#Privacy
All CosmicBytez Labs articles tagged #Privacy, across news, security advisories, how-to guides, and projects.
- News
Norway Fines Microsoft Ad Unit Xandr $9.6 Million Over Grindr Data Sharing
Norway's Datatilsynet fined Microsoft ad unit Xandr $9.6M (NOK 92M) for unlawfully sharing Grindr users' sexual orientation data with advertisers.
- News
Denmark Says Attackers Accessed CPR Data for 8.8 Million People via Company Account
Attackers abused a Danish company's lawful CPR register access for 10 days in September, exposing names, addresses, and ID numbers for 8.8 million people.
- News
Data Breach at Denmark's National Population Register Exposes 8.8 Million People
Hackers abused a Danish firm's legitimate access to mass-query Denmark's CPR register, exposing names, addresses and ID numbers of 8.8M people.
- News
Bipartisan Backlash to ALPRs Grows as Two High-Profile Bills Are Introduced
Hawley's Stop Flock Abuse Act and the Sanders-Merkley-AOC Ban Flock Act both target Flock Safety's ALPR surveillance networks.
- News
Google Gemini Could Soon Get Full Access to Your Mac's Files, Apps, and the Web
A hidden setting in Gemini's macOS app could let the AI read, edit, and delete any file, control native apps, and browse the web without asking first.
- News
Who's Tracking You? Use This New Service to Find Out
DecryptAds, a free tool from researcher Zach Edwards, cross-references ads.txt and sellers.json files to expose hidden ad-tech trackers and data brokers.
- News
doxx.net Raises $38 Million to Prevent AI Agent-on-the-Internet Misadventures
doxx.net raised a $38M Series A led by a16z to launch ADN, a platform designed to stop AI agents from reaching unsafe destinations.
- News
Google Tests Hidden Setting That Could Give Gemini Full Access to Your Mac
A hidden Gemini Desktop setting could grant full Mac file, app and web access without per-action prompts, as Apple moves to restrict that level of access.
- Security
CVE-2026-93428: Ultimate Member Plugin Missing Authorization Exposes Private Profile Fields
Ultimate Member ≤2.13.1 has a missing-authorization flaw letting unauthenticated attackers read privacy-restricted profile fields via directory AJAX endpoint.
- News
Data Broker Radaris Loses Domains in Privacy Fight
A New Jersey court ordered 14 Radaris domains, including radaris.com, transferred to plaintiffs after the broker stonewalled a Daniel's Law suit.
- News
New Mexico Jury Finds Meta Deceived Consumers About Data Privacy Practices
A New Mexico jury found Facebook violated consumer law 43.9 million times over privacy claims, exposing Meta to up to $219 billion in penalties.
- News
Who's Tracking You? New Service Unmasks Hidden Ad-Tech Networks
New free tool DecryptAds parses ads.txt and app-ads.txt files to expose the ad-tech firms and data brokers tracking you — ESPN.com alone lists 143.
- News
OpenAI Says AI Agents Uploaded User Images to Third-Party Hosting Sites
OpenAI disclosed that AI agents in its research environment posted 53 user-provided images to third-party hosting sites during a broader misalignment review.
- News
Google Fined €403 Million Over Location Data Privacy Violations
Ireland's DPC fined Google €403M ($463M) after finding it failed to meet GDPR transparency requirements across three location-tracking features.
- News
Hidden Meta Muse Setting Lets Local Malware Turn the AI Assistant Into a Backdoor
Researcher Patrick Wardle shows how malware already on a Mac can quietly redirect Muse's mic feed and hijack its granted permissions.
- News
Spain's AEPD Logs First Data Breach Attributed to an Autonomous AI Agent
Spain's data agency logged its first breach report naming an autonomous AI agent, which modified records and accessed invoices after gaining access.
- News
FTC Rescinds Policy Requiring Health Apps to Notify Users After a Breach
The FTC has withdrawn its 2021 policy applying breach notification rules to health apps and connected devices, narrowing compliance obligations.
- News
FTC Rescinds 2021 Policy on Health App Breach Notifications
The FTC withdrew its 2021 policy statement on health app breaches, saying a 2024 rule update already covers the ground it addressed.
- News
Brave Adds Built-In Email Aliases to Fight Tracking
Brave 1.94 adds free email aliases that forward to your real inbox, letting users hide their address from sites and block cross-site tracking.
- News
Manchester Airports Group Confirms Data Breach — Up to 8.9M Travelers Affected
Hackers breached Manchester Airports Group, exposing traveler emails, phone numbers, and vehicle data across three UK airports.
- News
Meta Agrees to $18 Billion Settlement Over Teen Social Media Harms
Meta will pay up to $18B to settle a multistate lawsuit alleging Facebook and Instagram were designed to drive compulsive use among minors.
- News
TikTok Reaches $400M Settlement with DOJ Over COPPA Children's Privacy Violations
The DOJ announced a $400M settlement with TikTok and ByteDance over COPPA violations, marking the largest children's privacy fine in U.S. history.
- News
Uber Fined €825 Million by Dutch Regulators Over Automated Driver Account Suspensions
The Dutch DPA fined Uber €825M for GDPR violations after its algorithm suspended driver accounts without meaningful human review or transparent explanation.
- News
TikTok Agrees to $400 Million Settlement in U.S. Child Privacy Lawsuit
ByteDance's TikTok will pay $400M to the U.S. DOJ to settle 2024 child privacy violations — $300M immediately, $100M deferred, with sweeping new...
- News
Is Online Privacy Possible? How Digital Identities Can Help
Separate digital personas and compartmentalization strategies help users defeat data broker profiling and protect their online privacy.
- News
Poland Probes MyDr Healthcare Software Breach Potentially Affecting 19 Million
Polish authorities are investigating a breach at healthcare software firm MyDr that may have exposed personal data of up to 19 million patients.
- News
14,000 Trezor Customers Impacted by Data Breach at ShipMonk
Hackers stole shipping data including names, addresses, emails, and phone numbers from 14,000 Trezor customers via a breach at logistics firm ShipMonk.
- News
Signal Adds Automatic Key Verification to Thwart Man-in-the-Middle Attacks
Signal launched Automatic Key Verification on August 12, 2026, using key transparency audited by Cloudflare and Trail of Bits to defeat MITM attacks.
- News
Google Chrome Cuts 7 Billion Unwanted Android Notifications Per Day
Google's Chrome anti-abuse systems blocked more than 7 billion unwanted notifications on Android per day during Q1 2026, using AI-powered detection to...
- News
New Mexico Judge Orders Meta to Pay $567 Million in Kids Online Safety Case
A New Mexico judge ordered Meta to pay $567 million in a kids online safety case, creating a $420 million youth treatment fund for social media harms to minors.
- News
South Korea Fines Telco Giant KT $39 Million for Customer Data Breach
South Korea's Personal Information Protection Commission has levied a KRW 53.979 billion ($39 million) fine against KT Corporation for data protection...
- News
Major Australian Energy Supplier Confirms Customer Data Compromised
Origin Energy confirmed that customer data was exposed in a recent breach, as the company works to assess how many Australians are affected.
- News
LG to Ban Residential Proxies from Smart TV Apps
LG Electronics USA announced it will suspend Smart TV apps that enroll viewers' televisions into residential proxy networks — a move triggered by research...
- News
Adobe Acrobat Extension Flaw Let Malicious Sites Read WhatsApp Web Data
Researchers at Guardio disclosed a now-patched vulnerability chain in the Adobe Acrobat Chrome extension dubbed HermeticReader, which could allow...
- News
Spain Fines 23andMe Nearly $3 Million for Cybersecurity Failings Enabling 2023 Hack
Spain's data protection agency AEPD has fined 23andMe approximately $3 million for cybersecurity failures that enabled the 2023 credential-stuffing breach...
- News
The Future of Age Verification: Your Face Never Leaves Your Device
As age verification mandates expand globally, on-device facial age estimation is emerging as a privacy-preserving alternative — processing biometric data...
- News
23andMe to Pay $18 Million in New Genetics Data Breach Settlement
Genetic testing company 23andMe has agreed to pay $18 million to settle claims from 43 attorneys general that it failed to adequately protect customers'...
- News
Centers Laboratory Data Breach Affects 540,000 Individuals
The WorldLeaks extortion group claims to have stolen 720 GB of data from Centers Laboratory, a healthcare testing and laboratory services provider,...
- News
Google and Microsoft Pull ModHeader After Hidden Tracker Found in 1.6M-Install Extension
Google and Microsoft have removed ModHeader — a popular HTTP header editor with 1.6 million installs across Chrome and Edge — after researchers discovered...
- News
Cash App Owner to Pay $45 Million Over Lax Security Allegations
Block, Inc. — the company behind Cash App — has agreed to pay $45 million to settle a bipartisan multi-state investigation alleging the fintech firm...
- News
Google Loses Final Appeal to Overturn €4.1 Billion EU Antitrust Fine
The Court of Justice of the European Union has dismissed Google's final appeal against a €4.1 billion antitrust fine, confirming that the company...
- News
WhatsApp Is Finally Getting Usernames to Help Keep Phone Numbers Private
WhatsApp has begun global rollout of optional usernames, allowing over 3 billion users to connect without sharing their phone numbers — closing a major...
- News
Google to Use UK and EU User IP Addresses for Ad Personalization
Starting August 3, 2026, Google will use IP addresses from UK, EEA, and Switzerland users for ad measurement and personalization — a reversal of its...
- News
UK to Require Government ID or Face Scan Before Creating Social Media Accounts
Opening a new social media account in the UK will soon require proving you are over 16 with a government ID upload or facial age scan, under a ban on...
- News
23andMe $47 Million Settlement Approved for 7 Million Breach Victims
A bankruptcy administrator has approved a $47 million settlement fund for roughly 7 million 23andMe customers whose genetic and health data was stolen by...
- News
Japanese Energy Firm Loses Drive with Data of 10.9 Million Clients
Kyushu Electric Power Co., Inc. has disclosed a physical security incident exposing private data of more than 10 million customers after a hard drive...
- News
Maine Breach Portal Abused to Publish Fake Data Breach Disclosures
Fraudulent data breach disclosures were submitted to Maine's official breach notification portal and publicly posted before legitimacy could be verified,...
- News
Free Apps Are Quietly Turning Smart TVs Into Web-Scraping Proxies for AI
A researcher has reverse-engineered the iOS SDK that Bright Data embeds in consumer apps and documented how it turns devices — including always-on smart TVs…
- News
California AG Sues 23andMe Over 2023 Breach Exposing Genetic Health Data
California Attorney General Rob Bonta filed a lawsuit against 23andMe — now Chrome Holding Co. — over its failure to protect millions of customers'...
- Project
Pi-hole v6 + Unbound: Network-Wide DNS Sinkhole with Recursive Resolution
Deploy Pi-hole v6 as a network-wide DNS sinkhole backed by Unbound as a self-hosted recursive resolver — eliminating ads, trackers, and malware domains...
- News
Microsoft Backpedals: Edge to Stop Loading Cleartext
Microsoft is reversing course on a controversial Edge browser behavior that loaded all saved passwords into process memory in cleartext at startup — a...
- News
Here's How the FTC Plans to Enforce the Take It Down Act
The FTC will levy hefty fines and pursue investigations against platforms that fail to remove non-consensual intimate imagery, including AI-generated...
- News
GM Agrees to $12.75M California Settlement Over Sale of Drivers' Data
General Motors will pay $12.75 million to settle California allegations that it violated the California Consumer Privacy Act by collecting and selling...
- News
GM to Pay Over $12 Million in California Privacy Settlement
General Motors has agreed to pay over $12 million to settle California privacy violations under the CCPA after sharing detailed driver behavior data —...
- News
GM to Pay Over $12 Million in Largest-Ever CCPA Fine Over
California regulators have issued a record $12 million settlement against General Motors for sharing OnStar driving behavior data with insurers without...
- News
European Commission Accuses Meta of Breaching Child Safety
The European Commission has formally accused Meta of violating the Digital Services Act by failing to adequately protect children under 13 from accessing...
- News
Firefox Vulnerability Allows Tor User Fingerprinting Across
A high-severity Firefox vulnerability (CVE-2026-6770) exploits the internal ordering of IndexedDB database names to generate a stable 44-bit fingerprint...
- Project
Self-Hosted Password Manager with Vaultwarden
Deploy a fully self-hosted, Bitwarden-compatible password manager using Vaultwarden on Docker with Caddy reverse proxy, automatic TLS, WebSocket...
- News
Google Blocks 8.3B Policy-Violating Ads in 2025, Launches
Google removed over 8.3 billion policy-violating ads and suspended 24.9 million accounts in 2025, while simultaneously rolling out sweeping Android 17...
- News
Citizen Lab: Law Enforcement Used Webloc to Track 500
Citizen Lab has documented how an Israeli surveillance company called Cobwebs Technologies built an advertising-based global geolocation platform named...
- News
Hims & Hers Breach Exposes the Most Sensitive Kinds of Patient PHI
ShinyHunters exploited compromised Okta SSO credentials to breach the Hims & Hers Zendesk customer support platform, exposing treatment category data for...
- Security
CVE-2026-28766: Gardyn Smart Garden API Exposes All User
A critical unauthenticated information disclosure vulnerability in the Gardyn smart garden platform exposes all registered user account information via a...
- Project
WireGuard Road Warrior VPN Server
Build a self-hosted WireGuard VPN server on Ubuntu for secure remote access — with NAT masquerading, DNS leak protection, QR-code client provisioning, and...
- News
Dutch Court Threatens xAI with Fines Over Grok's
A Dutch court has ordered Elon Musk's xAI to stop generating nonconsensual nude images via Grok or face fines of €100,000 ($115,000) per day for...
- News
European Parliament Rejects Extension of CSAM Scanning
The European Parliament voted 311 to reject an extension of CSAM scanning obligations for tech platforms, dealing a major blow to proposals that would...
- News
Weekly Recap: CI/CD Backdoor, FBI Buys Location Data
This week's cybersecurity roundup covers supply chain attacks hitting CI/CD pipelines, long-running IoT botnets finally disrupted, the FBI's warrantless...
- News
Cegedim Santé Breach Exposes 15.8 Million French Healthcare
A cyberattack on French healthcare software vendor Cegedim Santé exposed 15.8 million patient records from 3,800 doctors, with leaked data including...
- News
OpenAI Says ChatGPT Ads Are Not Rolling Out Globally For Now
OpenAI confirmed that ChatGPT ads remain a U.S.-only pilot for Free and Go plan users, despite a global privacy policy update that alarmed international...
- News
IDMerit KYC Data Breach Exposes 1 Billion Records Across 26
An unprotected MongoDB instance belonging to identity verification firm IDMerit left over 1 billion personal records — including SSNs, passport numbers,...
- News
Persona Source Code Leak Exposes Hidden Biometric
A 53MB source code leak from identity verification giant Persona reveals how routine age verification selfies feed into a surveillance system linking...
- News
AI Chat App Exposes 300 Million Private Messages from 25
A misconfigured Google Firebase backend in the Chat & Ask AI app exposed 300 million private chatbot conversations from 25 million users, including...
- News
Odido Data Breach Exposes 6.2 Million Dutch Telecom
The Netherlands' largest mobile network operator Odido has disclosed a data breach affecting 6.2 million customers, exposing names, addresses, bank...
- News
IRS Shares Tax Data of 1.28 Million Individuals with DHS
The IRS faces legal action after improperly disclosing confidential tax information of 1.28 million individuals to DHS for immigration enforcement,...
- News
Louis Vuitton, Dior, and Tiffany Fined $25 Million Over
South Korea's data protection authority has fined three LVMH luxury brands a combined $25 million for data breaches affecting millions of customers, with...
- News
6.8 Billion Emails Exposed Online in Massive Data Leak
A hacker revealed 6.8 billion email addresses online on February 11, 2026, in one of the largest email database leaks in history, raising concerns about...
- Project
Build a Dedicated OSINT Investigation Workstation
Set up a purpose-built OSINT workstation with Trace Labs VM, sock puppet management, browser isolation, VPN routing, and automated investigation workflows...
- News
Substack Discloses Data Breach After 100-Day Undetected
Substack CEO Chris Best disclosed a data breach on February 5 affecting approximately 700,000 users, after an unauthorized party accessed the platform...
- HOWTO
Pi-hole DNS Security: Block Ads, Trackers, and Malware
Deploy Pi-hole for network-wide ad blocking and DNS security. Includes setup, configuration, upstream DNS options, and integration with encrypted DNS.
- News
Telegram Investigating Claims of 30 Million User Data Breach
Telegram is investigating claims that a threat actor is selling data from 30 million users. The company denies any breach of its systems while the...
- HOWTO
Self-Hosting a Password Manager: Vaultwarden Setup Guide
Deploy your own password manager with Vaultwarden (Bitwarden-compatible). Includes secure configuration, SSL setup, and backup procedures.