HeadFlash Privacy — a ~4-minute daily brief on digital privacy, data protection and surveillance. New episode every weekday morning.
Latest episodes
-
5 min
Samsung TV telemetry, Johns Hopkins AI leak, and India privacy law fight
A hacker finds Samsung TVs recording audio and screenshots for ads, 3,182 patient records went into an unapproved AI tool, and 21 Indian publishers sue over privacy law.Sources:Cyb…
-
8 min
OpenAI cuts its top models off from the live internet after security scares
OpenAI locks advanced models offline, Google opens a Gmail ad loophole, and EU ambassadors agree six cookie purposes that skip consent.Sources:OpenAI is locking its most advanced A…
-
4 min
eMudhra exits TLS business after 8 weak-key certificates
An Indian certificate authority quits global SSL/TLS after researchers found private keys crackable in milliseconds, plus Malaysia's key custody and a Flock map.Sources:Disgraced e…
-
4 min
Judge orders Meta to pay $25B over Facebook privacy deception
Meta hit with a $25 billion New Mexico penalty, OPM ruled to have illegally shared federal worker records with DOGE, and a PHP flaw sparks breach warnings.Sources:Meta Ordered To P…
-
4 min
Court: OPM broke privacy law giving DOGE federal employee records
A New York federal court ruled OPM unlawfully handed millions of federal employee records to DOGE, while Telegram and AI data brokers face new scrutiny.Sources:Victory! Court Rules…
-
5 min
Meta opens news scraping rights as WhatsApp hides AI orders
Meta's October 30 terms let it scrape news sites for AI, while WhatsApp quietly embedded 102 hidden AI instructions in its help pages.Sources:Meta’s new commercial terms will allow…
-
13 min
Meta hack hits 1,500 people as 15 NHS staff fired over record snooping
Meta confirms stolen GitHub credentials exposed data on 1,500 people, while an NHS trust sacks 15 staff for accessing Nottingham attack victims' records.Sources:Meta says hackers s…
-
9 min
HeadFlash report: the cookie banner doesn't ask for consent. It manufactures it
I checked 50 big websites visible from Poland: what really happens after you click “I do not consent”. On Onet, Poland's biggest news portal, 810 companies still have the green lig…
-
5 min
Citizen Lab: Discover-Tech ads delivered zero-click spyware to Al Jazeera devices
Citizen Lab says an Israeli ad agency's platform served millions of ads that covertly installed spyware, including on dozens of Al Jazeera devices.Sources:Online ads weaponised to…
-
6 min
Doctoralia strips health data trackers after Markup probe
Doctoralia removed web trackers that leaked patient searches and appointment details to Google, LinkedIn and TikTok, while Washington immigration arrests tied to driver data jump f…
-
4 min
Coupang hit with $466M privacy fine as Elgin College bags Flock cameras
South Korea's record data-breach penalty, Pegasus data reaching NSO, and a college that had to trash-bag its own cameras.Sources:Coupang Data Breach Fine Reaches Record $466M: Nati…
-
4 min
Norway fines Microsoft's Xandr $9.6M over Grindr data sharing
Norway's largest-ever privacy fine hits Microsoft's Xandr for exposing Grindr users' sensitive data in ad auctions.Sources:Norway fines Microsoft ad firm $9.6 million over Grindr d…
-
16 min
Google's $10M bid for Spirit Airlines data draws 120 lawmakers' warning
Plus: Dutch push for a kill switch on EU police data deals, and the ICO probes a 169% surge in WhatsApp scam calls.Sources:100M Emails, 500M Chats: Google's Bid for Bankrupt Spirit…
-
4 min
Suffolk County Presses Flock Safety on 200 License Plate Cameras
Lawmakers question data retention, oversight of a 200-camera license plate reader network, while the ICO secures privacy changes from 10 AI developers.Sources:Long Island lawmakers…
-
5 min
Meta's Muse Builds Profiles of Non-Users as Church Hack Exposes 850,000
Meta's AI assistant drafts hourly dossiers on people who never signed up, while a South Korean megachurch breach may have hit 850,000 members.Sources:Meta's Muse Is Building Dossie…
-
4 min
Denmark's CPR Register Breach Hits 8.8 Million; FBI Cuts Accenture After PeopleSoft Hack
Denmark's national register exposed 8.8 million records, the FBI removed an Accenture contractor over an unpatched system, and Indonesia passed a sweeping data law.Sources:8.8 Mill…
-
5 min
Denmark CPR Breach Exposes 8.8 Million Records
Denmark calls the population register breach extremely serious, Seattle bans data-driven grocery pricing, and Raleigh weighs driverless patrol cars.Sources:Data breach hits Denmark…
-
13 min
German Police Read Signal and WhatsApp Messages via Linked Devices
Germany's customs agency has turned messenger device-linking into a permanent surveillance tactic, plus Italy's €7M IQVIA fine and more.Sources:German Police Are Using Linked Devic…
-
5 min
Ethereum Foundation launches zkAPI for private AI payments on mainnet
Ethereum's new zkAPI lets users pay for AI models without revealing identity, while Delhi's 2,500 AI camera plan and Australian chatbot privacy reforms raise fresh concerns.Sources…
-
3 min
Pentagon alerts millions after DMDC breach; Palantir faces 44,000 NHS objections
Pentagon notifies service members of a nine-month DMDC hack, while 44,000 object to Palantir's NHS data platform and a study finds cars sharing more data than phones.Sources:Pentag…