
God-Level Access: How DOGE Copied 300 Million Americans' Social Security Records to an Unauthorized Server
A whistleblower says a DOGE staffer copied every living American's Social Security record — names, SSNs, birth dates, addresses, citizenship status — ...
Incognito Mode Won't Save You from AI: Inside the Perplexity Privacy Lawsuit
A class-action lawsuit filed today alleges Perplexity was secretly routing your search queries to Meta and Google — even when you were browsing in pri...
The EU Just Put Snapchat on Trial: What the DSA Investigation Means for Your Kids
Half of all 10-year-olds in Denmark use Snapchat. The European Commission just opened a formal investigation. Here's what predators exploit, what the ...
The Algorithm Is on Trial — and It Just Lost
A jury just ruled that Meta and YouTube's recommendation algorithms are defective products that caused real harm to a real person. The punitive damage...
You Told BetterHelp Your Darkest Secrets. They Sold Them to Facebook.
2 million people chose BetterHelp for privacy. BetterHelp sold their mental health data to Facebook, Snapchat, and Criteo. The FTC fined them $7.8M. T...
Russia Phished Thousands of Signal Accounts — The App Was Fine, the Users Weren't
Russian intelligence successfully compromised thousands of Signal accounts through sophisticated phishing — not by breaking encryption, but by exploit...
DOGE Employee Allegedly Stole 500 Million Americans' Social Security Data on a Thumb Drive
A former DOGE software engineer allegedly walked out of the Social Security Administration with two massive databases — potentially covering 500 milli...
You Were Never the Player: How Pokémon Go Built a $3.5 Billion Surveillance Map
30 billion photos. 8 years of gameplay. Pokémon Go players unknowingly built the most detailed spatial map ever created — now powering delivery robots...
The Great Encryption Retreat: Meta Kills Instagram E2EE While TikTok Refuses to Build It
In the span of two weeks, Meta announced it will remove end-to-end encryption from Instagram DMs and TikTok confirmed it won't add it. The privacy imp...
Your Face For Rent: How AI Model Recruitment Is Fueling the Next Generation of Deepfake Scams
A WIRED investigation reveals Telegram channels recruiting 'AI face models' for pig-butchering scams in Cambodia — and the massive privacy implication...
The Payment Giant That Wants to Be Your Digital ID
Payment processors aren't just moving your money anymore — they're building identity verification empires. From Stripe Identity's biometric scans to P...
Texas Sues the Biggest TV Makers in the World — Your Smart TV Has Been Spying on You Every 500 Milliseconds
Texas Attorney General Ken Paxton sued Samsung, Sony, LG, Hisense, and TCL for turning millions of living rooms into surveillance systems. Courts have...
When Your AI Assistant Goes to War: Claude's Role in the Iran Strikes
The same AI that helps you write emails and debug code helped the US military strike over 1,000 targets in Iran within 24 hours. What does this mean f...
Meta's Stunning Legal Argument: BitTorrent Piracy Is Fair Use If You're Training AI
Meta argues in court that downloading pirated books via BitTorrent qualifies as fair use—as long as you're using them to train AI. The implications fo...
7 Million Surveillance Nodes on People's Faces: How Meta's Smart Glasses Became the Biggest Bystander Privacy Disaster in History
Meta sold 7 million Ray-Ban smart glasses in 2025. A Swedish investigation just revealed that contractors in Kenya are reviewing the intimate, unblurr...
Inside the DHS Contractor Leak: 6,681 ICE Vendors Exposed — Including a Company Building a Microwave Vehicle Stopper
A hacktivist group claiming to have breached DHS released contractor records tied to ICE enforcement. Buried in the data is a funded contract for a mi...
Viral Military Alert About Uber and Snapchat Tracking Was Fake — But the Privacy Threat Is Real
A viral message claiming U.S. Cyber Command warned soldiers to disable Uber and Snapchat location services was debunked — but the underlying privacy r...