.kadence-column484998_59baca-d5 > .kt-inside-inner-col{padding-top:20px;padding-right:20px;padding-bottom:10px;padding-left:20px;}.kadence-column484998_59baca-d5 > .kt-inside-inner-col{column-gap:var(--global-kb-gap-sm, 1rem);}.kadence-column484998_59baca-d5 > .kt-inside-inner-col{flex-direction:column;}.kadence-column484998_59baca-d5 > .kt-inside-inner-col > .aligncenter{width:100%;}.kadence-column484998_59baca-d5 > .kt-inside-inner-col{background-color:rgba(255, 229, 229, 0.83);}.kadence-column484998_59baca-d5 > .kt-inside-inner-col:before{opacity:0.3;}.kadence-column484998_59baca-d5{position:relative;}@media all and (max-width: 1024px){.kadence-column484998_59baca-d5 > .kt-inside-inner-col{flex-direction:column;justify-content:center;}}@media all and (max-width: 767px){.kadence-column484998_59baca-d5 > .kt-inside-inner-col{flex-direction:column;justify-content:center;}}

If you thought that opting out of surveillance on your smart TV would give you your privacy back, think again.

A study by researchers at Northeastern University found that some smart TVs still seem to send information about what you’re watching to third parties, even after you pressed the opt-out button.

The study, ‘Watching the watchers‘, tested twelve smart TVs from ten manufacturers to find out how well they respected opt-outs from automatic content recognition (ACR). ACR is a TV feature that captures audio and/or video content from smart TVs and uploads it to a third party (typically the TV manufacturer).

The third party converts this content into digital fingerprints to understand what you’re watching, and can then use it to send targeted advertising or allow others to do the same. It’s on most if not all smart TVs, and 82% of US households had a smart TV as of last year.

The test took in the eight operating systems behind roughly 95% of US smart TVs, and ran ten viewing scenarios on each of them. These ranged from viewing antenna TV through to viewing via screen mirroring from another device. The researchers tested viewing the first-party streaming services provided free with the manufacturers’ operating systems, along with sessions using third-party streaming apps. And they tested sessions where the TV was connected to another device via its HDMI port.

The study ran all of its tests both with ACR left on, and with the opt-out setting selected. The whole test involved over 5,000 automated sessions.

Vizio continued to send 100% of what looked like traffic when viewing its first-party streaming services and antenna-based TV services, even after people had opted out, the study said. It also sent the same amount of traffic when idle. However it didn’t send any ACR traffic for third-party streaming data, according to the report.

Samsung did appear to leak some traffic from third-party streaming services after the researchers opted out of its ACR function. They tested 30 runs of Samsung’s built-in streaming service after opting out of ACR, and found that it still showed traffic “consistent with ACR”.

After opt-out, the Samsung TV’s Tizen OS seemed to send ACR-related traffic about Netflix in 7% of runs, YouTube in 10% of runs, and Tubi TV in 20%. It sent ACR 60% of the time from HDMI sessions. Like the Vizio TV, it also sent ACR traffic for all of its first-party streaming sessions.

Late last month, a researcher reverse-engineered a Samsung Smart TV and cast doubt on whether disabling ACR worked on the device.

There was good news, though. Four smart TV operating systems went completely silent after the researchers turned off ACR: LG’s WebOS, Sony’s Google TV OS, Amazon’s FireTV OS, and Supersonic’s VIDAA OS.

Encryption is a research challenge

Vizio agreed to pay $2.2 million in a 2017 FTC settlement over charges that it collected viewing histories on eleven million smart TVs without user consent. At the time, it agreed to allow people to opt out of ACR.

The Vizio TV that the researchers tested sent traffic to Kinesis, an Amazon-run data ingestion service that the manufacturer uses to analyze data from its smart TVs. The researchers noticed no dip in traffic to this domain when they opted out of ACR on a Vizio TV. They said:

“The opt-out setting has no observable effect on traffic sent to this endpoint. However, we cannot inspect the payload due to encryption so we cannot confirm whether this violates the FTC settlement.”

That’s a challenge to this research because most smart TVs encrypt their ACR traffic, including Samsung. So the researchers had to infer that this was ACR traffic based on signals such as where it was being sent, along with timing, volume, and protocol details.

One exception was Supersonic’s VIDAA OS, which sent ACR data to servers unencrypted. The servers responded unencrypted with a genre for what they recognized. Anyone watching the network could see it all, they warned. And because the servers didn’t require a login at the time of the test, over 57 million ACR detection results from other people’s TVs were accessible.

Vizio’s first-party streaming service WatchFree+ also dropped unencrypted titles of any show or channel being watched into online communications with the free TV service provider. There’s no way to turn that off, the researchers warned.

Walmart acquired Vizio for $2.3 billion in 2024, partly to help “advertisers to meaningfully connect with customers at scale and boost product discovery”.

The retailer also runs Walmart Connect, a retail media business that uses its customers’ data to help other businesses target them with ads.

Walmart was particularly interested in Vizio’s advertising business it, said at the time:

“Pairing it with Walmart Connect will be impactful and allow us to invest in our business even further on behalf of our customers.”

What smart TV owners can do

What can you do to protect yourself from a smart TV that might be sending your viewing data elsewhere? The researchers have some suggestions:

• WebOS (LG), Fire TV OS, Google TV on Sony, and VIDAA OS on Supersonic all appeared to honor ACR opt-out, so selecting it on these TVs should be safe.
• Disconnect the TV from the internet and use an external streaming device. That way the TV can’t send back data, even if it picks it up from the HDMI connection.
• Use a blocklist. This takes a little more technical knowledge. If you run an internet router that can accept blocklists, then you can add a list of known ACR endpoints that will stop your TV’s traffic reaching them. The researchers provide one here.

---

Stop threats before they can do any harm.

Malwarebytes Browser Guard blocks phishing pages and malicious sites automatically. Free, one click to install. Add it to your browser →

.kadence-column484007_649ea4-04 > .kt-inside-inner-col{column-gap:var(--global-kb-gap-sm, 1rem);}.kadence-column484007_649ea4-04 > .kt-inside-inner-col{flex-direction:column;}.kadence-column484007_649ea4-04 > .kt-inside-inner-col > .aligncenter{width:100%;}.kadence-column484007_649ea4-04 > .kt-inside-inner-col:before{opacity:0.3;}.kadence-column484007_649ea4-04{position:relative;}@media all and (max-width: 1024px){.kadence-column484007_649ea4-04 > .kt-inside-inner-col{flex-direction:column;justify-content:center;}}@media all and (max-width: 767px){.kadence-column484007_649ea4-04 > .kt-inside-inner-col{flex-direction:column;justify-content:center;}}

Online fashion retailer Revolve Group said customers’ payment card numbers and expiration dates were stolen. In its customer notification letter filed with the Massachusetts Attorney General, Revolve told recipients the incident involved their names, addresses, and payment card details.

What was stolen?

The at-risk data includes customer names and contact information, payment card numbers, and card expiration dates. The breach only affected customers who had saved their payment card as a payment method in their Revolve account.

A filing on the Texas attorney general data breach website lists 127,200 affected Texans, but not a nationwide total. We found the figure of 1,515,073 in data returned by the site when searching for Revolve. That data labels it as the total number of people affected, but the figure isn’t displayed on the public listing. Other sites have repeated it, though they appear to rely on the same Texas record. The SEC filing did not give a number of affected people, and Revolve has not confirmed the total.

Revolve’s SEC filing does not mention card verification value (CVV) numbers. These three-digit security codes printed on the back of payment cards (four digits on the front for American Express cards) are an extra layer of security for card-not-present transactions.

It is also unclear whether the card numbers were fully visible or masked, or whether Revolve or a third-party payment processor held them.

Even without a CVV, card numbers and expiration dates may be enough to make purchases at some online stores. And scammers who know your real card details and contact information may be able to send more convincing phishing messages to trick you into revealing your CVV.

How did they get the data?

Revolve has not said how the attackers accessed the saved payment data. In its SEC filing, Revolve said it believes an unauthorized actor may have obtained the data “through automated means.” Records on the Texas attorney general’s site indicate that the incident happened on September 11 and was discovered on September 29.

No group has publicly claimed responsibility for the theft.

What Revolve customers can do now

Revolve said it has taken extra security measures following the breach, although didn’t say what those are.

---

---

If you have saved payment information in your Revolve account, your details may have been among those stolen. Fraud can often begin within days of a breach. If you’re concerned about your card details being exposed:

• Read your statements line by line to identify even small charges that you don’t recognize. Criminals will often make a small charge using stolen card details to see if the card works.
• Look for unfamiliar merchant names on your statement.
• Report unauthorized charges to the card issuer immediately.
• Consider removing saved cards from shopping accounts. You could use a password manager instead, some of which will store autofill data for payment cards.
• Ask your card issuer to cancel your card and reissue with a new number so that the old number becomes unusable.

Also, don’t immediately trust calls, texts, or emails about the incident. Scammers can use stolen information to make themselves sound convincing. If someone claims to be calling from your card issuer, call the number printed on your card to check.

If you’re unsure about a message or link, check it with Malwarebytes Scam Guard.

---

Let’s face it, an incognito window can only do so much. 
 
Breaches, dark web trading, credit fraud. Malwarebytes Identity Theft Protection monitors for all of it, alerts you fast, and comes with identity theft insurance. 

As preparation for the UK’s planned social media ban, Ofcom has set out four ways social media platforms could check whether users are aged 16 or over. The government and Parliament will decide how the ban works in practice.

Ofcom is the regulator for the communications services in the UK. The BBC reports that Ofcom identified four ways to check someone’s age that it considers “highly effective.”

Here’s what those checks would involve:

• Photo ID matching: Comparing a live image of you with the photo on an identity document, such as your passport, and checking the age information on that document.
• Bank-based checks: Using age information your bank already holds about you, with your consent.
• Facial age estimation: Using technology to estimate your age from your face. Ofcom says this technology has improved recently.
• Digital ID services: Using a digital identity service to prove your age, rather than presenting a physical document.

Let’s think through what those checks could mean.

Challenges

The challenge isn’t simply checking someone’s age. It’s doing so without turning everyday internet use into an identity check.

Photo ID matching brings highly sensitive documents and facial images into the process, which raises questions about how that information is handled and protected. The risks aren’t hypothetical: as I reported last year, a breach at a third-party support provider for Discord exposed government ID images belonging to around 70,000 users.

Banking-based checks can be more privacy-preserving if they return only confirmation that someone meets the age threshold, rather than exposing financial information. But the important questions are what information each party receives, what gets retained, and whether the check can be linked to someone’s activity.

Facial age estimation can avoid uploading an identity document, but it still processes a sensitive image and makes an imperfect prediction. Ofcom acknowledges that some technologies can be wrong by a few years around age 16, so people near the threshold may face an additional verification check.

I would expect these checks to stop some underage access but not eliminate it.

Previous restrictions have been followed by workarounds, including increased VPN use, borrowed credentials, and migration to services outside the restrictions. The danger is treating a successful age gate as proof that children are now safe, when it might push them into less regulated spaces.

The effectiveness depends on how the checks are implemented. A VPN may help someone avoid a check triggered by their apparent location; it won’t, by itself, bypass an identity or facial check that is still required.

Similarly, Ofcom says matching a live image to an ID is intended to make it harder to borrow someone else’s document. We shouldn’t assume every workaround defeats every method. But Ofcom accepts that some motivated children will get through. The meaningful test is how much harm these measures prevent, weighed against the privacy risks and barriers they introduce— not whether every user has completed a check.

My personal preference is double-blind verification: a provider confirms that you meet the age requirement without learning which service you’re accessing, while the service receives proof of age without learning your identity. Proving you’re old enough shouldn’t mean revealing who you are.

---

Scammers don’t need to hack you. They just need you to click once. 

Malwarebytes Identity Theft Protection catches suspicious activity before it becomes a problem.

.kadence-column482644_f2c16d-bc > .kt-inside-inner-col{padding-top:20px;padding-right:20px;padding-bottom:10px;padding-left:20px;}.kadence-column482644_f2c16d-bc > .kt-inside-inner-col{column-gap:var(--global-kb-gap-sm, 1rem);}.kadence-column482644_f2c16d-bc > .kt-inside-inner-col{flex-direction:column;}.kadence-column482644_f2c16d-bc > .kt-inside-inner-col > .aligncenter{width:100%;}.kadence-column482644_f2c16d-bc > .kt-inside-inner-col{background-color:#ffe5e5;}.kadence-column482644_f2c16d-bc > .kt-inside-inner-col:before{opacity:0.3;}.kadence-column482644_f2c16d-bc{position:relative;}@media all and (max-width: 1024px){.kadence-column482644_f2c16d-bc > .kt-inside-inner-col{flex-direction:column;justify-content:center;}}@media all and (max-width: 767px){.kadence-column482644_f2c16d-bc > .kt-inside-inner-col{flex-direction:column;justify-content:center;}}

A group of hackers calling themselves the Department of Peace says it stole and published the personal details of more than 41,000 people working for the US Department of Homeland Security (DHS). The department says it is aware of a potential breach.

The group, which also claimed the theft of contract documents from the DHS in March, gave the data to Swiss hacktivist maia arson crimew, who published it in collaboration with the transparency collective DDoSecrets. The latter also published the BlueLeaks data dump that listed law enforcement officers’ details in 2020.

The aim of publishing the data was to replace “anonymity with accountability,” DDoSecrets co-founder Emma Best said in an online statement.

According to TechCrunch, timestamps on the records suggest the data was taken around mid-August. The group said it had launched the attack in response to a July 17 statement by DHS Secretary Markwayne Mullin, in which he promised to “turn up the heat” with traffic stops.

What was stolen?

The data files published online, which the publishers have called “Icepick,” span staff at nearly 7,000 offices. They include the names, work email addresses, phone numbers, office addresses, job titles and membership in internal DHS groups. The employees impacted include almost 6,600 Immigration and Customs Enforcement (ICE) employees. ICE is the DHS unit responsible for immigration enforcement and deportations in the US.

The dataset also carried details of over 21,000 Customs and Border Protection (CBP) employees, along with information on people who work at the Cybersecurity and Infrastructure Security Agency (CISA).

The data dump revealed less information than the ShinyHunters’ FBI data heist in September, which reportedly contained Social Security numbers, emergency contacts, medical records and home addresses. Nevertheless, this is more than just a phone book of folks in the DHS.

For one thing, it doesn’t take much to cross-reference data. Reuters matched six DHS employees’ data to credit bureau records and breach data from a dark web intelligence platform. Online activists regularly use open-source intelligence (OSINT) to “doxx” people from very few clues, meaning that even a leak of basic identity information can put someone in danger. In fact, the creators of a separate searchable version say they added information through automated and manual research. So some details shown in that version may not have come from the data stolen from DHS.

---

---

The data in this case also included membership of groups within Active Directory, a Microsoft tool that contains identity information about computer users. Active Directory controls who can access different internal tools, services, and third-party software within an organization.

The files listed over 200 CBP users in a group that could access the facial recognition tool Mobile Fortify. Other groups reference a service called Penlink, which the company claims can track the location data of hundreds of millions of mobile devices.

According to the Guardian, job titles in the data dump show which agents were assigned to sensitive jobs such as special operations, surveillance, and undercover work.

How did they get the data?

The Department of Peace said that it got to the information via a single sign-on (SSO) service provided by identity company Okta. SSO is a prized target for hackers because a single authentication can get a user into many different workplace services and applications.

Okta says it has no evidence its data or systems were compromised, but that doesn’t rule out someone abusing a DHS account with stolen credentials.

DHS told reporters it was aware of a potential breach. One DHS employee whose data showed up in the breach told Reuters they hadn’t heard anything about it.

What DHS employees can do now

The leaked records include work contact details and internal group memberships. This information could help attackers create convincing messages or calls, and may expose some employees to unwanted attention or threats. DHS has warned about the risk of harassment, stalking, and physical harm. It is not yet clear whether the leak has led to specific threats or affected any operations.

If you work for DHS:

• Follow security advice and instructions from the DHS.
• Treat unexpected calls, emails, and texts about your role or colleagues with caution. Verify them through a contact method you already trust, and never share passwords or MFA codes.
• Change any personal passwords you’ve reused for work, and turn on MFA where available. Follow your agency’s process for work accounts.
• Report suspicious contact or threats to your agency’s security team. If you believe there’s an immediate danger, contact law enforcement.

Do you think your information might have been leaked in a data breach? Check out the Malwarebytes Identity Theft Protection service.

---

---

A reverse engineer claims that their Samsung smart TV has been collecting audio without their consent.

The researcher, who calls themselves “log4j,” said in an X thread that their 2025 Samsung TV was delivering ads that seemed suspiciously relevant to them. Investigating, they claim to have found a package called “always on voice,” which uses the TV’s built-in microphone to collect sounds from the room.

The software logged events such as dogs barking and babies crying, log4j said, adding that these events are counted and reported back to Samsung.

Samsung advertises similar features on some of its AI-enabled TVs. The company says its Pet Care and Family Care features use on-device AI to detect a dog barking or a baby crying and alert users. This doesn’t confirm log4j’s claims about the package or the data it reports.

However, log4j says that on TVs without microphones, the software searches for connected devices such as soundbars or Bluetooth microphones and uses those to listen instead.

The TV was also collecting geolocation data and mapping local networks, they said, adding that it ran a service on the TV that analyzes traffic on the local network.

log4j also says that the system uses a neural network tailored to a particular region to analyze your viewing habits. A neural network is a type of machine-learning model. log4j said:

“…in youtube it’s looking for videos you watch, ads you skip, progress in a video, etc.”

The tracking that’s on the record

While log4j’s claims haven’t been independently verified, Samsung has used automatic content recognition (ACR), a system that identifies what’s on screen. Earlier this year, Texas Attorney General Ken Paxton settled with Samsung, getting the company to agree that it would get Texans’ express consent before collecting or processing ACR viewing data.

A class action complaint filed in New York in January also accused Samsung of using ACR to record video and audio passing through the TV. The complaint accused Samsung of using machine-learning algorithms to analyze and link this data back to consumers. This includes information displayed when the TV is used as a computer monitor, it said, adding that the information can be linked to different people using the TV. The case was voluntarily dismissed in July.

The New York complaint added:

“Samsung exploits this Sensitive Information by (a) selling targeted advertisements to its corporate advertising clients, and (b) providing it to third-party advertising companies such as Google and X (f/k/a Twitter) for targeted advertising.”

A separate class action complaint filed in California this month accuses Samsung Electronics America of not being transparent about its ACR data collection.

This isn’t the first time that Samsung has been criticized for allegedly picking up in-room audio. In 2015, privacy group EPIC filed a complaint with the FTC, accusing Samsung of recording conversations and relaying them elsewhere. The nonprofit said at the time:

“Everything a user says in front of the Samsung SmartTV is recorded and transmitted over the internet to a third party regardless of whether it is related to the provision of the service.”

EPIC identified text-to-speech company Nuance as the third party.

What you can do

We can’t confirm all of log4j’s allegations, and Samsung doesn’t appear to have commented. But there have been multiple complaints about the data smart TVs collect. You can turn off features such as ACR, internet-based advertising, and voice recognition where possible.

log4j has also raised concerns about whether monitoring services are truly off. They said:

“ACR off via your preferences menu on samsung TVs should not be assumed to actually disable ACR telemetry.

i’ve found several instances where the checks (whether deliberate or not) are either incorrectly implemented or not checked at all.”

log4j says disconnecting your TV from Wi-Fi is the best option for immediate peace of mind, though that also means losing internet-based TV features. They also suggest using an Apple TV or a modifiable Android TV box with open-source software.

---

Facebook’s Cambridge Analytica scandal may feel like very old news. But the consequences are still arriving, and the latest comes with a $25 billion price tag.

Reuters reports that a New Mexico judge has ordered Meta to pay $25 billion in civil penalties after a jury found that Facebook misled consumers about its data practices and its handling of hate speech and misinformation. Meta says it expects to win on appeal.

This case is about more than information ending up in the wrong hands. It concerns what Facebook told people about who could access their information, how much control users had, and how the company enforced its own rules.

What Facebook told its users

In September, jurors found that the company and its leadership made 26 misleading statements on data privacy, hate speech, and other subjects. For example, Mark Zuckerberg’s 2010 statement that:

“We do not share your personal information with people or services you don’t want.”

That assurance appeared in a statement the jury found misleading. The judge found that choosing who could see a Facebook post did not necessarily control what outside app developers could access. That access was governed by separate settings that many users did not know existed.

New Mexico’s attorney general filed the lawsuit in 2021, following revelations that Cambridge Analytica obtained personal information from as many as 87 million Facebook users through a third-party app.

But New Mexico’s case went beyond Cambridge Analytica.

The state challenged Facebook’s representations to consumers about its data practices and its efforts to address misinformation and hate speech. The case centered on misleading consumers under New Mexico’s Unfair Practices Act, the state’s consumer protection law.

The state argued that third parties had broad access to users’ information and that Facebook tolerated harmful content when doing so benefited its business. Meta disputed the allegations, denied selling users’ information, and said the state had taken statements out of context.

New Mexico’s Department of Justice says the jury found 43,899,725 violations of state law. That does not mean nearly 44 million individual New Mexicans had their data taken. The count reflected the estimated audience for each misleading statement, rather than the number of individual people affected.

State law allows penalties of up to $5,000 per violation. Judge Francis Mathew found that a penalty exceeding $219 billion was warranted under the law but reduced the amount to $25 billion.

The judge said earlier penalties had failed to stop Meta from misleading consumers, including a $5 billion FTC penalty in 2019.

The money is not earmarked for compensation payments to individual Facebook users. According to Attorney General Raúl Torrez, state law directs the penalties to New Mexico’s school system.

Meta’s chief legal officer, C.J. Mahoney, said the company is confident it will prevail on appeal and characterized the lawsuit as an attempt to impose “a tax on speech.” Meta has also argued that a multibillion-dollar penalty risks violating constitutional protections concerning due process and excessive fines.

How to stay safe on social media

The case illustrates why privacy is not just a matter of choosing who can see a post. In a separate 2019 case, the Federal Trade Commission (FTC) alleged that Facebook had shared users’ information with third-party apps used by their friends, even when those users had chosen restrictive privacy settings.

A few precautions can help you limit what you share, although settings alone cannot guarantee privacy:

• Share selectively. Leave optional profile details blank, limit who can see your posts, and avoid publishing sensitive details such as your address or live location. Ask permission before posting information or photos involving other people.
• Check app permissions. Does a social media app really need your contacts, precise location, or entire photo library? Turn off unnecessary access in your device settings.
• Review tracking and advertising settings. Look for controls covering personalized ads, activity outside the platform, and data sharing. Restrict what you can, but don’t assume opting out of personalized ads stops all collection.
• Be selective about connected apps. Before connecting a quiz, game, or other service to your account, check what information it requests. Decline access that seems excessive for what the service does.
• Remember what “private” means. Restricting your audience helps control who sees your posts. It does not stop the platform itself from collecting or using information about your activity.

---

Scammers don’t need to hack you. They just need you to click once. 

Malwarebytes Identity Theft Protection catches suspicious activity before it becomes a problem.

Two Chicago customers say robots delivering their groceries and takeout scanned their faces and hands without consent, stored the data alongside their names and addresses, and used the recordings to train AI.

Their separate lawsuits accuse delivery robot operators Coco Robotics and Serve Robotics of violating Illinois’ biometric privacy law. Both companies dispute the claims.

The plaintiffs filed the cases in the Circuit Court of Cook County, Illinois, alleging that the robots used their cameras along with light detection and ranging (LiDAR) sensors to scan them.

LiDAR uses laser pulses to build a detailed 3D map of a robot’s surroundings. The lawsuits allege that, at close range, these sensors capture facial geometry in enough detail to support facial recognition.

Mitchell Breidinger ordered DoorDash groceries in September 2025. A Coco robot, operated by Coco Robotics, made the delivery. To collect it, he had to stand within about a meter of the robot’s cameras and LiDAR sensor while he entered a PIN code in the DoorDash app, and a Coco remote pilot watched the live video, according to the complaint.

Barry Schain filed a similar complaint against Serve Robotics, which sent one of its robots to deliver his Uber Eats order.

The complaint against Cyan Robotics (the California-based company that does business as Coco Robotics) states that the robots record detailed 360-degree LiDAR data on the urban environments that they navigate. Coco has never said that it blurs, downsamples, or removes human faces or hands from that LiDAR data, the complaint adds.

It also says the company:

“gives no notice before a robot records a person, identifies no specific purpose or retention period for the data, obtains no written release, and has published no retention or destruction schedule.”

Those who are scanned by Coco robots have no account to close with the robotics company and don’t get to choose whether they are served by a robot, the complaint points out.

Cyan uses the data that the robots collect to train its AI, the complaint says, adding that it also has data-sharing partnerships with companies including ChatGPT creator OpenAI.

Schain, who most recently took a delivery from a Serve robot on October 4, makes similar claims in his complaint. The company fulfills food delivery orders for both Grubhub and Uber Eats, it says, noting (unlike the complaint against Cyan) that these robots also collect audio.

Serve Robotics licenses video and LiDAR data to third parties for model training, the complaint says, citing Serve’s own filings with the Securities and Exchange Commission.

Both companies have pushed back, according to reports.

Coco said it has not collected biometric data in Chicago, that the suit “fundamentally misunderstands our technology” and that “the data we share is navigational data used to make sidewalks safer for all users.” It called the case “frivolous.” Coco said that it doesn’t share data from the beginning and end of delivery runs. Serve said that the robot systems are “not designed to identify individuals or create biometric profiles.”

Whether the data the robots capture qualifies as biometric information under BIPA is central to the lawsuits.

Illinois’ biometric law

Illinois’ biometric privacy law gives people the right to sue companies over the unlawful collection and use of their biometric data.

Under that law, biometric identifiers include scans of hand and face geometry. Companies must tell people in writing what biometric information they’re collecting, what they’ll use it for, and how long they’ll keep it. They must also get each person’s written consent and publish a schedule for destroying the data, and they must not sell or otherwise profit from it.

These class action suits were not delivered in a vacuum. Chicago residents had already mounted a petition against the delivery robots, citing collisions, interference with emergency vehicles, and concerns about potential surveillance. More than 4,550 Chicagoans have signed it, the petition says.

Both suits were filed by the same Chicago law firm, Almeida Law Group. Each seeks $1,000 per class member for negligent violations or $5,000 for intentional or reckless ones. Each complaint says its proposed class “includes many thousands of persons.”

---

Browse like no one’s watching. 

Malwarebytes Privacy VPN encrypts your connection and never logs what you do, so the next story you read doesn’t have to feel personal. Try it free → 

Anonymous imageboards have long been places where users could chat under pseudonyms without revealing their real names. But now people on these forums are discussing and testing AI tools for doxing — that is, for finding, matching, and publishing users’ data without their consent. Often this goes hand in hand with stalking the victim, hacking their accounts, bullying, and blackmail, and ultimately leads to a damaged reputation or even worse.

In this post, we explain how artificial intelligence helps malicious actors leak other people’s data — and how to stand up for your right to online privacy.

How bad actors uncover information about users

Analysts at Open Measures have reported that, since October 2025, users of Soyjak.party, an imageboard popular with young people on the far right, have been discussing and using AI to deanonymize other users. Their victims are often activists, bloggers, and members of other “hostile” forums.

The tools the experts found run right in the browser, and automate almost the entire process of collecting information about a victim. They can search open sources and leak databases, and they use any new leads — for example, an email address linked to a username — to dig even deeper. They also extract metadata from photos and videos, estimate a person’s approximate location from IP addresses they find, and finally put everything together into one huge digital dossier. These Soyjak.party tools are no longer functional, but similar ones have been spreading across other imageboards.

In February 2026, researchers demonstrated that sometimes ordinary forum chatter is enough to reveal who you are. They put together summaries of posts by 338 Hacker News users, removed names, usernames, and social media links, and then asked AI to work out who was behind them. The AI compared details about jobs, interests, and personal background with information available online — and correctly identified 226 of the people, or about two-thirds of the sample. The price of deanonymization turned out to be laughably low — at between US$1 and US$4 per user.

To be fair, people knew how to build digital dossiers even before the generative AI boom. For starters, there are OSINT tools that search for data in open sources. Journalists and investigators were the first to use them, but, as you might guess, malicious actors soon mastered these tools too. Unlike AI models and agents, traditional OSINT services follow set scripts and can’t “think” or make decisions on the fly.

An agent out for revenge: the OpenClaw case

If you think doxing always needs a person with ill intent, we’ve bad news: sometimes the one settling scores can be… artificial intelligence itself.

Here’s a story that started out innocuously enough. An AI agent running on the much-hyped OpenClaw platform suggested an improvement for Matplotlib, a popular tool for building graphs and charts. But the project’s rules said that code submitted by AI agents wasn’t accepted. One of the project’s volunteers, Scott Shambaugh, simply turned down the AI’s suggestion.

You’d think that would be the end of it. Think again! The AI agent decided the rejection deserved some publicity, so it published an “exposé” about the developer on its blog (yes, you read that right: the agent had its own blog). It gathered information about Shambaugh from open sources, studied his public activity, and accused him of being biased against AI. It even started speculating about the developer’s psychological motives, and suggested he was afraid of competition from artificial intelligence.

Once this “private” conversation between Shambaugh and the AI agent went public, other users rallied behind the developer — and the agent had to publish an “apology” post.

It’s a pretty absurd story, but it teaches a good lesson: always read the privacy policy of any AI service carefully, and steer clear of new models from unknown sources.

How to avoid becoming a doxing victim: a guide

If AI speeds up searches and connects the dots between details that used to be scattered across dozens of websites, the next logical question is: what can you do to shrink your digital footprint?

Disappearing from the internet completely is almost impossible. So protecting your data isn’t so much about leaving as few traces as possible, but cutting the number of links that can be used to piece together your identity. If you’re an advanced user, we recommend reading our post, How to disappear from the internet, in addition to the tips below.

Manage your digital footprint

• Search for yourself online. Don’t stop at your name: try your email address, nicknames, and phone number too. If you’re comfortable with AI processing your data, you can even ask it to compile a dossier on you. Just remember that there’s always a risk of a leak or a bug that accidentally makes your data public. And no, big, reputable services are no exception.
• Make private any profiles you don’t want to share with everyone. That makes it harder for search engines to index your new posts, and for scrapers and OSINT tools to collect them. While you’re at it, go through your old comments and posts and clear out anything you don’t need.
• Delete your ghost accounts. Go through your inboxes and check which websites you’ve signed up for. Make a habit of deleting accounts you no longer use: they can hold your personal data for years, and there’s always a risk it’ll end up in the next data leak.
• Set up two-factor authentication. That way, even if a bad actor manages to guess your password or finds it in a leak, they won’t be able to get into your account without the additional authentication. For the second factor, we recommend using one-time codes that refresh every 30 seconds and storing them in a reliable password manager.
• Strip metadata before posting photos and videos. Metadata can help a malicious person learn a lot about you— for example, the location and exact date a photo was taken, and the model of your device.
• Use a different password for every account you have. Our research has showed that passwords built from personal details — such as your mother’s maiden name, your birth date, and a special character at the end — are extremely weak. This kind of information often ends up in leaks, or can be pieced together from public sources, so the passwords can be easily brute-forced by smart algorithms. Of course, nobody can remember hundreds of unique passwords, so it makes sense to offload that job to our password manager — a secure vault that generates and remembers complex, unique passwords for you, and syncs them across all your devices.
• Find out about new leaks as fast as possible. Some online services will send you a free alert if your email address shows up in a known data leak. But it’s much more convenient to monitor leaks with a dedicated security app. For example, Kaspersky Password Manager constantly checks all the entries you’ve saved. It warns you if you use the same password on different websites, or if any of your saved login and password pairs has been compromised. Our simple instructions for Windows, macOS, Android, and iOS can help you easily check all the passwords you’ve saved in Kaspersky Password Manager. Your passwords are never sent to Kaspersky. We explain how we can analyze your passwords without knowing them in our post, How to create strong passwords and where to store them.
• Use reliable protection that tracks and blocks leaks of your data. While Kaspersky Password Manager only checks the active password entries you’ve added to it, Kaspersky Premium can monitor for compromised accounts linked to your email addresses (you can add up to 50 addresses to check), and for digital identity theft linked to your phone numbers. And besides reporting leaks that have already happened, our security solutions can also stop data about you from being collected online.
• Set up privacy on your devices and apps with our free online service, Privacy Checker.

Keep your accounts separate

The more websites that know your email, the more often it will show up in advertising profiles and potential leaks. For one-time and minor sign-ups, you can use an email masking service. All Apple users get this feature by default (Hide My Email). If you use another OS, you could try Firefox Relay, for example.

The service then creates a separate proxy email address for the website where you’re trying to sign up. Messages sent to that address are automatically forwarded to your real inbox, but the website never sees your real email address.

If you want to go all in, you can try splitting your digital life into several sub-personas by hand. Create several email addresses for different purposes. For example, use one for online stores, banks, and government services, a second for public social media, and a third for forums and social networks where you want to stay anonymous.

Keep in mind that all this is a challenge: you’ll need to keep coming up with new nicknames, and make sure your sub-personas never overlap. If you use an email address for an anonymous profile, don’t link it to services that already have your real details, and don’t use it as a backup email for a public account. One accidental link can easily undo all your effort.

Check what you share with exes

If you’ve recently broken up with a partner, make sure you check which parts of your shared digital life they can still access. Sadly, it’s very often ex-partners who become doxers or stalkers — spying on their former other half and stopping at nothing to do so. For more details on exactly what to do in this situation, read our article Post-breakup digital hygiene: what to check and shut down.

Use your right to be forgotten

Many countries have a right-to-be-forgotten law. It lets you ask search engines to remove links to pages that contain your personal data.

You can send the links to those pages, explain why you want them hidden, and request that they be removed from search results. Keep in mind that the page with your data isn’t deleted. Other search engines may still show it, and it may still turn up for other search queries.

To submit a request like this, use the dedicated forms from Google or Bing. But remember that a search engine can turn you down if it decides the information is in the public interest, or that the law requires it to be published.

There are more effective, though more time-consuming, ways to remove your data from the internet. We covered them in detail in our post, Why data brokers build dossiers on you, and how to stop them doing so.

Looking for more ways to protect your digital identity? Check out our other posts:

• How to disappear from the internet
• Doxing — another online danger for women
• Post-breakup digital hygiene: what to check and shut down
• The Naked Truth
• AI and the new reality of sextortion

Automated license plate readers (ALPRs) are cameras that photograph passing vehicles, read their number plates, and typically log the time, location, and vehicle details. On their own, the images might be used to find a stolen car or locate a suspect.

But lately there have been a lot of concerns raised about the way they are used. The main worry is caused by what happens when many cameras feed data into a shared, searchable network: it can create a detailed record of where ordinary people travel.

Some agencies have already taken it upon themselves to act on these concerns, as well as those around inaccuracy. Data errors can have serious consequences. At a recent Senate hearing, Florida resident Lindsey Isaacs described being arrested and held for 13 days after data from an AI-enabled plate-reader system incorrectly implicated her in a fatal car crash.

As a result of all this, US lawmakers from both major political parties have introduced proposals aimed at restricting automatic license plate reader networks.

Most of the reasons brought up are about Flock Safety, one of the largest suppliers of these systems in the United States, but they would apply more broadly to other ALPR vendors as well.

Flock says it deploys only 120,000 cameras operating across the country, while a researcher cited by the Senate described a much larger network of connected devices and cameras. The exact size may be disputed, but the central concern is clear: Data from a camera in one location can potentially be searched by an agency elsewhere.

Two different approaches

Reportedly, there are two different proposed laws in the making, while Flock says it supports a legal framework for license-plate readers and argues that the technology can improve public safety when it is used with strong oversight and accountability.

The first proposal, the Stop Flock Abuse Act, doesn’t aim to banish ALPR systems outright, it would create rules for how government agencies and vendors can use them.

Among other measures, the bill would require written approval and a record for every search, regular supervisor audits, encryption, and deletion of most vehicle-location data after ten days. It would also prohibit sharing or selling the data to non-governmental third parties, prevent ALPR networks from incorporating facial-recognition technology, and require data to stay in the US.

A second proposal, the Ban Flock Act, takes a much harder line. It would prohibit US federal agencies from using ALPRs or accessing data they collect. It would also withhold federal grant money from state and local governments that use ALPR systems and allow people to sue the federal government if their rights are violated through ALPR deployment.

Both bills are proposals, not enacted laws. In the US system, each would need to pass both the House of Representatives and the Senate in matching form, then be signed by the President.

Going forward

There is no guarantee either bill will receive a vote, let alone become law. But their introduction shows that ALPR technology is moving from a local procurement issue to a national privacy and civil-liberties debate.

License plate data may seem less sensitive than phone-location data, but a long enough record can reveal a person’s routines, relationships, medical visits, religious activity, or attendance at protests. The debate is therefore not just about cameras on streets to fight crime and find criminals, it is about whether governments and private vendors should be able to build searchable records of everyday movement.

So for consumers, the key question is not only whether a camera is installed on a street or near a business. It is also how long the resulting data is retained, who can search it, whether those searches are logged and reviewed, whether the information can be shared beyond the original agency, and what recourse exists when the system is wrong or abused.

---

Your name, address, and phone number may already be for sale.  

Data brokers collect and sell your personal details to anyone willing to pay. Malwarebytes Personal Data Remover finds them and gets your information removed, then keeps watch so it stays that way. 

The US government is alerting millions of people that their personal information was stolen during a breach of the Pentagon’s personnel records at the Defense Manpower Data Center (DMDC).

The DMDC is a central US Department of Defense (DoD) organization that manages personnel records, ID credentials, and benefit entitlements for military and civilian staff, veterans, and their families. It maintains over 60 million records for US military and civilian staff and their family members to help determine benefits and entitlements, such as healthcare and retirement.

Reportedly, cybercriminals had access from October 2025 to July 2026. CNN reports that the Pentagon confirmed the breach affects 2.76 million living individuals, potentially including current and former defense personnel or their dependents, and 294,000 deceased individuals.

A notification shared on Reddit states:

“A small number of unauthorized users accessed files on a server containing unencrypted PII.”

PII means personally identifiable information. The attackers gained access by exploiting a security vulnerability in an unspecified file-sharing system. The Pentagon says it has “no indication” of misuse. It hasn’t explained how it reached that conclusion or what it considers misuse, and it doesn’t rule out future misuse of the exposed information.

The exposed data is said to include Social Security numbers, names, dates of birth, sex, race, and service details. Some records also include contact information and occupational specialty.

Besides the risk that this data could help foreign intelligence services track US personnel, affected people face a lasting risk of identity theft. Birth dates cannot be changed, and Social Security numbers can only be changed in limited circumstances.

---

---

What to do if you’re affected

The Pentagon is offering 12 months of credit monitoring through IDX. If you receive a notification letter, take up the offer and consider a credit freeze with all three major credit bureaus: Equifax, Experian, and TransUnion. A freeze is free and restricts access to your credit report, helping prevent someone from opening new credit accounts in your name.

Other recommendations are:

• Get an IRS Identity Protection PIN to prevent someone else from filing a federal tax return using your Social Security number.
• Be suspicious of unexpected calls, emails, and texts, especially ones that mention your unit, rank, or job. Attackers can use the stolen details to make phishing attempts more convincing.
• Verify requests through official channels you look up yourself, rather than through contact details in the message.
• Use unique passwords and multi-factor authentication on email, banking, and benefits accounts.
• Limit location sharing and review privacy settings on phones and apps, since military leaders have raised concerns about commercial location data being used to target personnel.
• Follow instructions in the breach letter and further official communications and report any suspicious approach to your security officer.

---

Let’s face it, an incognito window can only do so much. 
 
Breaches, dark web trading, credit fraud. Malwarebytes Identity Theft Protection monitors for all of it, alerts you fast, and comes with identity theft insurance. 

A study testing 21 cars from 19 brands and 30 companion apps found connections to advertising and tracking companies, and evidence that some apps shared sensitive personal data.

Modern cars can unlock remotely, route around traffic, stream entertainment, summon roadside help, and cool or heat the cabin before you get in. But those conveniences come with a privacy cost that drivers may struggle to see and are unable to refuse.

We’ve covered cars and privacy a few times before, especially after Mozilla researchers described cars as a “privacy nightmare.”

Texas Attorney General Ken Paxton investigated car manufacturers seeking details of their data collection and sharing practices, and sued General Motors over allegations that it sold customer driving data to third parties.

Researchers from Northeastern University, working with Consumer Reports, tested vehicles from model years 2022 through 2025 and companion apps, observing network traffic while cars were stationary, driven, and used through their apps. The results reinforce an uncomfortable reality: connected vehicles are data-collection platforms on wheels.

The results in a nutshell:

• Both vehicles and companion apps contacted third-party domains, including those associated with advertising and tracking.
• 19 of 21 vehicles contacted at least one third party over Wi-Fi.
• 7 of 30 apps transmitted sensitive identifiers to third parties associated with advertising and tracking.

The troubling part is not that a car talks to its manufacturer. After all, a connected vehicle needs some network access for safety alerts, navigation, account functions, and maintenance. The bigger issue is the potential combination of identifiers. A vehicle identification number (VIN) can link a particular vehicle to its owner, while precise location can reveal highly sensitive patterns: where someone sleeps, works, worships, seeks medical care, spends time with friends, or travels. Add an email address or a name, and that information can be easier to connect to the detailed consumer profiles held by advertisers and data brokers.

And that’s before considering the privacy concerns around cameras that monitor drivers’ faces for signs of distraction or impairment.

Consent with strings attached

Consent is a weak safeguard when drivers have to accept extensive terms to use functions advertised as part of the vehicle. Several manufacturers said their connected services were opt-in, but declining can mean losing useful functionality. For example, Consumer Reports noted a Tesla warning that refusing its agreement may result in:

“reduced functionality, serious damage, or inoperability.”

That hardly sounds like freely given, informed consent.

There was one sign that scrutiny can matter: after researchers presented their findings, Honda told Consumer Reports it had directed vendor Amplitude to delete location data it received and stopped sending it going forward. But consumers should not need an academic study to discover who their car or its app is sharing data with.

Especially when Amazon, Google, Meta, and Microsoft—companies that already know plenty about us—were among the leading recipients of the driver data.

Until automakers collect less data and provide clear privacy settings, meaningful opt-outs, and deletion controls, drivers should treat a connected car, and especially its companion app, as another privacy-sensitive device. Review app permissions, turn off optional data-sharing settings, avoid linking unnecessary accounts, and ask manufacturers what data they retain, share, and delete.

---

Browse like no one’s watching. 

Malwarebytes Privacy VPN encrypts your connection and never logs what you do, so the next story you read doesn’t have to feel personal. Try it free → 

The Irish Data Protection Commission (DPC) has fined Google €403 million ($459 million) for violating European privacy law. The penalty follows a six-year inquiry into Google’s management of user location data between May 2018 and February 2020.

During that time, Google collected users’ location data without making clear that it could be used to infer their interests and shape the ads they saw.

Google’s location history keeps track of users’ locations when using their devices. It’s an opt-in service that includes a Timeline feature to display a private map of the places they’ve visited. A separate Android feature, Location Accuracy, helps devices determine their location more accurately than GPS alone.

Google had told users that they could stop Location History tracking by turning off that setting. But a report by the Associated Press in 2018 found that doing so wasn’t enough to stop Google from saving some of that location data. Researchers at Princeton University later confirmed the AP’s findings.

One reason was Web & App Activity, a separate Google account setting that can save information about what Google account holders have been browsing on the web and doing with their apps. That service was also collecting location data. Turning off Location History did not turn off Web & App Activity.

This issue led to payouts in multiple US jurisdictions. Google agreed to pay $85 million to Arizona in October 2022, $392 million to 40 states that November, and $9.5 million to the District of Columbia the following month. It also agreed to pay $39.9 million to Washington State in 2023, $1.38 billion to Texas in May 2025 as part of a two-suit settlement. Last September, a jury awarded $425 million in a separate class action case.

The DPC first looked into the issue in 2018 after the AP investigation and launched an official statutory inquiry in February 2020. Along with the fine, it has ordered Google to bring its location data processing into compliance within six months. The DPC says it will publish the full text of its decision in due course.

Google told Bloomberg that it had revised its practices since 2019 and launched tools to make location data easier to manage. In December 2023, Google announced that it would change its Timeline feature to keep its data on users’ devices. It also said that, for people turning on Location History for the first time, the default period before data is automatically deleted would fall from 18 months to 3 months.

This isn’t the only Google-related investigation that the DPC has launched. It launched one on Google’s processing of EU residents’ data for its AI model two years ago, and another related to the processing of personal data for its online Ad Exchange in 2019.

Check your Google location settings

Turning off Timeline doesn’t stop Google from saving location information through other settings. Check Web & App Activity and, if you see it, Search Services History too.

You can turn these settings off and delete activity already saved to your account.

---

Browse like no one’s watching. 

Malwarebytes Privacy VPN encrypts your connection and never logs what you do, so the next story you read doesn’t have to feel personal. Try it free → 

Apart from the privacy concerns around smart glasses, researchers have found that some cheap brands come with barely any security at all.

ABC Australia reports that researchers from NSB Cyber and Abstract Shield tested two inexpensive pairs, costing A$60 and A$110 (around US$42 and US$78), and found more than a dozen flaws across the smart glasses themselves, their app, and an associated website.

The main problem they uncovered was insecure Bluetooth pairing: If the glasses were powered on and not connected to their owner’s phone, an attacker could connect first, with no password or meaningful pairing confirmation.

After connecting, an attacker could reportedly control the glasses to capture photos or recordings, copy existing media, and intercept data moving between the glasses and the phone. An attacker could also make another device appear to be the victim’s glasses, allowing it to connect to the owner’s mobile app.

The testing also found that a Bluetooth-visible device identifier could allegedly be used with a weakness in the app’s website to retrieve a user’s email address and date of birth.

The research uncovered another privacy issue. ABC reports that voice or text submitted to the built-in AI, along with images sent to it, was first transmitted to a server in Shenzhen and could be forwarded elsewhere, depending on the function. The tests did not establish how the data was subsequently used.

The server locations, combined with some of the AI’s answers to specific questions, led researchers to conclude that the chatbot companion relied at least in part on Chinese sovereign AI models. Professor Kimberlee Weatherall, a technology regulation expert involved in the testing, said the failure to identify China in the privacy policy appeared to violate the Australian Privacy Principles,

The timing of the testing is also relevant because Australia’s smart-device security standards apply to most consumer smart devices manufactured on or after March 4, 2026. They require, among other measures, no universal default passwords, a way to report vulnerabilities, and information about the minimum security-update period. Devices made before that date are outside the requirements.

Experts quoted by ABC said the devices violated Australia’s privacy laws and were also likely to breach several sections of the Cyber Security Act. However, whether the new smart-device standards apply would depend partly on when the glasses were manufactured, and the rules have not yet been tested in a known enforcement action.

Professor Weatherall said:

“The rules say that the password must be unique. It doesn’t even seem like they were applying a password, which might mean that their standards are so low they don’t even technically breach that rule, which I find amazing.”

What to do

We’re not fans of smart glasses, expensive or cheap. But if you own a pair:

• Avoid pairing or using inexpensive camera glasses that lack a clear physical pairing step, account authentication, a published security-contact process, and a stated update-support period.
• Stop using their AI or cloud features for sensitive material, remove unnecessary permissions from the companion app, check for firmware and app updates, and consider returning the product if the vendor cannot document a fix.
• Ask permission before recording people, and check your local laws to understand what is and isn’t allowed.

---

From reporting threats to removing them.

Cybersecurity risks should never spread beyond a headline. Keep threats off your devices by downloading Malwarebytes today.

VPN use is growing around the world, with the worldwide average holding steady at 20% growth per year. Users have come to appreciate everything a VPN offers: it encrypts your connection, shields you from relentless ISP tracking (and the targeted ads that often come with it), hides your IP address and location, and lets you keep using your favorite paid services while traveling. This matters most at big public events, like international football tournaments, the Olympics, or concerts by popular performers, where the odds of scammers intercepting an unprotected Wi-Fi connection go up sharply.

That said, VPNs come with their own frustrations. One of the biggest is that many smart devices – including TVs, game consoles, streaming boxes, and smart-home gadgets – can’t run a VPN at all. On top of that, you usually have to set up the VPN separately on every single device in your home. Installing the VPN directly on your home router solves both problems at once: it protects your entire home network, including newly added devices. Here’s a closer look at what benefits that setup gives you.

1. Every device gets VPN protection

Turn on a VPN on your router, and every device connected to your home Wi-Fi automatically sends its traffic through that protected, encrypted connection. There’s nothing extra to do: connect your phone, laptop, or TV to the Wi-Fi, and its traffic is already routed through the VPN.

Many paid VPN services cap the number of devices you can use under a single subscription. But your router only counts as one device on that list, even though it might be protecting a dozen or more gadgets in your home at once.

It’s worth noting that installing a VPN on a router is usually only possible with paid VPN services. Free plans typically don’t offer this option, or only allow it in a very limited way.

2. Set it up and forget it

Setting up a VPN on every phone and computer in the house can get tedious fast. And if your home devices run on a mix of operating systems, you’ve to start by locating the VPN settings on each one, since Android, Windows, iOS, and macOS all handle this differently.

With a router setup, you configure the VPN once, and it automatically covers any new device you connect later too.

3. Protection even for devices that don’t support VPN

Plenty of devices can’t run a VPN at all. That includes smart TVs, streaming boxes, game consoles, and nearly every piece of smart-home tech out there, from baby monitors to robot vacuums. A VPN on your router protects all of them, and you don’t have to tinker with your vacuum cleaner or smart bulb’s settings separately.

4. No need to worry about turning the VPN on and off

Many people want to make sure that not a single byte of their data leaves their device before the VPN kicks in. The problem is that there’s always a short gap between turning on a computer or phone and the VPN firing up, and during that window, data travels over the internet unencrypted.

The usual fixes are to turn on special features – such as Always On VPN or a VPN kill switch – in the operating system or VPN app. A more effective option though is running the VPN on the router itself. That way, “not a byte without the VPN” becomes true automatically for every device on your home network. But for complete peace of mind, you’ll still want to set up a kill switch on the router too, so that if the VPN ever disconnects (say, the VPN server becomes temporarily unavailable), your devices lose their internet connection entirely rather than falling back to an unprotected one.

5. Working remotely with two VPNs at once

Another common headache is needing to run two VPN services at the same time. This usually comes up with remote work: you need a corporate VPN to connect to your company’s network, while also wanting a personal VPN for everything else. On many devices, running two VPN connections at once for different purposes is either a real hassle to configure or not possible at all. Constantly switching between the two isn’t convenient either, and it opens up privacy and security gaps.

A VPN on your router solves this too. You simply turn on the corporate VPN on your work computer, and it runs on top of your Wi-Fi connection, which is already protected by your personal VPN on the router. In effect, you end up with one VPN nested inside the other (corporate VPN → Wi-Fi → VPN → internet), but this layered setup rarely causes any issues.

6. Getting around apps that block VPNs

Some banking and streaming apps can detect when a VPN app is running on your device and simply refuse to work. Usually, they can’t tell what kind of VPN it is or why you’re using it. They just object to any VPN connection being active at all. If the VPN runs on your router instead of on the device itself, this problem disappears.

7. Protecting guests on your home network

Any device belonging to friends or family that connects to your Wi-Fi automatically gets VPN protection too, with no setup required on their end.

8. Less strain on your devices

Since the router handles the encryption workload, your phones, tablets, and other lightweight devices can use less computing power and drain less battery than they would if running a VPN themselves.

9. Simplified VPN management

Need to switch VPN servers, change protocols, or tweak other settings? Just do it once, on the router. There’s no need to reconfigure every device separately.

Precautions and things to keep in mind

For all its advantages, running a VPN on your router does come with a few trade-offs worth knowing about.

• Encrypting traffic for an entire network takes real processing power, so on an underpowered router, your connection speed may end up limited.
• Some routers don’t support VPNs at all, or only work with older, less secure protocols like PPTP.
• If your router was issued by your ISP, you may not have enough permissions to install a VPN on it.

In any of these cases, you can buy a more capable router that supports VPNs, and use it either instead of, or alongside the ISP-issued box, setting up your home network and VPN on your own hardware.

With this setup, your devices connect as follows: device → Wi-Fi or Ethernet → personal VPN on router → internet. For computers that also connect to a corporate VPN, the path looks slightly different: corporate VPN on computer → Wi-Fi or Ethernet → personal VPN on router → internet.

If you can’t connect your own router directly to your ISP’s network because your model lacks the right port (for example, with a fiber connection), you can use an Ethernet cable to plug your personal router’s input into your provider’s box. In that case, you can either switch the ISP-issued router into bridge mode or simply turn off its Wi-Fi so it doesn’t add unnecessary wireless clutter, since its only job now is connecting to the provider’s network and passing that connection along to your own router.

It’s also worth noting that some online services – like banks, government sites, online stores, and streaming platforms – may restrict or block access entirely when they detect a foreign IP address through a VPN. To get around this, you can either turn off Wi-Fi on your phone and use your mobile data instead, or take a more sophisticated approach to your router setup, as described below.

Most modern routers let you create more than one Wi-Fi network, usually supporting at least a separate home and guest network, each with their own settings. You can use this to create two networks: one with the VPN always on, and one without. Then, for services that don’t play well with VPNs, you can simply switch to the unsecured Wi-Fi network instead.

If you’re willing to spend some more time on setup, there’s an even more convenient option, known as split tunneling: individually configuring certain services or websites to bypass the VPN while sending everything else through your secure VPN connection as usual. To do this, you’ll need to specify the addresses of the sites that should skip the VPN.

Many feature-rich routers also let you divide your home devices into groups and set different connection rules for each group. That way, you could set things up so your smart TV reaches streaming services without a VPN, while your smart home devices, computers, and phones only ever connect to the internet through the protected channel.

How to set up a VPN on your router

Setting up a VPN on your router might sound more complicated than installing it on individual devices, but it delivers far more comfort and protection for your whole home network.

To do this, you’ll need a router that supports VPNs, and a subscription to a VPN service that can generate configuration files for routers using modern VPN protocols. Kaspersky VPN supports the two most widely used VPN protocols – OpenVPN and WireGuard – for connecting routers to the service.

You can create a Kaspersky VPN configuration file for your router by following our detailed guide. For instructions specific to your router model, we recommend searching online or asking an AI assistant something like “how to set up a VPN on {your router model}“.

Why LinkedIn is challenging an overbroad government demand—and why Congress must make secrecy the exception

Today, the U.S. Court of Appeals for the Fourth Circuit heard oral argument in LinkedIn’s (a Microsoft subsidiary) appeal challenging a government demand for user records and a related secrecy order that is preventing LinkedIn from notifying those users that the government is seeking their data. The appeal asks important, constitutional questions about whether service providers may challenge demands that sweep in records unrelated to an investigation, and when the government may prevent a provider from notifying the user of a request.  

This appeal continues Microsoft’s longstanding work to ensure that secrecy orders remain the exception, not the rule. LinkedIn’s appeal asks courts to enforce meaningful limits on both the scope of government demands and the secrecy that can accompany them. 

We recognize law enforcement’s important role in protecting public safety and investigating crime, and sometimes that does need to be done covertly. We respond to lawful legal requests. At the same time, customers and users deserve meaningful limits and independent oversight through an adversarial process. And, customers deserve to be notified when the government seeks their data, unless the government clearly establishes the need for secrecy under statutory and constitutional standards. 

Those safeguards fulfill basic constitutional rights. The Fourth Amendment protects the right to be free from unreasonable searches and seizures. That right applies to papers kept in a desk, and it also applies when personal and business records are stored online. Online service providers, like LinkedIn and Microsoft, also have a First Amendment right to speak to their customers when the government obtains an order to search their private information. Secrecy may sometimes be justified—but it should be tailored to demonstrated needs and subject to meaningful review.  

This particular case arose after LinkedIn received a court order seeking user records together with a secrecy order preventing LinkedIn from informing anyone about the order. The details remain under seal, including the nature of the information the government seeks and the people who own that information. But the Fourth Circuit partially unsealed LinkedIn’s opening brief in July, allowing the public to understand some of the core issues. LinkedIn argues that the demand is overbroad, the secrecy order is unconstitutional, and the government has violated LinkedIn’s due process by withholding evidence from LinkedIn. 

Three amicus briefs from a broad coalition support LinkedIn’s position. The American Civil Liberties Union and ACLU of Virginia argue that users’ privacy interests must inform whether a demand is reasonable and that providers may be the only practical means of challenging unlawful process because users often receive no notice. The Reporters Committee for Freedom of the Press warns that overbroad demands, delayed notice, and secret evidence can expose confidential sources and chill newsgathering. Amazon, Apple, Google, Meta, and X emphasize that cloud providers are uniquely positioned to identify irrelevant requests and that secrecy orders require case-specific evidence rather than boilerplate assertions. Together, these briefs show why cloud providers must be able to test both the scope of government demands and the need for secrecy. 

Microsoft has a long record of standing up for these principles. In 2014, Microsoft successfully challenged a secrecy order connected to a National Security Letter that prevented notice to an enterprise customer. In 2016, we filed a landmark challenge to the widespread use of indefinite secrecy orders. We’ve successfully challenged individual secrecy orders time and again over the years. Our efforts contributed to updated Justice Department policies, but executive-branch practices can change. Durable protections require the development of case law and legislation. 

The U.S. House of Representatives recently took an important step in that direction. On August 31, the House passed legislation to rein in secret surveillance and strengthen notice protections when the government seeks data held by technology providers. As we explained when the bill passed, the reforms would place clearer limits on secrecy orders, require greater accountability, and help ensure that secrecy is the exception – not the rule. The Senate should act promptly to send these historic reforms to the President. 

The House –passed legislation recognizes that privacy and public safety are not opposing values. Clear standards can give investigators the confidentiality they genuinely need while providing courts, providers, and customers with predictable rules. The pending legislation and LinkedIn’s appeal are the latest, complementary chapters in this broader effort. Legislation can establish durable, system-wide rules for notice and accountability. Courts must meanwhile enforce the limits already contained in existing statutes and the Constitution. Neither task requires obstructing legitimate investigations. Rather, both mean the government must seek only relevant information, justify secrecy with specific evidence, and infringe on speech to the least extent possible. 

That is why today’s argument matters beyond a single sealed investigation. People and organizations increasingly entrust their most sensitive information to online services. If providers cannot challenge demands they know are overbroad—or if courts may silence them without a rigorous, adversarial review—the safeguards the law requires will be weakened precisely when they are most needed.

Microsoft and LinkedIn will continue to support lawful investigations while standing up for customer privacy, transparency, and the rule of law. We have appealed to the Fourth Circuit to preserve providers’ ability to challenge overbroad demands and to require the government to meet its constitutional burden before imposing secrecy. And we urge the Senate to complete the work the House began by enacting durable non-disclosure order reform.

Further reading 

• House passes historic reforms to rein in secret surveillance 

• New success in protecting customer rights unsealed today 

• Keeping secrecy the exception, not the rule 

• DOJ acts to curb the overuse of secrecy orders. Now it’s Congress’ turn. 

• DOJ’s newly released recommended practices are a win for cloud and enterprise customers 

• Ensuring secrecy orders are the exception not the rule when the government seeks data owned by our customers 

• The need for legislative reform on secrecy orders 

• Freedom is built on the protection of privacy | Episode 2 

The post Protecting customer privacy means standing up for transparency appeared first on Microsoft On the Issues.

Picture your computer keeping a diary — the kind kids used to keep logging their daily activities, or the kind travelers, merchants, and nobles kept centuries before that. Here’s what it might look like.

Thursday, September 10.

• 8:00 AM. User read the news on cnn.com and bbc.co.uk (Safari).
• 8:10 AM. User replied to John Kaufman’s email about delivery dates, then sent the same question to the logistics team (Gmail).
• 8:20 AM. User checked his to-do list, reviewed recent updates, and planned out the day’s priorities (Todo).

We’re not exaggerating. This is exactly what your Mac’s new diary looks like. It’s a set of text files that any app on your computer can read — as can anyone sitting at the keyboard. The feature responsible is called Computer History, and it was released by OpenAI in mid-August. At the moment, it only works in the ChatGPT app for Mac, requires a Pro subscription or higher, and is disabled by default. According to its developers, the idea behind History is to let the AI assistant quickly get up to speed on your work context, so it can answer even vague requests, like “send a reminder to whoever I was emailing about last week’s deliveries”. Of course, that convenience comes at a price, ranging from your data being processed on OpenAI’s servers, to the risk of it leaking off your Mac — whether to a nosy family member or straight into the hands of cybercriminals.

How ChatGPT Computer History works

If this sounds a lot like Microsoft’s similar Recall feature, or Chronicle, which OpenAI itself announced earlier, that’s no coincidence. Both were built with the same goal in mind, just using different methods. Having watched Recall turn into the PR disaster it was, the team behind Computer History decided against constantly taking and analyzing screenshots. Instead, ChatGPT relies on macOS’s Accessibility features to read the text on your screen and track your actions: mouse clicks, text typed into fields, switching between apps, and the like. All of this gets stored as a stream of raw activity data inside the ChatGPT container (app group), which only the ChatGPT app itself, or other apps you’ve specifically given permission, can access. In tests run by digital forensics researchers, just two hours of normal computer use generated around 3500 of these logged events.

That raw data remains on your computer for up to 48 hours. During this time, the ChatGPT app periodically runs hidden chat sessions behind the scenes, where it asks the AI to summarize related events into a single recap. Essentially diary entries, these summaries get saved as plain text files in a folder that any app on your Mac can open: ~/.codex/memories/extensions/skysight/.

When you chat with the assistant, or when certain automated features kick in, these notes can be pulled into the conversation for more context-aware responses. OpenAI is especially keen on pointing out that the assistant can spot patterns in your workflows and offer to automate them, creating what it calls “skills” that replicate your actions for you.

Once a summary is ready, the raw activity data behind it is deleted. OpenAI says it won’t keep those hidden background chats or use them to train its AI, except where required by law. The diary-style summaries that get pulled into your conversations, though, are stored on OpenAI’s servers under the exact same rules as your regular chats and the assistant’s memory, so your preexisting privacy settings will apply to them too.

What Computer History can see, and what you can turn off

Since the whole feature runs on accessibility tools, ChatGPT only picks up what your operating system is already willing to share with those tools. That includes window titles, blocks of text, image captions in your browser, text you’re typing into a field as you type it, and the names of interface elements you click on. Watching a video? The AI can’t see the video itself, but it can read the window title, the site name, and the video description. Browsing photos? It sees file and folder names, not the actual images. Audio is never recorded or saved in any situation. All that gets logged from a video call is the meeting window title, unless the call itself has live captions turned on. Password fields that are masked (shown as dots) aren’t read at all and, according to OpenAI, private browsing windows are never scanned.

One thing that sets this apart from Microsoft Recall is the clearly spelled out step-by-step procedure the user needs to go through to turn it on. Computer History never activates itself. You have to navigate to the settings menu, then Integrations → Computer History and turn it on manually after reading through the warnings and explanations. You’ll also need access to the agent’s memory enabled for the feature to work. From there, you choose which apps and websites you want it to track, and confirm a series of macOS permission prompts.

For companies using a business subscription, this requires approval at two levels: an administrator first has to enable Computer History for the whole organization, and then each employee has to turn it on individually.

At any point, you can go to Computer History → Permissions and either list specific apps and sites to exclude from tracking, or, conversely, set ChatGPT to only watch a limited list you choose (Include only these apps, Include only these websites).

To see what your own computer’s diary looks like, check Computer History → History. From there, you can delete individual entries or disable the tracking of specific apps directly from the list.

The risks of using ChatGPT Computer History

We covered the risks of centralized storage of someone’s entire activity in our earlier piece on Microsoft Recall, and most of what we said there applies to ChatGPT Computer History.

• You might assume your chats and emails are private, protected by passwords and encryption. But a copy of the most important parts of those conversations is sitting in plain text files that anyone with access to your computer, and plenty of other apps, can open.
• The people you’re messaging have no idea this extra copy exists. If they’ve turned on, say, a self-destructing chat feature, but the messaging app’s window itself isn’t marked as private, that precaution does nothing to protect them.
• Even if you trust OpenAI completely and take its privacy promises at face value, your data can still be stolen directly off your computer by an infostealer. Mac-targeting infostealers have exploded over the past two years, so this isn’t a hypothetical risk. And the people who write this type of malware move fast, quickly updating it to grab whatever new type of data looks promising. OpenAI’s files are a boon for them: everything you’ve done, already summarized by AI into something easy to read. While there are no passwords or credit card numbers in there, the available details are likely enough to craft a convincing targeted urgent email from the boss.
• And if a nosy coworker or family member gets their hands on your computer, reading through the diary of your work and life would take them all of five minutes.

Computer History: turn it off, or just configure it?

We’d recommend limiting or fully disabling Computer History if your work involves sensitive information. This especially applies to doctors, lawyers, and anyone else bound by professional confidentiality, or handling personal or medical data. The same goes for anyone living with an overly controlling family member, or working in an office with nosy coworkers.

If none of that applies to you and you’d like to try out how useful the AI’s search and auto-generated skills actually are, here’s how to set things up safely.

• Lock down your Mac’s login. Turn off auto-login, and set your Mac to require a password immediately after the screensaver kicks in or it wakes from sleep. Use a strong password along with Touch ID, and make sure FileVault disk encryption is turned on.
• Set up your exclusions. Manually add every messaging app you use for private conversations, along with any finance apps or sites, and anywhere else you keep sensitive information, to Computer History’s exclusion list.
• Check in regularly. At least a couple of times a week, visit Computer History settings to see which apps and sites it’s been tracking. This helps you catch and remove any sources of private information you forgot to exclude earlier.

No matter how you configure Computer History, the two most common ways your data could end up in the wrong hands — on any Mac — are a macOS infostealer snatching it directly from your computer, and typing your information into a fake website. To guard against both, make sure you’re running full-featured security software on your Mac, such as Kaspersky Premium for macOS.

AI can create privacy risks you might never think to look for. You can read about more of them in our other posts:

• Attacks on Gemini: the possibilities are endless
• Why AI agents need an iron curtain
• Knives, kinks, and shooters: what AI toys are really saying to kids
• AI and the new reality of sextortion

And if you’d like to know how to turn off AI features that activate on your computer or smartphone without your knowledge, check out our guide, Unplugged: how to disable AI on your computer and smartphone.

Flock Safety’s cameras are automated license plate readers (ALPRs) designed to help police find stolen cars or wanted suspects.

A joint investigation by 404 Media and WIRED, based on data recovered from a physically removed Flock camera, found that its on-device software explicitly detects people as well as vehicles, bicycles, and license plates.

Separately, Washington DC’s police union says the Metropolitan Police Department used Flock data to track officers under Internal Affairs investigation without their knowledge.

Together, these reports illustrate a privacy problem: A network built to record the movements of vehicles can readily be used to follow almost anyone.

The latest reporting adds an important technical detail to that debate.

What Flock cameras collect

A group of hackers reportedly removed a Flock camera from a roadway, copied its storage, and recovered an encryption key stored on the device. That allowed them to unlock videos of thousands of vehicle detections despite Flock’s claim that its devices are protected by on-device encryption. Flock said it could not assess the claims without more detail.

The recovered camera files reportedly contained software models that detect people, even though public discussion of Flock has usually focused on cars and license plates. The researchers found no evidence that face-recognition features were actively used. Reassuring, but it should not be mistaken for a clean privacy bill of health.

Even without facial recognition, a system that records repeated sightings can potentially reveal sensitive patterns of movement, including where someone lives, works, worships, seeks healthcare, attends protests, visits family, or spends time with other people. When a person is matched to a vehicle, vehicle-based tracking can become person-based tracking in practice.

As an example of how widely the data can be shared, WIRED found that records from the city of Alpharetta, Georgia:

“were accessible to more than 2,000 agencies, including police departments, colleges, airports, and, inexplicably, the Office of Inspector General for the federal General Services Administration.”

Targeted tracking of people

The Washington DC dispute shows what happens when the power to follow people is turned inward.

The DC Police Union says it learned in July that MPD’s Internal Affairs investigators had used Flock license-plate-reader data to track sworn officers under investigation without their knowledge. The union filed a complaint and asked the department to stop, arguing that MPD lacked adequate controls for a system with such extensive surveillance capabilities.

MPD defended the use, saying its position is that the use of license-plate-reader data in the misconduct investigation was appropriate. It said the labor dispute is headed to arbitration.

If police officers themselves are concerned that the system can be used to monitor them without transparent rules, the public should ask an obvious follow-up question: What prevents the same tools from being used to follow residents, employees, journalists, activists, former partners, or other people with no meaningful ability to challenge the search?

Even when Flock wants privacy to meet surveillance halfway, its measures do not eliminate the underlying civil-liberties issue.

The recovered camera software and the DC dispute make the same point from different directions. Flock’s network is not merely a collection of roadside plate readers. It is a distributed system for recording movement, identifying patterns, and making those records available for search.

Meaningful safeguards should include:

• Public approval before cameras are deployed, with clear maps showing their locations and stated purposes.
• Strict limits on collection, retention, searches, and cross-jurisdictional sharing.
• A requirement for documented investigative justification before a search, with elevated approval for sensitive investigations.
• Independently reviewable audit logs, regular public transparency reports, and meaningful penalties for misuse.
• Clear bans on searches related to protected activity, immigration enforcement where local law forbids cooperation, abortion-related investigations, political surveillance, and personal purposes.
• Independent security assessments covering the cameras, cloud services, identity controls, key management, and third-party integrations.
• Automatic deletion that cannot be overridden merely because data could someday be useful.

Privacy cannot depend on authorized users always following rules, vendors configuring every setting correctly, or abuses being discovered the hard way. The first safeguard should be limiting the system’s ability to build a searchable record of ordinary people’s lives at all.

---

Browse like no one’s watching. 

Malwarebytes Privacy VPN encrypts your connection and never logs what you do, so the next story you read doesn’t have to feel personal. Try it free → 

The Manhattan District Attorney’s Office has seized the domains of 12 deepfake websites in what it called the largest known seizure of celebrity deepfake sites in history.

The sites, which marketed themselves as deepfake pornography platforms, hosted AI-generated videos of over 1,200 people, including those in the public eye, ranging from politicians to actors, musicians, and social justice advocates. At least one allowed users to create their own deepfakes by grafting real faces and bodies onto sexual imagery.

The term non-consensual intimate imagery (NCII) is increasingly used instead of pornography when the person depicted has not given permission. Deepfake NCII is growing, due in part to the ease with which it can be created. It only takes one photo to generate it, as we discussed on the Lock and Code podcast in June.

MrDeepFakes was previously the largest site for this kind of content. Its operators shut it down in May 2025, citing data loss. An Australian man who posted explicit deepfakes to the site was arrested, fined for contempt of court, and charged with publishing obscene material.

But other deepfake NCII sites continue to compete for attention online.

Deepfake technology can cause real harm when misused, and its effects continue to spread. Manhattan District Attorney Alvin Bragg warned that domestic abusers are threatening to release deepfake NCII depicting their victims. The FBI has also warned that sextortion attackers are using AI to turn social media photos of minors into sexually explicit images.

Legal action is growing

Law enforcement has been working hard to stem the flood of deepfake NCII sites. In June, the Department of Justice and the Department of Homeland Security seized two domains hosting hundreds of thousands of forged images and videos. San Francisco City Attorney David Chiu’s office also sued 16 deepfake sites in August 2024, managing to get ten of them taken offline or made inaccessible in California. New York state also passed legislation prohibiting the distribution of intimate deepfake images and videos in 2023.

At the federal level, the TAKE IT DOWN Act, enacted in May 2025, made certain intentional publication of NCII, including sexual deepfakes, a federal crime.

Seizing a deepfake site stops the immediate distribution of its content, but operators can migrate quickly to other infrastructure. A report from the Institute for Strategic Dialogue (ISD) found that the deepfake ecosystem is made of many parts, from AI tool providers through to hosting companies and cryptocurrency payment processors. It called for a multi-sector collaboration to stop the production and spread of this material.

Bragg’s office said it will continue monitoring the seized websites to stop them reappearing under different domains.

What can you do?

If someone creates or threatens to share intimate deepfakes of you, save the evidence and report it to the police. Do not pay someone who threatens to publish the images, as payment does not guarantee that the threats will stop.

Bragg’s office said many of the victims it approached did not realize that action could be taken. It urged anyone affected by the seized websites to contact its Cyber Crime Bureau at 212-335-9600.

You can learn more in the Malwarebytes guide to deepfakes. UN Women also provides useful resources for people affected by AI-powered abuse.

---

Scammers don’t need to hack you. They just need you to click once. 

Malwarebytes Identity Theft Protection catches suspicious activity before it becomes a problem.

If you’re still OK with posting pictures of your kids on social media, take a minute to hear from mother of two Kalie Robins. At the start of September, she did something that hundreds of thousands of parents do every day. She posted a video of her young daughter on Facebook.

Under the video of Robins and her daughter singing in a car, Facebook’s Meta AI system displayed a suggested question: “Who is the child passenger?”

Robins was shocked that Facebook would ask this question about a minor, so curiosity prompted her to click it. That’s when a flood of automated stalker-type behavior began.

In Instagram post, an enraged Robins described what happened:

“It starts pulling completely separate information for each of my kids.”

That included names, birth dates, and videos of them.

The site also pulled up a picture of her newborn daughter that Robins’ mother had posted on Facebook years ago, along with a long-deleted picture that Robins said had once been in her own account.

Things got weirder. The site then presented another question: “Where does Kalie Robins live?”

An increasingly outraged Robins clicked that question. She described the results:

“[Facebook] started digging through completely unrelated sh*t from years of my life.”

It dug through old posts that hinted at where she had lived in the past and newer posts that connected her to her current home. It finished by attempting to pinpoint her location.

Robins complained:

“I didn’t ask Facebook to build a profile of my family.”

She expressed shock that Facebook would piece together snippets of personal information from historical posts and package them into a detailed profile for other users.

You can watch Kalie Robins’ Instagram video here:

.kadence-column465357_a378ee-2f > .kt-inside-inner-col{display:flex;}.kadence-column465357_a378ee-2f{max-width:558px;margin-left:auto;margin-right:auto;}.wp-block-kadence-column.kb-section-dir-horizontal:not(.kb-section-md-dir-vertical)>.kt-inside-inner-col>.kadence-column465357_a378ee-2f{-webkit-flex:0 1 558px;flex:0 1 558px;max-width:unset;margin-left:unset;margin-right:unset;}.kadence-column465357_a378ee-2f > .kt-inside-inner-col,.kadence-column465357_a378ee-2f > .kt-inside-inner-col:before{border-top-left-radius:0px;border-top-right-radius:0px;border-bottom-right-radius:0px;border-bottom-left-radius:0px;}.kadence-column465357_a378ee-2f > .kt-inside-inner-col{column-gap:var(--global-kb-gap-sm, 1rem);}.kadence-column465357_a378ee-2f > .kt-inside-inner-col{flex-direction:column;align-items:center;}.kadence-column465357_a378ee-2f > .kt-inside-inner-col > .kb-image-is-ratio-size{align-self:stretch;}.kadence-column465357_a378ee-2f > .kt-inside-inner-col > .wp-block-kadence-advancedgallery{align-self:stretch;}.kadence-column465357_a378ee-2f > .kt-inside-inner-col > .aligncenter{width:100%;}.kadence-column465357_a378ee-2f > .kt-inside-inner-col:before{opacity:0.3;}.kadence-column465357_a378ee-2f{position:relative;}@media all and (min-width: 1025px){.wp-block-kadence-column.kb-section-dir-horizontal>.kt-inside-inner-col>.kadence-column465357_a378ee-2f{-webkit-flex:0 1 558px;flex:0 1 558px;max-width:unset;margin-left:unset;margin-right:unset;}}@media all and (max-width: 1024px){.kadence-column465357_a378ee-2f > .kt-inside-inner-col{flex-direction:column;justify-content:center;align-items:center;}}@media all and (max-width: 767px){.wp-block-kadence-column.kb-section-sm-dir-vertical:not(.kb-section-sm-dir-horizontal):not(.kb-section-sm-dir-specificity)>.kt-inside-inner-col>.kadence-column465357_a378ee-2f{max-width:558px;-webkit-flex:1;flex:1;margin-left:auto;margin-right:auto;}.kadence-column465357_a378ee-2f > .kt-inside-inner-col{flex-direction:column;justify-content:center;align-items:center;}}

Meta’s response

Meta launched Meta AI in April 2024 and has since built it into Facebook, Instagram, WhatsApp, and Messenger. It operates across Facebook, Instagram, and WhatsApp. The assistant can answer questions, generate images, and help users create or retrieve information.

Meta admitted in a statement to the Verge:

“The feature never should have prompted the individual with questions like that.”

The company said the feature had “missed the mark” and that it had fixed the issue that caused Meta AI to suggest questions about personal topics.

In a classic “yes, but” non-apology, a Meta spokesperson also pointed out that the AI only surfaced information drawn from posts the person asking could already access. Although that doesn’t seem to explain why it reportedly surfaced a photo she had deleted years ago.

A pattern of Meta AI failures

Meta AI hasn’t always respected privacy. In June last year, we reported that users were publicly sharing conversations, often without realizing it. A separate bug we reported the following month could have allowed people to view other users’ private Meta AI chats by simply guessing their IDs. Late last year, Meta also started targeting people with ads based on their Meta AI conversations.

What can users do?

Parents get understandably irate when they discover just how much sites like Facebook can learn about their kids. While Robins regularly posted pictures and videos of her children, she had no idea that the service could aggregate information from years of posts to profile them. She’s not alone.

So what can people do about it? Perhaps the better question is: What should people not do? The clearest answer is not to post identifiable pictures of your kids (or other people’s) on social media. Not just to stop them being tracked in a privacy hellscape, but also to reduce the risk of even darker outcomes.

Robins described what she planned to do next:

“I’m done. I’m removing any identifiable pictures and videos of our kids.”

She added that she’ll ask her friends to do the same because, if they don’t, Facebook would still be able to harvest her children’s pictures from their accounts and use them in the profiles it builds.

---

From reporting threats to removing them.

Cybersecurity risks should never spread beyond a headline. Keep threats off your devices by downloading Malwarebytes today.

The US Federal Trade Commission (FTC), together with Utah and California, has filed a lawsuit against telehealth provider Hims & Hers.

The FTC alleges that the company shared consumers’ sensitive health information with third‑party advertising platforms despite promising strong privacy protections.

Hims & Hers is a telehealth and digital health platform that connects users with licensed medical providers for online consultations, prescription medications, and personal care products.

The complaint also accuses Hims & Hers of deceptive billing and subscription practices that made it hard for users to avoid charges or cancel subscriptions.

According to the FTC’s complaint, filed in federal court in California, Hims & Hers:

• Shared sensitive health data, including details about medical conditions, with ad platforms such as Meta and Snap despite privacy promises.
• Charged before consultations. The company promised users they could consult a medical provider before being charged, but the FTC says many consumers were enrolled in recurring prescription subscriptions shortly after they submitted an intake form, often without first having a consultation.
• Made cancellation difficult. Before 2023, cancellation reportedly required contacting customer service by phone, email, or chat. Even after an online cancellation option appeared, the FTC alleges the button was hidden behind multiple steps and confusing options.

From a cybersecurity and privacy research perspective, this isn’t just about a single telehealth brand. It highlights three broader trends we see repeatedly in consumer programs:

Privacy policies versus reality. A company can market itself as privacy‑focused while still integrating third‑party advertising and analytics software development kits (SDKs) that leak sensitive information. This becomes especially concerning when health‑related events are linked to user accounts or tracking cookies.

Friction as a feature. Hard‑to‑find cancellation flows and unclear billing practices are examples of “dark patterns” that nudge users into paying for services they might not have chosen given all relevant information.

Regulatory pressure is growing. Health‑related services are under increasing scrutiny, especially when they handle sensitive data and combine it with advertising platforms.

The court will ultimately decide whether Hims & Hers violated the law, but the FTC’s action sends a clear signal: regulators are paying close attention to how health‑related services collect, use, and share sensitive data.

For anyone who values online privacy, the Hims & Hers case is a reminder that “health tech” does not automatically mean “privacy first.”

How to stay safe

More often than not, the privacy loopholes are hidden in the privacy policy somewhere.

Pro tip: one thing AI is good at is reading between the lines. Ask an AI chatbot to summarize a privacy policy and identify when your information may be shared with third parties. AI makes it much easier to understand lengthy privacy policies without reading every word yourself. If companies fail to follow their own privacy policies, regulators and consumers can hold them accountable.

Other than that:

• Don’t share sensitive information unless it’s genuinely needed to provide the service.
• Use strong, unique passwords and multifactor authentication (MFA). Even if a company is compliant, breaches happen. Unique passwords and two‑factor authentication limit the damage if your account details are exposed.
• Check your browser and app permissions. Disable unnecessary tracking features where possible, and consider privacy‑focused browser settings or extensions that limit third‑party cookies and trackers.

---

Your name, address, and phone number may already be for sale.  

Data brokers collect and sell your personal details to anyone willing to pay. Malwarebytes Personal Data Remover finds them and gets your information removed, then keeps watch so it stays that way.