.kadence-column484998_59baca-d5 > .kt-inside-inner-col{padding-top:20px;padding-right:20px;padding-bottom:10px;padding-left:20px;}.kadence-column484998_59baca-d5 > .kt-inside-inner-col{column-gap:var(--global-kb-gap-sm, 1rem);}.kadence-column484998_59baca-d5 > .kt-inside-inner-col{flex-direction:column;}.kadence-column484998_59baca-d5 > .kt-inside-inner-col > .aligncenter{width:100%;}.kadence-column484998_59baca-d5 > .kt-inside-inner-col{background-color:rgba(255, 229, 229, 0.83);}.kadence-column484998_59baca-d5 > .kt-inside-inner-col:before{opacity:0.3;}.kadence-column484998_59baca-d5{position:relative;}@media all and (max-width: 1024px){.kadence-column484998_59baca-d5 > .kt-inside-inner-col{flex-direction:column;justify-content:center;}}@media all and (max-width: 767px){.kadence-column484998_59baca-d5 > .kt-inside-inner-col{flex-direction:column;justify-content:center;}}

If you thought that opting out of surveillance on your smart TV would give you your privacy back, think again.

A study by researchers at Northeastern University found that some smart TVs still seem to send information about what you’re watching to third parties, even after you pressed the opt-out button.

The study, ‘Watching the watchers‘, tested twelve smart TVs from ten manufacturers to find out how well they respected opt-outs from automatic content recognition (ACR). ACR is a TV feature that captures audio and/or video content from smart TVs and uploads it to a third party (typically the TV manufacturer).

The third party converts this content into digital fingerprints to understand what you’re watching, and can then use it to send targeted advertising or allow others to do the same. It’s on most if not all smart TVs, and 82% of US households had a smart TV as of last year.

The test took in the eight operating systems behind roughly 95% of US smart TVs, and ran ten viewing scenarios on each of them. These ranged from viewing antenna TV through to viewing via screen mirroring from another device. The researchers tested viewing the first-party streaming services provided free with the manufacturers’ operating systems, along with sessions using third-party streaming apps. And they tested sessions where the TV was connected to another device via its HDMI port.

The study ran all of its tests both with ACR left on, and with the opt-out setting selected. The whole test involved over 5,000 automated sessions.

Vizio continued to send 100% of what looked like traffic when viewing its first-party streaming services and antenna-based TV services, even after people had opted out, the study said. It also sent the same amount of traffic when idle. However it didn’t send any ACR traffic for third-party streaming data, according to the report.

Samsung did appear to leak some traffic from third-party streaming services after the researchers opted out of its ACR function. They tested 30 runs of Samsung’s built-in streaming service after opting out of ACR, and found that it still showed traffic “consistent with ACR”.

After opt-out, the Samsung TV’s Tizen OS seemed to send ACR-related traffic about Netflix in 7% of runs, YouTube in 10% of runs, and Tubi TV in 20%. It sent ACR 60% of the time from HDMI sessions. Like the Vizio TV, it also sent ACR traffic for all of its first-party streaming sessions.

Late last month, a researcher reverse-engineered a Samsung Smart TV and cast doubt on whether disabling ACR worked on the device.

There was good news, though. Four smart TV operating systems went completely silent after the researchers turned off ACR: LG’s WebOS, Sony’s Google TV OS, Amazon’s FireTV OS, and Supersonic’s VIDAA OS.

Encryption is a research challenge

Vizio agreed to pay $2.2 million in a 2017 FTC settlement over charges that it collected viewing histories on eleven million smart TVs without user consent. At the time, it agreed to allow people to opt out of ACR.

The Vizio TV that the researchers tested sent traffic to Kinesis, an Amazon-run data ingestion service that the manufacturer uses to analyze data from its smart TVs. The researchers noticed no dip in traffic to this domain when they opted out of ACR on a Vizio TV. They said:

“The opt-out setting has no observable effect on traffic sent to this endpoint. However, we cannot inspect the payload due to encryption so we cannot confirm whether this violates the FTC settlement.”

That’s a challenge to this research because most smart TVs encrypt their ACR traffic, including Samsung. So the researchers had to infer that this was ACR traffic based on signals such as where it was being sent, along with timing, volume, and protocol details.

One exception was Supersonic’s VIDAA OS, which sent ACR data to servers unencrypted. The servers responded unencrypted with a genre for what they recognized. Anyone watching the network could see it all, they warned. And because the servers didn’t require a login at the time of the test, over 57 million ACR detection results from other people’s TVs were accessible.

Vizio’s first-party streaming service WatchFree+ also dropped unencrypted titles of any show or channel being watched into online communications with the free TV service provider. There’s no way to turn that off, the researchers warned.

Walmart acquired Vizio for $2.3 billion in 2024, partly to help “advertisers to meaningfully connect with customers at scale and boost product discovery”.

The retailer also runs Walmart Connect, a retail media business that uses its customers’ data to help other businesses target them with ads.

Walmart was particularly interested in Vizio’s advertising business it, said at the time:

“Pairing it with Walmart Connect will be impactful and allow us to invest in our business even further on behalf of our customers.”

What smart TV owners can do

What can you do to protect yourself from a smart TV that might be sending your viewing data elsewhere? The researchers have some suggestions:

• WebOS (LG), Fire TV OS, Google TV on Sony, and VIDAA OS on Supersonic all appeared to honor ACR opt-out, so selecting it on these TVs should be safe.
• Disconnect the TV from the internet and use an external streaming device. That way the TV can’t send back data, even if it picks it up from the HDMI connection.
• Use a blocklist. This takes a little more technical knowledge. If you run an internet router that can accept blocklists, then you can add a list of known ACR endpoints that will stop your TV’s traffic reaching them. The researchers provide one here.

---

Stop threats before they can do any harm.

Malwarebytes Browser Guard blocks phishing pages and malicious sites automatically. Free, one click to install. Add it to your browser →

.kadence-column484007_649ea4-04 > .kt-inside-inner-col{column-gap:var(--global-kb-gap-sm, 1rem);}.kadence-column484007_649ea4-04 > .kt-inside-inner-col{flex-direction:column;}.kadence-column484007_649ea4-04 > .kt-inside-inner-col > .aligncenter{width:100%;}.kadence-column484007_649ea4-04 > .kt-inside-inner-col:before{opacity:0.3;}.kadence-column484007_649ea4-04{position:relative;}@media all and (max-width: 1024px){.kadence-column484007_649ea4-04 > .kt-inside-inner-col{flex-direction:column;justify-content:center;}}@media all and (max-width: 767px){.kadence-column484007_649ea4-04 > .kt-inside-inner-col{flex-direction:column;justify-content:center;}}

Online fashion retailer Revolve Group said customers’ payment card numbers and expiration dates were stolen. In its customer notification letter filed with the Massachusetts Attorney General, Revolve told recipients the incident involved their names, addresses, and payment card details.

What was stolen?

The at-risk data includes customer names and contact information, payment card numbers, and card expiration dates. The breach only affected customers who had saved their payment card as a payment method in their Revolve account.

A filing on the Texas attorney general data breach website lists 127,200 affected Texans, but not a nationwide total. We found the figure of 1,515,073 in data returned by the site when searching for Revolve. That data labels it as the total number of people affected, but the figure isn’t displayed on the public listing. Other sites have repeated it, though they appear to rely on the same Texas record. The SEC filing did not give a number of affected people, and Revolve has not confirmed the total.

Revolve’s SEC filing does not mention card verification value (CVV) numbers. These three-digit security codes printed on the back of payment cards (four digits on the front for American Express cards) are an extra layer of security for card-not-present transactions.

It is also unclear whether the card numbers were fully visible or masked, or whether Revolve or a third-party payment processor held them.

Even without a CVV, card numbers and expiration dates may be enough to make purchases at some online stores. And scammers who know your real card details and contact information may be able to send more convincing phishing messages to trick you into revealing your CVV.

How did they get the data?

Revolve has not said how the attackers accessed the saved payment data. In its SEC filing, Revolve said it believes an unauthorized actor may have obtained the data “through automated means.” Records on the Texas attorney general’s site indicate that the incident happened on September 11 and was discovered on September 29.

No group has publicly claimed responsibility for the theft.

What Revolve customers can do now

Revolve said it has taken extra security measures following the breach, although didn’t say what those are.

---

---

If you have saved payment information in your Revolve account, your details may have been among those stolen. Fraud can often begin within days of a breach. If you’re concerned about your card details being exposed:

• Read your statements line by line to identify even small charges that you don’t recognize. Criminals will often make a small charge using stolen card details to see if the card works.
• Look for unfamiliar merchant names on your statement.
• Report unauthorized charges to the card issuer immediately.
• Consider removing saved cards from shopping accounts. You could use a password manager instead, some of which will store autofill data for payment cards.
• Ask your card issuer to cancel your card and reissue with a new number so that the old number becomes unusable.

Also, don’t immediately trust calls, texts, or emails about the incident. Scammers can use stolen information to make themselves sound convincing. If someone claims to be calling from your card issuer, call the number printed on your card to check.

If you’re unsure about a message or link, check it with Malwarebytes Scam Guard.

---

Let’s face it, an incognito window can only do so much. 
 
Breaches, dark web trading, credit fraud. Malwarebytes Identity Theft Protection monitors for all of it, alerts you fast, and comes with identity theft insurance. 

As preparation for the UK’s planned social media ban, Ofcom has set out four ways social media platforms could check whether users are aged 16 or over. The government and Parliament will decide how the ban works in practice.

Ofcom is the regulator for the communications services in the UK. The BBC reports that Ofcom identified four ways to check someone’s age that it considers “highly effective.”

Here’s what those checks would involve:

• Photo ID matching: Comparing a live image of you with the photo on an identity document, such as your passport, and checking the age information on that document.
• Bank-based checks: Using age information your bank already holds about you, with your consent.
• Facial age estimation: Using technology to estimate your age from your face. Ofcom says this technology has improved recently.
• Digital ID services: Using a digital identity service to prove your age, rather than presenting a physical document.

Let’s think through what those checks could mean.

Challenges

The challenge isn’t simply checking someone’s age. It’s doing so without turning everyday internet use into an identity check.

Photo ID matching brings highly sensitive documents and facial images into the process, which raises questions about how that information is handled and protected. The risks aren’t hypothetical: as I reported last year, a breach at a third-party support provider for Discord exposed government ID images belonging to around 70,000 users.

Banking-based checks can be more privacy-preserving if they return only confirmation that someone meets the age threshold, rather than exposing financial information. But the important questions are what information each party receives, what gets retained, and whether the check can be linked to someone’s activity.

Facial age estimation can avoid uploading an identity document, but it still processes a sensitive image and makes an imperfect prediction. Ofcom acknowledges that some technologies can be wrong by a few years around age 16, so people near the threshold may face an additional verification check.

I would expect these checks to stop some underage access but not eliminate it.

Previous restrictions have been followed by workarounds, including increased VPN use, borrowed credentials, and migration to services outside the restrictions. The danger is treating a successful age gate as proof that children are now safe, when it might push them into less regulated spaces.

The effectiveness depends on how the checks are implemented. A VPN may help someone avoid a check triggered by their apparent location; it won’t, by itself, bypass an identity or facial check that is still required.

Similarly, Ofcom says matching a live image to an ID is intended to make it harder to borrow someone else’s document. We shouldn’t assume every workaround defeats every method. But Ofcom accepts that some motivated children will get through. The meaningful test is how much harm these measures prevent, weighed against the privacy risks and barriers they introduce— not whether every user has completed a check.

My personal preference is double-blind verification: a provider confirms that you meet the age requirement without learning which service you’re accessing, while the service receives proof of age without learning your identity. Proving you’re old enough shouldn’t mean revealing who you are.

---

Scammers don’t need to hack you. They just need you to click once. 

Malwarebytes Identity Theft Protection catches suspicious activity before it becomes a problem.

.kadence-column482644_f2c16d-bc > .kt-inside-inner-col{padding-top:20px;padding-right:20px;padding-bottom:10px;padding-left:20px;}.kadence-column482644_f2c16d-bc > .kt-inside-inner-col{column-gap:var(--global-kb-gap-sm, 1rem);}.kadence-column482644_f2c16d-bc > .kt-inside-inner-col{flex-direction:column;}.kadence-column482644_f2c16d-bc > .kt-inside-inner-col > .aligncenter{width:100%;}.kadence-column482644_f2c16d-bc > .kt-inside-inner-col{background-color:#ffe5e5;}.kadence-column482644_f2c16d-bc > .kt-inside-inner-col:before{opacity:0.3;}.kadence-column482644_f2c16d-bc{position:relative;}@media all and (max-width: 1024px){.kadence-column482644_f2c16d-bc > .kt-inside-inner-col{flex-direction:column;justify-content:center;}}@media all and (max-width: 767px){.kadence-column482644_f2c16d-bc > .kt-inside-inner-col{flex-direction:column;justify-content:center;}}

A group of hackers calling themselves the Department of Peace says it stole and published the personal details of more than 41,000 people working for the US Department of Homeland Security (DHS). The department says it is aware of a potential breach.

The group, which also claimed the theft of contract documents from the DHS in March, gave the data to Swiss hacktivist maia arson crimew, who published it in collaboration with the transparency collective DDoSecrets. The latter also published the BlueLeaks data dump that listed law enforcement officers’ details in 2020.

The aim of publishing the data was to replace “anonymity with accountability,” DDoSecrets co-founder Emma Best said in an online statement.

According to TechCrunch, timestamps on the records suggest the data was taken around mid-August. The group said it had launched the attack in response to a July 17 statement by DHS Secretary Markwayne Mullin, in which he promised to “turn up the heat” with traffic stops.

What was stolen?

The data files published online, which the publishers have called “Icepick,” span staff at nearly 7,000 offices. They include the names, work email addresses, phone numbers, office addresses, job titles and membership in internal DHS groups. The employees impacted include almost 6,600 Immigration and Customs Enforcement (ICE) employees. ICE is the DHS unit responsible for immigration enforcement and deportations in the US.

The dataset also carried details of over 21,000 Customs and Border Protection (CBP) employees, along with information on people who work at the Cybersecurity and Infrastructure Security Agency (CISA).

The data dump revealed less information than the ShinyHunters’ FBI data heist in September, which reportedly contained Social Security numbers, emergency contacts, medical records and home addresses. Nevertheless, this is more than just a phone book of folks in the DHS.

For one thing, it doesn’t take much to cross-reference data. Reuters matched six DHS employees’ data to credit bureau records and breach data from a dark web intelligence platform. Online activists regularly use open-source intelligence (OSINT) to “doxx” people from very few clues, meaning that even a leak of basic identity information can put someone in danger. In fact, the creators of a separate searchable version say they added information through automated and manual research. So some details shown in that version may not have come from the data stolen from DHS.

---

---

The data in this case also included membership of groups within Active Directory, a Microsoft tool that contains identity information about computer users. Active Directory controls who can access different internal tools, services, and third-party software within an organization.

The files listed over 200 CBP users in a group that could access the facial recognition tool Mobile Fortify. Other groups reference a service called Penlink, which the company claims can track the location data of hundreds of millions of mobile devices.

According to the Guardian, job titles in the data dump show which agents were assigned to sensitive jobs such as special operations, surveillance, and undercover work.

How did they get the data?

The Department of Peace said that it got to the information via a single sign-on (SSO) service provided by identity company Okta. SSO is a prized target for hackers because a single authentication can get a user into many different workplace services and applications.

Okta says it has no evidence its data or systems were compromised, but that doesn’t rule out someone abusing a DHS account with stolen credentials.

DHS told reporters it was aware of a potential breach. One DHS employee whose data showed up in the breach told Reuters they hadn’t heard anything about it.

What DHS employees can do now

The leaked records include work contact details and internal group memberships. This information could help attackers create convincing messages or calls, and may expose some employees to unwanted attention or threats. DHS has warned about the risk of harassment, stalking, and physical harm. It is not yet clear whether the leak has led to specific threats or affected any operations.

If you work for DHS:

• Follow security advice and instructions from the DHS.
• Treat unexpected calls, emails, and texts about your role or colleagues with caution. Verify them through a contact method you already trust, and never share passwords or MFA codes.
• Change any personal passwords you’ve reused for work, and turn on MFA where available. Follow your agency’s process for work accounts.
• Report suspicious contact or threats to your agency’s security team. If you believe there’s an immediate danger, contact law enforcement.

Do you think your information might have been leaked in a data breach? Check out the Malwarebytes Identity Theft Protection service.

---

---

A reverse engineer claims that their Samsung smart TV has been collecting audio without their consent.

The researcher, who calls themselves “log4j,” said in an X thread that their 2025 Samsung TV was delivering ads that seemed suspiciously relevant to them. Investigating, they claim to have found a package called “always on voice,” which uses the TV’s built-in microphone to collect sounds from the room.

The software logged events such as dogs barking and babies crying, log4j said, adding that these events are counted and reported back to Samsung.

Samsung advertises similar features on some of its AI-enabled TVs. The company says its Pet Care and Family Care features use on-device AI to detect a dog barking or a baby crying and alert users. This doesn’t confirm log4j’s claims about the package or the data it reports.

However, log4j says that on TVs without microphones, the software searches for connected devices such as soundbars or Bluetooth microphones and uses those to listen instead.

The TV was also collecting geolocation data and mapping local networks, they said, adding that it ran a service on the TV that analyzes traffic on the local network.

log4j also says that the system uses a neural network tailored to a particular region to analyze your viewing habits. A neural network is a type of machine-learning model. log4j said:

“…in youtube it’s looking for videos you watch, ads you skip, progress in a video, etc.”

The tracking that’s on the record

While log4j’s claims haven’t been independently verified, Samsung has used automatic content recognition (ACR), a system that identifies what’s on screen. Earlier this year, Texas Attorney General Ken Paxton settled with Samsung, getting the company to agree that it would get Texans’ express consent before collecting or processing ACR viewing data.

A class action complaint filed in New York in January also accused Samsung of using ACR to record video and audio passing through the TV. The complaint accused Samsung of using machine-learning algorithms to analyze and link this data back to consumers. This includes information displayed when the TV is used as a computer monitor, it said, adding that the information can be linked to different people using the TV. The case was voluntarily dismissed in July.

The New York complaint added:

“Samsung exploits this Sensitive Information by (a) selling targeted advertisements to its corporate advertising clients, and (b) providing it to third-party advertising companies such as Google and X (f/k/a Twitter) for targeted advertising.”

A separate class action complaint filed in California this month accuses Samsung Electronics America of not being transparent about its ACR data collection.

This isn’t the first time that Samsung has been criticized for allegedly picking up in-room audio. In 2015, privacy group EPIC filed a complaint with the FTC, accusing Samsung of recording conversations and relaying them elsewhere. The nonprofit said at the time:

“Everything a user says in front of the Samsung SmartTV is recorded and transmitted over the internet to a third party regardless of whether it is related to the provision of the service.”

EPIC identified text-to-speech company Nuance as the third party.

What you can do

We can’t confirm all of log4j’s allegations, and Samsung doesn’t appear to have commented. But there have been multiple complaints about the data smart TVs collect. You can turn off features such as ACR, internet-based advertising, and voice recognition where possible.

log4j has also raised concerns about whether monitoring services are truly off. They said:

“ACR off via your preferences menu on samsung TVs should not be assumed to actually disable ACR telemetry.

i’ve found several instances where the checks (whether deliberate or not) are either incorrectly implemented or not checked at all.”

log4j says disconnecting your TV from Wi-Fi is the best option for immediate peace of mind, though that also means losing internet-based TV features. They also suggest using an Apple TV or a modifiable Android TV box with open-source software.

---

Facebook’s Cambridge Analytica scandal may feel like very old news. But the consequences are still arriving, and the latest comes with a $25 billion price tag.

Reuters reports that a New Mexico judge has ordered Meta to pay $25 billion in civil penalties after a jury found that Facebook misled consumers about its data practices and its handling of hate speech and misinformation. Meta says it expects to win on appeal.

This case is about more than information ending up in the wrong hands. It concerns what Facebook told people about who could access their information, how much control users had, and how the company enforced its own rules.

What Facebook told its users

In September, jurors found that the company and its leadership made 26 misleading statements on data privacy, hate speech, and other subjects. For example, Mark Zuckerberg’s 2010 statement that:

“We do not share your personal information with people or services you don’t want.”

That assurance appeared in a statement the jury found misleading. The judge found that choosing who could see a Facebook post did not necessarily control what outside app developers could access. That access was governed by separate settings that many users did not know existed.

New Mexico’s attorney general filed the lawsuit in 2021, following revelations that Cambridge Analytica obtained personal information from as many as 87 million Facebook users through a third-party app.

But New Mexico’s case went beyond Cambridge Analytica.

The state challenged Facebook’s representations to consumers about its data practices and its efforts to address misinformation and hate speech. The case centered on misleading consumers under New Mexico’s Unfair Practices Act, the state’s consumer protection law.

The state argued that third parties had broad access to users’ information and that Facebook tolerated harmful content when doing so benefited its business. Meta disputed the allegations, denied selling users’ information, and said the state had taken statements out of context.

New Mexico’s Department of Justice says the jury found 43,899,725 violations of state law. That does not mean nearly 44 million individual New Mexicans had their data taken. The count reflected the estimated audience for each misleading statement, rather than the number of individual people affected.

State law allows penalties of up to $5,000 per violation. Judge Francis Mathew found that a penalty exceeding $219 billion was warranted under the law but reduced the amount to $25 billion.

The judge said earlier penalties had failed to stop Meta from misleading consumers, including a $5 billion FTC penalty in 2019.

The money is not earmarked for compensation payments to individual Facebook users. According to Attorney General Raúl Torrez, state law directs the penalties to New Mexico’s school system.

Meta’s chief legal officer, C.J. Mahoney, said the company is confident it will prevail on appeal and characterized the lawsuit as an attempt to impose “a tax on speech.” Meta has also argued that a multibillion-dollar penalty risks violating constitutional protections concerning due process and excessive fines.

How to stay safe on social media

The case illustrates why privacy is not just a matter of choosing who can see a post. In a separate 2019 case, the Federal Trade Commission (FTC) alleged that Facebook had shared users’ information with third-party apps used by their friends, even when those users had chosen restrictive privacy settings.

A few precautions can help you limit what you share, although settings alone cannot guarantee privacy:

• Share selectively. Leave optional profile details blank, limit who can see your posts, and avoid publishing sensitive details such as your address or live location. Ask permission before posting information or photos involving other people.
• Check app permissions. Does a social media app really need your contacts, precise location, or entire photo library? Turn off unnecessary access in your device settings.
• Review tracking and advertising settings. Look for controls covering personalized ads, activity outside the platform, and data sharing. Restrict what you can, but don’t assume opting out of personalized ads stops all collection.
• Be selective about connected apps. Before connecting a quiz, game, or other service to your account, check what information it requests. Decline access that seems excessive for what the service does.
• Remember what “private” means. Restricting your audience helps control who sees your posts. It does not stop the platform itself from collecting or using information about your activity.

---

Scammers don’t need to hack you. They just need you to click once. 

Malwarebytes Identity Theft Protection catches suspicious activity before it becomes a problem.

Two Chicago customers say robots delivering their groceries and takeout scanned their faces and hands without consent, stored the data alongside their names and addresses, and used the recordings to train AI.

Their separate lawsuits accuse delivery robot operators Coco Robotics and Serve Robotics of violating Illinois’ biometric privacy law. Both companies dispute the claims.

The plaintiffs filed the cases in the Circuit Court of Cook County, Illinois, alleging that the robots used their cameras along with light detection and ranging (LiDAR) sensors to scan them.

LiDAR uses laser pulses to build a detailed 3D map of a robot’s surroundings. The lawsuits allege that, at close range, these sensors capture facial geometry in enough detail to support facial recognition.

Mitchell Breidinger ordered DoorDash groceries in September 2025. A Coco robot, operated by Coco Robotics, made the delivery. To collect it, he had to stand within about a meter of the robot’s cameras and LiDAR sensor while he entered a PIN code in the DoorDash app, and a Coco remote pilot watched the live video, according to the complaint.

Barry Schain filed a similar complaint against Serve Robotics, which sent one of its robots to deliver his Uber Eats order.

The complaint against Cyan Robotics (the California-based company that does business as Coco Robotics) states that the robots record detailed 360-degree LiDAR data on the urban environments that they navigate. Coco has never said that it blurs, downsamples, or removes human faces or hands from that LiDAR data, the complaint adds.

It also says the company:

“gives no notice before a robot records a person, identifies no specific purpose or retention period for the data, obtains no written release, and has published no retention or destruction schedule.”

Those who are scanned by Coco robots have no account to close with the robotics company and don’t get to choose whether they are served by a robot, the complaint points out.

Cyan uses the data that the robots collect to train its AI, the complaint says, adding that it also has data-sharing partnerships with companies including ChatGPT creator OpenAI.

Schain, who most recently took a delivery from a Serve robot on October 4, makes similar claims in his complaint. The company fulfills food delivery orders for both Grubhub and Uber Eats, it says, noting (unlike the complaint against Cyan) that these robots also collect audio.

Serve Robotics licenses video and LiDAR data to third parties for model training, the complaint says, citing Serve’s own filings with the Securities and Exchange Commission.

Both companies have pushed back, according to reports.

Coco said it has not collected biometric data in Chicago, that the suit “fundamentally misunderstands our technology” and that “the data we share is navigational data used to make sidewalks safer for all users.” It called the case “frivolous.” Coco said that it doesn’t share data from the beginning and end of delivery runs. Serve said that the robot systems are “not designed to identify individuals or create biometric profiles.”

Whether the data the robots capture qualifies as biometric information under BIPA is central to the lawsuits.

Illinois’ biometric law

Illinois’ biometric privacy law gives people the right to sue companies over the unlawful collection and use of their biometric data.

Under that law, biometric identifiers include scans of hand and face geometry. Companies must tell people in writing what biometric information they’re collecting, what they’ll use it for, and how long they’ll keep it. They must also get each person’s written consent and publish a schedule for destroying the data, and they must not sell or otherwise profit from it.

These class action suits were not delivered in a vacuum. Chicago residents had already mounted a petition against the delivery robots, citing collisions, interference with emergency vehicles, and concerns about potential surveillance. More than 4,550 Chicagoans have signed it, the petition says.

Both suits were filed by the same Chicago law firm, Almeida Law Group. Each seeks $1,000 per class member for negligent violations or $5,000 for intentional or reckless ones. Each complaint says its proposed class “includes many thousands of persons.”

---

Browse like no one’s watching. 

Malwarebytes Privacy VPN encrypts your connection and never logs what you do, so the next story you read doesn’t have to feel personal. Try it free → 

Meta says it has resolved an issue after some Ray-Ban Meta owners reported that their glasses recorded conversations without the “Hey Meta” wake phrase.

Users reported finding recordings and transcripts of conversations they did not knowingly save. Recording without anyone realizing raises privacy concerns for both the wearer and the people around them.

The complaints surfaced on Reddit, where one owner described unexpected recordings occurring with three pairs of glasses. The owner said the behavior started after a firmware update and occurred even with Respond without Hey Meta disabled. They also reported that the glasses’ internal notification light sometimes activated during normal conversation. Other commenters described similar unexplained activations.

As Android Authority reports, Meta says the problem has been fixed:

“This issue has been resolved. People can manage, review and delete voice logs of their interactions with Meta AI via settings at any time.”

What’s missing is a public explanation of what caused it, how many people were affected, and what happened to the audio captured.

This isn’t the first time we’ve reported on privacy concerns involving smart glasses. In June, we covered unreleased facial-recognition code found in Meta’s companion app. The code was not active, but the reporting raised concerns about how wearable cameras could eventually move from capturing people to identifying them without their knowledge.

What owners can do

According to the Reddit owner, Meta Support recommended disabling microphone and camera permissions, turning off Wear Detection, deleting voice history, and disabling automatic updates. Those steps would limit much of the gadget’s core functionality without explaining what went wrong.

Until Meta provides a fuller explanation, here are a few precautions that make sense if you wish to keep using your smart glasses:

• Review your voice history. Look for interactions you do not recognize and delete unwanted recordings or transcripts. Meta says users can manage these logs through Settings.
• Check your voice-activation settings. The owner reporting the issue said Respond without Hey Meta was already disabled, so do not treat that setting alone as a guarantee against unintended activation.
• Keep the glasses and companion app updated. Although the user associated the behavior with an update, that is not a good reason to permanently abandon updates that may contain security and privacy fixes.
• Always ask before recording other people. Their privacy matters even when your glasses are working exactly as intended.

Meta still owes users an explanation of what went wrong and what it has done to ensure it won’t happen again.

---

Browse like no one’s watching. 

Malwarebytes Privacy VPN encrypts your connection and never logs what you do, so the next story you read doesn’t have to feel personal. Try it free → 

Photos you take with your phone and some digital cameras can contain hidden information, including where they were taken. You can strip that data out before sharing a photo with someone, which would help to protect your location. But the image itself may still give you away.

A company called Graylark says its Raven AI tool can match an indoor photo to a specific property using visual clues alone. No GPS data or view out of the window required.

We’ve seen this company before. Its tool, GeoSpy, could work out where a photo was taken by analyzing features in the image, such as vegetation, buildings, and other landmarks.

Graylark itself grew out of experiments founder Daniel Heinen and his brothers carried out after reading about using AI to play GeoGuessr, a geography game in which people look at street-level images and try to work out where they were taken.

The company has since taken it further. According to 404 Media, Graylark has renamed the tool as Raven and expanded it to identify indoor locations as well. It uses visual clues in the image, without needing location metadata.

The tool works by matching images against property photos. An image of something as banal as a washer/dryer sitting in a nook can return a list of ranked results. The tool’s Short-Term Rental ID feature can search what Graylark describes as millions of rental listings worldwide, using an interior photo or a frame from a video.

However, the system targets more than just rental properties. Its Find Property feature searches for properties using exterior photos and, now, interior ones in supported cities.

This is more than just reverse image search, which can help you see if the same photo you’re looking at has been used elsewhere. The service can match different views of the same property by identifying features ranging from the shapes of wall tiles to the structure of a room and the color of its surfaces.

Law enforcement is already using the tool, for which founder Daniel Heinen landed $10.7m in seed funding in August. 404 Media said that Miami-Dade Sheriff’s Office and the Los Angeles Police Department bought access to the product.

According to Heinen’s social media posts, Raven can now tell which hotel you stayed in from a single photo. He cited a feature called HotelID that isn’t yet listed on the website. The Raven website also cites other uses. For example, it can tell you a car’s exact make, model, and year from a picture of its interior.

The tool works from identifiers such as email addresses, too. Investigators can find public photos on linked accounts and then use those photos to look for location clues. Graylark says this does not give investigators access to private accounts or messages.

Heinen says the short-term rental feature uses images from millions of rental listings around the world. According to 404 Media, Airbnb said it had no relationship with Graylark, and Zillow said scraping was against its terms of service. Those statements don’t confirm how Graylark obtained its imagery.

Heinen’s ambitions don’t seem to stop here. On September 8, he mentioned that he was experimenting with recent footage from tens of thousands of dashcams.

He has said that this kind of system can help combat human trafficking. A George Mason University study found that in around 80% of federal sex trafficking cases active in 2018 and 2019, victims were exploited at hotels or motels. And perhaps AI can help with unsolved crimes if used properly. Any suggested location still needs to be checked against other evidence.

But technology can also be misused, particularly when it comes to stalking. Heinen said on X that Raven is only available to enterprises, government, and law enforcement agencies. Other websites and consumer apps use the GeoSpy name, but Graylark says third-party products using that name are not operated by or affiliated with the company.

This brings us to what you can do to protect yourself should someone use this kind of tool for nefarious purposes.

How to keep your home more private

Think before publishing interior or exterior pictures of your home online. Even Google Photos can estimate where a photo was taken using landmarks and similarities with your other photos that have known locations, it says.

Check the frame for distinctive features before posting. Look for distinctive tiles, room layouts, views through windows, house numbers, or mail showing your address. Crop these out where practical.

Limit who can see your photos. Review the audience for your social posts and photo albums, including older ones. When traveling, consider waiting until you’ve left before posting recognizable accommodation photos.

Review old property listings. Ask your agent and the relevant property websites whether they can remove interior photos from old listings. Removal cannot recall copies already downloaded or collected. If you’re advertising a rental, use approximate-location settings where available, but remember that the listing photos themselves may still identify the property.

Remove location metadata before sharing. This won’t prevent visual matching, but it removes another way to find where a photo was taken. Don’t assume every service removes it for you.

• Apple users can do this directly on iOS: When sharing from Photos, tap Options and turn off Location.
• Google Photos lets you remove estimated or manually added locations, but not those recorded by your camera. Check location-sharing settings for each album, link, or conversation. Photos downloaded and shared outside Google Photos may still contain the original location data.
• Samsung users can choose to remove location data when sharing from Samsung Gallery, where the option is available.

---

Browse like no one’s watching. 

Malwarebytes Privacy VPN encrypts your connection and never logs what you do, so the next story you read doesn’t have to feel personal. Try it free → 

Norway’s privacy regulator Datatilsynet has fined advertising technology company Xandr 92 million Norwegian kroner, approximately $9.6 million, for unlawfully processing and sharing sensitive information about Grindr users.

While the decision concerns users in Norway, the data-sharing practices were not confined to Norwegian users. BleepingComputer reports that information about Grindr users in other countries was also exposed through the advertising system.

Between July 2018 and April 2020, Xandr handled real-time advertising auctions involving Grindr users. These automated auctions let advertisers bid to display an ad, but also involved circulating information about the person who would see it. Sensitive information revealing sexual orientation could potentially reach thousands of companies.

Crucially, users did not have to disclose their sexual orientation in their profiles. Datatilsynet said that simply being identified as a Grindr user was information that indicated sexual orientation.

According to the regulator, Xandr relied on Grindr to obtain consent without checking whether that consent was valid. As a company jointly responsible for the processing, Xandr had its own obligations. It was not enough to simply assume the app had obtained the explicit consent required.

This was not a case of hackers breaking into a dating app. The information was flowing through an advertising business without a valid legal basis. Privacy group noyb, which filed the complaint in cooperation with the Norwegian Consumer Council, says such systems use tracking identifiers to build profiles of people’s interests, habits, and behavior.

---

---

Although Xandr now belongs to Microsoft, the misconduct predates its acquisition. Microsoft completed its purchase of Xandr from AT&T on June 6, 2022, more than two years after the period covered by the fine. Microsoft told BleepingComputer it was reviewing the decision and assessing its options.

How to protect your privacy

This is a Norwegian enforcement action, but the data-sharing practices crossed borders. Users in the US and elsewhere shouldn’t assume their information stayed private just because the fine was issued in Norway.

You can limit how much additional information you disclose by giving a dating app only what you need to use it.

• Leave optional profile fields blank when the information feels too personal.
• Avoid publishing your workplace, home address, regular schedule, or other details that make you easy to locate.
• Review location permissions and advertising settings and limit them where possible.
• Think carefully before linking social accounts that reveal more of your identity.
• Don’t use dating apps on company-issued devices.

These precautions cannot guarantee privacy. Responsibility for unlawful sharing lies with the companies involved. This case shows that sensitive information can come from using the service itself, not just from what you write in your bio.

---

Scammers don’t need to hack you. They just need you to click once. 

Malwarebytes Identity Theft Protection catches suspicious activity before it becomes a problem.

Amazon’s “About You” page reveals what it thinks it knows about you—and you can’t simply switch it off.

Dexerto reports that one shopper discovered her profile included the observation:

“has flat buttocks”

She suggested this might relate to a previous purchase of “butt scrunch leggings.” Whatever the connection, buying clothes doesn’t mean you expect the retailer to start describing your body.

What is Amazon’s About You?

About You is a page where customers can review and edit the personal details Amazon uses to shape their shopping recommendations. Amazon introduced it in May as a way to make personalization more visible and easier to manage.

According to Amazon, the information behind its personalized shopping experience includes:

• Your purchase history
• Your searches
• Items saved to Lists
• Product reviews you have written
• Conversations with Alexa for Shopping

The resulting profile can contain categories such as “Home and Family,” “Interests and Hobbies,” “Brands,” and “Product Preferences.” Some entries describe straightforward shopping preferences. Others go further, making assumptions about how people live.

Amazon presents this as helpful. If you regularly buy non-dairy milk, for example, it might recommend other non-dairy products. But a useful recommendation and an accurate description of a person are not the same thing.

After all, a purchase might be a gift. An item on a list might be something you’re researching for someone else. A product search might reflect curiosity rather than a personal need.

Amazon has offered personalized recommendations for years. About You makes some of the information behind them visible and gives you a chance to see where its assumptions miss the mark.

How to find your information

To check what Amazon thinks it knows about you, log in to your Amazon account.

• Hover over your name above Account & Lists, near the top-right corner.
• Select Account.
• Find the tile Ordering and shopping preferences, and select Your Shopping preferences.
• From there, scroll to the bottom of the page and select Manage your information.

In the Amazon app, it works like this:

• After logging in, tap You at the bottom
• Tap Account > Account Settings > Shopping preferences > About You

Managing your information

To remove an entry:

• Select a category to see what Amazon has listed about you, either because you volunteered it or Amazon assumed it based on your buying behavior.
• Select Remove. You don’t need to select a reason. Select Remove again in the confirmation prompt.

Buying something should not be treated as volunteering every personal detail a retailer can infer from it. It’s good that these assumptions are visible and that you can remove them, but customers shouldn’t have to correct a profile they never deliberately filled out.

A meaningful privacy choice would let customers decline personal inferences, not merely delete them one at a time. It would also explain what deletion does. Is the information removed from Amazon’s servers or just moved out of your sight?

Amazon says you can remove information you don’t want used for personalization. Its announcement does not explain whether that also deletes the underlying data, or whether similar assumptions could be made again as you continue shopping. Nor does it describe a master opt-out from About You.

For now, checking your profile lets you see (and challenge) some of the conclusions Amazon has drawn about you.

---

Browse like no one’s watching. 

Malwarebytes Privacy VPN encrypts your connection and never logs what you do, so the next story you read doesn’t have to feel personal. Try it free → 

If you thought that having companies trawling your social media, browsing history, and TV habits for behavioral clues was bad, sit tight. Meta is just getting started. Its Muse personal AI agent is taking surveillance to the next level.

TIME magazine analyzed the software’s internal instructions and found that it maintains constantly updated dossiers on users and the people they know.

Meta released Muse last month, positioning it as a digital assistant that can handle different parts of your life. It can organize your emails, handle your grocery shopping, and cancel your subscriptions. It is available for free, with paid plans for people who want to do more.

Muse has already been downloaded more than five million times. Its ability to handle mundane online tasks could be bad news for businesses that rely on consumers not canceling their subscriptions. Some people think it will liberate thousands of consumers from low-interest bank accounts.

But Muse won’t just help you stick it to the man; it also is the man.

Have I got some bad Muse for you

You have to let Muse access all your systems before it can help organize them for you. Depending on what you connect and the permissions you grant, that can give it access to your calendar, emails, messages, and other personal information.

In doing so, it accesses data. Lots of it. An analysis by Surfshark late last month put it second only to Meta’s AI chatbot among the apps reviewed, with its App Store disclosures listing collection of 31 of 35 data types.

Those disclosures include Apple’s “Sensitive Info” category, which covers information such as racial or ethnic data, sexual orientation, pregnancy, disability, religious or philosophical beliefs, trade union membership, political opinion, genetic information, and biometric data. That doesn’t mean Muse collects every one of those details about every user, but it does show how broad its declared collection can be.

According to TIME’s analysis, Muse’s instructions call for it to refresh personal dossiers every hour. These can record how users met their contacts, along with arguments or tensions within social groups.

Somehow even creepier than that is its nightly review of your recent conversations, which it uses to guide future conversations. For example, it learns when a quick nudge for your attention will be most successful.

Meta uses Muse interactions to train its AI models by default, unless you opt out in the app’s settings.

Oh, and Muse stores these files in Meta’s cloud, where Meta can access them. The company says it will offer encryption that keeps them private even from Meta, but that option isn’t available yet, according to TIME.

Meta says Muse’s conversations and stored data are not shared with its advertising systems. It also says users choose how much access Muse gets and can tell it to forget specific things it has learned.

The magazine points out that simply not using Muse might not save you, because Muse can collect data on people that its users interact with. If you send a Muse user a message and the AI has access to that messaging system, your message can become part of what it reads.

Privacy nonprofit the Electronic Privacy Information Center (EPIC) points out that Meta has pulled a similar trick before, by building shadow profiles of people who aren’t signed up for its services.

When permissions become real-world harm

This would be scary enough were it not for other stories about Muse privacy invasions. Researcher Patrick Wardle found a way to compromise the software and turn it into a Mac backdoor.

Another team of reporters used it to compile personal details for members of vulnerable groups online. After first declining some of these requests, it capitulated when the prompts were reworded, they said.

Muse also invited a Marketplace buyer to someone’s home last month after accepting a lowball offer on a product that he was selling. Matt Robb, a YouTube tech reviewer, had clicked an “Allow Always” button, assuming that the AI would still ask before sharing his address with strangers. It didn’t. Instead, he said, it arranged the pickup without telling him. The buyer, who traveled half an hour to pick up the product, was not pleased.

If you use Muse, review the accounts it can access, the actions it can take without approval, and whether your interactions are being used for AI training. Give it only the access it needs for the task.

Would you use Muse? For more on Robb’s story and practical permission checks, read our guide to using AI assistants.

---

Browse like no one’s watching. 

Malwarebytes Privacy VPN encrypts your connection and never logs what you do, so the next story you read doesn’t have to feel personal. Try it free → 

Automated license plate readers (ALPRs) are cameras that photograph passing vehicles, read their number plates, and typically log the time, location, and vehicle details. On their own, the images might be used to find a stolen car or locate a suspect.

But lately there have been a lot of concerns raised about the way they are used. The main worry is caused by what happens when many cameras feed data into a shared, searchable network: it can create a detailed record of where ordinary people travel.

Some agencies have already taken it upon themselves to act on these concerns, as well as those around inaccuracy. Data errors can have serious consequences. At a recent Senate hearing, Florida resident Lindsey Isaacs described being arrested and held for 13 days after data from an AI-enabled plate-reader system incorrectly implicated her in a fatal car crash.

As a result of all this, US lawmakers from both major political parties have introduced proposals aimed at restricting automatic license plate reader networks.

Most of the reasons brought up are about Flock Safety, one of the largest suppliers of these systems in the United States, but they would apply more broadly to other ALPR vendors as well.

Flock says it deploys only 120,000 cameras operating across the country, while a researcher cited by the Senate described a much larger network of connected devices and cameras. The exact size may be disputed, but the central concern is clear: Data from a camera in one location can potentially be searched by an agency elsewhere.

Two different approaches

Reportedly, there are two different proposed laws in the making, while Flock says it supports a legal framework for license-plate readers and argues that the technology can improve public safety when it is used with strong oversight and accountability.

The first proposal, the Stop Flock Abuse Act, doesn’t aim to banish ALPR systems outright, it would create rules for how government agencies and vendors can use them.

Among other measures, the bill would require written approval and a record for every search, regular supervisor audits, encryption, and deletion of most vehicle-location data after ten days. It would also prohibit sharing or selling the data to non-governmental third parties, prevent ALPR networks from incorporating facial-recognition technology, and require data to stay in the US.

A second proposal, the Ban Flock Act, takes a much harder line. It would prohibit US federal agencies from using ALPRs or accessing data they collect. It would also withhold federal grant money from state and local governments that use ALPR systems and allow people to sue the federal government if their rights are violated through ALPR deployment.

Both bills are proposals, not enacted laws. In the US system, each would need to pass both the House of Representatives and the Senate in matching form, then be signed by the President.

Going forward

There is no guarantee either bill will receive a vote, let alone become law. But their introduction shows that ALPR technology is moving from a local procurement issue to a national privacy and civil-liberties debate.

License plate data may seem less sensitive than phone-location data, but a long enough record can reveal a person’s routines, relationships, medical visits, religious activity, or attendance at protests. The debate is therefore not just about cameras on streets to fight crime and find criminals, it is about whether governments and private vendors should be able to build searchable records of everyday movement.

So for consumers, the key question is not only whether a camera is installed on a street or near a business. It is also how long the resulting data is retained, who can search it, whether those searches are logged and reviewed, whether the information can be shared beyond the original agency, and what recourse exists when the system is wrong or abused.

---

Your name, address, and phone number may already be for sale.  

Data brokers collect and sell your personal details to anyone willing to pay. Malwarebytes Personal Data Remover finds them and gets your information removed, then keeps watch so it stays that way. 

The US government is alerting millions of people that their personal information was stolen during a breach of the Pentagon’s personnel records at the Defense Manpower Data Center (DMDC).

The DMDC is a central US Department of Defense (DoD) organization that manages personnel records, ID credentials, and benefit entitlements for military and civilian staff, veterans, and their families. It maintains over 60 million records for US military and civilian staff and their family members to help determine benefits and entitlements, such as healthcare and retirement.

Reportedly, cybercriminals had access from October 2025 to July 2026. CNN reports that the Pentagon confirmed the breach affects 2.76 million living individuals, potentially including current and former defense personnel or their dependents, and 294,000 deceased individuals.

A notification shared on Reddit states:

“A small number of unauthorized users accessed files on a server containing unencrypted PII.”

PII means personally identifiable information. The attackers gained access by exploiting a security vulnerability in an unspecified file-sharing system. The Pentagon says it has “no indication” of misuse. It hasn’t explained how it reached that conclusion or what it considers misuse, and it doesn’t rule out future misuse of the exposed information.

The exposed data is said to include Social Security numbers, names, dates of birth, sex, race, and service details. Some records also include contact information and occupational specialty.

Besides the risk that this data could help foreign intelligence services track US personnel, affected people face a lasting risk of identity theft. Birth dates cannot be changed, and Social Security numbers can only be changed in limited circumstances.

---

---

What to do if you’re affected

The Pentagon is offering 12 months of credit monitoring through IDX. If you receive a notification letter, take up the offer and consider a credit freeze with all three major credit bureaus: Equifax, Experian, and TransUnion. A freeze is free and restricts access to your credit report, helping prevent someone from opening new credit accounts in your name.

Other recommendations are:

• Get an IRS Identity Protection PIN to prevent someone else from filing a federal tax return using your Social Security number.
• Be suspicious of unexpected calls, emails, and texts, especially ones that mention your unit, rank, or job. Attackers can use the stolen details to make phishing attempts more convincing.
• Verify requests through official channels you look up yourself, rather than through contact details in the message.
• Use unique passwords and multi-factor authentication on email, banking, and benefits accounts.
• Limit location sharing and review privacy settings on phones and apps, since military leaders have raised concerns about commercial location data being used to target personnel.
• Follow instructions in the breach letter and further official communications and report any suspicious approach to your security officer.

---

Let’s face it, an incognito window can only do so much. 
 
Breaches, dark web trading, credit fraud. Malwarebytes Identity Theft Protection monitors for all of it, alerts you fast, and comes with identity theft insurance. 

A study testing 21 cars from 19 brands and 30 companion apps found connections to advertising and tracking companies, and evidence that some apps shared sensitive personal data.

Modern cars can unlock remotely, route around traffic, stream entertainment, summon roadside help, and cool or heat the cabin before you get in. But those conveniences come with a privacy cost that drivers may struggle to see and are unable to refuse.

We’ve covered cars and privacy a few times before, especially after Mozilla researchers described cars as a “privacy nightmare.”

Texas Attorney General Ken Paxton investigated car manufacturers seeking details of their data collection and sharing practices, and sued General Motors over allegations that it sold customer driving data to third parties.

Researchers from Northeastern University, working with Consumer Reports, tested vehicles from model years 2022 through 2025 and companion apps, observing network traffic while cars were stationary, driven, and used through their apps. The results reinforce an uncomfortable reality: connected vehicles are data-collection platforms on wheels.

The results in a nutshell:

• Both vehicles and companion apps contacted third-party domains, including those associated with advertising and tracking.
• 19 of 21 vehicles contacted at least one third party over Wi-Fi.
• 7 of 30 apps transmitted sensitive identifiers to third parties associated with advertising and tracking.

The troubling part is not that a car talks to its manufacturer. After all, a connected vehicle needs some network access for safety alerts, navigation, account functions, and maintenance. The bigger issue is the potential combination of identifiers. A vehicle identification number (VIN) can link a particular vehicle to its owner, while precise location can reveal highly sensitive patterns: where someone sleeps, works, worships, seeks medical care, spends time with friends, or travels. Add an email address or a name, and that information can be easier to connect to the detailed consumer profiles held by advertisers and data brokers.

And that’s before considering the privacy concerns around cameras that monitor drivers’ faces for signs of distraction or impairment.

Consent with strings attached

Consent is a weak safeguard when drivers have to accept extensive terms to use functions advertised as part of the vehicle. Several manufacturers said their connected services were opt-in, but declining can mean losing useful functionality. For example, Consumer Reports noted a Tesla warning that refusing its agreement may result in:

“reduced functionality, serious damage, or inoperability.”

That hardly sounds like freely given, informed consent.

There was one sign that scrutiny can matter: after researchers presented their findings, Honda told Consumer Reports it had directed vendor Amplitude to delete location data it received and stopped sending it going forward. But consumers should not need an academic study to discover who their car or its app is sharing data with.

Especially when Amazon, Google, Meta, and Microsoft—companies that already know plenty about us—were among the leading recipients of the driver data.

Until automakers collect less data and provide clear privacy settings, meaningful opt-outs, and deletion controls, drivers should treat a connected car, and especially its companion app, as another privacy-sensitive device. Review app permissions, turn off optional data-sharing settings, avoid linking unnecessary accounts, and ask manufacturers what data they retain, share, and delete.

---

Browse like no one’s watching. 

Malwarebytes Privacy VPN encrypts your connection and never logs what you do, so the next story you read doesn’t have to feel personal. Try it free → 

The Irish Data Protection Commission (DPC) has fined Google €403 million ($459 million) for violating European privacy law. The penalty follows a six-year inquiry into Google’s management of user location data between May 2018 and February 2020.

During that time, Google collected users’ location data without making clear that it could be used to infer their interests and shape the ads they saw.

Google’s location history keeps track of users’ locations when using their devices. It’s an opt-in service that includes a Timeline feature to display a private map of the places they’ve visited. A separate Android feature, Location Accuracy, helps devices determine their location more accurately than GPS alone.

Google had told users that they could stop Location History tracking by turning off that setting. But a report by the Associated Press in 2018 found that doing so wasn’t enough to stop Google from saving some of that location data. Researchers at Princeton University later confirmed the AP’s findings.

One reason was Web & App Activity, a separate Google account setting that can save information about what Google account holders have been browsing on the web and doing with their apps. That service was also collecting location data. Turning off Location History did not turn off Web & App Activity.

This issue led to payouts in multiple US jurisdictions. Google agreed to pay $85 million to Arizona in October 2022, $392 million to 40 states that November, and $9.5 million to the District of Columbia the following month. It also agreed to pay $39.9 million to Washington State in 2023, $1.38 billion to Texas in May 2025 as part of a two-suit settlement. Last September, a jury awarded $425 million in a separate class action case.

The DPC first looked into the issue in 2018 after the AP investigation and launched an official statutory inquiry in February 2020. Along with the fine, it has ordered Google to bring its location data processing into compliance within six months. The DPC says it will publish the full text of its decision in due course.

Google told Bloomberg that it had revised its practices since 2019 and launched tools to make location data easier to manage. In December 2023, Google announced that it would change its Timeline feature to keep its data on users’ devices. It also said that, for people turning on Location History for the first time, the default period before data is automatically deleted would fall from 18 months to 3 months.

This isn’t the only Google-related investigation that the DPC has launched. It launched one on Google’s processing of EU residents’ data for its AI model two years ago, and another related to the processing of personal data for its online Ad Exchange in 2019.

Check your Google location settings

Turning off Timeline doesn’t stop Google from saving location information through other settings. Check Web & App Activity and, if you see it, Search Services History too.

You can turn these settings off and delete activity already saved to your account.

---

Browse like no one’s watching. 

Malwarebytes Privacy VPN encrypts your connection and never logs what you do, so the next story you read doesn’t have to feel personal. Try it free → 

Apart from the privacy concerns around smart glasses, researchers have found that some cheap brands come with barely any security at all.

ABC Australia reports that researchers from NSB Cyber and Abstract Shield tested two inexpensive pairs, costing A$60 and A$110 (around US$42 and US$78), and found more than a dozen flaws across the smart glasses themselves, their app, and an associated website.

The main problem they uncovered was insecure Bluetooth pairing: If the glasses were powered on and not connected to their owner’s phone, an attacker could connect first, with no password or meaningful pairing confirmation.

After connecting, an attacker could reportedly control the glasses to capture photos or recordings, copy existing media, and intercept data moving between the glasses and the phone. An attacker could also make another device appear to be the victim’s glasses, allowing it to connect to the owner’s mobile app.

The testing also found that a Bluetooth-visible device identifier could allegedly be used with a weakness in the app’s website to retrieve a user’s email address and date of birth.

The research uncovered another privacy issue. ABC reports that voice or text submitted to the built-in AI, along with images sent to it, was first transmitted to a server in Shenzhen and could be forwarded elsewhere, depending on the function. The tests did not establish how the data was subsequently used.

The server locations, combined with some of the AI’s answers to specific questions, led researchers to conclude that the chatbot companion relied at least in part on Chinese sovereign AI models. Professor Kimberlee Weatherall, a technology regulation expert involved in the testing, said the failure to identify China in the privacy policy appeared to violate the Australian Privacy Principles,

The timing of the testing is also relevant because Australia’s smart-device security standards apply to most consumer smart devices manufactured on or after March 4, 2026. They require, among other measures, no universal default passwords, a way to report vulnerabilities, and information about the minimum security-update period. Devices made before that date are outside the requirements.

Experts quoted by ABC said the devices violated Australia’s privacy laws and were also likely to breach several sections of the Cyber Security Act. However, whether the new smart-device standards apply would depend partly on when the glasses were manufactured, and the rules have not yet been tested in a known enforcement action.

Professor Weatherall said:

“The rules say that the password must be unique. It doesn’t even seem like they were applying a password, which might mean that their standards are so low they don’t even technically breach that rule, which I find amazing.”

What to do

We’re not fans of smart glasses, expensive or cheap. But if you own a pair:

• Avoid pairing or using inexpensive camera glasses that lack a clear physical pairing step, account authentication, a published security-contact process, and a stated update-support period.
• Stop using their AI or cloud features for sensitive material, remove unnecessary permissions from the companion app, check for firmware and app updates, and consider returning the product if the vendor cannot document a fix.
• Ask permission before recording people, and check your local laws to understand what is and isn’t allowed.

---

From reporting threats to removing them.

Cybersecurity risks should never spread beyond a headline. Keep threats off your devices by downloading Malwarebytes today.

Flock Safety’s cameras are automated license plate readers (ALPRs) designed to help police find stolen cars or wanted suspects.

A joint investigation by 404 Media and WIRED, based on data recovered from a physically removed Flock camera, found that its on-device software explicitly detects people as well as vehicles, bicycles, and license plates.

Separately, Washington DC’s police union says the Metropolitan Police Department used Flock data to track officers under Internal Affairs investigation without their knowledge.

Together, these reports illustrate a privacy problem: A network built to record the movements of vehicles can readily be used to follow almost anyone.

The latest reporting adds an important technical detail to that debate.

What Flock cameras collect

A group of hackers reportedly removed a Flock camera from a roadway, copied its storage, and recovered an encryption key stored on the device. That allowed them to unlock videos of thousands of vehicle detections despite Flock’s claim that its devices are protected by on-device encryption. Flock said it could not assess the claims without more detail.

The recovered camera files reportedly contained software models that detect people, even though public discussion of Flock has usually focused on cars and license plates. The researchers found no evidence that face-recognition features were actively used. Reassuring, but it should not be mistaken for a clean privacy bill of health.

Even without facial recognition, a system that records repeated sightings can potentially reveal sensitive patterns of movement, including where someone lives, works, worships, seeks healthcare, attends protests, visits family, or spends time with other people. When a person is matched to a vehicle, vehicle-based tracking can become person-based tracking in practice.

As an example of how widely the data can be shared, WIRED found that records from the city of Alpharetta, Georgia:

“were accessible to more than 2,000 agencies, including police departments, colleges, airports, and, inexplicably, the Office of Inspector General for the federal General Services Administration.”

Targeted tracking of people

The Washington DC dispute shows what happens when the power to follow people is turned inward.

The DC Police Union says it learned in July that MPD’s Internal Affairs investigators had used Flock license-plate-reader data to track sworn officers under investigation without their knowledge. The union filed a complaint and asked the department to stop, arguing that MPD lacked adequate controls for a system with such extensive surveillance capabilities.

MPD defended the use, saying its position is that the use of license-plate-reader data in the misconduct investigation was appropriate. It said the labor dispute is headed to arbitration.

If police officers themselves are concerned that the system can be used to monitor them without transparent rules, the public should ask an obvious follow-up question: What prevents the same tools from being used to follow residents, employees, journalists, activists, former partners, or other people with no meaningful ability to challenge the search?

Even when Flock wants privacy to meet surveillance halfway, its measures do not eliminate the underlying civil-liberties issue.

The recovered camera software and the DC dispute make the same point from different directions. Flock’s network is not merely a collection of roadside plate readers. It is a distributed system for recording movement, identifying patterns, and making those records available for search.

Meaningful safeguards should include:

• Public approval before cameras are deployed, with clear maps showing their locations and stated purposes.
• Strict limits on collection, retention, searches, and cross-jurisdictional sharing.
• A requirement for documented investigative justification before a search, with elevated approval for sensitive investigations.
• Independently reviewable audit logs, regular public transparency reports, and meaningful penalties for misuse.
• Clear bans on searches related to protected activity, immigration enforcement where local law forbids cooperation, abortion-related investigations, political surveillance, and personal purposes.
• Independent security assessments covering the cameras, cloud services, identity controls, key management, and third-party integrations.
• Automatic deletion that cannot be overridden merely because data could someday be useful.

Privacy cannot depend on authorized users always following rules, vendors configuring every setting correctly, or abuses being discovered the hard way. The first safeguard should be limiting the system’s ability to build a searchable record of ordinary people’s lives at all.

---

Browse like no one’s watching. 

Malwarebytes Privacy VPN encrypts your connection and never logs what you do, so the next story you read doesn’t have to feel personal. Try it free → 

The Manhattan District Attorney’s Office has seized the domains of 12 deepfake websites in what it called the largest known seizure of celebrity deepfake sites in history.

The sites, which marketed themselves as deepfake pornography platforms, hosted AI-generated videos of over 1,200 people, including those in the public eye, ranging from politicians to actors, musicians, and social justice advocates. At least one allowed users to create their own deepfakes by grafting real faces and bodies onto sexual imagery.

The term non-consensual intimate imagery (NCII) is increasingly used instead of pornography when the person depicted has not given permission. Deepfake NCII is growing, due in part to the ease with which it can be created. It only takes one photo to generate it, as we discussed on the Lock and Code podcast in June.

MrDeepFakes was previously the largest site for this kind of content. Its operators shut it down in May 2025, citing data loss. An Australian man who posted explicit deepfakes to the site was arrested, fined for contempt of court, and charged with publishing obscene material.

But other deepfake NCII sites continue to compete for attention online.

Deepfake technology can cause real harm when misused, and its effects continue to spread. Manhattan District Attorney Alvin Bragg warned that domestic abusers are threatening to release deepfake NCII depicting their victims. The FBI has also warned that sextortion attackers are using AI to turn social media photos of minors into sexually explicit images.

Legal action is growing

Law enforcement has been working hard to stem the flood of deepfake NCII sites. In June, the Department of Justice and the Department of Homeland Security seized two domains hosting hundreds of thousands of forged images and videos. San Francisco City Attorney David Chiu’s office also sued 16 deepfake sites in August 2024, managing to get ten of them taken offline or made inaccessible in California. New York state also passed legislation prohibiting the distribution of intimate deepfake images and videos in 2023.

At the federal level, the TAKE IT DOWN Act, enacted in May 2025, made certain intentional publication of NCII, including sexual deepfakes, a federal crime.

Seizing a deepfake site stops the immediate distribution of its content, but operators can migrate quickly to other infrastructure. A report from the Institute for Strategic Dialogue (ISD) found that the deepfake ecosystem is made of many parts, from AI tool providers through to hosting companies and cryptocurrency payment processors. It called for a multi-sector collaboration to stop the production and spread of this material.

Bragg’s office said it will continue monitoring the seized websites to stop them reappearing under different domains.

What can you do?

If someone creates or threatens to share intimate deepfakes of you, save the evidence and report it to the police. Do not pay someone who threatens to publish the images, as payment does not guarantee that the threats will stop.

Bragg’s office said many of the victims it approached did not realize that action could be taken. It urged anyone affected by the seized websites to contact its Cyber Crime Bureau at 212-335-9600.

You can learn more in the Malwarebytes guide to deepfakes. UN Women also provides useful resources for people affected by AI-powered abuse.

---

Scammers don’t need to hack you. They just need you to click once. 

Malwarebytes Identity Theft Protection catches suspicious activity before it becomes a problem.

If you’re still OK with posting pictures of your kids on social media, take a minute to hear from mother of two Kalie Robins. At the start of September, she did something that hundreds of thousands of parents do every day. She posted a video of her young daughter on Facebook.

Under the video of Robins and her daughter singing in a car, Facebook’s Meta AI system displayed a suggested question: “Who is the child passenger?”

Robins was shocked that Facebook would ask this question about a minor, so curiosity prompted her to click it. That’s when a flood of automated stalker-type behavior began.

In Instagram post, an enraged Robins described what happened:

“It starts pulling completely separate information for each of my kids.”

That included names, birth dates, and videos of them.

The site also pulled up a picture of her newborn daughter that Robins’ mother had posted on Facebook years ago, along with a long-deleted picture that Robins said had once been in her own account.

Things got weirder. The site then presented another question: “Where does Kalie Robins live?”

An increasingly outraged Robins clicked that question. She described the results:

“[Facebook] started digging through completely unrelated sh*t from years of my life.”

It dug through old posts that hinted at where she had lived in the past and newer posts that connected her to her current home. It finished by attempting to pinpoint her location.

Robins complained:

“I didn’t ask Facebook to build a profile of my family.”

She expressed shock that Facebook would piece together snippets of personal information from historical posts and package them into a detailed profile for other users.

You can watch Kalie Robins’ Instagram video here:

.kadence-column465357_a378ee-2f > .kt-inside-inner-col{display:flex;}.kadence-column465357_a378ee-2f{max-width:558px;margin-left:auto;margin-right:auto;}.wp-block-kadence-column.kb-section-dir-horizontal:not(.kb-section-md-dir-vertical)>.kt-inside-inner-col>.kadence-column465357_a378ee-2f{-webkit-flex:0 1 558px;flex:0 1 558px;max-width:unset;margin-left:unset;margin-right:unset;}.kadence-column465357_a378ee-2f > .kt-inside-inner-col,.kadence-column465357_a378ee-2f > .kt-inside-inner-col:before{border-top-left-radius:0px;border-top-right-radius:0px;border-bottom-right-radius:0px;border-bottom-left-radius:0px;}.kadence-column465357_a378ee-2f > .kt-inside-inner-col{column-gap:var(--global-kb-gap-sm, 1rem);}.kadence-column465357_a378ee-2f > .kt-inside-inner-col{flex-direction:column;align-items:center;}.kadence-column465357_a378ee-2f > .kt-inside-inner-col > .kb-image-is-ratio-size{align-self:stretch;}.kadence-column465357_a378ee-2f > .kt-inside-inner-col > .wp-block-kadence-advancedgallery{align-self:stretch;}.kadence-column465357_a378ee-2f > .kt-inside-inner-col > .aligncenter{width:100%;}.kadence-column465357_a378ee-2f > .kt-inside-inner-col:before{opacity:0.3;}.kadence-column465357_a378ee-2f{position:relative;}@media all and (min-width: 1025px){.wp-block-kadence-column.kb-section-dir-horizontal>.kt-inside-inner-col>.kadence-column465357_a378ee-2f{-webkit-flex:0 1 558px;flex:0 1 558px;max-width:unset;margin-left:unset;margin-right:unset;}}@media all and (max-width: 1024px){.kadence-column465357_a378ee-2f > .kt-inside-inner-col{flex-direction:column;justify-content:center;align-items:center;}}@media all and (max-width: 767px){.wp-block-kadence-column.kb-section-sm-dir-vertical:not(.kb-section-sm-dir-horizontal):not(.kb-section-sm-dir-specificity)>.kt-inside-inner-col>.kadence-column465357_a378ee-2f{max-width:558px;-webkit-flex:1;flex:1;margin-left:auto;margin-right:auto;}.kadence-column465357_a378ee-2f > .kt-inside-inner-col{flex-direction:column;justify-content:center;align-items:center;}}

Meta’s response

Meta launched Meta AI in April 2024 and has since built it into Facebook, Instagram, WhatsApp, and Messenger. It operates across Facebook, Instagram, and WhatsApp. The assistant can answer questions, generate images, and help users create or retrieve information.

Meta admitted in a statement to the Verge:

“The feature never should have prompted the individual with questions like that.”

The company said the feature had “missed the mark” and that it had fixed the issue that caused Meta AI to suggest questions about personal topics.

In a classic “yes, but” non-apology, a Meta spokesperson also pointed out that the AI only surfaced information drawn from posts the person asking could already access. Although that doesn’t seem to explain why it reportedly surfaced a photo she had deleted years ago.

A pattern of Meta AI failures

Meta AI hasn’t always respected privacy. In June last year, we reported that users were publicly sharing conversations, often without realizing it. A separate bug we reported the following month could have allowed people to view other users’ private Meta AI chats by simply guessing their IDs. Late last year, Meta also started targeting people with ads based on their Meta AI conversations.

What can users do?

Parents get understandably irate when they discover just how much sites like Facebook can learn about their kids. While Robins regularly posted pictures and videos of her children, she had no idea that the service could aggregate information from years of posts to profile them. She’s not alone.

So what can people do about it? Perhaps the better question is: What should people not do? The clearest answer is not to post identifiable pictures of your kids (or other people’s) on social media. Not just to stop them being tracked in a privacy hellscape, but also to reduce the risk of even darker outcomes.

Robins described what she planned to do next:

“I’m done. I’m removing any identifiable pictures and videos of our kids.”

She added that she’ll ask her friends to do the same because, if they don’t, Facebook would still be able to harvest her children’s pictures from their accounts and use them in the profiles it builds.

---

From reporting threats to removing them.

Cybersecurity risks should never spread beyond a headline. Keep threats off your devices by downloading Malwarebytes today.