Privacy
Google's $10M bid for Spirit Airlines data draws 120 lawmakers' warning
Plus: Dutch push for a kill switch on EU police data deals, and the ICO probes a 169% surge in WhatsApp scam calls.
This edition was produced with artificial intelligence. Text and voice are generated automatically.
Google’s $10M bid for Spirit Airlines data draws 120 lawmakers’ warning
Google bid $10 million for bankrupt Spirit Airlines’ internal business data, including 100 million emails and 500 million Microsoft Teams messages, to train AI models. More than 120 US lawmakers, including Senator Elizabeth Warren and Representative Steven Horsford, warned that sensitive employee information could be exposed and urged Google and Spirit to exclude employee records where possible. The records include timecards, payroll and tax records, employment contracts and confidential workplace communications. Spirit ceased operations in May 2026 and its assets are being liquidated; Google won the August auction, and the sale needs bankruptcy court approval at a 14 October hearing. Google said it is not seeking personal information and that data would be excluded or de-identified by an independent third party. A court-appointed ombudsman recommended approval after steps to exclude passenger databases covering around 97 million customers, but that review did not assess employee privacy risks.
Topics: GoogleAI copyright
Netherlands seeks termination clause for EU police data-sharing deals
The Netherlands is seeking a termination mechanism for agreements extending the EU’s Prüm framework — which enables automated exchange of police data including DNA profiles, fingerprints and vehicle registration data — to trusted third countries, so deals can be shut down if political circumstances change. In comments obtained by Euronews on a European Commission proposal, the Dutch government said future agreements should specify grounds for termination, such as a trusted third country undergoing a radical change of regime. The Commission’s proposal names the UK, Canada, Norway, Iceland, Western Balkans candidate countries, Ukraine and Moldova as suggested trusted countries. The Netherlands called for thorough discussion of criteria and said any agreement must uphold EU data protection and fundamental rights and must not exceed what member states share among themselves. Slovakia prioritised Schengen associates and EU candidates; Germany and Belgium warned against moving too fast, citing bottlenecks in the current exchange system.
The Hague wants a kill switch for EU police data-sharing with third countries →
Topics: Europol data practices
ICO investigates 169% surge in automated WhatsApp scam calls
The UK Information Commissioner’s Office is investigating a surge in complaints about automated nuisance calls in which a recorded voice asks recipients to add the caller on WhatsApp. Complaints rose from 1,374 in July to 2,178 in August, up 58 per cent, then climbed a further 69 per cent to 3,684 in September — the highest level since 2021 and almost triple the July figure. Andy Curry, the ICO’s head of criminal investigations, said the rise was deeply concerning and the calls were often designed to manipulate people into handing over personal information or money, adding that reported numbers were likely just the tip of the iceberg. Simon Fell, of the Communications Crime Strategy Group, told BBC Radio 4 the calls appear to try to route recipients to a fake job listing that could involve money muling or a phishing exercise to identify active numbers, with that information resold on the dark web. The ICO urged people to report suspicious automated calls and register with the Telephone Preference Service.
Data watchdog investigating huge surge in ‘add me on WhatsApp’ scam calls →
Topics: Phishing
‘123456’ password tied to Danish CPR register breach of 8.8 million numbers
At least three user accounts at Funen-based IT company Pays used the password „123456” when hackers gained access to Denmark’s CPR register, including the company’s administrator account, according to Politiken. The breach exposed information linked to around 8.8 million CPR numbers. Jens Myrup Pedersen, a professor at Aarhus University, called the password security hopeless, saying there is really no security, it is an open door. Pays ApS, based in Odense, confirmed to TV 2 that its access had been compromised. Managing director and owner Sophie Laursen said the company was subjected to an attack where its legal access to search the CPR system was abused. The hacker had access from 10 September for 21 days and 17 hours. An anonymous hacker told Politiken they were behind the attack, claiming access was initially obtained using a leaked password belonging to a former employee of a small Danish company. The hacker allegedly built two programs to retrieve and externally store CPR information and said there were no plans to sell or publish it.
`123456’ password used in massive Danish CPR data breach - The Copenhagen Post →
Topics: Password securityGovernment agency data breaches
Chat Control 1.0 adopted by European Parliament after procedural reversal
Chat Control 1.0, a temporary derogation from ePrivacy rules designed to detect online child sexual abuse, was adopted by the European Parliament on Thursday and remains in effect until 3 April 2028, providing a buffer while lawmakers negotiate Chat Control 2.0. In March, MEPs rejected extending the measure after talks failed; in late June, Parliament President Roberta Metsola reopened the file, warning that expired rules left a dangerous gap in online child protection. The Council returned the file to Parliament at the start of the vacation season. A simple majority initially supported rejecting the position with 314 MEPs in favour, 276 against and 17 abstentions, but no absolute majority existed to reject the amended position, so the second reading was closed and the package sent to the Council. The amended position adopts a RENEW amendment excluding communications to which end-to-end encryption is, has been, or will be applied, which some MEPs called a glimmer of hope. German MEP Svenja Hahn called the passage a disgrace that opens the door for mass surveillance.
Chat Control 1.0 passed the European Parliament — through the back door | Euronews →
Topics: Chat ControlEncryption
DuckDuckGo adds Duck.ai chat sharing with 48-hour default expiry
DuckDuckGo added chat sharing to Duck.ai on October 7, 2026, with share links that expire after 48 hours by default unless the sender selects another window, according to a Spread Privacy blog post by Ben Kaiser. A share icon beneath every response offers sharing only that response or the entire chat up to that point; a full conversation can also be shared from the three-dot menu via Share and Create Share Link. The dialog offers expiry values of 1, 2, 7 or 30 days. When a link is created, the chat is encrypted on the sender’s device before upload; the link contains an identifier and a decryption key placed in the URL fragment after the # character, which browsers typically omit from server requests, so decryption happens in the recipient’s browser using a key the server never received. Every shared chat page carries noindex instructions. DuckDuckGo cited past cases where ChatGPT and Claude shared conversations appeared in search results. The post does not name the encryption algorithm, key length, or any independent audit.
Duck.ai share links expire after 48 hours by default →
Topics: Encryption
Survey finds 91% of US adults hit by scam attempts as privacy confidence falls
A nationwide survey found 91% of U.S. adults reported experiencing at least one scam attempt or cyberattack, and 17% said they lost money, according to Consumer Reports. Only 32% of Americans were at least somewhat confident that sensitive personal information stayed private, down from 48% in May 2025. Consumer Reports, Aspen Digital and the Global Cyber Alliance released the fifth annual Consumer Cyber Readiness Report for Cybersecurity Awareness Month, drawing on nationally representative surveys of 4,682 U.S. adults in March and April and 2,082 in May. One in five consumers who encountered a scam attempt said the most recent one had been tailored using their own details; among those whose most recent scam began with a call, 32% said it had been customized. Of the 17% who lost money, only 7% recovered losses. Recovery varied by payment method: 61% of credit card users were reimbursed, compared with 45% for debit cards, 15% for peer-to-peer services and 5% for cryptocurrency. Asked who should be responsible, respondents cited platform owners most often at 29%, followed by the federal government at 18%, individual consumers at 16% and financial companies at 14%. Consumer Reports President and CEO Phil Radford said AI is making fraud faster, cheaper and more personal, and that companies need to be held accountable and governments need real guardrails.
9 in 10 US adults report scam attempts as confidence in data privacy plunges →
Topics: Phishing
Saxony-Anhalt guide says recycle bin does not count as GDPR deletion
The State Commissioner for Data Protection of Saxony-Anhalt published an 18-page guide in September 2026, Data Erasure Policy for Personal Data Under the GDPR — Guide for Small Businesses, setting out how small businesses should build a data deletion policy. The document runs 13 numbered sections covering records of processing, storage inventories, a model deletion catalog with retention periods, shredder security levels, backup handling and a step-by-step erasure-request procedure. It states that moving documents and files to an operating system’s or email program’s recycle bin does not meet the requirements for deletion, because individual files can often be recovered with little effort even after the bin is emptied. It carries no new legal obligations and translates existing duties under Article 5(1)(e) and Article 17 GDPR into operational routines. The model deletion catalog gives retention periods including applicant data at six months after the procedure, employee data at 10 years after departure, and video surveillance at 72 hours. Paper shredding must meet at least DIN 66399 security level P-3, with P-4 or higher for health data and personnel files.
Saxony-Anhalt regulator says recycle bin does not count as GDPR deletion →
Topics: GDPR
Usage-based insurance apps penalize drivers for hard braking, report finds
Usage-based insurance apps from State Farm, Progressive and Allstate track drivers’ behaviour. State Farm’s program is Drive Safe & Save, Progressive’s is Snapshot, and Allstate’s is Drivewise. State Farm and Allstate promise poor driving scores will not raise a driver’s base rate. Progressive discloses that about 20% of Snapshot users see rates rise at renewal. Drivers on no-surcharge programs receive an immediate 10% signup discount, which disappears if they fail to meet automated standards over six months.
Slammed on the brakes to save a life? Your insurance app just penalized you →
Topics: Location tracking
Ontario YouTuber says police visited after he built camera to track police cars
Canadian software engineer and YouTuber Anthony Sistilli, of Brampton, Ontario, built his own automatic license plate recognition camera and set it up to track the movement of police cars. He posted several TikTok videos explaining how he built it and how it works, describing it as a personal Flock surveillance camera to Flock the Flockers. Brampton recently spent 2 million Canadian dollars on high-resolution cameras and automated licence plate recognition technology. According to a video Sistilli posted on YouTube earlier this week, two officers from Peel Regional Police turned up at his front door to ask what his intentions were for the data he gathered. Sistilli said one officer specifically mentioned how scary it would be for them because people would be able to find out where they lived, when they got on shift and what they were doing throughout the day. Peel Regional Police did not immediately respond to Gizmodo’s request for comment. Sistilli’s long-form video also discusses how companies like Flock market their products to municipalities and the lack of transparency about data collection and retention.
YouTuber Says Cops Paid Him a Visit After He Built Flock-Style Camera to Track Cops →
Topics: License plate readers (ALPR)Flock Safety
UK video doorbell rules: when cameras cross from security into a data breach
In the UK, using a video doorbell is broadly legal but must comply with privacy and data protection regulations. Recording within the boundaries of one’s own property is generally unproblematic; problems arise when footage captures public areas such as roads and pavements or extends onto a neighbour’s property. Video doorbells fall under the UK General Data Protection Regulation and the Data Protection Act 2018. Home surveillance firm Eufy said proportionality is key: the camera must serve a legitimate purpose, such as home security, without unnecessary intrusion, and a camera angled to focus on the front door is acceptable, while one recording large areas of public space or a neighbour’s windows may be considered excessive. Eufy said that if a doorbell captures public or shared spaces, a Data Protection Impact Assessment should be carried out, and people must be told recording is in progress, usually with a clear sign. The Information Commissioner’s Office can issue fines and enforcement notices, and civil proceedings can be pursued. Eufy cited Fairhurst v Woodard (2021), in which a homeowner was found guilty of harassment and data breaches, with damages and costs reported at around £100,000.
Your legal rights if neighbour has a video doorbell — privacy laws explained →
Topics: Smart devices privacyGDPR
Smart coffee makers draw scrutiny after 10TB transfer and contacts request
A Keurig coffee machine belonging to the parents of IT expert Nomad transmitted a terabyte of data in 10 days, a case that went viral after he posted about it on X. Nomad disconnected the device, saying it was not worth keeping an Internet of Things device connected that had the capability of bugging out and causing saturation. The massive transfer appears to have been caused by a bug. A Lavazza coffee machine asked for access to contacts and call logs; the company has been asked why its app wants those permissions and why its smart features do not work after connection. Brewing from the machine’s own app proved impossible, and a request to brew an espresso through Google Home, as instructed in the manual, returned a message that the coffee maker does not support selecting specific drink types like espresso through smart home commands. Both companies have been contacted for comment. Consumer Reports has cautioned users about smart appliances, warning earlier this year that home appliances relying on mobile apps for key functions and collecting data are becoming the standard. Consumer Reports’ Steve Blair found a dryer sending the equivalent of 135,000 text messages per week to its manufacturer. Consumer Reports recommends considering data security before buying any connected product and setting up a separate network on the router purely for smart devices.
Topics: Smart devices privacy
Walmart patents on pricing experiments draw scrutiny from Groundwork
Groundwork Collaborative identified more than a dozen Walmart patents describing customer profiling, pricing experiments and targeted promotions. One patent describes conducting pricing experiments by gradually raising prices to estimate willingness to pay; another describes withholding coupons from customers an algorithm predicts will pay full price; a third describes displaying different prices in search results, with Groundwork citing a hypothetical in which one shopper sees $90 and another $110 based on purchase history, location and other identifying data — an example from its interpretation of the patent rather than evidence Walmart showed those prices to customers. An electronic shelf label patent was granted in 2023, and other applications describe facial recognition, Wi-Fi tracking and physiological data such as heart rate. Groundwork CEO Lindsay Owens said corporations do not spend years building high-tech pricing tools, hiring experts and filing patents just to let them collect dust. Walmart EVP Dan Bartlett said the company does not and will not use a customer’s personal information, income, shopping history, urgency or willingness to pay to set individualized prices, summarizing its position as: We price products, not people. Walmart argues a patent describes a possible invention rather than an active business practice, and said it would not use or renew the patent describing cart-based price changes through Scan & Go and electronic shelf labels.
Walmart’s Patents Reveal the Technology That Could Let Algorithms Raise Your Prices →
Topics: Online tracking
West Virginia chestnut grove at risk from 8-gigawatt AI data center
A grove of 200 blight-resistant chestnut trees in West Virginia is at risk of being bulldozed for a hyperscale data center, according to a call to action in From the Front Lines: Struggles for Justice, a publication of the New York-based Global Justice Ecology Project. The Monarch Compute Campus is being developed by Nscale in collaboration with Nvidia and Caterpillar, per a company blog post. Under current plans, the completed facility will span over 2,250 acres and supply 8 gigawatts of computing capacity to AI companies including Anthropic. Total investment in the project exceeds $20 billion. Nscale’s website describes Monarch as one of the largest single AI infrastructure investments in US history, anchoring America’s compute foundation. Front Lines calls the chestnut trees irreplaceable, serving as a lifeline for future generations of new chestnut growth. The orchard was planted in the 1970s from wild surviving American chestnuts and is described as a vital genetics library and the primary seed source to restore the species across West Virginia.