Tag: privacy

Taxpayers Federation heads to Supreme Court to fight limits on taxman’s power to demand your emails and texts

The Canadian Taxpayers Federation is intervening in a Supreme Court of Canada case that it says will decide how far government agencies, including the Canada Revenue Agency, can go in demanding Canadians’ private records.

“The government already takes enough of your money. It shouldn’t get a blank cheque to go snooping through your private emails, text messages and personal information too,” CTF general counsel Devin Drover told Rebel News.

The case is Ontario Securities Commission v. Binance Holdings Limited. In 2023, the OSC ordered the cryptocurrency exchange to turn over every communication about Ontario or Canada sent by any of its directors, officers, employees, contractors or consultants since January 1, 2021, with no limit on subject matter.

The Court of Appeal for Ontario struck down the demand in November 2025, calling it “staggering in its breadth.” The court ruled the order violated section 8 of the Charter, which protects against unreasonable search and seizure, because the regulator had no reasonable foundation to believe the documents were relevant to its investigation.

The OSC is now asking the Supreme Court to replace that test with a looser one, under which an agency could demand any records “rationally connected” to its inquiry. According to the CTF, the OSC’s own filings say the ruling will affect the CRA’s power to demand records under the Income Tax Act.

The CTF argues that in a tax audit, almost any record a person holds can be tied to their income, so a lower standard would hand auditors near-unlimited reach.

“Just because some government bureaucrat wants to dig through your private life doesn’t mean they should have the power to do it,” Drover said.

He pointed out that Binance, a multinational company, spent more than two years before three different bodies before any court ruled on its Charter argument.

“Most Canadians don’t have an army of lawyers or deep pockets to fight back when government agencies overstep their authority. That’s why we’re taking this fight to the Supreme Court,” Drover said. “The government needs to be reminded that Canadians have constitutional rights, and those rights don’t disappear just because the taxman comes knocking.”

The case lands as Ottawa moves to toughen the CRA’s hand. According to the CTF, the Carney government’s budget bill, C-31, now before a House of Commons committee, would let the CRA fine taxpayers $50 a day, to a maximum of $25,000, for failing to fully answer an information request.

“If the Supreme Court lowers the bar in this case, it lowers it for the taxman too,” Drover said in a statement. “A tax auditor could demand years of a small business owner’s emails and texts on a hunch, and Ottawa wants to fine people $50 a day until they comply.”

The Supreme Court has not yet set a hearing date.

Keep reading

Meta Ordered to Pay $25 Billion Penalty for Misleading Facebook Users About Data Privacy

A New Mexico judge on Wednesday ordered Meta to pay a $25 billion penalty for misleading Facebook users about data privacy.

The judgment is related to the Cambridge Analytica data privacy scandal from nearly 10 years ago.

The jury found that Meta had more than 40 million violations of New Mexico’s unfair practices act.

CNBC reported:

Meta was ordered to pay $25 billion in penalties by a New Mexico court on Wednesday as part of a data privacy case that stemmed from the company’s Cambridge Analytica scandal from nearly a decade ago.

The penalty, revealed in a court filing, comes after a jury in a Santa Fe courthouse found in September the social media giant liable for misleading state citizens about how it safeguards and collects user data and prevents harmful information from flourishing on its services.

Although the jury concluded that Meta had over 43 million violations of the state’s unfair practices act, with each transgression carrying a civil penalty as high as $5,000, a New Mexico judge was responsible for determining the ultimate fine. The Wednesday filing showed that the state was awarded $219.5 billion, but the penalty was ultimately reduced to $25 billion.

“The extraordinary number of willful violations found by the jury, the duration and repetition of the conduct, the breadth of subjects on which violations occurred, the involvement of senior Facebook leadership, the size of New Mexico audiences reached, and the clear intentional and systematic nature of Facebook’s repeated misstatements established in the trial record support the highest level of penalty allowed by the New Mexico Unfair Practices Act – $5,000 per violation found by the jury,” New Mexico district court judge Francis Mathew wrote in the filing.

The judge added that interest on the penalty shall accrue at the rate of 15% each year until the fine is paid off in full.

In August, a court ordered Meta to pay $567 million into a fund over child harm.

New Mexico Judge Bryan Biedscheid compared Meta to air pollution and called it a “public nuisance.”

“Although Meta is not alone in this regard, its social media platforms are a significant contributing factor to the current mental health crisis among New Mexico’s youth established by the substantial evidence in this case,” Judge Bryan Biedscheid wrote in the ruling over the summer, CNBC reported.

Keep reading

Your Browser Might Be Spying On You To Change The Price Of Items You Purchase

he more companies know about you, the more you can be exploited.

Your data profile is constantly being updated when you browse, shop online, or use your credit card. Websites and apps track your location, device, searches, purchases, shopping carts, mouse movements, and how long you look at a product.

Your data profile includes information from brokers, loyalty programs, credit records, advertising networks, and other platforms. AI groups you by estimating income, interests, and vulnerabilities.

The Federal Trade Commission (FTC) began investigating in 2024, issuing demands for information to eight companies offering surveillance pricing products: Mastercard, Revionics, Bloomreach, JPMorgan Chase, Task Software, PROS, Accenture, and McKinsey & Company.

In January 2025, the FTC released preliminary findings showing a “hidden ecosystem of data brokers, digital platforms, and other intermediaries that specialize in monitoring and selling user data.”

The findings showed companies had access to extraordinarily detailed information. The FTC found a hidden ecosystem with at least 250 clients “that sell goods or services ranging from grocery stores to apparel retailers.”

Price manipulation is usually not obvious and can be quite sophisticated. Companies can withhold a discount, place expensive products at the top of your search results, or show a financially desperate customer a convenient yet costly financing option.

Investigations Show How Deep This Goes

The Princeton Review was caught charging between $6,600 and $8,400 for the same tutoring package based on customers’ ZIP codes. Asian residents were 1.8 times more likely to receive the higher price, including those in lower-income neighborhoods.

The company conveniently claimed it was based on business conditions. Maybe, but this demonstrates how personalized pricing can mimic discriminatory targeting.

Then we have Instacart “experimenting” with price differences on groceries. A Consumer Reports investigation involving more than 400 shoppers found identical grocery items were offered at different prices to different customers shopping at the same stores at the same time. Nearly three-quarters of the products tested showed price variations of as much as 23 percent.

The behavior isn’t just in the United States. The European Commission found deceptive practices by SHEIN, Apple, Temu, Vinted, Viagogo, Tinder, PayPal, Shopify, Amazon Prime, and more. Practices ranged from fake discounts (i.e., pretending to offer better deals by showing price reductions that are not based on the actual “prior prices”) to pressure selling (i.e., putting consumers under pressure to complete purchases using tactics like false purchase deadlines).

Paired with your personal data, these practices could be highly effective at getting you to pay more.

Keep reading

Meta Muse Exposes Users’ Personal, Business Secrets When They Share Conversations

Security researchers say Meta’s Muse AI assistant exposed thousands of users’ shared conversations because conversation titles were placed in subdomains that could be discovered through public DNS records. Meta has since suspended the sharing feature while it considers making changes. Ars Technica reports:Like many online services, Muse has allowed users to share searches, conversations, images, and similar content with other people. Such share features usually involve clicking an option to create a unique URL that anyone can use to load a page hosting the content. To keep potentially sensitive information from being accessible to unintended people, the URLs typically contain a long sequence of text that can’t be easily guessed.

Muse, which Meta CEO Mark Zuckerberg said last month was “built from the ground up for privacy and security,” seems to take the same precautions. But a central design decision for constructing URLs has made the links easy to discover. As a result, researchers from security firm Claroc said they were able to enumerate 6,800 links Muse users created for sharing conversations with others. After opening a few hundred of them, the researchers found information that was clearly not intended to be publicly available… […]. “If you had asked us beforehand, we would have guessed that gathering these would take real effort,” the researchers wrote. “It took one query.”

[…] The easiest way to discover the URLs is to perform a passive DNS search through one of many available commercial services. Passive DNS records store the historical resolution of domain names to IP addresses, as well as nameserver, and mail-server records over time. Passive DNS systems typically collect DNS responses from sensors positioned at recursive DNS resolvers or other infrastructure. A passive DNS record is generally created when a monitoring system observes a DNS response. In the case here, once the intended party clicks on the share link, the DNS information is recorded in a searchable database.

Claroc researchers were able to discover the Muse share links because all of them use the domain name cf.metaaiusercontent.com. Discovery is further made easy by the decision to add the conversation name to the URL, along with a long string of text. Simplified examples of such links are home-sale-budget-9f21c8a3.cf.metaaiusercontent.com, q3-revenue-review-7b1e42f0.cf.metaaiusercontent.com, and loan-application-draft-a4c9e2.cf.metaaiusercontent.com. It’s this last design decision, putting the conversation title in the subdomain rather than in the URL path, that makes public discovery possible.

Keep reading

Canadian YouTuber builds ‘Flock-like’ camera to exclusively track police vehicles, gets a visit from police — officers visit his home to express privacy concerns

A YouTuber has received an unexpected visit from the police over an automatic license plate recognition (ALPR) camera he built to specifically track police cars, using the same technology law enforcement has infamously used to track ordinary citizens. In a video posted to his channel on October 7, Anthony Sistilli says two police officers showed up at his doorstep on September 20th to ask questions about the device, asking what his intentions were with the project.

Sistilli, a Canadian software engineer and YouTuber, pointed out the irony of the officers’ concerns, explaining that they mirror the privacy concerns of ordinary citizens who are growing increasingly weary of the recent spike in blanket surveillance brought about by a mass installation of ALPR cameras. Flock Safety, a U.S. public safety technology company, recently scaled its centralized national surveillance network to over 120,000 cameras operating across 49 states, according to the company, capturing billions of vehicle scans every month.

The development sparked widespread public backlash, with critics arguing that Flock has quietly built a massive government surveillance dragnet without a public vote or federal oversight, since any police department on the network can search across state lines. Security researchers later discovered the network included 335,701 Flock cameras and created a “Flock Surveillance Map,” exposing their locations.

Similar ALPR camera surveillance networks exist in Canada, where Sistilli resides, prompting him to build his own device, but this time, encoded to exclusively track police cars. He detailed the build in several TikTok videos, describing it as “a personal Flock surveillance camera to Flock the Flockers.” He then posted a video of himself using the device in real life. The video brought Peel Regional Police, the local law enforcement serving Sistilli’s city, Brampton, Ontario, to his doorstep two weeks later.

Keep reading

The Law Can’t Keep Up with Flock’s AI Surveillance

It’s a windy day on the shore of Lake Michigan, and Maria is headed downtown from her home in Dolton, Illinois. As she has done several times this year, Maria plans to attend a peaceful protest at Grant Park against federal immigration policies. She has never been arrested and has even chatted cordially with police officers and federal agents stationed at previous events.

Agents working this protest have been instructed by their supervisors to be on the lookout for possible illegal immigrants and anti-government agitators. The agents activate a surveillance plan. Maria first encounters it shortly after pulling out of her driveway. As her red Honda Accord passes an automated license plate reader (ALPR), it captures an image of one of her bumper stickers with a pro-immigration slogan: “No human being is illegal.” The ALPR has been trained to recognize text such as bumper stickers, sending an automatic alert to a central computer. In turn, the computer sends signals to nearby artificial intelligence (AI)-enhanced “smart” street cameras to monitor the car’s movements.

A camera hanging from the W 71st St. overpass zooms in and captures an image of Maria’s face. The camera sends another ping to the computer, which identifies the driver as Maria (with, say, 91 percent confidence) based on her driver’s license photo and recordings of her at past rallies from officers’ body-worn cameras. The computer collects other data known about Maria from public records, including her registered nursing license. From the license, it pulls Maria’s home address. Next, the computer connects that information with recent police reports from the area. Nothing serious, but the report includes several mentions of pro-immigration graffiti on an abandoned building three blocks from where Maria lives. Possibly more significantly, the computer uncovers court records from 20 years ago, referring to a family dispute after Maria’s father was deported from the United States.

Keep reading

Danish Population Register Breached, Leaking Data of Nearly Nine Million People

Hackers are suspected of having cracked the Danish government’s national database containing the personal information of nearly nine million people, potentially exposing them to fraud or identity theft.

Copenhagen’s Ministry of Research, Education and Digitalisation said on Monday that the Central Register of Persons (CPR), the national civil registration database containing personal information for millions of citizens, has been compromised.

In Denmark, all legal residents have a unique 10-digit civil registration number, used to access public services, healthcare, banking, and taxes, and to store information on each citizen, including name, date of birth, address, marital status, citizenship, religious affiliation, and parentage.

The government said on Monday that unidentified people used a Danish business’s access to the system to wrongfully obtain the CPR numbers, names, and addresses of around 8.8 million people, the public Danish Broadcasting Corporation (DR) reported.

In a briefing on Monday, government minister Christina Egelund said that it was too early to tell whether it was a cyber attack or whether foreign state actors were involved in the leak.

“We are not ruling out any clues in the ongoing investigation. Nor that it may have an international character,” she said.

Egelund added that the government will review the entire CPR system and implement “adjustments and transformations” to re-establish security.

Keep reading

New Mexico Found a Way to Fine Platforms for Speech It Didn’t Delete

A civil jury has found Meta liable for violating New Mexico’s Unfair Practices Act, and now the judge is being asked to order the company to pay between $35 billion and $40 billion.

At a hearing on October 1 in Santa Fe, special prosecutor Randi McGinn asked Judge Francis Mathew of the First Judicial District Court to order Meta to pay this amount, while a lawyer for the social media giant said such a penalty would be “an astronomical” one, violating “a host of constitutional provisions.”

Meta is being punished for making false statements about user privacy, and also for not removing “hate speech” and “misinformation” fast enough.

The verdict was delivered on September 25, finding Meta had made 26 false or misleading statements, resulting in nearly 43.9 million violations of the state’s Unfair Practices Act.

This would translate to a maximum of $5,000 per violation, or $219 billion in all – more than the $206 billion the tobacco industry had to pay in a settlement in 1998. The state asked for about 20% of this amount.

The number of violations was arrived at by counting the number of people in New Mexico, and the number of Facebook users in the state, and then multiplying these numbers by the number of times Meta made false statements in news outlets and on its own platforms.

The state had to show only that harm was likely, not that it actually occurred.

Meta is being punished for lying about how it handled user data, and the Cambridge Analytica scandal that saw a third party harvest data from about 87 million profiles. The company is also being punished for not removing “hate speech” and “misinformation” fast enough – and the number of violations in this category is about a quarter of the total.

The New Mexico case is not the only one where Meta is being forced to pay up – in March, a Santa Fe jury ordered it to pay $375 million in a case involving child safety on Facebook and Instagram, and in August, the judge in that case added another $567 million for a youth mental health fund.

In August, 47 states reached a settlement with Meta, along with other social media companies, that will see them pay $17 billion. Judge Mathew mentioned this during the October 1 hearing, saying that due process suggests he should opt for a much lower amount than what the state of New Mexico is asking for.

During the hearing, Meta’s lawyer Matt Nicholson described the case as “about 26 statements over 11 years” and said that the state “made absolutely no showing that anyone in the state of New Mexico ever saw them, relied on them or were harmed by them in any way.”

McGinn countered that “the one thing you didn’t hear from counsel is an apology.”

Keep reading

Privacy concerns put smart glasses under scrutiny as Norway seeks temporary ban

A trip to the park. A day at the beach. A workout session at the gym. All in public spaces where smart glasses can snap photos, record conversations or stream video online — without people in the line of their lenses and microphones knowing about it.

Norway’s government wants to get a handle on both the promise and peril of AI glasses and is proposing that parliament enact a temporary ban on them in some places.

It’s the latest sign of growing concern in many countries about new technologies that are fundamentally changing the way people live. Some governments have banned the use of social media by children and young teens.

Norway’s government said the proposal for the temporary ban will be made to parliament, the Storting, “as soon as possible.”

AI glasses fan concerns — from showers to seashores and beyond

A key question is where to draw the line.

Norwegian authorities say a ban on the use of smart glasses could apply to places where “privacy is particularly important,” like healthcare facilities, or fitness centers with changing rooms and showers. A major focus is spaces where children congregate, such as schools, kindergartens, playgrounds and youth clubs.

But it could extend to public concerts and sports events, plus parks, beaches, museums and shopping centers.

A temporary ban would give authorities time to decide what types of devices might be affected, and debate whether permanent regulation is needed. The government was quick to note that it was not proposing a total ban and said such devices should still be allowed in some places and for private use.

The government also said it was considering exceptions to a ban for vulnerable groups, so that “socially beneficial uses” of smart glasses could be permitted in some circumstances.

Privacy advocates hail Norway’s move

Adam Smith, a technology advocacy officer at Britain-based Privacy International, said Norway’s move was “a welcome protection against big tech’s greedy attempts to extract ever more data, often in absence of any thought for the privacy or rights of others.”

“No reality exists in which people expect to be secretly surveilled going about their daily lives,” he said.

One effort to rein in the use of AI glasses has run aground — in the home of Silicon Valley.

California’s governor last week vetoed legislation that would have penalized the use of smart glasses to record people without their permission in places like changing rooms, doctor’s offices and other spaces people generally consider private.

Keep reading

DOJ Issues Requests For Documents to ERIC and Zuckerbuck-Funded CEIR Over Sharing of Private Voter Data

Last month, The Gateway Pundit reported that Department of Homeland Security Secretary Markwayne Mullin had sent a letter to Attorney General Todd Blanche urging him to renew calls for investigations into barcode/QR code voting systems and the Election Registration Information Center (ERIC) and its handling of sensitive motor-vehicle data.

DHS officials had previously met with the DOJ under then-Attorney General Pam Bondi in September 2025 regarding these concerns.  DHS’s previous concerns did not seem to produce any sort of resolution, legal determination, or any meaningful action.

Now, under recently confirmed Attorney General Todd Blanche, the Department of Justice has sent two letters requesting information related to the DHS concerns— one to ERIC and one to the Center for Election Innovation and Research (CEIR).

The DHS letter outlines concerns that ERIC may have violated the Driver’s Privacy Protection Act (DPPA) by providing drivers’ private data to the CEIR.  CEIR and ERIC both claim that this is a “permissible use” outlined in the DPPA and that the data was used for research.

The DOJ letter to ERIC states:

ERIC has maintained that its use of DPPA-protected personal information falls under a statutory permissible use.  But courts have construed exceptions to the DPPA’s protections narrowly, and the membership agreement’s vague references to “research projects” and “responding to requests for information from third parties” do not appear to be tethered to the DPPA’s limited permissible uses.  Even apart from the issue of disclosure to third parties, the scope of ERIC’s own use of DPPA-protected personal information remains unclear.  Although using such information for furtherance of government functions may be a permitted use, using protected information for certain partisan purposes is not a government function and is thus not permitted under the DPPA — regardless of whether a state consents.

Keep reading