Privacy Digest 23/26
Get Privacy Digest in your inbox
Subscribe
Ads in Popular Apps Give Police a Powerful Tool to Spy on Users
An investigation reveals how Penlink’s Webloc lets authorities search billions of location records collected through advertising trackers embedded in everyday apps. The system can identify phones present at a specific place and time, reconstruct movements over 12 months, and update locations hourly. Customers include US Immigration and Customs Enforcement, local police forces, and authorities in Germany, the UK, and other countries. In the US, agencies can purchase commercially collected location data without the warrant generally required to obtain similar records from phone companies. Even app developers may not know their users’ data ultimately reaches surveillance companies.
bloomberg.com
Hands-On With Ring’s New AI Drone Camera for Your Home
Amazon's Ring is launching a $249.99 indoor security drone in January 2027 that can autonomously patrol your home, respond to alarms, and stream video through the Ring app. Powered by cloud-based AI, it maps rooms, navigates obstacles, and follows programmed routes. Ring says the camera records only during flight and remains covered when docked. Its new encryption system limits Amazon's access to footage, but cloud processing remains essential for navigation and AI-powered features. With cameras now capable of moving independently through private spaces, the device introduces new questions about surveillance, data collection, and privacy inside our homes.
theverge.com
Everyone Everywhere Hated Meta’s New AI Training Terms. Now, They’re on Pause
Following widespread backlash, Meta has suspended changes to its commercial terms that would have allowed the company to collect content from websites linked to business accounts for AI training and other purposes. Publishers and businesses objected to the possibility of their work being used without permission or compensation. A Norwegian court temporarily blocked the changes following legal action supported by 180 media companies, while UK regulators announced an investigation. Meta initially delayed the update and narrowed its scope before putting it on hold entirely. Existing terms remain in effect, and the company has not announced when or whether revised rules will follow.
404media.co
Revealed: Palantir Lobbied Minister to Stretch AI Tools’ Reach to NHS GP Records
Private WhatsApp messages reveal that US technology company Palantir lobbied a British health minister to extend its software to family doctors' records, despite their exclusion from its existing £330 million contract with England's National Health Service (NHS). Palantir argues that linking healthcare data could improve patient care, while doctors warn that access to identifiable medical information could undermine trust and confidentiality. The controversy has deepened after NHS England removed claims about the software's adoption, following revelations that 29 hospital trusts were not using all or most of it. The company maintains that its technology preserves local control over patient data.
theguardian.com
Cyberattack on Fireworks AI Allowed Hackers to Access Notion Customers’ Chat Transcripts
Hackers breached AI infrastructure provider Fireworks AI, exposing customer data from companies relying on its services, including Notion. The attackers accessed conversations from Notion AI's Insights feature, potentially revealing both users' questions and AI-generated responses. Around 1% of Notion customers were affected, although much of the stolen information could not be linked to specific individuals. Notion disconnected from Fireworks and deleted data stored on its systems after learning of the breach. The incident, Fireworks' second in two months, highlights how information shared with AI assistants can become vulnerable through third-party providers users may not even know exist.
techcrunch.com
Google Wanted Spirit Airlines Data. Flight Attendants Found a Way to Opt Out
A proposed $10 million sale of Spirit Airlines' historical records to Google for AI training has prompted an unusual privacy victory for workers. After flight attendants challenged the deal, new safeguards were introduced to protect personal information contained in billions of emails, workplace messages, and employee records. An independent company will remove identifying details, while sensitive medical, labor, and safety documents will be excluded entirely. Google has agreed to preserve these protections but can withdraw if too much data is removed. The agreement still requires court approval and could establish an important precedent for employee privacy in AI training.
wired.com
Join our 450,000 + subscribers
Feel more secure and empowered online with every new edition of Ghostery’s Privacy Digest.
