There is one exception. It’s a single file the law gives you the right to pull, read, and correct. But almost nobody does. That’s because few people know it even exists. This post is about how the trail gets built and how to use the one real piece of leverage you have.

One caveat before we start. Everything here runs on US law, so it is written mainly for readers in the United States.

Subscribe now

The Inspection You Paid For Doesn’t Stay Yours

When you hire a home inspector, you are paying for a confidential, room-by-room analysis of the most expensive thing you will ever own. Roof age. Foundation cracks. The outdated electrical panel that might be a fire risk. You paid for it to know what you were buying. You probably assumed it stayed between you, the inspector, and your agent.

The software that inspectors use is being consolidated fast. Spectora, the largest home inspection platform in North America, is owned by a private equity firm called Radian Capital. In April 2025 it bought HomeGauge, its main legacy competitor, and put it under the same roof. Between them, that company now sits behind roughly one of every three home inspections in the United States.

If you read Spectora’s actual privacy policy, the reuse of your inspection data is spelled out. The company reserves the right to use de-identified information in aggregate form to train, in its own words, “systems that use artificial intelligence or machine learning,” and it says that can include information about the home inspection itself. Other clauses let your data change hands in a sale or bankruptcy. HomeGauge’s policy adds that even if you ask them to delete your data, they may keep and keep using the de-identified version.

Share

The Trail You Can’t See

When you start to dig into it, you discover that a lot of the data about your home is outside your control.

File a claim and it goes into national databases that insurers share. Pull a permit and it becomes a public record that data vendors resell. Bit by bit your home ends up with a risk profile held by companies you have never heard of, one they assemble, trade, and use to price you, all authorized by a privacy policy you clicked years ago.

This is where United States law leaves you with very little recourse. Most of the world’s stronger privacy regimes are built on a principle called purpose limitation, the idea that data collected for one reason cannot be freely reused for an unrelated one. American law mostly does not work that way.

As long as a use is disclosed somewhere in a policy, it is generally allowed, whether or not you ever read it or imagined the future use case. So the data gets reused in whatever ways the policy allows, and you are never told what it is used to decide.

What the Viral Version Gets Wrong

You may have seen a version of this story going around on social media, claiming your home inspection report is already being sold straight to your insurer to raise your premium. I went looking and found no evidence of that. The more likely dynamic is less direct and harder to spot.

Nobody has to actually sell your individual report for it to impact your premium. Pooled with millions of others and stripped of your name, your property and claims data trains the risk models and feeds the databases insurers price from. Your house helps set the rate for houses like yours, in places like yours. The cost still lands on your bill, but it arrives filtered through the rate for your whole risk class rather than through a file with your name on it.

In other words, insurance companies can now get to the same outcome whehter they use your specific, identifiable data or aggregated data using ultra sophisticated risk models.

The One File You’re Allowed to Open

There is some good news in all of this. Some of the records about your home are regulated as consumer reports under the Fair Credit Reporting Act, the same legal category as your credit report. That comparison is the easiest way to understand what this is.

Your home effectively has its own credit report.

But instead of tracking how you borrow and repay, it tracks your claims history, insurers pull it to decide whether to cover you and at what price, and because the law treats it as a consumer report, you have the right to see it, dispute it, and be told when it is used against you. You can pull it today.

You cannot see most of your home’s data trail, and you cannot reach it. This file is the exception. And it is worth knowing exactly how to use it.

Read more

If you or someone in your family owns one of those cheap Android streaming boxes, there’s a decent chance it has been routing other people’s internet traffic through your home connection without your knowledge. These are the $25 or $30 devices on Amazon that promise free access to every sports league and every streaming platform for a one-time fee. But before you shrug this off because you don’t own one of these devices, mainstream TVs are at risk too, so be sure to read to the end.

Subscribe now

Last week, Krebs on Security published an investigation tracing the problem to a company that trades on the NASDAQ, meaning this isn’t some shadowy criminal operation running out of a basement. It’s a publicly listed business with shareholders and quarterly earnings. Researchers linked millions of compromised TV boxes to the NASDAQ traded company’s proxy network. The company disputes the characterization. The researchers stand by their findings.

What this kind of operation does, in plain terms, is turn your home internet connection into a commercial product. Someone pays for access to a residential IP address in your city. Their traffic gets routed through your box. To whoever is on the receiving end, the request looks like it came from your house.

Requests via a residential proxy look like they’re coming from a real household, not a data center, which is what makes them valuable. The customers using these aren’t always doing benign things, and your address ends up in those logs. The FBI’s March advisory on residential proxy networks lists the known use cases:

• Ad fraud

• Account takeovers

• Bypassing fraud detection systems

• Accessing illicit marketplaces

This isn’t only pre-loaded on hardware. Researchers found the software embedded inside free streaming apps as a hidden add-on called an SDK running quietly in the background. Apps with names like CRICFy, DooFlix, RTS TV, and CyberFlix are the kind of thing someone installs on an Android box to watch rugby or a soccer match.

After you install the app, the SDK runs in the background. Once your box joins the network, the proxy keeps running after you close the app. And so long as the app is installed, the connection never ends.

Share

What the Legal Risk Actually Looks Like

The FBI’s advisory states that once a device is compromised, your IP address:

“can be used by threat actors to mask their online illegal activity, making the consumer appear responsible.”

Does that mean you’re at risk of legal liability if your streaming box is used by a third party for illegal activity?

Federal criminal charges require proving intent, and courts have been skeptical of IP-address-only evidence for a long time. A 2012 ruling out of the Eastern District of New York held that an IP address is no more conclusive than a telephone number. It tells you where a connection came from, not who made it. Actual prosecution is therefore unlikely.

The realistic risk is more mundane, but still disruptive to you. Here’s a reasonably likely scenario:

Criminal activity traces back to your address. Law enforcement contacts your ISP. Your ISP flags or terminates your account. Investigators show up or issue a subpoena before they’ve established you were not the actual user. You spend time and energy demonstrating that someone else was using your connection. You’re right, and eventually that gets sorted out. Meanwhile the criminal moved on to someone else’s box weeks earlier.

Riley Kilmer, co-founder of Spur Intelligence (a company that tracks these proxy networks professionally) put it plainly: “If they use your network for illegal activity, there’s a chance that law enforcement could come knocking at your door.” The burden of proving you didn’t do it still lands on you, even when the law technically presumes otherwise.

What to Do If You Own One of These Boxes

Stop using it on your main network. Put it on a guest network at minimum, or unplug it. A factory reset often isn’t enough. If the SDK is in the firmware rather than installed through an app, resetting the device doesn’t touch it. Replace it with a Roku, Apple TV, or Fire TV from a verified retailer if you want a clean start.

And regardless of what’s plugged into your TV, this post walks through privacy settings on every major platform, including what to disable and where to find it:

The Bigger Problem To Worry About For Most

Spur Intelligence scanned 6,038 apps across LG and Samsung’s smart TV platforms and found 2,058 containing residential proxy SDKs. On LG’s webOS, 42.5% of apps carried the code. On Samsung’s Tizen, 26.9%. These aren’t sketchy off-brand devices. They’re the TVs sitting in most living rooms.

Amazon explicitly prohibits apps that facilitate proxy services for third parties in its Device and System Abuse Policy. Roku has reportedly drawn the same line, with affected apps disappearing from the Roku store after the company flagged them. LG and Samsung have done neither. The same business model that Amazon bans and Roku reportedly blocks is running on webOS and Tizen right now, and neither company has published a policy addressing it.

In many cases the proxy company isn’t just supplying the SDK to app developers, it’s publishing the apps itself, shipping dozens of throwaway games, screensavers, and clock apps specifically to have somewhere to put the software. The app is just the vehicle (or a Trojan Horse, if you prefer). Your internet connection is what they’re actually selling.

One Pac-Man game on Samsung TVs makes the arrangement explicit at install: watch ads, or let the app use your TV’s connection for “web indexing.” That’s industry language for routing other people’s internet traffic through your home connection. And that’s the consent model LG and Samsung are apparently comfortable with.

If you have an LG or Samsung TV, the most practical step right now is to audit what’s installed and remove anything you didn’t deliberately add. That includes screensavers, clock apps, casual games, and anything that promises to be ad-free.

The no-name Android box problem has a fix. The brand-name TV problem is still waiting for the platforms to take action and crack down on this type of hidden practice.

Subscribe now

Looking for help with a privacy issue or privacy concern? Chances are we’ve covered it already or will soon. Follow us on X and LinkedIn for updates on this topic and other internet privacy related topics.

Disclaimer: None of the above is to be deemed legal advice of any kind. These are *opinions* written by a privacy and tech attorney with years of working for, with and against Big Tech and Big Data. And this post is for informational purposes only and is not intended for use in furtherance of any unlawful activity. This post may also contain affiliate links, which means that at no additional cost to you, we earn a commission if you click through and make a purchase.

• Know your doxxing risk. DoxxScore gives you a personalized exposure assessment and action plan in under 5 minutes. Get Your Risk Score →

• Check out our new, free username generator to help you create unique usernames for different accounts. Reusing usernames is convenient, but terrible for your privacy. This tool makes it easy to create unique usernames on the fly.

  Share Secrets of Privacy

Waze is built around something Google Maps doesn’t do at all. Other Waze users can watch your car move across the map in real time, see your username, and read the traffic reports you send as you drive. The entire feature set depends on that kind of sharing, not just sharing with Google.

Google Maps mostly collects information about you and keeps it, or shares it with Google’s ad business. Waze does that too, since it’s owned by Google and runs on much of the same infrastructure. But Waze adds a second layer on top of that, a live social map where other people can see where you are while you’re driving.

So the privacy question for Waze is a little different. There’s what Google collects, which mirrors most of what I covered in the Google Maps piece. And there’s what other Waze users can see about you, which is a separate setting most people never touch because they don’t realize it’s separate.

Subscribe now

What Waze Actually Collects

Three categories are in scope here, and they roughly mirror what I found in Google Maps.

The first is location and route history. Waze logs your GPS position, your speed, and your route, and saves it to a running record of every drive you’ve made on the app. This is the same kind of data Maps stores in Timeline, just under a different name and a different settings menu.

The second is search and destination data. Every address you’ve searched, your saved home and work locations, and your recent destinations are stored separately from your route history and have their own deletion controls.

The third is passive background location. Depending on your settings, Waze can check your location even when the app isn’t open, in order to send you reminders for planned drives, traffic alerts, and parking assistance. This is functionally identical to what Google Maps does in the background, and it’s controlled the same way, through your phone’s location permissions rather than anything inside the app.

Share

Still a Google Product

Waze feels like a scrappy, community-run app, and in some ways it still is. But Waze has been owned by Google since 2013, and the privacy policy is direct about working with Google’s other companies for advertising, including sharing your device’s advertising identifier with those partners.

The Settings That Actually Matter

Listed roughly in order of impact. The first two are your highest privacy ROI.

1. Location Permission, Same Fix as Maps

Waze needs precise location to navigate, so don’t switch to approximate location. The setting that matters is when the app can access your location, not how precisely.

On Android, go to Settings > Location > App location permissions > Waze, and set it to “Allowed only while in use.”

On iOS, go to Settings > Privacy & Security > Location Services > Waze, and set it to “While Using the App.”

2. Invisible Mode, What It Actually Hides

This is the one most people get wrong. Invisible Mode hides your username, your moving icon, and your activity from other Waze users on the map. It does not stop Waze itself from collecting your location and route data. The company’s own privacy policy is direct about this.

Even while you’re invisible to other users, Waze keeps collecting your location and route data for everything else outlined in the policy.

There’s a second cost to this setting that surprises people. Going invisible also turns off your ability to send traffic reports, message other users, or edit the map. So it’s a real tradeoff, not a free privacy upgrade. You’re trading the social features for social invisibility, not for less data collection.

To turn it on, open Waze, tap the menu icon, go to Settings, then Privacy, and switch on “Go invisible.”

3. Ad Personalization

In the same Privacy menu, you can turn off “Personalize your ads.” Like most ad personalization toggles, this doesn’t stop ads from showing. It stops Waze from using your account activity and saved information to choose which ones you see.

4. Navigation History and Recent Locations

Still in the Privacy menu, you’ll find separate controls for navigation history (every place you’ve navigated to or checked an ETA for) and recent locations (a shorter list tied to recent searches). You can delete individual entries or clear both lists entirely. They’re tracked separately from your account’s broader route history, so clearing one doesn’t clear the other.

5. Contacts Access For Find Friends

Waze has a feature that scans your phone’s contacts to suggest Waze users you might know. I couldn’t find a dedicated toggle for this in the current privacy settings menu, which is surprising. The more reliable control sits at your phone’s permission level rather than inside the app.

On Android, go to Settings > Apps > Waze > Permissions > Contacts, and turn it off unless you actually want to use the feature.

On iOS, go to Settings > Privacy & Security > Contacts > Waze, and turn it off.

This matters beyond your own data. If you grant Waze contacts access, the people in your phone book who don’t use Waze and never agreed to anything are part of what gets uploaded.

Takeaway

After all of this, Waze still knows where you are while you’re navigating, because that’s what the app does. You’ve cut the background collection, removed yourself from the social map if you want to be removed, and made sure your contacts aren’t getting swept up by a feature you forgot existed. That’s legit progress.

What you haven’t done, and can’t really do with a settings change, is use Waze without Google knowing your location in real time. That’s true of Google Maps too, but Waze’s whole feature set depends on a level of location sharing that Maps doesn’t require. The traffic data, the live reports, and the community map all need you to be visible to the system, even when you’ve made yourself invisible to other users.

If you want an app that does what Waze does without running through Google, you’re mostly out of luck right now. The crowdsourced traffic and incident reporting that makes Waze unique doesn’t really exist anywhere else with the same reliability and features. That’s a different situation than Google Maps, where Organic Maps and OsmAnd are alternatives for plain navigation, if imperfect. Waze’s actual product, the live community layer, doesn’t have a privacy-respecting equivalent yet.

If you've now worked through both the Maps and Waze settings and you're starting to notice how many of these adjustments lead back to the same Google account, that's the right observation. The bestselling De-Google Your Life guide will help you break free of Google. It’s free for annual paid subscribers. Everyone else can get a deal here.

Subscribe now

Looking for help with a privacy issue or privacy concern? Chances are we’ve covered it already or will soon. Follow us on X and LinkedIn for updates on this topic and other internet privacy related topics.

Disclaimer: None of the above is to be deemed legal advice of any kind. These are *opinions* written by a privacy and tech attorney with years of working for, with and against Big Tech and Big Data. And this post is for informational purposes only and is not intended for use in furtherance of any unlawful activity. This post may also contain affiliate links, which means that at no additional cost to you, we earn a commission if you click through and make a purchase.

• Know your doxxing risk. DoxxScore gives you a personalized exposure assessment and action plan in under 5 minutes. Get Your Risk Score →

• Check out our new, free username generator to help you create unique usernames for different accounts. Reusing usernames is convenient, but terrible for your privacy. This tool makes it easy to create unique usernames on the fly.

  Share Secrets of Privacy

More than 40 of these sites have been identified running the same page template, the same code, and the same advertising, just behind different World Cup-themed names. Malwarebytes, which tracked the operation, describes them as effectively identical despite their different URLs. A script generates a separate page for every match, which makes the whole operation cheap to run and easy to scale. (source)

Subscribe now

The stream itself, when it appears at all, is usually pulled from a third-party piracy service. The site operators don’t control it or vet it. What they do control is everything surrounding the video player, and that’s the purpose of this scheme.

The advertising network these sites run is a delivery route for fake virus warnings, bogus software update prompts that install malware, fake prize and verification pages, and forced redirects into subscription traps. The video window is incidental. The pop-ups, redirects, and hidden clickable overlays are the actual purpose. (source)

This model isn’t new, and it isn’t specific to soccer/football. Scammers have used major sporting events as bait for years because the demand is predictable and the audience is in a hurry. Someone trying to catch a match that starts in three minutes isn’t going to carefully read the URL or notice that a browser update prompt appeared. The urgency is what the sites are designed to exploit.

Alongside the fake streaming sites, researchers tracked roughly 19,000 domains containing references to “FIFA” registered since January 2026, with some linked to phishing campaigns targeting fans searching for tickets and merchandise. The FBI issued a formal public service announcement warning that scammers are creating fraudulent versions of FIFA-affiliated websites to steal personal information, conduct financial fraud, and sell fake products and services. (source)

Share

The streaming angle has a different risk profile than traditional event ticket fraud. You don’t have to hand over payment details to get hurt by a fake streaming site. Just landing on one and clicking something, like a pop-up or a fake update prompt, can be enough. Some fake streaming apps conceal Android banking trojans that capture banking credentials and keystrokes while replicating the interface of legitimate platforms. That’s the mobile version of the same scam, and it’s more dangerous because app permissions tend to be granted at a surprisingly high rate. (source)

The streaming scam problem is structurally hard to solve, because there’s genuine unmet demand driving it. Broadcast rights for the World Cup are expensive and fragmented by region. Plenty of people who want to watch a specific match legally can’t, either because their country’s broadcaster doesn’t carry it or because they’re traveling and their home service is geo-blocked. Scammers exploit that gap, and they do it by building sites that look just good enough to get a few minutes of attention before anyone gets suspicious.

The practical answer for most people is to figure out in advance where to watch legally in their region. In the US, the 2026 World Cup is on Fox, FS1, Telemundo, and Peacock. If you’re outside the US, your national broadcaster is almost certainly carrying it. If you’re traveling and your home service is geo-blocked, you’ll want to spend a few minutes understanding your options.

If you did land on one of these sites and clicked something you now regret, the immediate steps are: don’t install anything it prompted you to download, close the browser tabs, and clear your browser cache. If something did get installed, your device’s built-in security scanner is a reasonable starting point.

The tournament runs through July 19. There will be more of these sites as the knockout rounds draw bigger audiences. The one consistent tell is that none of the legitimate broadcasters require you to hunt for them. If you’re three clicks deep following a link someone posted in a forum, it’s probably a scam site.

The World Cup produced one other privacy story worth noting.

A German fan named Freddy spent the past month going viral on X by documenting a road trip across small-town America while following his national team. He kept his face out of every photo and never used his real name, because from the start he wanted to keep some separation between his online persona and his actual identity.

It mostly worked, until it didn’t.

When his account hit close to a million followers, people started digging through his 22,000 posts looking for anything damaging, fabricated tweets started circulating, and fake accounts impersonating him appeared within days of him going viral. He left X rather than wait to see how much worse it got.

Freddy was more privacy-conscious than most people who end up with that kind of audience, and it still became untenable. The lesson isn’t that anonymity fails (which it usually will at a certain level), rather, it’s that most people have no idea what’s already findable about them before the attention arrives.

If you’re posting publicly about your location in real time, or you’ve ever been briefly visible online, it’s worth knowing what a motivated stranger could find. That’s the problem DoxxScore was built to solve. A one-time assessment of your doxxing exposure before someone else runs the same search. You can find it at DoxxScore.com.

Subscribe now

Looking for help with a privacy issue or privacy concern? Chances are we’ve covered it already or will soon. Follow us on X and LinkedIn for updates on this topic and other internet privacy related topics.

Disclaimer: None of the above is to be deemed legal advice of any kind. These are *opinions* written by a privacy and tech attorney with years of working for, with and against Big Tech and Big Data. And this post is for informational purposes only and is not intended for use in furtherance of any unlawful activity. This post may also contain affiliate links, which means that at no additional cost to you, we earn a commission if you click through and make a purchase.

• Check out our new, free username generator to help you create unique usernames for different accounts. Reusing usernames is convenient, but terrible for your privacy. This tool makes it easy to create unique usernames on the fly.

• Curious what strangers can find out about you from your phone number? We break it down in one of our most popular posts ever: We Searched a Phone Number on a Free Website. The Results Were More Detailed Than Expected.

  Share Secrets of Privacy

Except a small program is now running quietly in the background, copying every password your browser has saved, every autofill entry with your name, address, and phone number, every active login session for your email, your bank, your social media accounts. Within minutes it packages all of that up and sends it somewhere else.

This is called an infostealer, and it’s become one of the more common tools in the cybercrime economy.

Subscribe now

What’s Actually Happening

To be honest, this isn’t a new category of malware. Keyloggers and spyware have existed for decades. What’s changed is what the current generation is built to grab and how easy it’s become to deploy.

Think about everything sitting in your browser right now.

• Saved passwords for dozens of sites.

• Credit card numbers you told Chrome to remember.

• The “stay logged in” cookies for your Gmail, your bank, your Amazon account.

• Autofill data with your home address and phone number.

An infostealer copies all of that and sends it to whoever deployed the malware. The targets include session cookies, which let an attacker into your accounts without needing your password or your two-factor code, because the session is already authenticated. That’s the part old-school keyloggers mostly couldn’t touch.

The browser is the main target, but not the only one. Infostealers also go after standalone applications like VPN clients and email clients, and cryptocurrency wallets get particular attention, with the malware scanning for wallet files and browser extensions to extract private keys. Some variants pull session data from Telegram, Signal, and Discord, and take screenshots while they’re at it.

Distribution has changed too. The most common infostealers are now rented out as subscription services, so whoever runs the campaign doesn’t need to write any code. They rent access, point it at a phishing email or a fake download page, and start collecting. What comes back gets sold as a “log,” often for just a few dollars, on dark web marketplaces and Telegram channels.

Share

What sets this apart from most malware you’ve heard about is that it doesn’t announce itself. Ransomware locks your files and demands payment, so you know immediately something is wrong. An infostealer just sits there collecting data in the background. Devices can stay infected for a long time before anyone notices, because nothing about how the computer behaves actually changes.

This Isn’t Fringe

Verizon’s 2025 Data Breach Investigations Report examined infostealer logs being actively traded by criminals. They found that 30% of the compromised devices in those logs were enterprise machines, but 46% of the devices with corporate logins on them were personal, unmanaged devices.

So nearly half the devices containing work credentials were people’s personal laptops. Not because anyone hacked a company network. Because someone’s home computer got infected, and that computer happened to have both a Netflix password and a work email saved in the same browser.

The connection to bigger attacks is clear when you look at the data.

54% of ransomware victims in 2024 had their credentials show up in infostealer logs before the ransomware attack happened. The infostealer isn’t really a separate problem from ransomware. It’s often the step that happens first, quietly, weeks or months before anything visible goes wrong.

My Take

The standard recommendation is “use a password manager and enable two-factor authentication”. That’s good advice, but it assumes the threat is someone guessing or cracking your password. Infostealers don’t guess anything. They read what’s already sitting on your machine, including the session cookies that let attackers into your accounts without needing a password or a 2FA code at all.

While a password manager helps, it doesn’t fully solve this. And if you’re using the password-saving feature built into Chrome or Safari rather than a dedicated manager, you may be more exposed than you realize, since browser-stored passwords are one of the specific things this malware looks for. More on that below.

I think this threat gets more attention over the next year or two, mostly because it keeps showing up as the silent first step behind bigger breaches that eventually do make headlines. A lot of people will hear about infostealers for the first time when their bank flags a login from a country they’ve never visited.

Subscribe now

The Good News

There’s a free tool that tells you whether your email has shown up in a stealer log. Go to haveibeenpwned.com, the same breach-checking site you may already know, and enter your email. The basic search has always been free and stays that way.

Stealer logs show up in your results as a named breach, something like “Stealer Logs, Jan 2025” or “Data Troll Stealer Logs.” If you see one of those in your list, that’s your answer. Click into it and HIBP’s description explains what a stealer log is and roughly when it was collected.

What the free check won’t tell you is which specific sites your credentials were captured against. Seeing the exact domains, your bank, your email provider, whatever it was, requires a paid HIBP subscription and its API. The free version confirms you were caught up in one. It doesn’t hand you the full breakdown.

That’s still useful on its own, and it takes about thirty seconds to check.

The harder part is what to do next, because changing your passwords alone doesn’t fix this. If the malware is still active on your device, it will simply capture your new passwords too. And if you’re using a browser-based password manager, the exposure runs deeper than most people expect.

The Check, Step by Step

Read more

Mastercard has a division built specifically to package up cardholder transaction data and sell it to advertisers, data brokers, and anyone else willing to pay for access. A 2023 investigation by U.S. PIRG (a consumer advocacy group) found that Mastercard runs at least 25 different data products through this division, and most cardholders have no idea it exists. Mastercard’s public position is that it doesn’t sell “personal cardholder data for marketing.” PIRG’s response was that the distinction doesn’t hold up. While Mastercard isn’t handing over your name, it doesn’t need to. The categories themselves are personal enough.

Amex just got back into this business too. In October 2025 the company launched Amex Ads, which lets brands target its 34 million U.S. cardholders based on what they’ve bought and where they’ve traveled.

Visa is the interesting case. It ran a similar product called Visa Ad Solutions until 2021, then shut it down. Whether that means Visa stopped monetizing transaction data, or just stopped doing it through that particular product, is something Visa has never clearly answered.

What this all means is that three companies process essentially all of the card payments in the country. Two of them are actively selling insights derived from those payments to outside parties right now, and the third has a complicated history that nobody’s fully accounted for.

Subscribe now

How This Actually Works

The way people imagine this works is that the credit card company sells a list of your purchases with your name attached. That’s not quite how it works.

When you buy something, the network sees the merchant name, the amount, the date, and roughly where the transaction happened. Mastercard’s own privacy policy says it generally doesn’t need your name to process the transaction, and usually doesn’t have it in that data stream.

What the network does have is volume. Billions of transactions, attached to anonymized account identifiers, repeating over months and years.

From that, Mastercard builds what PIRG described as behavioral categories. Frequent late-night fast food orders. Big spikes in spending around certain dates. A pattern that looks like someone furnishing a new apartment, or someone who just had a baby, or someone the company would internally tag as a “high-value” customer worth targeting with offers. The Electronic Frontier Foundation pointed out that Mastercard uses transaction frequency, amount, location, date, and time specifically to predict what kind of spender you are.

None of that requires your name. Instead, it requires only your pattern. And patterns are often more identifying than names, because almost nobody else shares your exact combination of where, when, and how much.

It’s worth being clear about how we know credit card companies use your spending data versus what’s a reasonable worry.

The advertising use case is documented and not in doubt. But health and life insurers buying this kind of data for underwriting is not something I found evidence of happening today, at least not directly. But privacy advocates have flagged it as the obvious next step, and it’s not hard to see why. A pattern of frequent fast food orders and no gym membership charges is exactly the kind of signal an insurer would want and a data broker would be happy to package.

Nothing about the current setup prevents that from happening, of course. It’s just, as far as anyone’s reported, not happening yet.

Share

This Is a Deliberate Business Now

Mastercard didn’t end up with 25 different data products by accident. Someone built a roadmap for that, with robust sales teams and growth targets.

Amex didn’t launch Amex Ads in October 2025 because they happened to have some data sitting around. That’s a media business they stood up on purpose, with named partners like Marriott and Macy’s, and they’re describing it to cardholders as a perk (“relevant content at exactly the right time”) rather than something being done to them.

My honest read is that this is going to keep expanding because the economics are good and because most of what these companies are doing is, in fact, legal under current federal privacy law. The Gramm-Leach-Bliley Act lets financial companies share data with very limited opt-out rights, and what opt-out rights exist are often buried in annual privacy notices nobody reads. A handful of state privacy laws (California’s among them) give residents stronger opt-out and deletion rights, but enforcement against card networks specifically has been close to nonexistent.

So if you’re waiting for this to get fixed at the policy level, I wouldn’t hold your breath. The more useful question is:

what you can actually do about your own exposure, given that this is the environment.

Where the Opt-Outs Actually Lead

Before getting into what to do, it’s worth being straight about what doesn’t work, because most privacy advice oversells the opt-out step.

Read more

Only there’s one problem - you never hear back.

What you may not realize (at least until it’s too late) is that the “interview” was the purpose, and the job posting was just a ruse.

A growing category of fraud targets job seekers not for their social security number or credit card info, but for something that can’t be rotated like a password or frozen like a credit card: their face and their voice.

Subscribe now

How the Scam Works

Fake recruiters are inviting victims to professional-looking video interviews. The conversation feels normal, but the system is recording facial angles, blinking behavior, and voice samples. That data can later be used to bypass liveness checks and even access financial accounts.

The part that makes this different from a garden-variety phishing attempt is what the data enables.

Banks and fintech platforms have been rolling out biometric authentication (Face ID and voice verification) as a security upgrade. The assumption built into those systems is that your face and voice are yours alone. Fraudsters have found a way to challenge, if not disprove that assumption.

A ready-to-use synthetic identity sells for as little as $15 on criminal marketplaces, and tools to bypass financial institution liveness checks are available for between $10 and $50. The raw material those tools need is high-quality biometric data. A 30-minute video interview, recorded without your knowledge, is an efficient way to collect it.

Share

The Scale Is Already Large

Reports to the FTC about job scams tripled from 2020 to 2024, with reported losses jumping from $90 million to $501 million over the same period. That figure almost certainly undercounts the real total; the FTC has noted that the vast majority of fraud goes unreported. And those numbers predate the current wave of AI-powered interview fraud, which began accelerating in late 2024.

Sumsub’s Q1 2025 research found that deepfake fraud surged by 1,100% year over year in North America. What changed? The tooling got cheap enough and capable enough that fraud operations which required significant technical skill a few years ago are now accessible to anyone who knows where to look.

The downstream effects are already showing up in financial crime data. In April 2025, Hong Kong police dismantled a deepfake scam ring that used AI-generated video and cloned voice attacks to open accounts at HSBC, causing losses exceeding HK $1.5 billion, roughly $193 million.

What Your Face and Voice Are Actually Worth

Telegram channels selling stolen biometric data also offer virtual camera tools that can be inserted during liveness checks to substitute a deepfake image for the user’s real face. Sellers even specifically advertise compatibility with major financial institutions including Binance, BBVA, and Revolut.

So the chain looks like this:

fake interview collects your facial geometry and voice samples, that data gets packaged or sold, and it ends up being used to open accounts, approve loans, or transfer funds, all in your name.

Unlike a stolen password, you cannot change your face. Once that data is out, it is out.

Sumsub’s research shows synthetic identity document fraud in North America rose 311% year over year in Q1 2025. Biometric harvesting operations are one of the supply chains feeding that number.

Subscribe now

What the Fraudulent Interview Actually Looks Like

Most of these operations put real effort into appearing legitimate. The recruiter’s profile looks credible, often impersonating a real person at a real company. AI-generated headshots and recycled job descriptions make the impersonation hard to catch at a glance.

The interview itself tends to follow normal patterns, focusing on job history, strengths, why you’re interested in the role. That’s partly to keep you engaged long enough to collect usable data, and partly because a functional-sounding conversation produces better audio and more natural facial expressions than an awkward one. The platform will typically be something you haven’t seen before, attributed to a video interviewing tool you can’t find much about online.

My Take

The mainstream privacy conversation is still treating this primarily as an employer problem. In that scenario, companies need to worry about deepfake candidates infiltrating their hiring pipelines. This is a real issue and we’ve touched on it before. But job seekers have been left almost entirely out of the discussion.

The job market for much of the last two years has been brutal enough that people are conditioned to take any interview they can get. Someone in month four of a job search is less likely to run careful due diligence on an interview request, and fraudsters know this (desperation works in a fraudster’s favor).

There’s also a timing problem. By the time you realize a recruiter was fake, the interview recording has already been processed. Most victims never find out at all. They just wonder why they didn’t hear back.

The practical guide job seekers actually need, such as how to vet a recruiter before you accept the interview request, what platform red flags to look for, and what to do if you’ve already participated in something that felt off, doesn’t exist in consumer privacy coverage. That’s what the rest of this post covers.

Vetting a Recruiter Before You Accept

Read more

Search has alternatives. Gmail has alternatives. Chrome has alternatives that are genuinely better, both overall and from a privacy POV.

But Maps?

The gap between Google Maps and every privacy and semiprivacy-friendly alternative (Organic Maps, OsmAnd, even Apple Maps) is real enough that I understand why people stay. The coverage, the business data, the real-time traffic, and the accuracy in dense urban areas is unmatched. For most people in most places, the alternatives aren’t there yet.

Subscribe now

So this post isn’t about quitting Google Maps. It’s about what you should change if you’re going to keep using it, and what the settings actually do versus what Google implies they do. Those are often different things.

One note before we get into it:

these settings reduce your exposure, they don’t eliminate it.

Google Maps is, structurally, a data collection product that also gives you directions. If you want to understand the full picture of what that means across Google’s ecosystem, and what it takes to actually step off it, that’s what my De-Google Your Life guide covers.

But that’s a much larger project. This post is narrower, covering just Maps and the key changes you can make.

Share

What Google Maps Actually Collects

There are three data categories worth understanding before touching any settings.

The first is Timeline, the record of where you’ve physically been. When enabled, Maps logs your routes, the places you stopped, how long you stayed, and infers what you were doing (driving, walking, visiting a restaurant).

After a major policy change Google rolled out through 2024, this data now lives on your device by default rather than Google’s servers. That’s an important shift because it largely closed off the geofence warrant problem (where law enforcement could demand location data on everyone near a crime scene by serving Google directly).

The new exposure risk is your device itself. A 2025 Pennsylvania case, for example, used Google Maps Timeline data extracted from a phone to place a defendant at a location, without requiring expert testimony to explain the technology.

The second is search and navigation history, which logs every address you’ve searched and every route you’ve run. This is stored separately from Timeline and controlled by a separate setting. Most people who turn off Timeline assume this type of data is covered. It isn’t.

The third is passive background data. When Google Maps has “Always” location permission, it collects location signals even when you’re not actively using it. This feeds both Timeline and, through Web & App Activity, Google’s broader profile of your movements.

What the 2024 Changes Actually Mean

In late 2023, Google announced that Timeline data would move from its servers to users’ devices, and cut the default auto-delete period from 18 months to 3 months. The company framed this as a privacy improvement, and in one specific sense it was.

Google can no longer hand your location history to law enforcement via a server-side warrant because Google no longer has it.

Google still requires a warrant, not merely a subpoena, to produce location data it does hold. Your device is now the single point of failure. If your phone is seized, imaged, or accessed, Timeline data sits on it. Cloud backup of Timeline is available but opt-in, and Google says it encrypts it in a way that blocks their own access. Treat that as probable but not verified.

None of this affects what Google collects in real time while you’re actively navigating. That still happens, and it still feeds the ad and personalization infrastructure.

Subscribe now

The Settings That Actually Matter

Work through these in order. The first two have the most impact.

1. Location Permission - Limit When, Not How Precisely

Most guides get it wrong with this setting. The advice you’ll see on privacy forums is to switch Google Maps from precise location to approximate location. Don’t do that. Google Maps has required precise location for navigation since mid-2023, and approximate location breaks routing. The change that actually matters is when Maps can access your location, not how precisely.

On iOS, go to Settings > Privacy & Security > Location Services > Google Maps and set it to “While Using the App.” Leave Precise Location on.

On Android, go to Settings > Location > App permissions > Google Maps and set it to “Allow only while using the app,” not “Allow all the time.”

Setting it this way stops Maps from collecting location signals in the background when you’re not actively using it. That’s where a meaningful share of passive data collection happens.

2. Timeline - Check Whether It’s On, Then Decide

Google’s documentation now says Timeline is off by default. If you’ve had a Google account for more than a few years and enabled it at any point, it’s likely still on. Check rather than assume.

On both platforms, open the app and tap your profile picture, then go to Your Timeline > the three-dot menu (top right) > Location & privacy settings. From here you can turn it off entirely, or set auto-delete to 3 months if you want to keep the feature.

You can also manage it at the account level at myaccount.google.com > Data & Privacy > Timeline.

If you turn it off and want to delete what’s already stored, the same settings screen has a “Delete all Timeline data” option. Do that separately. Turning off the setting doesn’t delete existing data.

3. Web & App Activity - the One Most People Miss

This is the setting that undermines everything else if you leave it on. When Web & App Activity is enabled, your Maps searches, navigation history, and location context from Maps use get saved to your Google account regardless of your Timeline setting. They’re independent. Turning off Timeline while leaving Web & App Activity on is like locking your front door and leaving the back open.

On both platforms, go to myaccount.google.com > Data & Privacy > Web & App Activity. Turn it off, or at minimum set auto-delete to 3 months.

Google will warn you that some Maps features will be “less personalized.” That’s accurate. It also describes what personalization means in practice, Google using your activity history to inform what it shows you, and by extension, what it shows advertisers about you.

Share

4. Maps Search History

Separate from Web & App Activity, Maps maintains its own search history log. On both platforms, tap your profile picture, then go to Your data in Maps > Maps search history. You can delete history there and set auto-delete.

5. Incognito Mode - For Specific Trips

Google Maps has an incognito mode that stops search history from saving and pauses Timeline updates while active. It’s underused.

On both platforms, tap your profile picture and select “Turn on Incognito Mode.”

Use it for medical appointments, addresses you’d rather not have in your history, anything you’d prefer not to see surface later in Google’s “places you’ve visited” features. Incognito mode doesn’t stop real-time location sharing if you have that enabled with specific contacts, and it doesn’t make you invisible to your carrier or network.

6. Use Maps Without a Google Account

This one doesn’t get mentioned enough.

Google Maps works on both iOS and Android without signing in. Navigation, search, and real-time traffic all still function. What you lose is Timeline, saved places, and anything that depends on account history.

Now Google still collects data from unauthenticated sessions, it just can’t attach it to your account identity. It gets tied to your device identifier and IP address instead. That’s a genuine reduction in exposure, but not a complete one.

If you use Maps occasionally and don’t rely on saved places or commute features, signing out permanently is the highest-impact change on this list. Everything in steps 1 through 5 is about limiting what Google collects and retains under your identity. Removing the identity from the equation is a different approach entirely.

To sign out on either platform, tap your profile picture and select “Sign out.” Maps will continue working.

The Honest Bottom Line

After working through all of this, Google Maps is still Google Maps.

If you implement the above setting changes, you’ve reduced the data surface because background collection is off, Timeline isn’t building a permanent record of your movements, your search history isn’t feeding the personalization engine. That’s positive, and it’s worth doing.

What you haven’t done is stopped Google from knowing where you are while you’re actively navigating. That’s the core function of the app, and there’s no privacy setting that separates the navigation from the data collection. They’re the same operation.

If that’s the line you want to be on the right side of, the answer is a different app. For what it’s worth, Organic Maps has improved significantly and covers most use cases for people who live in major metro areas. OsmAnd is more powerful but has a steeper learning curve.

Apple Maps is adding ads, so the “at least it’s ad-free” argument is expiring. Apple says the ads will be contextually targeted based on your current search, not your location history, and that your data stays on-device. That’s a different model from Google’s if true. But it’s Apple’s claim, which will need to be verified

The De-Google Your Life guide covers this in full: Maps, Search, Chrome, Android, and the account-level changes that matter most. If you’re already making settings changes, it’s the logical next step (FYI, the guide is free for paid annual subscribers).

How long did all these setting changes take you? If you found something you’d left on that surprised you, share this with someone who probably has the same settings.

Subscribe now

Looking for help with a privacy issue or privacy concern? Chances are we’ve covered it already or will soon. Follow us on X and LinkedIn for updates on this topic and other internet privacy related topics.

Disclaimer: None of the above is to be deemed legal advice of any kind. These are *opinions* written by a privacy and tech attorney with years of working for, with and against Big Tech and Big Data. And this post is for informational purposes only and is not intended for use in furtherance of any unlawful activity. This post may also contain affiliate links, which means that at no additional cost to you, we earn a commission if you click through and make a purchase.

• Know your doxxing risk. DoxxScore gives you a personalized exposure assessment and action plan in under 5 minutes. Get Your Risk Score →

• Check out our new, free username generator to help you create unique usernames for different accounts. Reusing usernames is convenient, but terrible for your privacy. This tool makes it easy to create unique usernames on the fly.

  Share Secrets of Privacy

Helpful Links:

• https://osmand.net/

• https://organicmaps.app/

• https://maps.here.com/

“AI can now make you a great parent.”

The product being pitched is Ollie, a family AI assistant (link to the thread is at the end of this post). The thread describes Ollie deploying “an army of AI agents to scan the chaos, extract what matters and plan your day.” It reads your email, monitors your WhatsApp, finds unpaid bills while you sleep, and sends you a morning brief at 7am.

“Ollie never shuts off,” the author says. That’s presented as the product’s best feature.

I believe the app is genuinely useful. Parenting coordination is exhausting with all the school emails, the activity group chats, the calendar conflicts, and the missing ingredients you notice at 6pm when about to prepare dinner.

And I get why 1.9 million people were intrigued by the X thread. But “never shuts off” describes something most people have never deliberately agreed to give a third-party company. And the implications are worth understanding before you hand over your inbox.

Especially because, in one form or another, you may have already handed it over.

Subscribe now

A Different Kind of Access

Most apps ask for permission to do one thing. Your weather app wants your location. Your camera app wants your microphone. You grant it, you understand roughly what it gets, and the relationship is bounded.

Agentic AI tools work differently. They don’t ask for one thing. They ask for persistent, broad access to read and act across multiple systems at once:

• your email

• your calendar

• your messages

• your finances

Then they operate continuously, without your involvement, making decisions about what matters and what to do with it. Unlike current apps that typically touch one data type, agentic AI connects dots across your entire digital life and makes autonomous decisions about how to use that information, often with minimal human oversight.

That’s a fundamentally different relationship than anything most people have agreed to before.

Ollie isn’t alone in this category. Skylight, a physical touchscreen calendar sitting in over a million family kitchens, aggregates your Google Calendar, iCal, Microsoft account, school apps, and sports scheduling apps into a single always-on display. The newer model uses AI to parse photos of paper flyers from your kids’ backpacks and automatically adds events to your calendar.

The device never goes dark and the sync never stops. Your family’s full schedule, routines, locations, and recurring appointments live in cloud infrastructure you probably haven’t thought about since setup.

Share

And then there’s Gmail. Google has been scanning your email for years to power its “smart features,” and in late 2024 expanded that access to Gemini AI across Gmail, Calendar, Drive, and Meet. Users were automatically opted in. Turning it off is possible, but Google buried the setting in two separate places and bundled it with features like spell-check so that opting out is genuinely annoying. (opt out instructions are further down below).

If you’ve been following the privacy conversation around AI wearables, you’re already familiar with a related version of this problem. at Online Safety Substack wrote last week about Amazon’s acquisition of Bee, a wearable that records conversations all day and uploads transcripts to the cloud. His point:

the real risk isn’t to the person wearing it, who consented. It’s to everyone around them who didn’t.

Family AI tools work on similar logic, just applied to your household. The data flowing through Ollie isn’t only yours. It includes your partner, your kids, your nanny, and your family’s schedule as a whole.

These tools are part of a growing category that markets itself as the “family OS.” The convenience is legit. The privacy tradeoffs are of course more complicated than the compelling pitch suggests.

The Attack Vector Built into the Design

There's one risk with these tools that most people are overlooking:

When you give an AI agent access to your email, every email you receive becomes a potential instruction to that agent. Not from you. From whoever sent it.

Security researchers have documented a class of attack called prompt injection, where malicious content hidden inside an email tricks an AI agent monitoring your inbox into taking actions you never authorized. Unlike phishing attacks that require a human to click something, a successful prompt injection against an agent requires no human error at all. The email arrives, the agent reads it, the hidden instruction executes.

This is already happening in real deployments. Security teams are detecting prompt injection payloads arriving through email, with instructions hidden in white text on a white background, invisible to human readers, designed specifically to manipulate AI agents monitoring inboxes. The agent does exactly what it’s told.

This isn’t a flaw in Ollie specifically. It’s a structural property of any system that gives an AI persistent access to read and act on your communications. Meredith Whittaker, the president of Signal, made this point publicly at SXSW last year (link to video at the end):

agentic AI poses serious security risks precisely because completing tasks for users requires giving the agent access to reams of data, and that access doesn’t just serve you. It creates a target.

The more access an agent has, and the more autonomously it acts, the larger the surface area for this kind of attack. An agent that reads your email to surface a school reminder and an agent that reads your email to exfiltrate your financial details have exactly the same level of access. The difference is who’s giving it instructions.

Subscribe now

What the Data Actually Includes

Ollie’s privacy policy says message content “may be reviewed or used in aggregate to improve Ollie’s systems.” That’s easy to skim past, and I’ve written before about why privacy policies generally aren’t worth reading as a primary strategy because they’re written to protect the company, not you (and they’re intentionally broad enough to permit almost anything). But even setting aside what the policy permits, the practical implications of opting into those are worth understanding.

Your family’s communications aren’t abstract data. They include medical appointments, financial stress, the dietary restriction your kid was just diagnosed with, the pickup logistics when schedules don’t align, the nanny you just hired. “Used in aggregate to improve our systems” is where all of that goes.

Ollie’s infrastructure runs on third-party services including OpenAI’s API. Ollie’s own FAQ cites OpenAI’s commercial API terms as the basis for its claim that your data isn’t used for model training. That’s a claim about OpenAI’s behavior, not a contractual guarantee Ollie itself is making to you. If that relationship changes, you have no direct recourse.

Early agentic AI deployments have already produced security incidents where researchers found thousands of exposed instances leaking API keys, chat histories, and account credentials. In some cases, the failures originated not at the consumer-facing product but in the infrastructure beneath it.

Ollie is also currently free, with a stated goal that future features will support the business. The data is being collected now, before the monetization model is finalized. Whatever Confabulation Corporation eventually decides to do with this product, they will have a detailed behavioral dataset of family households already built. Privacy policies can be updated. Data that exists at the time of a policy change doesn’t disappear.

How to Evaluate Any Agentic Tool Before You Grant Access

Since privacy policies are generally written to protect companies rather than users, I don’t rely on them as a reliable guide to actual behavior. But four practical questions help you size up your real exposure before you hand a tool access to your household. They don’t require reading anything legal.

Read more

That case involved Talkspace, an online and mobile therapy services app. But the underlying problem is far bigger than one platform.

Millions of Americans are generating detailed records of their mental and physical health every day through apps that most people have never thought could be used against them legally.

Your sleep logs, your step counts, your mood tracking, and your calorie intake data are all stored on someone else’s servers. And when a lawsuit happens, the owner of those servers get a letter demanding the information.

This has already happened to people in divorce cases, custody disputes, employment lawsuits, and personal injury claims. The incriminating data existed and the other side’s lawyer found it. But by then it was too late to do anything about it.

Subscribe now

What “Subpoena” Actually Means Here

Most people think of subpoenas in the context of criminal investigations, like cops at the door. Scenes you would see in a Law & Order episode.

Civil litigation is quieter and far more common. Divorce proceedings, child custody disputes, personal injury claims, and employment lawsuits are scenarios where where health app data is increasingly being pulled into court. Those scenarios are also where you are far less likely to have thought about the long term implications of the data in advance.

In divorce proceedings, sleep patterns, stress levels, and activity data from health apps have been used to argue about a spouse’s mental state or ability to care for children. In personal injury cases, defense lawyers can use fitness tracker data to argue that a plaintiff is more active than their claimed injuries would suggest.

In one California case, a victim’s Fitbit showed a spike in heart rate followed by a rapid slowdown at the exact time a suspect claimed he was only there briefly to drop off food. In Connecticut, a man was charged with murdering his wife after data from her Fitbit showed she was moving around an hour after he claimed an intruder had killed her, and that she had covered far more distance than his account described.

These are criminal examples, but they illustrate the basic mechanics at play:

apps that record time-stamped physiological data create a parallel account of events.

In civil litigation, that parallel account is available to any attorney who files the right paperwork.

Your Health Apps Are Not Protected by HIPAA

Most people assume health data is private because there are laws about health data being private. There are, but those laws don’t apply to most of the apps on your phone.

The information stored in health apps isn’t covered by HIPAA, so companies can legally share the data. HIPAA applies to healthcare providers, insurers, and their direct business partners. The most common examples are your doctor’s office, your hospital, and your insurance company.

A consumer wellness app you downloaded from the App Store is a technology company. It sits entirely outside that regulatory framework.

This means Calm, Headspace, MyFitnessPal, most period trackers, most fitness apps, and most mood-logging tools have no federal obligation to treat your data as medical information. They have privacy notices, but privacy notices are not laws. If you read the fine print, you’ll find that these companies are required to disclose information to law enforcement officials with a subpoena or search warrant, or to other parties if a court so orders.

The one partial exception in the consumer app world is therapy platforms explicitly contracted with licensed providers and billed through insurance. Those may carry HIPAA obligations depending on how they’re structured. But even HIPAA isn’t the full shield people assume it is.

The protected status of “psychotherapy notes” under HIPAA does not generally extend to civil litigation brought by the patient where health records may contain relevant evidence and where the privilege has been waived. A typical example is when someone sues for emotional distress. By doing that, they’ve then made all records about their mental state fair game.

Share

What’s Actually Being Retained

Deleting an app doesn’t delete the data of course. The data lives on the company’s servers, often indefinitely.

Calm’s data retention policies do not define a clear length of time after which data or cookies are deleted. Headspace says it will keep personal information for as long as needed to perform its obligations, or for as long as legally permitted, and explicitly lists responding to subpoenas and court orders as a stated use of that data. MyFitnessPal retains personal information for as long as you maintain an account or as needed to provide services, and as necessary to comply with legal obligations, resolve disputes, and enforce agreements.

In plain terms:

years of data, sitting on servers, is available to any attorney who wants it badly enough and has a plausible legal argument for relevance.

The Talkspace situation illustrates this most clearly. The platform has, by its CEO’s own account to investors, amassed 140 million message exchanges. That database exists because the company records and stores conversations. The individual user never sees that infrastructure. They just see a chat window that feels private.

Subscribe now

My Take

What’s making health data more of a personal legal risk isn’t really the law. Subpoenas have always allowed adverse parties in litigation to get at your data. What’s changing is the richness of the data being generated and how long it persists.

Someone going through a divorce ten years ago had a phone and maybe some emails. Someone going through a divorce today potentially has years of detailed sleep data, mood logs, location history, calorie records, menstrual cycle data, and therapy transcripts, all of it stored in cloud accounts they stopped thinking about.

The risk isn’t hypothetical future legislation either. The risk is that the data you generated last year, when nothing was wrong, gets subpoenaed in a proceeding you haven’t imagined yet.

Auditing Your Exposure: a Threat-Model Approach

The right way to think about this isn’t “which apps are safe”. That’s too vague.

Instead, think about “which apps create risk in the specific scenarios most likely to affect me.” The three scenarios that drive the vast majority of civil health-data subpoenas are:

Read more

Hackers spent nearly ten weeks inside the network of the largest public health system in the United States, took the fingerprints of at least 1.8 million people, and the response was 24 months of credit monitoring.

Now the monitoring isn’t worthless. It covers real financial fraud risk. But it’s aimed at the wrong threat for the wrong timeframe. And NYCHHC isn’t a one-off. It’s the most visible example so far of something that’s going to keep happening.

Subscribe now

Biometric data collection has expanded rapidly across healthcare, government, workplaces, and financial services over the past decade. Each new collection point is another institution whose vendor could be compromised, and another population of people who had no meaningful say in the collection and will have no real remedy after the exposure.

The advice below is written for anyone in the NYCHHC dataset. But it applies equally to anyone whose fingerprints have ever been collected by an employer, a hospital, a government agency, or a background check vendor. That population is much larger than 1.8 million people, and it’s growing. Odds are you fall in that bucket.

Before getting into what to do, there are two risk timelines worth understanding, because they require different responses and almost no breach coverage distinguishes between them.

The first is immediate and concrete. The second is slower and speculative in the short term, but increasingly probable as tools get cheaper and the data ages.

Share

The Near-Term Threat Isn’t the Fingerprints

First things first. The near-term risk in this breach isn’t the biometric data. It’s what the biometric data comes packaged with because this breach didn’t take fingerprints alone. It took:

medical records, health insurance details, specific diagnoses and medications, Social Security numbers, passports, driver’s licenses, geolocation data, and financial account information.

That combination is the raw material for medical identity fraud, a specific and growing crime where someone uses your insurance to obtain prescriptions, medical equipment, or procedures in your name. You often don’t find out until a debt collector calls about a bill for a procedure you never received, or you go to use your benefits and find they’re exhausted.

While the theft of fingerprints are what gets the most attention, they aren’t the primary weapon by scammers in this scenario. What they do is make impersonation more convincing. An attacker who can call your insurer knowing your diagnosis, your medications, your policy number, and your SSN is already dangerous. Having the biometric data on hand is just one more piece to support the scam.

The Long-Term Threat Is Real, Just Slower

Stolen fingerprint templates can be used to reconstruct fingerprint images. With accessible equipment, including 3D printers and materials like silicone or gelatin, researchers have demonstrated the ability to create physical spoofs capable of fooling most consumer fingerprint sensors, including the ones used for mobile banking. This has been shown in controlled research and in real-world demonstrations.

The barrier today is effort because it takes more work than cracking a stolen password. But biometric data has an indefinite shelf life, and the tools to exploit it are getting cheaper every year. The people in this dataset will still be in it when the economics become more feasible.

The OPM case is the clearest precedent. When the Office of Personnel Management disclosed in 2015 that 5.6 million fingerprint records had been stolen, the agency acknowledged that:

“the ability to misuse fingerprint data is limited -- however, this probability could change over time as technology evolves.”

That was eleven years ago. The technology has evolved. The people whose fingerprints were taken have no more options now than they did then. The people in the NYCHHC dataset will still be in it when the economics shift. So will anyone else whose fingerprints are sitting in an institutional database somewhere.

Share

What the Credit Monitoring Is Actually For

The monitoring NYCHHC is offering is oriented toward financial fraud such as new credit accounts opened in your name, hard inquiries, score changes, etc. That’s the risk model that all breach responses are built for, because it’s the one with established, clear remedies. Biometric exposure doesn’t fit into it, and medical identity fraud fits into it imperfectly at best. Neither is the core use case the monitoring was designed for.

Part of why the remediation is so narrow is that there’s no legal framework requiring anything broader. There’s no federal biometric privacy law. HIPAA governs how healthcare institutions must secure data, not whether they should be collecting certain kinds of data in the first place.

Illinois’ Biometric Information Privacy Act is the closest thing to a meaningful framework in the country, and it only applies in one state. NYCHHC collected millions of fingerprints under a legal framework designed for an earlier era, and the remediation framework that kicked in when it was breached was designed for a different kind of data entirely.

The steps below address the actual threat. Some are specific to people in the NYCHHC dataset. Most apply to anyone whose biometric data has ever been held by an institution, which, if you’ve been employed, treated at a major healthcare system, or processed through a government agency in the last decade, is probably you.

Read more

Change your password, keep an eye on your credit report, and you’ll probably be okay.

The NYC Health + Hospitals breach doesn’t have that. There is no version of “okay” available for the 1.8 million people whose data was taken, because among the things hackers walked out with were fingerprints and palm prints.

Those cannot be changed. They cannot be cancelled and reissued. The people in this database are more exposed today than they were in January, and that will still be true 15 years from now.

Subscribe now

NYC Health + Hospitals, the largest public health system in the United States, disclosed the breach on May 18. Hackers were inside its network from late November 2025 through early February 2026, nearly ten weeks, entering through a compromised third-party vendor.

What was taken varies by individual but covers a lot of ground:

• medical records

• Social Security numbers

• passports

• driver’s licenses

• health insurance details

• billing and financial data

• geolocation data

• biometric data including fingerprints and palm prints.

NYCHHC is offering 24 months of credit monitoring to those affected. The fingerprints were almost certainly collected during employee onboarding, as prospective staff are generally required to enroll their fingerprints for criminal background checks. Whether patients’ biometrics were also compromised has not been confirmed.

The standard breach response assumes compromised data can be fixed in some form:

• Passwords reset.

• Credit cards get cancelled.

• Even a Social Security number can be changed (even if not easily)

• You can freeze your credit, set up an IRS identity protection PIN, and file fraud alerts.

The entire response to a data breach is built on that assumption.

Biometric data doesn’t fit into that arrangement though. A stolen fingerprint template is useful to a criminal today, in five years, and in twenty. It has no expiration date.

Share

This isn’t the first time this has happened. In 2015, hackers breached the US Office of Personnel Management and took 5.6 million fingerprint records from federal employees and contractors. Those people were offered credit monitoring. More than a decade later, no additional remedy was ever provided. The NYCHHC breach just added 1.8 million more people to that list.

For the most part, this story is being treated as a healthcare cybersecurity story. Just another hospital breach that is unfortunate but familiar.

That’s not entirely wrong, but it misses something.

When an institution collects your fingerprints, it permanently takes on a liability that it can eventually shed but that you never can. NYCHHC can get breached, patch its systems, update its vendor contracts, issue its press release, and move on. The people in its database carry the exposure for the rest of their lives. The 24 months of credit monitoring is the institution’s closure. For the individual, there’s nothing similar because the exposure of biometric data never ends.

If there’s one practical thing worth doing today, regardless of whether you’re directly affected by this breach, it’s reconsidering your use of biometric data.

Regular readers know we’re not a fan of the technology and have advised against it for some time. For your most sensitive accounts, including your personal devices, a strong PIN or passphrase has distinct advantages, including:

• it lives only in your head and can be changed if something goes wrong.

• Law enforcement (at least in the US) can’t compel you to provide a password to unlock your devices, but in some jurisdictions, they can compel you to use your biometrics

The harder question is what people are what to do about compulsory biometric use like at work or for some government service. And what are people owed when the government or an employer takes their biometrics then is compromised?

In most cases, it’s not an option to decline or opt out of providing your biometric data to an employer or the government. But two years of credit monitoring isn’t a true remedy. It’s laughably insufficient and disproportionate to the harm.

The fingerprints stolen from OPM in 2015 are still stolen, still potentially useful, and the people who lost them still have no meaningful remedy. Modern society has built an entire infrastructure for collecting biometric data without building any corresponding accountability for when it’s lost.

That needs to change.

Subscribe now

Looking for help with a privacy issue or privacy concern? Chances are we’ve covered it already or will soon. Follow us on X and LinkedIn for updates on this topic and other internet privacy related topics.

Disclaimer: None of the above is to be deemed legal advice of any kind. These are *opinions* written by a privacy and tech attorney with years of working for, with and against Big Tech and Big Data. And this post is for informational purposes only and is not intended for use in furtherance of any unlawful activity. This post may also contain affiliate links, which means that at no additional cost to you, we earn a commission if you click through and make a purchase.

• Know your doxxing risk. DoxxScore gives you a personalized exposure assessment and action plan in under 5 minutes. Get Your Risk Score →

• Check out our new, free username generator to help you create unique usernames for different accounts. Reusing usernames is convenient, but terrible for your privacy. This tool makes it easy to create unique usernames on the fly.

  Share Secrets of Privacy

Article sources:

Sources:

• https://www.securitymagazine.com/articles/100424-trust-in-biometric-data-is-declining-among-consumers

• https://www.nextgov.com/cybersecurity/2015/09/opm-says-more-fingerprint-data-was-stolen-opm-hack-first-believed/121781/

• https://thenextweb.com/news/nyc-health-hospitals-data-breach-biometrics-fingerprints

when a breach includes booking details specifically, the follow-on scam isn’t generic phishing. It’s targeted.

A scammer with your name, your hotel, and your travel dates can reach out in a way that feels completely legitimate, because the details are real.

Since then I’ve had people ask some version of the same question.

How do I know if a message from my hotel is real? How do I verify without getting it wrong?

That’s the right question. Unfortunately it’s also the wrong moment to be asking it.

In this post I'm going to walk through a pre-booking privacy protocol that actually reduces your exposure before anything goes wrong. Most of it is straightforward. One tip comes from a travel insider friend that turns out to have a privacy benefit nobody talks about.

Subscribe now

By the Time You Get the Message, It’s Too Late

By the time someone sends you a message referencing your reservation at your hotel, the hard part of the scam is already done. The attacker has what they need. Your vigilance at the point of contact still matters, such as catching the payment method requests, the urgency pressure, the slightly-off domain name. But it’s a last line of defense operating after the window for real prevention has closed.

Researchers at Sekoia documented a campaign in 2025 in which attackers compromised hotel staff credentials and used that access to contact guests directly over WhatsApp and email, with accurate reservation details in hand. The cover story was a routine verification procedure.

It was convincing because the details were real. That campaign predates the Booking.com breach, which means the data exposure problem isn’t specific to one platform or one incident.

The Scale of the Problem is Noteworthy.

According to the FTC, there were more than 58,000 reports of travel, vacation, and timeshare fraud in 2024 totaling $274 million in losses. That almost certainly undercounts the actual number, since most fraud goes unreported.

AI has made the identification problem meaningfully worse. The old tells like awkward phrasing, generic salutations, obvious typosquatting have been largely neutralized. What researchers from iSeatz and Carnegie Mellon have both flagged is that urgency remains one of the more reliable signals, but it’s a thin thread to hang your security on when everything else about the message looks right.

Voice cloning technology now allows attackers to impersonate airline representatives using voice samples pulled from publicly available customer service recordings. Click-to-call ads on mobile search results can route you directly to a scammer posing as your airline without any visible indication something is wrong. The technical sophistication of these attacks is increasing faster than most people’s awareness of them.

The Window Most People Don’t Use

Here’s what I think gets missed in most coverage of this topic. Every article I’ve read (and I’ve read a lot of them recently) focuses on how to recognize a scam when it arrives.

• Check the domain.

• Look for urgency.

• Call the hotel back using a number from the official site.

All of that is correct. But it treats the moment of contact as the starting point.

It isn’t.

There’s a window between when you decide to travel and when you finalize your reservation, and the decisions you make in that window determine how much information is circulating about you when something eventually goes wrong. Travel platforms know a surprising amount:

your name, email, phone number, travel dates, specific property, number of guests, special requests, payment method, and in many cases device and IP data.

That information sits in their systems long after your trip ends, feeding loyalty programs and in some cases data-sharing arrangements you didn’t explicitly agree to.

What you hand over, and to how many different systems, is something you can actually influence, but only before you confirm.

Most people never think about it until a suspicious message lands.

The Pre-Booking Protocol

None of this requires technical expertise. It’s a set of small decisions made earlier in the process than most people consider. Including this first tip from a long time friend in the hospitality industry.

Read more

Not in some vague, aggregated sense. They have a record of the domains your phone connected to, the apps that sent requests, and depending on which programs you haven’t opted out of, your physical location derived from cell towers rather than your GPS. Turning off location on your phone doesn’t touch that.

The good news is you can do something about it. The bad news is that most of the settings you’d instinctively reach for don’t address the problem. I’ll show you below what settings you need to tweak and the one tool that ISPs wish you wouldn’t use.

Subscribe now

Why Carrier Tracking Is Different

When you use incognito mode or clear your cookies, you’re affecting what gets stored on your device and limiting some cookie-based tracking. Your ISP operates independently of all of that.

AT&T, for example, states in its privacy notice that when it collects web browsing information as an internet service provider, it “works independently of your web browser’s cookie and private browsing settings.” What your browser knows and what your carrier knows are separate data streams.

The same applies to device location settings.

Your phone’s location toggle controls what apps can access. Your carrier can collect location data from the network itself, derived from which cell towers your phone is connecting to, without involving your device’s GPS at all.

This isn’t a loophole or a gray area. It’s how these programs are designed to work. And it’s all legal.

Share

How We Got Here

In 2016, the FCC passed broadband privacy rules that would have required ISPs to get affirmative opt-in consent before using or sharing your browsing history and other sensitive data. Congress repealed those rules in 2017, largely along party lines, and President Trump signed the repeal into law. Because the repeal used the Congressional Review Act, the FCC is also blocked from issuing any substantially similar rule without future legislation specifically authorizing it.

That leaves a genuine regulatory gap. The FTC nominally handles privacy for most industries, but its jurisdiction over ISPs, which are classified as common carriers, is legally complicated. The practical result is that the major mobile carriers operate opt-out advertising programs, and customers are enrolled by default.

What Each Carrier Actually Does

Verizon runs two tiers. The Custom Experience program, which all consumer smartphone customers are enrolled in by default, uses information about websites you visit and apps you use to build interest profiles. Custom Experience Plus, which requires an opt-in, adds device location obtained from the Verizon network and Customer Proprietary Network Information, including call details. Your device location settings have no effect on it. The carrier doesn’t need your GPS because it uses the towers your phone is already connecting to.

AT&T runs a similar structure. The base “Personalized” program is on by default and uses demographic data, general location, and account usage to tailor ads. “Personalized Plus” requires an opt-in and is where AT&T collects web browsing data as your ISP, adds precise location, and shares it with third parties. Per AT&T’s own policy, both programs operate independently of your browser’s private mode and cookie settings.

T-Mobile runs the Magenta Advertising Platform. Its Do Not Sell or Share page states directly: “We may sell or share your personal information on this website or app.” T-Mobile’s Privacy Dashboard contains multiple toggles that are on by default, and the Do Not Sell toggle doesn’t automatically cover advertising programs you may have previously opted into. Those require separate action.

Then there’s Starlink, which until recently was the exception. As a satellite provider with a simpler business model, it had stayed out of the ad profiling game. On January 15, 2026, Starlink updated its global privacy policy to allow the use of customer data to train AI models, including sharing with third-party collaborators for their own independent purposes, unless customers opt out. Starlink clarified afterward that individual browsing history and destination IP addresses are not included. Account data, contact information, and usage metrics are.

What “We Don’t Sell Your Data” Actually Means

All three major carriers use some version of this language. Verizon states it doesn’t sell information from its Custom Experience programs to others for their own advertising.

What they do is build interest profiles and then use those profiles to power their own advertising platforms, which brands pay to target against. The data doesn’t move to a third party. The targeting capability does. That distinction matters considerably to the lawyers who drafted those privacy policies. It matters less to you as a subscriber.

While the 2017 repeal didn’t create this business model, it did clear the path for it.

Here’s What the Opt-Out Menus Don’t Tell You

Opting out of these programs stops the ad-tier profiling. It doesn’t affect the data your carrier collects to actually provide service. Call records, billing data, network diagnostics, the cell towers your phone touched today, all of that continues regardless of your privacy settings. What these opt-outs address is the separate commercial layer built on top of operational data.

There’s also a timing problem.

Read more

So it’s understandable if you overlook a new effort by New York State to regulate what you can use a 3D printer for. The problem is this new law would have repercussions far beyond 3d printers.

In fact, it’s another example of legislatures (backed by special interests) using a sympathetic cause to push for a privacy invasion.

Subscribe now

What This Law Is Actually Building

New York’s still-unfinished 2026-2027 budget contains a provision requiring every 3D printer sold in the state to ship with mandatory surveillance software. The stated goal is stopping people from printing untraceable “ghost guns” at home. In practice, this means that the 3D printer software will scan every print job against a government-specified algorithm and will refuse to execute anything it flags as a potential firearm component.

Whether that goal is legitimate is a separate conversation. What matters here is the mechanism being built to pursue it:

a government-specified prohibited-content list, embedded inside a consumer device at the manufacturer level, and enforced by criminal law.

It’s worth noting that New York isn’t alone. California and Washington are pursuing identical legislation in the same session. Which implies there’s a centralized push to enact these laws in friendly jurisdictions before wider deployment.

So far, most of the coverage of these bills has stayed inside the 3D printing community, focused on whether the algorithm actually works. That’s the wrong frame and not thinking big picture enough.

The larger concern is what gets established as legally acceptable, and which devices legislators decide to target next. Because the legal precedent set here can easily apply to other commonly owned devices.

What the Algorithm Actually Has to Do

A brief overview of 3D printer technology is helpful here to understand why 3D printers are the initial target.

3D printers work by following a script that includes thousands or even millions of tiny instructions that say things like “move left 2mm, extrude a little plastic, move right 3mm.” The printer executes these one by one, in order, with no idea what it’s making. It doesn’t know if it’s building a chess piece or a phone case. It just follows the list.

To comply with a law like the one proposed in New York, manufacturers would have to build software capable of analyzing that code in real time. The software would need to infer the geometry of the object being constructed, and compare it against a prohibited-shapes database. It would stop working if it matched a prohibited design.

Pilot tests found these algorithms triggered on 17% of non-weapon prints due to superficial geometric resemblance to firearm components. Things like L-shaped brackets and cylindrical housings. Basically anything that looks vaguely like a barrel or receiver to software with no ability to understand context.

The algorithm doesn’t work well enough and has a high false positive rate, which is a problem in and of itself. Similar things are happening with the AI technology automobile manufactures will soon be required to deploy in vehicles in the U.S. and EU. The tech doesn’t work well enough to meet the stated goal.

But whether the tech works or not is likely beside the point.

Share

What This Law is Actually Building

The surveillance apparatus required to block the 3D printing of firearm components is comprised of the following:

• A database of prohibited designs maintained by the state and updated at the state’s discretion, with no public process for contesting entries

• Mandatory firmware on a general-purpose manufacturing device that checks against that database

• Class E felony charges for possessing certain design files, even if you never print anything

• Criminal penalties for anyone who share those files with anyone the state hasn’t licensed.

The censorware doesn’t even have to work to cause harm. Creating a government-controlled blacklist baked into consumer devices, backed by criminal penalties is the harm. The technology is almost beside the point. The real goal is creating infrastructure to monitor and restrict consumer behavior, and the ghost gun argument is just how they’re selling it.

On the Ghost Gun Rationale

If you’ve read my coverage of age verification laws, the ghost gun rationale will feel familiar. (see here)

“Protect the children” is a political argument that is almost impossible to oppose publicly, which makes it an effective vehicle for pushing through surveillance infrastructure that would face real scrutiny if proposed on its own terms. Nobody wants to be the legislator who voted against protecting kids. The policy that gets attached to that rationale is almost beside the point.

Ghost guns serve the same function here.

“Stop people from printing untraceable weapons at home” is the kind of argument that can move quickly through a legislature, especially when it’s buried in a budget bill rather than debated as standalone policy.

The 3D printing community is fighting it on technical grounds, arguing the algorithm doesn’t work and the false positive rate makes it unworkable. Both things are true.

But a law doesn’t have to achieve its stated purpose to establish a precedent. What matters is what legal architecture gets built in the attempt, and whether that architecture is available for the next application once this one normalizes it.

Subscribe now

The “Dual-Use” Problem

“Dual-use” is a term used in military and export-control law, where it describes technologies with both legitimate civilian applications and potential weapons uses.

That term used loosely applies well in the 3D printer regulations context because the underlying logic is the same. Every legislature that passes a version of this 3D printer law is establishing that a consumer device with obvious legitimate uses can be required by statute to run government-specified content-filtering software, enforced at the firmware level. Criminal penalties are available for circumvention.

3D printers are the test case. They’re politically convenient because the user base is small and most voters don’t own one. The same statutory structure can be applied to any device a future legislature decides fits the same description.

The 3D printing angle is ultimately a distraction. Here’s what this actually looks like applied to devices you do own.

Routers

Your home router transmits web traffic that could, theoretically, be used to plan violence or coordinate criminal activity. A dual-use designation doesn’t require the device to be primarily used for harm. It requires only a plausible argument that it could be.

Under a router-targeting version of this template, your ISP or router manufacturer could be compelled to run state-specified deep packet inspection firmware, refusing to route traffic flagged by a government algorithm, with criminal liability for anyone who tries to disable it.

Laptop Cameras

Your laptop camera can be used to record things the state might someday want to restrict. So can your phone.

We already have a live version of this debate in the CSAM (child sexual abuse material) scanning context, where governments have pushed Apple and others to implement client-side scanning that checks your photos against a government database before you can upload them. The 3D printer law is that argument applied to manufactured objects rather than digital images.

General Equipment

A document scanner in a law office, a CNC router in a small machine shop, and a laser cutter in a school makerspace are all general-purpose tools that can produce outputs someone in a legislature might someday want to prohibit.

The legal template being built in New York doesn’t care which device it’s applied to. It needs a public-safety rationale, a device class the public doesn’t feel strongly about, and a state legislature willing to bury the provision in a budget bill.

The Manufacturer-Compliance Wrinkle

One thing that gets lost in the “government surveillance” framing is the state doesn’t run this software. Manufacturers do. And they do so under compulsion from the state, which is effectively getting the manufacturer to do their surveillance dirty work.

This is a feature, not a bug.

It gives the state the surveillance outcome without the accountability that would attach to a government-run program. The manufacturer takes the legal and reputational exposure. The state gets the compliance. Users get a device that reports their activity to a third party under terms they can’t negotiate, enforced by criminal law.

Where This Stands

New York’s budget is still being negotiated, and this provision could be stripped in conference. California’s AB 2047 and Washington’s HB 2321 are still moving. If any of these pass, the others get easier.

A passed law is a model. Legislators who want to look tough on ghost guns will cite the precedent, and manufacturers who’ve already built compliance infrastructure for one state will lobby for uniformity rather than a patchwork.

The 3D printing community is fighting this on technical grounds. Those arguments are correct. They’re also arguments about a narrow constituency. The precedent being set here goes far beyond 3D printing.

Subscribe now

Looking for help with a privacy issue or privacy concern? Chances are we’ve covered it already or will soon. Follow us on X and LinkedIn for updates on this topic and other internet privacy related topics.

Disclaimer: None of the above is to be deemed legal advice of any kind. These are *opinions* written by a privacy and tech attorney with years of working for, with and against Big Tech and Big Data. And this post is for informational purposes only and is not intended for use in furtherance of any unlawful activity. This post may also contain affiliate links, which means that at no additional cost to you, we earn a commission if you click through and make a purchase.

• Know your doxxing risk. DoxxScore gives you a personalized exposure assessment and action plan in under 5 minutes. Get Your Risk Score →

• Check out our new, free username generator to help you create unique usernames for different accounts. Reusing usernames is convenient, but terrible for your privacy. This tool makes it easy to create unique usernames on the fly.

  Share Secrets of Privacy

Her owner, Dennis Morida, did what anyone would do:

posted photos on social media and neighborhood apps asking for help.

Within hours, he received a call from someone claiming to be a police sergeant. Hazel had been hit by a car, the voice said. She was at a local vet, awaiting surgery.

A photo arrived showing what appeared to be Hazel injured on an operating table. The couple paid nearly $2,000. Then a strange thing happened - Hazel showed up next morning on her own at the house.

Turns out the photo was fabricated using AI tools and the real images Morida had posted publicly. The caller was never a police sergeant and Hazel was never hurt.

The whole operation, from monitoring the post to pulling the photos to generating the fake photo to making the call probably took minutes.

Subscribe now

What You’re Actually Publishing

What made this scam possible wasn’t the AI, which is just a tool. It was the information Morida provided for free.

A lost pet post is, structurally, a targeting package. Consider what it contains:

• a clear photo of the subject with enough detail to generate convincing fakes

• your phone number or a direct way to reach you

• your approximate neighborhood

• the breed and distinctive markings of the animal

• an unmistakable signal that you are emotionally compromised and willing to pay quickly to resolve the situation.

Scammers don’t need to guess anything. It’s sitting in a public post, searchable, broadcasting to anyone who happens to be watching.

It would be nice if this was just a handful of bad actors stumbling across posts. But it’s looking more like organized monitoring.

The Animal Compassion Team, a Fresno, California-based nonprofit, told local media they receive around 20 calls per day from pet owners reporting similar incidents. This is a volume that suggests systematic social media surveillance, not random opportunism.

The cases follow a consistent script. In December 2025, an elderly Fresno man received a message claiming his missing service dog, Chewie, had undergone surgery at a specific local veterinary clinic. The scammer sent AI-generated photos of Chewie appearing to recover from a procedure inside that facility, built from images the owner had shared online months earlier when Chewie first went missing.

Fortunately the man called the clinic directly before sending any money. The clinic confirmed they had never seen the dog.

Not everyone makes that call though.

Subscribe now

In March 2026, an Alabama man named James Laiacona posted about his missing Chihuahua, Tank, on a Monday. Tuesday morning, a caller told him Tank had been hit by a car and was in surgery, implying the procedure would stop without immediate payment. Laiacona paid $900 before the call ended. Tank was found safe later.

The AI image component doesn't need to be sophisticated. A photo of a specific dog's face placed in a generic surgery setting is enough to override rational thinking in someone who is already panicked, and that's really all it needs to do.

Share

The AI Isn’t the Story

Most coverage of these cases focuses on the image generation technology, as though that’s the novel part. TBH, these same scams could be done pre-AI with photoshop, though perhaps not as quickly.

The more useful observation is deeper:

this scam only works because public distress posts create reliable, detailed targeting opportunities at no cost to the scammer.

Lost pet posts are one instance of a broader pattern. The scam works the same way for any post that:

• simultaneously signals emotional vulnerability

• announces a problem the person would pay to solve

• identifies the subject clearly enough to generate convincing fakes, and

• provides a direct contact method.

AI tools just lowered the production cost of acting on that information to nearly zero.

Most protective advice focuses on recognizing the scam after contact has been made. However, the lost pet post itself is where the exposure happens, and there’s a way to ask for help publicly without broadcasting the details that make you targetable.

What to Share Publicly, and What to Withhold

The goal of a public lost pet post is to get recognized and reported by someone in your area. It doesn’t require providing everything a scammer needs to impersonate that scenario convincingly.

Read more

That’s not how it usually works. In fact, the most common version requires no special skills at all.

The doxxer just needs a name, some publicly available websites, and about 20 minutes. Top sources they look at are people search sites, property records, and old social media accounts. Data broker sites that aggregate all of it in one place are even better.

The important takeaway is that the information needed to doxx you is already out there. Someone just has to look and put the pieces together.

Subscribe now

Most people who care about privacy have done something about it. Switched to a different search engine, maybe. Stopped posting publicly as much. They’ve thought about it, which puts them ahead of most people, but thinking about it tends to produce a general sense of being careful rather than any real picture of what’s actually out there.

The gap between “I’m pretty private” and what someone could find about you in twenty minutes varies enormously depending on who you are and what you’ve done online over the past decade. Someone with a common name and no social media footprint has a different risk profile than someone with a decade of LinkedIn history, a public Instagram, and a home address on their business website.

The exposure also isn’t uniform across life circumstances.

People going through a divorce, changing jobs, or relocating often have vulnerabilities they haven’t stopped to consider. Attorneys, therapists, real estate agents, teachers, basically anyone in a public-facing role tends to be more findable than they realize, because their work requires a certain amount of visibility. Parents who posted about their kids through the 2010s have left a trail they’ve probably never looked at as a whole.

You can’t do much about any of this without first knowing where you stand.

What DoxxScore Does

DoxxScore is a self-assessment tool we built. It walks you through a five-section questionnaire covering seven risk categories, including search visibility, social media exposure, contact information accessibility and identity linkage. It then runs your email against known breach databases and calculates a personalized risk score from 0 to 100.

The output isn’t a generic checklist. It’s a prioritized action plan built around your answers, with difficulty ratings and time estimates for each step, so you know what to tackle first and what can wait. Delivered as a web report and a PDF sent to your email.

One-time cost of $19. No subscription, no recurring charges.

Why This Exists

The hardest part of improving your privacy isn’t finding advice. There’s no shortage of that.

Instead, the hardest part is knowing where to start when you don’t know how exposed you actually are.

DoxxScore answers that question first. Once you know your risk profile, the path forward gets a lot clearer.

If you’ve been meaning to get a handle on your digital exposure but haven’t known where to begin, this is a good place to start.

Take the assessment at doxxscore.com. Use discount code LAUNCH50 for 50% off (only 20 discounted spots, so don’t wait).

Questions about how it works, what the report looks like, or what goes into the scoring? Reply and ask.

Further reading on doxxing risk:

Meta wants training data for the AI agents it’s racing to ship.

A company spokesperson confirmed as much directly, saying:

the models need real examples of how people actually use computers, and that the best way to get those examples is to watch employees at work.

This is the third announcement like this in four months. Workplace activity is becoming AI training data, and most workers are still thinking about workplace surveillance the way they thought about it five years ago. That model is out of date, and here’s why.

Subscribe now

Three Pipelines, One Supply Chain

Three distinct streams are feeding into the same data supply chain.

The first is active collection from current employees. Meta is the highest-profile example. Any employer large enough to train its own AI models has an obvious incentive to start here, because in-house employee data is free and already flowing through company systems.

The second pipeline runs through contractors. In January, Wired reported that OpenAI's data vendor Handshake AI started asking its freelance contractors to upload real work products from their past and current jobs. Actual contracts, financial models, decks, and code repositories produced for other employers. The point of collecting these documents is to feed them into OpenAI's training data, where they become part of the model weights. Handshake provides a tool called "Superstar Scrubbing" to help contractors remove confidential information before uploading. The original employers and clients are not in the loop.

The third is the dead-company market. On April 16, a startup called SimpleClosure launched a platform called Asset Hub that helps shutting-down companies monetize what its CEO, Dori Yona, calls “operational exhaust.”

The full archive of a defunct company (years of Slack messages, Jira tickets, email chains, Google Drive folders) gets bundled and sold to AI labs as training material. Per Forbes, SimpleClosure has processed nearly 100 of these deals in the past year, with payouts ranging from $10,000 to $100,000 per company. A competitor called Sunset is doing the same thing.

The first company to go through this at scale was cielo24, a transcription business that shut down after thirteen years. Its former CEO, Shanna Johnson, sold every Slack message, internal email, and Jira ticket for what she described as hundreds of thousands of dollars.

Share

It Isn’t Just Meta, and It Isn’t Just Engineers

A reasonable response at this point is that these are three tech-industry stories about tech-industry companies, which doesn’t necessarily say much about the average worker. I don’t think that holds up, and a viral video from 2024 is a decent way to show why.

The post hit four million views because people found it viscerally strange.

But the software running in that coffee shop wasn’t custom-built. It was sold to the cafe by a vendor, which means the same vendor is selling it to other cafes, other retail operations, other small businesses.

Each of those installations generates data about how humans interact with physical workspaces, which happens to be exactly the kind of embodied-workflow training data AI labs are short on. And the worker making the coffee has even less leverage than the Meta engineer to negotiate what happens to any of it.

The Breach Problem Nobody Is Pricing In

Every company involved in this supply chain says it strips personally identifiable information before the data changes hands. SimpleClosure says it, OpenAI says it, Meta says it. The claim is that your name, email, and phone number come out before the archive goes to the buyer.

That’s the wrong thing to focus on.

A Slack archive with names removed still contains your writing style, your project details, your references to specific coworkers and clients, your internal jokes, and the content of what you actually said. ‘Anonymized’ doesn’t mean what it did 50 years ago. For nearly 20 years, it’s meant something closer to ‘lightly disguised’ when in the right (wrong?) hands. More to the point, the content itself is the sensitive material.

• A complaint about a manager.

• A disclosure of a medical condition.

• A complaint about a client.

• A half-formed opinion about a competitor.

These don’t need your name attached to be damaging, and PII scrubbing doesn’t touch them.

There’s also a concentration problem.

An AI lab holding archives from a hundred defunct companies is a bigger breach target than any one of those companies ever was. If that lab gets breached, the fallout hits every former employee of every source company at once, years after they’ve moved on. The risk isn’t contained by the original employer closing its doors. It’s been handed off to a third party who now has every reason to keep the data and every reason to keep buying more.

Workplace Monitoring Used to Have An End Point

What feels different about this moment is that the purpose of workplace monitoring has shifted.

Traditional workplace monitoring existed to inform management decisions.

Was Kelly productive enough? Should she be promoted? Should the team be restructured?

The data was analyzed inside the company, for the company’s own use. It was invasive, but it was somewhat bounded.

What’s happening now operates on a different level.

Workplace activity is being harvested as a commodity that sells on an open market. The data doesn’t stay within the company that collected it. It feeds models that get deployed into thousands of other workplaces. The worker who clicks through a dropdown menu on a Meta laptop today is effectively helping train the AI that will, in two or three years, replace some other worker at some other company. And that worker hasn’t been offered anything in exchange.

There’s no opt-out in most of this. Most employment agreements don’t address it at all (yet). The IP assignment language employees signed when they took their jobs was written on the assumption that the employer might use work product internally. Nobody was anticipating the secondary market in employee work product.

Your Defensive Playbook

The rest of this piece focuses on what you can actually do, because there are meaningful moves available.

Most employers haven’t worked out their own policies on this yet, which means there’s a window of time where individual pushback can shape outcomes. And even solo workers without any collective bargaining power can meaningfully limit their exposure, if they know what to look for.

Read more

Instead, they open with your actual profile photo, your real follower count, and a thumbnail of your most recent post. Everything in the email looks legitimate because the attacker pulled your public data before sending you anything.

This comes from a phishing campaign documented this week by Malwarebytes that pulls real YouTube channel data to build a personalized copyright scare page. The moment you land on it, the page already knows your avatar, your subscriber count, and your most recent video. If you enter your credentials on the fake Google sign-in it serves up, you lose your entire Google account.

And while this particular scam focuses on YouTube, it can equally apply to any number of other platforms, from Facebook to Instagram to Substack. Creators are especially at risk.

Subscribe now

This scheme runs like a global hacker franchise. Multiple attackers share the same phishing kit, each running their own campaigns with their own affiliate ID embedded in the links. One operator can swap out the destination domain at any time to evade takedowns. That means the infrastructure stays live even when individual phishing pages get flagged.

There’s also a detail that says a lot about how professionally these operations are being run. The scam automatically screens out any channel with more than three million subscribers, instead showing those creators a clean bill of health rather than a scare page. The reason is simple if you think about it:

Large creators are more likely to have security staff, YouTube contacts, or the visibility to get the operation shut down quickly. Smaller creators, who have less protection and just as much to lose, are the higher value target.

The reason this scam works is that YouTube has a public API. In case you think this is just a YouTube problem, public APIs are not unique to YouTube. Any platform that displays your profile photo, follower count, and recent activity to the world gives an attacker the raw material to build a personalized scare page.

Facebook business pages, LinkedIn profiles, Etsy storefronts, Substack publications all expose enough public data to run the same scheme. A fake “your Facebook page has been flagged for removal” notice showing your page name, your follower count, and your most recent post would be just as convincing to a small business owner as the YouTube copyright notice is to a creator.

Voice cloning has crossed what researchers at the University at Buffalo describe as the “indistinguishable threshold.” Some major retailers are already reporting over 1,000 AI-generated scam calls per day.

The family emergency call, the one where you hear your daughter’s voice saying she’s been in an accident, is no longer a theoretical risk. It’s running at scale, and it runs on a few seconds of audio pulled from a public video or voicemail. Experian’s 2026 fraud forecast describes intelligent bots carrying out automated family-member-in-need scams with a sophistication that wasn’t possible even two years ago.

Both of those attacks share the same logic as the YouTube scam. They start with real data about you, pulled from public sources, and use it to make the approach feel legitimate before you’ve had a chance to think.

There’s a separate but related story worth knowing about too. A credential-stealing malware called Omnistealer revealed the other day hides its attack code inside blockchain transactions on networks like TRON and Binance Smart Chain. Because blockchains are append-only, those malicious snippets are effectively permanent once they’re mined into a block. You can take down a malicious GitHub repo or revoke a domain, but you can’t roll back TRON to remove a few hundred bytes of malware staging code.

The campaign has been linked by on-chain forensics to (no surprise!) North Korean state-sponsored actors. It spread through fake developer job offers on LinkedIn and GitHub where technically skilled targets handed what looked like a routine freelance project.

While the personalization angle is less pronounced here, what Omnistealer illustrates is the other half of the same shift:

sophisticated fraud operations are not only getting better at targeting people, they’re getting better at making their infrastructure difficult, if not impossible, to shut down. The attacks are more convincing and more resilient at the same time.

That combination is what makes this moment different from previous waves of online fraud.

Share

For most of the history of online fraud, the attacker’s main constraint was personalization. A phishing email that addressed you by name was already considered sophisticated. And a scam call that knew where you worked was alarming.

Building a scam that looked genuinely specific to you (your face on the page, your voice in the audio or your channel data in the copyright notice) required real effort and real resources. That constraint kept the scam volume down. It limited who could run these operations and how many people they could reach.

That constraint is gone, and it’s not coming back.

The YouTube copyright kit fetches your real data automatically from a public API. Voice cloning tools require a few seconds of audio, freely available for most people who have ever posted a video or left a voicemail. The personalization layer is now a commodity. Anyone with modest resources can build an attack that feels like it was made specifically for you, because technically, it was.

What legislators and most security advice haven’t caught up to yet is that the old detection signals no longer work. You were told to look for misspellings, generic greetings, implausible urgency. An email that called you “Dear Customer” was a tell. None of that applies anymore. The new signals are different, and defending against them requires a different posture.

Subscribe now

How to Defend Yourself

The defense move here isn’t about being more skeptical of suspicious-looking messages. That’s because messages won’t look suspicious. The defense is structural, which means developing habits and configurations that hold up even when the attacker has already done their homework on you. Here’s how to do that.

Read more

Yet their faces ended up training a facial recognition system that now sells to police departments, government agencies, and the military.

How did that happen?

Subscribe now

The U.S. Federal Trade Commission (FTC) alleged that OkCupid shared users’ photos, location data, and demographic profiles with Clarifai, a “computer vision company”. They did so without user consent and in direct violation of its own privacy policy. OkCupid’s founders were personally invested in Clarifai, and one of them sent the photos from his personal email account, bypassing any corporate oversight.

No contract governed the data handoff. And no restrictions were placed on what Clarifai could do with the misappropriated data.

Clarifai ended up using the images to build technology capable of identifying the age, sex, and race of faces. The company has since secured contracts with the U.S. Air Force Research Laboratory and partnered with defense firms supplying AI to the Army’s intelligence community.

So dating profile pictures became raw material for defense contractors. The people in those photos had no idea, and were never asked.

Share

The FTC settled the case in March 2026.

The good: The settlement permanently bars Match Group and OkCupid from misrepresenting their data practices and requires compliance reporting for a decade.

The bad: Match Group did not admit wrongdoing.

The ugly: The settlement carries no financial penalty. And the FTC did not require Clarifai to delete any of the data it received.

Twelve years of willfully misusing people’s images, and the regulatory consequence is a promise to tell the truth going forward.

The OkCupid Story Isn’t Really About OkCupid

Most people process news like this as a company-specific scandal. OkCupid was reckless with customer data, OkCupid got caught, but you don’t use OkCupid, so you’re fine.

That’s the superficial take. As is usually the case with these stories, there’s a deeper level.

Every site where you’ve uploaded photos, whether LinkedIn, Facebook, Instagram, a fitness app, a medical portal, or a real estate platform, operates under a privacy policy that its legal team wrote. And they wrote it to maximize the company’s flexibility, not yours. I’ve written before about why reading those policies is a waste of time. 👇

What the OkCupid case illustrates is the specific mechanisms that makes privacy policies useless:

Privacy policies are often inaccurate, either out of negligence or intentional bad behavior (as appears to be the case with OKCupid). Or a company can change the policy at any time, usually without notice, to make their privacy infringing practices legit. And in almost all cases privacy policies are drafted to provide broad rights and discretion to use your data, which means most people don’t know what they’re supposedly consenting to.

Unfortunately the OKCupid incident isn’t a one-time failure by a company with bad intentions. It’s a repeatable playbook.

Many people now understand that tech companies design features specifically to get you to hand over your face voluntarily. It’s been going on since the dawn of the internet but AI companies have taken it to a whole new level. The best example is when OpenAI/ChatGPT pushed an anime filter, the Ghibli-style portrait, which allowed users to see themselves as a cartoon.

Users got a quick dopamine hit from doing that. And OpenAI received valuable data to bolster their facial recognition capabilities without paying anything. That’s about as lopsided of a trade as you can find.

OkCupid’s founders didn’t need a clever feature to capture valuable biometric data because they already had three million photos sitting in a database. But the outcome is the same:

your face, in a training set, with no restrictions on what gets built from it.

The enforcement consequence for any of this is, apparently, a compliance checklist. Which shouldn’t be surprising to anyone following these incidents. Penalties handed down by regulators are usually small compared to company revenues. Businesses then calculate the cost of protecting (or not protecting) your privacy, and when the answer is zero (or near zero) dollars in penalties, the math doesn’t work in favor of your privacy.

For photos specifically, the only meaningful control you still have is upload discipline. Review which apps have access to your Google, Apple, or Facebook account, and think carefully before handing your face to the next platform that makes it seem fun or convenient. The photos you never put up can’t be handed to anyone.

You can't un-upload a photo, and you can't control where it goes once a company has it. Knowing that your photos can move from a dating app to a defense contractor through a personal email and a handshake should change how you evaluate the next platform that asks for your face. While the next platform asking for your photo isn't OkCupid, the incentive structure is identical.

One more thing: I've been sharing the behind-the-scenes of building DoxxScore over on Substack Notes. Things like the thinking behind the product, what I've learned about digital privacy along the way, and where it's headed. If that interests you, a sample post is below. DoxxScore goes live next week, so stay tuned for more information. ⌛

Subscribe now

Looking for help with a privacy issue or privacy concern? Chances are we’ve covered it already or will soon. Follow us on X and LinkedIn for updates on this topic and other internet privacy related topics.

Disclaimer: None of the above is to be deemed legal advice of any kind. These are *opinions* written by a privacy and tech attorney with years of working for, with and against Big Tech and Big Data. And this post is for informational purposes only and is not intended for use in furtherance of any unlawful activity. This post may also contain affiliate links, which means that at no additional cost to you, we earn a commission if you click through and make a purchase.

• Privacy freedom is more affordable than you think. We tackle the top Big Tech digital services and price out privacy friendly competitors here. The results may surprise you.

• Check out our new, free username generator to help you create unique usernames for different accounts. Reusing usernames is convenient, but terrible for your privacy. This tool makes it easy to create unique usernames on the fly.

  Share Secrets of Privacy