Bilingual

AB 1856: CA Exempts Open Source, Still Expands Age-Gating
19 days ago
- California lawmakers are considering an exemption for open-source operating systems from the age-bracketing requirements of AB 1043 due to public pressure, but concerns remain about threats to speech, privacy, and security.
- AB 1856 expands the age-bracketing regime from operating systems and app stores to include web browsers and websites, increasing constitutional harms to users despite some relief for open-source developers.
- An amendment to AB 1856 exempts open-source operating systems from age data collection, offering partial relief, but ambiguities persist regarding commercial use and application scope.
- EFF opposes AB 1856 because it broadens AB 1043's scope, potentially leading to more age verification, invasive data collection, and barriers to lawful speech without addressing core privacy and anonymity issues.
- The bill has passed the Assembly and moves to the Senate, where EFF will advocate for amendments to narrow AB 1043's impact and enhance user protections against age-gating harms.
Chat Control 1.0 vs. 2.0
17 days ago
- Chat Control 1.0 is Regulation (EU) 2021/1232, a temporary law that allowed voluntary scanning of private messages for child sexual abuse material, excluding encrypted messages; it expired in April 2026 but is being revived by the Council via a fast-track process.
- Chat Control 2.0 is the proposed permanent CSA Regulation, which would mandate detection and reporting; negotiations are deadlocked over issues like mandatory scanning and encryption, with no agreement after five trilogue rounds.
- The EU Parliament has taken protective stances, rejecting extensions of Chat Control 1.0 and advocating for targeted scanning with judicial oversight, while the Council pushes for broader scanning measures.
- Key events include the expiration of Chat Control 1.0, Council attempts to resurrect it, and ongoing trilogue failures for Chat Control 2.0, with encryption and suspicionless scanning as major points of contention.
- As of July 2026, Chat Control 1.0's revival is pending an urgency vote in Parliament, requiring an absolute majority to stop it, while Chat Control 2.0 negotiations continue under the Irish presidency.
Chat Control passed first round in EU Parliament
16 days ago
- EU Parliament narrowly approves urgency motion to reconsider Chat Control 1.0 before summer break.
- Proponents aim to reinstate expired regulation allowing voluntary scans of private communications for child abuse material without suspicion.
- Critics argue the move violates parliamentary procedure and enables mass surveillance under general suspicion.
- Social Democrats cave to pressure, supporting urgency despite prior rejection of Chat Control extension.
- Tactical advantage for proponents due to lower vote threshold on final session day, making re-enactment likely.
- Concerns raised over AI scan error rates and erosion of privacy, with fears it may delay more effective regulations.
The internet does not want readers. It wants livestock
14 days ago
- The internet treats users as livestock, focusing on converting audiences, optimizing funnels, and capturing leads rather than providing genuine content.
- Platforms and tools have become overly complex and intrusive, prioritizing growth and measurement through engagement metrics and attention harvesting, leading to 'enshittification'.
- There is a growing movement of people building websites that reject tracking, pop-ups, and data collection, advocating for simple, respectful online experiences as a radical act of good manners.
Google's new remote attestation scheme is every bit as terrible as its old one
14 days ago
- Google's 'reCAPTCHA Mobile Verification' threatens to block users running independent, 'de-googled' Android versions that prioritize privacy and block ads.
- Browsers act as user agents on the open web, allowing users to control their experience, but Google's walled-garden approach undermines this interoperability.
- Google has engaged in anticompetitive practices, including blocking rival technologies and losing multiple antitrust cases, to cement market dominance.
- De-googled Android alternatives like CalyxOS and Graphene offer enhanced privacy by resisting Google's pervasive data collection.
- Remote attestation technologies, such as Web Environment Integrity (WEI) and reCAPTCHA Mobile Verification, enable servers to reject devices based on their configurations, limiting user choice and accessibility.
The 4th Amendment Moves to the Cloud: Chatrie and the Future of Digital Privacy
15 days ago
- The Supreme Court held that police obtaining cell phone location data via a geofence warrant constitutes a Fourth Amendment search, overriding the third-party doctrine.
- The decision extends Carpenter v. United States principles, emphasizing privacy in location records and rejecting arguments based on data quantity or duration.
- Key unresolved issues include the scope of protection for other digital data, the robustness of Fourth Amendment safeguards, and warrant particularity requirements.
- Justices were divided: a majority upheld privacy expectations, concurrences raised concerns about warrant reasonableness, and dissents favored a broader third-party doctrine.
- The ruling impacts law enforcement practices, data storage policies, and corporate compliance with reverse warrants, highlighting ongoing digital privacy challenges.
Microsoft admits Windows 11 has a GDID tracker with no off switch
12 days ago
- Microsoft's Global Device Identifier (GDID) is a persistent, unique digital fingerprint assigned to Windows installations when users sign in with a Microsoft Account, used for licensing and tracking across services.
- The FBI used GDID to trace alleged hacker Peter Stokes by linking his Windows device's activity across VPNs and proxies to his online accounts, leading to his arrest at Helsinki airport in 2026.
- Privacy concerns arise because GDID is assigned without user consent, lacks visible controls like on Apple or Android, and can persist across reinstalls via Microsoft Account linkages, raising surveillance questions.
- To mitigate GDID tracking, users can switch to local accounts, disable optional diagnostics and advertising IDs, turn off cloud search, or use Linux with Tor for high-risk activities.
India halts WhatsApp global username feature over cyberfraud risk
10 days ago
- WhatsApp introduced global username feature, enabling chatting without sharing phone numbers.
- Indian government objected to the username feature, fearing increased scams and fraud.
- Government also sought explanations from Telegram and Signal regarding their username features.
- Experts warn that conceding to India's demands could lead to global copycat regulations.
- India is WhatsApp's largest market with over 850 million users.
- Username feature could protect users from harassment by separating online identities.
- Government concerns lack evidence, as similar cybercrime risks exist across various platforms.
- WhatsApp emphasized built-in security measures against impersonation in username system.
- India's move could lead to fragmented privacy protections across jurisdictions.
- Public notice on design features is seen as unprecedented government overreach.
They Prefer the App
8 days ago
- The author prefers building websites over mobile apps, but feels like an outsider because many people now primarily use apps and have forgotten about websites.
- Many apps, especially informational ones like those for schools, could be replaced by simple websites but instead restrict basic web features like copy-paste and link handling.
- People often don't understand websites, viewing them as lightweight previews of apps, and services push apps to better track user data, as seen with platforms like LinkedIn or Facebook.
- While the author and a small community prefer using progressive web apps, most users happily download large apps for tasks that websites can handle, making website enthusiasts a minority.
'We decided not to limit VPNs': UK government U-turns on age-gating VPNs
8 days ago
- The UK government decided not to limit VPNs, citing their legitimate privacy and security uses.
- Research shows only 7-10% of teenagers use VPNs to bypass age checks, while 45% use false dates of birth.
- Social media platforms will be required to prevent underage users from circumventing age assurance measures.
- New rules include midnight curfews and default disabling of autoplay and infinite feeds for 16- and 17-year-olds.
- Mandatory breaks for AI chatbot use by under-18s are planned to prevent emotional dependency.
The ACLU Is Arming Lawyers to Expose State Surveillance Secrets
3 days ago
- The ACLU of Massachusetts is releasing an online toolkit for defense attorneys to uncover secret police surveillance use.
- The toolkit includes legal motions to force disclosure of surveillance tech like facial recognition, license plate readers, and AI reports.
- It also features preservation motions to prevent automatic deletion of surveillance data by government and private vendors.
- The effort aims to address the lag between police adopting new tech and courts ruling on its legality.
- Examples show police often hide surveillance use, even from prosecutors, via secrecy agreements or vague warrants.
- The toolkit helps attorneys request the full scope of surveillance, as many currently ask for limited records.
- Preservation motions target self-destructing evidence, such as AI-drafted police reports or automatically deleted footage.
- Massachusetts courts have shown support for digital privacy, with rulings against withheld evidence and for warrant requirements.
- The release coincides with a recent Supreme Court ruling on geofence warrants, which the toolkit addresses.
- The ACLU plans to adapt the toolkit for other states and gather feedback from attorneys using the motions.
Fourth Circuit: Border Agents Can Search Your Phone by Hand, No Suspicion Needed
4 hours ago
- The Fourth Circuit ruled that manual cell phone searches at U.S. borders require no warrant or suspicion, while forensic searches require individualized suspicion.
- EFF argued that all border device searches should need a warrant based on probable cause, or at least the same Fourth Amendment standard.
- The court distinguished manual from forensic searches based on technical differences, but critics note both are equally invasive of privacy.
- Even brief manual searches can reveal intimate personal data, undermining the court's reliance on the search lasting only two minutes.
- A silver lining: the court left open the possibility that lengthier manual searches might require heightened suspicion, but for now officers can bypass higher standards.

Hasty Briefsbeta

#digital privacy

AB 1856: CA Exempts Open Source, Still Expands Age-Gating

Chat Control 1.0 vs. 2.0

Chat Control passed first round in EU Parliament

The internet does not want readers. It wants livestock

Google's new remote attestation scheme is every bit as terrible as its old one

The 4th Amendment Moves to the Cloud: Chatrie and the Future of Digital Privacy

Microsoft admits Windows 11 has a GDID tracker with no off switch

India halts WhatsApp global username feature over cyberfraud risk

They Prefer the App

'We decided not to limit VPNs': UK government U-turns on age-gating VPNs

The ACLU Is Arming Lawyers to Expose State Surveillance Secrets

Fourth Circuit: Border Agents Can Search Your Phone by Hand, No Suspicion Needed