Tag: privacy

Your Car Is Sharing More Private Data Than Your Smartphone. Who’s Getting It?

Modern vehicles, like every other technology device we own, from smartphones to fridges and even dog collars, are connected to the internet 24/7. They learn from us, know things about us, and most of the time use that information to make our lives easier. Cars, specifically, collect vital driving and behavior data that is borderline impossible to opt out of if you want to use your vehicle’s modern convenience features. And a new study recently found that your sensitive information (some of which isn’t even car-related) is being shared with far more parties than you realize.

The only way you’ll be surprised by what you’re about to read is if you’ve been in a coma for the last decade or two. But even for those of us who are mildly aware of how the technology we rely on every day interacts with us and the data we generate, this recent study by Boston’s Northeastern University in partnership with Consumer Reports will make you raise an eyebrow—several times.

The study covered 21 vehicles of 19 different brands (listed below) and 30 companion mobile apps that process and handle user data.

You can peruse the 18-page paper here, but you can also see the main takeaways below:

  • Companion Apps Share Data That Goes Beyond Car Stuff: 70% of companion apps contacted more than five unique ATA (advertising, tracking, analytics) domains, typically sharing location, timing, and other data packets. For most test vehicles, adding the automaker or third-party (usually pre-installed) app at least doubles the number of ATA companies exposed to the owner’s data. The Envista and Nissan Ariya, which were nearly silent on their own, each reach 20+ ATA companies once the app is counted. myCadillac contacted 51 ATA domains.
  • How Many Third-Party Apps Your Car Contacts Wildly Varies: Over Wi-Fi, vehicles contacted at most four first-party domains but averaged about 9 integrated third parties. The Tesla Model 3 contacted 34 ATA domains and the Cybertruck 23, while the Mercedes EQS and Buick Envista contacted no third parties. Thirteen of the 21 vehicles contacted Google ATA domains, including ones like doubleclick.net that aren’t needed for core services. Vehicles with Android Automotive and Google services contacted many more trackers, and even sibling brands differed; oddly enough, the Envista, Lyriq, and Blazer did not behave in the same manner.
  • Some Apps Share Your VIN With Vendors, Something Not Even Your Smartphone Can Do: Seven apps (19 of 21 cars) transmitted personal information to ATA third parties: all four GM apps, HondaLink, Lincoln, and MyNissan. VINs were the most common, sent to recipients including Google, Microsoft, and Meta. The worry is that a VIN plus an email, phone number, or location lets an ad company link a specific person to their browsing and purchase history. The study also highlights that a VIN can’t be reset the way a phone’s advertising ID can. Also, I just published a blog this week about how I enjoyed Honda’s infotainment with Google Built-in, and cracked a joke about the price I am willing to pay for convenience.
  • OEMs Mostly Pass the Buck to Their Partners and Vendors: Of 17 manufacturers contacted for the study, 14 responded. All said their vendor contracts covered data flows. Five blamed embedded browsers in their apps, and seven said reading third-party terms is the consumer’s responsibility. Of course, if you opt out or simply don’t use the features, then you wouldn’t be utilizing your car to its full potential. Tesla warned about reduced functionality or inoperability, while Rivian warned about disabled navigation and over-the-air updates. The privacy policies disclosed that data may go to third parties but not which ones or why. Only Honda changed course. It had Amplitude delete the location data it received and stopped the app from sending it. Go Honda.
  • Gathering This Data Wasn’t Easy: Even if you only use the official apps pre-installed in your car, some of these may connect to your phone and ultimately open your browser. Once it does, the whole flow of data changes because it follows your phone’s browser settings, not your car’s. This means your car is now receiving cookies and browsing data and sharing them in ways you weren’t aware of or expected.

Keep reading

EU Piracy Watch List Targets YouTube Downloader and VPNs

The European Union (EU) continues to be a major world player in the war on copyright infringement, and the next salvo is the EU’s updated Counterfeit and Piracy Watch List.

Rights holders have been busy submitting their input, and the European Commission (EC) published their contributions on September 24. Some of the suggestions are an open source tool, four major VPN companies, and several internet infrastructure firms.

The Commission says the list “will identify and describe the reportedly most problematic online services and marketplaces in order to encourage their operators and owners, as well as the responsible local authorities and governments to take the necessary actions and measures to reduce the availability of IPR infringing goods or services.”

However, the same page is at pains to explain that the list “does not purport to make findings of legal violations.” It’s not clear how the EC expects to prove that a site or service is “problematic” without establishing whether it is in fact breaking the law, but this is not the first time that the EU has tried to have its cake and eat it, too, on copyright.

The consultation opened on June 11 and closed on September 21. Those who wish to react to what has been submitted can do so until October 28, and the next Watch List is due in the second quarter of 2027.

One of the submissions came from the International Federation of the Phonographic Industry (IFPI), which represents the recorded music industry globally. On September 11, IFPI asked the EC to include yt-dlp, a command-line program used to download videos and audio from sites like YouTube, in the Watch List.

In fact, it is the openness of the project, and the fact it is maintained by a community of developers that makes it difficult to control, IFPI said in its submission. The document also reveals that the music industry has been keeping a close eye on the project’s development, and knows that it was originally created by a developer using the username “pukkandan”, and that the current maintainers are “coletdjnz”, “bashonly” and “Grub4K.”

IFPI also names several infrastructure companies as being “problematic” – Cloudflare, Njalla, GoDaddy, and Verisign.

On Verisign, IFPI notes that the company “is the registry for the .com and the .net top-level domains.”

Meanwhile, Spain’s top football league LaLiga has asked that four VPN providers – NordVPN, ProtonVPN, ExpressVPN, and Surfshark – be included in the Watch List.

The football league does not object to VPNs as such, but to the way they are marketed by affiliates. The submission says that these affiliates publish guides on how to use the VPNs to watch LaLiga matches for free, and that the VPN companies are aware of this and profit from it through their affiliate programs.

In fact, the guides are written by third parties who have affiliate deals with the VPNs, and who earn a commission when they sell subscriptions. The “guides” rank VPNs and link to their discounted offers.

LaLiga’s submission puts it this way: “The conduct that takes these services beyond neutral technical provision is the deliberate marketing of circumvention, conducted at arm’s length through affiliate programmes.”

LaLiga does not name or link to a single one of these guides, nor does it say that the VPN companies are behind them.

In the past, LaLiga tried to get NordVPN to pay a fine for not blocking IP addresses that were accessing its content, but a Spanish court refused the request.

The nature of the submissions made by IFPI and LaLiga also shows that the targets are now no longer only sites accused of piracy and their operators, but also perfectly legitimate and lawful technology and services – such as VPNs and open source software – that happen to be used in ways that cut into the profits of the entertainment and sports industries.

Keep reading

Censorship Advocates Seek To Use Bots And Anonymous “Sock Puppet” Accounts For Themselves While Denying Them To Others

Political leaders across the West have said for a decade that governments must end online anonymity to shut down fake accounts known as bots, particularly those from Russia. “I want to see real names on the internet,” said German Chancellor Friedrich Merz in February. “In a democracy, citizens have the right to privacy,” said Spanish Prime Minister Pedro Sánchez at Davos in January 2025, and “not to anonymity or impunity,” proposing to tie every social media account to a European digital identity wallet. Greece’s digital governance minister proposed in April 2026 to link every profile to a verified identity because “The major problem behind anonymity is toxicity.” French President Emmanuel Macron declared that his priority was “to demand the disappearance of fake accounts” and “these famous bots, these troll farms.”

But now the advocates of government censorship of legal speech are demanding the legal power to wage information warfare through anonymous accounts and an explicit “sock puppet” strategy. Buried in the Australian government’s new censorship bill is a definition: “A sock puppet identity is a false or fictitious identity assumed by a person in the course of using, or carrying out any activity in relation to, an online service.” The legislation goes on not to warn of bad actors using sock puppets but rather to authorize the eSafety Commissioner, Julie Inman Grant, to create and use sock puppets to “disseminate” information.

Keep reading

OpenAI admits another rogue agent incident

OpenAI’s agents have leaked 53 images uploaded by ChatGPT users, the company has said, without specifying whether the pictures were AI-generated or depictions of real people, or when they were posted online.

The incident comes amid a series of cases in recent months involving autonomous AI agents, which can independently plan and carry out tasks using external tools. OpenAI, Anthropic, and Google have all revealed instances in which their models accessed real systems during testing, including coordinated cyberattacks against government resources.

In a post on X on Friday, OpenAI said most of the leaked pictures had been removed, adding that it was working with hosting providers to take down the remaining content.

The agents had access to the images because OpenAI relies on anonymized user data for part of its model-training process, Reuters reported on Friday, citing the company, its former employees and outside researchers.

Keep reading

The Pentagon Flocked Itself. Should Big Brother Be Worried?

As the headquarters to the U.S. military, the Pentagon is surrounded by billions of dollars worth of surveillance and security technology.

These systems provide multiple layers of protection for the building but they also carry a risk of backfiring: any surveillance system that is vulnerable to intruders could potentially provide unauthorized users with details about the activities of the Defense Department (DOD) and its employees. This risk is higher than usual right now because of the decision to install a controversial piece of equipment all over the Pentagon grounds: Flock cameras.

There are at least nine Flock automated license plate readers (ALPRs) currently monitoring the traffic lanes used by drivers entering the Pentagon’s parking lots, including many of the DOD’s own employees. The purpose of these cameras is to give the Pentagon’s security forces the ability to automatically record information about incoming vehicles that may pose a security risk. But if the alleged vulnerabilities of Flock cameras are as serious as the company’s critics allege, then this equipment could be exploited to obtain a detailed list of the national security officials seen entering the Pentagon each day. In this way, the Pentagon’s rush to obtain security equipment from private contractors may pose a national security risk of its own.

Concerns about the ability of Flock products to track people alongside cars has produced backlash from privacy-minded citizens, resulting in both protests and contract cancellations. Others have criticized Flock’s devices for security vulnerabilities that expose them to unauthorized users, flaws which could be especially dangerous in the context of military facilities. Flock Safety has sought to downplay these issues, insisting that they have “never been hacked.” Critics dispute this claim, pointing to multiple different ways that Flock’s devices can be accessed by unauthorized users.

These concerns prompted two members of Congress’ Intelligence committees – Senator Ron Wyden (D-Ore.) and Rep. Raja Krishnamoorthi (D-Ill.) – to write a letter last year asking for an investigation into Flock’s “negligent cybersecurity practices.” The duo alleged that the company “needlessly exposes Americans to the threat of hackers and foreign spies tapping this data.” When asked about the Pentagon’s Flock cameras, Sen. Wyden said that “Installing internet-connected cameras in the Pentagon parking lot is obviously a dumb idea. In particular, given Flock’s troubling cybersecurity track record, the Pentagon might as well send the data from those cameras directly to China, Russia and Iran.”

Keep reading

This Group Made Tech to Protect Users’ Privacy. Trump Labeled Them Terrorists.

When the government puts a target on your back, every corner of online organizing becomes a puzzle. How do you ensure that your emails are private, when Google will hand over the contents of your emails to prosecutors, sometimes without ever notifying you? How do you keep your comrades informed, when maintaining an email list poses a security risk? How do you share information online without compromising the security of your web visitors?

Until September 6, the Autistici/Inventati (A/I) Collective provided privacy-focused digital infrastructure that allowed aligned groups around the world to evade government surveillance. Under siege, groups from Hamas to the Seattle Anarchist Book Fair sought refuge from the prying eyes of three-letter agencies through the use of A/I Collective email addresses, websites, mailing lists, and blogs. The users of A/I Collective technology were no strangers to the United States counterterrorism apparatus, but on August 26, 2026, the Trump administration took the unusual escalatory step of listing the technology provider itself as a Specially Designated Global Terrorist organization.

Legal uncertainty and disruption ensued immediately after the designation. The sanctions framework maps far more cleanly onto groups directly engaged in violence than it does onto a group providing anti-surveillance technology. Under the post-9/11 executive order establishing the Specially Designated Global Terrorist list, fundraising for ISIS or holding joint press conferences with al-Qaeda is verboten. But could posting on blogs hosted by the A/I Collective trigger a $1 million fine and 20 years of imprisonment? Official communications provide little assistance; the Treasury Department’s Office of Foreign Assets Control FAQ unhelpfully states that the exchange of information may be either blocked or exempt.

In a press release, the State Department pointed to the A/I Collective’s vetting of users for “ideological affinity,” folding the targeting of the organization into the enforcement of Donald Trump’s National Security Presidential Memorandum 7 (NSPM-7), which has initiated a crackdown on the global left. Civil society groups immediately noted the escalation into targeting not only those accused of violence, but their purported backers. “The designation of A/I Collective is significant because Treasury is applying counterterrorism sanctions not only to organizations it alleges engage directly in violence, but also to entities it characterizes as providing enabling infrastructure to designated or terrorist-linked groups…[G]roups and individuals that rely on the A/I Collective’s infrastructure may now need to assess whether continued use creates sanctions exposure,” wrote the Charity & Security Network, a coalition that has helped nonprofits navigate sanctions risk since 2009.

While users of A/I Collective services struggled to interpret the sanctions, the hammer came down immediately on the volunteer collective. Within 48 hours of the designation, the United States-based holder of the autistici.org domain shuttered the website, leaving A/I Collective to flee to an alternate domain. The Italian Banca Etica suspended the bank account the volunteer collective used to collect donations, citing sanctions risk. Backed into a corner, with no way to protect users and collect the donations needed to fund its €13,000 annual budget, the A/I Collective announced the shutdown of all of its services on September 6, 2026. In a statement, the A/I Collective wrote: “The possibility that our work may cause legal and financial consequences to those who are close to us — or even only have something to do with us — leaves us no choice.” On September 20, an estimated 10,000 NoBlogs sites went dark, stranding the radical activists who used the A/I Collective-hosted blogging platform to share everything from zines to direct-action tactical communiques.

Keep reading

Far-Left MA Gov. Maura Healey Wants Government Healthcare Workers to Barge Into the Homes of EVERY New Baby in the State “To Make an Assessment”

Far-left Democrat Governor Maura Healey is pushing a shocking new proposal that would expand state-funded home visits to the house of every single newborn baby born in the state.

Under the guise of “maternal healthcare” and mental health support, Healey wants government-appointed healthcare providers to physically enter the homes of parents to conduct “assessments” on families.

On Boston Public Radio, after pitching her postpartum package, Healey said this:

“Everybody in the state, when you have a baby, you’re going to have a home visit. You’re going to have a home visit within days, weeks, and that will be an opportunity for a healthcare provider to make an assessment and to see if you need some additional support and resources.”

Keep reading

The Mexican Government Is Cutting Off Users Who Refuse to Register Their Phone Lines

The Mexican government and Mexican telecommunications companies have disconnected millions of phone lines belonging to citizens who failed to register their phones with their identities. The move comes just two months after the government announced a delay in the registration deadline due to less than half of the country complying.

In early September, Mexico’s Telecommunications Regulatory Commission (CRT) released a statement claiming that about 9.55 million phone numbers ending in “1” were registered. The CRT said about 1.9 million had been temporarily deactivated for failing to register on time. The agency claimed more than 1.16 million were reactivated after registration.

In June, the CRT announced a staggered extension for citizens to register their mobile phone lines with their identification. The new deadlines were based on the final digit of the phone number, with phone numbers ending in “0” given until August 15 to comply, numbers ending in “1” given until September 1, and so on until December 31.

While announcing the numbers for September 1 registration, the CRT reiterated its claimed purpose for linking phone numbers to individual identities, stating:

“This link seeks to eliminate anonymity on mobile lines to contribute to the fight against crimes committed through cell phones, such as fraud and extortion.”

However, since the cancellation of phone lines has begun, Mexican citizens have been posting on social media detailing their skepticism. They are increasingly concerned about how their data might be stored and who might have access to it.

These concerns are particularly prescient after numerous hacks of Mexican government databases, including one in late 2025 in which hackers used Claude AI to gain access to private information. As one user wrote:

“I’m really upset: because they didn’t register my line, they suspended my service and I was left without data. I paid for the phone, I pay the balance, and the service too. Why do I have to give more personal information just to use it? More citizen info doesn’t mean more security.”

Some users said they had registered in time, but were still disconnected.

“They suspended my line, my deadline hasn’t passed yet, the app says my line is already registered… and then what? I’ve been waiting for over two hours for a turn in the chat and on the phone and nothing, just a bot”

Keep reading

UK Government’s Apple iCloud Backdoor Secrecy Called “Farcical” in Court

The British government’s policy of neither confirming nor denying that it had ordered Apple to put a backdoor into iCloud has been described as “farcical” during a court hearing.

The London-based Royal Courts of Justice is the venue of the Investigatory Powers Tribunal, which on Thursday heard that the “neither confirm nor deny” (NCND) stance was “logically unsustainable” given that everybody already knows the fact.

Ben Jaffey KC, who represents the campaign groups Privacy International and Liberty, told the court that the government was defending a secret that no longer exists.

The tribunal is hearing Apple’s complaint alongside the complaint from Privacy International and Liberty, challenging the home secretary’s power to issue secret orders, known as technical capability notices (TCNs).

The January 2025 leak to the Washington Post revealed that the Home Office had issued a TCN to Apple, requiring access to end-to-end encrypted messages and data stored by Apple customers worldwide in iCloud. Apple did not comply with the order and instead pulled its Advanced Data Protection service from UK users.

But within hours of the Washington Post story, Home Office sources confirmed the report to the Times. In October 2025, the Home Office issued a new TCN, reportedly narrower in scope and aimed at UK users.

As the tribunal was told, this was not the only confirmation of the original order. A post on X by former US director of national intelligence Tulsi Gabbard in August 2025 was seen by more than three million people, while in December 2025, the investigatory powers commissioner, Brian Leveson, said that “lawful access can be achieved in a way that strikes a balance between maintaining strong encryption and ensuring law enforcement and the government can protect the public from terrorism, serious crime, and hostile state activity.”

Gabbard had reported that the UK had agreed to “drop its mandate” for Apple to provide a “backdoor” that would have enabled access to the protected encrypted data of American citizens.

Jaffey told the court that it was unlikely that Home Office sources would have confirmed the TCN without “tacit approval” from the government. “But here, within hours of reporting by the Washington Post, multiple sources were confirming to the Times the existence of the orders,” he said.

Leveson’s statement, Jaffey continued, “gives the game away.” The commissioner’s report would have been “clearly prejudicial to issues that might come in front of him in the future” had there been no TCN issued at all.

And while the Home Office is sticking to its NCND policy, WhatsApp and Google have confirmed in witness statements that they have not received any such orders – something they are free to say because there is no legal bar on disclosing that you have NOT received a TCN.

Apple, on the other hand, is in a different position because it did receive the order, and is now in court trying to force the government to confirm this, and by extension, admit that the TCN is still in force.

Another argument made by Jaffey is that Apple had to ask for permission before it could discuss the order with the US government, and that permission was granted. “The fact that Apple even needed to ask permission confirms there is a TCN,” he said.

The government’s argument against abandoning the NCND policy is that it would damage national security and hinder the investigation and prosecution of “serious crime,” including terrorism and online child abuse. But Jaffey said that “the horse has long bolted” as far as secrecy around the TCN is concerned, and that the government’s stance is “ridiculous” and “understates the principle of open justice.”

Keep reading

Friedrich Merz Again Calls For An End To Online Anonymity

German Chancellor and CDU leader Friedrich Merz is once again advocating for an end to online anonymity.

Merz spoke at the Chancellery in Berlin on Tuesday, where he received the winners of the 61st federal “Jugend forscht” youth research competition, and took their questions. The event was streamed live by the government.

One of the participants asked Merz about introducing a real-name requirement on the internet, and how it could be reconciled with the work of informants, investigative journalism, and the need to sometimes be able to communicate anonymously.

Merz’s answer did not address the question of journalism at all. Instead, he spoke about the difficulties in establishing who is behind an online message, and who to hold responsible, as well as the proliferation of messages generated by bots.

“Please, nobody come to me with free speech. This has nothing more to do with free speech,” Merz said. Free speech, he continued, is “at best” a libertarian understanding of politics out of parts of the United States, “that I personally do not share.”

A liberal society, he went on, must be able to protect its citizens “from false information, from personal denigration, from discrimination.”

Merz, who “grew up in the analog world” said he often wonders if the digital world should be allowed to have “completely different rules.”

In the old world, he said, if a newspaper published false information, one could take action against it, and this, he said, created a certain “hygiene.”

In the digital world, Merz is unhappy that people can use pseudonyms, abbreviations, or made-up names, “and we have enormous difficulty establishing at all who is responsible for it. Is it the platforms or is it the authors themselves? And if so, who actually are the authors?”

He mentioned the “coarsening of manners” and the role of bots in generating messages. According to Merz, his party’s (CDU) competitor, AfD, had benefited in Saxony-Anhalt from messages generated by bots.

It is essential to protect personality rights and “our democracy,” Merz said.

He did allow that there are good reasons to allow for anonymous expression, but did not go into any of them.

It’s also important to note that Merz was not announcing any new policy, bill, or law, and was answering a question from a teenager.

Keep reading