grep -rl "privacy" ./articles
Siri Recap and Live Rewind keep the microphone live. Apple says no audio is stored — only condensed text sent to Private Cloud Compute, deleted after seven days. Every safeguard is built around the wearer. California's recording statute asks about the consent of everyone else in the room.
Kinryū Labs found an Elasticsearch cluster holding nine years of Advance Passenger Information: names, dates of birth, nationalities, passport numbers and expiry dates, flight and seat details. It was not an open database — the front door returned 401, and a second path answered to default credentials.
A dark web service called Nexus advertised more than 153 million US and Canadian driver's licence scans, six image files each. Brian Krebs found his own licence in it, and his mother's, timestamped seconds apart on a day they both rented a car. The infrared and ultraviolet frames are the detail that says where the images came from.
Encrypted Client Hello hides which sites you visit from your ISP and anyone on the network. Android 17 turns it on at platform level, and where a server does not support it, sends convincing fake ECH anyway. That second half matters more than the first: privacy that only some people have is a label, not a protection.
Glassbox runs 30-plus fingerprinting techniques locally and tells you how identifiable you are. Its author measured Chrome at 99% and Tor Browser at 56%, and one work session as unique among 7.6 billion browsers. His advice is the opposite of what most privacy guides say: stop customising, and get into a large identical crowd.
Two DMCA subpoenas filed in New York on 20 August demand that Microsoft and Discord hand over device identifiers, IP addresses, phone numbers, linked accounts and OneDrive contents — for every account that spoke in three named servers since 1 June. One of those servers belongs to a streamer who says he knows nothing about it. The deadline is 4 September.
The Dutch Data Protection Authority found Uber suspended driver accounts — sometimes permanently — through automated decisions with no human review, and did not tell drivers it was happening. The violations run from 2018 to 2022. It is the authority's fourth fine against the company, and Uber is appealing.
The DoJ and FTC sued TikTok and ByteDance in August 2024 over children's privacy. The settlement is $300 million now and $100 million more once a court vacates the consent decree entered against Musical.ly, TikTok's predecessor — the order from the 2019 case that was supposed to stop this happening again.
A seller calling himself ZeroBytes listed DGFiP data on 12 August. The French finance ministry says 678,000 individuals and professionals had data extracted, that a property-registry platform exposed around two million more, and that of those only 252,149 were actually stolen. No passwords or online accounts were touched — which matters less than it sounds.
Xfinity WiFi Motion turns the radio link between your gateway and a smart speaker into a movement sensor, with no camera and no hardware to buy. It is opt-in and off by default, which most of the alarm about it gets wrong. The real question is what a log of when your home was occupied becomes once your ISP is holding it.
The latest round of threat notifications went out on Thursday. Apple has now notified people in over 150 countries since late 2021, and deliberately attributes nothing — which is both a defensible policy and the reason these alerts are hard to act on.
Google published Q1 2026 figures for its notification abuse work: automatic permission revocation for inactive sites, HTTP 429s past a threshold, and network-level analysis of coordinated service workers.
'AI Sidebar with DeepSeek, ChatGPT, Claude and more' had 300,000 installs and a 4.6-star rating before Google removed it in January. It returned in August, clean for eleven days, then shipped a 21-line addition.
The UK dropped its first secret order in 2025 after American pushback. It issued a second. Apple has now filed a complaint with the Investigatory Powers Tribunal, and the underlying demand is unchanged: access to backups that are end-to-end encrypted by design.
The DPDP Rules were notified on 14 November 2025 with an 18-month runway to May 2027. But the soft-enforcement phase ends on 13 November 2026, legacy data must be revalidated by then, and penalties reach ₹250 crore.