Doctoralia strips health data trackers after Markup probe

Doctoralia removes trackers that sent health data to Google, LinkedIn and TikTok

Doctoralia, the world’s largest health appointments platform, removed web trackers that sent personal information to tech companies after an investigation by The Markup and Brazil’s Agência Pública. The probe found trackers logging patient searches for specialties, appointment dates and doctors’ names and transmitting them to LinkedIn, TikTok and Google across domains in Brazil, Colombia and Mexico. Patient names were not included, but trackers tied users to unique IDs linkable to social media profiles. Privacy advocates note appointment data can infer sensitive conditions, such as reproductive healthcare or cancer treatment. DocPlanner spokesperson Arsenia Nikolaeva confirmed a thorough internal review found nothing raising privacy concerns but said additional measures are being introduced. Network traffic no longer shows sensitive data being sent.

World’s largest health appointment platform dumps its web trackers after Markup investigation →

Topics: Online trackingHealthcare data breaches

Signal refuses to comply with Canada’s Bill C-22 metadata retention

Signal has told Canadian Parliament it will not comply with Bill C-22, which would require internet and electronic service providers to retain customer metadata. Signal threatened to pull out of Canada over the bill in May. Conversational metadata includes who spoke to whom, when, and call length. In June, Public Safety Minister Gary Anandasangaree amended the bill to cut metadata retention from one year to six months. Signal retains only a user’s phone number and timestamps of account creation and most recent connection, so any metadata requirement would substantially increase stored data. A spokesman said the law would not require decryption of end-to-end encrypted services or compel backdoors. Signal’s Udbhav Tiwari said creating a weaker product collecting such metadata presents a stark choice: we will not make changes to our product.

Signal: We won’t comply with Canadian surveillance bill →

Topics: Messaging apps privacyEncryption

Oklahoma judge rules license plate reader records need a warrant

A federal judge in Oklahoma, Sara E. Hill, ruled this month that people have a reasonable expectation of privacy in automated license plate reader records, so police generally need a warrant to search them. Hill found the databases contain information about all vehicles passing network-connected cameras at all times and enable indiscriminate mass surveillance. The ruling is an outlier; nearly every court to date has found ALPR use is not a search under the Fourth Amendment. A nationwide network of more than 144,000 AI-assisted cameras tracks motorists billions of times weekly. A federal lawsuit over San Jose’s ALPR system is pending, as are challenges to Flock cameras in Wichita and Norfolk. Courts rejecting such suits acknowledge the legal picture could change as ALPR numbers multiply.

Other courts should heed a federal judge’s warning about Flock-enabled mass surveillance →

Topics: License plate readers (ALPR)Geofence warrants and Fourth Amendment rulings

Korea privacy chief admits security failures as banking breach tests new fine ceiling

South Korea’s Personal Information Protection Commission chairperson Song Kyoung-hee told the National Assembly audit that data security systems lag considerably, attributing vulnerability to security spending not keeping pace with IT investment. She said basic measures were missed: access rights unmanaged, encryption not applied, abnormal traffic undetected. Lawmakers noted the commission’s budget grew 45 percent over five years while breaches escalated, and challenged Song over the Government24 portal breach disclosed roughly a month after the incident, beyond the 72-hour legal deadline. AI-assisted breaches at Shinhan Bank and KB Kookmin Bank triggered a presidential-level response; President Lee Jae Myung ordered an urgent investigation on October 4. The incidents are the first major events under the revised Personal Information Protection Act, which took effect September 11, 2026, raising fines to 10 percent of total annual global revenue.

Korea Privacy Regulator Admits Security Failures as Banking Breach Tests PIPA Fine Ceiling →

Topics: South Korea data breaches and enforcement

Washington immigration arrests tied to driver data rise fivefold

Immigration arrests linked to searches of Washington driver information have risen at least fivefold since July, according to the University of Washington’s Center for Human Rights. Verified cases rose from 64 over about a year to 354 as of Tuesday. Center executive director Angelina Godoy called the numbers off the charts and projected further increases despite state policies meant to block federal agents. The main conduit is Nlets, a data-sharing platform letting agents search the Department of Licensing database for names and addresses. Washington began blocking Nlets queries from ICE and Homeland Security Investigations last November, but Godoy said agents can still gain access using another agency’s passcode. Researchers asked Gov. Bob Ferguson to curtail the practice; Ferguson said the state will review what other states have done and what is lawful to require judicial warrants for civil immigration-related requests.

Immigration arrests linked to Washington driver data ‘off the charts’ →

Topics: ICE and DHS immigration surveillanceDriver's license data leaks