LAPD urged to drop Flock; SEC bought airline records

Mayor Bass calls on LAPD to end Flock Safety partnership over trust and deportation fears

Mayor Karen Bass said Thursday that the LAPD should stop working with Flock Safety, the company behind AI-enabled license plate readers, warning that the firm had lost public trust, especially among immigrant communities targeted by the federal administration. Bass said she supports license plate reading technology generally but argued the LAPD needs to identify another company that doesn’t share data. The announcement follows a pause in the relationship last month, though police officials later said they were negotiating a new deal with more safeguards.

Dozens of mostly smaller cities have already deactivated Flock cameras or ended contracts over concerns that data could be used to track down immigrants for deportation. A recent Washington Post report found at least 50 instances of law enforcement misusing camera access, largely to stalk former romantic partners. An LAPD inspector general’s report also found limitations in existing agreements with Flock, Axon, and Motorola, recommending updated contracts, regular audits, and standardized rules for traffic stops. Flock denies having contracts with ICE and says it bars federal agencies from its lookup tools, while retaining plate reader data for only 30 days.

Mayor says LAPD should stop using Flock devices; concerned data is used for deportations →

SEC bought over one billion airline ticket records without a warrant

The Securities and Exchange Commission subscribed to Airlines Reporting Corporation’s Travel Intelligence Program, gaining access to over one billion ticket records, according to documents obtained by 404 Media through a FOIA request. The data included passengers’ names, credit card numbers, departure and arrival cities, and flight numbers. The subscription included an alert system flagging new bookings against a monitoring list, with the agency requesting between one and 25 alerts daily. No court order was needed for the purchase.

ARC is a clearinghouse co-owned by American, Delta, and United that resold bookings made through sites like Expedia and Kayak. The same post-9/11 surveillance infrastructure was previously sold to the FBI, IRS, and Homeland Security before lawmaker pressure forced its shutdown in 2025. The newly released documents show the program’s reach was wider than known, covering foreign-to-foreign journeys. ARC defended the program, saying it was established after the September 11 attacks and has contributed to preventing and apprehending criminals involved in money laundering and terrorism.

SEC Bought a Billion Airline Records to Track Travelers—Likely Without a Warrant →

Mysk finds three leaks in Apple Private Relay that expose real IP addresses

Security researchers at Mysk discovered three separate leaks in Apple’s Private Relay and other browser proxies that allow websites to see a user’s real IP address. Private Relay is designed to hide the IP address in Safari using a dual-hop architecture, but the flaws affect all iOS browsers with proxy features, including Tor-based browsers, because all iOS browsers are required to use WebKit. VPNs are unaffected since they work device-wide.

The first leak involves DNS prefetching, which resolves domain names through the device’s normal DNS path instead of the proxy. The second involves WebAuthn, where Related Origin Requests are handled by the operating system’s credential service outside the browser’s proxy. The third uses WebTransport, which opens a connection directly from the device. Mysk did not report the issues to Apple and released them publicly, citing excessively long wait times and previous rejections. They noted that EasyOptOut reported an iCloud Hide My Email leak to Apple in June 2025, which took about 13 months to address. Mysk set up a website where users can check if their browser is affected.

Apple’s Private Relay Leaks Your Real IP Address in Safari →

AI note-taking apps face class actions over recording and training data

A class-action lawsuit, Chamberlain v. Granola, Inc., was filed July 30, 2026, alleging the AI note-taking app recorded a user without consent during a video call, citing violations of the Electronic Communications Privacy Act and California’s Invasion of Privacy Act. Granola’s marketing states its app runs locally so other people in the room won’t know it’s there, which plaintiffs argue constitutes an illegal wiretap. Users are opted into model training by default, and opting out does not apply retroactively. Granola denies the accusations, stating it anonymizes all training data.

Similar cases are pending against Otter.ai, with four class actions consolidated in the Northern District of California, and Fireflies.ai faces multiple suits under Illinois’ Biometric Information Privacy Act for harvesting voiceprints. Read AI has been banned from several universities over privacy risks. In these suits, companies argue the obligation to obtain consent falls on the user, not the company, but courts historically do not look favorably on hiding behind terms-of-service agreements. At least eleven states enforce all-party consent rules, and recommended steps include obtaining verbal consent, opting out of model training, and invoking California’s right to erasure.

AI Note-Taking Apps Are Violating User Privacy →

Verb marketplace lets consumers sell personal data directly to AI labs

Verb, a data exchange, launched a marketplace Thursday that lets consumers sell their personal data directly to companies, with AI labs expected to be the biggest buyers. Users add the Verb tracker to their phone, which collects selected activity including shopping habits and social media use, with the ability to toggle off categories. Users set the price for their data, with Verb providing an estimate based on what is shared, and can select certain companies they don’t want to sell to. Verb says it excludes passwords, text messages, and health data from analysis.

CEO Cyrus Beschloss argued the marketplace could create “a completely new asset class,” though previous attempts to pay consumers directly for personal data have struggled. Companies already spend billions collecting and buying consumer data, but consumers rarely participate in those transactions. As AI companies search for fresh, high-quality data to train future models, proprietary behavioral data may become more valuable than the web data many models have already consumed. Beschloss acknowledged data breach risks, saying the platform was designed with those threats in mind.

Exclusive: Verb lets you sell your data to AI labs for training →