Privacy
GM pays $220 million over driver data sold to insurers
36 attorneys general settle with GM, Ofcom wins moderation data from TikTok, X and Meta, and CBP is ordered to explain a Dulles phone seizure.
This edition was produced with artificial intelligence. Text and voice are generated automatically.
GM to pay $220 million over driving data sold to insurers
Maryland Attorney General Anthony Brown announced that General Motors agreed to pay $220 million to settle allegations it sold customers’ driving behavior and location data to third parties without knowledge or consent. Maryland receives $7.33 million from the settlement, joined by a coalition of 36 attorneys general. The case covered GM’s Smart Driver program between 2016 and 2024, which tracked speeding, hard braking, acceleration and trip times, with data allegedly sold to brokers and passed to insurers that sometimes used it to set rates. Investigators said some customers were enrolled without consent and that GM systems wrongly told more than 370,000 drivers they were not enrolled. GM must now obtain express consent before collecting or sharing such data, undergo regular assessments and oversee dealerships. It discontinued Smart Driver in 2024.
General Motors to Pay $220 Million to Settle Driver Data Privacy Allegations →
Topics: Location trackingData brokers
TikTok, X and Meta lose High Court fight over Ofcom data demands
TikTok, X and Meta lost their High Court challenge against Ofcom and must hand over data on how they moderate harmful content, including material seen by children. Lord Justice Singh and Mrs Justice Collins Rice ruled in Ofcom’s favour and refused to quash the information notices, the first legal test of the regulator’s demand powers under the Online Safety Act 2023. The notices require data on user activity by age group, volumes of content and accounts moderated, children’s exposure to actioned content, appeal outcomes and timing, and reports from UK users. The companies called the requests unlawful and the most burdensome they had ever received, costing millions of pounds. The judges said they had not sufficiently explained why the notices were onerous and rejected the claim they were irrational.
Social media titans must hand moderation data over to Ofcom after failed High Court bid →
Topics: Children's online safety
Judge orders CBP to justify airport phone and laptop seizure
Judge Leonie M. Brinkema of the Eastern District of Virginia ordered Customs and Border Protection to explain the seizure of devices belonging to psychiatric nurse Muhammad Numaan Imam and his wife Khadijah Mansoor at Washington Dulles International Airport, after Imam refused to unlock his phone citing patient emails and privacy-protected case-management software. CBP asked to seal its response from the public and from Imam, citing privileged law enforcement information. After reading the filings, Brinkema found most redacted material is not privileged and gave CBP until Thursday noon to object to unsealing, identifying only two sentences as legitimately blacked out. She had already ordered sworn statements from everyone who handled the devices. CBP policy deletes data within 21 days absent probable cause of digital contraband or legal violations.
CBP really doesn’t want to reveal what it does to Americans’ phones →
Senators demand release of FISA opinion as lapsed Section 702 keeps running
Senators Ron Wyden and Adam Schiff wrote on 26 October to director of national intelligence Jay Clayton and attorney general Todd Blanche demanding release of a Foreign Intelligence Surveillance Court opinion and the names of officials who withheld it, with a written response due by 6 November. They said the 17 March opinion contains serious abuses of Americans’ rights and that the administration missed its declassification deadline. Section 702 lapsed in June 2026 after the House rejected reauthorisation, with 19 Republicans joining Democrats, yet collection continues to March 2027 because the same opinion permitted another year of activity. More than 20 civil liberties groups, including the ACLU and EFF, want the opinion public before any reauthorisation debate. Blanche said in July he would declassify it.
Lapsed US snooping law still running as senators object | Computer Weekly →
ChatGPT dot starts texting US Pro users through Linq
OpenAI began rolling out iMessage and RCS texting for its ChatGPT dot agent on October 28, giving US-based Pro subscribers access from the iPhone Messages app or any RCS-capable Android app without a separate download. The feature routes messages between the dot and the user’s phone through Linq, a third-party Application-to-Person messaging provider, placing a commercial intermediary inside a channel users may associate with Apple’s end-to-end encryption. OpenAI has not publicly specified whether messages carry iMessage’s end-to-end encryption or arrive as standard SMS, and its help documentation urges caution with sensitive information sent by text and notes the thread runs through an outside operator. The dot runs on GPT-6 Astra, connects to more than 4,000 apps and shares memory with the ChatGPT app. The preview excludes the EEA, Switzerland and the UK.
ChatGPT Dot Can Now Text via iMessage and RCS, But Linq Sees All Messages →
Topics: ChatGPTMessaging apps privacy
Report links ad-tech bidding to profiling of Starlink users in 105 countries
Investigations by TrendAI and Citizen Lab examined Discover-Tech, an Israeli ad-tech firm, over alleged profiling of Starlink users. TrendAI found an entity it designated SHADOW-EARTH-79 was the leading winning bidder for Starlink-associated advertising impressions across 105 countries, capturing roughly 12.9% of observed Starlink ad wins versus about 2.6% across general traffic, a nearly fivefold overrepresentation it called implausibly dominant. Six people familiar with the investigation told Reuters the designation refers to Discover-Tech. TrendAI assessed with moderate-to-high confidence the pattern reflected targeting and tracking infrastructure rather than conventional advertising, noting satellite connections reach users where terrestrial networks are state-controlled or degraded. Citizen Lab documented a platform called Controlium that could fingerprint, de-anonymize and secretly track users through ads. The findings do not establish that Starlink terminals were compromised.
Topics: Online tracking
Chainalysis discloses breach via offensive agentic techniques
Chainalysis disclosed a security incident in which an external actor used offensive agentic techniques to gain unauthorized access to its internal systems and tools earlier this month. The company published the disclosure and the full text of the email sent to affected customers on Friday at roughly 5:14 PM ET, and has since been patching vulnerabilities and hardening its systems. Accessed data includes user IDs, full names, email addresses and organizational role labels for users provisioned on the platform. Chainalysis said there is no evidence of unauthorized access to investigation content, authentication credentials or session tokens, and it is still determining which records were accessed for each organization. It is working with external cybersecurity experts and using large language models to support a broader security review. Customers are advised to enable two-factor authentication and watch for scammers impersonating the company.
Chainalysis discloses data breach from “offensive agentic techniques” →
Topics: Autonomous AI agent cyberattacks in the wild
Russia adds Apple and Microsoft to surveillance registry
Russia’s communications regulator Roskomnadzor placed Apple and Microsoft on its registry of organizers of information dissemination on October 2. Companies on the registry must retain the written, audio and video messages of users in Russia and hand the data to security services on demand. They must also keep records on their users and on how those users’ messages were sent, and store them inside Russia for three years. Companies that ignore the rules risk penalties and, eventually, limits on how people in Russia can reach their services. Roskomnadzor can add companies at the request of federal security or law enforcement agencies, and since 2024 has been able to list them against their will once a court finds repeated neglect of notification obligations. Several hundred companies are on the list, including Google and Google Meet since January.
Russia added Apple and Microsoft to a state surveillance registry →
Flock reinstalls cameras in Minnesota city that canceled its contract
Dayton, Minnesota’s police department was notified of a Flock maintenance work order on September 17, and the city responded the next day that the program had been put on hold and no work orders were to be completed. Flock reinstalled two cameras anyway without city authorization, and residents complained after spotting them despite the canceled contract. The Dayton city council had voted on August 25 to suspend the automatic license plate reader program and Flock cameras following community concerns over privacy and data misuse.
Topics: Flock SafetyLicense plate readers (ALPR)
India unveils sealed-room framework for training AI on sensitive data
India’s Ministry of Electronics and Information Technology launched the Data Empowerment and Protection Architecture for AI Training framework in Bengaluru, developed primarily by iSPIRT. Its central idea is to bring AI models to the data rather than move data to researchers, letting companies train algorithms on sensitive data held by hospitals, banks and government agencies without the information leaving those institutions. Under DEPA, data stays with its owner while a sealed room, a secure computing environment, runs only what an authorised digital contract permits; no one can access the data inside, not even the operator. A developer sends in a model and receives only the trained model or a decision. The framework is not legally binding, and consultations begin in the coming weeks before any legal framework, a process that could take years.
India bets on ‘sealed rooms’ to train AI on sensitive data without exposing it →
Proton employees say AI-first push sidelines security testing
In October 2026, 90% of the code for Proton’s tools was written by AI, largely using Anthropic’s Claude, according to several employees. On October 29, 404 Media published an investigation based on testimony from eight employees, one former employee, internal Slack conversations, meeting recordings and an internal memo by CTO Bart Butler. In a security Slack channel at the end of August, an employee asked for a few days to perform a penetration test on freshly written code before production; CEO Andy Yen replied that this was bullshit and loser thinking and that of course the company can be fast and secure. Butler’s memo said jobs are no longer about writing code and called for code mostly reviewed by AI rather than humans long term. Proton said it does not make layoffs and use AI as an excuse, and did not dispute the investigation.
Proton AI Push: CEO Dismisses Security Tests as Weakness →
How to cut Siri and Gemini off from sensitive apps
Apple introduced a dedicated Excluded Apps setting for Siri AI in iOS 27.2, letting users block the assistant from accessing selected applications on Apple Intelligence-compatible iPhones. Once an app is added, it becomes unavailable to Siri, Search and Siri suggestions, and Siri AI’s on-screen awareness for that app is blocked too. Google Gemini relies on connected-app permissions plus separate controls for screen context and notification access, revocable through the Gemini app’s settings. Google also offers Intelligent Screen Context, which infers when screen information would be useful. Neither approach disables the assistant or prevents all data sharing: screenshots, uploaded files or copied messages deliberately shared may still be processed, and disconnecting an app does not delete information already stored in AI activity history. The Electronic Frontier Foundation has encouraged operating system developers to give users straightforward controls over which applications AI assistants can access.
How to block Siri AI and Google Gemini from accessing your sensitive app data →
Topics: AppleGoogle Gemini
European Parliament tables over 1,000 amendments to GDPR
The European Parliament has tabled more than 1,000 amendments to the GDPR as the EU revises its core privacy law. An analysis of all the amendments identifies which members are the strongest defenders of current privacy protections and which are seeking to undermine them.
Data Privacy Ranking | GDPR OMNIBUS | Data Privacy in the EU Omnibus amendments →