Biometric Data Policy

Unknown — Fri, 17 Jul 2026 00:00:00 +0000

Biometrics are optional. Face and voice protection are Executive-tier features that require your explicit, written consent before we collect anything. The rest of KnytX works without them.</li>

We store math, not photos. Your face becomes a 512-number vector. Your voice becomes a 192-number vector. The original photos and audio are deleted immediately after we extract these embeddings.</li>

The embeddings are encrypted with AES-256-GCM. The keys are held separately. Even our engineers can't read them in bulk.</li>

We never sell or share biometric data. Not to advertisers, not to brokers, not to law enforcement except under a valid court order — and we will tell you if that happens unless legally gagged.</li>

You can delete it all in one click. When you do, the embeddings are destroyed — not soft-deleted, not archived, not anonymized. Gone. We log the destruction so you can prove it happened.</li>

If you downgrade or cancel, your biometrics are destroyed automatically within 7 days, even if you forget to ask.</li> </ul> </div> </div>
Effective: 22 May 2026.
1. What this policy covers</h2> This policy supplements the main KnytX Privacy Policy</a> and applies specifically to biometric identifiers and biometric information collected through KnytX Executive-tier identity-protection features. Two categories of biometric data are in scope:

Facial embeddings — 512-dimensional numeric vectors derived from photos you upload during identity onboarding. We use them to detect social-media profiles that impersonate you.</li>
Voiceprints — 192-dimensional numeric vectors derived from a voice sample you record during enrollment. We use them to detect AI voice clones used in scam calls and CEO-fraud attempts.</li> </ul>
Both are treated as protected biometric data across the regimes we operate in:
Regime</th> Classification</th></tr></thead>

Illinois BIPA</td> “biometric identifiers”</td></tr>
GDPR Article 9</td> “special category data”</td></tr>
CCPA §1798.140(ae)</td> “sensitive personal information”</td></tr>
Texas CUBI</td> “biometric identifiers”</td></tr>
Washington My Health My Data</td> “consumer health data” (when collected for impersonation defense)</td></tr> </tbody></table>
2. The controller, the basis, and the consent</h2>
Controller / Data Fiduciary: NCRYPTO Labs Private Limited, Bangalore, India. See Section 1 of the main privacy policy</a> for full controller identification.
Lawful basis:
Regime</th> Basis</th></tr></thead>

GDPR / UK GDPR</td> Article 9(2)(a) — explicit consent. Article 6(1)(a) — consent for the underlying processing.</td></tr>
DPDPA, 2023</td> §6 consent, with notice under §5. Treated as data of heightened sensitivity in our DPIA.</td></tr>
CCPA / CPRA</td> §1798.121 right-to-limit complied with by default; processing limited to the purposes you authorised.</td></tr>
BIPA (Illinois)</td> §15(b) written release obtained before collection.</td></tr>
Texas CUBI</td> §503.001 informed consent obtained before capture.</td></tr>
Washington My Health My Data</td> Affirmative, opt-in consent obtained before collection or sharing.</td></tr> </tbody></table>
Consent capture: When you enroll a face or voice, we present the full consent text on-screen, you must tick an unticked box and click “I consent”, and we record:

the exact consent text shown (consent_text</code>)</li>
the consent version identifier (consent_version</code>, e.g. biometric_v1</code> for face, voice_biometric_v1</code> for voice)</li>
the timestamp (consented_at</code>)</li>
the IP address from which consent was given</li>
the user account that gave consent</li> </ul> This record persists even after you revoke consent, because BIPA §15(a) and GDPR Article 7(1) require us to be able to demonstrate that consent was given. 2a. BIPA §15(b) written-release requirement</h2> Illinois law (740 ILCS 14/15(b)) prohibits any private entity from collecting, capturing, or otherwise obtaining a person’s biometric identifier or biometric information unless it first: Informs the individual in writing that biometric data is being collected or stored;</li> Informs the individual in writing of the specific purpose and length of term for which the biometric data is being collected, stored, and used; and</li> Receives a written release executed by the individual.</li> </ol> KnytX satisfies these requirements as follows: Disclosure of collection (§15(b)(1)). The enrollment consent screen states plainly: “KnytX will derive a numeric facial embedding (512 numbers) / voiceprint embedding (192 numbers) from the material you upload. This is biometric data under Illinois BIPA and similar laws.” Purpose and retention disclosure (§15(b)(2)). The same screen states: Purpose: Detection of social-media profiles impersonating you (face) / detection of AI voice clones (voice).</li> Retention: Your biometric data is retained for the duration of your Executive-tier subscription, or until you revoke consent, whichever is earlier. Automatic deletion occurs within 7 days of plan downgrade, subscription cancellation, or consent revocation. Retention never exceeds 3 years — BIPA §15(a)’s statutory maximum. The full trigger table is in Section 6.</li> </ul> Written release (§15(b)(3)). The enrollment flow requires three steps: (i) read the full disclosure text presented on-screen, (ii) tick an unticked checkbox labelled “I have read and agree to the biometric data disclosure above”, and (iii) click the “I consent” button. This interaction is recorded with the data elements set out in Section 2 above. It constitutes the written release required by §15(b)(3). Electronic consent satisfies Illinois law under 5 ILCS 175/5-120. Illinois residents may request a copy of their written-release record by emailing legal@knytx.com</a> with subject line “BIPA §15(b) record request”. 3. What we collect and what we do not</h2> We collect: 2 to 3 reference photos (face enrollment), processed on our EU servers, then deleted within seconds of embedding extraction</li> One short voice sample (voice enrollment), processed on our EU servers, then deleted within seconds of embedding extraction</li> The resulting embeddings (encrypted at rest)</li> The cryptographic hash of each original input (for deduplication only — the hash is not reversible)</li> </ul> We do not collect, derive, or store: Raw photos or audio after embeddings have been extracted</li> Any embedding of a person who has not personally enrolled and consented</li> Embeddings of minors. Family-plan minors do not receive biometric enrollment; this is enforced in code.</li> Faceprints of bystanders captured in your reference photo (we reject photos containing more than one detectable face)</li> Health, ethnicity, age, gender, or any demographic inference from your biometrics. We do not run such models.</li> </ul> 4. How embeddings are protected</h2> In short: embeddings are made and stored on our own EU infrastructure, encrypted with per-customer keys. No cloud biometric API sees your raw data, and nobody can decrypt embeddings in bulk from the app. Local extraction. Embeddings are generated by an ONNX model (ArcFace for face, ECAPA-TDNN for voice) running on our own infrastructure in the EU. No cloud biometric API touches your raw data.</li> Encryption. Each embedding is encrypted with AES-256-GCM using a per-tenant key. The key is held in a separate key-management service and is rotated on a documented schedule.</li> Access control. Bulk decryption of embeddings is not possible from the application layer. A break-glass procedure exists for incident response; every break-glass event is logged and reviewed.</li> No transit outside the EU. Facial and voice embeddings are stored exclusively on our own infrastructure in the Frankfurt data region, inside the European Union. Cross-border replication for disaster recovery uses the same encryption and stays within EU-adequate jurisdictions.</li> </ul> 5. Purposes — and only these purposes</h2> In short: we use your biometrics only to spot impersonators, catch voice clones, and verify content you send us. Never for login, advertising, or model training. Biometric embeddings are used only for: Impersonation detection. Comparing your facial embedding against profile photos discovered by our impersonation scanner on social platforms, returning candidates with a similarity score for your manual confirmation.</li> Voice-clone detection. Comparing an inbound voice sample (one you ask us to verify) against your enrolled voiceprint, and against generative-audio artifacts.</li> Deepfake verification on demand. When you upload a suspicious image or audio for verification, we compare it against your own enrolled biometrics to answer “is this really you?”</li> </ol> Biometrics are never used for: Authentication or login (we use OIDC + passwords, not face/voice)</li> Advertising, profiling, or any commercial purpose other than the protection service you paid for</li> Training of any generalised model. Our face and voice models are pre-trained on publicly licensed datasets and are not fine-tuned on customer data.</li> Sharing with any third party, including data brokers, advertisers, government agencies (except under compelled legal process), or affiliated companies.</li> </ul> 6. Retention and irrevocable destruction</h2> In short: delete it yourself any time. We also delete it automatically within 7 days of a downgrade or cancellation. Destruction is permanent — the key is destroyed and the data is overwritten, with no backup that survives. Trigger</th> What happens</th> Timeline</th></tr></thead> You click “Delete biometric data”</td> All embeddings destroyed; consent record marked revoked; detected-profile cache cleared</td> Immediate; confirmation event logged within 24h</td></tr> You downgrade below Executive tier</td> Automatic deletion job destroys embeddings</td> Within 7 days of downgrade</td></tr> You cancel your subscription</td> Automatic deletion of embeddings, plus all other data per main privacy policy</td> Within 30 days; biometrics within 7</td></tr> You revoke consent without cancelling</td> Embeddings destroyed; affected features disabled</td> Immediate</td></tr> Account inactivity > 24 months</td> Embeddings auto-purged ahead of broader account-data deletion</td> Within 12 months of trigger</td></tr> </tbody></table> “Destruction” means cryptographic shredding: the per-tenant encryption key is destroyed and the ciphertext is overwritten. There is no soft-delete, no archive copy, no analytics export, no backup that survives. Destruction is logged with timestamp and operator (or system job) identity for audit. This commitment satisfies BIPA §15(a) (“permanently destroy” within statutory schedule), GDPR Article 17, DPDPA §13, CCPA §1798.105(c), Texas CUBI §503.001(c-1), and Washington My Health My Data §10. 7. Your rights</h2> In addition to the rights in the main privacy policy</a>, you have these biometric-specific rights: Right to refuse. You can use every non-Executive KnytX feature without enrolling biometrics. Executive without face/voice enrollment is supported — name-only impersonation scanning remains available.</li> Right to withdraw consent at any time. Use the “Delete biometric data” control in your account, or email legal@knytx.com</a>. Withdrawal is effective on receipt; we do not require a reason.</li> Right to a deletion certificate. On request, we will provide a signed certificate stating which embeddings existed, when they were destroyed, and the destruction method.</li> Right to know. You can ask what biometric data we hold. We will respond with the categories, retention period, and current encryption status. We do not reveal the encrypted vector itself, which would defeat the purpose.</li> Right not to be retaliated against. Withdrawing biometric consent does not affect your subscription, pricing, or access to non-biometric features.</li> BIPA statutory damages (Illinois residents). Under BIPA, individuals may be entitled to statutory damages of $1,000–$5,000 per violation for improper biometric data collection or disclosure. This is a disclosure of your legal rights, not a legal representation by KnytX.</li> </ul> 8. Children</h2> We do not collect biometric data from anyone under 18. The Executive tier is not sold to minors. Family-plan minor accounts are blocked from biometric enrollment in code. If you believe a minor’s biometric data has been collected, contact legal@knytx.com</a> immediately and we will destroy it within 24 hours. 9. Disclosures and government requests</h2> We will not voluntarily disclose biometric data to any government or law-enforcement agency. We may be compelled by a valid court order, in which case: We will challenge requests that appear overbroad, jurisdictionally improper, or that target a category of users rather than a named individual.</li> We will notify the affected user unless we are legally prohibited from doing so.</li> Disclosures are logged and counted in our annual transparency report.</li> </ol> We do not voluntarily share biometric data with NCRYPTO Labs sister entities (Stalten, XRTE) or with KnytX commercial partners. 10. Changes to this policy</h2> Sometimes we change the scope of biometric processing — for example, by introducing a new model, a new use case, or a new sub-processor. When we do, we obtain fresh consent before processing your existing biometric data under the new terms. Your prior consent does not roll forward silently. Material changes are notified by email at least 30 days before they take effect; you may delete your biometrics before the change without penalty. 11. Data Protection Impact Assessment</h2> GDPR Article 35 requires a DPIA for large-scale processing of special-category data. We have completed a DPIA covering facial-embedding and voiceprint processing. A redacted summary is available on request at legal@knytx.com</a>; the unredacted version is shared with supervisory authorities on request. 12. Contact</h2> Biometric-specific questions: legal@knytx.com</a>, subject line “Biometric Policy”. For the standing controller details, postal address, and supervisory-authority routing, see Section 12 of the main Privacy Policy</a>. Impersonation Takedowns — How Evidence Is Handled Unknown — Fri, 17 Jul 2026 00:00:00 +0000 Plain-language summary</div> When you click "Not me" on a detected profile, we keep an evidence package. Profile URL, the impersonator's screen name, the snapshot of the profile photo, the similarity scores, and the date you confirmed.</li> We file takedown reports with the platform. Instagram, Facebook, Twitter/X, TikTok, LinkedIn — using each platform's own impersonation-report endpoint.</li> The impersonator's data is held under legitimate interest (GDPR Art. 6(1)(f)), balanced against your right not to be impersonated. We do not over-collect and we do not retain longer than the takedown process requires.</li> If the platform closes the case or the profile disappears, we delete the evidence within 12 months. Successful takedowns keep a minimal record (URL + date) for audit only.</li> We do not pursue counter-notices. If an impersonator contests, we hand the matter back to you. KnytX is not your attorney.</li> </ul> </div> </div> Effective: 22 May 2026. 1. Context</h2> The KnytX impersonation scanner (Pro tier and above) and the Vigil</a> daily scan (Executive tier) discover social-media profiles that may be impersonating you. For each candidate the dashboard asks “Is this you?” with two buttons: This is me and Not me. When you click “Not me”, you are telling us that the profile is an impersonator. That click triggers two things. First, we file a takedown report with the relevant platform on your behalf. Second, we retain a small evidence package about the impersonator, who is themselves a third party with data-protection rights. This page explains how we balance your right not to be impersonated against the impersonator’s data-protection rights, and what specifically we store and for how long. 2. What we collect about the impersonator</h2> When you confirm an impersonation, we snapshot the following from public sources only: The platform (Instagram, Facebook, Twitter/X, TikTok, LinkedIn, etc.)</li> The profile URL (the public link to the impersonating account)</li> The screen name / handle as shown on the platform</li> The display name and bio (where publicly visible)</li> The profile photo as it appeared at the time of detection (we store a hash and a low-resolution snapshot)</li> The face-similarity and name-similarity scores our scanner computed</li> The date and time of detection</li> The date and time you confirmed “Not me”</li> The takedown channel we used and the platform’s response</li> </ul> We do not collect: The impersonator’s posts beyond the bio</li> The impersonator’s followers, friends, or social graph</li> Any private data, login data, or anything behind authentication</li> IP addresses, device fingerprints, or any data we could not see by visiting the public profile URL</li> Real-name identification of the impersonator unless they have themselves published it on the profile</li> </ul> The snapshot exists for one reason. If the platform requires evidence, or the impersonator changes their profile after we report it, you can still show what the impersonating profile looked like at the time of detection. 3. Lawful basis for processing the impersonator’s data</h2> In short: the impersonator has data-protection rights too. We rely on legitimate interest (your right not to be impersonated), we ran the balancing test, and we collect only what the takedown report needs. The impersonator is a data subject under GDPR, UK GDPR, DPDPA, and other regimes. Those regimes protect data about identified or identifiable natural persons, regardless of whether the person is using their real name. We process their public profile information under: GDPR Article 6(1)(f) — legitimate interest. The legitimate interest is your right not to be impersonated and the public interest in deterring identity fraud. We have conducted the three-part balancing test (purpose, necessity, balancing) and documented it in our DPIA. Protecting a real person from impersonation outweighs the impersonator’s interest in keeping a public deceptive profile up. And we collect only what the takedown report needs. The full cross-regime legal basis for our impersonation-defense activities is set out in the legal framework matrix</a>.</li> GDPR Article 9 — not invoked. We do not collect special-category data about the impersonator. The biometric comparison runs on your enrolled embedding against a publicly visible profile photo. The impersonator’s biometric data is not separately stored — only the similarity score and a snapshot of the public photo, both minimum-necessary for the takedown.</li> DPDPA, 2023 §7 — voluntarily-disclosed publicly-available personal data of the impersonator, processed for a specified legitimate purpose (defending the Data Principal against impersonation).</li> California CCPA — the impersonator may or may not be a California resident; processing of publicly-available information under the Act’s public-records / publicly-available carve-outs.</li> </ul> Sometimes a flagged profile turns out to be a legitimate look-alike — someone who happens to share your name and resemble you, but is not actually impersonating you. In that case the legitimate-interest balance shifts. We will, on the look-alike’s request, delete the snapshot and remove the takedown report from our system. 4. The takedown report</h2> The takedown report we file with the platform contains: A statement that you (named) consider the profile to be impersonating you</li> The URL of the impersonating profile</li> The URL of your verified profile on the same platform, if any</li> The similarity scores and a brief technical summary in plain English</li> A sworn statement (some platform impersonation flows require one)</li> KnytX’s identification as your authorised agent</a> for the purpose of filing the report</li> </ul> Each platform has its own report endpoint: Instagram: Help Centre impersonation form</li> Facebook: Help Centre impersonation form</li> Twitter / X: Impersonation report form</li> LinkedIn: Trust and safety report</li> TikTok: Trust and safety report</li> </ul> We file through the platform’s own channels. We do not file under DMCA §512 unless the impersonation also involves copyright infringement — for example, the impersonator using your copyrighted photos. DMCA was designed for copyright, not for identity. Misusing DMCA notices is a federal cause of action, and we will not file them improperly. 5. Counter-notices and contested takedowns</h2> If an impersonator contests the takedown — which they sometimes do, particularly on platforms that allow appeals — we surface the contest in your dashboard and stop. We do not: File a second report claiming the contest is fraudulent</li> Threaten the impersonator or the platform</li> Pursue litigation on your behalf</li> </ul> What we will do, if you ask: Provide you with the full evidence package we retained</li> Refer you to relevant supervisory authorities (the EDPB has guidance; the California AG has an impersonation-and-identity-theft channel; the FTC accepts identity-theft reports)</li> Refer you to attorneys who specialise in online impersonation in your jurisdiction. We do not maintain a referral business, so we give you a list of resources, not a single recommendation.</li> </ul> The line between an aggressive impersonator and a contested look-alike claim is genuinely hard; we are not going to pretend it is not. KnytX defaults to caution: we will not escalate without your fresh instruction. 6. Retention</h2> In short: we keep full evidence only while the takedown is live. After it closes, we cut back to a minimal record (URL, date, outcome), and you can ask us to delete evidence sooner. Status</th> Retention</th></tr></thead> Takedown successful (profile removed by platform)</td> 12 months of full evidence, then minimal record (URL + date + outcome) retained for audit</td></tr> Takedown filed, no response from platform</td> 18 months, then closed and minimised</td></tr> Contested by impersonator, you instruct us to stop</td> 6 months of full evidence (in case you re-open), then minimised</td></tr> Contested by impersonator, you instruct us to continue</td> Retained until matter resolved</td></tr> Look-alike requests deletion and you accept</td> Full evidence deleted within 30 days; closure note retained for audit</td></tr> </tbody></table> Minimised records contain only what is necessary to demonstrate, in a future audit or dispute, that a takedown was filed on a specified date and what the outcome was. The impersonator’s name, photo, and bio are removed at minimisation time. You can request earlier deletion of evidence at any time. We will honour the request unless the matter is currently contested. 7. Your access and the impersonator’s access</h2> In short: you can download your full evidence package any time. If the impersonator asks what we hold, we tell them the categories and basis, but we do not reveal who reported them unless the law forces it. Your access. You can download the full evidence package for any takedown from your KnytX dashboard. The package includes everything in Section 2 plus the report we filed and any platform response. The impersonator’s access. If the impersonator is identifiable and submits a verifiable data-subject access request to legal@knytx.com</a>, we will: Verify the request to the extent reasonably possible without further infringing on you.</li> Respond with the categories of data we hold about them, the lawful basis, the recipient (the platform we reported to), and the retention period.</li> Decline to name the person who reported them, unless a valid legal process compels it. Naming the reporter would risk further harm to the data subject who was being impersonated.</li> Refer disputes to the relevant supervisory authority where we and the impersonator cannot agree.</li> </ol> This balance — disclosing the existence and categories of processing, declining to disclose the reporter — is consistent with EDPB guidance on conflicting data-subject rights. 8. What this is not</h2> It is not defamation work. If you believe the impersonator has defamed you, you need an attorney.</li> It is not criminal complaint work. If the impersonator’s conduct rises to fraud, harassment, or stalking, file with law enforcement; we can help you compile the evidence package, but we cannot file on your behalf.</li> It is not litigation. KnytX does not sue impersonators.</li> </ul> 9. Questions</h2> Impersonation-evidence questions: legal@knytx.com</a>, subject line “Impersonation Takedown”. Active impersonation in progress: security@knytx.com</a> for emergency triage during business hours. Mobile App Permissions — What We Use & Why Unknown — Fri, 17 Jul 2026 00:00:00 +0000 Plain-language summary</div> Yes, we ask for sensitive permissions. Scam call screening needs access to incoming calls. SMS phishing detection needs access to incoming SMS. We are honest about this.</li> SMS bodies and call audio stay on your device. The screening logic runs locally. Only metadata that is genuinely needed (an extracted URL, a phone number for caller-ID lookup) ever crosses the wire — and where possible it crosses as a hash.</li> Camera and microphone are Executive-only. They are used for one-time biometric enrollment, with consent, and you can revoke at any time. See the Biometric Data Policy</a>.</li> You can revoke any permission at any time. The app degrades gracefully — features that require the permission stop working, and we tell you in plain English what stopped.</li> The mobile code will be open source (GPLv3). Published at github.com/knytx</a> at launch (planned — not yet public; see our open-source roadmap</a>). Verify what the code actually does.</li> </ul> </div> </div> Effective: 22 May 2026. This page satisfies the disclosure obligations under the Google Play Sensitive App Permissions policy, the Apple App Review Guidelines §5.1.1 (Data Collection and Storage), and GDPR Article 13 transparency requirements. 1. Why a mobile app asks for so much</h2> The KnytX mobile app is a passive shield. It exists so you do not have to think about scam calls, phishing SMS, or impersonation alerts; it taps you on the shoulder when something needs your attention and stays out of your way the rest of the time. To do that, it needs access to the channels through which threats actually arrive. Those channels — your incoming calls, your incoming SMS — are some of the most sensitive surfaces on your device. Both Google Play (Sensitive App Permissions policy) and Apple App Store (Guideline §5.1.1) set rules for apps that request such permissions. The app must disclose the exact use, route the most sensitive processing on-device where feasible, and offer a permission-revocation path that does not break the app’s basic value. This page is the disclosure they require, and the disclosure you deserve. 2. Android permissions</h2> Permission</th> Platform</th> Feature served</th> What crosses the wire</th> Lawful basis</th> If revoked</th></tr></thead> READ_CALL_LOG</code> and READ_PHONE_STATE</code></td> Android</td> Passive Call Shield — checks incoming caller-ID against a locally-cached scam-number database before your phone finishes ringing</td> Nothing during a call. Periodic background sync downloads the scam-number database delta (compressed, signed); no per-call telemetry</td> GDPR Art. 6(1)(b) performance; Art. 6(1)(f) legitimate interest in telephony fraud protection</td> Passive Call Shield stops. Rest of the app remains functional. Dashboard explains which features stopped and why</td></tr> READ_SMS</code> and RECEIVE_SMS</code></td> Android</td> Passive Link Shield — reads incoming SMS bodies, extracts URLs, checks against phishing-classification API, posts warning if URL is malicious. SMS body parsed locally; only extracted URL sent for classification</td> URLs only. Never the SMS body, sender, or timestamp. URL sent over TLS to authenticated KnytX endpoint</td> GDPR Art. 6(1)(b) performance; Art. 6(1)(f) legitimate interest in phishing defense</td> Passive Link Shield stops. Rest of the app remains functional</td></tr> FOREGROUND_SERVICE</code> and RECEIVE_BOOT_COMPLETED</code></td> Android</td> Keeps call and SMS screeners running across reboots — Google Play and modern Android background-execution limits would otherwise prevent privacy-protection apps from working reliably. On-device only; does not grant new data access</td> Nothing as a consequence of this permission</td> Same as underlying features</td> Screeners may be killed by the system after a few minutes of inactivity</td></tr> POST_NOTIFICATIONS</code></td> Android</td> Delivers warning notifications (scam call, phishing SMS, family alert) and the weekly digest. Notifications rendered locally from local data plus authenticated KnytX server pushes</td> Nothing as a consequence of this permission (KnytX uses Firebase Cloud Messaging as transport — see Section 5)</td> GDPR Art. 6(1)(b) performance</td> You stop receiving in-app notifications. Everything remains visible in the app dashboard</td></tr> CAMERA</code> (Executive tier only)</td> Android</td> One-time face enrollment for impersonation defense. Camera capture happens locally; you confirm the photo before any upload</td> Reference photo uploaded over TLS to KnytX EU servers; facial embedding extracted, original photo deleted within seconds. See Biometric Data Policy</a></td> GDPR Art. 9 — explicit consent recorded on enrollment screen</td> No additional reference photos can be captured. Existing enrollments remain valid until you delete them</td></tr> RECORD_AUDIO</code> (Executive tier only)</td> Android</td> One-time voice enrollment for voice-clone detection. Voice sample captured locally; you preview and confirm before upload</td> Voice sample uploaded over TLS to KnytX EU servers; voiceprint embedding extracted, original audio deleted within seconds</td> GDPR Art. 9 — explicit consent recorded on enrollment screen</td> No new voice enrollments. Existing voiceprints remain until you explicitly delete them</td></tr> </tbody></table> Permissions we deliberately do not request</h3> ACCESS_FINE_LOCATION</code> / ACCESS_COARSE_LOCATION</code> — KnytX does not track your location.</li> READ_CONTACTS</code> — KnytX does not read your address book. The scam-number check is anonymous.</li> READ_EXTERNAL_STORAGE</code> (modern equivalents) beyond the minimum needed for the camera/voice flows.</li> Any advertising-ID or attribution permission. We do not run ad tech.</li> </ul> 3. iOS capabilities and extensions</h2> iOS is structured around capabilities and app extensions rather than a single permissions list. Each extension runs in a sandbox; the iOS app cannot read SMS or call audio directly, only through the extension surfaces below. Permission / Capability</th> Platform</th> Feature served</th> What crosses the wire</th> Lawful basis</th> If revoked</th></tr></thead> CallKit Directory Extension</td> iOS</td> Passive Call Shield — publishes a scam-number directory to iOS, which labels or blocks matching incoming calls. Per-call check is iOS’s native CallKit lookup; no KnytX server in the call path</td> Periodic directory sync (signed). No per-call telemetry</td> GDPR Art. 6(1)(b) performance; Art. 6(1)(f) legitimate interest</td> Caller-ID labelling and blocking stops</td></tr> ILMessageFilterExtension</code></td> iOS</td> Passive Link Shield — Apple’s IdentityLookup</code> framework routes incoming SMS through the extension, classifying them as Promotional, Transactional, Junk, or unfiltered. Extension runs in an iOS sandbox with limited network access</td> URLs only, on demand, when the local cache cannot classify. Never the full SMS body, never sender, never timestamp</td> GDPR Art. 6(1)(b) performance; Art. 6(1)(f) legitimate interest</td> SMS classification stops</td></tr> Camera (NSCameraUsageDescription</code>) and Microphone (NSMicrophoneUsageDescription</code>)</td> iOS</td> Executive plans only — biometric enrollment (face and voice). Same on-server processing model as Android</td> Reference photo or voice sample uploaded over TLS; embedding extracted, original deleted within seconds</td> GDPR Art. 9 — explicit consent</td> No new biometric enrollments. Existing data remains until you delete it</td></tr> Background App Refresh</td> iOS</td> Keeps the scam-number directory and findings dashboard in sync. iOS controls scheduling; the app does not run continuously</td> Same delta sync as Android</td> GDPR Art. 6(1)(b) performance</td> Directory and dashboard may fall out of sync until next manual open</td></tr> </tbody></table> 4. Revoking access</h2> You can revoke any permission at any time: Android: Settings → Apps → KnytX → Permissions.</li> iOS: Settings → KnytX → individual capability toggles.</li> </ul> The app detects revocation on next launch and: Disables only the features that depend on the revoked permission.</li> Surfaces a banner explaining which features stopped, and what the user-facing consequence is.</li> Does not nag, dark-pattern, or otherwise re-prompt outside the on-screen banner.</li> </ol> Revoking the OS permission does not by itself destroy data we already hold. To destroy it, use the “Delete biometric data” control in the in-app account settings. That explicit deletion is what removes it, per the Biometric Data Policy</a>. 5. Third-party platform services</h2> Firebase Cloud Messaging (Android push notifications). Operated by Google. Used solely as the transport for push notifications. The notification payload sent through FCM is the minimum needed — a category and a non-personal payload identifier. The actual notification content is fetched from KnytX servers when the app processes the push.</li> Apple Push Notification service (iOS). Operated by Apple. Same transport role.</li> </ul> Neither FCM nor APNs receives the content of your calls, SMS, or any biometric data. 6. Data sent to KnytX servers, summarised</h2> Across every permission above, the data that actually crosses the wire to KnytX servers from the mobile apps is: Data</th> Why</th> Volume</th></tr></thead> URLs extracted from SMS</td> Phishing classification</td> Per-URL, on demand</td></tr> Account telemetry (login, sync events)</td> Service operation</td> Per-event</td></tr> Reference photos (Executive enrollment)</td> Biometric embedding extraction, then deletion</td> Once per enrollment</td></tr> Voice samples (Executive enrollment)</td> Voiceprint embedding extraction, then deletion</td> Once per enrollment</td></tr> Sync requests for scam-number database, findings, weekly digest</td> Service operation</td> Periodic</td></tr> </tbody></table> That is the complete list. The repos at github.com/knytx</a> (publishes at launch) will include the network-layer module, so you can verify every endpoint the app talks to. 7. Children</h2> KnytX mobile apps are not intended for users under 16 (EU) or under 18 (India). The Family plan supports family members who are minors only with parental consent; biometric enrollment is blocked for minors regardless of consent. 8. Updates and questions</h2> Material changes to the permissions list are communicated by in-app notice and a release-note entry on the GitHub repos (publishes at launch). Once published, the repos will be the canonical record of what the app does. Until then, this page tracks them. Permission-related questions: legal@knytx.com</a>, subject line “Mobile Permissions”. Security-related issues: security@knytx.com</a>. Privacy Policy Unknown — Fri, 17 Jul 2026 00:00:00 +0000 Plain-language summary</div> For browsing, we collect very little. Name and email if you contact us, cookieless analytics when you browse, and application materials if you apply for a role. Protection services add only the identifiers you ask us to protect.</li> For protection services, we collect what we need to protect you. Email addresses, phone numbers, and other identifiers data brokers list you under. Biometrics (face, voice) only on Executive plans, only with explicit consent.</li> We never sell your data. Not to advertisers, data brokers, or anyone else. Our business model is subscriptions and services — not your data.</li> We don't track you with cookies. Our analytics (Umami) is cookieless and privacy-respecting.</li> You can ask us to delete your data at any time — email legal@knytx.com</a> and we'll handle it within 30 days. Biometric data is destroyed within 7 days.</li> Your rights depend on where you live. EU/UK/Swiss residents have GDPR rights, Indian residents have DPDPA rights, California residents have CCPA rights. We honour all three.</li> </ul> </div> </div> Effective: 22 May 2026. 1. Who we are (the controller)</h2> This Privacy Policy is published by: NCRYPTO Labs Private Limited (“NCRYPTO Labs”, “we”, “us”) A company incorporated under the Companies Act, 2013 (India). Registered office: Bangalore, Karnataka, India. Email: legal@knytx.com</a> NCRYPTO Labs operates the KnytX privacy & security platform under the trading name “KnytX”. For the purposes of GDPR (Regulation (EU) 2016/679), NCRYPTO Labs is the data controller of personal data processed through knytx.com and KnytX services. For DPDPA, 2023 purposes, NCRYPTO Labs is the Data Fiduciary. For CCPA purposes, NCRYPTO Labs is the business. Data Protection Officer. GDPR Article 37(1)(b) requires a DPO where the controller's core activities consist of large-scale processing of special-category data. Our Executive-tier biometric features (facial embeddings, voiceprints) are a candidate trigger. We assessed this in writing. At today's scale, the processing is not "large-scale" within the meaning of WP29 Opinion 4/2017 guidance. We re-check the trigger every six months, and we will appoint a DPO the moment the threshold is crossed. The assessment is summarised in our annual transparency report. For data-protection inquiries today, contact legal@knytx.com</a>. </div> In short: NCRYPTO Labs (India) runs KnytX. It is the controller for GDPR, the Data Fiduciary for DPDPA, and the business for CCPA. A DPO isn’t legally required yet; we re-check that every six months. 2. What this policy covers</h2> In short: this policy covers knytx.com and KnytX products. Other NCRYPTO Labs businesses have their own policy, linked below. This policy applies to: the knytx.com website and any subdomain we publish under knytx.com</li> KnytX products and services once you sign up for them (subject to additional product-specific notices)</li> KnytX consulting and professional services engagements (subject to additional contractual terms)</li> </ul> For broader processing across NCRYPTO Labs operations — including Stalten (semiconductor IP), XRTE (autonomous systems), and corporate functions — see the NCRYPTO Labs Privacy Policy</a>. 3. What we collect, why, and on what legal basis</h2> In short: the table below lists every category we collect, why we collect it, our legal basis, and how long we keep it. For browsing, it’s very little. Protection services add only the identifiers you ask us to protect. </colgroup> Category</th> What</th> Why</th> GDPR lawful basis</th> DPDPA basis</th> Retention</th> </tr> </thead> Contact form / email</td> Name, email, company, message content</td> To respond to your inquiry</td> Legitimate interest (Art. 6(1)(f)); consent for marketing follow-up.</td> Voluntary disclosure for specified purpose</td> 24 months after last contact</td> </tr> Website analytics (Umami)</td> Hashed page-view events, referrer, country (IP-derived), device class.</td> Understand traffic and improve the site.</td> Legitimate interest (Art. 6(1)(f)). Cookieless; no personal identifiers stored.</td> Anonymised; outside DPDPA scope</td> Aggregated raw events deleted within 30 days.</td> </tr> Job applications</td> Name, contact details, CV, cover letter, application materials.</td> Evaluate your application</td> Pre-contractual steps (Art. 6(1)(b)); consent</td> Voluntary disclosure for hiring</td> 12 months from application date</td> </tr> Waitlist signups</td> Email, optional country</td> Notify you when a product launches; honour early-access pricing.</td> Consent (Art. 6(1)(a))</td> Consent</td> Until unsubscribed or 24 months inactivity.</td> </tr> Service engagement data</td> As specified in your service agreement.</td> Deliver the service you've contracted</td> Performance of contract (Art. 6(1)(b))</td> Necessary for service</td> Per service agreement default 24 months post-termination.</td> </tr> Protection identifiers</td> Emails, phone numbers, postal address, and usernames you ask us to monitor.</td> File removal requests; run breach and dark-web scans.</td> Performance of contract (Art. 6(1)(b))</td> Necessary for service</td> Subscription duration deleted within 30 days of cancellation.</td> </tr> Facial embeddings</td> 512-dim vector derived from photos you upload; original photos deleted within seconds.</td> Detect impersonating social profiles (Executive tier).</td> Explicit consent (Art. 9(2)(a))</td> §6 consent; documented in DPIA</td> Until consent revoked or plan downgraded; 7-day deletion. See Biometric Data Policy</a>.</td> </tr> Voiceprints</td> 192-dim vector derived from a voice sample; original audio deleted within seconds.</td> Detect AI voice clones (Executive tier).</td> Explicit consent (Art. 9(2)(a))</td> §6 consent; documented in DPIA</td> Until consent revoked or plan downgraded; 7-day deletion.</td> </tr> Stealer-log identifiers</td> Email addresses you authorised us to monitor against stealer-log corpora.</td> Detect active credential compromise (Pro tier+).</td> Performance of contract (Art. 6(1)(b))</td> Necessary for service</td> Active monitoring window raw queries not logged beyond scan transaction.</td> </tr> Dark-web exposure hits</td> Source forum/market, snippet, date, threat assessment from third-party intelligence.</td> Notify you of dark-web mentions (Pro tier+).</td> Performance of contract (Art. 6(1)(b)); Art. 6(1)(f) for security.</td> Necessary for service</td> 24 months from detection unless you delete earlier.</td> </tr> Scam-call telemetry</td> Caller-ID match results and timing, no audio.</td> Maintain the Passive Call Shield and learn new scam patterns.</td> Performance of contract (Art. 6(1)(b))</td> Necessary for service</td> Aggregated per-call records deleted within 30 days.</td> </tr> Call-screening logs</td> Hashes of incoming numbers checked locally on your device, only uploaded when you flag a number.</td> Build the scam-number database (anonymised aggregate).</td> Legitimate interest (Art. 6(1)(f)) for the aggregate; consent for the flag.</td> Necessary for service</td> Per-event records deleted within 30 days aggregate persists.</td> </tr> Impersonation evidence</td> Public-profile snapshot, similarity scores, takedown status when you confirm "Not me".</td> File platform takedown reports on your behalf.</td> Legitimate interest (Art. 6(1)(f)) — see Impersonation Takedowns</a>.</td> Necessary for service</td> 12–18 months full evidence then minimised.</td> </tr> </tbody> </table> </div> We do not collect: payment card numbers (handled by Stripe / your local processor — see their privacy policies)</li> behavioural advertising signals</li> cross-site tracking identifiers</li> raw call audio or raw SMS bodies — these are processed on your device only (see Mobile App Permissions</a>)</li> demographic inferences from biometric data — our face and voice models are not used to infer age, gender, ethnicity, or health</li> </ul> 4. Who else sees your data (recipients and sub-processors)</h2> In short: only our vetted service providers, our own staff on a need-to-know basis, the brokers we file removals with, and legal recipients when the law compels it. We never share your data with advertisers or for commercial gain. We share personal data only with: Service providers we contract with to operate the site and services, under written processor agreements that limit their use to instructed purposes. The full sub-processor list is published at /transparency/sub-processors/</a>, with jurisdiction, purpose, what we send each vendor, and the transfer mechanism. That list includes the Pro-tier dark-web vendors (SpyCloud, Hudson Rock, Flare.io, DarkOwl) and the Executive-tier image-search provider (PimEyes).</li> NCRYPTO Labs internal teams — engineering, security, customer success, legal — strictly on a need-to-know basis.</li> Responding businesses when we file removal requests on your behalf as your authorised agent</a>. The identifiers we share are the minimum necessary to identify you to the broker so they can locate and delete your records.</li> Legal recipients — only when compelled by valid legal process (subpoena, court order, or equivalent), and we will notify you unless the legal process forbids it.</li> </ul> We do not share personal data with advertisers, data brokers (other than as a removal target on your behalf), marketing partners, or any party for monetary or commercial consideration. 5. International transfers</h2> In short: your data lives in Frankfurt. The narrow transfers to India (support tickets, CVs) are listed here with their legal basis. Default processing region is the European Union (Frankfurt, Germany). Some operational data may be transferred to India for processing by NCRYPTO Labs staff — for example, support ticketing and employee CVs reviewed in India. Such transfers from the EU rely on either: adequacy mechanisms applicable at the time of transfer, or</li> Standard Contractual Clauses (Module 1 / Module 2 as applicable, 2021/914), or</li> explicit consent.</li> </ul> A copy of the relevant transfer safeguards is available on request from legal@knytx.com</a>. 6. Your rights</h2> In short: you can ask us to show, fix, delete, or export your data, and you can withdraw consent. Email legal@knytx.com</a>. Your exact rights depend on where you live (GDPR, DPDPA, or CCPA), and you can also complain to a data-protection regulator. You have the following rights, exercisable by emailing legal@knytx.com</a>. We will respond within 30 days (GDPR / DPDPA) or 45 days (CCPA, extendable by 45 days). There is no charge for a reasonable request. Under GDPR (EU, UK, Switzerland) — access, rectification, erasure, restriction, data portability, objection, and the right to withdraw consent. You also have the right to lodge a complaint with a supervisory authority. EU/EEA residents may complain to the data protection authority in their own country — find yours in the EDPB members list</a>. UK residents may contact the ICO</a>. Swiss residents may contact the FDPIC</a>. Under DPDPA, 2023 (India) — access, correction/completion, erasure, and grievance redressal. You may also nominate a representative to exercise your rights if you die or become incapacitated, and you may approach the Data Protection Board of India once it is operationalised. Under CCPA / CPRA (California) — the right to know, delete, and correct. You may also opt out of “sale” or “sharing” (we do neither), limit our use of sensitive personal information, and be free from retaliation for exercising these rights. We do not sell or share personal information as defined by CCPA. Universal commitments — we will not require you to create an account to exercise your rights. We will not charge you for reasonable requests. We will verify your identity in proportion to the request’s sensitivity. 7. Cookies and similar technologies</h2> In short: no tracking cookies, no ad cookies, no tracking pixels. Only the few cookies the site needs to work, plus cookieless analytics. We do not use tracking cookies, advertising cookies, or third-party tracking pixels. We use: Strictly necessary cookies for site functionality (preferred currency, theme, region) — set on first interaction, no consent banner required under GDPR e-Privacy guidance.</li> No analytics cookies — Umami operates cookieless and uses hashed visit signals only.</li> </ul> If we add additional cookies (e.g., for an authenticated dashboard), we will publish a cookie notice and obtain consent before setting non-essential cookies. 8. Children’s privacy</h2> In short: our consumer products aren’t for children, and we don’t knowingly collect their data. KnytX for Families is run by a parent or guardian, with consent recorded at signup. KnytX consumer products are not directed at children under 16 (EU) / 18 (India, DPDPA verifiable parental consent threshold) / 13 (US, COPPA). We do not knowingly collect personal data from children. KnytX for Families is intended to be used by a parent or legal guardian on behalf of family members. Parental consent is captured and recorded at signup. If you believe we have collected data from a child without proper consent, contact legal@knytx.com</a> and we will delete it. 9. Security</h2> In short: we encrypt your data at rest and in transit, limit access, test our systems, and will tell you and the regulators if a breach affects you. No system is fully secure, and we don’t pretend otherwise. We follow security practices proportionate to the sensitivity of the data we hold: Encryption at rest (AES-256) and in transit (TLS 1.3)</li> Access controls with least-privilege defaults and audit logging</li> Annual third-party security review (SOC 2 Type II currently in progress; not yet attested)</li> Quarterly penetration testing on production systems</li> Documented incident-response runbook with regulatory breach-notification timelines (72h GDPR, 72h DPDPA once operational)</li> </ul> No system is fully secure. We will notify affected individuals and relevant regulators in accordance with applicable law if a breach materially affects you. 10. Automated decision-making and profiling</h2> In short: the scores on your dashboard are for your eyes only. They never set your price, your features, or your eligibility, and we never share them with insurers, lenders, employers, or landlords. You can dispute an input or ask for a human review. KnytX surfaces several numeric signals on user dashboards. They are the Privacy Risk Score (all tiers), the Privacy Maturity Level (Pro+), the Scam Vulnerability Score (Pro+), and a 4-dimension Pro score (financial, identity-theft, physical safety, reputation). Your Privacy Risk Score and related signals are used only to inform and alert you. They do not determine the price of KnytX, the features you receive, your eligibility for the service, or any decision with legal or similarly significant effects under GDPR Article 22. We do not share scores with any third party, including insurers, lenders, employers, or landlords. You can contest any score input or request a human review by contacting legal@knytx.com</a>. </blockquote> The full disclosure lives at /transparency/scoring-transparency/</a>. It sets out the input-to-output mapping for each score, the weights we apply, and your rights: to dispute an input, to a human review, and to opt out of seeing scores. That page is the meaningful-information disclosure required under GDPR Article 13(2)(f) and Article 14(2)(g). It is also the equivalent transparency disclosure for DPDPA, 2023 once the Rules are finalised. 11. Changes to this policy</h2> In short: if our practices change, we update this page and tell you the important changes by email and in-product notice. We will update this policy when our practices change. Material changes are communicated three ways: by email (to subscribers and waitlist members), by in-product notification, and by a notice on the policy page. The “Last updated” date at the top reflects the most recent revision. 12. Contact</h2> In short: for any privacy question, email legal@knytx.com</a>. For regulator complaints, see Section 6. Privacy and data-protection inquiries: legal@knytx.com</a> Postal address: NCRYPTO Labs Private Limited, Bangalore, Karnataka, India For supervisory-authority complaints, see Section 6. Terms of Service Unknown — Fri, 17 Jul 2026 00:00:00 +0000 Plain-language summary</div> Our website is for information. Browse freely, but don't scrape, attack, or misuse it.</li> Our technology is proprietary. Don't copy, reverse-engineer, or redistribute without a license.</li> If you engage our services, separate agreements govern deliverables, timelines, and pricing.</li> Indian law applies for general disputes — arbitration in Bangalore. Mandatory consumer-protection rights in your country of residence (EU, UK, Switzerland, California, etc.) are not affected.</li> </ul> </div> </div> Effective: 22 May 2026. About these terms</h2> KnytX is the privacy and security platform of NCRYPTO Labs Private Limited (“NCRYPTO”). By using knytx.com, you agree to these terms. The full NCRYPTO Labs terms govern all its operations. They cover intellectual property, limitation of liability, export controls, and dispute resolution. See the NCRYPTO Labs Terms of Service</a>. Use of website</h2> You may browse and access knytx.com for informational purposes. You may not scrape, crawl, or automatically extract content without written permission. You may not attempt unauthorized access to our systems, transmit malicious code, or use the website for any unlawful purpose. Intellectual property</h2> All content, technology, and materials on knytx.com — including logos, documentation, software, and specifications — are the property of NCRYPTO Labs Private Limited. Access to product descriptions or specifications does not constitute a license to use our proprietary technology. Incorporated policies</h2> These Terms of Service incorporate the following KnytX policies by reference. When you create a KnytX account or use the relevant service, you agree to them as part of these terms: Privacy Policy</a></li> Authorised Agent disclosure</a></li> Biometric Data Policy</a></li> </ul> Service agreements</h2> Professional services and product licensing are governed by separate written agreements with specific deliverables, timelines, and pricing. Governing law</h2> These terms are governed by Indian law. Disputes are resolved by arbitration in Bangalore under the Arbitration and Conciliation Act, 1996. Consumer protection carve-out. Are you a consumer in the EU, UK, Switzerland, California, or another jurisdiction with mandatory consumer-protection laws? Then this clause does not limit the rights and remedies those laws give you. You may bring consumer disputes in the courts of your own country of residence. Business customers and clients under a service agreement remain bound by Indian law and Bangalore arbitration. Contact</h2> KnytX (a division of NCRYPTO Labs Private Limited) Email: legal@knytx.com</a> Bangalore, Karnataka, India Trademarks Unknown — Fri, 17 Jul 2026 00:00:00 +0000 Plain language: The KnytX name, shield logo, and wordmarks are registered trademarks of NCRYPTO Labs Private Limited. You may reference KnytX in editorial context but may not use our marks in ways that imply endorsement, sponsorship, or affiliation without permission. </div> Effective: 22 May 2026. Our trademarks</h2> The KnytX name, logo, and wordmark are trademarks of NCRYPTO Labs Private Limited, registered in India. Related trademarks include NCRYPTO, Stalten, KnytX, XRTE, Agni, and Critle. Permitted use</h2> You may reference KnytX in journalism, reviews, academic papers, technical discussions, and social media — provided you make clear you are not affiliated with or endorsed by KnytX. Restricted use</h2> You may not incorporate KnytX trademarks into your product name, company name, domain name, or marketing materials without written permission. Contact legal@knytx.com for licensing inquiries. Third-party trademarks</h2> All other trademarks mentioned on knytx.com are the property of their respective owners and are used for identification purposes only. For the complete trademark policy, including brand identity guidelines, logo usage rules, and attribution requirements, see the NCRYPTO Labs Trademark Policy</a>. Contact</h2> Brand assets: press@ncrypto.co</a> Trademark legal: legal@knytx.com</a> Security Disclosure Policy Unknown — Fri, 17 Jul 2026 00:00:00 +0000 Reporting a vulnerability</h2> If you discover a security vulnerability in any KnytX-controlled software or infrastructure, please report it privately before disclosing it publicly. Contact: security@knytx.com</a> We will acknowledge your report within 48 hours and provide a resolution timeline within 7 days of triage. What is in scope</h2> KnytX mobile apps (Android and iOS) — authentication, data egress, permission misuse, storage of sensitive data, biometric handling</li> KnytX backend API — authentication bypasses, privilege escalation, data exposure, injection vulnerabilities</li> KnytX web properties — knytx.com and any subdomain handling user data or authentication</li> KnytX browser extension (when released)</li> </ul> What is out of scope</h2> Denial-of-service attacks against production infrastructure</li> Social engineering of KnytX employees or contractors</li> Physical access attacks</li> Findings in third-party services we use (report those to the respective vendor)</li> Theoretical vulnerabilities without a proof of concept</li> Issues already known to us and tracked in our public issue trackers</li> </ul> Our commitments to researchers</h2> We will not pursue legal action against researchers who act in good faith under this policy.</li> We will acknowledge your contribution in our release notes (or privately, if you prefer).</li> We will notify you when the vulnerability is fixed.</li> We will not share your identity with third parties without your consent.</li> </ul> Private disclosure preferred</h2> We ask that you give us a reasonable time to fix the issue before public disclosure. Our standard fix window is 90 days from confirmed triage. If you need to disclose sooner for any reason, please let us know and we will work with you on a coordinated timeline. For critical vulnerabilities actively being exploited, please contact us immediately at security@knytx.com</a> with “CRITICAL” in the subject line. Scope of this policy</h2> This policy covers all software published at github.com/knytx</a>. Mobile repositories will be published at public launch; see Open Source</a> for the timeline. It also covers all production services operated by NCRYPTO Labs Private Limited under the KnytX brand. Reproducible-build discrepancies — where the published binary does not match the source — are explicitly in scope and treated as critical severity. PGP Key</h2> To encrypt sensitive vulnerability reports, request our PGP key by emailing security@knytx.com</a> with “PGP KEY REQUEST” in the subject line. The published key and its fingerprint will be available at https://keys.openpgp.org</a> (search security@knytx.com</code>). Note: If you cannot obtain or verify our key, you may send unencrypted reports — we prefer disclosure over silence. California DELETE Act — methodology Unknown — Fri, 17 Jul 2026 00:00:00 +0000 In short: the free California DELETE Act filing lives on the DELETE Act product page</a> — that page prepares the request, walks you through submitting it, and tracks broker responses. This page is the methodology reference: what the statute does, what it covers, and where KnytX’s role begins and ends. What the statute does</h2> California Senate Bill 362 was signed in October 2023 and codified as Civil Code §1798.99.80 through §1798.99.89. It requires data brokers operating in California to register annually with the CPPA. Through the CPPA’s “accessible deletion mechanism” (the DROP portal), a California resident submits one verified request, and every registered broker must delete their records and stop selling their personal information. Instead of contacting ~500 brokers individually, you file once. What KnytX prepares (and what stays yours)</h2> The DROP mechanism has no consumer- or agent-submission API — there is no button KnytX can press for you. KnytX removes the busywork around the manual step: it verifies California residency, assembles your full identifier set (every email on your account, phone, prior addresses, legal name), prepares the request in the format DROP requires, walks you through submitting it, then tracks acknowledgements and the 45-day compliance window in your dashboard. The submission click is yours. For CCPA/CPRA per-broker requests — a different mechanism KnytX does submit on your behalf — see the authorised-agent disclosure</a>. What it covers, and what it doesn’t</h2> Covered</th> Not covered</th></tr></thead> Brokers registered with the CPPA (~500 entities)</td> Brokers operating in California without registering</td></tr> Personal information those registered brokers hold</td> First-party processors you deal with directly (bank, employer, insurer)</td></tr> Continued sale or sharing going forward (brokers must stop)</td> Records already sold downstream before the request</td></tr> </tbody></table> The DELETE Act reaches the ~500 registered brokers. A long tail of unregistered and international brokers is outside its scope — that gap is what paid KnytX Shield</a> closes with per-broker CCPA §1798.105 removals and continuous re-removal. Legal authority</h2> California Civ. Code §1798.99.80 et seq. — the DELETE Act itself.</li> CCPA §1798.140(i) — authorised-agent definition.</li> CCPA Reg §7063 — signed-permission requirements for an agent.</li> CCPA §1798.105 — the underlying deletion right the Act amplifies.</li> </ul> For how the DROP mechanism fits KnytX’s broader cross-regime removal strategy, see the legal-framework matrix</a>. This page is not legal advice; for a specific dispute, consult a privacy attorney in your jurisdiction. See also</h2> DELETE Act Filing — the free guided filing (California residents)</a> — where you actually file</li> KnytX Shield — paid coverage including unregistered brokers</a></li> Legal-framework matrix — the full cross-regime context</a></li> </ul> DELETE Act questions: legal@knytx.com</a>, subject line “DELETE Act”. How We Check Breaches Without Seeing Your Passwords Unknown — Fri, 17 Jul 2026 00:00:00 +0000 In short: your browser hashes the password on your device and sends us only the first five characters of that hash, never the password itself. We return every match in that bucket; your browser finds the one that matters. We can’t rebuild your passwords from what we see, by design. The question this page answers</h2> If you use the KnytX breach checker or the password check inside the Pro tier, you might reasonably ask: “If I’m checking whether my password was leaked, doesn’t KnytX have to know my password?” </blockquote> The answer is no, and this page explains why. It is not because we promise not to look. It is because the design makes looking impossible. This is the difference between a privacy promise and a privacy architecture. </a>The walkthrough</h2> Step 1. Your password (or email) is hashed on your device</h3> A hash is a one-way fingerprint of a string. The same input always produces the same hash. You cannot work backwards from the hash to recover the input without guessing the input first. For password checks we use SHA-1. Not because it is the strongest hash — it isn’t. It is the format the public Pwned Passwords corpus is published in, and matching that format is what lets us interoperate. When you ask KnytX to check whether a password has been compromised, your browser does this locally: password = "password" hash = SHA1(password) = "5BAA61E4C9B93F3F0682250B6CF8331B7EE68FD8" </code></pre> That string of 40 hexadecimal characters never leaves your machine. Step 2. We send the first five characters — and only those</h3> prefix = hash[0..5] = "5BAA6" suffix = hash[5..40] = "1E4C9B93F3F0682250B6CF8331B7EE68FD8" </code></pre> Your browser sends 5BAA6</code> to our server. That is it. Five hexadecimal characters identify a bucket containing roughly one in every 1,048,576 possible hashes — typically 400 to 600 real hashes in our breach corpus. The five-character prefix is what cryptographers call a k-anonymity boundary: every prefix is shared by hundreds of other possible passwords, so the server cannot tell which one you actually meant. Step 3. Our server returns the entire bucket</h3> The server looks up every hash in our breach engine that starts with 5BAA6</code> and returns the list of suffixes plus how many times each has appeared in known breaches. The response looks like: 1E4C9B93F3F0682250B6CF8331B7EE68FD8:1842 1E4C9B93F3F0682250B6CF8331B7EE68FE2:3 …approximately 400 more rows… </code></pre> Step 4. Your browser does the final match — locally</h3> Your browser scans the returned list for the suffix it computed in Step 1. If it finds a row, the count tells you how many breaches contain that password. If it does not, your password is not in our corpus. The server never knows which row in the response your browser cared about. From its point of view, the request was indistinguishable from a request by any other user whose password happened to share the same five-character prefix. Why this matters</h2> We cannot, by design, build a database of your passwords</h3> Suppose a hypothetical adversarial KnytX engineer wanted to build a database of which users use which passwords. What does our log show? An IP address (typically a Cloudflare edge IP, not your home IP)</li> A timestamp</li> The string 5BAA6</code></li> </ul> That is not a password database. It is not a credential leak when we get breached. It is a list of which 5-character prefixes were popular on a given day, which is approximately as useful as a list of which two-digit numbers got typed into a calculator. The full hash is unknowable to us; the plaintext is unknowable to anyone except your device. We cannot lie about this</h3> The architecture is verifiable. If you open your browser’s network inspector and watch a check happen, you can see exactly what we send. The relevant code path is in our open-source mobile apps under GPLv3 (see /transparency/open-source/</a>), and the same model is used in the web client. The promise is not “we won’t look” — it is “we structurally can’t look”. The same model applies to email and phone checks</h3> The breach engine uses the same 5-character SHA-256 prefix model for email and phone lookups. Your full email and full phone number stay on your device for the routine breach check. (The dark-web monitoring scanners in Pro+ require plaintext because the underlying vendors are text-indexed, not hash-indexed — see the sub-processor list</a> for which vendors get plaintext and which get hashes.) Limits and honest caveats</h2> SHA-1 is weak for general cryptography. We use it for breach lookups because the Pwned Passwords ecosystem standardised on it. SHA-1 is fine for k-anonymity because we are not relying on collision resistance. We are relying on the cost of brute-forcing a specific 35-character suffix from a 5-character prefix, which is astronomical. Where we hash other data (email, phone), we use SHA-256.</li> Your network sees that you made a request. The five-character prefix is meaningless, but the fact that you used our breach checker at a particular time is visible to your ISP. If that threat model matters to you, run KnytX through a VPN. In practice almost nothing useful leaks from the fact of a breach check.</li> A k-anonymity check confirms presence; it does not confirm absence with certainty. If your password is not in our corpus, it means it is not in the breaches we have indexed. New breaches happen weekly. We re-scan our corpus and re-notify; we do not promise that a one-time clean result is forever clean.</li> The breach corpus is a snapshot. We update it on a documented schedule. Email legal@knytx.com</a> for the technical paper describing the full breach-engine architecture.</li> </ul> Where this fits in the broader trust story</h2> K-anonymity is one of three architectural commitments we make: Hashed prefix queries for routine breach checks (this page).</li> Local processing for biometric features — face and voice embeddings are extracted on our own infrastructure, never on a cloud API. See /legal/biometric-policy/</a>.</li> On-device processing for mobile call and SMS screening — the actual content of your messages and calls never reaches our servers. See /legal/mobile-permissions/</a>.</li> </ol> Together, these mean the most sensitive parts of your data — passwords, biometrics, message bodies, call audio — never leave the device you control. We hold what we cannot avoid holding; we minimise what we do. Questions</h2> Architectural questions: security@knytx.com</a>. Policy questions: legal@knytx.com</a>. Removal Legal Basis by Region Unknown — Fri, 17 Jul 2026 00:00:00 +0000 Why this page exists</h2> KnytX markets cross-regime data removal. Truthful-advertising regimes — FTC Act §5 in the US, the UK CMA, the EU Unfair Commercial Practices Directive, and the Indian Consumer Protection Act — require that claim to be substantiated. This page is the substantiation. If you are a regulator reading this, the section citations below are the statutes and regulations we file under; we are happy to share sample request templates on request to legal@knytx.com</a>. If you are a customer reading this, the table tells you which law your removal is filed under, which authority you can escalate to, and which KnytX entity bears controller responsibility for your data. </a>The matrix</h2> Region</th> Removal statute</th> Filing window</th> Authority for complaints</th> Controller / Fiduciary of record</th></tr></thead> California, USA</td> CCPA §1798.105 (right to delete). DELETE Act / SB 362 (Civ. Code §1798.99.80 et seq.) for the consolidated registered-broker pipeline.</td> 45 days, extendable by 45 days with notice.</td> California Privacy Protection Agency (CPPA) and California Attorney General.</td> NCRYPTO Labs Private Limited (business under CCPA). KnytX, as authorised agent under §1798.140(i).</td></tr> Other US states with comprehensive privacy laws</td> State-specific delete rights — Virginia VCDPA §59.1-577, Colorado CPA §6-1-1306, Connecticut CTDPA §10, Utah UCPA §13-61-203, Texas TDPSA §541.052, etc.</td> 45 days (most states), with single 45-day extension.</td> State Attorney General in each state.</td> NCRYPTO Labs Private Limited (controller).</td></tr> EU / EEA</td> GDPR Article 17 (right to erasure). Article 21 (right to object) where erasure is contested.</td> 30 days, extendable to 90 days with reasoned notice.</td> The supervisory authority in the member state where you reside or where the alleged infringement occurred. EDPB coordinates cross-border.</td> NCRYPTO Labs Private Limited (controller under Article 4(7)). EU representative appointed under Article 27 where required.</td></tr> United Kingdom</td> UK GDPR Article 17 + Data Protection Act 2018.</td> 30 days, extendable.</td> Information Commissioner’s Office (ICO).</td> NCRYPTO Labs Private Limited. UK representative under DPA 2018 §83 where required.</td></tr> Switzerland</td> Federal Act on Data Protection (FADP, revised 1 September 2023), Article 32 (right to deletion).</td> “Within a reasonable time” — we treat it as 30 days.</td> Federal Data Protection and Information Commissioner (FDPIC).</td> NCRYPTO Labs Private Limited.</td></tr> India</td> DPDPA, 2023 §13 (right to erasure of personal data of the Data Principal).</td> “Within a reasonable period” pending Rules — we treat it as 30 days.</td> Data Protection Board of India (once operationalised); Ministry of Electronics and Information Technology in the interim.</td> NCRYPTO Labs Private Limited (Data Fiduciary).</td></tr> Brazil</td> LGPD Art. 18(VI) (right to delete personal data processed under consent).</td> 15 days.</td> Autoridade Nacional de Proteção de Dados (ANPD).</td> NCRYPTO Labs Private Limited.</td></tr> Canada (federal)</td> PIPEDA Principle 4.5 (limited withdrawal of consent and disposal). Quebec Law 25 for Quebec residents.</td> Reasonable period; Quebec Law 25 sets stricter timelines.</td> Office of the Privacy Commissioner of Canada (OPC). Commission d’accès à l’information for Quebec.</td> NCRYPTO Labs Private Limited.</td></tr> Australia</td> Privacy Act 1988, APP 11.2 (destruction or de-identification when no longer needed). Notifiable Data Breaches scheme.</td> Reasonable timeframe.</td> Office of the Australian Information Commissioner (OAIC).</td> NCRYPTO Labs Private Limited.</td></tr> </tbody></table> Where a broker operates across multiple regimes, we file under whichever statute gives you the strongest right and the shortest compliance window. We cite the statute by section number on the request itself so the broker cannot rely on ambiguity. How we decide which statute applies to you</h2> Your “applicable regime” is determined by your residency, not by where the broker is headquartered or where the data was originally collected. Specifically: We use the residency you declared at signup, refined by ongoing signals (billing country, IP region history).</li> If your declared residency and your signals diverge, we ask you. We do not silently file under a regime you did not consent to.</li> If you are dual-resident — for example, an EU citizen working temporarily in California — we file under whichever regime gives you the stronger right and the broader scope. You can override our default at request time.</li> </ul> What we do not file under</h2> “Right to be forgotten” alone. This is a journalistic shorthand for the Costeja v. Google line of EU case law. Our requests cite the statutory article (GDPR Article 17), not the shorthand, because brokers can stall against shorthand.</li> “Privacy law” as a generic phrase. We never send a removal email that says “pursuant to applicable privacy law” without a section number. Vagueness benefits the broker.</li> Tortious or defamation claims. Those require a court and an attorney. KnytX files administrative privacy requests, not legal complaints.</li> </ul> When a broker refuses or partially complies</h2> Statutory exceptions exist in every regime — fraud prevention, security, public-interest journalism, compliance with another law. When a broker invokes an exception we: Record the cited exception in your dashboard, verbatim.</li> Assess whether the exception facially applies. If we believe it does not, we file a follow-up request citing the same authority and asking for a written justification.</li> If the refusal persists and we believe it is improper, we escalate by helping you draft a complaint to the relevant supervisory authority (CPPA, ICO, the relevant DPA, FDPIC, etc.).</li> </ol> We do not litigate on your behalf. We do not threaten litigation. We do not promise the broker a “lawsuit” if they refuse — that is not our authority and it tends to make the situation worse, not better. The controller-of-record question</h2> For every request we file, NCRYPTO Labs Private Limited is named as the controller (GDPR / UK GDPR), business (CCPA), or Data Fiduciary (DPDPA). Some thoughts on the joint-controller question: Dark-web vendor lookups (Pro tier). When we send a hashed identifier to SpyCloud, Hudson Rock, or DarkOwl on your behalf, our position is that we remain the sole controller and the vendor is a processor under GDPR Article 28 / DPDPA §8(7). We have signed processor agreements that say so. A regulator could argue this is joint controllership under Article 26; our DPIA addresses this and we are prepared to defend the processor characterisation, with a fallback joint-controller arrangement documented if a regulator disagrees.</li> PimEyes reverse-image search (Executive tier). This is the closest case to joint controllership in our pipeline, because PimEyes operates a public-facing search service with its own purposes. Our position is that we use the API only for a defined, bounded purpose (impersonation defense) and that PimEyes is a processor for that limited interaction. We disclose this in our sub-processor list</a>.</li> The CPPA mechanism (DELETE Act). The CPPA portal is a state-administered system, not a sub-processor. NCRYPTO Labs Private Limited acts as your authorised agent</a> in filing.</li> </ul> Postal addresses and points of contact</h2> For each regime, the controller-of-record can be contacted at: Primary (all regimes): NCRYPTO Labs Private Limited, Bangalore, Karnataka, India. legal@knytx.com</a>.</li> EU representative (GDPR Art. 27): appointed and named on filings where required.</li> UK representative (DPA 2018 §83): appointed where required.</li> </ul> Supervisory-authority contact details are listed in Section 6 of the main Privacy Policy</a>. Updates to this matrix</h2> When a new privacy law comes into force that we can file under — for example, a US federal privacy law if Congress passes one, or new EU regulations — we update this matrix and the underlying request templates. Material changes are summarised in our annual transparency report. If you spot an error or a missing regime, please email legal@knytx.com</a>. This page is meant to be accurate, not promotional. Open Source — Our Mobile Apps Are Auditable Unknown — Fri, 17 Jul 2026 00:00:00 +0000 Status: the repositories below publish at launch. This page describes what you will be able to verify once they are live. Why we will open-source the mobile apps</h2> A KnytX mobile install asks you for permissions that very few apps should ever ask for. It reads your incoming calls, reads your incoming SMS, runs a foreground service, listens for boot, and (on Executive plans) accesses camera and microphone for biometric enrollment. Those are the same permissions a stalkerware app asks for. The difference between us and stalkerware is what the code does with the access. The only honest way to make that difference verifiable is to publish the code. We will publish: Android client — Kotlin, GPLv3, at github.com/knytx</a>.</li> iOS client — Swift, GPLv3, at github.com/knytx</a>.</li> Browser extension if and when we ship one — GPLv3.</li> </ul> We do not publish: The Rust backend (closed source). This is where the broker-removal templates, the dark-web vendor integrations, the scoring algorithms, and the ML models live. Releasing those would let bad actors evade our detection logic without informing real users.</li> The ONNX biometric models. Those are derived from third-party research weights and bound by upstream licenses.</li> The web dashboard (Next.js). Less load-bearing on permissions, but still proprietary for the same operational-security reasons as the backend.</li> </ul> The line is: anything that asks for permission on your device is open. Anything that runs on our servers is closed but documented. API behaviour is documented. Contact security@knytx.com</a> to request the OpenAPI specification, which describes every request the mobile app can make of the backend. Reproducible builds</h2> A reproducible build means anyone, anywhere, can compile the source code and get a binary. That binary is byte-for-byte identical to the one we ship to the Play Store or App Store. If they are not identical, something has been added, and you should not install our binary. We make this verifiable: Each release tag in github.com/knytx</code> will be signed.</li> CI builds the release artefact from the tagged commit using a pinned toolchain.</li> The build hash (SHA-256 of the APK and IPA respectively) is published in the release notes on GitHub.</li> The Play Store and App Store binaries we publish are the same artefact CI produced, with the same hash.</li> </ol> To verify, you: Clone the repo at the tag.</li> Run the documented build (./scripts/reproducible-build.sh</code>).</li> Compare the SHA-256 of your output with the SHA-256 in the GitHub release notes.</li> </ol> If they do not match, please report it to security@knytx.com</a> and to the wider security community. A diverging hash means one of three things: our build infrastructure was compromised, a CI race condition introduced non-determinism, or the published binary is not from this source. Any of those is a vulnerability we want fixed immediately. This commitment is in scope of our security disclosure policy</a>. Audit history and cadence</h2> Pre-launch audit. Before the first public release, an independent firm reviews the mobile codebases for the obvious categories. Those are permission misuse, network egress to undisclosed endpoints, insecure storage of credentials or biometric material, and side-channel leaks via logs or analytics.</li> Annual paid audit. Every twelve months thereafter, we commission a fresh audit. We rotate the auditor every two cycles to avoid familiarity bias.</li> Community audit, anytime. Once the code is public, our disclosure policy covers researchers acting in good faith. We welcome reports.</li> </ul> Audit reports are published in redacted form (with vendor-specific identifying information removed when the auditor requires it) within 60 days of receipt. Findings are tracked in public issues where they can be discussed without operational risk; sensitive findings are tracked privately until remediated, then published. What the apps actually do — quick reference</h2> For the impatient, here is a one-line description of every permission and what the code does with it. The full disclosure with code references lives at /legal/mobile-permissions/</a>. Permission</th> What the code does</th> Where in the repo</th></tr></thead> READ_CALL_LOG</code>, READ_PHONE_STATE</code> (Android), CallKit Directory Extension (iOS)</td> Checks incoming caller ID against a locally cached scam-number database. The phone number does not leave the device for this check.</td> android/app/src/main/kotlin/io/knytx/scam/CallScreener.kt</code></td></tr> READ_SMS</code>, RECEIVE_SMS</code> (Android), ILMessageFilterExtension</code> (iOS)</td> Reads incoming SMS bodies, extracts URLs, checks URLs against a phishing API. SMS bodies are processed on-device; only the URL is sent for the check.</td> android/app/src/main/kotlin/io/knytx/scam/SmsScreener.kt</code></td></tr> FOREGROUND_SERVICE</code>, RECEIVE_BOOT_COMPLETED</code></td> Keeps the call and SMS screeners running across reboots. No data is sent during boot.</td> android/app/src/main/kotlin/io/knytx/service/ShieldService.kt</code></td></tr> CAMERA</code> (Executive only)</td> One-time face photo capture for biometric enrollment. Photos are uploaded to KnytX servers only after explicit consent; embedding is computed server-side; original photos are deleted within seconds. See /legal/biometric-policy/</a>.</td> Onboarding module</td></tr> RECORD_AUDIO</code> (Executive only)</td> Voice sample capture for voiceprint enrollment. Same on-server processing pattern.</td> Onboarding module</td></tr> </tbody></table> The Play Store and App Store privacy labels reflect this exact list. If a privacy label diverges, the GitHub README is the source of truth. The promise that survives us</h2> If KnytX is ever sold, acquired, or otherwise changes hands, the open-source mobile clients under GPLv3 remain free for anyone to maintain. Even if every other commitment on this site evaporated, you could still fork the mobile clients. They would keep running against any compatible backend, including a self-hosted one, if someone built it. GPLv3 makes this a legal entitlement, not a corporate promise. We chose it on purpose. What we ask from contributors</h2> Once the repos are live, they accept pull requests under the standard fork-and-PR flow. By contributing, you agree that your contribution is licensed under GPLv3. We do not require a CLA. We do not relicense your contributions. We do not have a dual-licensing scheme that lets us monetise the open-source code outside GPL terms. For security disclosures, please read our security disclosure policy</a> before opening a public issue. We prefer private disclosure first. The audit trail applies to the KnytX mobile app</a> — the primary surface where these open-source components run. Questions</h2> Repository, build, or audit questions: security@knytx.com</a>. License or contribution questions: legal@knytx.com</a>. Scoring Models & Automated Signals Unknown — Fri, 17 Jul 2026 00:00:00 +0000 In short: the scores on your dashboard are advisory signals that show you where to focus, not automated decisions used against you. The logic is deterministic and published, you can see every input, dispute it, or turn scoring off, and no score leaves your dashboard. These are the scores you see in your Privacy Exposure Score dashboard</a>. Why this page exists</h2> KnytX surfaces several numeric signals on user dashboards. The previous version of our Privacy Policy said we did not run automated decisions and would update the policy if that changed. It has changed. This page exists so the disclosure is concrete, not generic. GDPR Article 22 gives a data subject the right not to be subject to a decision based solely on automated processing that produces legal or similarly significant effects. Our scores do not meet that threshold — they are advisory signals shown to you, not adjudicative outputs used against you — but we want to be explicit about that distinction rather than rely on it as a defense. </a>The four scores in production</h2> 1. Privacy Risk Score (all tiers)</h3> What it is: A single number, 0–100, summarising your overall digital exposure. Higher means more exposed.</li> Inputs: Number of brokers listing you, number of breaches your identifiers appear in, severity of each breach, presence of stealer-log entries (Pro+), dark-web mentions (Pro+).</li> Logic: A weighted sum, with the weights published below. Not a machine-learning model — a deterministic scoring rubric you can audit.</li> What it is used for: Sorting the dashboard. Highlighting which remediation to do next. Tracking your improvement over time.</li> What it is not used for: Pricing. Insurance. Hiring decisions. Anything outside of your KnytX dashboard. We do not share the score with any third party.</li> </ul> Weights (published): Input</th> Weight</th> Notes</th></tr></thead> Number of broker listings</td> up to 30 points</td> Capped at 30 for any single user</td></tr> Number of breaches (verified)</td> up to 25 points</td> Verified breaches only; unverified leaks add lower weight</td></tr> Stealer-log entries</td> up to 20 points</td> High weight because stealer logs imply active compromise</td></tr> Dark-web forum mentions</td> up to 15 points</td> Pro tier and above</td></tr> Sensitive PII exposed (SSN, financial, biometric)</td> up to 10 points</td> Multiplier on the other inputs</td></tr> </tbody></table> The weights are public. Future changes to the weights are versioned, and your dashboard shows which version produced the displayed score. 2. Privacy Maturity Level (Pro and above)</h3> What it is: A discrete progression — Beginner, Foundational, Intermediate, Advanced, Hardened — describing how much of the KnytX feature set you have engaged with and how much risk you have mitigated.</li> Inputs: Completion of broker removals, breach remediation actions, password rotation, biometric enrollment (where applicable), open-source-app installation, 2FA enrollment for the KnytX account itself.</li> Logic: Threshold-based. Each level requires a set of completed actions. The list is visible in the dashboard.</li> What it is used for: Gamification. Helping you see progress. Suggesting the next action.</li> What it is not used for: Anything outside the dashboard.</li> </ul> Beginner Foundational Intermediate Advanced Hardened </div> 3. Scam Vulnerability Score (Pro and above)</h3> What it is: A number, 0–100, estimating how easy it would be for a scammer to construct a convincing pretext against you using exposed data.</li> Inputs: Combinations of exposed data that are particularly useful for social engineering — name + DOB + employer, name + phone + last-four of SSN, voice sample exposure, family-member identifier exposure (where you have authorised family-plan visibility).</li> Logic: Combinatorial. Specific high-value combos add more points than the sum of their parts (because a scammer with three correlated facts is meaningfully more dangerous than one with three uncorrelated facts).</li> What it is used for: Prioritising remediation. Highlighting “preemptive scam warning” coverage.</li> What it is not used for: Anything beyond your dashboard.</li> </ul> 4. Pro 4-Dimension Score (Pro, Family, Team, Executive)</h3> What it is: Four sub-scores, each 0–100, for financial risk, identity-theft risk, physical safety risk (relevant when home address is broadly exposed), and reputation risk.</li> Inputs: Categorised subsets of the inputs to the overall Privacy Risk Score, plus impersonation findings for the reputation dimension.</li> Logic: Deterministic weighting per dimension, with the weights published in your dashboard.</li> What it is used for: Letting you see which kind of risk is largest, so you can prioritise.</li> What it is not used for: Anything beyond your dashboard.</li> </ul> What the scores are not</h2> None of the four scores is, in our view, a “solely-automated decision producing legal or similarly significant effects” under GDPR Article 22, because: The scores are shown to you, the data subject. They are inputs to your own decisions.</li> The scores do not determine the price of KnytX, the features you get, or whether you can use the service. KnytX pricing is tier-based and posted publicly.</li> The scores are not shared with insurance companies, lenders, employers, landlords, or any other third party. We have no commercial relationship with any such party.</li> The logic is deterministic and disclosed. There is no opaque ML model whose reasoning we cannot explain.</li> </ol> If a regulator concluded that one of the scores does fall within Article 22, we have a documented fallback: turning the score into an explicitly opt-in feature with a human-review path. We are prepared to switch to that posture on short notice. DPDPA Draft Rules 2025</h2> India’s draft DPDPA Rules contemplate disclosure obligations for “significant” automated decisions. We treat scoring as in-scope for that disclosure even though the scores are advisory, and we will update this page if the final Rules change the threshold or the disclosure format. Your rights, specifically about scoring</h2> Right to see the inputs. Your dashboard shows the contribution of each input to each score. If a finding is incorrect (e.g. a broker listed under your name is actually a different person), use the in-product flagging control or email legal@knytx.com</a> to dispute the input. Disputed inputs are excluded from your score while the dispute is open.</li> Right to a human review. Email legal@knytx.com</a> with subject line “Score review” and a member of our team will manually review the score, the inputs, and the logic and either explain or correct as appropriate. This is free and not rate-limited.</li> Right to opt out of scoring. Account settings → “Disable scoring dashboard”. The scoring engine still runs (your findings are still there), but the numeric and level outputs are hidden. You will see raw findings instead.</li> Right to delete the score history. Account settings → “Delete score history” removes the time-series record. Current scores will rebuild on the next scan; prior history is gone.</li> Right to portability. The score history is part of your data export.</li> </ul> Inputs we do not use, on principle</h2> The following are NOT inputs to any KnytX score: Your IP address or geolocation history</li> Your browsing behaviour on knytx.com</code></li> Your device or browser fingerprint</li> Your demographics inferred from any data we hold</li> Your subscription tier, payment history, or how long you have been a customer</li> Any data from sister companies (Stalten, XRTE) or any external commercial source</li> </ul> We score what you are exposed to, not who you are. Changes to the scoring logic</h2> When we change a weight, add an input, or retire a model, we: Publish the new weights in this page, with a dated revision note.</li> Show both the old and new score on the dashboard for at least 14 days so you can see the impact.</li> Allow you to opt out of the new model in the meantime if you disagree with the change.</li> </ol> Material model changes are included in the annual transparency report. Questions</h2> Scoring questions, disputes, and human-review requests: legal@knytx.com</a>, subject line “Scoring”. For the broader controller-of-record details, see Section 1 of the Privacy Policy</a>. Sub-Processors & Data-Sharing Partners Unknown — Fri, 17 Jul 2026 00:00:00 +0000 In short: every third party we send data to is named below, with its legal entity, jurisdiction, exactly what we send, and the DPA that binds it. Where a hash works instead of the raw identifier, we send the hash. The vendors we deliberately refuse to use are listed too. How to read this page</h2> A sub-processor is any third party we instruct to process personal data on our behalf. Under GDPR Article 28(3), we must disclose them, bind them to written terms, and stay liable for their performance. Under DPDPA §8(7), we must give notice to the Data Principal. Under CCPA, processors are “service providers,” restricted from using data for their own purposes. For each vendor we list: Legal entity — the actual contracting party.</li> Jurisdiction — where the contracting entity sits and where processing happens.</li> Purpose — exactly what we use them for.</li> What we send — the data categories that leave our systems.</li> Plaintext or hash — whether the vendor sees the raw identifier or only a hashed/prefixed form.</li> Transfer mechanism — the legal basis for international transfers, where relevant.</li> DPA reference — the contract that governs the relationship.</li> </ul> If a category is not listed for a vendor, we do not send it. This is our current set of sub-processors, updated as they change. Infrastructure and analytics</h2> Cloudflare, Inc.</h3> </th> </th></tr></thead> Jurisdiction</td> US-incorporated; EU traffic terminates at Frankfurt and Amsterdam edges</td></tr> Purpose</td> CDN, DDoS protection, TLS termination for knytx.com</code></td></tr> Data shared</td> Request metadata only (IP, user-agent, URL) — no account data</td></tr> Plaintext / hash</td> Plaintext request metadata</td></tr> Transfer mechanism</td> EU SCCs (Module 2, 2021/914) + supplementary measures</td></tr> DPA</td> Cloudflare DPA</a> (publicly published)</td></tr> </tbody></table> Umami Cloud</h3> </th> </th></tr></thead> Jurisdiction</td> Umami Software, Inc.; processing in the EU</td></tr> Purpose</td> Cookieless website analytics for knytx.com</code></td></tr> Data shared</td> Hashed visit signals (page, referrer, anonymised country, device class) — no cookies, no persistent identifiers</td></tr> Plaintext / hash</td> Hashed; raw IP is not stored</td></tr> Transfer mechanism</td> Processing in the EU; no cross-border transfer</td></tr> DPA</td> Signed processor DPA; Umami privacy notice</a> linked for reference</td></tr> </tbody></table> Email-forwarding provider</h3> </th> </th></tr></thead> Jurisdiction</td> EU-based; vendor selection in progress — entry will be updated before launch</td></tr> Purpose</td> Receive and forward inbound email to *@knytx.com</code> role addresses</td></tr> Data shared</td> Contents of inbound email correspondence you send to us</td></tr> Plaintext / hash</td> Plaintext; encrypted in transit (SMTP/TLS) and at rest</td></tr> Transfer mechanism</td> EU SCCs if any non-EU touchpoint; otherwise intra-EU</td></tr> DPA</td> Standard processor DPA</td></tr> </tbody></table> Dark-web and breach-intelligence vendors (Pro tier and above)</h2> We invoke these vendors when a Pro, Family, Team, or Executive user runs a scan with dark-web exposure checks. We do not invoke them for Basic or Free users. These data feeds power KnytX Vigil</a>’s dark-web credential monitoring. SpyCloud, Inc.</h3> </th> </th></tr></thead> Jurisdiction</td> US (Texas)</td></tr> Purpose</td> Detect user identifiers in stealer-log malware exports (Redline, Raccoon, Vidar, etc.)</td></tr> Data shared</td> Email address only — no password, phone, or address</td></tr> Plaintext / hash</td> Plaintext (SpyCloud catalog requires it); minimised to enabled identifiers only</td></tr> Transfer mechanism</td> EU SCCs (Module 1, controller-to-processor) + enhanced-protection addendum</td></tr> DPA</td> Signed processor agreement — forbids training, profile-building, or onward sale</td></tr> </tbody></table> Hudson Rock Ltd. (Cavalier)</h3> </th> </th></tr></thead> Jurisdiction</td> Israel</td></tr> Purpose</td> Stealer-log detection; redundancy check alongside SpyCloud (non-overlapping coverage)</td></tr> Data shared</td> Email address only</td></tr> Plaintext / hash</td> Plaintext</td></tr> Transfer mechanism</td> Israel partial EU adequacy decision; SCCs for data outside adequacy scope</td></tr> DPA</td> Signed processor agreement; same scope and restrictions as SpyCloud</td></tr> </tbody></table> Flare Systems (Flare.io)</h3> </th> </th></tr></thead> Jurisdiction</td> Canada (Quebec)</td></tr> Purpose</td> Dark-web forum, marketplace, and paste-site monitoring for user identifiers</td></tr> Data shared</td> Email and, where enabled, phone number or username</td></tr> Plaintext / hash</td> Plaintext (forum mentions are text-matched, not hash-indexed)</td></tr> Transfer mechanism</td> Canada PIPEDA adequacy covers most exports; SCC fallback otherwise</td></tr> DPA</td> Signed processor agreement; use restricted to query response</td></tr> </tbody></table> DarkOwl, LLC</h3> </th> </th></tr></thead> Jurisdiction</td> US (Colorado)</td></tr> Purpose</td> Secondary dark-web index; coverage redundancy alongside Flare</td></tr> Data shared</td> Email, phone, username where enabled</td></tr> Plaintext / hash</td> Plaintext</td></tr> Transfer mechanism</td> EU SCCs</td></tr> DPA</td> Signed processor agreement</td></tr> </tbody></table> PimEyes sp. z o.o.</h3> </th> </th></tr></thead> Jurisdiction</td> Poland (EU)</td></tr> Purpose</td> Reverse-image search for facial impersonation detection (Executive tier only, after explicit biometric consent)</td></tr> Data shared</td> Single reference photo per query; “do not store” flag set where supported</td></tr> Plaintext / hash</td> Image bytes (API requires it)</td></tr> Transfer mechanism</td> Intra-EU; no third-country transfer</td></tr> DPA</td> Signed processor agreement restricted to impersonation-defense purpose; see legal-framework matrix</a> for joint-controller analysis</td></tr> </tbody></table> Payments and billing</h2> Stripe Payments Europe, Ltd.</h3> </th> </th></tr></thead> Jurisdiction</td> Ireland (EU customers); Stripe, Inc. (US); Stripe India Pvt. Ltd. (INR billing)</td></tr> Purpose</td> Subscription billing and payment processing</td></tr> Data shared</td> Customer email, billing country, and payment request — KnytX never sees or stores card numbers</td></tr> Plaintext / hash</td> Plaintext for billing-required fields</td></tr> Transfer mechanism</td> EU SCCs for EU-to-US transfers; Stripe operates EU-data residency for EEA customers</td></tr> DPA</td> Stripe DPA</a> (publicly published)</td></tr> </tbody></table> What we deliberately do not use</h2> Google Analytics, Mixpanel, Amplitude, Segment, or any product-analytics SDK that builds behavioural profiles.</li> Advertising networks (Google Ads, Meta, TikTok). KnytX does not advertise and does not run pixels.</li> Customer-data platforms (Salesforce Marketing Cloud, HubSpot CRM). We use a single transactional-email vendor for service notifications and no CRM-style customer-data aggregation.</li> Generative-AI vendors for processing user content. We do not pass user identifiers or scan content to OpenAI, Anthropic, Google, or any third-party model API. Internal AI models run on our own infrastructure.</li> </ul> Do you see a network call from knytx.com</code> or the KnytX product to a vendor not listed here? Please report it to security@knytx.com</a>. We want to know. Adding, changing, or removing a sub-processor</h2> When we add a new sub-processor we: Complete a written vendor-due-diligence review (security, privacy posture, data-residency, breach history).</li> Sign a Data Processing Agreement before any data flows.</li> Update this page within 5 business days.</li> Give 30 days’ advance notice to enterprise customers, and to any individual customer who asked for sub-processor change notifications.</li> Record the change in the next annual transparency report.</li> </ol> Customers may object to a new sub-processor. If we cannot reasonably accommodate the objection, you may cancel the affected service without penalty during the notice window. DPA on request</h2> Need the customer-facing DPA? It is the agreement between you and NCRYPTO Labs, and it names these sub-processors and their transfer mechanisms. Email legal@knytx.com</a> with subject line “DPA request”. AI Security Questionnaire Tools: What They Do & Miss Unknown — Sun, 12 Jul 2026 00:00:00 +0000 AI security questionnaire tools promise to turn an 8-hour spreadsheet into a 30-minute review. That promise is mostly true, with an important asterisk. The AI is drafting, not deciding. The gap between those two words is where every credible vendor in this category draws a hard line, and where every well-run internal process should too. The short answer: AI security questionnaire tools use a retrieval-and-draft pipeline. They parse each question, retrieve matching entries from your answer library, draft an answer, score its confidence, and route low-confidence ones to a human. A person reviews and approves every answer before it’s submitted. The tools worth using make review a hard gate. Never auto-submit. Here’s what’s actually happening under the hood when a tool claims to “automate” a security questionnaire with AI, what tends to go wrong, and what to check before you trust one with a real deal. How the pipeline actually works</h2> Strip away the marketing and the mechanism is a standard retrieval-and-generation pattern applied to a specific document type: Parse. The tool reads an uploaded questionnaire — usually a CSV or XLSX, sometimes a Word doc or a vendor-portal form — and extracts each individual question as a discrete item, along with any answer-format constraints (yes/no, free text, multiple choice).</li> Retrieve. For each question, the system searches your existing answer library — the set of previously-approved Q&A pairs, policy excerpts, and document snippets — for the closest matches. This is the step that makes the tool only as good as your library. A thin library returns thin, generic matches.</li> Draft. A language model turns the retrieved material into a coherent answer in the requested format, ideally with an inline citation back to the source library entry so a human reviewer can verify where the claim came from.</li> Score confidence. The better tools attach a confidence score to each draft based on how well the retrieved material actually matched the question. Low-confidence drafts should be flagged for a human to write from scratch rather than presented as a finished answer.</li> Human review. A person reads every drafted answer, edits where needed, and approves before anything is submitted.</li> Export. The approved answers get written back into the original file format — ideally without disturbing any cells the reviewer didn’t touch, since procurement teams sometimes notice a corrupted spreadsheet before they notice a good answer.</li> </ol> Step 5 is the entire ballgame. Everything before it is retrieval and language generation, both of which are commodity technology at this point. What actually separates the tools is the quality of the retrieval, the honesty of the confidence scoring, and whether the product makes it easy or hard to skip the review step under deadline pressure. Where AI drafting goes wrong</h2> Hallucinated specificity. A language model asked “what’s your data retention policy” with no strong library match will often produce a plausible-sounding, entirely fabricated answer rather than admitting it doesn’t know. This is the single most dangerous failure mode, because a fabricated answer reads exactly as confidently as a correct one. The fix is architectural, not a prompting trick: the system needs to refuse to answer, not guess, when retrieval confidence is low. Stale library entries. An AI drafting tool will happily cite a subprocessor list from eight months ago if that’s what’s in the library, with full confidence and a clean citation. The citation makes it look verified; it isn’t. Staleness tracking on library entries — flagging when an approved answer is past its review date — matters as much as the drafting quality itself. Answering the wrong version of the question. Two questionnaires can ask what looks like the same question (“describe your encryption approach”) but expect very different levels of detail. A CAIQ response and a bespoke enterprise questionnaire calibrate differently. A naive retrieval match can paste in an answer that’s technically accurate but calibrated for the wrong audience. Auto-submit as a feature. Some tools market a fully automated, no-review pipeline (draft, format, submit) as the selling point. Don’t use one. A wrong answer on a security questionnaire is a contract-risk problem. Procurement teams and legal reviewers treat questionnaire answers as representations you can be held to. The tools worth using treat human review as a hard gate in the product itself, not an optional setting a busy team will eventually skip. Format corruption on export. A smaller, more mundane failure. Some tools rewrite the entire spreadsheet on export instead of only touching the cells they filled. That can silently mangle formatting the buyer’s procurement team is expecting. Round-trip fidelity, where the original file exports back with untouched cells genuinely untouched, is a real quality signal, not a nice-to-have. What to check before trusting a tool with a real questionnaire</h2> Does it show its work? Every drafted answer should carry a visible citation to the specific library entry or document it came from. If you can’t see where an answer originated, you can’t verify it.</li> Does it score confidence honestly? Ask what happens to a question with no good library match. “Best-effort guess” is the wrong answer. “Flagged for human answer, no draft shown” is the right one.</li> Where does your data actually go? Some tools route your questionnaire content — which often includes real infrastructure detail — through a third-party AI API by default. Ask specifically whether that’s opt-in or opt-out, whether it’s logged, and whether it’s disclosed on your own subprocessor list if you turn it on.</li> Can you export without breaking the file? Ask for a demo with a real questionnaire format your buyers actually use, not a clean sample file.</li> Is review actually mandatory, or just available? A checkbox for “auto-submit” anywhere in the product is a signal to keep looking.</li> </ul> The honest limit</h2> Even a well-built AI drafting layer doesn’t remove your responsibility for what gets submitted under your company’s name. The realistic win isn’t “questionnaires disappear.” It’s turning an 8-15 hour research-and-writing task into a 30-90 minute review-and-approve task. The hard part, verifying the answer is actually correct, still rests with a human who understands your own infrastructure. Any vendor telling you otherwise is selling you a liability, not a shortcut. This “draft-then-human-review” model is exactly the line KnytX for Business</a> is built around for a small team, once it’s live: AI-assisted drafting with a citation and confidence score, and human approval kept as a hard gate. For how a standalone trust layer compares to the big compliance bundles that fold AI drafting into a larger platform, see KnytX Trust vs Vanta & Drata</a>. KnytX Trust isn’t live yet — join the waitlist</a> to get in at launch. Frequently asked questions</h2> Can AI fully answer a security questionnaire for you? No. AI drafts answers from your library, but a human must review and approve each one. A wrong answer is a contract-risk problem, so the tools worth using make review a hard gate and never auto-submit. How does an AI questionnaire tool actually work? It parses each question, retrieves matching entries from your answer library, drafts a response, scores its confidence, and routes low-confidence items to a human. A person reviews every answer before export. What’s the biggest failure mode to watch for? Hallucinated specificity: a model inventing a plausible-sounding answer when it has no strong library match. The fix is architectural. The system should refuse to answer when retrieval confidence is low, not guess. Related reading</h2> Security questionnaire automation: what it is and how to do it</a> — the full picture, including the answer library and trust-center layers this post assumes.</li> What trust center software actually does</a> — the layer that reduces questionnaire volume before AI drafting even gets involved.</li> CAIQ automation, explained</a> — how AI drafting performs against the most standardized questionnaire format.</li> </ul> CAIQ Automation: Answer the CSA Questionnaire Once Unknown — Sun, 12 Jul 2026 00:00:00 +0000 If you sell software to enterprise buyers, you’ve probably received some version of the CAIQ. The Consensus Assessments Initiative Questionnaire is a standardized security-assessment format published by the Cloud Security Alliance (CSA). Alongside the SIG, it’s one of the two formats common enough to be worth understanding on its own. The short answer: CAIQ automation means answering the CSA questionnaire once, then reusing that answer set on every future request. Because the CAIQ is standardized, you build a library organized by control domain, publish it once to the CSA STAR Registry, and populate each new buyer’s copy from answers you already wrote. A human still reviews every drafted answer before it goes out. What the CAIQ actually is</h2> The CAIQ maps to the CSA’s Cloud Controls Matrix (CCM). The CCM is a structured set of control domains: application security, data governance, encryption and key management, identity and access management, incident response, and vendor/subprocessor management. Instead of writing their own questions from scratch, a buyer hands you the CAIQ. It asks a standardized set of yes/no-plus-explanation questions mapped directly to those CCM domains. The practical effect for a vendor is predictability. A bespoke enterprise questionnaire is different every time, but the CAIQ’s structure is the same across every buyer who uses it. That predictability is what makes it automatable in a way ad hoc questionnaires aren’t. You’re not reverse-engineering a new format each time. You’re answering the same instrument repeatedly. The shortcut most small vendors miss: CSA STAR Registry</h2> Here’s the part that isn’t obvious until someone tells you. The CSA runs a public database called the STAR Registry. You submit your completed CAIQ once and make it publicly discoverable. Buyers who recognize the CAIQ format can check the registry before sending you their own copy. Some procurement teams are explicitly trained to check it first. This enables the “answer once, reuse everywhere” pattern that experienced vendors land on organically. Complete the CAIQ thoroughly one time. Submit it to the STAR Registry, where the entry-level Self-Assessment tier is free. From that point forward you have a standing, citable artifact instead of starting from zero on every CAIQ request. Some buyers will still want their own copy delivered directly rather than a registry link. Even then, you’re populating their spreadsheet from an answer set you already built, not writing it fresh. This is a genuine “answer once” mechanism. It’s a big part of why experienced compliance teams describe hitting a point, often cited informally as “after about five completed questionnaires,” where a master template turns a new CAIQ request into a couple of hours of review instead of a multi-day project. What CAIQ automation actually means in practice</h2> Applied to the CAIQ specifically, the general questionnaire-automation pattern gets sharper because the format is fixed: 1. Build the answer set against the CCM domains directly, not against a specific buyer’s spreadsheet. Every CAIQ maps to the same control domains. So an answer library organized by CCM domain, rather than by “questionnaire from Buyer X,” transfers cleanly to every future CAIQ you receive and to STAR Registry submission. 2. Publish to STAR Registry once the library is solid. This is the trust-center-equivalent move for the CAIQ specifically. It’s a standing, checkable artifact that deflects requests before they reach your inbox as a spreadsheet. 3. Let drafting tools do format-matching, not research. Because CAIQ questions are standardized, a retrieval-and-draft tool has an easier time here than on a bespoke questionnaire. It matches known questions to known answers. There’s less risk of the “wrong calibration for this buyer” problem that shows up on custom enterprise formats. The same rule still applies, though: a human should review every drafted answer before it goes out. That matters most on control-domain questions, where a wrong “yes” surfaces later as a real gap. 4. Keep it current against your actual infrastructure. CAIQ answers about encryption, key management, and subprocessors go stale like any other library entry. A registry submission from 18 months ago that lists a subprocessor you’ve since dropped is worse than not having a STAR Registry entry at all. CAIQ vs. a bespoke enterprise questionnaire</h2> A standardized CAIQ is easier to automate well. But a large share of enterprise buyers still send their own custom questionnaire on top of, or instead of, the CAIQ. That’s often because their internal vendor-risk process is built around it. Realistically, most small vendors need both. You want a CAIQ/STAR Registry presence for the buyers who accept it, and a general answer library for everyone else. That general library, covered in our security questionnaire automation guide</a>, also handles SIG questionnaire</a> requests, the other major standardized format. If you’d rather not build and maintain the library yourself, this answer-once-reuse-everywhere workflow is exactly what KnytX for Business</a> is designed to run for a small team once it’s live. It pairs an AI-assisted answer library with a public trust center. See how that standalone approach compares to the big compliance bundles in KnytX Trust vs Vanta & Drata</a>. KnytX Trust isn’t live yet — join the waitlist</a> to get in at launch. Frequently asked questions</h2> What is the CAIQ? The Consensus Assessments Initiative Questionnaire is a standardized security-assessment format from the Cloud Security Alliance. It maps to the CSA Cloud Controls Matrix, so buyers use one common question set instead of writing their own each time. Is submitting to the CSA STAR Registry free? The entry-level Self-Assessment tier is free. You publish your completed CAIQ there once, and buyers who accept the registry can check it before sending their own copy. Can you fully automate a CAIQ response? No. Automation handles retrieval, format-matching, and drafting, but a human should review every answer. A wrong “yes” on a control question can surface later as a real compliance gap. Related reading</h2> Security questionnaire automation: what it is and how to do it</a> — the general system this post specializes for the CAIQ.</li> SIG questionnaires, explained</a> — the other standardized format, and how it differs.</li> What trust center software actually does</a> — the publish-once, deflect-repeatedly layer that STAR Registry mirrors for CAIQ specifically.</li> </ul> DROP Act Deadline: What Happens August 1, 2026 Unknown — Sun, 12 Jul 2026 00:00:00 +0000 August 1, 2026 is a real regulatory deadline, and it’s getting confused with a different date that doesn’t exist: the day your data supposedly disappears. It isn’t that. Here’s what actually happens. The one-sentence version</h2> Starting August 1, 2026, every data broker registered with California’s Privacy Protection Agency (CPPA) must begin retrieving and processing deletion requests submitted through the DROP portal (Delete Request and Opt-out Platform). That does not mean anyone’s data is already deleted by that date, and it is not a one-time event. It’s the start of an ongoing, recurring obligation, not a finish line. What “brokers must begin processing” actually requires</h2> The statute — California Civil Code §1798.99.86, part of SB 362 (the DELETE Act) — sets three concrete obligations that kick in on August 1, 2026: Retrieve deletion requests at least every 45 days. Registered brokers have to pull the current list of deletion requests from the DROP portal on a recurring 45-day cadence, not just once.</li> Report processing status within 45 days of each retrieval. A broker that pulls the list has 45 days to report back what it did with each request.</li> Complete deletion determinations within 90 days. The full cycle — retrieve, process, confirm or contest — has a 90-day outer bound.</li> Re-check on every subsequent retrieval. If a broker re-acquires data on someone who already filed a deletion request, it has to delete that data again on the next 45-day cycle, without the consumer re-filing.</li> </ol> Non-compliance carries a real penalty: up to $200 per consumer, per day, per violation, enforceable by the CPPA. What August 1 does not mean</h2> It does not mean your data is deleted that day. Nothing about the date guarantees your specific records disappear on August 1 or shortly after. If you file a DROP request before the deadline, brokers still get up to 45 days to retrieve it and up to 90 days total to complete the determination. Realistically, the first wave of confirmed deletions from requests filed around this date is expected in late fall 2026, not August. It does not mean unregistered brokers are covered. DROP only binds brokers that registered with the CPPA. California’s registered-broker list runs to roughly 500 entities. Independent researchers estimate 900+ brokers actually operate in ways that meet SB 362’s definition. The gap isn’t touched by the August 1 deadline. It covers organizations that haven’t registered, are contesting whether they qualify, or are simply non-compliant. Big registered names like Spokeo</a>, Whitepages</a>, and Acxiom</a> are in scope; many smaller and unregistered brokers are not. See our DELETE Act filing guide</a> for the full registered-vs-unregistered breakdown. It does not extend to other states. This deadline is specific to California Civil Code §1798.99.86. If you live in Texas, Oregon, Colorado, or anywhere else, this date has no direct legal effect on your data. Those states don’t have an equivalent centralized portal yet. A “your CCPA 45-day clock has started” message would be legally wrong for a non-California resident. What you can do before the deadline</h2> Filing before August 1 doesn’t get your data deleted faster than filing after. The 45/90-day clocks run from when a broker retrieves your request, not from the calendar date. What filing early does get you is queue position: your request is already waiting for the very first retrieval cycle once brokers are obligated to start pulling it. That beats joining a queue that may see a rush of first-time filers right around the deadline. KnytX prepares the DROP filing package (the identifier set and CPPA-aligned consent) and walks you through submitting it yourself. There is currently no consumer- or agent-submission API, so we prepare it, you file it, never “we file it for you.” The filing itself is free on KnytX’s free tier, no card required. See DELETE Act Filing</a> for the guided version, or the full legal mechanics</a> if you want the statutory detail first. A realistic timeline</h2> Now → August 1, 2026: Registration enforcement continues; brokers prepare their retrieval pipelines. Filing a DROP request now queues it for the first retrieval cycle.</li> August 1, 2026: Registered brokers become legally obligated to start retrieving deletion requests at least every 45 days. This is a compliance start date, not a data-deletion date.</li> ~Mid-September 2026 (45 days later): First retrieval-and-report cycle deadline for brokers that pull requests on August 1.</li> Late fall 2026 (up to 90 days later): Realistic window for the first wave of confirmed deletion determinations to land, assuming no CPPA enforcement delays.</li> Every 45 days after that: The recurring cycle — retrieve, process, re-check for re-added data — continues indefinitely. You do not need to re-file.</li> </ul> Frequently asked questions</h2> Will my data actually be gone on August 1? No. August 1 is when the processing obligation begins, not a deletion date. Realistically expect confirmations to start arriving in the following months, not on the day itself. Do I need to wait until August 1 to file? No — you can file today. Filing earlier just means your request is already queued when the retrieval obligation starts, instead of joining whatever volume of requests shows up right at the deadline. What happens to brokers that aren’t registered? Nothing changes for them on August 1. DROP only reaches CPPA-registered brokers. Unregistered brokers require separate deletion requests under your general CCPA rights — see our DELETE Act guide</a> for that gap in detail. Is this the same deadline for every state? No. This is a California-specific statutory date under Civil Code §1798.99.86. No other state currently has an equivalent centralized deletion mechanism or deadline. What if a broker misses the deadline? The CPPA can impose penalties of up to $200 per consumer per day per violation. As a filer, you’ll see non-responsive brokers flagged in your DROP account status; you don’t need to chase enforcement yourself. What this page is not</h2> This is not a promise that your data disappears on a specific date, and it’s not a substitute for the CPPA’s own guidance. Want the full statutory mechanics (who has to register, what counts as a “data broker,” what happens if you move out of state)? Read our complete DELETE Act filing guide</a>. To see how much of your data is out there before you file anything, walk through an example scan →</a>. It’s an interactive example report, not a live scan of your own data, but it shows exactly what a data broker exposure check looks for. Statutory basis: California Civil Code §1798.99.86 (SB 362, the DELETE Act). Retrieval/reporting/determination cadence per the statute’s text; enforcement penalty figures per the CPPA’s public guidance. Your Mobile Carrier Sells Your Location and Calls Unknown — Sun, 12 Jul 2026 00:00:00 +0000 In January 2019, Motherboard journalist Joseph Cox paid $300 to a bounty hunter, a stranger with no law enforcement authority, no badge, and no court order. The bounty hunter located a T-Mobile subscriber’s real-time GPS position using nothing but that person’s phone number. He obtained the location from a data aggregator called Microbilt, which had purchased location data from T-Mobile. This was not a breach. No one hacked anything. It was a commercial transaction. The carrier sold the data, and the aggregator sold access to it. Anyone willing to hand over three hundred dollars could find out where you were standing. When Cox’s investigation ran in Motherboard on 8 January 2019, it prompted immediate public pledges from AT&T, T-Mobile, Verizon, and Sprint to stop selling location data to aggregators. By the time the FCC completed its formal investigation — years later, in April 2024 — three of the four had not meaningfully done so. The Commission fined AT&T $57 million, Verizon $46.9 million, T-Mobile $31.5 million, and Sprint $12 million (now absorbed into T-Mobile). The combined $148.1 million in penalties represented the largest coordinated FCC privacy enforcement action in the agency’s history. The fines landed. The practices had already run for years. What does your mobile carrier know, and does it sell it? Your carrier knows your continuous location (from cell-tower registration), every number you call and that calls you, your data usage, and your device’s permanent IMEI. In 2024 the FCC fined the four major US carriers a combined $148 million for selling real-time location data to aggregators. You can’t stop all of it. But you can opt out of CPNI marketing use, strip carrier-app permissions, use encrypted calls and messages, and (in the EU/UK) file a Subject Access Request. That data also feeds downstream brokers like Acxiom</a>. What your carrier actually knows about you</h2> No other commercial entity collects quite the same profile as a mobile carrier. Banks know your spending. Google knows your searches. Your carrier knows where your body is, continuously, and who you talk to. Cell tower triangulation gives carriers your physical location every time your phone registers with the network. That happens constantly, even when you’re not making a call or using data. For smartphones running carrier-integrated location services (which is most of them), this is supplemented by GPS and Wi-Fi-assisted positioning accurate to within a few metres. Your carrier doesn’t just know you were in Manchester on a given Tuesday. It can tell whether you were in a hospital ward or the car park outside. Call records — every number you dialled and every number that rang yours, with timestamps and call duration — are stored as a matter of course. This metadata is often more revealing than the calls themselves. A pattern of calls to a domestic abuse hotline, an oncologist, or a bankruptcy solicitor tells a story even without a recording. SMS metadata (sender, recipient, timestamp) is similarly retained, though carriers generally do not store message content. Mobile data usage at the domain level is logged for network management purposes. Many carriers historically used deep packet inspection to analyse unencrypted traffic, a practice that drew regulatory scrutiny in the US and UK. Device identifiers, particularly the IMEI (your handset’s permanent hardware serial number), tie all of this data to a specific device. Even if you change SIM cards or phone numbers, the IMEI links your activity back to the same physical phone. Law enforcement access to this data runs on a separate track from commercial sharing. Under the Electronic Communications Privacy Act in the US, call records can be obtained with a subpoena — a lower bar than a warrant. The 2018 Supreme Court decision in Carpenter v. United States improved protections for historical cell-site location information, holding that extended location tracking requires a warrant. But the commercial pipeline that Joseph Cox exposed operated entirely outside the law enforcement framework. It moved data from carrier to aggregator to whoever paid, without any legal process at all. The commercial data pipeline</h2> Carriers describe their location data products using terms like “anonymised,” “aggregated,” and “de-identified.” These descriptions rarely survive contact with technical scrutiny. A 2013 study by Yves-Alexandre de Montjoye at MIT showed that four data points were enough to re-identify 95% of individuals in an anonymised mobile location dataset. The four points: a shop you visited, a station you passed through, a postcode you frequented, and a time. The data carriers sell is not meaningfully anonymous. The buyers are various. Insurance companies purchase location data to verify accident reports and build actuarial models of driving behaviour. Financial institutions use it for fraud detection — confirming that a customer making an overseas card transaction is actually in that country. Retailers pay for foot traffic analytics: how many people who drove past a Currys also stopped at a competitor? Data brokers sit downstream of all of this, aggregating carrier data with records from other sources and reselling the combined profile. The FCC’s 2024 enforcement action centred specifically on CPNI, Customer Proprietary Network Information. Section 222 of the Communications Act defines this category to include call records, service details, and associated billing information. Carriers are prohibited from sharing CPNI with third parties without customer consent, subject to narrow exceptions. The Commission found that AT&T, Verizon, Sprint, and T-Mobile had all failed to establish adequate safeguards. They had allowed CPNI to flow to aggregators and downstream buyers in ways the law did not permit. Their internal compliance programmes were inadequate. In some cases, carriers were relying on contractual promises from aggregators that the aggregators were not keeping. SS7: the infrastructure flaw that’s been there since 1975</h2> Before considering what carriers choose to do with your data, it’s worth understanding a structural vulnerability they cannot easily fix. Signalling System 7 (SS7) is the set of protocols that allow mobile networks worldwide to communicate. They route calls, verify that a subscriber is reachable on a visited network, and enable roaming. It was designed in 1975. At that time, only a small number of trusted national telecoms operators had access to the system, so authentication wasn’t built in. That assumption has not held. Today, SS7 access can be legitimately purchased through specialised wholesale carriers. Compromised or corrupt telecom operators in various jurisdictions can also act as back doors into the system. A party with SS7 access can silently query the global network to find which cell tower your handset is registered with. They can intercept SMS messages — including SMS-based two-factor authentication codes. They can redirect calls. They can spoof caller ID. None of this requires physical proximity to you. Citizen Lab, the University of Toronto research group that investigates digital espionage, documented SS7-based surveillance being sold commercially by the late 2010s. The German magazine Der Spiegel ran detailed reporting in 2014 on how the NSA exploited SS7-adjacent protocols as part of bulk collection programmes. In 2017, the German newspaper Süddeutsche Zeitung reported that SS7 attacks had been used to intercept messages belonging to German parliamentarians. The US Senate Intelligence Committee held hearings on SS7 vulnerabilities in 2017, producing no meaningful legislative remedy. The protocol still underlies global telecom infrastructure. There is no realistic near-term path to replacing it. IMSI catchers: surveillance hardware you walk past</h2> IMSI catchers — commercially known as Stingrays, DRTboxes, and other product names sold by Harris Corporation and others — are portable devices that impersonate cell towers. When your phone connects to one, believing it to be a legitimate mast, the device captures your IMSI (International Mobile Subscriber Identity). That number uniquely identifies your SIM card. Higher-capability variants can intercept call content and data traffic. US law enforcement at federal, state, and local level has purchased these devices extensively. A 2016 investigation by the American Civil Liberties Union identified over 75 agencies in 27 states with confirmed Stingray purchases. That count relied only on documents obtained through public records requests, so it likely undercounts the actual number significantly. The Baltimore Police Department alone used a Stingray over 4,300 times in a seven-year period, largely without obtaining warrants. The legal status of IMSI catcher use sits in unsettled territory even after Carpenter. That decision addressed historical location data held by a carrier. IMSI catchers operate in real time and capture data before it ever reaches a carrier’s servers. Some law enforcement agencies have argued that this places them outside the warrant requirement. Courts have reached inconsistent conclusions. The Electronic Frontier Foundation maintains a running tracker of known law enforcement IMSI catcher use and relevant case law at eff.org/pages/cell-site-simulators-imsi-catchers. Private-sector IMSI catcher use — corporate intelligence, stalking, fraud — is illegal in most jurisdictions but technically feasible with equipment that can be purchased on the secondary market. What the carrier app on your phone is doing</h2> Alongside the network-level data collection, the apps carriers publish for account management conduct their own surveillance. In 2022, privacy researcher Zach Edwards published analysis showing that several major US carrier apps were running third-party analytics SDKs from advertising companies. These SDKs transmitted device identifiers, behavioural signals, and in some cases location data to advertising networks that had no obvious relationship to managing a phone account. The My AT&T and T-Mobile apps were among those flagged. The permissions these apps request frequently exceed what account management requires. My AT&T has at various points requested microphone access. Verizon’s app has requested camera access. Contacts access appears in multiple carrier apps. It’s useful for a “find contacts on our network” feature. But that feature does not require the app to retain your contact list on an ongoing basis. Users have meaningful recourse here. On both iOS and Android, you can open Settings → Privacy (or Privacy & Security on iOS) and review which permissions each carrier app holds. Microphone, camera, and contacts access can be revoked without breaking the app’s ability to pay your bill, check your data usage, or manage your plan. Location access can be set to “only while using” rather than “always” if you want store-finder functionality without continuous background tracking. The position in Europe</h2> EU residents benefit from a regulatory framework that, at least in principle, treats carrier data as sensitive by default. The ePrivacy Directive (Directive 2002/58/EC) predates GDPR and specifically addresses the processing of communications data, including location data derived from network activity. Under the Directive, processing traffic and location data for purposes beyond delivering the communication requires explicit consent. Commercial sharing of location data without consent is not permitted. In practice, enforcement has been uneven. The German Federal Network Agency (Bundesnetzagentur) and French regulator ARCEP have both issued guidance restricting commercial location data sharing. But the major carriers have faced fewer headline fines in Europe for this practice than in the US. Part of this reflects the different structure of European telecom markets; part reflects the pace of regulatory investigations. In the UK, the ICO has issued guidance on telecommunications data under its post-Brexit data protection framework, which mirrors GDPR in most material respects. The ICO’s position is that location data from mobile networks constitutes personal data and that its commercial use requires a lawful basis. Subject Access Requests directed to UK carriers must be answered within one calendar month. For EU and UK subscribers, a Subject Access Request to your carrier is a practical starting point for understanding what they hold. Carriers are data controllers for this purpose and are obliged to provide a copy of personal data they process. The request costs nothing and must be fulfilled within 30 days under GDPR, one month under UK GDPR. What you can actually do about this</h2> The options are real, even if none of them are comprehensive. Opt out of CPNI sharing for marketing. US carriers are required by the FCC to allow customers to opt out of using CPNI for marketing purposes. This does not cover law enforcement requests or all commercial uses, but it’s a start. AT&T’s opt-out form is at att.com/ecpnioptout. Verizon’s is at verizonwireless.com/privacy/cpni. T-Mobile requires a call to customer service — they do not publish a direct URL for this, which is itself a friction choice. If you’re outside the US, check your carrier’s privacy centre for an equivalent mechanism; EU carriers are required to provide one under ePrivacy rules. Strip back carrier app permissions. On your phone, go to Settings → Privacy and remove microphone, camera, and contacts access from any carrier app. Keep location on “while using” if you use store-finder features; revoke it entirely if you don’t. Use end-to-end encrypted calls and messages for sensitive communications. Signal encrypts both call content and message content. WhatsApp encrypts content but retains more metadata. Either one makes carrier-level content interception irrelevant for those conversations, though carrier call and SMS metadata remains available when you use native dialling. Disable Wi-Fi calling if you want reduced location fingerprinting. Wi-Fi calling routes voice calls through your internet connection rather than the cellular network. That reduces the tower-triangulation data generated. It’s a marginal measure, but it removes one of the continuous location signals your phone emits. Review your account for unauthorised additions. SIM swapping is one of the more damaging attacks that exploits carrier data systems. A fraudster convinces a carrier to transfer your number to a new SIM they control. Checking your account periodically for lines, extra SIMs, or plan changes you didn’t make costs nothing and catches this early. File a Subject Access Request if you’re in the EU or UK. Formally asking your carrier what they hold about you does two things. It produces a concrete record you can review. And in aggregate, it creates administrative work for carriers that makes data maximalism less profitable. The fines the FCC levied in 2024 were the largest the agency had imposed for privacy violations. They were also, for AT&T, roughly 0.2% of the company’s 2023 annual revenue of $122.4 billion. Whether enforcement at that scale changes commercial incentives is an open question. The practices Joseph Cox documented in 2019 reflected a broader pattern. Someone could buy real-time location for $300 through a chain of commercial transactions. It was an industry where the financial rewards of location-data trading vastly exceeded the perceived regulatory risk. Whether the 2024 fines shifted that calculus will become apparent only when the next investigation is published. Want to see what data about you is already circulating online? Walk through an example exposure report →</a>. It’s an interactive example, not a live scan of your own data. KnytX Shield</a> isn’t live yet; join the waitlist</a> to run yours at launch. Security Questionnaire Automation: What & How Unknown — Sun, 12 Jul 2026 00:00:00 +0000 The email lands the same way every time. A prospect’s procurement team sends a spreadsheet: 80 to 200 rows, questions about your encryption standard, your incident-response plan, your subprocessor list, your last penetration test. The deal is now blocked until someone on your team fills it out. If you’re a 2-20 person B2B vendor, that someone is probably your CTO or your one security-adjacent employee. They just lost 8 to 15 hours they didn’t have. The short answer: security questionnaire automation is the set of tools and processes that reduce the time each questionnaire costs. It works on three levels: a reusable answer library, AI-assisted drafting, and a public trust center that deflects requests before they arrive. It does not replace your actual security posture, and it doesn’t remove your responsibility for a wrong answer. Build the library first, publish a trust page early, and add AI drafting last. This happens more than people expect it to. Whistic’s 2025 vendor survey found the average vendor answers 37.3 assessment requests a month. That figure blends companies of every size. A small vendor selling into 30-80 enterprise accounts a year sees something more like a few questionnaires annually, spiking to one or two a month during an active enterprise sales push. Either way, the arithmetic is brutal at small-team scale. Each questionnaire is a fixed multi-hour tax, the questions repeat across vendors almost word for word, and without a system, none of that work carries forward to the next one. “Security questionnaire automation” is the umbrella term for tools and processes that reduce that tax. It’s a real category with real vendors in it. But the term gets used loosely enough that it’s worth being precise about what it actually covers. What “automation” actually means here</h2> There are three distinct things people mean when they say “automate our security questionnaires,” and they solve different problems: 1. Answer reuse (the library). The single highest-leverage fix. Every questionnaire asks some version of the same 40-60 questions: encryption at rest, SSO support, breach history, data residency, subprocessor list. Put your answers to those questions in a structured, searchable library instead of scattered across old email threads and completed spreadsheets. Then you stop re-researching your own infrastructure every single time. This is the part that compounds. Your fifth questionnaire should take a fraction of the time your first one did, because you’re pulling from a library, not starting from a blank sheet. 2. Draft generation (the AI layer). Given a new questionnaire and an existing answer library, a model can match incoming questions to library entries and draft a first-pass answer. This is genuinely useful. It turns “find the right answer among 200 library entries” into “review and approve a suggested answer.” But it is not a replacement for human review. A wrong answer on a security questionnaire is a contract-risk problem, not a UX inconvenience. Anyone selling you an “auto-submit” flow is selling you liability. The vendors doing this responsibly draft with citations back to source documents and a confidence score, and route low-confidence answers to a human instead of guessing. 3. Volume reduction (the trust center). The most underrated lever, because it doesn’t feel like “automation.” It’s a public page. A trust center is a standing page, hosted at something like trust.yourcompany.com</code>, that publishes your security posture, certifications, subprocessor list, and the answers to the questions procurement asks most often, before they ask. Vanta reports that its Trust Center product deflects roughly 87% of buyer questions before they become a formal questionnaire at all. One company reported a 40% drop in inbound questionnaires the week after publishing a trust center. Those are third-party, attributed figures, not universal guarantees. But the mechanism is intuitive. Procurement teams check your public page before they open a spreadsheet, and a lot of them stop there. What automation does not fix</h2> Be skeptical of any pitch that promises to eliminate questionnaires entirely. A few things automation genuinely can’t do: It doesn’t replace SOC 2, ISO 27001, or your actual security posture. A trust center and an answer library present your posture faster; they don’t create a posture you don’t have. If a buyer’s questionnaire specifically requires an attestation you don’t hold, no amount of drafting speed gets you past that gate.</li> It doesn’t stop questionnaires from arriving. Even the best trust center deflects most, not all, buyer-generated volume — some enterprise procurement teams have a mandatory internal questionnaire regardless of what you publish.</li> It doesn’t reduce your liability for a wrong answer. If anything, a faster drafting pipeline raises the stakes on review discipline. It’s easier to approve something you didn’t fully read when the draft already looks polished.</li> SOC 2 doesn’t eliminate questionnaire volume either, which surprises people. Vanta and Drata automate the evidence collection that produces your SOC 2 report. They don’t automate the questionnaire response itself. A completed SOC 2 report often triggers more detailed follow-up questions rather than fewer.</li> </ul> Building the system: a realistic sequence</h2> If you’re starting from zero — no library, no trust center, just a folder of old questionnaire responses — here’s the order that actually works, based on how the underlying problem compounds. 1. Extract your existing answers into a structured library first. Before you touch a drafting tool, pull the real answers out of your last 3-5 completed questionnaires. You already wrote these; the problem is they’re locked inside individual spreadsheets instead of being reusable. This step alone, done by hand in an afternoon, cuts real time off your next questionnaire. 2. Publish a public trust page before you build a private drafting pipeline. This is counter-intuitive, because the drafting tool feels like the “real” automation. But the trust page is the volume-reduction lever, and it compounds immediately. Every day it’s live, it’s quietly absorbing questions that would otherwise become a full questionnaire. A minimal trust page (security posture, certifications you actually hold, subprocessor list, a handful of FAQ answers) is worth shipping even before your answer library is complete. 3. Add AI-assisted drafting once the library has real depth. Draft-generation tools are only as good as what they retrieve from. Turning on AI drafting against a 10-entry library produces mediocre drafts and erodes trust in the tool. Turning it on against a 100+ entry library, built from several real completed questionnaires, produces drafts your team can approve in minutes instead of writing from scratch. 4. Keep human review as a hard gate, not a formality. Every credible vendor in this category treats “a human reviewed and approved this specific answer” as non-negotiable, and every credible internal process should too. Low-confidence AI drafts should route to “needs a human answer,” not a best-guess autofill. This isn’t caution for its own sake. An inaccurate answer on a security questionnaire is something your buyer can hold you to contractually. 5. Track staleness. Answers decay. A subprocessor list from eight months ago, an encryption standard you upgraded, a certification that’s now expired: a library without a review-date system quietly starts lying to you. Build or buy staleness tracking from the start, rather than discovering a stale answer mid-deal. Who this is actually for</h2> This whole problem is sharpest for a specific company size: roughly 2-20 person B2B vendors selling into enterprise accounts, past their first few deals but before they have a dedicated security or compliance hire. Below that size, questionnaires are rare enough that a shared doc is fine. Above it, most companies have either hired for the role or already adopted a compliance platform with these features built in. If that’s your team, the honest framing is simple. Build the library first, since it’s mostly your own labor, not a tool purchase. Publish the trust page early, because it starts paying off immediately. Treat drafting tools as an accelerant on a foundation you already have, not a replacement for building one. If you’d rather run all three layers from one place, that’s the job KnytX for Business</a> is built to do for a small team once it’s live: an AI-assisted answer library plus a public trust center, with human review kept as a hard gate. For how a standalone trust layer compares to the big compliance bundles, see KnytX Trust vs Vanta & Drata</a>. KnytX Trust isn’t live yet — join the waitlist</a> to get in at launch. Frequently asked questions</h2> What does security questionnaire automation actually automate? It automates three things: reusing past answers from a searchable library, drafting first-pass answers with AI, and deflecting repeat questions with a public trust center. It doesn’t automate the final human review, and it can’t create a security posture you don’t have. How long does a security questionnaire take without automation? For a 2-20 person vendor, roughly 8 to 15 hours each, usually falling on the CTO or one security-adjacent employee. A reusable answer library is what drives that number down on later questionnaires. Should I buy AI drafting first? No. Build the answer library first and publish a trust page early. AI drafting is only as good as the library it retrieves from, so add it once you have real depth. Related reading</h2> AI security questionnaires: what the drafting tools actually do</a> — a closer look at the drafting layer specifically, including where AI-generated answers go wrong.</li> What trust center software actually does</a> — the volume-reduction layer in more depth.</li> CAIQ automation, explained</a> — the standardized questionnaire this approach handles well.</li> SIG questionnaires, explained</a> — the other major standardized format, and where it differs from CAIQ.</li> </ul> SIG Questionnaire: Core vs. Lite, and Reuse Unknown — Sun, 12 Jul 2026 00:00:00 +0000 If your team has ever groaned at a questionnaire named “SIG” rather than a generic “security review,” you’ve met the Standardized Information Gathering questionnaire. Shared Assessments publishes and maintains it. It’s widely used by financial services, healthcare, and other buyers with formal third-party-risk programs. It’s one of the two standardized questionnaire formats worth knowing by name; the other is the CAIQ</a>. Vendors tend to remember the SIG most, because it’s often the longest. The short answer: the SIG questionnaire comes in two sizes. SIG Lite is a few-hundred-question summary screen; SIG Core runs well over a thousand questions across every control domain. The buyer picks the version based on how they tier the risk of the relationship. To stop dreading them, build one reusable answer set organized by Shared Assessments’ domain structure, and reuse it on every future SIG. SIG Core vs. SIG Lite</h2> The SIG comes in two working sizes. Knowing which one you’re looking at changes how you should plan for it. SIG Lite is the shorter version. It’s a few hundred questions covering the major control domains at a summary level. It’s typically used for lower-risk vendor relationships, or as a first-pass screen before a deeper review. If you’re a smaller company being evaluated for a limited-scope engagement, SIG Lite is what you’re more likely to see. SIG Core is the full version. It often runs well over a thousand questions across every control domain Shared Assessments tracks: risk management, access control, application security, cloud hosting, physical security, incident management, business continuity, privacy, and more. This is the version that produces the “why is this taking two weeks” reaction from a first-time recipient. It genuinely is that large, and a large share of the questions require specific, defensible detail rather than a checkbox. The buyer chooses which version to send based on their own risk tiering of the relationship. A bigger contract, more sensitive data access, or a more regulated industry on the buyer’s side tends to trigger SIG Core rather than SIG Lite. You generally can’t request the shorter version. It’s determined by how the buyer’s risk program classifies the engagement. Why the SIG feels harder than a bespoke questionnaire</h2> Counterintuitively, a fully custom questionnaire from a single buyer can sometimes be faster to answer than a SIG. The reason is the SIG’s breadth. It reaches into control domains a smaller vendor may not have formal documentation for at all: physical security controls for an office you don’t have a formal policy on, business continuity planning beyond “we use a cloud provider with redundancy,” or vendor management processes for your own sub-vendors. A bespoke questionnaire from one buyer tends to ask about what that buyer specifically cares about. The SIG asks about everything Shared Assessments’ full control taxonomy covers, whether or not it’s relevant to your actual risk profile. The practical implication is cost. Your first SIG Core response is disproportionately expensive relative to any single questionnaire you’ve answered before, because you’re likely writing first-draft policy language for domains you’ve never had to formalize. That cost mostly doesn’t repeat. The second SIG Core you receive draws on the same underlying library. Still, budget real time for the first one specifically. Building a reusable SIG answer set</h2> The general answer-library approach from our security questionnaire automation guide</a> applies directly, with two SIG-specific adjustments: 1. Organize your library by Shared Assessments’ domain structure, not by “questionnaire from Buyer X.” The SIG’s control domains are standardized and stable across versions. So a library built around that structure transfers to every future SIG you receive. It also gives you a natural checklist for domains you haven’t documented yet. 2. Treat the first SIG Core as a policy-writing project, not a questionnaire-answering one. You may not yet have a written business-continuity plan, a formal vendor-management process, or documented physical-security controls. Your first SIG Core is the forcing function that makes you write them, not just answer around them. That’s real work. But it’s work you’ll draw on for every future questionnaire, SIG or otherwise, so do it properly rather than improvising placeholder answers under deadline pressure. 3. Expect SIG Lite requests to reuse most of the same library. SIG Lite is a subset of the same underlying control taxonomy. A well-built SIG Core answer set makes SIG Lite requests genuinely fast, often closer to an hour of review than a multi-day project. You’re selecting and lightly editing from material you already have. 4. Watch for version drift. Shared Assessments updates the SIG periodically, and question wording or scope can shift between versions. A library entry that answered “SIG 2023” precisely may need a light edit to match a newer version, even if your underlying practice hasn’t changed. Don’t assume an exact-text match years apart. SIG and your trust center</h2> Unlike the CAIQ, there’s no equivalent of the CSA STAR Registry for publicly registering a completed SIG response. Shared Assessments doesn’t run an open public registry the way CSA does. That makes a general trust center</a> more valuable for SIG-heavy buyers specifically. You can’t point them at a public standardized-response database the way you can with CAIQ. So a strong public trust page (subprocessor list, certifications, policy summaries) is what deflects some SIG requests before they’re formally sent, and speeds up the ones that still arrive. If building and maintaining that answer library and trust page yourself sounds like the real work, that’s the job KnytX for Business</a> is built to run for a small team once it’s live. It pairs an AI-assisted answer library with a public trust center. For how a standalone trust layer stacks up against the big compliance bundles, see KnytX Trust vs Vanta & Drata</a>. KnytX Trust isn’t live yet — join the waitlist</a> to get in at launch. Frequently asked questions</h2> What is the difference between SIG Core and SIG Lite? SIG Lite is a few-hundred-question summary screen for lower-risk vendors. SIG Core runs well over a thousand questions across every control domain. The buyer chooses which to send based on how they tier the risk of the relationship. Can you request SIG Lite instead of SIG Core? Usually not. The buyer’s risk program decides which version applies, based on contract size, data sensitivity, and industry. You generally answer whichever version they send. Is there a public registry for the SIG like the CAIQ has? No. Shared Assessments doesn’t run an open public registry the way CSA does for the CAIQ. A strong public trust page is the closest equivalent for deflecting SIG requests. Related reading</h2> Security questionnaire automation: what it is and how to do it</a> — the general system this post specializes for the SIG.</li> CAIQ automation, explained</a> — the other standardized format, and its public-registry shortcut.</li> What trust center software actually does</a> — the layer that reduces SIG volume specifically, since there’s no public SIG registry to lean on.</li> </ul> Trust Center Software: What It Is & Why It Matters Unknown — Sun, 12 Jul 2026 00:00:00 +0000 Before a procurement team sends you a 150-row spreadsheet, a growing number of them do one thing first. They Google “[your company] trust center” or look for a “Security” link in your footer. If they find a page with your certifications, your subprocessor list, and answers to the questions they were about to ask, some meaningful share of them stop there. If they don’t find anything, the spreadsheet is now the default path. The short answer: trust center software is a public, always-on page that publishes your security posture, certifications, and subprocessor list before a buyer asks. It deflects a large share of security questionnaires because most buyer questions are repetitive, and a public answer satisfies them. You don’t need SOC 2 to publish one. A minimal, honest version is worth shipping early. That page is a trust center. Some vendors call it a trust page, a security profile, or a trust portal. It’s become the standard category name across the market’s largest vendors, since Vanta, SafeBase, Secureframe, and Atlassian all use “Trust Center.” It’s worth understanding on its own, separate from the AI-drafting tools that often get bundled with it. What a trust center actually is</h2> A trust center is a public, always-on page — typically hosted at something like trust.yourcompany.com</code> — that presents your security and compliance posture without requiring a buyer to ask. At minimum, a useful one includes: Certifications and attestations you actually hold — SOC 2, ISO 27001, whatever’s real. Not a roadmap item presented as current.</li> A subprocessor list — every third party that touches customer data, kept current. This is one of the most commonly requested items in any questionnaire. Publishing it removes an entire back-and-forth.</li> Security posture summary — encryption approach, data residency, incident-response basics, in plain language a non-technical procurement reviewer can parse.</li> A pre-approved FAQ — the 15-30 questions that show up in nearly every questionnaire you’ve ever received, answered once, publicly, instead of once per deal.</li> A document room for anything sensitive — pen test summaries, DPAs, full policy documents. Gate these behind an NDA or a verified-buyer login rather than making them fully public, since not everything belongs on an open page.</li> </ul> The distinction that matters is durability. A trust center is a standing artifact, not a one-time deliverable. It sits there working between deals. A questionnaire response is single-use. It disappears into one buyer’s procurement file the moment you submit it. Why it works: the deflection mechanism</h2> A trust center reduces questionnaire volume for a simple reason. Most buyer questions are genuinely repetitive, and a public answer satisfies a large share of them before a formal process starts. Vanta, one of the category’s largest vendors, reports that its Trust Center product deflects roughly 87% of buyer questions before they escalate to a full questionnaire. Separately, at least one company has reported a 40% drop in inbound questionnaire volume in the weeks after publishing a trust center. Both figures are third-party or self-reported by specific companies. Treat them as directional evidence the mechanism works, not a guarantee of your own results. Deflection rate depends heavily on how complete your page is and how sophisticated your buyers are. The buyers most likely to be satisfied by a trust page alone are ones running lightweight vendor-risk review, like a startup or mid-market company doing a quick check before signing. The buyers still likely to send a full questionnaire are large enterprises and regulated industries with a mandatory internal vendor-risk process. A trust page speeds up their review, since their analyst can pull answers instead of waiting on you, but it usually doesn’t eliminate the formal questionnaire entirely. What the category costs today</h2> Trust center software is bundled into pricing in different ways depending on the vendor, and the range is wide: Vanta: the base Essentials plan (roughly $7.5K-$12K/year) does not include the Trust Center — it’s a separate add-on around $6K/year on top, or bundled into the Plus tier ($20K-$45K/year), which also includes AI questionnaire responses.</li> Drata: the Foundation plan (roughly $7.5K-$15K/year) includes a Trust Center at the Standard tier plus a limited number of AI-assisted responses.</li> SafeBase: acquired by Drata for a reported $250M in February 2025, after operating as a standalone trust-center specialist; standalone pricing before the acquisition ran roughly $7K-$15K/year.</li> Dedicated questionnaire tools that bundle a trust page (Conveyor, 1up, and similar) price differently again — see our Conveyor</a> and 1up</a> comparison pages for specifics.</li> </ul> The pattern worth noticing is this. At most of the market’s largest vendors, the trust center isn’t sold on its own. It’s an add-on or a tier gate inside a much larger compliance-automation platform whose core product is SOC 2 evidence collection, not the trust page itself. That’s a reasonable business model if you’re already buying the compliance platform for other reasons. It’s a bad deal if the trust page and questionnaire handling are the only things you actually need. KnytX for Business</a> is built for that second case: a standalone AI-assisted trust center and answer library for a small team, not a platform bundle. It isn’t live yet — join the waitlist</a> to get in at launch. You don’t need SOC 2 to publish one</h2> This is the part that surprises smaller vendors. A trust center doesn’t require a completed SOC 2 report to be worth publishing. A pre-SOC 2 company can and should publish a minimal, honest version: your actual current security practices, a note that SOC 2 is planned with a realistic date, your subprocessor list, and your DPA. Buyers doing early-stage diligence on a small vendor often look for evidence of a documented, thought-through posture more than a specific certification. “We don’t have SOC 2 yet, here’s what we do have and here’s our timeline” is a legitimate, common answer. A trust page communicates it far better than silence. What matters is that everything on the page is genuinely true today, not aspirational. A trust page that overstates your posture is worse than no trust page. A sophisticated buyer’s security team will catch the overstatement and flag it as a red mark against your credibility for the rest of the deal. Building a minimal one</h2> If you’re starting from nothing, the fastest real path to a useful trust center looks like this: Inventory what’s actually true. List your real certifications (even “none yet, SOC 2 targeted for Q[x]”), your actual subprocessors, your real encryption and data-residency setup.</li> Answer the 20 questions that show up every time. Pull your last 3-5 completed questionnaires and find the questions that repeat almost verbatim. Write clean, current answers to those first. They’re your highest-leverage content.</li> Publish the subprocessor list and DPA. These two documents alone answer a large fraction of standard vendor-risk questions. They’re usually the fastest to assemble, since they’re mostly already documented internally.</li> Gate anything sensitive, don’t omit it. A pen test summary or detailed architecture doc can live behind an NDA-gated request instead of being fully public or entirely missing. Most buyers accept a request-and-review flow for genuinely sensitive material.</li> Keep it current. A stale trust page (an old subprocessor, an expired certification still listed as active) actively damages trust once a buyer notices, more than having no page at all. Whatever system you use needs a review-date mechanism, not a one-time publish.</li> </ol> Frequently asked questions</h2> Do I need SOC 2 to publish a trust center? No. A pre-SOC 2 company can publish a minimal, honest version: current security practices, subprocessor list, DPA, and a note that SOC 2 is planned with a realistic date. What matters is that everything on the page is true today, not aspirational. How much does a trust center reduce security questionnaires? Vanta reports its Trust Center deflects roughly 87% of buyer questions before they become a formal questionnaire, and one company reported a 40% drop after publishing. Both are third-party figures, so treat them as directional, not a guarantee. What does trust center software cost? At the biggest platforms it’s an add-on or tier gate inside a larger compliance suite, often $6K to $45K a year all in. Standalone trust-page tools price differently. A minimal version you build yourself costs mostly your own time. Related reading</h2> Security questionnaire automation: what it is and how to do it</a> — the trust center is one piece of the full picture.</li> AI security questionnaires: what the drafting tools actually do</a> — the layer that handles what a trust page doesn’t deflect.</li> KnytX Trust vs Vanta & Drata</a> — how a standalone trust page compares to the Trust Center bundles bigger compliance platforms sell today.</li> </ul> Protecting Elderly Relatives From AI Voice Scams Unknown — Sat, 11 Jul 2026 00:00:00 +0000 In February 2024, a 76-year-old woman in Ontario, Canada, wired $21,000 CAD to a stranger. She believed he was a lawyer helping her grandson out of a drunk-driving arrest. The first call had come from her grandson, or something indistinguishable from him. Researchers at the University of Waterloo later reviewed the case. They estimated the voice clone could have been generated from as little as three seconds of publicly available audio, sourced from one of the young man’s social media videos. She had not been careless. She had asked the “lawyer” for a callback number. She had spoken to her husband. She had tried to slow the process down. None of it helped. The scam had begun with a voice she loved, one that arrived in distress. That emotional lock-in happened before any of her other defences had a chance to engage. This is not an edge case. It is the current standard for elder fraud. The short answer. AI voice cloning can copy a loved one’s voice from as little as three seconds of public audio, so a “grandparent in trouble” call can sound completely real. The single most effective defense is a family code word: a private word every family member knows and a scammer cannot guess. If an emergency caller can’t say it, hang up and call the person back on a number you already have. Back that up by silencing unknown callers, asking the bank for a verbal passphrase on large transfers, tightening social media privacy, and talking through the scam before it happens. The FBI logged $3.4 billion in elder fraud losses in 2023. Why older adults are disproportionately targeted</h2> The FBI’s Internet Crime Complaint Center (IC3) recorded $3.4 billion in elder fraud losses in 2023. That was close to half of all reported cybercrime losses across every demographic that year. The imbalance is not accidental. Three structural factors make older adults more valuable targets. First, accumulated assets. Retirees hold more liquid savings on average than younger adults. There is simply more money available, and in accounts that can often be accessed without multi-factor authentication that younger users have grown accustomed to setting up. Second, social isolation. Many older adults live alone or have smaller daily support networks. When a panicked call arrives claiming a grandchild is in jail, there is often no one within arm’s reach to turn to for a second opinion. The scam fills that vacuum with a helpful “lawyer” or “police officer” who sounds authoritative and calm. Third, and this is the factor the industry talks about least, cognitive processing speed. The speed and confusion tactics used in these calls are not random. They are calibrated. A 2019 FINRA Investor Education Foundation study found that financial decision-making ability peaks around age 53 and declines measurably after that. Not catastrophically, but specifically in ways that affect resistance to high-pressure social manipulation. Older adults are not less intelligent. They are, however, more vulnerable to the time pressure and emotional flooding that scammers deliberately manufacture. The targeting is also increasingly data-driven. Scam operations buy consumer data lists that include estimated net worth, age brackets, and geographic concentration of older demographics. Your elderly relative may already be on a contact list. How AI voice cloning changed the equation</h2> The grandparent scam — a caller impersonating a grandchild in distress — has existed since at least the early 2000s. For most of that period, it relied on the target’s imagination doing the heavy lifting. Callers would say “it’s me, grandma” and count on panicked relatives filling in the rest. That changed between 2022 and 2024. AI voice cloning moved from a research curiosity to a commercially available, consumer-grade tool — and in many cases a free one. Services including ElevenLabs, Murf, and a range of smaller competitors can generate a convincing voice clone from a 30-second audio sample. That sample does not require any access to the target’s devices or private communications. It requires a Facebook video, a TikTok clip, an Instagram Reel, a YouTube appearance. Most families have made exactly this material public without thinking about it. In 2023, the FTC reported complaints explicitly identifying AI-generated voices in grandparent scam calls. It was the first time the agency had named the technology in fraud reports. A GlobalNews (Canada) investigation the same year demonstrated the attack chain directly. A journalist’s voice was cloned from a publicly available podcast episode and used to try to trigger a distress response from a family member. The experiment succeeded. The journalist had not consented to the podcast being used that way, but nothing prevented it. For how the cloning itself works, see the guide to AI voice-cloning scams</a>. Three seconds of audio. Sometimes thirty. That is the current threshold. The anatomy of a well-executed grandparent scam</h2> Understanding exactly how these calls are structured is protective in itself — it removes the element of surprise, which is what the scam depends on. The scammer begins by identifying a grandchild through social media. This is usually straightforward: an elderly person’s Facebook friends list is often visible publicly, and tagging and family connections make the grandchildren easy to find. Once the grandchild is identified, their voice is extracted from any publicly available video — a birthday message, a graduation clip, a holiday post. The call opens with maximum emotional impact. Not “hello” — the caller leads with the grandparent’s name, then the grandchild’s name, then distress: “Grandma? It’s Jake. I’m in trouble.” Those six words are doing enormous work. The grandparent’s nervous system is already responding before any rational evaluation can begin. A second caller then comes on the line. This person plays the lawyer, the police officer, or the bail bondsman. They are calm, professional, and provide specific-sounding details about bail amounts, court dates, and procedures. The specificity is a manipulation technique — detail signals authenticity. Then comes the instruction that isolates the target: “Please don’t call your son or your daughter. Jake is embarrassed. He doesn’t want them to know.” This severs the most obvious safeguard — the family members most likely to recognise that something is wrong — at precisely the moment they are most needed. Payment is requested in cash, wire transfer, or gift cards. Gift cards are preferred by scammers because they are immediate and essentially unrecoverable. Time pressure is applied throughout: an hour window, a magistrate who will only hold the case until a specific time, a window that closes before other family members come home and ask questions. The whole sequence can run in under twenty minutes. The family safety code word</h2> The most effective defence against this scam is not technological. It costs nothing and takes about five minutes to set up. Establish a family code word. Choose a word or short phrase that every immediate family member knows and that a scammer would have no means of guessing. If someone calls claiming to be a family member in an emergency, ask for the code word. If they don’t produce it, hang up immediately — then call the person directly on a number you already have. The word should meet three criteria. It needs to be genuinely obscure — not a pet name the family uses openly on social media, not a childhood nickname that appears in anniversary posts. It should be short enough that no one forgets it under stress. And it should be something that would not come up naturally in any other conversation, so there is no chance of it being accidentally mentioned to someone outside the family. The FTC and AARP both name the family code word as the single most effective countermeasure against voice-clone grandparent scams. Its power lies in the fact that it short-circuits the emotional flooding before it can take hold. The target does not need to evaluate whether the voice sounds right, whether the story makes sense, or whether the lawyer is legitimate. They ask one question. If the answer fails, the call ends. The code word should be established in a calm moment — at a family dinner, in a WhatsApp group message, during a regular phone call. Not in the aftermath of a near-miss, when people are still shaken. Practical protective steps you can take this week</h2> Set up the safety word. Cover everyone in the immediate family. Write it down somewhere private if needed — a physical note in a wallet or a pinned secure note in a password manager. Make sure every family member who might receive an emergency call knows it. Configure silence for unknown callers. On iPhone: Settings → Phone → Silence Unknown Callers. On Android: open the Phone app, go to Settings, then Block numbers, then toggle Unknown callers. Legitimate emergencies leave voicemails. Scammers operating at scale almost never do. Speak to the bank directly. Contact your elderly relative’s bank branch — not through any number a caller provides, and not through a link — and ask whether they offer a verbal passphrase for high-value transactions. Many banks will place a secondary verbal check on wire transfers above a set threshold, though it takes a proactive request to set it up. Several UK high street banks now offer dedicated elder financial protection services; Lloyds and Barclays have both run specific programmes along these lines. Talk about the scam before it happens. The most underused protection is simple familiarity. An older adult who knows that this scam exists, who has heard how it works and what it sounds like, is substantially less likely to be caught by it. AARP’s Fraud Watch Network — at aarp.org/money/scams-fraud/ — maintains a live scam tracker and runs a helpline at 877-908-3360. The helpline is free and staffed by people who specialise in exactly these situations. Review social media privacy settings for the whole family. The voice samples that make these scams work come from somewhere. Grandchildren’s TikTok, Instagram, and Facebook videos are the most common sources. Set these accounts to private where possible. Disable video download options. Consider whether public holiday posts, birthday videos, or graduation clips — the ones that get tagged and shared broadly — need to stay publicly visible, or whether they can live in a friends-only or family-only setting. For families managing finances together: Ask the bank about transaction monitoring alerts and mandatory delay periods on wire transfers. Power of attorney arrangements and joint accounts can be configured with specific elder financial protection flags at many institutions, requiring a second verification step before large transfers proceed. If a scam has already happened</h2> First: report it quickly. For wire transfers, speed is everything. Banks can sometimes recall a transfer within 24 to 72 hours if the fraud is reported immediately. Call the bank’s fraud team — not the general customer service line — and use the word “fraud” explicitly. Gift card payments are generally not recoverable once the codes have been shared, but reporting them still matters for the fraud record. In the United States, report to the FTC at reportfraud.ftc.gov and to the FBI’s IC3 at ic3.gov. In the United Kingdom, contact Action Fraud at actionfraud.police.uk. In Canada, the Canadian Anti-Fraud Centre takes reports at antifraudcentre-centreantifraude.ca and maintains a database of active scam operations. AARP’s Fraud Network has advisors who specialise in elder fraud recovery and can help navigate the reporting process. IC3 data from 2023 shows that elder fraud reporting rates remain low. Many victims do not report, partly out of embarrassment and partly because they don’t believe anything can be done. Both assumptions are wrong. Reporting creates investigative patterns that lead to prosecutions, and in a meaningful number of cases, funds are at least partially recovered. There is no reasonable basis for shame here. These operations are designed and run by professionals whose specific expertise is overcoming normal human caution. They study resistance and build scripts to defeat it. Being targeted is not a sign of diminished capacity. It is a sign of having been identified as a person with assets and a family, which describes most people who are loved. The monitoring layer</h2> There is a more proactive layer most families have not yet considered. Scam operations often build their call lists from data broker records and compromised contact databases. That means an elderly relative’s phone number may appear in fraud-linked datasets before any call is made. Privacy monitoring that tracks scam-associated contact databases can flag when a family member’s number shows up. That turns a post-incident report into advance warning. The principle is straightforward. Knowing a relative is likely on a scammer’s contact list lets you brief them, revisit the code word, and raise their alertness before the call comes. Reducing the underlying exposure is the other half. The fewer data broker sites that list a relative’s name, phone, and address, the less raw material scammers have to build a targeted call. Curious what data brokers already expose about your family? See what a scan finds →</a> walks through an example exposure report. KnytX Shield isn’t live yet; once it launches, its Family tier is built to watch for a household’s details in these databases and remove the broker listings automatically. Join the waitlist</a> to get in early. How to Read a Privacy Policy: Clauses That Matter Unknown — Fri, 10 Jul 2026 00:00:00 +0000 In 2008, researchers Lorrie Faith Cranor and Aleecia McDonald at Carnegie Mellon University asked a simple question. How long would it take an average American internet user to read every privacy policy they met in a year? Their figure: 76 work days. Not calendar days, but working days, eight hours each. And that was at 2008 levels of online activity. The researchers were not suggesting people should read faster. Their conclusion was structural: privacy policies are written to create the legal appearance of informed consent while making it practically impossible to achieve in real life. The paper, “The Cost of Reading Privacy Policies,” has not aged badly. The services have multiplied. The policies have not shortened. The clauses that produce the most consequential outcomes stay buried under thousands of words of boilerplate. Those are the clauses on who gets your data, how long it is kept, and whether it can be sold. Understanding what those clauses look like, and where to find them, makes the problem workable. It does not take anything close to 76 days of reading. The short answer: You do not need to read a whole privacy policy. Find five clauses instead: third-party sharing, retention periods, the consent mechanism, the update-notification method, and data sale. Vague phrasing (like “trusted partners” or “as long as necessary”) is usually where the real license hides. A browser Ctrl+F search finds all five in a few minutes. The rest of this guide shows what each clause means when you find it. What does “we may share your data with trusted partners” mean?</h2> This is the most consequential sentence in most privacy policies. It appears in some variant in nearly all of them. Every word is doing work. “May” is the critical modifier. It makes the practice conditional — the company is reserving the right to share data without committing to doing so. There is no obligation to share; there is also no obligation not to. The sentence is a permission grant to the company, not a description of current practice. “Trusted partners” is defined nowhere in the policy. In practice, it means any entity the company has a contractual relationship with. That covers advertising networks, analytics platforms, market research firms, and affiliate marketing companies. For large conglomerates, it also covers business units of the same parent company operating under different brand names. Under GDPR, Article 13(1)(e) requires companies to disclose “the recipients or categories of recipients of the personal data.” This is a real obligation. EU-regulated companies must name specific third parties or specify categories. Examples: “advertising networks,” “analytics providers,” “social media platforms.” They must do so clearly enough that you can form a meaningful picture of where your data goes. Under most US law, there is no equivalent requirement for companies outside specific regulated sectors such as healthcare (HIPAA) or financial services (GLBA). A US company’s privacy policy is legally permitted to say “trusted partners” and mean exactly what that phrase says: anyone they have a business relationship with. The practical test: pull up the US and EU versions of the same company’s privacy policy side by side. Meta, Google, Microsoft, and LinkedIn all publish region-specific policies. The EU version names categories of recipients. The US version frequently does not. That gap reflects what companies disclose when legally required to versus what they disclose voluntarily. The EU version, even if you are not in the EU, shows what they are obligated to tell someone. “Legitimate interests” — GDPR’s flexibility clause</h2> For anyone subject to GDPR, there is a second clause worth locating: the legal basis on which the company processes your personal data. GDPR Article 6(1) sets out six lawful bases for processing. Consent is the one most people have heard of. “Legitimate interests” under Article 6(1)(f) is the one most frequently used to avoid asking for consent. The statutory text allows processing without consent when it is “necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject.” In principle this requires a documented Legitimate Interests Assessment — a genuine balancing of the company’s interests against your rights and freedoms. The ICO’s guidance on lawful bases accepts that direct marketing can qualify as a legitimate interest, while noting that intrusive profiling for advertising purposes generally cannot without consent. In practice, “legitimate interests” appears as a catch-all. LinkedIn’s reliance on legitimate interests for targeted advertising was found by the Irish Data Protection Commission to be unlawful in a 2022 decision. The Irish DPC reached an equivalent conclusion about Meta’s approach to targeted advertising on Facebook and Instagram in January 2023, imposing €390 million in fines across two decisions. Meta had argued it could rely on contractual necessity — that personalised advertising was necessary to provide the service users signed up for. The EDPB rejected that, and the DPC’s decisions confirmed that the legal basis for personalised advertising in the EU is consent, not contract or legitimate interests. Watch for a policy that says a company processes your data for “business purposes on the basis of legitimate interests” without specifying those purposes. It is reserving the right to do things it has not disclosed, under a legal basis it has not properly tested. Under GDPR you can object to legitimate-interests processing under Article 21(1). The burden then shifts to the company to demonstrate compelling grounds to override your objection. Retention periods — or the absence of them</h2> GDPR Article 5(1)(e) requires personal data to be kept “no longer than is necessary for the purposes for which the personal data are processed.” Most privacy policies technically satisfy this with a vague line. Something like: “We retain your personal data for as long as necessary to provide the service, or as required by applicable law.” No period is given. No differentiation between data types. No explanation of what “necessary” means in practice. The California Privacy Rights Act (CPRA), effective January 2023, goes further than GDPR in one specific respect. It requires businesses to disclose the retention period for each category of personal data they collect. US companies with Californian customers who comply with CPRA publish retention schedules. These tell you explicitly that purchase history is kept for seven years, location data for twelve months, browsing behaviour indefinitely. If that same company’s global policy says “as long as necessary,” the CPRA schedule shows what that means. Absence of a specific retention period is a signal. Data kept indefinitely can be breached, subpoenaed, sold in an acquisition, or used for purposes that did not exist when you created your account. Companies that delete data quickly tend to say so — it is a differentiator. Companies that keep it indefinitely say as little as possible. Consent that isn’t really consent</h2> Many privacy policies describe a consent mechanism in language that sounds more meaningful than the mechanism actually is. A policy might state: “You can control your marketing preferences by adjusting the settings in your account.” This sounds like genuine user control. Whether it is depends entirely on the default setting and the ease of changing it. GDPR Recital 32 is clear: “Silence, pre-ticked boxes or inactivity should not constitute consent.” Suppose the marketing preferences box defaults to ticked and most users never visit account settings. The policy has technically disclosed an opt-out, but the practical effect is consent through inaction. In January 2022, France’s CNIL fined Google €150 million and Meta €60 million over their cookie consent designs. Accepting was a single click, but declining required navigating nested preference panels. That asymmetry violated GDPR’s equal-ease requirement. The ICO’s 2023 enforcement notices to major UK websites made the same point under UK GDPR. When reading a privacy policy, find where it describes the consent mechanism. Then ask two questions. What is the default state? And how many steps does it take to change it? The unilateral update clause</h2> Almost every privacy policy contains a provision in the following form: “We reserve the right to update this policy at any time. We will notify you of material changes by posting the updated policy on our website. Your continued use of the service constitutes your acceptance of the revised terms.” This clause has been used to expand data-sharing practices after corporate acquisitions. The WhatsApp example is the most documented case. When Facebook acquired WhatsApp in 2014, WhatsApp’s privacy policy explicitly stated that user data would not be shared with Facebook. In August 2016, WhatsApp updated that policy. It began sharing certain user data, including phone numbers and usage patterns, with Facebook entities. The stated purposes included improving Facebook ads and products. Users who continued using WhatsApp had, under the policy’s own terms, accepted this expansion. The EU took action. The European Commission investigated under competition law rather than data protection law. It fined Facebook €110 million in 2017 for providing misleading information during the acquisition process. Specifically, Facebook had claimed that linking accounts between the two platforms was technically unfeasible. Under GDPR, which came into force in 2018, data protection regulators also scrutinised the data-sharing arrangement. For EU users of WhatsApp, regulators ultimately restricted the sharing for accounts that existed before the 2016 policy update. For users outside the EU, no equivalent restriction applied. The structural problem is this. The unilateral update clause, combined with a continued-use-equals-acceptance model, lets a company materially change how your data is processed without asking for fresh consent. Under GDPR, material changes to processing purposes or legal bases require communicating the change clearly and, where applicable, obtaining new consent. Under US law, the continued-use model is generally enforceable. When these update notices arrive — the modal that says “We’ve updated our privacy policy” — reading the summary of what changed is worth three minutes of your time. Which five clauses should you check in a privacy policy?</h2> Rather than reading a full policy, locate five specific sections. Most policies have a table of contents or anchor links; failing that, a browser Ctrl+F search takes under two minutes. Third-party sharing. Find the section on sharing or disclosure. Does it name specific categories of recipients, or does it use phrases like “trusted partners,” “service providers,” and “business partners” without definition? Under GDPR-compliant policies, you will see categories like “advertising networks,” “analytics providers,” and “cloud infrastructure providers.” Under policies not constrained by GDPR, you will often see only vague phrases. The vaguer the language, the broader the licence. Retention periods. Search for “retain” or “retention.” Watch for a sentence ending with “as long as necessary” or “as required by law.” With no specific time period, there is no defined deletion schedule. The CPRA requires Californian-facing businesses to publish specific periods. If the policy does not, check whether the company has a separate CPRA or “California Privacy” supplement. Many publish the specific schedule only there. Consent mechanism. Find where the policy describes how your consent is given and how you can withdraw it. Phrases like “by using the service, you consent” are broad and not specific to any particular processing purpose — these are structural consent waivers, not genuine consent mechanisms. Look for whether withdrawal is described as equally easy as giving consent, and what the default state of any preference is. Update notification. Find how the company says it will tell you about changes. “We will post notice on our website” means you will not be told directly. “We will notify you by email before material changes take effect” is meaningfully different. The notification method determines whether you have any realistic chance of knowing the terms have changed before you are bound by them. Data sale. Under CCPA and CPRA, companies subject to California law must explicitly disclose whether they sell or share personal information as those laws define it. They must also provide a “Do Not Sell or Share My Personal Information” link or mechanism. If a company’s policy covers the US and includes a CCPA section, that section tells you whether your data is sold. Outside that regulatory context, many companies process data in ways that function economically as a sale. They share it with advertising partners who pay for access, without ever using the word “sell.” Tools that do the reading for you</h2> For services you use regularly without wanting to review full policies, several resources do useful pre-processing work. Terms of Service; Didn’t Read (tosdr.org) has been rating and summarising privacy policies since 2012. Services receive a grade from A to E, with specific clauses flagged as consumer-friendly or hostile. The most widely used platforms — Google, Meta, Apple, Amazon, Spotify, Twitter/X, LinkedIn — are covered in detail. An E-rated service means the summary team found the terms particularly harmful to users. PrivacySpy.io runs a similar analysis with a searchable database, useful for comparing services in the same category across clause categories including data sale and third-party sharing. Both tools reflect policies as of their last review. For high-stakes decisions — a health app, a financial service, a workplace tool — they supplement but do not replace a direct check of the five clauses above. The most direct reality check is a Subject Access Request (SAR). Under GDPR Article 15, you are entitled to receive a copy of all personal data a company holds about you, along with information about processing purposes and recipients. Comparing the response to what the policy claims is collected frequently reveals discrepancies — data kept longer than stated, undisclosed data categories, or third-party recipients the policy omits. Under CCPA, Californian residents have an equivalent right. Both must be answered within 30 days (GDPR) or 45 days (CCPA), at no charge. Template letters and escalation steps are in the practical guide to exercising your GDPR rights</a>. Why this matters beyond the abstract</h2> Privacy policies are not the end point of data handling. They are the permission slip that determines what happens downstream. A company that reserved the right to share with undefined “trusted partners” can transfer your browsing history, purchase patterns, and location data to an advertising data broker. That broker aggregates it into a profile sold to insurers, employers, or political campaigns. None of this requires a breach. It is the policy working exactly as written. Gravy Analytics was sanctioned by the FTC in December 2024 for collecting and selling sensitive location data from mobile apps without adequate consumer consent. That included visits to healthcare facilities and places of worship. Many of the source apps disclosed sharing location data with “analytics partners.” Technically accurate. The end use — health-related movement profiles sold to any paying customer — was not disclosed in any form a user could have anticipated. The clauses described here are the ones that create the gap between what a policy technically says and what it actually enables. Finding them does not require reading 76 days’ worth of policies. It requires knowing where to look and what the phrasing means when you find it. See what a scan finds →</a> walks through an example report of the kinds of personal data brokers expose. KnytX Shield isn’t live yet; join the waitlist</a> to run your own scan at launch. Continuous Breach Monitoring: Why Yearly Checks Fail Unknown — Thu, 09 Jul 2026 00:00:00 +0000 On 8 November 2018, a security tool inside Marriott International generated an alert. The alert was real. The breach it had detected had been running since 2014. That year, Marriott acquired Starwood Hotels. The acquisition included Starwood’s entire guest reservation database. Buried inside it was a compromise that Starwood itself had apparently never detected. When Marriott’s security team finally traced the intrusion, they found that an attacker had kept persistent access to Starwood’s systems for four years. That access survived the ownership change, the data migrations, and the integrations. Approximately 383 million guest records were in scope: names, email addresses, phone numbers, passport numbers, Starwood Preferred Guest account details, and payment card information. The UK’s Information Commissioner’s Office fined Marriott £18.4 million in October 2020. That was reduced from an initial proposal of £99 million after Marriott showed co-operation and the economic disruption of the pandemic was taken into account. The fine could not undo four years of exposure. The Marriott case sits at an extreme end of the detection timeline. But it is not an outlier in kind, only in duration. TL;DR: Breaches take an average of 204 days just to detect (IBM), and some run for years. A once-a-year check with free public tools only catches breaches that are already public and widely circulated. It misses the 204-day window before disclosure, private-channel data that may never go public, and stealer logs entirely. Real continuous breach monitoring covers three channels near real-time: breach databases, paste sites, and dark-web markets. In this article: The detection problem, by the numbers</a></li> What happens to your data in that window</a></li> What a once-a-year check actually catches</a></li> Stealer logs and why they sit outside the breach framework</a></li> What continuous monitoring actually looks like</a></li> What to do now, in priority order</a></li> Frequently asked questions</a></li> </ul> The detection problem, by the numbers</h2> IBM’s Cost of a Data Breach Report, published annually in partnership with the Ponemon Institute, is the most widely cited source on breach timelines. The 2023 edition analysed 553 organisations across 16 countries and 17 industry sectors. Its finding on the mean time to identify a breach: 204 days. Mean time to contain it once identified: 73 days. Together, 277 days from initial intrusion to containment. Over nine months, across the industry average. Equifax is instructive here. Attackers exploited a known Apache Struts vulnerability on 12 May 2017. Equifax did not discover the breach until 29 July 2017 — 78 days later. The company did not disclose it publicly until 7 September 2017. By then, the personal data of 147 million Americans had been exfiltrated, including Social Security numbers, birth dates, addresses, and driver’s licence numbers. The US Federal Trade Commission ultimately secured a $700 million settlement, the largest data breach settlement in US history at the time of signing. But the 78 days of undetected access were the window that mattered. The 204-day figure is not driven by edge cases. It represents thousands of incidents averaged together, including many that were caught faster. Which means the incidents that pull the average upward — breaches that run for months or years, like Marriott — are considerably more common than they should be. For individuals caught in those breaches, the timeline carries a secondary implication. GDPR requires organisations to notify the relevant supervisory authority within 72 hours of becoming aware of a breach. Notification to affected individuals must follow “without undue delay.” US state notification laws typically give companies 30 to 90 days from discovery. These timelines start when the company discovers the breach — not when the breach began. If discovery happens at day 204, the 72-hour regulatory clock starts at day 204. You may not receive a notification letter until day 270 or later. Your data has been circulating for the better part of a year before anyone tells you. What happens to your data in that window</h2> Stolen data does not sit idle. It moves through a fairly consistent pipeline from the moment of theft. The first stage is high-value exploitation. Attackers who have just exfiltrated a large dataset typically mine it immediately for the most valuable records — complete credit card details with CVV, credentials to financial accounts, corporate logins. These are used directly for fraud or sold quickly to other criminals while they are fresh and potentially unknown to fraud prevention systems. Prices on dark web marketplaces reflect the value gradient. Email-and-password combination records sell for a few cents each. Full credit card records with billing address and CVV fetch $8 to $20 per card on established markets. A complete “fullz” package — name, Social Security number, date of birth, and card details — ranges from $15 to $40. These figures come from breach intelligence firms including Comparitech and Digital Shadows, which publish periodic pricing surveys of dark web markets. The second stage is bulk resale. Data that was not immediately exploited enters the market in bulk lots. A buyer might purchase 10 million records from a single breach to run credential stuffing campaigns. These are automated attempts to use email/password pairs from one breach to log in to unrelated services. This works because password reuse is endemic. SpyCloud’s 2023 breach exposure report found that 68% of users exposed in multiple breaches reused the same password across those incidents. The third stage is wide circulation. Eventually, breach data filters down to free repositories. Paste sites, Telegram channels, and “combo list” archives aggregate breach data and make it available without charge. At this stage, the original breach is often years old — but the data is still usable for anyone who wants to run automated attacks. The Adobe breach from October 2013, which exposed 153 million user records, serves as a benchmark for how long breach data persists in active use. Security researchers documented Adobe credentials appearing in credential stuffing attack logs as recently as 2021 — eight years after the breach. The data did not expire. Every account that was not remediated remained a valid attack surface. What does a once-a-year check actually catch?</h2> Most people become aware that their data has been compromised through one of four routes. The notification letter is the slowest. It arrives after the company has discovered the breach, completed an internal investigation, notified regulators, and then dispatched individual notifications. By that point, the breach is typically months old. Checking a public breach lookup tool — Have I Been Pwned being the most comprehensive free option — depends on the breach having been disclosed and indexed. HIBP ingests breach data when it becomes publicly available, either through voluntary disclosure or because a researcher or journalist has surfaced it. It does not index data that is circulating privately — on private dark web forums, in stealer log marketplaces, or in closed Telegram channels. Fresh breach data typically circulates for 12 to 24 months in closed channels before appearing anywhere public tools can reach. Finding unauthorised charges on a card is reactive by definition. The fraud has already occurred. The alert you receive is the bank telling you your money has moved, not a warning that your credentials were exposed. Account takeover is the worst outcome. You discover it when you can no longer log in, or when you receive an alert that your password was changed from a device you do not own. An annual check using public tools covers exactly the segment of breach data that is already widely known. It misses data in the 204-day window between breach and disclosure. It misses data circulating on non-public channels that may never be publicly disclosed. And it misses the stealer log ecosystem entirely. Stealer logs and why they sit outside the normal breach framework</h2> The breach model assumes a company’s server is compromised and a database is exfiltrated. Infostealer malware operates differently. Redline, Vidar, and Raccoon — the main commercial families — infect individual devices and extract browser-saved passwords, session cookies, and autofill data at the point the user’s own machine. The exfiltration happens from your device, not from a company’s infrastructure. The resulting “logs” are sold through dedicated marketplaces and Telegram channels. Genesis Market ran this model until the FBI’s Operation Cookie Monster seized it in April 2023. Russian Market, 2easy.shop, and multiple Telegram channels continue to operate on the same model. Logs are listed with previews: which sites the victim was authenticated to, whether active banking sessions were present, the date of exfiltration. A log with active corporate sessions sells for significantly more than a log containing only consumer accounts. The credentials in a stealer log are not credentials from 2014 — they are passwords the victim used last week. The session cookies are active authentication tokens that bypass password protection entirely. Public breach monitoring services, including HIBP, do not index stealer log data in the same way they index breach dumps, because the data structure is different. HIBP added stealer log coverage in 2023, flagging emails that appear in indexed logs, but the coverage is partial. Specialist services — SpyCloud, Hudson Rock’s Cavalier API — monitor stealer log marketplaces specifically. They represent a different monitoring requirement from breach database coverage: one focused on company-side compromises, the other on device-side compromises. Both channels require monitoring simultaneously. What does continuous monitoring actually look like?</h2> Meaningful monitoring covers three channels, and the alert timing matters as much as the channel coverage. Breach database monitoring ingests new breach data as it is disclosed or discovered. This includes the service’s own indexed database, HIBP feeds where available through partnership, and direct partnerships with breach research organisations. Say a company reports 10 million records stolen, or a researcher discovers a dataset on a public-facing S3 bucket. That should trigger an alert within hours, not appear in a weekly summary. Paste site monitoring covers Pastebin, Ghostbin, and similar services where credential dumps are posted shortly after being compiled. Paste sites are accessible to anyone and are crawled continuously by both security services and automated attack infrastructure. Data appearing on paste sites is typically already in active use. An alert at the moment of paste-site appearance still gives you a meaningful window to act before the data spreads further. Dark web monitoring covers forums, marketplaces, and channels where fresh breach data is traded and stealer logs are sold. The depth of coverage here varies considerably between services. A service claiming “dark web monitoring” may be crawling a small set of publicly accessible forums. A deeper service indexes closed marketplaces and private channels, where the most valuable fresh data appears earliest. Alerts should be near real-time. A weekly digest report is not monitoring — it is a delayed summary of events that may already be over. If a breach dataset containing your credentials is live and being actively used for credential stuffing, a same-day alert enables a password change within the highest-risk window. A report that arrives seven days later is primarily historical. What to do now, in priority order</h2> These steps are not theoretical risk management. They address specific, documented failure modes in the breach timeline. Check all your email addresses against Have I Been Pwned today. Not just your primary address. Check every address you have used for account registrations, including old ones you no longer actively use. Old addresses remain in company databases and in breach data regardless of whether you still check them. Enable HIBP’s breach notification emails for each address. Use a password manager with integrated breach monitoring. 1Password’s Watchtower checks stored passwords against known breach databases and flags compromised credentials automatically. Dashlane’s Dark Web Monitoring runs similar checks. Bitwarden’s built-in HIBP integration does the same. If a stored password appears in a breach, you want to know immediately, not at your next annual review. Activate real-time transaction alerts on every card and bank account. Most UK and US banks offer push notifications for any card transaction above a threshold you set. Set the threshold to £0/£0. A same-day alert when your card number is used fraudulently is a fundamentally better position than discovering it on your monthly statement. Place a credit freeze with all five credit bureaus. Most UK and US guidance mentions three US bureaus: Equifax, Experian, and TransUnion. There are five. NCTUE (National Consumer Telecom and Utilities Exchange) handles identity checks for utility accounts and telecoms. ChexSystems is used by most banks for new current account applications. Innovis is smaller but used by several lenders. A freeze on only the major three leaves doors open that are regularly used in identity fraud. A freeze costs nothing in the US under federal law and prevents new credit being opened using your information regardless of what breach data exists. Check your email forwarding rules once a month. A compromised email account frequently has forwarding rules installed silently. Every email you receive is then also copied to an address the attacker controls. The password reset for your bank account that you never requested may have already been intercepted this way. In Gmail: Settings → See all settings → Forwarding and POP/IMAP. In Outlook: Settings → View all Outlook settings → Mail → Forwarding. For fuller coverage, use a service that monitors stealer log marketplaces. This is the channel that public breach tools do not cover. SpyCloud operates at enterprise level. Consumer-facing services with stealer-log coverage are available at lower price points. KnytX Shield is built to cover this alongside breach monitoring and paste-site coverage once it launches. The reason this matters is simple. If your device was infected with infostealer malware and your credentials are being sold on Russian Market, no standard breach alert will reach you. Only stealer-log-specific monitoring will. The breach you haven’t heard about yet</h2> The Marriott breach ran for four years. The Equifax breach ran for 78 days. Neither company knew while it was happening. The 204-day average is not a technology problem that will be solved by better enterprise security tooling alone. Some fraction of it will improve as detection tools mature. But the distribution of breach timelines is fat-tailed. A small number of very long-running compromises pull the average up. Those long-running compromises tend to be the ones with the most data exposed and the most harm caused. Checking once a year, with free public tools, catches data from breaches that are already publicly known and already have circulated widely. It is better than nothing. It is not monitoring. The window that matters is the one between breach and disclosure. That’s the 204 days when data is actively trading and the company does not yet know it has been compromised. Real-time alerts, across all three channels, are the mechanism for closing that window. Everything else is catching up after the fact. Frequently asked questions</h2> What is continuous breach monitoring? It’s near real-time watching of three channels for your data: breach databases, paste sites, and dark-web markets. It aims to alert you within hours of a leak, instead of a yearly or after-the-fact check. Why isn’t a yearly Have I Been Pwned check enough? HIBP only indexes breaches once they’re public. It misses the 204-day pre-disclosure window, private-channel data, and most stealer logs. A yearly check catches what’s already widely known, not what’s actively being traded. What are stealer logs, and why do they matter? Stealer logs come from malware on your own device, not a company server. They contain fresh passwords and active session cookies. Standard breach tools index them poorly, so they need dedicated monitoring. Can I do continuous monitoring for free? Partly. Enable HIBP notifications, bank transaction alerts, and password-manager breach checks today. Full stealer-log and dark-web coverage usually needs a paid service. Also check whether your details already sit on people-search sites</a>. What you can do right now</h2> Want to see what data brokers expose about you? See what a scan finds →</a> shows an example report: the kinds of sites that list your name, phone, and address. Once KnytX Shield launches it will monitor breaches, paste sites, and dark-web markets for your data automatically. Join the waitlist</a> to get in early. LinkedIn Data Privacy: What It Knows, How to Lock It Unknown — Wed, 08 Jul 2026 00:00:00 +0000 The short answer: LinkedIn data privacy is weaker than the professional register suggests. Your profile bundles your name, job history, employer, location, connections, and inferred salary into structured, sellable data. In 2021, a scraper packaged 700 million such records and sold them on a hacking forum. You cannot undo that. You can shrink what LinkedIn holds going forward. Audit your profile, hide your connections list, block the cross-site Insight Tag, and turn off the AI-training and ad-tracking settings below. In June 2021, a user with the handle “GOD User TomLiner” posted a sample of one million records harvested from LinkedIn on a forum called RaidForums. They advertised the remainder — 700 million entries in total — for sale at an undisclosed price. Researchers at Privacy Sharks verified the sample within days. The records held full names, email addresses, phone numbers, physical addresses, geolocation data, employment histories, and inferred salary ranges. LinkedIn, owned by Microsoft since 2016, acknowledged the collection existed but maintained that no security breach had occurred. The data, it said, had been scraped from public-facing profiles using LinkedIn’s own API and publicly accessible pages. That statement was accurate in a narrow technical sense. It was also nearly beside the point. Seven hundred million people had published professional information for one reason. They expected recruiters to view it, colleagues to connect, and hiring managers to reach out. They had not consented to having that information packaged into a commercial dataset. Nobody had vetted the buyers on a criminal marketplace. LinkedIn’s legal position did not change what those buyers could now do with the data. What LinkedIn Actually Knows About You</h2> A LinkedIn profile created in good faith holds a remarkable amount of structured personal data. At the most basic level, that means your full legal name, a photograph, and your current location. It also holds your complete employment history with employer names and dates, your educational history, and a list of professional skills. If you have held multiple roles at the same company, LinkedIn records that progression too. Your connections list is a map of your professional relationships: who you know, in which industries, and how recently you interacted with them. Go a layer deeper and it becomes more granular. If you use LinkedIn Recruiter, the platform logs which company profiles you have researched and how long you spent on them. LinkedIn Learning is the training library Microsoft acquired from Lynda.com. If you use it, LinkedIn knows which skills you are trying to develop, which courses you started and never finished, and which certifications you are pursuing. The gap between your listed skills and your learning activity is a reasonable proxy for where you feel professionally inadequate. That data has commercial value. Apply for jobs through LinkedIn’s “Easy Apply” function and the data expands again. You may have entered your desired salary range, your notice period, or whether you are open to relocation. LinkedIn retains all of it. It feeds a model of your career trajectory that the platform sells to recruiters as a premium targeting product called LinkedIn Recruiter. Then there is the Insight Tag, which we will come back to. Is a data scrape different from a data breach?</h2> LinkedIn’s defence in 2021 was that scraping is not breaching. The company repeated this framing in its statement: “Our teams have investigated a set of alleged LinkedIn data that has been posted for sale. We want to be clear that this is not a data breach and no private LinkedIn member data was exposed.” The legal position is contested. In the United States, LinkedIn had been fighting this battle in the courts for years before the 2021 incident. The case of hiQ Labs v. LinkedIn turned on whether scraping publicly accessible pages violated the Computer Fraud and Abuse Act, the 1986 federal law against unauthorised computer access. The Ninth Circuit ruled that it did not, because the data was publicly available without any authentication barrier. LinkedIn petitioned the Supreme Court for review. The Supreme Court declined. In Europe, the picture is different and more favourable to data subjects. In September 2022, the European Data Protection Board issued guidelines on scraping under GDPR. The EDPB’s position was unambiguous. The fact that a user has made personal data publicly accessible does not strip that data of its protected status. A person who publishes their employment history for professional networking has not authorised unlimited third-party collection, aggregation, and commercial resale of it. The GDPR’s lawful-basis requirements apply regardless of whether the data is technically public. CNIL, France’s data protection authority, has pursued enforcement on this basis. In 2022, CNIL issued guidance requiring companies that run mass scraping operations on French residents’ data to comply with GDPR obligations, including legitimate purpose and proportionality. Several enforcement actions followed against data broker operations built on scraped professional data. Ireland’s Data Protection Commission is LinkedIn’s lead EU supervisory authority, because Microsoft’s European headquarters are in Dublin. In 2021, it found that LinkedIn had been processing behavioural data for advertising without an adequate lawful basis. LinkedIn had to update its processing for European users as a result. The scraping-versus-breach distinction is useful for LinkedIn’s communications team. It is less useful for the 700 million people whose data was sold. How does scraped LinkedIn data enable targeted attacks?</h2> The 2021 LinkedIn dataset was not just a privacy violation in the abstract. It was a toolkit. Spear phishing is the most immediate risk. A generic phishing email — “Dear Customer, your account requires attention” — converts well below one percent of the time. Now picture a different email. It addresses you by your full name, references your employer and job title, names a specific former colleague, and purports to come from your IT department. That is a fundamentally different threat. The 2021 dataset gave attackers every element they needed to personalise attacks at scale. They did not have to research individual targets; the dataset had done it for them. (See our guide to spear phishing attacks</a> for how these are built.) Business email compromise is more targeted and more lucrative. The FTC documented cases in 2021 and 2022 where attackers used LinkedIn data as a starting point for CEO fraud. The method is simple. Identify a company’s finance team and CEO from LinkedIn. Use a phone number from the dataset to impersonate the CEO calling the CFO. Instruct a wire transfer on some urgent pretext. These attacks succeed when the caller shows familiarity with internal structures, and professional networks document those structures in fine detail. The FBI’s Internet Crime Complaint Center reported $2.4 billion in losses to business email compromise in 2021 alone. The dataset’s use for physical-world harm is less discussed but serious. Domestic abuse situations often involve an abuser trying to locate someone who has left. A profile listing “Greater London Area” plus an employer name, combined with a residential postcode from another breach, narrows a search dramatically. Researchers described the geolocation data in the 2021 dataset as coarse. Coarse for an attacker is not the same as coarse for a determined one. What do other job platforms collect?</h2> LinkedIn is the most prominent professional data collector, but it is not alone. The ecosystem around it is worth understanding. Indeed and Glassdoor are both owned by Recruit Holdings, a Japanese firm with roughly £2.5 billion in annual revenue. Indeed tracks every search query you run, every filter you apply, every job description you open, and every company you research. Its privacy policy permits sharing data with employers. That includes the fact that you have been actively searching, which can affect salary negotiations if your current employer is paying attention. Apply to fifty jobs over six months, and that pattern becomes commercially useful to HR technology firms and, indirectly, to credit-assessment firms that buy data about financial-instability signals. Glassdoor’s review system creates a different problem. Reviews are posted under pseudonyms, but Glassdoor requires a verified email to post. The pseudonym does not fully protect the reviewer. In several US cases, employers who suspected negative reviews came from former staff obtained subpoenas to compel Glassdoor to disclose reviewer identities. Glassdoor has contested some of these subpoenas and complied with others. If you are considering a negative review of a former employer, understand that your anonymity is conditional, not guaranteed. ZipRecruiter, Monster, and CareerBuilder all feed data into the broader HR technology ecosystem. Candidate profiles are commercially valuable, especially those showing frequent applications, career pivots, or salary expectations. Buyers include firms that sell talent intelligence and financial-services providers assessing creditworthiness. The link between job searching and credit-risk assessment is not hypothetical. It is documented in the data brokerage industry’s product catalogues. What does the LinkedIn Insight Tag track off the platform?</h2> The LinkedIn Insight Tag is a JavaScript pixel, a snippet of code, that LinkedIn gives companies to measure advertising effectiveness. The premise is reasonable. A company runs a LinkedIn ad campaign and wants to know whether members who saw the ad later visited its website. The Insight Tag makes that connection. Over 300,000 websites currently have it installed. The implication is significant. Every time a LinkedIn member visits any site carrying the Insight Tag, LinkedIn receives a signal that the member was there. LinkedIn knows you visited a mental health clinic’s website. It knows you visited a fertility treatment provider. It knows you spent three sessions reading about cancer treatment options. LinkedIn classifies this as “B2B marketing intelligence,” but the behavioural inferences available from such a dataset go well beyond campaign attribution. The Irish DPC’s 2021 finding, that LinkedIn processed behavioural advertising data without an adequate lawful basis, was partly about this cross-site collection. LinkedIn updated its processing for European users afterward. Users outside Europe have fewer protections. The Insight Tag also shows why the scraping-versus-breach framing obscures more than it reveals. Here, LinkedIn is not the victim of scraping. It is conducting the collection. The question is not whether your data was taken without permission. When you created a LinkedIn account to find a job, did you understand what else you were signing up for? You were also enrolling in cross-site behavioural tracking, across every website your employer’s marketing team happens to have instrumented. How do you lock down LinkedIn data privacy?</h2> None of this requires abandoning LinkedIn entirely, though some people will make that choice. The more practical response is to reduce your exposure step by step and make bulk matching harder. Turn off AI-training use. LinkedIn added a “Data for generative AI improvement” setting for US members in September 2024, switched on by default. It lets LinkedIn train its AI on your profile, posts, and activity. Turn it off under Settings & Privacy > Data privacy > Data for generative AI improvement. For the full company-by-company AI-training picture, see our guide to opting out of AI training</a>. Audit your profile data. Remove any information you do not need to be professionally discoverable. Personal phone numbers do not belong on LinkedIn; use a work number or nothing at all. Specific home addresses have no place on a professional profile. Review whether exact employment dates (month and year) are necessary, or whether year-only is enough for you. Lock down your connections list. Your professional network is intelligence. Under Settings → Privacy → Profile Privacy, find “Who can see your connections” and set it to “Only you.” Leaving it visible hands scrapers a ready-made social graph attached to your profile. Opt out of LinkedIn’s advertising data processing. Under Settings → Ads → Ad Settings, disable all targeted advertising options. That includes “LinkedIn’s partners can show you ads off LinkedIn.” This limits some of the cross-platform tracking, though it does not stop the data collection itself. Block the Insight Tag at the browser level. Install uBlock Origin on your browser. Its default filter lists include the LinkedIn Insight Tag domain (snap.licdn.com</code>). Once installed, the Insight Tag cannot fire when you visit websites that have it embedded. This is a more reliable protection than LinkedIn’s own opt-out controls, which operate at the policy level rather than the technical level. Use a dedicated email address for LinkedIn. Create an address used only for LinkedIn and job applications. Do not reuse the address tied to your bank, your NHS patient portal, or your pension account. When a scraper harvests your LinkedIn email, they get an address that cannot be cross-referenced to your financial accounts. Services like SimpleLogin or Proton’s aliases make this easy to manage. Consider using a name variant. Some professionals use a middle initial or a name variant on LinkedIn — “J. Smith” rather than “John William Smith” — making bulk automated matching against other datasets harder. This is a privacy technique, not a deception; it does not affect your discoverability to recruiters who are searching for your skills and experience. Enable Private Mode for job searching. If you are actively searching while employed, turn on LinkedIn’s Private Mode (Settings → Privacy → Profile viewing options). It stops your current employer from seeing that you have viewed competitor companies or recruiter profiles. It does not make you invisible to LinkedIn, but it reduces the visible signals. Request your LinkedIn data. Under Settings → Data Privacy → Get a copy of your data, LinkedIn allows you to download an archive of what it holds. Review it. The data categories may include things you did not know LinkedIn had logged, including your past search history and messages sent. The 2021 dataset is already in circulation. You cannot retroactively remove your data from it. What you can do is control the data surface you present going forward. Limit what LinkedIn accumulates about your behaviour across the web. Reduce how easily the data you do share can be cross-referenced. Perfection is not available. Meaningful reduction of exposure is. The same professional details that leak from LinkedIn also feed the people-search brokers, which resell your name, employer, and address. Broker pages like Spokeo</a> and Whitepages</a> show what that looks like and how to opt out. What you can do right now</h2> Want to see what data brokers expose about you? See what a scan finds →</a> shows an example report: the kinds of sites that list your name, phone, and address. Once KnytX Shield launches it will find and remove these automatically. Join the waitlist</a> to get in early. Smart Speaker Privacy: What Echo and Nest Record Unknown — Tue, 07 Jul 2026 00:00:00 +0000 In 2019, a team of researchers at Northeastern University and Imperial College London ran one of the most thorough independent tests of smart speaker privacy to date. Over six months, they played 125 hours of scripted dialogue and ambient household sound past eight popular smart speaker models. They measured how often each device woke up and began recording without being deliberately addressed. Every device had false activations. The Amazon Echo activated unintentionally an average of 1.5 to 19 times per day, depending on the wake word and the content playing nearby. The researchers published their findings and shared them with manufacturers. Amazon disputed the methodology. The speakers kept recording. That study, published in the Proceedings of the ACM on Interactive, Mobile, Wearable and Ubiquitous Technologies, didn’t receive much coverage outside privacy circles. It should have. The short answer: Smart speakers listen constantly for a wake word, and the local model gets it wrong often, up to 19 times a day for some Echo setups. Each false trigger uploads real audio to Amazon, Google, or Apple servers, where it’s stored by default and sometimes reviewed by human contractors. Police have obtained Echo recordings in court cases. You can cut the exposure without new hardware: use the hardware mute button, delete voice history, set auto-delete, and turn off human review and voice purchasing. Jump to: Why false activations matter</a> · What the companies store</a> · Law enforcement access</a> · Voice data and ads</a> · What to change</a> · Network-level separation</a> Why false activations are the core problem</h2> Smart speakers operate in a state of constant, low-level listening. The device’s onboard chip runs a wake-word detection model. This is a small, local system built to recognise one specific trigger phrase. When it thinks it hears that phrase, it opens an audio stream to the company’s cloud servers. From that point, everything you say is sent, processed, and stored. The local model is the problem. It is not very good. It has to be small enough to run on a modest chip, which means it makes mistakes. “Unboxing” and “Texas” have both been documented as false triggers for Alexa. A TV news broadcast, a podcast, a snatch of conversation from another room: any of these can cross the threshold. When that happens, the audio stream opens. Seconds or minutes of audio get uploaded, analysed, logged with a timestamp, and linked to your account. In most default configurations, that log is permanent. Google Assistant’s wake phrase, “Hey Google,” has been triggered by the phrase “OK, Boomer.” Siri has been activated by the sound of zips. These are not hypothetical edge cases; they appear in user-reported complaints, contractor accounts, and in the data that privacy researchers have obtained through subject access requests. The Northeastern and Imperial College study was significant precisely because it was systematic rather than anecdotal. The researchers created a controlled environment and measured activation rates methodically. The finding was up to 19 false activations per day for some Echo configurations. That means a device in a typical home could send dozens of accidental recordings to Amazon’s servers each week. It records ambient conversation that was never meant for any server anywhere. What the companies actually store</h2> Each major assistant has a different approach to retention, but they share a common default: they keep your recordings. Amazon Echo stores voice recordings indefinitely unless you manually delete them. Each recording is accessible in the Alexa app under Settings → Alexa Privacy → Review Voice History. You can scroll back through years of entries. More significant than the storage itself is what Amazon does with it. The company employs teams of contractors in multiple countries, including Romania, India, and Costa Rica, who listen to voice recordings as part of a “quality assurance” programme. Bloomberg reported on this in April 2019. The contractors heard domestic arguments and medical conversations. They heard what appeared to be a sexual assault being described. They heard material captured by accident, from people who had no idea anyone was listening. Workers told Bloomberg that some recordings were obvious mistakes, but they were being reviewed regardless. Google Nest stores voice and audio activity in your Google account, under a category called Voice & Audio Activity. For years, this was on by default. GDPR enforcement in the EU eventually pushed Google to change the default for European users. In 2019, a Belgian public broadcaster, VRT NWS, obtained and published a sample of more than 1,000 Google Assistant recordings. They came from a contractor with access to the review programme. The recordings included fragments of domestic conversations, apparent medical symptoms, and confidential exchanges. Google acknowledged the leak and suspended the human review programme in the EU. Apple Siri attracted similar controversy in July 2019. The Guardian reported that Apple contractors were regularly hearing private medical discussions between doctors and patients, confidential business meetings, and details of what appeared to be criminal activity. All of it was captured via accidental Siri activations. Unlike Amazon and Google, Apple asserted that Siri recordings are not linked to Apple IDs. Apple uses random identifiers rather than account-linked ones, which is a meaningful distinction for targeted profiling. But the recordings were still being reviewed by humans who had not been disclosed to users. Apple paused the programme and later made it opt-in. These were not isolated events. They describe a structural feature of how these systems work: audio goes to servers, humans occasionally review it, and the disclosure to users was, in each case, insufficient. Law enforcement and your recordings</h2> Stored recordings can be accessed by law enforcement. This is not a hypothetical — it has happened in court cases. In 2017, prosecutors in Benton County, Arkansas, sought recordings from an Amazon Echo that had been present during an alleged murder. The device had belonged to James Bates, who was charged with killing a friend in his hot tub. Amazon initially challenged the warrant on First Amendment grounds, arguing that the assistant’s responses constituted speech with constitutional protections. Amazon ultimately provided the recordings — not because the warrant challenge failed, but because Bates’s own defence counsel consented to the disclosure. Charges were later dropped, but the legal exchange established a template. Later in 2017, in Farmington, New Hampshire, prosecutors sought Echo recordings in a double murder case. A couple, Timothy and Meredith Sullivan, had been killed, and police believed an Echo in the home may have captured audio around the time of the killings. Amazon challenged that subpoena. The recordings were eventually provided. The Electronic Privacy Information Center (EPIC) is a Washington-based privacy advocacy organisation. It tracked at least 11 cases through 2021 in which Amazon complied with law enforcement requests for Alexa voice recordings. The actual number is almost certainly higher, because many such disclosures happen with no public record. The legal standard matters here. The Wiretap Act provides meaningful protection against real-time interception of communications. Authorities generally need a wiretap order, which requires showing probable cause to a judge. But stored recordings are a different category. Under the Stored Communications Act, law enforcement can access stored records with a subpoena, which requires a lower standard than a full warrant. Your recordings, once stored, are subject to this lower threshold. A subpoena doesn’t require a judge’s sign-off. A grand jury or even a government attorney can issue one in many circumstances. Outside the United States, the protections vary considerably. In the UK, the Investigatory Powers Act 2016 gives GCHQ and the police broad powers to request data from communications service providers, which Amazon, Google, and Apple are. Amazon’s global law enforcement request numbers are disclosed in transparency reports. But these aggregate figures obscure the specific categories of data requested. Voice data and the advertising economy</h2> Amazon’s primary business is not selling smart speakers. It is selling advertising and driving purchases. The Echo is, among other things, a data collection node. Voice interactions with Alexa inform the wider Amazon advertising system. “Alexa, add this to my cart” is a purchase signal. “Alexa, remind me to buy milk” is a signal about household routines. “Alexa, what time does the pharmacy close?” is a health-adjacent query. Amazon’s Privacy Notice acknowledges that it uses information collected from Alexa to improve its services — and “services” includes advertising. The specific mechanics of how voice interaction data is used to personalise advertising are not publicly disclosed in granular form. Amazon has been cautious about making explicit claims in either direction. What is documented: Amazon’s advertising business generated $56.2 billion in revenue in 2024. The Echo lives in people’s kitchens and living rooms, listening to household life. That role is part of what makes the broader data ecosystem valuable. Google is more explicit. Its Privacy Policy states that information collected across its services can be used to provide “more relevant ads.” That includes voice interactions via Google Nest. Voice data joins the wider Google account profile: search history, YouTube viewing, Chrome browsing, Maps location history, and Gmail content (in the case of Smart Compose and related features). Each signal reinforces the others. Apple makes stronger claims about keeping advertising data separate. It does not run a behavioural advertising business the way Amazon and Google do. Siri data’s random identifier system also keeps some separation. That distinction is real. But it does not address the human review issue, and it doesn’t prevent law enforcement access. What you should actually change</h2> The good news: there are concrete steps that reduce exposure meaningfully. None of them require buying new hardware. Use the mute button. Every major smart speaker — Echo, Nest, HomePod — has a physical mute that disables the microphone at the hardware level. This is more reliable than any software setting. When you are in a sensitive conversation, when you are on a work call in the same room, when guests are over — use the mute button. The speaker cannot send audio it cannot record. Amazon Echo: Open the Alexa app. Go to More → Settings → Alexa Privacy → Review Voice History. Delete all recordings. Then go to Manage Your Alexa Data and set “Automatically delete recordings” to either 3 months or “Don’t save recordings.” Disable “Use of voice recordings” and “Help improve Amazon services and develop new features.” If you have voice purchasing enabled, disable it under Settings → Account → Voice Purchasing. This doesn’t stop recordings from being made temporarily during processing, but it limits long-term retention. Google Nest: Log into your Google account. Go to Data & Privacy → My Activity. Find “Web & App Activity,” click Manage, then filter by “Voice and Audio.” Delete all existing voice activity. To stop future saving: back on the main Data & Privacy page, find “Voice & Audio Activity” and turn it off. EU-based users should check whether Google has re-enabled this without notification; it has happened following app updates. Apple HomePod and Siri: On iPhone, go to Settings → Siri & Search → scroll to “Improve Siri & Dictation” and disable it. This opts you out of the human review programme. On HomePod itself, use the Mute button for sensitive conversations. Apple’s random identifier system already provides more separation than Amazon or Google, but the opt-out removes the human review component entirely. Disable features you don’t use. Alexa’s “Drop In” function lets two Echo devices open an audio channel between them with minimal friction. It was designed for quick inter-room communication within a household. But if your account credentials were ever compromised, an attacker with access to your Amazon account could potentially use Drop In to listen into a room. If you don’t actively use Drop In, disable it: Alexa app → Device Settings → Communications → Drop In → Off. Network-level separation</h2> If you want stronger protection without removing the devices, network segmentation is worth understanding. A home router that supports VLANs — virtual local area networks — can place your smart speakers on a separate network segment that cannot communicate with your computers, phones, or NAS drives. This means that even if a speaker’s firmware were compromised, the attacker cannot pivot to other devices on your network. Eero, Ubiquiti’s UniFi range, and many other consumer routers support this. The setup requires moderate technical comfort, but guides exist for each major platform. DNS-level blocking via Pi-hole or NextDNS lets you block known telemetry domains at the network level. NextDNS maintains curated blocklists that include Amazon and Google telemetry endpoints. Blocking these does not prevent all data transmission — recordings go to core processing endpoints that cannot be blocked without breaking the device — but it can reduce ancillary data collection. Be aware that some blocks will break device functionality in ways that are difficult to trace. These are not steps for everyone. But they exist. And for someone who has a home office where sensitive client conversations happen near an Echo that they haven’t reconfigured, they’re worth knowing about. The 2019 Northeastern and Imperial College paper ended with a measured call for more transparency from manufacturers about false activation rates and what happens to accidentally captured audio. Six years on, Amazon, Google, and Apple have each made incremental changes to defaults and human review policies. All three still store recordings by default. All three still share data with law enforcement on request. The false activation problem hasn’t been solved — it’s been managed. The mute button, the deletion settings, and the opt-outs exist. They require you to go looking for them. For the rest of the connected home, our smart home privacy guide</a> covers TVs, cameras, and thermostats. What you can do right now</h2> Want to see what data brokers expose about you? See what a scan finds →</a> shows an example report: the kinds of sites that list your name, phone, and address. Once KnytX Shield launches it will find and remove these automatically. Join the waitlist</a> to get in early. Why Your Data Keeps Crossing the Atlantic Unknown — Sun, 05 Jul 2026 00:00:00 +0000 On 16 July 2020, the Court of Justice of the European Union issued a judgment that made hundreds of millions of data transfers simultaneously unlawful. The case had started years earlier with a complaint from an Austrian lawyer named Max Schrems. He had noticed something straightforward. Facebook was sending his European personal data to servers in the United States. There, it became accessible to US intelligence agencies under American surveillance law. Schrems wanted to know what legal basis allowed that. The EU’s highest court eventually agreed there was not one. The ruling — Schrems II, because this was his second successful legal challenge to transatlantic data transfer rules — invalidated Privacy Shield overnight. Facebook, Google, Microsoft, and virtually every US-based cloud provider were suddenly operating in a legal grey zone. The scale was staggering. Meta’s Facebook transfers alone represented one of the largest cross-border data flows in the world. The decision rippled across corporate legal departments on both sides of the Atlantic. Contracts had to be revisited. Risk assessments had to be done for the first time. Some never were. That was 2020. A replacement framework arrived in 2023. It is already being challenged. The short answer: When you use a US service from Europe, your data usually travels to US servers. There it falls under US law, including surveillance powers with no EU-style oversight. GDPR requires a legal mechanism for that transfer. Two mechanisms, Safe Harbor and Privacy Shield, were struck down by EU courts. The current one, the 2023 Data Privacy Framework, survived a first challenge in September 2025 but faces a broader “Schrems III” threat in 2026. Your practical options: check DPF certification, ask companies what transfer safeguards they use, and prefer EU-hosted providers for sensitive data. What does “data transfer” actually mean?</h2> Most people assume their email, search history, or social media data stays in the country where they use the service. It generally doesn’t — and for Europeans, the legal consequences of that matter considerably. An EU resident using Gmail is having their emails processed on servers potentially in the United States, Ireland, and several other locations simultaneously. An EU resident scrolling Facebook has their clicks, reactions, and browsing patterns transferred to Meta’s US infrastructure for ad targeting. An employee at a German company using Microsoft 365 is having their files, Teams messages, and calendar data sent to Azure data centres that may include US locations. A French person using a fitness app owned by an American company has their health and location data sitting on servers subject to US law. Chapter V of the GDPR addresses this directly. Any transfer of personal data outside the European Economic Area requires a legal mechanism: a formal basis in law that justifies moving data beyond EU jurisdiction. Without one, the transfer is unlawful, full stop. This is not a technicality. The EU takes the position that personal data is not just a commercial asset. It carries rights attached to the individual it describes, and those rights do not disappear at a border. The three mechanisms that have governed EU-to-US transfers tell the story of two decades of failure and attempted repair. Safe Harbor, Privacy Shield, and the current framework</h2> Safe Harbor ran from 2000 to 2015. It was a self-certification system: US companies could declare they would comply with EU data protection principles, and their doing so was deemed adequate under EU law. The European Commission had issued a formal adequacy decision — a determination that US law provided essentially equivalent protection to the EU’s own. Then Edward Snowden disclosed the scope of NSA surveillance in 2013. Safe Harbor’s assurances that EU data would be handled according to EU-style principles looked hollow against a programme that hoovered up data from the very US companies making those assurances. Max Schrems filed his first complaint in 2013. The Court of Justice struck down Safe Harbor in October 2015, in what became known as Schrems I. The court found that US national security law allowed interference with fundamental rights in ways incompatible with EU standards. It also found that Safe Harbor provided no effective remedy for EU citizens affected. Privacy Shield replaced it in 2016. It was more elaborate than Safe Harbor. It added more requirements for participating companies, a new ombudsperson mechanism for EU citizens to raise complaints, and renewed adequacy findings from the European Commission. It lasted four years. Schrems II killed it for the same underlying reason. Two US surveillance authorities were the problem. Section 702 of the Foreign Intelligence Surveillance Act (FISA), which authorises bulk collection of communications. And Executive Order 12333, which governs overseas surveillance. The court found that neither provided an effective legal remedy for EU citizens. The ombudsperson created by Privacy Shield did not qualify as an independent court or tribunal with binding authority. The problem was structural. US constitutional privacy protections do not extend to non-US persons, and EU citizens had no meaningful way to challenge how American intelligence agencies handled their data. The EU-US Data Privacy Framework (DPF) was adopted in July 2023. It attempts to fix the specific defect the court identified. Executive Order 14086, signed by President Biden in October 2022, created a new Data Protection Review Court. This is an independent judicial body where EU citizens can challenge US surveillance activities affecting their data. It is staffed by judges who do not hold other government positions and can order remedies. The European Commission issued a fresh adequacy decision. DPF has been in operation since July 2023. The DPF is already being litigated. The first challenge to reach court came from a French parliamentarian, Philippe Latombe. In September 2025, the EU’s General Court dismissed it and upheld the DPF’s adequacy. That was a narrow challenge, though, and it is under appeal. A broader threat is building around NOYB, the privacy NGO Max Schrems founded. NOYB’s argument is that the Data Protection Review Court remains subject to executive control in meaningful ways. It also notes that the underlying surveillance authorities, Section 702 and EO 12333, are still in place and still permit collection that would not be permissible under EU law. Then, in mid-2026, a US Supreme Court ruling (Trump v. Slaughter) weakened protections for the independence of US oversight bodies. NOYB responded by urging the European Commission to exit the DPF, and it signalled a fresh challenge, a likely “Schrems III.” Given the previous two outcomes, legal teams advising US cloud providers are not betting heavily on permanence. What happened between Privacy Shield and DPF</h2> The gap between Privacy Shield being struck down in July 2020 and DPF arriving in July 2023 lasted exactly three years. During that period, the dominant legal mechanism for EU-to-US transfers was Standard Contractual Clauses — SCCs. SCCs are contractual clauses approved by the European Commission that can be incorporated into agreements between an EU data exporter and a non-EU data importer. By signing up to SCCs, the importer makes two promises. It will handle the data according to EU-equivalent standards. And it will tell the exporter if it receives a government access request it cannot comply with under GDPR. Schrems II didn’t eliminate SCCs as a mechanism, but it significantly complicated their use. The ruling held that an exporter relying on SCCs must carry out a Transfer Impact Assessment. This is an analysis of whether SCCs actually provide adequate protection in practice, given the laws of the destination country. For transfers to the US, this meant honestly confronting one structural problem, the same one that killed Privacy Shield. Section 702 FISA authorises collection that SCCs cannot contractually prevent. Companies were technically required to do this analysis. Most didn’t, or produced documents that reached the conclusion they needed without genuine analysis. The Irish Data Protection Commission’s enforcement against Meta’s Facebook operations in May 2023 was the definitive test of whether this mattered. The Irish DPC found that Meta’s reliance on SCCs to transfer EU user data to US servers was inadequate. In practice, the SCCs did not provide protection equivalent to EU law, given US surveillance capabilities. The fine was €1.2 billion, the largest in GDPR history. The transfers were ordered to be suspended, though Meta relied on DPF once that became available. The Irish DPC’s handling of this case also illustrated a chronic structural problem. The complaint that eventually produced the €1.2 billion fine was filed in 2013 — ten years before the decision arrived. Ireland hosts the European headquarters of most major US technology companies. So the Irish DPC handles the bulk of cross-border complaints against Google, Meta, Apple, Microsoft, LinkedIn, and others. Its pace of enforcement has been a persistent source of friction with other European data protection authorities. The European Data Protection Board even stepped in to require the DPC to act more forcefully on the Meta case. What this means for your actual data</h2> When you use a US social media platform from Europe, your posts, private messages, reactions, and location check-ins travel to US servers. They sit under US law, not just EU law. Depending on the platform and the specific programme, they may be accessible to the NSA under Section 702 without a warrant, as part of bulk collection from US internet companies. This is not a hypothetical. It is precisely what the Snowden disclosures confirmed and what three successive court challenges have turned on. When a healthcare app you use is owned by a US company, your health data may be subject to US law. That includes law enforcement and intelligence access with no equivalent EU oversight mechanism. US health privacy law (HIPAA) only applies to specific covered entities: health insurers, healthcare providers, and their business associates. It does not apply to consumer wellness apps, fitness trackers, or most health-adjacent platforms. Your HealthKit data, your period-tracking app data, your symptom diary: none of that is necessarily HIPAA-protected. And if it crosses the Atlantic on inadequate legal grounds, it has even less protection. When an employer migrates to a US cloud provider, employee HR data — performance reviews, salary information, disciplinary records, communications — may cross borders. Employment data is among the categories that most workers have the least visibility into. It routinely moves internationally as companies switch infrastructure, often without conducting the transfer impact assessments that GDPR requires. SCCs on paper do not equal protection in practice. That is what the European Court of Justice said in 2015, said again in 2020, and what the pending DPF challenge may say a third time. What you can actually do</h2> The legal machinery is complicated. Your practical options are more limited but not meaningless. Check DPF certification. The official list of companies certified under the EU-US Data Privacy Framework is searchable at dataprivacyframework.gov. If a company is listed, they have committed to DPF obligations and are subject to enforcement by the US Federal Trade Commission for non-compliance. Certification is not a guarantee — Safe Harbor was also self-certification — but it is the legally operative mechanism while DPF stands. If a company handles your data and isn’t on the list, they need a different transfer mechanism. Request information about SCCs and Transfer Impact Assessments. Under GDPR Article 15 (right of access), you can request confirmation of what data is held about you. You can also ask about transfers to third countries, including the safeguards in place. You can also ask under Article 46 what transfer mechanism a company is relying on. Many companies will respond by pointing to boilerplate about SCCs. Some will claim their TIAs are commercially confidential. That response is itself informative. Prefer EU-established and EU-hosted providers for sensitive data. For health data, financial information, or legal communications, the practical risk reduction from using a European provider running on European infrastructure is real. EU-headquartered companies can still use US cloud providers and create the same transfer problem — so ask specifically whether data is stored and processed in the EEA. Many enterprise cloud contracts include a “data residency” option. Consumer services rarely do, but it is increasingly a competitive differentiator. File complaints when transfers look unlawful. The Schrems cases both began as individual complaints to a data protection authority. Filing a complaint costs nothing. Each EU member state has a national DPA. In France, that is the CNIL at cnil.fr. In Germany, the Federal Commissioner for Data Protection at bfdi.bund.de. In Ireland — which handles most major US platform complaints — the Data Protection Commission at dataprotection.ie. UK residents (post-Brexit the UK operates its own framework, the UK-US Data Bridge) can file with the ICO at ico.org.uk. Complaints do result in action, even if slowly. The Meta SCC case took a decade, but it produced the largest GDPR fine in history and a transfer suspension order. The pace is frustrating. It is not nothing. Follow NOYB. The organisation Max Schrems founded, NOYB (noyb.eu), publishes plain-English analyses of enforcement decisions and pending cases. They are the most active litigants challenging unlawful data practices across Europe. Their case tracker gives the clearest view of what is being challenged, what has been decided, and what remains unresolved. If the DPF challenge produces Schrems III, NOYB is where you will read about it first. The underlying problem hasn’t been resolved</h2> Three frameworks. Over two decades. Two court strikes. And fresh challenges still in play. The structural tension has never changed. The United States conducts mass surveillance that does not require warrants for non-US persons. EU privacy law requires effective legal remedies for people whose data is collected. Those two positions are hard to reconcile without the US fundamentally changing how it collects intelligence from internet infrastructure. That has not happened, and shows no sign of happening. The Data Protection Review Court created by Executive Order 14086 is a genuine attempt to create a judicial remedy that could satisfy EU legal standards. Whether it does will be determined by the Court of Justice. If it doesn’t, a third adequacy decision will fall, and the legal basis for an enormous proportion of EU-US commercial data flows will collapse again. Companies will fall back on SCCs again. The Irish DPC will spend another decade enforcing against inadequate reliance on them. Your data is not a passive object in this dispute. It is what the dispute is about. See what a scan finds →</a> walks through an example report of what data broker exposure looks like. KnytX Shield isn’t live yet; join the waitlist</a> to run your own scan at launch. Biometric Privacy Laws: Your Rights to Face & Voice Unknown — Sat, 04 Jul 2026 00:00:00 +0000 This article is educational and does not constitute legal advice. Consult a qualified attorney for advice specific to your situation. In February 2021, Facebook agreed to pay $650 million to settle a class action lawsuit brought under Illinois’ Biometric Information Privacy Act. The allegation: Facebook’s “Tag Suggestions” feature had been scanning users’ faces in uploaded photos to suggest names — without written consent — since at least 2011. Six million Illinois residents were eligible for approximately $200 each, making it the largest BIPA settlement ever reached at that point. The feature had been running quietly for years. Facebook called it a convenience tool. Illinois law had a different interpretation, and a federal court agreed. The number is worth sitting with. $650 million. Not for a data breach. Not for leaked health records. It was for face geometry: measurements extracted from photos to recognise a person, collected without asking. The short answer: Your face, voice, and fingerprints are “biometric data,” a category the law treats as especially sensitive. Your rights depend heavily on where you live. Illinois’s BIPA is the strongest US law and lets individuals sue directly. GDPR (EU and UK) treats biometrics as “special category” data needing explicit consent. Most other US states have weak or no biometric-specific protection. Practical steps at the end let you find and delete face templates regardless of your location. What is biometric data?</h2> Biometric data is information derived from your physical or behavioural characteristics that can uniquely identify you. Under Illinois BIPA (740 ILCS 14), the statutory definition is broad. It covers retina or iris scans, fingerprints, voiceprints, and scans of hand or face geometry. It also covers any “identifier based on an individual’s biophysical characteristics.” Under GDPR Article 9, biometric data processed to uniquely identify a natural person is “special category” data. That is the same tier as health records, political opinions, and information about sexual orientation. That classification is not symbolic. It triggers specific legal requirements: explicit consent, prohibition on processing without a lawful basis, mandatory data minimisation, and, in practice, a higher bar for litigation damages when breached. The EU chose to put biometric data alongside health data deliberately. Biometrics are permanent. You can change your password, cancel a credit card, and move house. You cannot change your iris, your face geometry, or the shape of your fingerprint ridges. A facial recognition template — the numerical representation of your face’s spatial measurements — is not the photo itself. It is derived data, a mathematical fingerprint of your face. BIPA and GDPR both regulate the template, not just the underlying photograph. This distinction matters because companies frequently argue that “we only store photos” while building recognition systems on top of them. Can I sue under BIPA? Illinois set the standard, and it has teeth</h2> The Illinois Biometric Information Privacy Act, passed in 2008, remains the most enforceable biometric privacy law in the United States. What makes it different from most privacy legislation is the private right of action — any individual can sue without needing to prove actual harm. The statute sets out: Written notice before collecting biometric data, explaining what is being collected and why.</li> Written consent signed or electronically agreed to before collection begins.</li> A published retention policy stating how long data will be held and the criteria for destruction.</li> Prohibition on profiting from biometric data — selling it, leasing it, or trading it.</li> Mandatory destruction when the purpose for collection is complete, or within three years, whichever comes first.</li> </ul> Violate these requirements negligently: $1,000 per person per violation. Do it intentionally or recklessly: $5,000. In a class action with millions of class members, the arithmetic moves fast. BIPA has been applied well beyond social media. Six Flags Entertainment faced a lawsuit over fingerprint scanning used to process season pass holders entering parks — the plaintiff, a 14-year-old minor, hadn’t provided written consent. The Illinois Supreme Court ruled in 2019 that each separate scan was a discrete BIPA violation, not just the initial collection, multiplying potential damages significantly. Factory floors using fingerprint time clocks have faced multiple class actions from employees who were never given the required written disclosure. Healthcare providers using palm vein readers for patient identification have been sued under the same statute. The law does not distinguish between a tech company and a manufacturing plant — if you collect biometric identifiers in Illinois without written consent, you are exposed. The Facebook settlement worked out to about $200 per class member. The $650 million fund was divided among roughly 1.6 million claimants who submitted valid claims, out of the six million eligible. Not everyone claimed. That is a consistent pattern in privacy settlements: most eligible people never file. The payout for those who do claim ends up meaningfully larger as a result. Clearview AI: what happens in the absence of regulation</h2> Clearview AI built a facial recognition database by scraping more than three billion photos from public internet sources. The scraped sources include Facebook profiles, LinkedIn pages, Instagram accounts, news sites, and mugshot databases. The resulting system lets a customer upload a photo of an unknown person’s face. It then returns a list of potential matches, each linked back to the source page where the photo appeared. Clearview sold access primarily to US law enforcement agencies, with some international clients. The company’s legal argument is simple: public photos are public data. If you posted a photo on a platform whose terms of service allow indexing, Clearview argues it had every right to index it. This argument has not fared well where there is a statute specifically addressing the collection of biometric identifiers. The Illinois Attorney General sued Clearview in May 2022. The claim: Clearview had violated BIPA’s ban on collecting biometric data without written consent. In a settlement announced in May 2024, Clearview agreed to stop selling database access to private entities for use against Illinois residents. It also agreed to stop selling access to Illinois-based businesses. The settlement did not require Clearview to delete the Illinois data it had already collected, and the company continues to operate. The FTC reached a separate settlement with Clearview in May 2023 over deceptive practices. It required deletion of data from non-law-enforcement clients and limited future commercial use. But it imposed no financial penalty and did not directly restrict the facial recognition database itself. Clearview is instructive precisely because it shows what is legally possible when a company operates mostly in states without biometric-specific statutes. In the 40-plus US states that have no equivalent to BIPA, scraping public photos to build a recognition database is effectively unregulated. The law caught up in Illinois. Elsewhere, it has not. GDPR and what “explicit consent” actually requires</h2> GDPR Article 9 prohibits processing biometric data to uniquely identify natural persons unless one of ten narrow bases applies. In practice, for consumer services, the relevant basis is explicit consent. And explicit consent under GDPR is substantially more demanding than a buried checkbox in a terms-of-service update. Explicit consent must meet five conditions. It must be freely given (the service cannot be withheld for refusing). It must be specific to the particular processing purpose. It must be informed (you must know what you are consenting to). It must be unambiguous (a genuine affirmative action, not silence or pre-ticked boxes). And it must be separate from other consents. A single “I agree to our privacy policy” does not cover biometric collection. The European Data Protection Board’s 2022 guidelines on facial recognition in social media make this clear. Consent to use a photo-tagging feature is not the same as consent to generate and store a biometric template of your face. These are legally distinct processing activities that need distinct consent. Supervisory authorities have enforced this. In August 2019, Sweden’s Data Protection Authority (Datainspektionen) fined a school in Skellefteå 200,000 SEK (approximately €20,000). The school had used facial recognition to track student attendance, with no valid legal basis for processing minors’ biometric data. The amount was modest, but the principle was unambiguous: convenience and operational efficiency are not lawful bases under Article 9. The UK Information Commissioner’s Office issued Clearview AI an enforcement notice in May 2022. It ordered the company to stop collecting data on UK residents, delete existing UK data, and stop giving UK customers access to the system. The ICO also imposed a fine of £7.5 million (later contested on appeal, which Clearview challenged extensively). The key legal finding was clear. Clearview had collected UK residents’ biometric data without their knowledge, without a lawful basis, and without any meaningful way for affected individuals to exercise their rights. Which US states protect your biometric data?</h2> Illinois remains the gold standard because it is the only state with a private right of action for biometric violations. Texas passed its Capture or Use of Biometric Identifier law in 2009. It is structurally similar to BIPA but contains no private right of action. Enforcement is left entirely to the state Attorney General, which historically reduces the number of cases pursued. Washington’s My Health My Data Act, signed in April 2023, covers biometric data in healthcare contexts and includes a private right of action. But its scope is narrower than BIPA. Colorado, Connecticut, and Virginia have comprehensive privacy laws with biometric data provisions. These include rights to access, correct, and delete biometric data, plus opt-out rights for certain uses. But they do not impose BIPA’s pre-collection consent and notice requirements. And none of them lets individuals sue without proving harm. California’s Consumers Legal Remedies Act and CCPA provide some biometric protections, but enforcement requires documented harm or AG action. Several California municipalities — San Francisco, Oakland, Berkeley — have banned facial recognition use by local government agencies. Massachusetts has similar prohibitions on police use. These moratoriums address government surveillance specifically; they do not govern private companies. The practical consequence is that your legal position depends almost entirely on your ZIP code. An Illinois resident has meaningful private enforcement rights that a Texas resident sitting at the same desk, buying from the same platforms, does not. What you can do now</h2> If you are in Illinois: you have direct legal recourse. If an employer, retailer, gym, or other business collected your fingerprints, facial scans, or voiceprints without first giving you written notice and obtaining written consent, that is a BIPA violation. Several law firms specialise in BIPA class action work — a search for firms with active BIPA dockets in Chicago will surface them. The most common unaddressed violations are workplace time-clock systems using fingerprint or facial recognition. Many employers implemented these systems without understanding their BIPA obligations. If you are in the EU or UK: submit a Subject Access Request to any company you believe holds biometric data on you. Under GDPR Article 15 and UK GDPR, they have one month to respond. If the company has generated a biometric template from your face — even from publicly sourced photos — that is personal data you are entitled to request. Article 17 gives you the right to request deletion where the processing lacked a valid legal basis. The ICO has a template for submitting complaints about organisations that ignore or refuse deletion requests. Across all platforms: go into your social media account settings and look for any facial recognition or “face recognition features” setting. Instagram, Facebook, and LinkedIn have all offered these in various forms. Disable them where they exist. If a platform has already generated face templates, request deletion through the data settings page or a formal deletion request. Facebook (now Meta) specifically lets you view and delete your face recognition data in its data settings. For anyone: be deliberate about photo tagging. A photo tagged with your full name on a public or semi-public profile teaches any system scraping that platform to associate your face geometry with your identity. Audit who can tag you in photos. Review and remove existing tags on your own profile. The tagged photos may remain, but removing the tag stops your name being linked to the face for scraping purposes. Run a periodic reverse image search using a recent photo of yourself. Services such as Google Images, TinEye, and Yandex Images index differently and cover different parts of the web — running all three takes under ten minutes. If your face appears on a site where you did not post it, that site may have a removal request mechanism. If it does not, and the site operates under EU or UK jurisdiction, a GDPR deletion request to the site operator is your next step. Check people-search data brokers. Sites such as Spokeo</a>, Whitepages</a>, BeenVerified</a>, and their equivalents often aggregate social media profile photos alongside name, address, and phone number records. Many pull from platforms you have used. That ties your face to your identity across databases you never opted into. Most brokers have opt-out processes. They are deliberately tedious, but they work. The regulatory direction</h2> The EU AI Act passed in 2024, with provisions taking effect in stages through 2026. It classifies real-time remote biometric identification in publicly accessible spaces as a “prohibited AI practice” when used by law enforcement. The exceptions are narrow: targeted searches in serious criminal matters, subject to judicial authorisation. Private employers using workplace biometric systems face classification as “high-risk AI.” That triggers conformity assessments, registration requirements, and mandatory transparency with affected workers. This is the first legislation to frame biometric AI as a category requiring pre-deployment risk assessment rather than post-breach accountability. In the US, the National Biometric Information Privacy Act would create a federal version of Illinois BIPA. It has been introduced in Congress multiple times, most recently in 2023. It has not passed. The state-level patchwork is the operative legal reality, and for the foreseeable future, Illinois residents will continue to have rights that residents of most other states do not. The Facebook settlement happened because Illinois residents had a law that let them sue. The Clearview cases happened because Illinois and the ICO had specific statutory authority to act. The pattern repeats: where specific biometric statutes exist, enforcement follows. Where they do not, the collection continues. Your face is a permanent identifier. The laws protecting it are not permanent — they were written, amended, and can be changed. The gap between where enforcement exists and where it does not is large, and it is not shrinking quickly. See what a scan finds →</a> walks through an example report of the kinds of personal data brokers expose. KnytX Shield isn’t live yet; join the waitlist</a> to run your own scan at launch. Your Old Email Account Still Unlocks Your Accounts Unknown — Fri, 03 Jul 2026 00:00:00 +0000 In January 2019, a dataset called “Collection #1” appeared on a hacking forum. Security researcher Troy Hunt, who runs Have I Been Pwned, described it as the single largest dataset he had ever processed. It held 773 million unique email addresses and 21 million unique passwords, aggregated from hundreds of older compromises. When he sent out breach notifications, many recipients hadn’t touched the relevant email address in years. Some didn’t remember the password. A significant portion didn’t even think of the address as “theirs” anymore. That response is the problem. The email address isn’t dormant from an attacker’s perspective. It’s a key. (For the full picture of what an old inbox still holds, see our guide to dormant email accounts</a>.) The abandoned account timeline</h2> The mechanics of this are worth spelling out precisely, because most people don’t think through the whole chain. When you signed up for an internet service in 2008 or 2012 or 2015, you used whatever email address you had at the time. Maybe it was a Hotmail address you made at fifteen. Maybe it was a Yahoo account from university. That address got passed between services — you used it to register on forums, shopping sites, LinkedIn, Amazon, your bank’s online portal. It’s embedded in those services as your username, or your recovery address, or both. Then you drifted to Gmail, or to an address at your own domain, and you stopped checking the old one. The old address didn’t disappear from the services you’d registered with. It’s still there. And attackers know that millions of those addresses exist, because breach datasets circulate continuously. The Yahoo breach, disclosed in 2017 after having been concealed for years, exposed 3 billion accounts — more than one per internet user on the planet at the time. The breach originated in 2013. The data from it has never stopped circulating. When someone has that breached data, they have two immediate options. The first: log in directly. Many people haven’t changed their passwords since 2013, or have reused the same password across services, meaning a password from one leak grants access to others. The second, and often more powerful option: use the email account as a master key for everything it’s still connected to. The password reset chain</h2> Walk through a specific scenario. An attacker has a list of Yahoo credentials from a 2013 breach dump. They’re automated: credential-stuffing</a> tools can try thousands of username/password pairs per hour against a login form. They find one that still works: your old Yahoo address, with the password you haven’t changed in eleven years. They’re now in your inbox. They search for keywords: “confirm”, “welcome”, “account”, “order”. Within seconds they’ve found a six-year-old Amazon order confirmation. They open Amazon, type in the old Yahoo address, and click “Forgot Password.” Amazon sends a reset link to that inbox. The attacker clicks the link. They’re now inside your Amazon account, with access to saved payment cards, shipping addresses, and order history. If you have Amazon Pay configured, other linked services may be reachable too. No sophisticated hacking was required. No vulnerability was exploited. Amazon behaved exactly as designed; the problem is that the recovery address it trusted had been compromised years earlier without the account owner knowing. This chain works with any service that offers email-based password recovery and hasn’t verified that the recovery address is still under the owner’s control. Which is most of them. What those old addresses are connected to</h2> The scope of the problem is wider than most people realise, because the same email address was used across a decade of signups. LinkedIn is a particular exposure. The 2012 breach exposed 6.5 million password hashes — that was the number LinkedIn disclosed at the time. When the full dataset was eventually sold in 2016, the actual figure was 117 million accounts. Many of those accounts still exist, still list the same email addresses, and in some cases still use the same passwords. LinkedIn sent out forced password resets in 2016, but the email addresses themselves remain on record, available to anyone who received the dump. PayPal is high-stakes. Financial services that still list an old email as a recovery mechanism give attackers a direct path to payment data. PayPal allows password resets via email. If the email account is compromised, PayPal’s two-step recovery process becomes irrelevant. Apple ID is significant because of what’s tied to it: purchase history, iCloud photos, Find My, App Store payment methods. Say your Apple ID was created with an old email address, and that address is still listed as the recovery contact, not just the username but the trusted fallback. An attacker with access to that inbox can then trigger an Apple ID recovery flow. Banking portals present the most serious risk. Many UK and US banks still allow account recovery via email if a phone number isn’t available or fails verification. An attacker might control your recovery email and have your account number, which is obtainable from breaches of other services or from fraud-market data brokers. That combination may be enough to initiate a reset of online banking credentials. The bank’s security controls are only as strong as the weakest recovery channel. Dormant social media accounts — old Twitter/X handles, Facebook profiles, forum registrations — are lower stakes financially, but they matter. Attackers use them for identity establishment: posting as you, running scams from your profile, or using your trusted account to send convincing phishing messages to your contacts. When the address gets recycled</h2> Account recycling is a documented attack vector that makes this worse. Both Yahoo and Microsoft have, at various points, decommissioned inactive email addresses and made them available for new registration. If someone new registers your old Hotmail or Yahoo address, they start receiving everything sent to it — including password reset emails from every service you never updated. This isn’t theoretical. Researchers demonstrated the vulnerability in 2013 when Microsoft introduced its recycling policy. Within days of new users registering recycled addresses, they were receiving account confirmation emails, reset links, and notifications from services the previous owner had used. Microsoft has adjusted policies since then. But the underlying architectural risk, services trusting any holder of a given email address, hasn’t gone away. Yahoo’s recycling programme was paused after public criticism but resumed. The precise current status changes. The point is that an attacker doesn’t even need to compromise an email account the traditional way. If your old address was recycled, whoever registered it next has everything you left behind. The abandoned account audit</h2> This is fixable, but it requires going through every old address systematically. Do it once properly and you remove the exposure. Step one: log into every old address you can. This sounds obvious. Most people skip it because the inbox feels irrelevant. Open it. Change the password immediately to something strong and unique, using a password manager</a>. Enable two-factor authentication</a> on the email account itself. Then read the inbox. Look specifically for recent password reset emails or login notifications you didn’t trigger; these tell you if someone is already using the account as a pivot point. Step two: if you can’t log in, attempt recovery. Email providers offer account recovery via phone number, backup email, or security questions. If you can recover access, do it and then follow step one. If you genuinely cannot recover the account — no matching phone, no accessible backup address, failed identity verification — document the address. Accept that it represents a risk you can no longer mitigate directly at source. Step three: find everything connected to those addresses. Search your current email account for terms like “confirm your email”, “welcome to”, “registration”, “account created”. This returns a list of services where you registered using each address. The list is usually longer than expected. Step four: update recovery addresses everywhere. On each service you identify, log in (or trigger a recovery if you can) and change the recovery email to your current, secure address. If you can’t access the account on a given service because it requires recovery to the old address you can’t reach, use the service’s account deletion or identity verification process. This is tedious. It’s worth doing. Step five: for addresses you’ve permanently lost access to. Every service still pointing to those addresses is a single-click breach. Prioritise changing recovery email on anything with financial data or identity information: banking, PayPal, Apple ID, Google, Amazon. These require you to get into the account by other means — customer support, ID verification — before you can update anything. Start with the highest-risk services first. Step six: run breach checks on all your addresses. Have I Been Pwned at haveibeenpwned.com is free, well-maintained, and indexes breaches from Collection #1 onward. Enter every email address you’ve ever used, not just the current one. Subscribe to alerts. If any of your addresses are in a new breach dump, you’ll know within hours rather than months. Monitoring what you can’t fully close</h2> Even after an audit, old addresses don’t disappear from breach circulation. A dataset that includes your Hotmail address from 2012 may be re-sold, recombined, and re-circulated for years. The data doesn’t expire. This means ongoing monitoring matters as much as the one-time clean-up. Most people monitor their primary email address and consider themselves covered. Old addresses go unwatched. A GDPR or CCPA removal request can cover all identifiers associated with one person, including old email addresses, when submitted to data brokers and people-search sites</a> like Spokeo</a>. That doesn’t remove the address from criminal breach databases, which operate outside legal compliance frameworks. But it reduces the surface area for enrichment attacks, where brokers combine breach data with additional personal information. Monitoring several email addresses at once closes the gap that comes from checking each one individually, sporadically, or not at all. KnytX Privacy Shield is built to do this, with unified breach alerts across all your identifiers. It isn’t live yet; join the waitlist</a> to turn it on at launch. The risk isn’t hypothetical and it doesn’t require you to have done anything wrong. Collection #1 alone contained data from hundreds of separate breaches spanning a decade. The people whose addresses appeared in it were victims of compromises at companies whose names many of them had forgotten. The accounts they’d abandoned still held the keys to everything they’d built afterwards. Some found out immediately, because they were monitoring. Most found out too late, if at all. Your old email address is almost certainly in at least one breach. It may still be accepting logins. And unless you’ve explicitly updated your recovery contact everywhere it was ever used, it is probably one inbox away from unlocking your bank, your Amazon account, and your identity documents. Check all your email addresses for breach exposure →</a> Medical Identity Theft: When Someone Uses Your Name Unknown — Thu, 02 Jul 2026 00:00:00 +0000 In 2023, a woman in Phoenix received a collection notice for $120,000. The debt was for a liver surgery — one she never had, never scheduled, and had no knowledge of until the bill arrived. Someone had used her name, her insurance number, and her date of birth to check into a hospital in a different state, received the surgery, and disappeared. Her insurer had already paid a portion. The rest was now being pursued as a patient balance. The surgery had been performed eight months earlier. Her medical records, meanwhile, had been updated with new diagnoses and a blood type entry that was wrong. They also listed post-operative medications that could have caused serious harm if a future physician had acted on them without checking. This is what separates medical identity theft from the credit card variety. Financial fraud is reversible. Disputing charges, freezing accounts, and issuing new cards are established processes that work. Our guide to how identity theft happens</a> covers the financial side. Medical identity theft corrupts something that cannot simply be reset: the clinical record a doctor uses to make decisions about your care. What Medical Identity Theft Actually Does</h2> When a thief uses your identity to obtain medical treatment, they do not just run up a bill. Every procedure, every diagnosis, every medication administered gets written into your record. If a thief has a different blood type, a different medication history, or untreated conditions you do not have, those details now sit in your file. The next time you present at an emergency room unconscious, or need surgery under anaesthesia, the physician working from that record is working from contaminated data. The Ponemon Institute has tracked this fraud category since 2013. It found that the average victim spends $13,500 resolving a medical identity theft case and devotes more than 200 hours to the process. That means writing letters, disputing records with multiple providers, filing complaints, and chasing corrections through a system not built to accommodate them. The US Federal Trade Commission consistently reports hundreds of thousands of victims per year. Most researchers believe the figure is significantly undercounted, because so many cases go undetected or unreported. Financial identity theft triggers alerts. Credit bureaux flag suspicious new account openings. Banks send fraud texts. The infrastructure for catching and signalling financial fraud is decades old and reasonably effective. The medical records system has nothing comparable. There is no single credit bureau for health data. There is no real-time alert when a claim is filed under your policy, and no automatic flag when treatment is documented somewhere you have never been. The result is a category of fraud where victims find out late and the trail is cold. The records they need corrected are scattered across multiple providers, insurers, and systems that do not communicate with each other. How Thieves Obtain Your Medical Identity</h2> Three routes account for the majority of cases, and each is worth understanding because the defences are different. Healthcare data breaches are the largest single source. In 2019, the American Medical Collection Agency was a billing contractor used by Quest Diagnostics, LabCorp, and several other major providers. It suffered a breach that exposed the records of approximately 25 million patients: names, dates of birth, Social Security numbers, and insurance details. The breach went undetected for months. The records surfaced on criminal forums and were sold in bulk. Quest alone notified nearly 12 million patients. Medical records sell for between $10 and $1,000 on dark web markets, depending on completeness. That is far more than credit card numbers, which fetch under a dollar each, because a full medical record enables both healthcare fraud and financial fraud at once. Insider theft at medical facilities is the second major route. People with system access — billing clerks, receptionists, nurses, administrative contractors — sometimes sell patient records directly. In 2014, a Cedars-Sinai employee was caught accessing the records of celebrity patients and leaking them to tabloids. The same access that enables tabloid snooping enables identity fraud. The difference is motive. A low-paid billing contractor who can sell fifty patient records for $500 each faces a temptation the healthcare system has not structurally addressed. Social engineering is the third route, and the most preventable. The most common version is a phone call claiming to be from your insurer or Medicare. It asks you to “verify” your membership number, date of birth, or insurance ID. The caller often knows your name already, because it takes nothing to find that on a data broker site like Spokeo</a> or Whitepages</a>. The request sounds routine. Medicare recipients are specifically targeted because Medicare ID numbers were, until 2018, the Social Security number itself. CMS has since issued new alphanumeric Medicare Beneficiary Identifiers, but old numbers remain compromised for anyone enrolled before the switch. The 1-800-MEDICARE number exists precisely because this scam is so persistent. The Detection Problem</h2> Most victims discover medical identity theft in one of three ways. The first is an unexpected bill for treatment they did not receive. The second is an insurance claim denial saying their annual benefit limit has been reached. The third is a visit to a new provider, where the medical record in front of the doctor contains information the patient does not recognise. None of these are early warning signals. By the time a bill arrives or a claim is denied, the fraud has typically been running for months. The Ponemon Institute’s research found the average time between the start of medical identity theft and discovery is 14 months. Fourteen months of claims being filed, records being altered, and your insurance paying out on procedures you know nothing about. There is a detection tool that most people ignore: the Explanation of Benefits letter. Every time a claim is filed against your health insurance, your insurer sends you an EOB. It is a document showing what was claimed, what was paid, and what you owe. Most people, particularly those who are not actively unwell, treat these as administrative noise and throw them away. Reading them carefully is genuinely the fastest way to catch this fraud early. Watch for a claim from a facility you do not recognise. Watch for a date when you were definitely not receiving treatment, or a procedure that does not match any appointment you recall. These are the flags. Request a complete claims history from your insurer if you have not kept your EOBs. Most insurers will provide several years on request. This is not a significant burden on their part; they maintain this data for their own reasons. Ask for it, and actually review it. The Legal Framework and Who Can Help You</h2> In the United States, the machinery for addressing medical identity theft exists, though it requires you to drive it. The FTC’s IdentityTheft.gov handles medical identity theft alongside financial fraud. Filing a report there generates an Identity Theft Report — a formal document that has legal weight when disputing fraudulent accounts and records. The FTC will also create a personalised recovery plan. Do this first; you will need the report for almost every subsequent step. HIPAA gives you two specific rights that matter here. Under 45 CFR § 164.524, you have the right to access your medical records from any covered healthcare provider within 30 days of request. Under 45 CFR § 164.526, you have the right to request amendment of your records if you believe they are inaccurate or incomplete. The provider can deny an amendment request, but they must document the denial and your disagreement. They must also include your written statement of dispute in your record going forward. The practical sequence: file at IdentityTheft.gov first. Then write to each healthcare provider where fraudulent records appear, enclosing a copy of the Identity Theft Report, and formally invoke your right to amendment under HIPAA § 164.526. Also request an accounting of disclosures — HIPAA requires providers to tell you who your records have been sent to in the previous six years. This tells you how far the contaminated record has already travelled. Contact your insurer’s Special Investigations Unit, not general customer service. Every major insurer has an SIU whose job is exactly this kind of fraud. A standard customer service rep cannot order a fraud investigation or reverse payments; the SIU can. Ask specifically to be transferred or to have your case escalated to that unit. For Medicare recipients, report to the HHS Office of Inspector General hotline (1-800-HHS-TIPS). Then review your Medicare Summary Notice — the equivalent of an insurer’s EOB — for any unfamiliar claims. The OIG takes Medicare fraud seriously because it affects programme finances, and they have investigative resources. Outside the United States, the frameworks differ but the rights exist. In the UK, the NHS has a formal complaints process, and the Information Commissioner’s Office handles data protection complaints under UK GDPR. If your NHS records contain inaccurate information from someone else’s treatment, you have a right to have them corrected. In EU member states, GDPR Article 16, the right to rectification, applies directly. Healthcare providers are data controllers; they are obligated to correct inaccurate personal data on request. What to Do Right Now</h2> You do not need to have discovered fraud to take protective steps. Most of these are one-time actions that take less than an hour. Review your EOBs. Request a complete claims history from your insurer if you do not have the letters. Go through it looking for providers you do not recognise, dates that do not align with any appointment, or treatments you did not receive. Flag anything suspicious in writing. Access your medical records. In the US, you can request records directly from each provider you have seen. Many now offer access through patient portals — MyChart is the most common. If records contain information you do not recognise, document it and prepare a HIPAA amendment request. Check your Medical Information Bureau file. The MIB is a database used by insurers when evaluating life, health, and disability insurance applications. It holds coded records of conditions disclosed on applications. You are entitled to one free report per year at mib.com. This will not catch all medical identity theft, but it may surface conditions or diagnoses you did not disclose because you do not have them. If you suspect active fraud, contact your insurer’s SIU directly. Explain what you have found and ask them to open a fraud investigation. Get a case reference number. Then file the FTC report and begin sending HIPAA amendment requests to each affected provider. For Medicare recipients, review every Medicare Summary Notice you receive. You can also access your claims history through Medicare.gov. Report any suspicious claims to 1-800-MEDICARE (1-800-633-4227) or the HHS OIG hotline. Do not discuss your Medicare Beneficiary Identifier with anyone who calls you — Medicare does not make unsolicited calls asking for this information. Document everything. Keep copies of every letter you send and receive, every reference number from every phone call, and every response from providers and insurers. Resolving medical identity theft takes months and sometimes years. The victims who resolve it most effectively are those who treated it from the start as a paper trail to be meticulously maintained. One more thing: if you do discover your records have been corrupted, tell your current doctors explicitly. Do not assume the amended record will reach everyone who needs to see it quickly enough. Maybe your blood type was wrong in a record. Maybe a drug allergy was added that you do not have, or a condition was documented that you do not have. If so, tell the physicians treating you now, in person, and ask them to note the discrepancy in your current file. Medical identity theft is unusual among fraud categories in that the financial harm, while serious, is the secondary problem. The primary problem is the clinical one: decisions made about your body, by people acting in good faith, on information that belongs to someone else. See what a scan finds →</a> walks through an example report of the kinds of personal data brokers expose. KnytX Shield isn’t live yet; join the waitlist</a> to run your own scan at launch. How Breach Data Gets Sold on Criminal Markets Unknown — Wed, 01 Jul 2026 00:00:00 +0000 In April 2021, RaidForums hosted the public release of a database with personal information for 533 million Facebook users across 106 countries. At the time, RaidForums was the largest English-language hacking forum by active membership. The data included phone numbers, full names, locations, birthdates, and email addresses. It had been scraped from Facebook using a contact importer feature in 2019. Facebook’s response when journalists reported it: this was “old data” and the “vulnerability was found and fixed in August 2019.” That statement was narrowly true and broadly useless. The dataset was freely available for download within hours. Within days, independent researchers had built a lookup tool so anyone could check whether their phone number was in it. The data remains in circulation. RaidForums itself was seized and shut down by the FBI in April 2022 — but the dataset has since appeared on its successors, repackaged, recombined, and still usable. The Facebook leak is not unusual. It is typical. What makes it instructive is its scale and the clarity of the market’s response. It also shows the gap between what companies say about old breaches and what actually happens to the data afterwards. The short answer: After a breach, stolen data moves through a commercial pipeline. It’s validated, graded, and priced on structured dark-web markets. Email and password pairs sell for cents, credit cards for $5–35, “fullz” identity packages for $15–40, and medical records for $20–100. Data cascades from top buyers down to free combo lists, staying usable for years. Stealer-log markets add a real-time layer of freshly stolen credentials. Market takedowns disrupt but don’t erase copies already sold. Your best defence is unique passwords, breach alerts, and transaction monitoring. In this article: How the markets operate</a></li> How data is graded and priced</a></li> The resale cascade</a></li> Stealer log markets: the real-time layer</a></li> Law enforcement action and its limits</a></li> What you can do about it</a></li> Frequently asked questions</a></li> </ul> How do the markets operate?</h2> Dark web markets for stolen data are not shadowy, disorganised IRC rooms. They are commercial platforms with customer support, dispute resolution systems, searchable databases, and structured reputation mechanisms. The well-documented forums include RaidForums (seized April 2022), BreachForums (seized March 2023, relaunched, seized again in May 2024), Exploit.in (still operating as of writing), and XSS.is (a Russian-language forum, also still active). These are indexed databases, not information dumps. Sellers list data with sample records for verification, describe the breach source and date, and set pricing in cryptocurrency, typically Monero or Bitcoin. Vendors build reputations across dozens of transactions. Bad data — samples that fail validation, card numbers that have already been cancelled, email lists that bounce at high rates — generates negative reviews and tanks a seller’s standing. Verified, fresh data from sellers with established track records commands significant price premiums. The mechanics are meaningfully similar to any e-commerce marketplace, which is precisely what makes them effective. Genesis Market, before Europol’s “Operation Cookie Monster” seizure in April 2023, was one of the most sophisticated examples. Genesis didn’t just sell usernames and passwords — it sold complete browser fingerprints. A Genesis “bot” was a packaged collection of browser session cookies, saved credentials, and device configuration data extracted from a victim’s machine by infostealer malware. Buyers could import a Genesis bot into a browser plugin and impersonate the victim’s browsing session: same device fingerprint, same cookies, same active authenticated sessions. Logging in as someone without knowing their password, because you’re presenting as their device. That’s qualitatively different from a credential list. How is data graded and priced?</h2> Before data reaches market, it is typically validated. Automated tools check whether email addresses are live and whether passwords still authenticate against targeted services (credential stuffing validation). They also check whether credit card numbers pass the Luhn algorithm and return valid Bank Identification Numbers. Freshness and validation status drive pricing. The price ranges below are drawn from Experian’s annual Dark Web Price Index, Trustwave SpiderLabs research, and Flashpoint threat intelligence reports — all publicly published: Email address and password pairs: $0.01–0.10 per record in bulk. This is commodity data. Hundreds of billions of email/password combinations are in circulation from years of accumulated breaches. Volume discounts apply; a list of one hundred million unvalidated combinations might sell for hundreds of dollars. Email address, phone number, and full name: $0.50–2.00 per record. More useful for targeted phishing and SIM-swapping attacks, where knowing a victim’s phone number is necessary. Credit card with CVV (UK domestic or US domestic): $5–20 per card, depending on the card’s credit limit, the issuing bank, and how recently the data was obtained. Cards near or above a $10,000 limit sell at the high end. Credit card with CVV (European or UK international-use card): $20–35 per card. European cards historically achieve better fraud bypass rates due to differences in how merchants in certain regions handle card-not-present transactions. “Fullz” — a complete identity package including Social Security number, date of birth, address, driver’s licence number, and bank account details: $15–40 per identity. Used to open fraudulent accounts, apply for credit, or submit false tax returns. Medical records: $20–100 per record, making them among the highest-value data categories per record. Medical data is used for insurance fraud — submitting claims for procedures that didn’t happen — and for prescription drug fraud. Medical records also contain enough personal detail to make identity theft straightforward. Corporate network access sold by initial access brokers: $100 to $25,000 or more. Price depends on the company’s size, sector, the level of access obtained, and whether it includes domain administrator credentials. An initial access broker doesn’t run the intrusion themselves. They sell the foothold to ransomware operators or espionage groups who conduct the larger attack. The grading process also distinguishes “combo lists” — email and password pairs that have been pre-validated against specific services (Netflix, Spotify, PayPal, banking portals) — from raw unvalidated dumps. Validated combo lists command a significant premium because the checking work is already done. Some criminal services offer checking-as-a-service: submit a raw credential list, pay a fee, receive back only the pairs that successfully authenticated. The resale cascade</h2> A breach database doesn’t get used once and discarded. It cascades. First-wave buyers — typically the most capable and best-resourced criminal groups — extract maximum value quickly. They run credential-stuffing attacks, drain financial accounts, and sell any access they establish. Then they pass the remaining records downstream. Second-tier buyers pay less for data that’s been partly picked over. From there it migrates further: to public paste sites (Pastebin, various Ghostbin successors) and to free file hosts. Eventually it lands in aggregated “combo lists” that bundle records from dozens of separate breaches into single files, sold in batches of hundreds of millions. The Adobe breach from October 2013 exposed 153 million records. It included email addresses, poorly encrypted passwords, and password hints stored as plain text. That data is still appearing as a component of credential combo lists over a decade later. The individuals whose passwords were reused across other accounts have continued providing value to attackers for twelve years. This is why breach exposure is not time-bounded by the breach date. Once a credential appears in a combo list, it will be tested and re-tested for years. Changing your password on the specific breached service helps. If the same password was used anywhere else, those accounts remain at risk indefinitely until each one is updated. Stealer log markets — the real-time layer</h2> Separate from static breach databases, stealer log markets operate on a different model: near-real-time sale of outputs from infostealer malware actively running on compromised devices. Russian Market, 2easy.shop, and STYX Market are among the active examples. Genesis Market, before its takedown, was the most technically sophisticated. These markets sell “logs,” which are automated exports from malware installed on a victim’s machine. The malware usually arrives through a malicious download, pirated software, or a phishing email. A single log contains a lot: every password saved in the victim’s browsers, all active session cookies (enabling session hijacking without the password), form autofill data including addresses and payment card numbers, and device fingerprints including browser configuration, installed extensions, and timezone. The value is immediacy. These aren’t credentials from a three-year-old breach. They’re credentials the victim used last Tuesday, with active session cookies that may still be valid. NordVPN’s research published in 2023 found over 54 million stolen credentials on dark web markets across a 12-month window. Of those, 26 million came from stealer malware logs rather than traditional database breaches. The distinction has practical consequences. Breach notification services like Have I Been Pwned index known breach databases. Stealer log markets operate outside that visibility. You won’t receive a breach alert for data stolen from your browser by malware on your own machine. Law enforcement action and its structural limits</h2> The pace of law enforcement action against criminal data markets has genuinely accelerated since 2022. The record is substantial: RaidForums seized April 2022. Genesis Market seized April 2023 in Europol’s Operation Cookie Monster, with 119 arrested across seventeen countries. BreachForums seized March 2023, its administrator ShinyHunters arrested. AlphaBay taken down in 2017 — at the time the largest dark web market — in a joint FBI, DEA, and Dutch National Police operation. Hansa Market taken down in the same 2017 operation. These are meaningful disruptions. They are not permanent solutions. Forum administrators migrate to new infrastructure. Communities rebuild around new domains. BreachForums was seized in March 2023, relaunched within weeks under new administration, and the relaunch was seized again in May 2024. The underlying criminal economy generating the data — ransomware operations, infostealer malware campaigns, insider data theft — continues regardless of what happens to any particular marketplace. More fundamentally: the data sold before a forum’s takedown remains in the possession of everyone who bought it. Law enforcement shutting down the marketplace does not erase the copies already distributed. The Facebook dataset from 2021 was circulating on RaidForums when the FBI seized it. The seizure didn’t delete the copies in buyers’ hands. The data has appeared on BreachForums, on Telegram channels, on file hosts, and continues to be used in SIM-swapping attacks and account takeover fraud years later. What can you do about it?</h2> None of this is abstract risk. Your credentials may already be in circulation. The question is whether you know, and whether you’ve limited the damage. Check your breach exposure. Have I Been Pwned (haveibeenpwned.com) indexes breach databases and alerts you when your email address appears in a new one. Sign up for alerts for every email address you use. This doesn’t cover stealer log markets, but it covers the major public breach databases and catches most large incidents. Use a password manager with unique passwords everywhere. This is the single most effective mitigation against credential stuffing. If every account has a different password, a breach of one account doesn’t give attackers access to others. The value of a stolen credential collapses to just that one site rather than everything you’ve ever signed up for. Enable transaction alerts on all financial accounts. Credit card fraud from freshly stolen card data typically begins within 48 to 72 hours of the data appearing on a market. Real-time transaction alerts let you identify and dispute fraudulent charges before they compound. Monitor your credit reports for new account openings. In the UK, check your reports through Experian, Equifax, and TransUnion — all three, because they don’t always match. In the US: annualcreditreport.com gives you free weekly reports from all three bureaus. A credit freeze — not a fraud alert, but an actual freeze — prevents new credit accounts being opened in your name without your active unfreeze step. It is free in both the UK (through each bureau directly) and the US (federally mandated free freeze since 2018). Consider a dark web monitoring service that covers stealer log markets specifically. Most consumer identity monitoring services scan breach notification databases. Fewer cover the stealer log markets where real-time credential theft shows up first. Look for services that explicitly state stealer log coverage before subscribing. The criminal economy that handles stolen data is efficient precisely because it is decentralised, competitive, and self-correcting. Individual market takedowns disrupt it; they don’t stop it. The practical response is to reduce what you stand to lose when, not if, your data appears somewhere in this pipeline. Frequently asked questions</h2> How much does stolen data sell for? Email and password pairs go for cents in bulk. Credit cards with CVV fetch $5–35, “fullz” identity packages $15–40, and medical records $20–100. Corporate network access can reach $25,000 or more. How long does breach data stay usable? Years. The 2013 Adobe breach still appears in credential combo lists over a decade later. Once a password is in circulation, attackers test it repeatedly. Any account reusing it stays at risk until you change it. Does a market takedown delete my data? No. Seizing a forum stops that platform, but it doesn’t erase copies already sold. The data reappears on successor forums, Telegram channels, and file hosts, and stays in use for years. What are stealer logs? They’re real-time exports from malware on a victim’s device: saved passwords, active session cookies, and autofill data. Breach checkers like Have I Been Pwned index poorly, so you may get no alert. This is also how data ends up feeding people-search sites</a>. What you can do right now</h2> Want to see what data brokers expose about you? See what a scan finds →</a> shows an example report: the kinds of sites that list your name, phone, and address. Once KnytX Shield launches it will find and remove these listings automatically. Join the waitlist</a> to get in early. Dating App Location Privacy: Who Buys Your Data Unknown — Tue, 30 Jun 2026 00:00:00 +0000 It is 11 pm in a city where same-sex relationships remain socially punishable even if no longer criminally prosecuted. A man opens Grindr, scrolls the grid, messages someone two kilometers away. The app needs his location to do its job. That’s the entire premise. He knows the app knows where he is. What he doesn’t know is that this location data is being packaged alongside his device identifiers and passed to advertising networks. A data broker is buying it. A determined person can purchase the same dataset and trace the device back to his apartment building. It could be a journalist, a hostile family member, or a government contractor. He thinks the risk is someone seeing his profile. The risk is someone who never opens the app. What dating apps actually collect</h2> Most people understand that dating apps know who they’re attracted to. Fewer understand the full inventory. Precise GPS coordinates — not neighborhood-level, but accurate enough to identify which building you’re in — are core to how proximity-based apps function. The location data they collect is more precise than what most apps request, because imprecision would break the product. Beyond location: photos, sexual orientation entered explicitly, religious and political preferences from profile questions, message content stored on company servers without end-to-end encryption. And then the behavioral layer — who you swipe on, who you match with, how long you linger on a profile. This data is rarely mentioned in privacy summaries. It is collected continuously. Grindr and the advertising SDK problem</h2> In 2020, the Norwegian Consumer Council published a report called “Out of Control.” It documented how Grindr shared user data with multiple advertising partners through its in-app advertising SDK. That data included precise location and the fact that the user was on Grindr. The data flows happened automatically, continuously, without meaningful user consent. The Norwegian Data Protection Authority (Datatilsynet) responded with a fine of NOK 65 million — approximately €6.5 million — in 2021. Grindr appealed. The Privacy Appeals Board (Personvernnemnda) upheld the NOK 65M fine on appeal in 2022; a later reduction to NOK 6.5M came through subsequent court proceedings. The behavior that triggered the fine had already run for years. In January 2023, the Federal Trade Commission fined Grindr $7 million in a separate action focused on the company’s practice of sharing users’ HIV status with advertising partners. HIV status — disclosed by users in their own profiles, in some cases — was flowing to advertisers. The FTC’s complaint made clear this was not an accidental data leak. It was a structural consequence of how the advertising SDK was integrated. Two enforcement actions, two countries, two separate violations. Both trace back to the same underlying problem. A company built its revenue model on selling the data of a uniquely vulnerable user population. The Catholic priest case</h2> In July 2021, The Pillar — a Catholic news outlet — identified a senior official of the United States Conference of Catholic Bishops as a Grindr user. They purchased commercially available location data from a data broker, cross-referenced it with known locations associated with the official, and identified his device from the movement pattern. He resigned within days. The data used was sold as “anonymized.” The brokered dataset contained no names. What it held was a device identifier, a timestamp, and a GPS coordinate. That set repeated tens of thousands of times, tracing the movement of a specific device across months. Device identifiers are pseudonymous, not anonymous. Pair them with any other identifying dataset and you can undo the anonymity. That could be an employer’s records, a church staff directory, or a lease. The Pillar did exactly this. The case collapsed the standard reassurance. Defenders of location data sales argue that anonymized data is safe. What “anonymized” means in practice is that a name has been removed from a file that still contains everything necessary to recover it. The trilateration attack</h2> Apps that display distance to nearby users (“1.2 km away”) have a structural weakness. A person sets up three fake accounts at different known spots. From each account, they query the same target profile. With three distances, they can solve for the target’s exact coordinates. Researchers demonstrated this against Grindr concretely. Grindr removed exact distance figures afterward. Altered versions of the feature persist across many apps and keep part of the same weakness. The attack requires patience and multiple accounts. That’s all. The India context</h2> The Supreme Court’s 2018 decision in Navtej Singh Johar v. Union of India struck down Section 377 of the IPC as it applied to consensual same-sex relations between adults. This was a significant legal change. It did not eliminate the practical risks that LGBTQ+ Indians face. Employment discrimination, family rejection, and social ostracism remain common outcomes when someone is outed — regardless of whether criminal prosecution is possible. In many parts of India, the gap between legal status and social reality is wide enough that exposure through a dating app carries serious consequences. Grindr, Scruff, HER, Tinder, and Bumble all have Indian user bases. The Digital Personal Data Protection Act</a> designates certain categories of data as sensitive, which provides a framework. But enforcement is still developing. And nothing in the Indian regulatory landscape matches the Norwegian Consumer Council or the FTC’s active monitoring of data broker sales. No organization in India is systematically tracking whether dating app location data from Indian users is appearing in commercial data broker catalogues. It almost certainly is. Why “just don’t use the apps” is the wrong answer</h2> The people at highest risk from dating app data sales are often those for whom the apps matter most. The apps connect people who cannot safely be visible in physical spaces. The privacy failures are worst precisely for the users who need privacy most. That’s not an argument against using the apps. It’s an argument for understanding what you’re accepting when you do. What you can do</h2> On Grindr: Settings > Privacy > Enable “Incognito Mode.” This keeps your profile out of distance-based searches. That limits the trilateration attack surface and reduces how broadly your profile is visible to other users. Use approximate location on your phone. Android 12 and iOS 14 both allow you to grant apps approximate location rather than precise location. Many dating apps still function with approximate location — they can tell you someone is nearby without knowing your address. Go to your phone’s app permissions and set location to “approximate” for any dating app that doesn’t require precision to be useful to you. Set location permission to “while using the app” only. No dating app needs location access when you’re not actively using it. “Always on” location permissions let the app record your location at any time. That includes when you’re at home, at work, or at a place you wouldn’t want recorded. Separate your dating app identity from your primary identity. Use an email address not linked to your real name. Avoid Facebook login — it passes your identity directly to the app and connects your dating profile to your social graph. Review app permissions. Many dating apps request access to contacts, microphone, and photo library beyond what they need to function. Revoke permissions you didn’t consciously grant. The data that dating apps generate is location attached to sexual identity attached to message content. The combination is more dangerous than any single element. Treating it that way — limiting precision, separating identities, restricting permissions — is not paranoia. It is proportionate. What you can do right now</h2> Want to see what data brokers expose about you? See what a scan finds →</a> shows an example report: the kinds of sites that list your name, phone, and address. Once KnytX Shield launches it will find and remove these automatically. Join the waitlist</a> to get in early. License Plate Readers: A Map of Everywhere You Drive Unknown — Mon, 29 Jun 2026 00:00:00 +0000 You leave home at 7:43 AM. The ANPR camera at the junction reads your plate. You stop at the hospital for a routine test — another camera at the entrance gate logs you in and out. You drive past a religious site on the way back. A traffic enforcement camera at the intersection captures the plate. You pull into the mall parking structure in the evening. The parking operator’s camera logs your entry time. By the end of an ordinary Thursday, five separate systems have recorded where your vehicle was, at what time, and for how long. None of this required you to do anything wrong. None of it required a warrant. What ANPR systems actually do</h2> Automatic Number Plate Recognition works the same way everywhere. It is called ANPR in India and the UK, and License Plate Reader or LPR in the US. A camera photographs passing vehicles. Software reads the plate number from the image. The system logs the plate number, the timestamp, and the GPS coordinates of the camera. The record is stored. That’s it. There is no threshold of suspicion required. Your vehicle doesn’t need to be flagged, wanted, or even unusual. Every vehicle that passes gets logged. The data sits in a database, searchable and — depending on the operator — shareable. The US market: what commercial ANPR looks like at scale</h2> The US context is worth understanding because it shows where commercial ANPR can go when it’s left to grow without meaningful regulation. Motorola Solutions acquired Vigilant Solutions in 2019. Vigilant operates LEARN, the Law Enforcement Archival and Reporting Network. It is a commercial database of license plate scans that, by various reports, has piled up billions of records. Law enforcement agencies subscribe to query it. The data comes from police-operated cameras. It also comes from commercial sources: repo companies, parking operators, and private ANPR networks that scan plates as a side effect of their core business. Flock Safety sells ANPR cameras to homeowners’ associations, apartment complexes, and businesses. The footage feeds into a shared database that law enforcement can query without a warrant, because private parties collected it. Flock calls this a network of “community cameras.” What it builds is a surveillance system that skips the constitutional limits that would apply if police deployed the same cameras themselves. Private collection. Commercial pooling. Law enforcement access. No warrant. No notification. India’s ANPR deployment</h2> India’s ANPR infrastructure is younger but growing quickly, and it’s embedded in official systems in ways that make it structurally harder to contest. Traffic enforcement ANPR cameras operate at major intersections in Delhi, Mumbai, Bengaluru, Chennai, and other large cities. They are used for red light violations, speed enforcement, and stolen vehicle detection. The enforcement use case is legitimate. The data retention policy — how long records of innocent vehicles are kept, who can access them, and whether they can be shared — is not publicly documented in any consistent way. The Vaahan database, maintained by the Ministry of Road Transport and Highways, is India’s central vehicle registry. Every plate number links to an owner’s name, address, and vehicle history. When an ANPR camera captures a plate, a Vaahan lookup converts it into a person. The camera reads a plate; the database reads a life. Delhi Police’s CCTNS — the Crime and Criminal Tracking Network and Systems — links to ANPR data for vehicle-based investigations. The concern is scope. CCTNS was designed for criminal case tracking. But the ANPR data it draws on covers every vehicle that passed a camera, not just vehicles linked to crimes. Bengaluru and Hyderabad police have publicly confirmed ANPR deployment for traffic management and investigation. Some cities have integrated ANPR feeds into Smart City Integrated Command and Control Centres. The command center framing sounds managerial. It is also a persistent, queryable record of urban movement. What a license plate history actually reveals</h2> A single scan tells you little. A history tells you almost everything. A record showing your vehicle visited a specific hospital three times in two months says something medical. Visits to a religious site say something about faith. A legal aid office, a political party headquarters, a protest location, a psychiatric clinic — all of these are inferences waiting to be drawn from a stack of timestamped records. This is the argument the US Supreme Court addressed in Carpenter v. United States in 2018. The court held that historical cell-site location data constitutes a detailed chronicle of a person’s physical presence and that accessing it requires a warrant. Chief Justice Roberts wrote that the data “provides an intimate window into a person’s life, revealing not only his particular movements, but through them his familial, political, professional, religious, and sexual associations.” Plate reader data is a direct analogue. It hasn’t received equivalent legal protection anywhere, including in India. The difference between a one-time location check and a historical record is the difference between knowing where someone is and knowing who they are. Aggregated over months, a movement profile is more revealing than a wiretap. It is one more feed into the broader location tracking picture</a> that phones, apps, and cameras build together. The commercial angle</h2> In the US, commercial ANPR data is bought and sold. Debt collectors use it to find vehicles for repossession. Insurance companies use it to check driving patterns. Private investigators query commercial ANPR databases routinely. No warrant is required, because private parties collected the data. In India, commercial ANPR is still young. Parking operators at major malls and airports are installing ANPR to manage entry and exit, which is a legitimate use. Whether that data is kept beyond the operational need, or shared with third parties, is not publicly documented. The US path suggests asking that question now, before the market grows. The legal position in India</h2> No specific law governs ANPR data retention or sharing in India. Police ANPR operates under departmental standing orders — documents that are rarely public and contain no mandatory purge timelines for records of innocent vehicles. The Digital Personal Data Protection Act 2023</a> would in principle apply to vehicle data linked to a person. And through Vaahan, plate data is almost always linkable. But the Act carries broad, loosely bounded exemptions for law enforcement. In practice, police ANPR data sits outside any meaningful accountability framework. The absence of rules is not neutrality. It defaults to retention, accumulation, and access without oversight. What you can do</h2> The options are limited, and it’s worth being honest about that. Anti-surveillance measures — plate covers, infrared LED arrays — are illegal under Indian motor vehicle regulations. Don’t use them. When traveling somewhere sensitive, public transit creates a less centralized data trail than driving. Bus and metro journey data is fragmented across operators rather than aggregated into a single vehicle-linked record. Meaningful difference, not a complete solution. RTI requests are underused. File a Right to Information request with your city’s traffic police or smart city authority asking about ANPR retention policies, data sharing agreements, and access logs. You may not get a complete answer. You will create a paper trail. Keep your vehicle registration address current in Vaahan. Inaccurate records cause problems during enforcement stops — unrelated to surveillance, but worth fixing. Advocate for retention limits. Time-limited deletion for records of vehicles not linked to any investigation is the policy change that actually matters. That requires engagement with DPDPA implementation consultations and state traffic authority rule-making. Slow work. The only work that fixes the problem structurally. What you can do right now</h2> Want to see what data brokers expose about you? See what a scan finds →</a> shows an example report: the kinds of sites that list your name, phone, and address. Once KnytX Shield launches it will find and remove these automatically. Join the waitlist</a> to get in early. Remote Work Surveillance: What Bossware Does Unknown — Sun, 28 Jun 2026 00:00:00 +0000 It’s 11:14 AM on a Tuesday. You’ve been working from home for two years. You step away from your desk to get water, come back, and continue drafting a report. Nothing about this feels unusual. But while you were gone, your employer’s monitoring software did three things. It took a screenshot of your screen. It logged that you had no mouse or keyboard activity for four minutes. And it updated your “productivity score” downward. This is not a hypothetical. It’s the routine operation of tools that millions of employers deployed during the remote work shift — and never removed. The category has a blunt name: bossware. And it does exactly what the name implies. What bossware actually does</h2> Screenshot capture is the feature most people have heard of. Tools like Hubstaff, Time Doctor, and Teramind take screenshots at set intervals — typically every few minutes — and store them in a dashboard your manager or HR team can review. Some products let employers adjust the frequency. Some blur the screenshots by default; many don’t. That’s the obvious part. The less obvious parts are harder to detect. Keystroke logging records what you type — in documents, browsers, and chat applications. Some products log continuously; others sample. Either way, the data is stored and retrievable. Application and website monitoring tracks which programs you have open, which URLs you visit, and how long you spend in each. Twenty minutes on a news site at lunch is logged. A personal project open in a text editor is logged. The employer sees a timeline of your entire workday at the application level. Productivity scoring is where it gets particularly strange. AI-driven systems — Teramind has one, Time Doctor has one — take all this activity data and collapse it into a score. They decide whether your activity counts as “productive” or “unproductive” based on rules the employer configures. Reading a competitor’s documentation might count as unproductive. A sales call that requires long listening periods looks like idle time. Mouse movement tracking treats movement as a proxy for working. It’s why some remote workers have started using mouse jigglers — devices or scripts that simulate movement. That tells you everything about the relationship between this metric and actual productivity. Webcam recording is available in some products. Controlio offers video recording through the device camera during work hours, configurable by the employer. Communication monitoring goes further still. Some enterprise tools scan the content of Slack messages and Teams chats for keywords or policy violations — content-level analysis of what employees write to each other, not just metadata. The products doing this</h2> Hubstaff is widely used in India for managing distributed and remote teams. It offers screenshot capture, time tracking, activity level scores based on keyboard and mouse input, and URL monitoring. Time Doctor has deep penetration in India’s BPO sector — it tracks time at the task level, captures screenshots, and generates reports employers use for payroll and performance reviews. BPOs have used it for years; remote work brought it to roles that were previously unmonitored. Teramind sits at the more intensive end of the market. Beyond screenshots and activity tracking, it offers behavior analytics and data loss prevention features that flag if sensitive files are being moved or copied. It’s positioned for organizations where data security is the stated justification — banks, healthcare firms, legal companies. Microsoft Viva Insights arrives differently — not as a third-party install, but as a component of Microsoft 365 that administrators enable. It gives managers aggregate team analytics: focus time, collaboration patterns, after-hours work, meeting load. Microsoft frames this as wellbeing data, anonymized at the team level. Most employees don’t know it’s on. The India context — and what the law says</h2> India’s BPO and IT services sector was using monitoring software long before remote work normalized it for white-collar roles. The justification is real: these companies process sensitive data for global clients — banking records, healthcare information, customer support — and monitoring is part of the compliance they sell to those clients. The problem is that the same infrastructure has now extended well beyond that context. The monitoring built for data security in a BPO has become productivity surveillance in software companies, with most employees never told it exists. No specific Indian law prohibits employee monitoring on company-owned devices and networks. The Digital Personal Data Protection Act 2023</a> adds one meaningful requirement. Employers acting as data fiduciaries must inform employees about what personal data is being collected and for what purpose. Whether a keystroke log or a productivity score counts as “personal data” under the DPDPA is unsettled. But the transparency obligation is real. The contrast with European law is instructive. In France, employers must consult the works council before deploying monitoring software. In Germany, works council consent is required. Under GDPR, keystroke logging faces substantial compliance barriers — lawful basis, proportionality, notification. India has no equivalent constraint. An Indian employer can deploy monitoring software without asking. Whether they should is a separate question they mostly haven’t asked themselves. How to tell if monitoring software is on your work computer</h2> If your employer issued the device, assume monitoring software is present. This is the realistic baseline. But you can check. On Windows, open Task Manager and go to the Details tab. Look for processes like tdagent.exe</code> (Time Doctor), hubstaff.exe</code> (Hubstaff), or teramind.exe</code> — though names vary by version, so search any unfamiliar process name online. On Mac, open Activity Monitor and check for unfamiliar processes with constant low-level network activity, which is characteristic of tools uploading screenshots. Check the installed applications list for anything with “monitoring,” “time tracking,” or “productivity” in the name. Not seeing it doesn’t mean it isn’t there. Some products run as background services specifically designed not to be obvious. What you can do</h2> Keep personal activity off work devices entirely. Use your phone or a personal laptop for anything that isn’t work. This isn’t paranoia — it’s the appropriate response to a realistic situation. Ask your employer directly what monitoring software is deployed. “What tools does the company use to track time or productivity for remote employees?” is an increasingly reasonable HR question. How your employer answers it tells you something about how they approach this relationship. If your performance reviews reference productivity scores or activity data, you have standing to ask what data was used and how it was calculated. Request the underlying logs. Don’t accept a score without understanding what generated it. If you work for a European company as a remote contractor, GDPR gives you explicit access rights. You can formally request a copy of the personal data that’s been collected about you. The employer is required to respond. The productivity paradox</h2> Research on remote work consistently finds that people who are trusted to manage their own time perform better and stay longer than those under heavy surveillance. This is not surprising. What bossware measures is activity patterns — mouse movement, keystrokes, URLs — not whether the work produced is any good. A developer who thinks through a complex problem for thirty minutes before writing code registers as unproductive. A support agent copy-pasting canned responses registers as highly productive. The software optimizes for what it can see, and what it can see is not work quality. The tool deployed to ensure productivity often produces the exact performative busyness it was meant to prevent. People move their mouse more. They keep work-adjacent tabs open. They optimize for looking active. Employers who understand this have moved away from bossware. The ones who haven’t are paying for dashboards that tell them everyone is working hard. Meanwhile they get less from their teams than they would have if they had simply left them alone. What you can do right now</h2> Want to see what data brokers expose about you? See what a scan finds →</a> shows an example report: the kinds of sites that list your name, phone, and address. Once KnytX Shield launches it will find and remove these automatically. Join the waitlist</a> to get in early. How Stores Track You: Bluetooth Beacons and Wi-Fi Unknown — Sat, 27 Jun 2026 00:00:00 +0000 You walk into a mall on a Saturday afternoon. You pass through the main entrance, drift toward a sportswear store, spend twelve minutes browsing, leave without buying anything, and end up at a food court. You’re not logged into anything. You didn’t scan a QR code. You haven’t touched the mall’s Wi-Fi. Your phone is in your pocket. You were still tracked. The whole time. Bluetooth beacons: the hardware you walk past without noticing</h2> Retailers and mall operators deploy small, inexpensive devices called Bluetooth Low Energy (BLE) beacons throughout their spaces — mounted near entrances, attached to shelving units, placed at aisle intersections. Each beacon broadcasts a constant signal. When a Bluetooth-enabled phone comes within range, the beacon logs the device’s MAC address, its own beacon ID, and a timestamp. Do this across dozens of beacons in a single store, and you have a movement trace. It shows which entrance the device came through, how long it spent in each section, whether it stopped at the display near the checkout, and which store it came from immediately before. Chain together the logs from every retailer in a mall, and the picture becomes a detailed floor-by-floor path through the entire building. The device doesn’t need to be actively using Bluetooth. It just needs to have Bluetooth on — which it almost certainly does, because turning Bluetooth off entirely breaks headphones, car connections, and smartwatch pairing. Wi-Fi probing: your phone searching for familiar networks</h2> There’s a second tracking mechanism that runs even when you’ve never touched the mall’s Wi-Fi. Smartphones constantly broadcast what are called Wi-Fi probe requests. These are short signals asking nearby networks “Are you the one I already know?” Each request includes the device’s MAC address, the same hardware identifier used by Bluetooth beacons. Companies like RetailNext, Euclid Analytics, and Density deploy Wi-Fi receivers throughout retail spaces specifically to capture these probe requests. The result is the same: a timestamped movement log tied to a device ID, built from signals your phone sent without your involvement. RetailNext’s platform combines this Wi-Fi data with in-store cameras and point-of-sale systems. That gives retailers metrics on dwell time, path analysis, and conversion rates: how many people who passed a display actually bought something. Density uses infrared sensors to count and track people without cameras. Placer.ai doesn’t deploy any hardware at all. It buys location data that already exists inside mobile apps you’ve installed, then builds foot traffic analytics for any physical location it chooses to analyse. The MAC address randomization partial fix</h2> Apple recognised this problem. iOS 14, released in September 2020, introduced MAC address randomization. Instead of broadcasting your device’s permanent hardware identifier, your iPhone sends a different randomized address for each network, changing over time. Android followed with the same feature in Android 10. This created real friction for beacon and probe-based tracking. Retail analytics systems that had built longitudinal profiles on stable MAC addresses suddenly found their data fragmenting. But it didn’t end the problem. Many retailers already held years of data built on stable MACs before randomization arrived. Some analytics vendors shifted toward additional fingerprinting signals — timing patterns, signal strength combinations, device capability broadcasts — that can partially re-link randomized identifiers over time. And the profile-linking problem, described below, means randomization only helps if nothing else in your visit connects your device to your identity. The profile doesn’t need your name — until it does</h2> A device ID tracked across a mall visit is genuinely anonymous in isolation. The analytics company doesn’t know your name. They have a pseudonymous identifier moving through a physical space. This anonymity collapses the moment something links your device to your identity. The most common bridge: you pay by credit card. Your card transaction — store, amount, time — gets matched against the movement log showing a device in that store at that time. The anonymous trace gets a name. Every future visit by the same device is now attributed. Loyalty apps are a direct link. When you scan a loyalty card or open a retailer’s app inside the store, you’ve handed over your identity voluntarily. Mall loyalty programmes — common across DLF, Phoenix, Prestige, and Nexus properties in India — collect email addresses, phone numbers, and purchase history. A mall app open on your phone while you walk through a beacon-equipped corridor means your physical path is now part of your loyalty profile. Placer.ai’s model makes the hardware question largely irrelevant. Say an app on your phone has location permissions and sells that data onward. It could be a weather app, a flashlight app, or a game. Placer.ai may already be using that feed to log which retail locations you visit, how often, and when. No beacon required. No Wi-Fi connection required. India: the mall Wi-Fi problem</h2> In India, major malls typically offer free Wi-Fi. Connecting requires registering your phone number, sometimes via OTP verification. The Wi-Fi network was already collecting movement data from your probe requests. Once you register, the mall operator can attach your phone number to the device identifier that’s been logging your path through their property. India’s Digital Personal Data Protection Act 2023</a> requires explicit, informed consent before processing personal data for purposes beyond what’s reasonably expected. Consider a Wi-Fi login screen with a “By continuing you agree to our Terms of Service” button. Buried in those terms is consent to movement tracking and marketing analytics. That does not meet the DPDPA standard in any meaningful sense. Whether enforcement will reach this specific practice remains to be seen. As of mid-2026, the implementing rules are still being finalised and enforcement is in its earliest stages. Indian retail analytics also runs through loyalty infrastructure. Capillary Technologies, which works with major Indian retail chains, combines loyalty programme data with location analytics. If you’ve enrolled in a retailer’s loyalty programme in India, some version of your in-store movement data is very likely part of your profile there. What you can do</h2> Turn off Bluetooth when you’re not using it. This is the single most effective step. A beacon can only log your device if it receives a signal from it. No signal, no log. Turn off Wi-Fi when you’re not connected to a network. On Android, the Quick Settings Wi-Fi toggle works. On iOS, the Control Centre toggle temporarily disables scanning but re-enables after a few hours — go to Settings > Wi-Fi to turn it off completely. Verify MAC address randomization is active. On Android 10 and later, go to Settings > Network & Internet > Wi-Fi, tap your connected network, and confirm “Randomized MAC” is shown under MAC address type. For new networks, randomization is on by default — but checking costs nothing. Don’t connect to mall Wi-Fi. The registration process is the link between your phone number and your movement data. Mobile data works fine for most purposes inside a mall. Skip the mall loyalty app. A loyalty app that requests location permissions is a direct real-time feed of your physical location to the retailer. The discounts rarely justify it. Disable location permissions for shopping apps you aren’t actively using. On both iOS and Android, set location access to “While Using App” rather than “Always.” Better still: deny it entirely and grant it only when needed. None of these steps require technical expertise. They take about five minutes across your phone’s settings screens. They significantly reduce what retail analytics systems can collect — not to zero, but meaningfully. The companies doing this tracking are not acting illegally under most current frameworks. They are, however, building detailed profiles of your physical movements using infrastructure you walk past without any visible sign it’s there. Whether that’s acceptable is not a question the industry will answer for you. What you can do right now</h2> Want to see what data brokers expose about you? See what a scan finds →</a> shows an example report: the kinds of sites that list your name, phone, and address. Once KnytX Shield launches it will find and remove these automatically. Join the waitlist</a> to get in early. Inside India's Smart City Surveillance Network Unknown — Fri, 26 Jun 2026 00:00:00 +0000 Walk through Lucknow’s Hazratganj on an ordinary afternoon and count the cameras. They’re on traffic lights, mounted above shop awnings, bolted to poles that also carry street lights. Some are domes. Some are fixed-lens units pointing down the road. At the major intersections, you might spot the larger pan-tilt-zoom models — the ones that can follow a face across 400 meters of open street. None of them carry labels saying who operates them, what footage they retain, or who can query the resulting data. There is no sign explaining that Lucknow is a Safe City project site. No QR code linking to a privacy notice. No opt-out. This is not a hypothetical future. It is what was built — systematically, at public expense, across 100 Indian cities — under a program launched in 2015. The Smart Cities Mission and the surveillance it funded</h2> The Smart Cities Mission (SCM) was announced by the Ministry of Housing and Urban Affairs as an urban development initiative. One hundred cities were selected. Each received central funding and a mandate to modernize infrastructure. The program’s framing was about mobility, sanitation, digital connectivity, and citizen services. Surveillance infrastructure became a core deliverable. The mechanism was the Integrated Command and Control Centre (the ICCC). It is a centralized operations hub connecting camera feeds, emergency dispatch, traffic management, and, in some cities, social media monitoring. Every selected city was expected to build one. Most did. The Safe City initiative ran alongside SCM as a Ministry of Home Affairs program. It provided separate funding for police surveillance infrastructure in eight cities: Delhi, Lucknow, Mumbai, Kolkata, Chennai, Bengaluru, Hyderabad, and Ahmedabad. The two programs overlap substantially in some cities. That creates surveillance networks funded from multiple streams, with no unified oversight. What was actually deployed</h2> The scale varies sharply by city, but the pattern is consistent. Lucknow’s Safe City project was among the earliest to deploy large-scale facial recognition. Cameras feed continuously into a system that matches faces against a police database — wanted persons, individuals on watchlists — without individual activation decisions. Hyderabad stands out even within India’s surveilled landscape. The Telangana State Police operate TSCOP — Telangana State Citizen’s Online Portal — integrating camera networks with police databases, vehicle records, and field officer systems. It is among the most densely surveilled cities in the country by any reasonable measure. Delhi is in a different category. The network exceeds 300,000 cameras under Delhi Police and various civic bodies. The stated justification for facial recognition was locating missing persons. During the 2020 Delhi riots, police used the system to identify protesters in the aftermath. The Internet Freedom Foundation documented the deployments. Multiple people were misidentified. Surat, Bhopal, and Raipur have built ICCCs integrating traffic data, crime reporting feeds, and emergency services dispatch. The command center model pools data that was previously siloed across agencies. That integration is the point — and it is precisely what makes the accountability questions hard. Across all of these deployments, vehicle number plate recognition (ANPR) runs alongside facial recognition. Some ICCCs incorporate social media monitoring feeds. No authoritative public count of cameras exists — the figure is in the tens of thousands, likely higher. The accountability gap</h2> The most important fact about India’s smart city surveillance infrastructure is not its scale. It is how little legal structure governs it. There is no central law regulating CCTV deployment in Indian public spaces. Cities operate under state police orders, SCM project documentation, and Safe City scheme guidelines. None of these are public law. None establish individual rights. And none specify who can access footage, for how long, or on what authority. No public disclosure of false positive rates exists for any facial recognition system currently in operation across Indian smart cities. This is not a minor procedural gap. A system with a 0.1% error rate applied to millions of daily camera matches produces thousands of false identifications. The people most likely to be misidentified — darker-skinned individuals, women, faces captured in poor lighting or low resolution — are not edge cases. They are a substantial portion of the population these systems operate against. No mandatory data retention limits apply. Footage collected today may be retained for months or years — the period varies by city and agency, and in some cases appears to be indefinite. The Software Freedom Law Centre (SFLC.in) and the Internet Freedom Foundation (IFF) have spent years filing RTI requests to establish basic facts. Which vendors supplied which systems. What databases the facial recognition queries. What oversight exists before a match triggers a police action. The responses have been partial, delayed, or refused. The accountability infrastructure does not exist — it is not merely hard to access. Who built this</h2> The camera hardware comes from a fragmented vendor ecosystem. Chinese manufacturers — Hikvision and Dahua — are prominent in the Indian market. Both were added to the US Department of Commerce Entity List for their role in surveillance infrastructure used against Uyghurs in Xinjiang. Whether footage from Indian deployments flows through or to foreign vendor systems is not publicly audited. NEC Corporation holds Indian government contracts. Bosch and Axis supply cameras into the market. Indian companies including Staqu Technologies and FaceX supply facial recognition software to state police forces. Oversight of this ecosystem is not unified anywhere. What the DPDPA does and does not cover</h2> India’s Digital Personal Data Protection Act 2023 — the DPDPA — is a real law with real individual rights. It does not govern most of what is described above. The DPDPA contains explicit exemptions for national security and law enforcement purposes. State police departments collecting facial recognition data under these exemptions face no DPDPA obligations. No requirement to disclose what they collect. No data minimization requirement. No mandatory retention limits. No individual right of access or correction. The surveillance infrastructure built under the Smart Cities Mission and Safe City initiatives operates in a space the DPDPA explicitly does not reach. This is a policy decision, not an oversight. India has no surveillance reform framework: no law establishing judicial authorization requirements, accuracy standards, mandatory impact assessments, or individual rights against police data systems. That absence is itself a choice. Other democracies have grappled with this. India has not enacted a response. The DPDPA is meaningful for commercial data processing. For state surveillance, it changes nothing. What you can do</h2> The options are limited but real. File RTI requests with your city’s smart city special purpose vehicle (SPV). Ask specifically: how many cameras are deployed, what data they retain, for how long, and which vendors supply the facial recognition systems. SPVs are public bodies and RTI applies. Enough filings create pressure even where law does not. The Internet Freedom Foundation tracks surveillance deployments and accepts public tips about new systems. Their work has produced the most reliable public record of what Indian police facial recognition systems have actually done. Supporting them matters. At protests and public gatherings, facial coverings — masks, hats, glasses — meaningfully reduce recognition accuracy in most deployed systems. Do not carry linked devices if you can avoid it. Advocate for a surveillance reform bill. India has privacy advocates, parliamentary committees that have noted the gap, and a constitutional right to privacy established in 2017. The infrastructure that exists today is being built ahead of any legal framework. That framework, once it arrives, will tend to accommodate what already exists rather than dismantle it. The window to shape what gets built is now — and it is narrowing. What you can do right now</h2> Want to see what data brokers expose about you? See what a scan finds →</a> shows an example report: the kinds of sites that list your name, phone, and address. Once KnytX Shield launches it will find and remove these automatically. Join the waitlist</a> to get in early. Connected Car Data Privacy: What Automakers Collect Unknown — Wed, 24 Jun 2026 00:00:00 +0000 You drove to a hospital last Tuesday. You took a route that avoided the usual roads — maybe you didn’t want anyone to know where you were going. You parked, spent two hours inside, and drove home. You told no one. Your car told General Motors. The timestamp, the GPS coordinates, the route, the speed, the duration: all of it logged by the connected vehicle system. You agreed to it when you tapped “Accept” on the infotainment screen during setup. You probably don’t remember doing it. Most people don’t. This is the privacy problem with modern cars. It’s invisible and comprehensive. And unlike the tracking on your phone, most people haven’t started paying attention to it yet. What your car is actually recording</h2> Connected cars are essentially smartphones on wheels, and they collect data at a similar scale. Location history is the most obvious. Your car’s GPS logs where you go, when, for how long, and at what speed. This isn’t just for navigation — it’s stored and transmitted to the automaker’s servers. Over months, that record is a detailed map of your life: which doctor you visit, which mosque or temple, which political offices, which other addresses you stop at regularly. Driving behavior goes deeper. Hard braking events, rapid acceleration, sharp cornering, time of day you drive — all of it feeds telematics systems that insurers pay to access. The data isn’t abstract. It’s used to make decisions about what you pay. Infotainment systems are a particular problem. When you connect your phone via Bluetooth or USB to play music or use hands-free calling, most cars pull in more than you intend. Call history. Contact lists. Text message previews. Some systems cache this data locally in a way that persists long after you’ve disconnected the phone — or sold the car. Voice recordings from in-car assistants are processed by those companies under their own privacy policies. That covers Amazon’s Alexa Auto, Google Assistant, and Apple’s Siri through CarPlay. It layers on top of whatever the automaker collects. Two sets of data collection. Two companies with access. One conversation about where you’re going. Exterior cameras add another layer. Tesla stores footage captured by its cameras around events like collisions, sudden braking, and sentry mode activations. Footage from a camera pointing at a public street is one thing. Footage stored on Tesla’s servers, associated with your account and your location history, is another. The investigation that should have made headlines</h2> In September 2023, the Mozilla Foundation released the most comprehensive privacy audit of automobiles ever published. Their Privacy Not Included project evaluated 25 car brands against standard privacy criteria. All 25 failed. Mozilla called cars “the worst product category we have ever reviewed for privacy.” That’s a meaningful statement from a team that has audited hundreds of products across years: routers, children’s toys, health apps, smart home devices. Cars beat all of them for data overreach. The specifics were striking. Nissan’s privacy policy allowed the company to collect and share data about “sexual activity” as inferred personal information. That category appears nowhere in the actual function of driving a car. It raises obvious questions about how it gets inferred and why Nissan thought it needed that right. Kia’s policy allowed sharing driver data with law enforcement without a court order: no warrant required, just a request. Across the 25 brands, 84% said they could share data with government or law enforcement. Most shared or sold data to third parties. None of this is a secret. It’s in the privacy policies. The policies are just written to be unread. When car data raised insurance premiums</h2> The abstract became concrete in March 2024. The New York Times reported on General Motors’ OnStar Smart Driver program, a telematics service that collected detailed driving behavior data from enrolled customers. That data was shared with LexisNexis</a> and Verisk, two major data brokers whose clients include insurance companies. Many drivers enrolled in OnStar without fully understanding what data would flow to whom. They then found their insurance premiums raised based on driving scores they had no way to review or contest. GM suspended the data-sharing partnerships following the reporting. But the episode illustrated exactly how the pipeline works. The automaker collects data and sells it to brokers. The brokers sell it to insurers. The insurers act on it, and the driver is the last to know. Where India sits in this picture</h2> India’s car market is moving fast toward connectivity. Maruti Suzuki, Hyundai, Tata Motors, and MG Motor all offer connected vehicle features with telematics, location services, and remote monitoring through their companion apps. These systems collect location and behavioral data as a core function. The data policies governing them vary — and most have not been subjected to the kind of scrutiny Mozilla applied to the global brands. Ola Electric is worth naming specifically. The S1 scooter collects real-time location, battery data, and riding behavior through the Ola Electric app. That’s personal data by any reasonable definition. India’s Digital Personal Data Protection Act 2023</a> applies to exactly this kind of data. Location history and behavioral profiles qualify as personal data under the Act. The companies collecting it are data fiduciaries with corresponding obligations. No Indian automaker has faced regulatory action over connected vehicle data as of mid-2026. That’s not reassurance. It’s a gap. Enforcement infrastructure under the DPDPA is still being built. The data is being collected now. The second-hand car problem nobody mentions</h2> If you sell a car, buy one second-hand, or return a lease vehicle, the infotainment system may still contain the previous owner’s data — contacts, call history, saved locations, paired device records. Factory resets are not always performed between owners. Dealerships don’t reliably check. This cuts both ways. The person who buys your car after you may be able to see where you drove, who you called, and which phone you used. And you may be driving around in a car that still holds someone else’s data. What you can do</h2> Factory reset the infotainment system before you sell, return, or trade in your car. The option is usually in Settings under System or Privacy — search the car model and “factory reset infotainment” if you can’t find it. Do not assume the dealership will handle this. Opt out of connected services data sharing where offered. Look in the vehicle settings under “Privacy,” “Data Sharing,” or the companion app settings. Not all manufacturers offer a meaningful opt-out, but some do. Check before assuming the default is fine. For insurance telematics programs: Read the full disclosure before enrolling. Understand specifically whether the data goes to third parties beyond your insurer, and which ones. The GM/LexisNexis situation was not unique — it was the one that got reported. Don’t pair your primary phone contacts with the car if contact privacy matters to you. Use a different device, or set up Bluetooth for audio only and handle calls through the phone itself. Read the “third parties” and “law enforcement” sections of your automaker’s privacy policy. Those two sections tell you almost everything you need to know about where your data goes and under what conditions. Most people have never looked. Check your automaker’s privacy settings annually. Policies update. Default settings change. A feature that required opt-in last year may have become opt-out this year. What you can do right now</h2> Want to see what data brokers expose about you? See what a scan finds →</a> shows an example report: the kinds of sites that list your name, phone, and address. Once KnytX Shield launches it will find and remove these automatically. Join the waitlist</a> to get in early. Hidden AirTag Trackers: How to Find One in Your Car Unknown — Tue, 23 Jun 2026 00:00:00 +0000 In immediate danger? If you find a tracker and you are leaving an abusive relationship or fear for your safety, don’t remove it before you have a plan. Removing it alerts the person watching. Call iCall at 9152987821 (India) or a local domestic-violence helpline first, and read the “If you’re in an unsafe situation”</a> section below. Brooks Nader, a Sports Illustrated model, discovered in December 2021 that a stranger had slipped an Apple AirTag into her coat while she was at a bar in New York. She didn’t know it was there. The stranger tracked her home. She posted about it on Instagram the next morning. Within days, police departments across the United States were fielding reports of hidden AirTags found in wheel wells, handbags, and jacket pockets. They had been placed by ex-partners, jealous spouses, and people who had no business knowing where anyone was going. This is not a hypothetical threat. The devices cost less than ₹3,200. They fit in a pocket. They work. How AirTags work</h2> Apple launched AirTags in April 2021. The pitch was simple: attach one to your keys, drop one in your bag, and if you lose them, Find My will tell you where they are. The engineering behind that promise is what makes the product alarming in the wrong hands. An AirTag doesn’t have its own cellular connection. It doesn’t need one. It broadcasts a Bluetooth signal, and every iPhone nearby silently detects that signal and relays the AirTag’s location back to its registered owner — through Apple’s servers, encrypted end-to-end, without the relay phone ever knowing it participated. Apple calls this the Find My network. It has hundreds of millions of nodes. In any city, coverage is essentially continuous. Put an AirTag in someone’s wheel well in a Mumbai apartment complex parking lot. Within minutes, you know which car belongs to which building. Within hours, you know where that person works. Within a week, you have a detailed map of their life. What Apple did — and didn’t do</h2> Apple wasn’t naive about the risk. They built in anti-stalking measures from the beginning, then upgraded them after the wave of reports in late 2021. The main safeguard: if an AirTag is separated from its owner’s phone for 8 to 24 hours, it starts beeping. The range on that alert is variable — Apple never published the exact logic — but it means a tracker left in your car will eventually make noise. Apple also added “Unwanted Tracking” alerts to iPhones: if an AirTag that doesn’t belong to you travels with you for long enough, your phone will notify you. Android users had nothing at launch. Apple later released a Tracker Detect app for Android — but users had to find it, download it, and run a manual scan. Google has since built Bluetooth tracker detection into Android directly, though the gap between iPhone and Android protection remained significant for years. The 8-to-24 hour beep window is real protection. It’s also genuinely exploitable. If you want to confirm where someone lives, you don’t need 24 hours — you need a few. And the beep can be muffled: wrap the AirTag in cloth, tuck it inside foam padding in a wheel well, and the sound carries much less. Several stalking victims have described finding AirTags they never heard. Apple has faced lawsuits from stalking victims. The company’s position — that they’ve done more than any other tracker manufacturer to address the problem — is accurate. It isn’t a complete answer. Other trackers you should know about</h2> AirTags are not the only option. They’re just the most visible one. Tile, now owned by location data company Life360, makes Bluetooth trackers that work on their own network. Tile doesn’t have Apple’s scale — fewer relay devices — but in urban areas it’s effective. Tile trackers don’t beep autonomously, but Tile’s app includes a “Scan and Secure” feature that checks your surroundings for Tile devices registered to other people. Samsung SmartTags use Samsung’s Galaxy network and Ultra-Wideband technology for precision finding. Samsung Galaxy phones will alert users to unknown SmartTags traveling with them. If you don’t own a Samsung phone, the warning won’t reach you. Then there’s the category that’s harder to detect: dedicated GPS trackers with no Bluetooth at all. Search “vehicle GPS tracker” on Amazon India or Flipkart. You’ll find dozens of options priced between ₹1,500 and ₹5,000, sold under marketing copy like “fleet management” and “vehicle security.” They run on 3G or 4G SIM cards and report location to an app in real time. No proximity dependency. No Find My network. No beep after 8 hours. You won’t find these with a Bluetooth scan. They only show up when they’re actively transmitting, so detection requires either a physical search or an RF scanner. At the professional end: hardwired trackers that draw power directly from a vehicle’s electrical system. These are what private investigators use. They have no battery to die, they leave no dangling wires, and finding one requires a physical sweep of the vehicle or a professional counter-surveillance inspection. How to check your vehicle</h2> Start outside. Run your hands around both front and rear wheel wells — magnets hold well against the steel brackets inside. Use your phone’s flashlight and camera to look at the undercarriage, particularly around the frame rails and near the spare tire compartment. Check inside the front and rear bumper covers; there are recesses where a small device sits invisibly. If you have access to a mirror on an extendable stick — the kind mechanics use — the full undercarriage sweep takes about five minutes. Move inside. Check under both front seats, particularly back against the seat rails. Check the fabric pockets on seat backs. Check the trunk corners, especially where the liner meets the body. Check the OBD-II diagnostic port — usually below the steering wheel on the driver’s side. Hardwired trackers sometimes run through that port; a device that doesn’t belong there is immediately visible. On your phone: iPhone: Open the Find My app. Under the “Items” tab, there’s a section called Tracking Notifications — make sure it’s enabled. If an AirTag is traveling with you, you’ll receive an alert. You can also tap “Identify Found Item” if you find a physical AirTag to see its serial number.</li> Android: Google’s Find Nearby Devices (built into Android settings under Safety & Emergency) now scans for Bluetooth trackers from multiple manufacturers. Additionally, Apple’s Tracker Detect app is available on the Google Play Store — run a manual scan.</li> </ul> For non-Bluetooth GPS trackers, you need a radio frequency detector — available on Amazon India for ₹2,000 to ₹8,000. They detect active transmissions, so the tracker must be sending a signal when you scan. Some GPS trackers only transmit periodically to save battery. A few minutes parked while running the scan increases the chances of catching one mid-transmission. The legal situation in India</h2> There is no law in India that straightforwardly criminalizes placing a GPS tracker on a vehicle you don’t own. It falls into a patchwork of provisions. Section 66E of the IT Act covers privacy violations through capturing or transmitting images of a private area — not a precise fit for location tracking. Section 354D of the IPC covers stalking: following someone or monitoring their movements and electronic communications without consent. A GPS tracker placed on a vehicle could fall under 354D, but you’ll need the physical device and evidence of intent to file an FIR. Bring both to the station that covers your residence. If you’re in an unsafe situation</h2> If you find a tracker and you’re in a domestic violence situation or leaving an abusive relationship, don’t remove it immediately — not without a safety plan. Removing a tracker alerts the person monitoring it. A sudden loss of signal, especially at your home address, tells them you found the device. Depending on the situation, that can escalate risk rather than reduce it. Contact iCall at 9152987821 before taking action. The same principle that applies to removing stalkerware from a phone — don’t disturb the evidence without a plan — applies here. Decide with support whether to remove the device, leave it in place temporarily, or hand it to police directly as evidence. What you can do right now</h2> Want to see what data brokers expose about you? See what a scan finds →</a> shows an example report: the kinds of sites that list your name, phone, and address. Once KnytX Shield launches it will find and remove these automatically. Join the waitlist</a> to get in early. Doxxing: What It Is and How to Protect Yourself Unknown — Mon, 22 Jun 2026 00:00:00 +0000 On a Tuesday in October 2022, a journalist covering communal violence in Manipur opened Twitter. Pinned in a thread with sixty thousand impressions was her home address, the one she hadn’t published anywhere. Her phone number followed. Then the names of her children’s school. The replies were not ambiguous about intent. She’d done nothing wrong. She’d published accurate reporting. Someone decided that was sufficient reason to weaponize every piece of information they could find about her. They posted it where tens of thousands of people could act on it. That’s doxxing. Not a fringe phenomenon, not something that only happens to celebrities. A real and documented tactic used against journalists, activists, women who express opinions online, and anyone who attracts the wrong kind of attention. Being doxxed right now? If your home address is public and the threats feel direct, treat it as a physical-safety situation. Screenshot everything first, then report. For support in India, call iCall at 9152987821 or the National Commission for Women helpline at 7827170170. Full steps are in “If you’re being doxxed right now”</a> below. The short answer: Doxxing is publishing your private details so a mob can find you. Doxxers use people-search sites, social media, WHOIS records, voter rolls, and property records. Nearly all of this is public and legal to collect. You can’t become invisible, but you can raise the cost of finding you: search yourself, remove broker listings, lock down social profiles, use WHOIS privacy, and strip photo metadata. Jump to: What doxxing is</a> · How doxxers find you</a> · Who gets doxxed</a> · Protect yourself now</a> · If you’re being doxxed</a> · What platforms owe you</a> What doxxing actually is</h2> Doxxing is the deliberate publication of someone’s private information to enable a mob to harass, threaten, or physically harm them. That information includes home address, phone number, employer, family members’ names, vehicle registration, and daily schedule. The name comes from “dox,” a slang abbreviation of documents. The mechanics matter. A common defense doxxers offer is that all the information they published was technically public. This is usually true. Your name is public. Your approximate neighborhood might be public. Your employer might be on LinkedIn. But aggregating, connecting, and broadcasting that information to an audience motivated to harm you is what turns scattered data into a weapon. The harm is in the targeting, not any single data point. Doxxing is not a new tactic, but the internet has industrialized it. In 2014, Gamergate demonstrated what coordinated doxxing could do at scale. Female game developers and critics, among them Zoe Quinn, Brianna Wu, and Anita Sarkeesian, had their home addresses, phone numbers, and family members’ details posted across 4chan, Reddit, and Twitter. Death threats followed. Several were forced to leave their homes. The campaign lasted months and destroyed careers. It was also, in retrospect, a rehearsal. The tactics that emerged from Gamergate were refined and applied in every subsequent coordinated harassment campaign. In India, doxxing has a specific and documented communal dimension. The Bulli Bai and Sulli Deals cases</h2> In July 2021, a GitHub repository called “Sulli Deals” appeared. It listed photographs of Muslim women, with language framing them as objects for “auction.” These were real women, real names, real photos scraped from social media. The repository did not host the women’s addresses directly. But it identified them by name and photo to an audience that knew how to find the rest. GitHub took the repository down after complaints. By then, the damage was done. In January 2022, a new repository called “Bulli Bai” appeared on GitHub with the same structure and the same targets. This time, the response was faster. Mumbai Police arrested the app’s developer, a 21-year-old from Uttarakhand, within days. Delhi Police made additional arrests. The individuals arrested were young — in their early twenties — which did not make the targeting any less coordinated or the harm any less real. Both cases illustrate something specific about doxxing in the Indian context: that it can be organized around religious and communal identity in ways that carry threat registers beyond ordinary harassment. For Muslim women who were listed, the targeting communicated not just “we found your information” but “we consider you a legitimate target for communal violence.” The doxxing was also a threat assessment. GitHub’s response — removal after the fact — was the standard platform response to doxxing. Reactive, not preventive. The repositories were live long enough to be screenshot, shared, and archived. How doxxers find information</h2> Understanding the attack surface is the first step to reducing it. Doxxers are not sophisticated hackers in most cases. They are patient researchers using tools that anyone can access. People-search sites are the starting point. Sites like JustDial, Whitepages</a>, BeenVerified</a>, and Pipl aggregate publicly available records into searchable profiles. That includes phone directories, business registrations, property filings, and court records. In India, JustDial indexes business phone numbers that often belong to the individual business owner. Whitepages maintains Indian records. These sites exist to sell data access. They do not distinguish between legitimate users and people building harassment dossiers. Social media OSINT — open-source intelligence gathering — is more powerful than most people assume. Username correlation is the basic technique. If you use the same handle on Twitter, Reddit, Instagram, and a gaming forum, someone can cross-reference everything you’ve posted across all four. Location can be extracted from photo EXIF data: the metadata that cameras and smartphones embed in images, which often includes GPS coordinates. Even without EXIF data, photos reveal information: a distinctive building in the background, a local landmark, a bus route number on a bus stop sign. Identifying a neighborhood from a selfie background is not difficult for someone who knows the area. Domain WHOIS records have historically been one of the most significant leak vectors. When someone registers a website without purchasing WHOIS privacy protection, their name, address, phone number, and email are publicly indexed in the WHOIS database. These records can be years old and still live — older registrations from before WHOIS privacy became standard practice remain accessible through historical WHOIS tools. LinkedIn is an open professional directory. Your employer, your job title, your professional connections, your career history — all published voluntarily and indexed publicly by default. For doxxers, LinkedIn answers the question “where do they work and who do they work with” in seconds. Voter rolls in India are a significant and underappreciated data source. The Electoral Roll — the official list of registered voters — is publicly accessible and contains name, address, and voter ID number. The Election Commission of India publishes electoral rolls online. Someone with your name and approximate location can often find your registered address from public electoral data. Property records are public record in India. Land registry details, including ownership names and addresses, are accessible through state registration departments. If you own property registered in your name, that information is public. None of these require technical skill. They require time, motivation, and the knowledge that these sources exist. All of which doxxers have. Who gets doxxed</h2> The population of doxxing targets is not random. Some categories recur consistently. Journalists — particularly those covering organized crime, political corruption, or communal issues — are targets because their work creates enemies with resources and motivation. A journalist who exposes a politician’s land dealings or documents a mob’s activities has given that party a direct reason to silence them. Doxxing is cheaper than litigation and more immediately effective at changing behavior. Women who express opinions online are a disproportionate target. This is not speculation — it is one of the most documented patterns in harassment research. A woman who says something about politics, gaming, religion, film, or virtually any subject in a public forum with sufficient reach becomes a potential target. The threshold for triggering a doxxing campaign can be very low. People involved in public controversies — even momentary ones, even minor ones — discover that a viral moment creates a harassment window. Consider someone filmed in a confrontation, or whose tweet gets screenshotted and shared, or whose comment in a local Facebook group gets picked up by a larger account. Any of these can produce a brief burst of hostile attention. That is all someone with doxxing skills and malicious intent needs. Activists and protesters who participate in public demonstrations face targeted doxxing from opponents of their cause. Farmers’ protest supporters, anti-CAA protesters, environmental activists — all have faced documented doxxing campaigns from organized opposition groups. And, bluntly: anyone who wins an online argument with someone unstable enough to retaliate. The asymmetry of doxxing is part of what makes it effective as intimidation. You don’t need to be prominent to be targeted. You need to have made one person angry enough to spend two hours researching you. Pre-emptive protection — what you can do now</h2> The goal of protective measures is not invisibility, which is unrealistic for most people. The goal is to raise the cost of finding your information high enough that you fall below the threshold of effort a harasser is willing to invest. Start by searching yourself. Open Google and search your full name in quotes, your name plus city, your name plus phone number. Search your username across platforms. Check your name on JustDial. Check Whitepages. What’s already indexed tells you where your current exposure is. Remove or suppress data broker listings. JustDial has a contact form for removing listings. Whitepages has a privacy request process. The removals don’t always stick, and they’re not instantaneous, but they reduce the depth of what an automated search returns. For a step-by-step removal guide, see our post on removing your data from Indian data brokers</a>. Use WHOIS privacy on every domain you register. If you register a domain name — for a personal site, a side project, a small business — pay for WHOIS privacy. It costs under ₹500 per year with most registrars and removes your name and address from the public WHOIS database entirely. Check your existing domain registrations today. If WHOIS privacy isn’t enabled, enable it. Audit your social media profiles. Remove your phone number from every platform that has it — Twitter/X, Facebook, Instagram, WhatsApp’s linked accounts. Remove your home city or make it vague (state level rather than city). Remove your workplace from public view if you can. On Facebook specifically, check who can see your friends list — a full friends list is a map of who can be targeted to reach you. Use a PO box or virtual address for anything that requires a public-facing physical address. Business registrations, domain registrations, freelance work — if you need to provide a mailing address to a third party or for a public record, use an address that isn’t your home. India Post offers PO boxes. Several private services offer virtual address and mail forwarding. Maintain separate email addresses for public and personal activity. Your public-facing email is the one attached to your Twitter account, your bylines, and your public profiles. It should not be the same address tied to your bank account, your phone number, and your close personal contacts. Keeping them separate limits the blast radius of any single exposure. Strip EXIF data from photos before sharing. On Windows, right-click any image and navigate to Properties > Details > Remove Properties and Personal Information. On Linux and macOS, ExifTool is a free command-line utility that removes metadata from individual images or entire directories in a single command. No technical background required — exiftool -all= filename.jpg</code> removes all metadata from a file. Do this before posting any photo publicly, particularly anything taken on a smartphone in a location you’d rather not disclose. Use inconsistent usernames across platforms. If you use the same handle on Twitter, Reddit, LinkedIn, gaming forums, and a cooking blog, you’ve made cross-platform correlation trivially easy. Your handle on a platform where you discuss personal subjects should not be searchable back to your professional identity. The inconvenience is minor. The protection is meaningful. If you’re being doxxed right now</h2> The first instinct when discovering a doxxing is to report everything immediately and hope for fast deletion. This is the wrong sequence. Screenshot everything first. Reports and takedowns sometimes trigger deletion before you’ve documented what was posted. A screenshot of the original post, the timestamp, the username of the poster, and the URL is evidence you may need for a police complaint, a platform escalation, or a legal action. Document before you report. Report to the platform. Twitter/X, Facebook, Reddit, and GitHub all maintain explicit policies against doxxing. Twitter/X’s rules prohibit “publishing or posting other people’s private information without their express authorization and permission.” Reddit bans doxxing site-wide, though enforcement quality varies enormously by subreddit and moderator. GitHub has a documented process for removing repositories that doxx individuals — the Bulli Bai takedown came through this process. Use the platform’s official report mechanism and be specific: name the policy being violated, link the content, and include screenshots in your report. File an FIR with cyber police. Doxxing as a standalone named offense does not exist in Indian statute — but it can be prosecuted under multiple existing provisions. Section 66 of the IT Act covers computer-related offenses. Section 66C covers identity theft. Section 66D covers cheating by personation using communication devices. Section 354D of the IPC covers stalking, which includes online monitoring and contact for the purpose of fostering personal interaction. File an FIR at your nearest cyber crime police station. You can also file online at cybercrime.gov.in. Include screenshots, URLs, and timestamps. Contact CERT-In. India’s Computer Emergency Response Team maintains a complaint mechanism for cyber incidents at incidents@cert-in.org.in. For cases involving coordinated harassment with a cyber component, a CERT-In complaint creates an official record and can trigger escalation. Contact a domestic violence helpline if physical safety is at risk. If the doxxing includes your home address and the threats are direct, treat it as a physical safety situation, not only a digital one. iCall (9152987821) provides psychological support. The National Commission for Women helpline is 7827170170. Tell someone you trust offline: your physical location, your schedule for the next few days, and who knows you’re dealing with this. Tell someone offline. This is not optional. Doxxing is designed to isolate its targets — to make them feel visible to hostile strangers and invisible to everyone who might help. Breaking that isolation is part of surviving it intact. What platforms owe you</h2> Twitter/X maintains a doxxing policy. Enforcement is inconsistent and has become more so since 2022. The policy exists. Whether it gets enforced depends on content moderation capacity that has clearly declined. Reddit prohibits doxxing at the site level. Individual subreddit quality varies by several orders of magnitude. A well-moderated subreddit will remove doxxing within minutes. A poorly moderated one may take days or never. India’s IT Rules 2021 are formally the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules. They require significant social media intermediaries (platforms with more than 5 million registered users in India) to do three things: appoint a Grievance Officer based in India, provide a working contact mechanism, and acknowledge complaints within 24 hours. If you file a complaint and receive no response within 24 hours, the platform may be in violation of its legal obligations under Indian law. Escalate to the platform’s India Grievance Officer directly. They are legally required to publish this contact information. GitHub, as a code hosting platform, sits in a different regulatory category, but has its own content policies and has demonstrated willingness to act on doxxing repositories when specifically reported. The Bulli Bai takedown, however delayed, happened. The consistent theme across all platforms is that reactive moderation is the norm. Content comes down after damage is done. Pre-emptive protection is therefore personal rather than institutional — you cannot rely on platforms to prevent your doxxing, only to eventually respond to it. What you can do right now</h2> Want to see what data brokers expose about you? See what a scan finds →</a> shows an example report: the kinds of sites that list your name, phone, and address. Once KnytX Shield launches it will find and remove these automatically. Join the waitlist</a> to get in early. Stalkerware: How to Detect, Remove & Stay Safe Unknown — Sun, 21 Jun 2026 00:00:00 +0000 She noticed it on a Tuesday morning. She had mentioned, only in a WhatsApp message to her sister, that she was thinking about visiting a shelter. That evening, her husband brought it up — calmly, conversationally, as if he had simply overheard it. She hadn’t called him. She hadn’t told him. She had never said the word “shelter” out loud. Her phone knew. And so did he. What she was experiencing is textbook stalkerware: commercial surveillance software installed secretly on a victim’s device, transmitting their location, messages, call logs, and photos to whoever put it there. It’s sold openly. It’s easy to install. And in most jurisdictions, including India, the products themselves are entirely legal to buy. If you fear for your safety, read this first. Do not delete stalkerware the moment you find it. Many products alert the abuser if the app is removed. That moment of discovery can be dangerous. Reach out from a device you’re sure is clean. In India, call iCall at 9152987821 or the Vandrevala Foundation at 1860-2662-345 (24/7). Full safety steps are in “Before you do anything”</a> below. What stalkerware actually is</h2> Stalkerware is not a virus or a hack in the conventional sense. It’s a category of commercially sold software — marketed, usually, as “parental monitoring” or “employee tracking” tools — designed specifically to hide from the person being monitored. The leading products include FlexiSPY, mSpy, Hoverwatch, Spyic, and eyeZy. You can buy them right now, on their own branded websites, with pricing tiers, customer support, and money-back guarantees. FlexiSPY’s premium plan, at the time of writing, costs around $68 per month. The marketing copy describes it as a tool for “worried parents” and “employers who need to protect company data.” What these apps actually do: once installed on a target device, they run invisibly in the background. They transmit GPS location continuously. They log every text message, WhatsApp message, and call. They can access the photo library. On some devices, they activate the microphone. All of it streams silently to a web dashboard that the person who installed the app can access from anywhere. The Coalition Against Stalkerware — a group of domestic violence organizations and cybersecurity firms — estimates that the vast majority of stalkerware victims are women in intimate partner relationships. The “parental monitoring” framing is, largely, marketing cover. The FTC drew a line in 2021</h2> In September 2021, the US Federal Trade Commission took an unprecedented step. It banned Support King, the company behind a stalkerware product called SpyFone, from operating any surveillance business. Not fined. Banned. The FTC’s investigation found that SpyFone harvested data from victims’ phones and failed to secure it adequately, exposing that data to additional risk. The commission also found the product was being used primarily not by parents or employers, but by stalkers and abusive partners. Support King was ordered to delete all data it had collected and notify victims that they had been surveilled. It was the first time a US regulator had explicitly targeted stalkerware as a consumer protection issue rather than just a law enforcement matter. The FTC has since pursued similar actions against other surveillance apps. The message from that action was clear: selling a surveillance tool marketed for secret use against other adults is not a legally safe business. That enforcement action happened in the United States. India has no equivalent regulatory action on record. How it gets installed</h2> This is the question that matters most for understanding your risk: stalkerware requires physical access to the unlocked device, typically for about five minutes. Most products advertise this explicitly in their setup guides. You need the phone in your hand, and you need it unlocked. On Android, installation involves enabling “install from unknown sources” in settings — a standard security override — then downloading and running the stalkerware APK. Once installed, the app icon is typically hidden. The app may rename itself something innocuous in the app list: “System Service,” “Phone Manager,” “Device Health.” Android’s more open architecture makes it the more common target. On iOS, the situation is more constrained but not impossible. A jailbroken iPhone can be compromised the same way as Android. But several stalkerware products — including some versions of mSpy — operate entirely through iCloud sync without needing physical device access at all. If someone knows your Apple ID and password, they may be able to access your iCloud-backed messages, photos, and location history from a web browser. No app installation required. This is why the question “who has had access to my phone?” matters. But so does the question “who knows my Apple ID password?” And if you’re worried about being tracked physically as well, our guide to hidden AirTags and GPS trackers</a> covers how to sweep a car or bag. Signs your phone may have stalkerware</h2> None of these signals are definitive on their own. But a cluster of them — especially alongside a relationship where your partner seems to know things they shouldn’t — warrants a closer look. Battery draining faster than usual. Stalkerware runs continuously in the background, polling location, intercepting messages, and transmitting data. That takes power. Say a phone that used to last a full day now needs charging by midafternoon. It may just have an aging battery. Or it may be doing a lot of work you don’t know about. Higher than expected data usage. Location pings, photo uploads, message logs — all of it goes somewhere over your data connection. Check your monthly data usage in your carrier’s app or in Settings. If you’re consuming significantly more data than your usage habits suggest, something is transmitting. Phone warm when sitting idle. Your phone should do nothing overnight. If it’s warm when you pick it up in the morning, it was running something. Apps you don’t recognize. In your app list, look for anything with a generic, system-sounding name that you didn’t install and can’t identify. Stalkerware developers specifically choose names that blend in. Someone knows too much. This is the signal that matters most. Maybe your partner references details from private conversations, knows where you were when you didn’t tell them, or seems to respond to things before you’ve said them. Trust that feeling. How to check your device</h2> These steps will help you look more carefully. Go through them methodically, preferably somewhere private. Android</h3> Open Settings > Apps > See All Apps. Work through the list. For any app you don’t recognize, tap it to see when it was installed. If it was installed on a date when your partner had access to your phone, that warrants suspicion. Open Settings > Battery > Battery Usage. Look for apps that are consuming a notable percentage of battery in the background — especially apps you don’t use or don’t recognize. Open Settings > Accessibility > Installed Services. This is the most reliable check. Stalkerware almost always requires accessibility permissions to intercept messages and calls. Any service listed here that you didn’t enable yourself is a red flag. On some Android versions, also check Settings > Device Admin Apps — stalkerware sometimes registers as a device administrator to prevent easy uninstallation. iOS</h3> Open Settings > Privacy & Security > Location Services. Scroll through the list and look for any app with “Always” access that you don’t recognize or don’t use. Open Settings > [your name] and scroll down to the device list. If you see an unfamiliar device logged into your Apple ID, someone may have access to your iCloud data. You can remove devices from this list — but read the safety section below before doing anything. Open Settings > [your name] > iCloud and review which data categories are synced. Messages, photos, and location can all be accessible to anyone logged into your Apple ID from another device. Also check whether someone has added themselves to Family Sharing on your account — this gives visibility into location. Before you do anything — read this</h2> If you find stalkerware on your device and you’re in a relationship where you fear for your safety, do not delete it immediately. This is not a caveat. It’s the most important thing in this guide. Many stalkerware products are configured to send an alert if the app is uninstalled or if certain data stops arriving. Deleting the app — or resetting permissions, or removing a device from your Apple ID — can alert your abuser that you’ve discovered the surveillance. In an abusive relationship, that moment of discovery can be dangerous. The right sequence is: Do not act on the device yet.</li> Contact a support line from a different device — a phone you’re certain is clean, a friend’s phone, or a landline. In India: iCall at 9152987821 (TISS’s psychological counseling service, which also handles domestic violence situations) or Vandrevala Foundation at 1860-2662-345 (24/7 mental health and crisis helpline). These organizations can help you think through a safety plan before you take any action on your phone.</li> Plan your next steps with support. A domestic violence counselor can help you think through the sequence of leaving or securing your situation in a way that accounts for the surveillance.</li> </ol> When it is safe to act, a factory reset is the most reliable solution — not trying to find and remove the specific stalkerware. Stalkerware is designed to resist detection and removal. A factory reset wipes the device entirely and removes everything. Set the device up as new afterward, not from a backup (a backup may restore the stalkerware). Change your Apple ID or Google account password from a separate device before or immediately after the reset. What the law says in India</h2> Here’s where it’s worth being precise, because there’s a common misconception about what’s actually illegal. Selling stalkerware in India is not illegal. FlexiSPY and mSpy can be purchased and delivered to an Indian address without violating any law. The companies are not breaking Indian law by operating here. Using stalkerware against someone without their consent is a different matter. Installing software on someone’s device without their knowledge or permission violates Section 66 of the Information Technology Act 2000, which covers unauthorized access to computer systems. “Computer” under the IT Act includes mobile phones. Intercepting someone’s private communications — messages, calls — without authorization violates Sections 66B and 66E of the IT Act 2000 and provisions of the Indian Telegraph Act. And stalkerware is almost always used to monitor someone’s movements and contact. That conduct falls under Section 354D of the Indian Penal Code, which covers stalking. Section 354D was added in 2013 following the Nirbhaya case. It explicitly covers monitoring a person’s use of the internet, email, or other electronic communication. If you want to file a complaint: go to your nearest police station and file an FIR citing Section 66 of the IT Act and Section 354D IPC. Bring evidence — screenshots, the name of the app you found, dates. You can also file a complaint with the Cyber Crime Reporting Portal at cybercrime.gov.in, which has a specific category for complaints involving women. The challenge, practically, is that police response to IT Act complaints varies significantly by state and district. Documentation matters. Having a lawyer or support organization alongside you matters. This is another reason to reach out to support organizations before engaging the legal system alone. A note for parents</h2> If you’re reading this because you’re genuinely concerned about a child’s online safety: the distinction that matters is consent and transparency. Google Family Link and Apple Screen Time are both designed to be visible to the child being monitored. The child knows the monitoring is in place. That transparency is what makes them appropriate tools for parental oversight rather than surveillance. Hidden monitoring of any person — including an adult child, a teenager, or a young child who doesn’t know — trains them to believe that secret surveillance is normal. It removes the opportunity to build trust through conversation. And in the case of an adult child, it’s legally the same as monitoring a stranger. If your concern is about a young child’s safety online, use visible tools and have the conversation. If your concern is about a partner, a sibling, or an adult child — what you’re describing is not parenting. It’s surveillance, and it causes real harm. What you can do right now</h2> Want to see what data brokers expose about you? See what a scan finds →</a> shows an example report: the kinds of sites that list your name, phone, and address. Once KnytX Shield launches it will find and remove these automatically. Join the waitlist</a> to get in early. Location Tracking: Who Follows You & How to Stop It Unknown — Sat, 20 Jun 2026 00:00:00 +0000 A woman in Rajasthan fled her husband. Changed cities, changed her number, stayed off social media. Six weeks later, he found her. The investigator he hired didn’t need to follow her — he just bought her location history from a data broker that had purchased it from apps on her old phone. She’d uninstalled them. Didn’t matter. The data was already sold. This isn’t a hypothetical. Documented cases like this have been reported across the US and Europe. In India, the data infrastructure that enables it is largely the same — and the legal guardrails are thinner. Your phone’s location data is not private. It’s a commodity. Multiple companies are harvesting it right now, from multiple angles, and selling it to buyers you will never know about. Here is every method they use, who buys the output, and what you can actually do about it. The short answer: Your phone leaks your location through seven channels: GPS, cell towers, Wi-Fi, Bluetooth beacons, your IP address, your advertising ID, and hidden SDKs inside ordinary apps. Data brokers, advertisers, hedge funds, and government agencies buy the output. You can’t opt out of your carrier’s tracking. But about 20 minutes of settings changes cuts most commercial harvesting. Audit location permissions, downgrade apps to approximate location, disable Wi-Fi scanning, reset your advertising ID, and use a VPN. Jump to: The seven tracking methods</a> · Who buys location data</a> · The India carrier picture</a> · The permission you give away</a> · How to reduce your exposure</a> · Location data and the DPDPA</a> How your phone tracks you — all seven methods</h2> GPS</h3> The one everyone knows. GPS pulls your precise coordinates from satellites, accurate to a few meters when the signal is clean. It’s the most accurate method and the most battery-intensive. It also requires explicit app permission on both Android and iOS. When you grant an app “precise location,” it can pull GPS coordinates. The problem isn’t GPS itself. It’s that many apps request this permission with no legitimate need for it. A news aggregator. A shopping app. A weather app that could function fine on approximate location. Each one that gets your GPS data is a potential vector for selling it. Cell tower triangulation</h3> This one requires no app permission and no action from you. Every moment your phone has a SIM card in it, your carrier knows which cell towers it’s connecting to. In cities, where towers are dense, this triangulation puts your location accurate to a few hundred meters. In rural areas, it’s rougher, but it’s never completely absent. Jio, Airtel, and Vi (Vodafone Idea) hold this data on every Indian subscriber, constantly. TRAI regulations require telecom operators to maintain call detail records, or CDRs, which include location data. Law enforcement can access these through court orders. What the regulations do not clearly define is the scope of commercial sharing with third parties. The silence on that question is itself significant. Your carrier’s location data is the one you cannot opt out of without removing your SIM card. Wi-Fi positioning</h3> Google and Apple have both built global databases that map Wi-Fi network names and MAC addresses to physical locations. Your phone detects nearby Wi-Fi networks even when you’re not connected to them. It can then look up those networks in these databases and pinpoint your location faster and more accurately than GPS alone. Android has a setting called “Wi-Fi scanning” under Location settings that allows this to happen even when you’ve turned Wi-Fi off. Most people have never heard of it. It’s on by default. Bluetooth beacons</h3> Walk into a Reliance Smart, an Inorbit Mall, or any large retail space with modern infrastructure. There’s a reasonable chance Bluetooth beacons are tracking how long you spent in each section, how often you visit, and which displays you lingered near. Retailers use this data for layout optimization and advertising. The dwell-time profiles don’t necessarily link to your identity directly, but they link to your device. Combined with other signals, that’s enough. Our guide to in-store Bluetooth and Wi-Fi tracking</a> covers this in depth. IP geolocation</h3> Crude, but zero permission required. Every website you visit sees your IP address, which maps to a rough geographic location. This is typically accurate to the city or neighborhood level. It’s why a travel booking site knows you’re in Bengaluru without you telling it. Advertisers and analytics platforms use IP geolocation as a fallback when more precise signals aren’t available. A VPN masks this by replacing your IP address with the VPN server’s address. It’s the one method where a single tool provides complete protection. Advertising ID tracking</h3> Android assigns every device an Advertising ID, the AdID. iOS assigns an Identifier for Advertisers, the IDFA. These are persistent identifiers that allow advertisers to track your behavior across different apps on the same device. Open a food delivery app, then a news app, then a game. Each app reports your behavior to ad networks. Those reports are linked by your AdID. Over time, the cross-app profile built from this data is detailed: what you browse, when you’re active, what you buy, where you are when you do all of this. The AdID ties every data point together into a single profile without using your name. You can reset your AdID. Few people do. SDK-level location harvesting</h3> This is the mechanism most people are unaware of, and it’s the one responsible for the most commercial location data in circulation. App developers build apps using third-party software development kits — SDKs — for analytics, advertising, and attribution. These SDKs, embedded invisibly inside apps, often request location permission and harvest that data in the background, independent of what the app’s stated purpose is. The developer may not even have full visibility into what the SDK is collecting. When you grant location permission to an app, you’re also granting it to every SDK embedded in that app. Those SDKs report back to their parent companies — ad networks, data aggregators — who compile, package, and sell the result. Who buys location data</h2> The buyers are more diverse than most people expect. SafeGraph and Veraset are American location data brokers. They purchase raw location pings, millions of them from millions of devices, sourced from apps via SDK-level harvesting. They clean, structure, and resell this data to a broad range of customers. Retailers buy it to understand foot traffic patterns near their stores and competitors’. Hedge funds buy it to analyze consumer behavior before quarterly earnings. If parking lot visits at a retail chain are down, that’s an investment signal. Urban planners and academic researchers buy it for movement studies. Government agencies also buy it. In documented cases that includes US federal law enforcement and intelligence agencies. The appeal is clear: commercial purchase of location data sidesteps the warrant requirements that would otherwise apply to accessing it directly from carriers. Multiple congressional investigations and court filings have documented this practice. The Supreme Court’s 2018 decision in Carpenter v. United States established that extended cell tower location data requires a warrant. But it left significant gaps, and commercial data broker purchases sit in murky territory. Outlogic, formerly X-Mode Social, was removed from the Apple App Store and Google Play Store in December 2020. Motherboard/Vice reporting had revealed it sold location data to US military contractors and brokers working with defense clients. X-Mode rebranded as Outlogic. The underlying business continued: buying location data from apps, selling to intelligence and government contractors. InMobi is a Bengaluru-based mobile advertising network, one of the largest in Asia. Location data is central to how mobile advertising targeting works, and InMobi operates at significant scale in India. Advertising networks use location data for targeting (served ads based on where you’ve been), measurement (did this ad drive a store visit), and audience segmentation. Advertisers use location data for retargeting. If you visited a competitor’s showroom last Thursday, a car brand can target you with ads today. If you visited a hospital, health insurance advertisers may reach you next week. The connection between physical movement and ad targeting is direct, well-documented, and legal under current Indian law. Hedge funds and institutional investors buying location data as investment signals is a practice that has grown substantially over the past decade. It is a normal and legal commercial transaction. The ethical question around it is mostly unasked: do app users understand that their location data funds Wall Street trading? The India-specific carrier picture</h2> Every Indian subscriber on Jio, Airtel, or Vi generates continuous location data through cell tower connections. In dense urban areas such as Delhi, Mumbai, Bengaluru, and Hyderabad, this data is accurate enough to place you in a specific neighborhood, sometimes a specific block. TRAI’s licensing framework requires operators to maintain CDRs for specified periods. Law enforcement access to this data is available through the legal process: court orders, or executive directions in national security contexts. What isn’t publicly defined is the scope and nature of commercial arrangements between telecoms and third-party data buyers. Unlike the US, where some of this has been litigated and investigated by Congress, the Indian picture remains largely opaque. The prudent assumption: your carrier knows where your phone is, always, and the legal constraints on what happens with that data are not fully specified. The “precise location” permission you’re probably giving away</h2> When an app requests location permission, Android 12 and later and iOS 14 and later offer a meaningful choice that most users skip past. Precise location gives the app your GPS-level coordinates, accurate to a few meters. Approximate location gives a roughly 3-kilometer radius instead. For a food delivery app that needs to place a pin on your building, precise location is justified. For a weather app, a news app, or a shopping app, approximate location is plenty. The data quality difference matters enormously for harvesters. A precise location ping can identify your home address, your workplace, the hospital you visited, the mosque or temple you attend. A 3-kilometer radius can confirm you’re roughly in Bandra, and that’s it. Same app, same SDK, same data broker pipeline. But with approximate location, the harvested data is commercially much less valuable. Android also gives you three options for when an app can access location. The choices are “Allow all the time,” “Only while using the app,” and “Don’t allow.” Background access (“Allow all the time”) means the app can check your location when it’s not open. It runs even when the app is not in use. That is how SDK-level harvesting in the background works. Most apps have no legitimate reason to need background location access. How to actually reduce your location exposure</h2> None of this requires leaving your phone at home. It requires about 20 minutes of settings changes and one habit adjustment. Audit your location permissions. On Android, go to Settings > Location > App permissions. Look at every app with “Allow all the time” access. Ask whether it genuinely needs your location when you’re not using it. For most: change to “Only while using the app” or “Don’t allow.” On iOS, go to Settings > Privacy & Security > Location Services. Same audit, same question. Use the “Precise Location” toggle per app to downgrade to approximate for apps that don’t need exact coordinates. Disable Wi-Fi scanning. Android only: Settings > Location > Wi-Fi scanning, and turn it off. This stops your phone from using Wi-Fi networks to determine your location when Wi-Fi is off. Reset your Advertising ID regularly. On Android: Settings > Google > Ads > Reset advertising ID (newer Android: Settings > Privacy > Ads). This breaks the continuity of cross-app tracking. Advertisers can still build a new profile on your reset ID, but the historical profile tied to your old ID becomes less useful. On iOS: Settings > Privacy & Security > Tracking, and set “Allow Apps to Request to Track” to off. This tells apps they cannot access your IDFA and prevents most cross-app tracking. Use a VPN</a> for IP geolocation protection. A VPN replaces your visible IP address with the VPN server’s address, preventing IP-based location profiling. It’s the one category where a VPN directly helps with location tracking. It doesn’t protect against GPS, cell towers, or SDK harvesting, so don’t mistake it for a complete solution. For sensitive trips: airplane mode. Say you’re visiting a place you don’t want in any database. A clinic, a lawyer, a political meeting, a religious gathering outside your mainstream. Airplane mode prevents all network-based tracking. Cached GPS can still be accessed by apps you open, but with no network connection, nothing can be reported back in real time. Location data and India’s DPDPA 2023</h2> The Digital Personal Data Protection Act 2023</a> is India’s primary data privacy legislation. It establishes three things. Consent requirements for collecting and processing personal data. Rights for data principals to access and erase their data. And obligations on data fiduciaries, the entities that collect and process data. Location data is personal data under the DPDPA. Its collection requires consent that is free, specific, informed, and unconditional. The right to erasure applies to it. The consent withdrawal mechanism applies. What the DPDPA does not do is create a tiered “sensitive personal data” category. The final act applies a unified personal data framework. Heightened obligations attach to Significant Data Fiduciaries designated by the central government, rather than to particular data types. This is a meaningful gap for location data specifically. Precise location can directly reveal where you live, where you worship, what healthcare facilities you visit, and your daily routine. In most privacy frameworks internationally, this sensitivity is explicitly recognized. DPDPA 2023 handles it only through the general consent and purpose-limitation requirements that apply to all personal data. How this plays out in enforcement is untested. The Data Protection Board is the enforcement body established by the DPDPA, and it has not yet adjudicated location data cases. The practical protections on offer are still uncertain, which is exactly why the settings-level measures above matter more in the near term than the legal framework. The business model running underneath all of this is simple. Location is valuable, collection is cheap, and there are buyers at every point in the chain: app developers, SDK vendors, data brokers, advertisers, hedge funds, and government contractors. The surveillance doesn’t require malice. It requires only that each party in the chain treats your movement through the world as inventory. The protections that exist are mostly self-administered. Settings audits, permission downgrades, ID resets. They don’t eliminate the exposure, because your carrier always knows where you are. But they significantly reduce what commercial actors can harvest and sell. Twenty minutes of changes now will meaningfully limit what flows into that pipeline going forward. What you can do right now</h2> Want to see what data brokers expose about you? See what a scan finds →</a> shows an example report: the kinds of sites that list your name, phone, and address. Once KnytX Shield launches it will find and remove these automatically. Join the waitlist</a> to get in early. Your Prescription History Is for Sale Unknown — Fri, 19 Jun 2026 00:00:00 +0000 You hand the prescription slip to the counter. The pharmacist keys something in. Tablets are counted, packed, and handed back in a white paper bag. The whole transaction takes ninety seconds. You leave. What you don’t see is the entry that’s now in a database: your name, your address, the doctor’s name, the drug, the dosage, the date. That record doesn’t stay at the pharmacy. In an industry built on data, prescription records are a commercial asset, and they have been for decades. Is your prescription history really for sale? In the US, yes. Pharmacies have long sold “de-identified” prescription records to health data companies like IMS Health (now IQVIA), which resell prescribing intelligence to drug makers. In India there are no confirmed public reports of pharmacy apps selling records to brokers. But their privacy policies permit broad data use beyond filling your order. “De-identified” is not “anonymous”: drug, dose, doctor, date, and area are enough to re-identify a person. For the wider picture, see who’s selling your medical data</a>. How a US company built a $3 billion business on your doctor visits</h2> The model was established long before Indian online pharmacies existed. IMS Health, now rebranded as IQVIA, built one of the largest health data businesses in the world. It bought prescription records from pharmacies across the United States, stripped out patient names, and sold the cleaned data to pharmaceutical companies. The pitch to drug makers was simple: know exactly which doctors prescribe which drugs, in what volumes, in which zip codes. Then send your sales reps to the right doors. IQVIA’s health data business has grown to a multi-billion dollar operation. The prescription data arm was the foundation. Pharmacies were paid for records that, on paper, had been de-identified. The drug companies got granular, actionable intelligence. And patients — who had no idea this was happening — got nothing, including no choice. The de-identification problem surfaced later. Researchers showed repeatedly that removing a name and phone number doesn’t make medical data anonymous. Consider someone in a particular neighborhood, of a certain age, filling a specific prescription for a rare oncology drug on a specific date. That combination is close to unique. Re-identification from “anonymized” prescription data is not theoretical. It has been demonstrated in peer-reviewed research. The US eventually moved to restrict this practice for certain drug categories, but the infrastructure of prescription data commerce was already built. That infrastructure is now replicating itself in India. What online pharmacies in India actually collect</h2> When you upload a prescription to 1mg, PharmEasy, Netmeds, or Apollo Pharmacy, it feels like a convenience. It functions like a data disclosure. These platforms capture: your name, your phone number, your delivery address, the prescribing doctor’s name, the medication, the dosage, and the date. For repeat prescriptions — chronic medications for blood pressure, diabetes, thyroid conditions — that means a longitudinal record of your health over years. Every refill is another data point. The platform knows your medication history better than most of your relatives do. Tata 1mg was acquired by Tata Digital, part of one of India’s largest conglomerates. PharmEasy is backed by substantial venture capital, including from SoftBank. These are no longer small startups optimizing for user experience. They are companies with investors, revenue pressures, and corporate incentives to find value in the data they hold. What their privacy policies actually say varies. Most permit use of data for “improving services,” “analytics,” and “marketing.” Those categories are broad enough to cover a great deal. This is not unique to pharmacy apps. Nearly every platform in India uses similar language. But the sensitivity of prescription data makes the vagueness particularly concerning. To be precise about what we know and don’t know: there are no confirmed public reports of Indian pharmacy platforms selling prescription records to brokers. That is what IMS Health did in the US. What is documented here is different. These platforms’ privacy policies permit uses of health data that go well beyond filling your order. Companies are permitted to do a great deal under their own terms. What they have disclosed doing publicly is far narrower. That gap is exactly where privacy risk lives. What pharmaceutical companies want with this data</h2> Prescription data from Indian pharmacies could reach pharmaceutical companies through direct sale, data partnerships, or aggregated analytics products. If it did, the use cases are well understood from the US market. Drug makers want to identify which doctors prescribe their drugs heavily, to reward them. They also want to know which prescribe competitors’ drugs, to target with sales effort. They want to find patient populations for clinical trial recruitment. They want to understand demand by geography to optimize distribution. In some markets, they use patient-level data to target branded drug advertising directly to consumers. The neighborhood chemist is not immune to this either. Busy independent pharmacies increasingly use point-of-sale and inventory software — these systems digitize every prescription filled. The data may sit on a local server. Or it may sync to a cloud platform the pharmacist chose based on price, not privacy practices. The pharmacist who’s been serving your neighborhood for twenty years may genuinely have no idea what the software vendor’s data-sharing arrangements look like. What DPDPA 2023 says — and what it doesn’t yet require</h2> India’s Digital Personal Data Protection Act 2023 applies a unified personal data framework. Health data, including prescription records, is personal data under the DPDPA. Heightened obligations apply to Significant Data Fiduciaries designated by the central government, rather than being tiered by data category. The act does require explicit, purpose-specific consent for personal data processing across the board. A blanket “by using this service, you agree to our data use” buried in terms of service is not supposed to meet that standard. Whether current online pharmacy consent flows actually meet DPDPA’s requirements is an open question. India notified the DPDP Rules and stood up the Data Protection Board in late 2025. But 2026 is a phased “soft enforcement” period, with the heaviest penalties for core obligations arriving by mid-2027. Companies know this. The practical consequence is that the full compliance pressure DPDPA’s data-minimization and consent requirements imply has not arrived yet. Apollo Pharmacy, as part of the Apollo Hospitals group, is integrated with ABDM — the Ayushman Bharat Digital Mission — which includes a health consent framework. ABDM’s consent architecture is more explicit than a typical app’s privacy policy. It specifies which data is being shared, with whom, and for what purpose. It also gives users a mechanism to revoke consent. That’s meaningfully better than the alternatives. It doesn’t mean Apollo’s data practices are perfect, but the architecture at least acknowledges the sensitivity of what’s being collected. The re-identification problem, again</h2> It is worth saying plainly: “de-identified” prescription data is not safe. The fields that make prescription data commercially valuable — drug name, dosage, prescribing doctor, date, geographic area — are the same fields that make it re-identifiable. Picture a person in a specific pin code, filling a prescription for a psychiatric medication, on a recurring monthly basis. That is not a nameless data point. They are a person who can be found. This isn’t a hypothetical risk. It is a documented property of health data that researchers have established over two decades of privacy research. Any company that tells you your prescription data is “anonymized” and therefore safe to share freely is either mistaken or not being straight with you. How to protect your prescription data</h2> Review the privacy policy of any online pharmacy you use, specifically what it says about data sharing and analytics. Look for explicit statements about whether data is shared with pharmaceutical companies, insurers, or third-party analytics platforms. For chronic medications, consider a local neighborhood pharmacist using only a basic billing system. That may serve your privacy interests better than a large platform, even if the platform is more convenient. Convenience and data exposure are often the same transaction. Under DPDPA Section 13, you have the right to request deletion of your personal data from digital platforms, including prescription records. This right exists now, even before enforcement begins. Most platforms have not made this easy — but submitting a formal deletion request creates a paper trail. If you use Apollo Pharmacy or any ABDM-linked platform, check your consent settings within the ABDM health locker. You can see what data has been shared and revoke ongoing consents. Don’t upload prescriptions to platforms that don’t explain clearly what happens to that data. The absence of a clear explanation is itself information. What you can do right now</h2> Want to see what data brokers expose about you? See what a scan finds →</a> shows an example report: the kinds of sites that list your name, phone, and address. Once KnytX Shield launches it will find and remove these automatically. Join the waitlist</a> to get in early. India's ABHA Health ID: What It Collects & Risks Unknown — Thu, 18 Jun 2026 00:00:00 +0000 A patient walks into a government hospital in Pune. She’s been referred from a clinic in Chennai — a clinic she visited two years ago after a difficult pregnancy. The registration desk attendant asks for her ABHA number. She recites it. The attendant types it in. Within seconds, a doctor she has never met is looking at her discharge summary from Chennai and her follow-up lab reports. He can also see a prescription for a condition she has told almost nobody about. This is not a breach. This is the system working exactly as designed. The Ayushman Bharat Digital Mission is building something extraordinary: a unified health record system for 1.4 billion people. It is designed so your medical history follows you everywhere in the Indian healthcare system. Whether that sounds like progress or surveillance depends heavily on whether you understood what you agreed to when you created your ABHA ID. The short answer: Your ABHA is a 14-digit health ID that links your medical records across participating providers. It is an address, not a store: records stay with the hospitals and labs, and access runs through a consent system. The main privacy gaps are weak consent in busy government hospitals, the Aadhaar linkage, no published independent security audit, and enforcement of the DPDPA that is still ramping up. Your best protection is to create your ABHA deliberately and manage your consent log in the ABHA app. What are ABDM and ABHA?</h2> The Ayushman Bharat Digital Mission (ABDM) launched in September 2021. It is administered by the National Health Authority (NHA), which sits under the Ministry of Health and Family Welfare. The ambition is large. It aims to replace the fragmented, paper-heavy records system that has defined Indian healthcare for decades. In its place: a federated digital infrastructure that links every provider, every patient, and every record. The patient-facing piece of that infrastructure is the ABHA — the Ayushman Bharat Health Account. It is a 14-digit unique health identifier, created either through Aadhaar-based verification or through a mobile number. Once created, it becomes the linking key that ties your medical records across all healthcare providers participating in the ABDM network. ABHA is not a health record. It is an address. The records themselves stay with the hospitals, labs, and pharmacies that generated them. What ABHA does is make those records findable, retrievable, and shareable — across providers, across cities, and across time — through a consent-based access system. That distinction — ABHA as address, not store — matters when thinking about privacy. It also creates its own complications, as we’ll get to. Participation in ABDM is not mandated for most providers, but the government has been pushing hospitals, especially public ones, to integrate. As of early 2026, tens of thousands of healthcare facilities are registered on the ABDM network, along with thousands of labs and pharmacies. What gets linked to your ABHA ID</h2> When a participating provider links a health interaction to your ABHA number, these are the categories of records that can be associated: Discharge summaries. Any inpatient stay at a registered hospital — the summary prepared on discharge, including diagnosis, procedures, and follow-up instructions. Prescriptions. Digital prescriptions issued by registered doctors. Pharmacy dispensing records from participating pharmacies can also be linked. Diagnostic reports. Blood tests, urine analysis, imaging reports (X-rays, MRIs, ultrasound), pathology findings — anything generated by a lab or diagnostics center registered on the ABDM network. Immunization records. Vaccine records, including those linked through the CoWIN platform, which was integrated with ABDM infrastructure. Chronic condition management records. If you’re being managed for diabetes, hypertension, or another ongoing condition and your provider participates, those longitudinal records can be linked and tracked over time. The storage model is federated. The NHA does not hold a central copy of your MRI or your discharge summary. Those stay with the Health Information Provider — HIP — that created them. What is centralized is the consent log and your ABHA identity — the registry that knows which providers hold records tagged to your ID and what consents are currently active. This model was a deliberate design choice. It reduces the catastrophic-breach risk of a single central repository. It also means that if a hospital’s own systems are compromised, your records there are exposed — that is a provider-side risk, not an ABDM-specific one. The consent architecture — and where it breaks down</h2> The ABDM framework is built on what the NHA describes as consent-based health data sharing. Here is how it’s supposed to work. Healthcare providers on the ABDM network fall into two roles. Health Information Providers (HIPs) generate and hold records. Health Information Users (HIUs) are entities that want to access records. A doctor at a new hospital, for example, acts as a HIU when they want to pull your records from a previous provider. When a HIU wants to access records linked to your ABHA ID, they must submit a consent request. You receive that request through a PHR — Personal Health Record — application. The consent request specifies which categories of records are being requested, the purpose, and the time window for which access is being sought. You approve or deny it. If you approve, the requesting HIU gets time-limited, purpose-specific access. PHR applications that participate in this system include the government’s own ABHA app (previously integrated with Aarogya Setu). Others include Practo, PharmEasy, and private health platforms that have joined the ABDM ecosystem. The consent mechanism in these apps is reasonably well-designed. You can see pending requests, review active consents, and revoke access. The problem is not the app. The problem is what happens before anyone opens the app. Busy government hospitals are the ones integrating with ABDM most aggressively. There, registration often goes like this. A patient arrives. A desk attendant asks for their ABHA number, or helps them create one on the spot, links their records, and moves on to the next patient. Time-limited consent, purpose-specific access, the ability to revoke: none of these are explained. In many cases, patients don’t know a PHR app is involved at all, or that consents can be managed through it. This is the real consent gap in the ABDM architecture. The system provides the tools for meaningful consent management. The implementation, particularly in public health settings serving patients with low digital literacy, frequently doesn’t use them. Who can actually see your records</h2> Within the ABDM framework, access to records linked to your ABHA ID falls into several categories. Providers you explicitly consent to. This is the intended primary use case — a doctor at a new hospital requests access, you approve it, they can see relevant records for the duration you specified. Emergency access. ABDM has provisions for situations where a patient cannot provide consent — emergencies, unconsciousness. In these cases, certain emergency access mechanisms can be activated. The specifics of what can be accessed, and by whom, without prior consent are defined in the ABDM framework documents. That scope is deliberately broad enough to be useful in genuine emergencies. Whether it is narrow enough to prevent misuse is a separate question. Research and public health. The ABDM framework includes provisions for the use of de-identified health data for public health research and epidemiological surveillance. The NHA has described this as a significant potential benefit — and it is. Population-level insights from unified health records could transform India’s public health response capacity. The privacy concern here is whether de-identification is robust enough, and under what conditions identified data could be accessed by government agencies for public health surveillance purposes. The framework language on this is broad. Government agencies. This is where the architecture meets India’s broader governance context. Health data collected through systems integrated with Aadhaar-based identity sits in a regulatory environment where data protection enforcement is still ramping up. The Digital Personal Data Protection Act passed in 2023 and applies a unified personal data framework. Health data is personal data under the DPDPA, with heightened obligations applying to Significant Data Fiduciaries designated by the central government, not tiered by data category. Its rules were notified in November 2025, but most substantive duties phase in through 2027, and full penalty-backed enforcement is not yet active. Until it is, the practical protections against government access to ABDM-linked data are primarily architectural and procedural, not legal. The privacy concerns worth taking seriously</h2> There are a few issues that deserve more attention than they typically get in coverage of ABDM. The Aadhaar linkage. ABHA linked to Aadhaar is not just a convenient identity layer. Aadhaar also connects to your bank accounts through Aadhaar-enabled payments, your tax identity, and your telecom SIM through eKYC. It can even reach your location data through devices tied to Aadhaar-authenticated services. When your health record is connected to the same 12-digit number that connects all of those, the theoretical surface of any breach or unauthorized access becomes significantly larger. A compromise of your ABHA-linked health data is, in principle, one step away from a much more complete profile. No published independent audit. As of early 2026, no independent security audit of the ABDM infrastructure had been published. The NHA has described internal security standards, referenced compliance with ISO 27001 frameworks, and noted that the federated model limits central-store risk. These are legitimate points. They are not a substitute for a published third-party audit of the kind that would allow independent assessment of whether the architecture is actually secure in practice. Consent UI versus consent understanding. The PHR apps participating in ABDM present consent in reasonably clear language. But “reasonably clear” and “meaningfully informed” are different standards. A consent dialog that lists categories of records and a time window is legible to a digitally literate patient who is not in a hurry. It is often not meaningfully understood at a government hospital counter. Picture a patient who speaks a language other than Hindi or English, has limited smartphone literacy, and is focused on getting care rather than reading consent disclosures. The insurance question. India’s health insurance market is growing rapidly. Health insurers could gain access to longitudinal ABHA-linked records, through consent, affiliated PHR apps, or future regulatory changes. If they do, the implications for premium pricing, claim denials, and underwriting are significant. The current ABDM framework does not explicitly prohibit this pathway. It is worth watching. What you can do right now</h2> These are concrete steps, not general advice. Create your ABHA ID deliberately, not by default. ABHA is not automatically generated for all Indians. You create it voluntarily. If you want one, go to the official ABHA app or abdm.gov.in and create it on your own terms. Do not let it happen at a hospital registration desk where the process may not be explained clearly. Open the ABHA app and review your consent log. If you already have an ABHA ID, open the ABHA app (or Aarogya Setu, which integrates with it) and look at the consents currently active. You may find consents you don’t remember granting, or consents for providers you no longer use. Revoke anything you didn’t knowingly authorize. Limit the time window on future consents. When granting a provider access to your records, the consent interface allows you to specify a time period. Use it. A doctor treating you for a specific condition does not need six months of access — choose the shortest window that covers your treatment. Check which PHR apps have your consent. Practo, PharmEasy, and other participating apps are HIUs that may hold active consents to access your records. If you’ve used any of these apps and granted access, verify whether that consent is still active and revoke it if you’ve stopped using the service. If records were linked without a clear explanation, you can withdraw. If a hospital worker linked your records at a registration desk without explaining what consent means, that link is not permanent. You can revoke the consent through the ABHA app. The records themselves stay with the provider — but access to them through the ABDM network can be cut. Think through the trade-off honestly. ABHA genuinely helps patients with complex medical histories. If you’ve been managing a chronic condition across multiple providers, or if you’ve needed emergency care away from your home city, having your records accessible is not a small benefit. The privacy calculus is real on both sides. Opting out entirely because of privacy concerns is a legitimate choice. So is opting in carefully, understanding what you’re consenting to. The bigger picture</h2> India is building health data infrastructure that most developed countries are still trying to put together. The NHS in the UK took the better part of two decades to partially connect its health records system. The US healthcare system remains fragmented in ways that cause measurable patient harm every year. ABDM, if it reaches scale and maintains architectural integrity, could genuinely be one of the more significant public health infrastructure achievements of this decade. That potential is real. So are the risks. The main protection gap is not the ABDM architecture itself — the federated model, the consent framework, and the HIU/HIP structure are reasonable design choices. The gap is in three places: meaningful consent enforcement in the field, independent security auditing that goes beyond internal compliance attestations, and a functioning data protection law with active enforcement. Until all three are in place, the system asks patients to trust that the architecture will be implemented as designed, and that access will be limited to what’s disclosed. Trust is not nothing. It is also not sufficient. Watch the DPDPA enforcement timeline. Watch whether the NHA commissions and publishes independent audits. Watch whether insurance industry lobbying succeeds in opening ABDM data to underwriting. And in the meantime, manage your own consent log — it’s one of the few tools you actually control. What you can do right now</h2> Want to see what data brokers expose about you? See what a scan finds →</a> shows an example report: the kinds of sites that list your name, phone, and address. Once KnytX Shield launches it will find and remove these automatically. Join the waitlist</a> to get in early. How Health Insurers Profile You Before You Apply Unknown — Wed, 17 Jun 2026 00:00:00 +0000 You sit down to fill out a health insurance application. Name, date of birth, address, a few medical history questions. You answer honestly. You hit submit. What you don’t know is what happens by the time the underwriting system processes your form. It may have already queried two or three external databases you never filled out. From those, it builds a risk profile around you. It can include medications you’ve taken, neighborhoods you’ve lived in, and financial signals you’ve never thought of as health data. The form was formality. The real file was assembled before you started typing. This is not speculation. It is how insurance underwriting works in the United States, and there is nothing in Indian regulations that prohibits it here. How do health insurers profile you before you apply? In the US, underwriting systems query outside databases before setting your premium. LexisNexis Risk Solutions and Verisk sell consumer risk profiles built from public records and behavioral data. Milliman IntelliScript compiles your prescription-fill history from pharmacy benefit managers. Those queries happen before you’re quoted, often before the insurer contacts you at all. In the US you can request and dispute these reports under the Fair Credit Reporting Act. In the EU, GDPR gives you access rights. In India, the infrastructure exists but the guardrails are still thin. The companies that sell your health risk score</h2> In the US market, two companies sit at the center of pre-application health data collection: LexisNexis Risk Solutions and Verisk (through its Verisk Financial and analytics divisions). Both sell consumer risk profiles to insurers. These combine public records, address history, credit indicators, and in some products, behavioral signals inferred from purchasing data. These are not background check companies in the colloquial sense. They are underwriting intelligence platforms, and major US health and life insurers are their primary clients. More pointed is Milliman IntelliScript, which compiles prescription fill history sourced from pharmacy benefit managers. When a US insurer wants to know what medications you’ve taken over the last several years, they don’t ask you. They query IntelliScript. The database is populated by PBMs, the intermediaries that process pharmacy claims. They license the data to Milliman, which resells access to insurers as a subscription product. This covers prescriptions you filled. Opioid medications. Psychiatric medications. Diabetes and cardiovascular drugs. The fill record exists whether or not you disclosed the condition on your application. The query happens before you’re told your premium — often before you’ve received any communication from the insurer at all. What the profile contains</h2> The breadth of data that feeds into insurance risk models is wider than most people assume, and it extends well beyond clinical history. Prescription fill history is the most direct signal. A diabetes medication fill pattern lets an insurer infer both the condition and, from fill frequency and dosage changes, how well-managed it is. The same logic applies to psychiatric prescriptions, pain management regimens, and chronic condition medications that application questions are designed to surface anyway. Credit score and payment history appear counterintuitive as health indicators, but actuarial models have established a statistical correlation between financial stress and health outcomes. Whether it reflects causation or confounding doesn’t matter to the model. The correlation is commercially useful enough to include. Home ownership status and neighborhood data are proxies for socioeconomic risk — and through that, health risk. Whether you live within walking distance of a gym or a fast food cluster is a real signal. It has appeared as a data point in experimental US insurer models. The data comes from location services companies that sell aggregated mobility patterns. Social media activity has been piloted by some US insurers as a behavioral signal. The evidence that it adds underwriting value is contested. That hasn’t stopped the experimentation. None of these inputs appear on your application form. Several of them you don’t think of as health-related data at all. The India picture</h2> Indian health insurers — Star Health, HDFC Ergo, Niva Bupa, Bajaj Allianz Health, and others — operate under IRDAI’s regulatory framework. IRDAI’s underwriting guidelines require disclosure of the criteria used to set premiums and decline applications. They do not prohibit third-party data purchases for underwriting. Whether Indian insurers currently buy data broker products for pre-application profiling is not publicly confirmed. IRDAI has not issued guidance restricting it. And the commercial incentive is identical to the one in markets where it’s already standard. India’s DPDPA addresses consent and individual rights. Its rules were notified and its Data Protection Board stood up in late 2025. But 2026 is a phased soft-enforcement period, and its application to insurance underwriting data flows has not been tested. The risk isn’t that Indian insurers are definitely doing this. It’s that the infrastructure exists, the incentive is real, and the guardrails don’t. The Star Health breach: why this matters doubly</h2> In October 2024, reports emerged that personal data belonging to approximately 31 million Star Health Insurance customers had been offered for sale via a Telegram chatbot. The data reportedly included policy numbers, PAN numbers, medical claims information, and personal contact details. That is exactly the health-financial combination identity fraudsters value most, because it enables fraud across both systems at once. The attacker claimed an insider had facilitated access. Star Health disputed this and said it was investigating. The data appeared online regardless. What this illustrates is a compounding risk. The very data insurers collect to profile you — prescription history, medical claims, financial identifiers — is itself breach-exposed. Insurers are high-value targets precisely because of what they hold. The profile built on you before you apply is the same profile that surfaces on Telegram when the insurer is compromised. Your rights, by jurisdiction</h2> The rights available to you depend entirely on where you are. In the United States, the Fair Credit Reporting Act (FCRA) classifies Milliman IntelliScript and similar pharmacy history databases as consumer reporting agencies. You have the right to request a free copy of your IntelliScript report and dispute inaccurate entries — request it at milliman.com/intelliscript. LexisNexis consumer reports are accessible via lexisnexis.com/consumer-disclosures. If you’ve been denied coverage or charged a higher premium, requesting these reports is where to start. In the EU, GDPR Article 22 restricts fully automated decisions with legal or significant effects, unless there is meaningful human review. A premium determination likely qualifies. Article 15 gives you access to the personal data used in a decision about you, including its sources. Exercising this against an insurer requires a formal subject access request and persistence, but the right exists and courts have enforced it. In India, IRDAI regulations allow you to request the underwriting rationale from your insurer. One thing DPDPA has not yet clarified is whether you can compel an insurer to disclose that it used third-party data broker inputs. Nor can you always force it to identify which ones. That gap needs explicit IRDAI guidance. What you can do</h2> If you’re in the US, request your LexisNexis consumer disclosure and your Milliman IntelliScript report. You have a legal right to both at no cost. Errors in these databases — a medication attributed to the wrong person, an outdated condition — can raise your premium without your knowledge. Check your CIBIL report regularly. Credit data feeds insurance risk models in multiple markets. A payment history error that hurts you on a loan can hurt you again at underwriting. If your premium increases without explanation, ask in writing what data was used in the decision. In India, frame this as a request for underwriting rationale under IRDAI guidelines. You may not get a complete answer — but the request creates a paper trail. Be deliberate about app permissions. The data feeding insurer risk models is assembled from dozens of mundane sources: a pharmacy app, a fitness tracker, a grocery loyalty card. Each one is a feed. What you can do right now</h2> Want to see what data brokers expose about you? See what a scan finds →</a> shows an example report: the kinds of sites that list your name, phone, and address. Once KnytX Shield launches it will find and remove these automatically. Join the waitlist</a> to get in early. Hospital Tracking Pixels: Searches Reach Facebook Unknown — Tue, 16 Jun 2026 00:00:00 +0000 You’re sitting at home. You’ve just noticed a lump. You go to your hospital’s website — the one your doctor is affiliated with, the one that sends you appointment reminders and stores your discharge summaries — and you search for an oncologist. You click through to the breast cancer care page. You check the appointment availability. You’re scared and you’re alone and you think you’re doing something private. You’re not. At the exact moment you click through those pages, a small piece of JavaScript code embedded in the hospital’s website is sending a record of your visit — the URLs you opened, the search terms you typed, the buttons you clicked — to Facebook’s advertising servers. You never agreed to this. In most cases, you were never told. What The Markup found in 2022</h2> In June 2022, investigative news organisation The Markup published a report that should have caused a national reckoning. Researchers analysed the top 100 US hospital systems by revenue and found that 33 of them had installed the Meta Pixel — Facebook’s tracking code — directly on their patient-facing websites and portals. The data being sent wasn’t abstract. It included the name of the physician a patient had searched for, the condition-specific pages they had visited, and in some cases the specific appointment type they had tried to book. One hospital’s portal was transmitting a patient’s medication name alongside the name of their doctor, directly to Facebook’s ad infrastructure. Combined, those two facts paint a precise medical portrait. This wasn’t a hack. Nobody broke into anything. Hospitals installed the Pixel themselves, willingly, because it helped their marketing teams understand which Facebook ad campaigns were driving website visits. The privacy catastrophe was a side effect nobody had thought through — or had thought through and decided was acceptable. What the Meta Pixel actually does</h2> The Pixel is a snippet of JavaScript. You paste it into your website and it starts reporting back to Facebook: who visited, what they did, where they came from. For a retailer, this is how you know that your Facebook campaign drove 400 people to your product page and 12 of them bought something. It’s genuinely useful for advertising measurement. The problem is that the Pixel is indiscriminate. It doesn’t know the difference between a shoe store and a hospital. It automatically captures URLs visited, form interactions, and button clicks. On a hospital website, those interactions encode medical information. The URL hospital.com/conditions/hiv-care</code> tells you what a person was researching. The URL hospital.com/doctors/oncology/book-appointment</code> tells you that someone is trying to see a cancer specialist. The Pixel captures that and sends it to Facebook. The Pixel doesn’t ask what kind of website it’s sitting on. Nobody at Meta reviewed whether installing it on a patient portal was appropriate. The hospitals didn’t check what data it was collecting before they installed it. This is how medical information ends up in an advertising database: through carelessness, not malice. That arguably makes it worse, because at least malice has a clear target. The hospitals named — and what it cost them</h2> Advocate Aurora Health is one of the largest health systems in the US, operating across Wisconsin and Illinois. In October 2022 it disclosed that the Meta Pixel and Google Tag Manager had been installed on its patient portal. Together they had transmitted data for approximately three million patients. That figure makes it one of the largest health data exposure events of the year it was disclosed. In 2024, Advocate Aurora Health settled a class action lawsuit for $12.225 million. The settlement didn’t require the health system to admit wrongdoing. Three million patients. Years of browsing data transmitted to advertising servers. Twelve million dollars split across a class of millions. Do that arithmetic. Dignity Health, Premera Blue Cross, and Stanford Health Care were among the other institutions identified in The Markup’s investigation and subsequent reporting. The pattern was consistent: pixel installed by a marketing or IT team, privacy implications not assessed, data flowing to Facebook for months or years before anyone noticed. How it keeps happening</h2> Hospital marketing teams operate under the same pressures as any other marketing team. They need to justify ad spend. They need to show that Facebook campaigns drive appointment bookings. The Meta Pixel is the standard way to do this — it’s what every agency recommends, it’s what every platform tutorial explains, and it takes about ten minutes to install. Nobody in that workflow is thinking about what the Pixel captures on a patient portal login page. The IT team installs what the marketing team asks for. The marketing team installs what their agency recommends. The agency recommends what works for their other clients. And so, quietly, medical data starts flowing to Menlo Park. This is a governance failure, not a technical one. The code does exactly what it says it does. The question nobody asked was whether it should be running on a page where patients search for their HIV medications. What this means in India</h2> Indian hospital websites use tracking code routinely. Google Analytics, Facebook Pixel, and similar tools are standard components of digital marketing for major health systems — sophisticated operations running paid campaigns, retargeting website visitors, and measuring conversion funnels. The same Pixel that caused the US lawsuits runs on health-related pages across the Indian internet. There is no Indian equivalent of HIPAA — the US law that restricted what the hospitals were permitted to share with third parties. When The Markup’s investigation triggered enforcement in the US, it was under HIPAA, a law with teeth and a specific prohibition on sharing protected health information without patient authorisation. India has no such law for health data. The Digital Personal Data Protection Act classifies health-related data as sensitive personal data and imposes stricter obligations around consent and processing. But enforcement has not begun. The specific question of whether tracking pixels on hospital websites constitute unlawful processing of sensitive data under DPDPA has not been tested. Until it is, the practice continues without consequence. What you can do</h2> Use a tracker blocker</a>. uBlock Origin and Privacy Badger both block the Meta Pixel. Install one. They work, they’re free, and they stop this particular data pipeline at the source. Use private browsing for health searches. It doesn’t block trackers on its own, but combined with a tracker blocker it limits the fingerprint left on any given device. Better: use a different device from the one you use for social media. Use a VPN</a> when visiting health-related websites. Your IP address is itself a data point that links sessions together. A VPN prevents IP-based profiling across sites. Call to book appointments. The Pixel can’t capture a phone call. If you’re booking something sensitive, the telephone is still the most private channel. Search for health information on general search engines in private mode, not on hospital portals. The hospital website is where the Pixel lives. The search engine result is not. Keep the sensitive research off the hospital’s tracking infrastructure. If you’re in the EU: you have the right to file a complaint with your national data protection authority if a hospital website tracked you without valid consent. The GDPR requires explicit, informed consent before placing tracking pixels — consent that pop-up banners buried in cookie notices don’t cleanly satisfy. The Meta Pixel investigation proved one thing clearly: the medical information you think is private because it’s on your hospital’s website is not private at all. It is, in the absence of deliberate protective action, advertising data. That’s worth sitting with. What you can do right now</h2> Want to see what data brokers expose about you? See what a scan finds →</a> shows an example report: the kinds of sites that list your name, phone, and address. Once KnytX Shield launches it will find and remove these automatically. Join the waitlist</a> to get in early. 23andMe Bankruptcy: How to Delete Your DNA Data Unknown — Mon, 15 Jun 2026 00:00:00 +0000 23andMe filed for Chapter 11 bankruptcy in March 2025. Its genetic database — 15 million profiles — became a corporate asset. That means it went on the balance sheet next to the lab equipment and the office furniture. California Attorney General Rob Bonta issued public guidance: delete your data now. The company was subsequently acquired through the bankruptcy process. A new owner controls that database today. Whatever the old privacy policy said, bankruptcy resets the terms. A buyer can renegotiate. Your consent was given to a company that no longer exists in the same form. If you’ve been putting this off, stop putting it off. The short answer: Log in to 23andMe, open Account Settings, and use Delete Data to erase your genetic, health, and ancestry results. Download your raw DNA first if you want a local copy. Withdraw research consent separately. In the EU or UK, send a formal Article 17 erasure request for a paper trail. This takes about five minutes and stops further exposure, though it can’t retrieve data already breached in 2023. Why is genetic data different in a bankruptcy?</h2> Most data breaches or corporate acquisitions involve records you could theoretically replace. You change your password. You get a new credit card. You move to a new email address. You cannot get new DNA. Genetic data identifies you permanently. It also identifies your relatives — people who never agreed to share anything with 23andMe. Your cousin’s ancestry. Your sibling’s disease markers. Your children’s inherited conditions. One person’s consent decision affects an entire biological network. Privacy policies are not legally binding contracts in bankruptcy. A buyer isn’t obligated to honor a seller’s commitments to users. The Federal Trade Commission has challenged such transfers before. The clearest case was RadioShack’s attempt to sell customer data in its 2015 bankruptcy. But enforcement is not guaranteed, and it is certainly not fast. Then there’s the breach. In October 2023, 23andMe disclosed that 6.9 million profiles had been accessed by attackers using credential stuffing — reusing login credentials stolen from other breached sites. That data is already out. Deleting your account doesn’t retrieve what’s already circulating. But it does stop the clock on further exposure. How do you delete your 23andMe data?</h2> This takes about five minutes. Do it now, before you read the rest. Go to 23andme.com</a> and log in.</li> Click your name or avatar in the top right corner → Account Settings.</li> Scroll down to the section labeled 23andMe Data.</li> Click Delete Data. This initiates deletion of your genetic data, health reports, and ancestry results.</li> 23andMe will send a confirmation email. You have 30 days to cancel if you change your mind.</li> If you want to keep a local copy of your raw DNA: before you start the deletion, go to Settings → Browse Raw Data → Download. Save the file somewhere you control — an encrypted drive, not a cloud service.</li> If you joined the 23andMe Research program: go to Consent & Agreements in your account settings and withdraw your research consent separately. This is a distinct step from deleting your account.</li> </ol> The deletion request applies to data held by 23andMe on their servers. It does not reach back to data already shared with research partners under previous consent, and it does not affect the breach data from 2023 that’s already in other hands. What about other genetic testing companies?</h2> 23andMe isn’t the only one worth thinking about. Ancestry (ancestry.com) offers a data deletion option under Privacy → Manage My Personal Information. The path is ancestry.com/privacy/options. Their database is larger than 23andMe’s and they operate across multiple business lines — genealogy, subscription services, consumer DNA. MyHeritage allows account deletion at myheritage.com/delete-account. They had their own breach in 2018 — 92 million email addresses and hashed passwords were exposed. If you have an account there, delete it. FamilyTreeDNA disclosed in January 2019 that they had voluntarily shared user data with the FBI for law enforcement matching purposes without user notification. They later updated their terms to disclose this practice. Know what you’re agreeing to before using their service. A general rule for all of these: do not upload raw DNA files to third-party analysis sites — GEDmatch, Gedmatch Genesis, or any similar service — without reading their law enforcement sharing policies first. GEDmatch became the basis for the Golden State Killer identification in 2018. That was a murder case. The matching technology works equally well on any DNA in the database, for any purpose, by anyone with access. Can you delete your DNA data from outside the US?</h2> 23andMe’s privacy policy covers users globally. But what that means in practice depends on where you are. If you’re in the EU or UK, you have a right to erasure under Article 17 of the GDPR. Don’t just use the standard deletion flow — send a formal erasure request citing Article 17 explicitly. This creates a paper trail and triggers specific obligations. Direct it to 23andMe’s data protection contact, which is listed in their privacy policy. If you’re in India, the Digital Personal Data Protection Act treats genetic data as sensitive personal data. 23andMe holds data about Indian residents on US servers. Extraterritorial enforcement against a US company in bankruptcy is genuinely difficult — there’s no clear mechanism to compel compliance from this distance. The practical answer is the same as everywhere else: delete the account, withdraw research consent, and don’t rely on legal protection that can’t be enforced quickly. If you’re elsewhere: check whether your country has a right to erasure in its data protection law. Exercise it in writing, not just through the in-app flow. What you can’t undo</h2> Deleting your 23andMe account now is the right call. But some things are already done. If you participated in their research program, data contributed to studies may already be incorporated into published research or shared datasets. That doesn’t mean you shouldn’t still withdraw consent — stopping further sharing matters — but it means the research use of past data is largely irreversible. The 6.9 million profiles from the October 2023 breach are in the wild. If your data was among them, it exists somewhere outside any company’s deletion policy. A data exposure check won’t find your raw DNA. But it can show you what other personal information about you is already circulating on people-search sites</a> that buy and resell it. The broader lesson: genetic databases are permanent liabilities. Every company holding this data is a future bankruptcy, acquisition, breach, or regulatory failure waiting to happen. The safest genetic database is one you’re not in. Frequently asked questions</h2> Can I still delete my DNA after 23andMe was bought? Yes. The new owner still has to honor deletion requests through the same Account Settings flow. Delete now, because a buyer can renegotiate the old privacy terms. Does deleting my account remove the 2023 breach data? No. The 6.9 million profiles exposed in October 2023 are already circulating and outside any company’s deletion policy. Deletion stops further exposure, not past exposure. Should I download my raw DNA before deleting? Only if you want a personal copy for medical use. Save it to an encrypted drive you control, never a cloud service. If you don’t need it, skip this step. Do I have to withdraw research consent separately? Yes. Withdrawing research consent is a distinct step from deleting your account. Do both in Account Settings under Consent & Agreements. What you can do right now</h2> Want to see what data brokers expose about you? See what a scan finds →</a> shows an example report: the kinds of sites that list your name, phone, and address. Once KnytX Shield launches it will find and remove these automatically. Join the waitlist</a> to get in early. Wearables and Health Data: What Your Insurer Learns Unknown — Sun, 14 Jun 2026 00:00:00 +0000 Imagine an email from Aditya Birla Health Insurance: you’ve earned ₹2,000 in cashback this quarter, because your Fitbit showed you averaged 8,000 steps a day. It feels like a reward. It is also a window. The same data that earned you that cashback told your insurer how sedentary you were in December and how poorly you slept in November. If you’d had a low-activity month, it might have quietly informed how your renewal was priced. That’s the deal. The cashback is real. So is the surveillance. What fitness trackers actually collect</h2> Modern wearables are not pedometers. The list of what a current Fitbit Sense or Apple Watch Series 9 records looks nothing like counting steps. Heart rate is measured continuously — not just during workouts, but 24 hours a day. Resting heart rate, elevated heart rate during rest, heart rate variability (HRV). That last one is a proxy for stress levels and nervous system state. A Fitbit can tell, over time, whether your baseline stress is trending upward. Sleep is tracked in stages (light, deep, REM) using movement and heart rate data. Miss several nights of deep sleep in a row and it’s logged. An insurer with access to that record can infer recovery patterns, shift work schedules, and alcohol use. Heavy drinking disrupts sleep stages in characteristic ways. That is far more than any self-reported questionnaire reveals. Blood oxygen (SpO2) appears on newer Fitbits, including the Sense, Charge 5, and later models. Low SpO2 readings at night can indicate sleep apnea — a condition that affects premiums when disclosed and, when not disclosed, constitutes a material omission. ECG readings are available on Apple Watch Series 4 and later, and the Fitbit Sense. They can detect atrial fibrillation, a heart rhythm irregularity that, in the wrong hands, could affect your insurability. Menstrual cycle tracking is built into newer Fitbits and the Samsung Galaxy Watch. Regularity, irregularities, predicted fertile windows: extremely personal data, stored on servers. The privacy risks of period tracking data</a> apply here too. All of this is generated passively. You don’t submit a form. You wear a device and it produces a continuous record of your physiology. Google now owns Fitbit</h2> Google completed its acquisition of Fitbit in January 2021 for $2.1 billion. The EU approved the deal only after extracting commitments from Google. One was a pledge not to use Fitbit health and wellness data for Google advertising for ten years from the approval date. That deadline is 2030. After that, the commitments expire and Google’s obligations are less clear. What Google has done in the meantime is integrate Fitbit into Google Health. Your health data now lives inside the same company that holds your search history, location history, Gmail, and Google Pay transactions. Your steps and sleep data are part of that picture — connected to everything else Google knows about you in ways that are difficult to fully audit. Google maintains that it doesn’t use health data for ads. The question is whether that holds past 2030, and whether it holds if Google’s business priorities shift. Nobody knows. Apple’s approach is genuinely different — up to a point</h2> Apple Health data is stored on-device by default. Apple does not use HealthKit data for advertising. When a third-party app requests access to your health data, iOS prompts you explicitly — per category, per app. That granularity is real. Apple is not mining your resting heart rate to serve you ads. But Apple’s control extends only to Apple’s own systems. If you grant a third-party wellness app access to your HealthKit data — a fitness app, a meditation app, an insurance partner app — Apple’s protection ends there. That app can collect, store, and share your health data under its own privacy policy, which may be far less protective. The security of your Apple Watch data depends heavily on which apps you’ve said yes to. This is a meaningful difference from Google, but it’s not a guarantee. It relocates the risk from Apple to the apps sitting on top of Apple’s platform. The insurance angle</h2> The connection between wearables and insurance is no longer hypothetical. It’s live, operational, and growing. Aditya Birla Health Insurance’s Activ Health program in India offers premium discounts and cashback when customers meet fitness targets: steps, active minutes, workouts. The targets are tracked through a connected wearable or smartphone. The data flows from your device to their platform. Meeting targets earns rewards. Not meeting them doesn’t trigger an explicit penalty — today. But the insurer now has a real-time view of your physical activity that no medical test could replicate. Vitality, a program run by Discovery Health and licensed to insurers globally, operates on similar logic. Customers share health and activity data; they earn points; points translate to discounts, rewards, and premium reductions. Partners include major insurers across South Africa, the UK, Europe, and parts of Asia. John Hancock went further. In 2018, the US life insurer stopped selling traditional life insurance entirely — all new policies require participation in its Vitality wellness program. Customers wear a tracker; John Hancock gets the data. Not a voluntary add-on. The product. The concern is not that these programs are fraudulent — they operate on consent, explicit if often buried. The concern is actuarial drift. Insurers accumulating long-term fitness data will, over time, identify what it predicts. Low activity correlates with worse health outcomes. Once they can flag high-risk individuals through behavioral data rather than medical history, the pressure to price accordingly is enormous. They may not say “we’re raising your premium because your step count is low.” They’ll say “we adjusted pricing based on our risk models.” The outcome is the same. Where India stands</h2> The Insurance Regulatory and Development Authority of India (IRDAI) has not issued specific guidance on how wearable data can be used in underwriting. The framework doesn’t yet exist. The Digital Personal Data Protection Act (DPDPA)</a> classifies health data as sensitive, so explicit consent is required before collection. Insurers running wellness programs satisfy this by burying a data-sharing clause in the program’s terms. You click “join Activ Health.” Several screens in, you’ve consented to health data collection and processing. Legally valid. Not meaningful in any practical sense. Most people joining for premium discounts are not reading five pages of data processing terms. They’re clicking through to the cashback. The EU extracted binding commitments from Google over Fitbit data because it built the regulatory capacity to do so. IRDAI has not moved in that direction yet. What you can do</h2> Joining a wellness program for the cashback is a rational decision. So is knowing exactly what you’re agreeing to. Before joining any insurance wellness program, read the data sharing section of the terms — not the marketing page. Which third parties receive your data? What are they allowed to do with it? Is there an exit mechanism that actually removes your historical data? On Fitbit, go to Settings > Privacy > Personal Information and review what’s shared with connected apps. Revoke access to anything you no longer use. On Apple Watch, open the Health app, tap your profile, then Sources. Review which apps have access to which categories and remove anything you don’t actively trust. The data has value far beyond the cashback it’s traded for. The rewards are real. So is what you’re giving up. What you can do right now</h2> Want to see what data brokers expose about you? See what a scan finds →</a> shows an example report: the kinds of sites that list your name, phone, and address. Once KnytX Shield launches it will find and remove these automatically. Join the waitlist</a> to get in early. What Your Therapy App Knows, & Who Else Sees It Unknown — Fri, 12 Jun 2026 00:00:00 +0000 It’s 11 pm. You open the app, select your therapist, and start typing about the panic attack you had at work. You describe it in detail — the chest tightness, the embarrassment, the fear that it will happen again. The app feels like a private space. The interface is calm. There’s no one else around. What you don’t see is the code running in the background: the advertising SDKs, the analytics packages, the third-party trackers loading alongside your session. You are not in a private space. You are in a product. The BetterHelp case: a company that explicitly broke a promise</h2> In March 2023, the Federal Trade Commission fined BetterHelp $7.8 million for sharing mental health data with Facebook, Snapchat, Criteo, and Pinterest — for advertising purposes. This was not a data breach. BetterHelp made a deliberate business decision. The FTC’s complaint was specific. BetterHelp collected data through intake forms, including whether users had previously been in therapy, their email addresses, and the mental health struggles they disclosed when signing up. The company then uploaded that data to Facebook to build advertising audiences. It used it to run targeted ads. It did this while explicitly telling users, in its privacy policy and in marketing materials, that their personal health data would not be used for advertising. The settlement required BetterHelp to pay the $7.8 million directly back to affected users — a full refund, distributed automatically. It also prohibited BetterHelp from sharing user health data for advertising in the future. Read that last sentence again. The prohibition was on future behavior. This happened, it ran for years, and a federal enforcement action was required to stop it. What these apps actually collect</h2> Mental health apps sit on top of one of the richest possible datasets about a human being. Intake questionnaires include clinical-grade instruments — the PHQ-9 depression scale, the GAD-7 anxiety measure. These are tools designed to surface serious symptoms. When you answer honestly, which you’re supposed to, you are disclosing exactly the kind of information that insurance companies, employers, and data brokers would pay for. In-app messaging with therapists is captured verbatim. Session frequency and duration are logged separately — even if the content were protected, the metadata tells a story. Someone who starts using a mental health app three times a week after a particular date is communicating something. That data exists whether the messages do or not. If you’ve connected a wearable</a> such as a smartwatch or fitness tracker, some apps pull in biometric data: heart rate, sleep patterns, stress indicators. That’s another layer. Payment and subscription status are logged. So is the moment you cancel. The employer problem</h2> Talkspace sells enterprise wellness packages to employers. The data that flows back under these contracts is aggregate — individual session content does not go to HR. But aggregate data has limits as a protection. Knowing that usage in a particular team spiked after a round of layoffs, or that an employee’s usage pattern changed sharply before a performance review, is information. Patterns narrow quickly in small departments. More directly: knowing that a specific employee uses a mental health app at all — even without seeing content — is information some HR departments would file away. Whether they should act on it is a separate question from whether they do. The system that’s supposed to help you requires disclosures to an infrastructure that serves your employer’s interests, not yours. The Indian picture</h2> India’s mental health app market is growing fast. The demand is real — access to qualified therapists is genuinely limited outside major cities, and the stigma around seeking help in person remains significant for many people. Apps look like a solution. iCall, run by the Tata Institute of Social Sciences (TISS), is meaningfully different from the commercial platforms. As an academic and social-welfare institution, TISS operates under different incentives. iCall is not running advertising, does not have enterprise contracts, and its data governance follows an academic ethics framework rather than a growth-stage startup’s. It is not a perfect system, but the commercial pressure that drove BetterHelp’s choices simply doesn’t apply. YourDost, Wysa, and Amaha (formerly InnerHour) are the larger commercial Indian players. Wysa, a UK-India startup, positions its AI chatbot as a wellness tool rather than a therapy replacement. Amaha offers matched therapy and psychiatric care. None have been the subject of confirmed data misuse incidents — though that reflects the current state of enforcement more than it confirms the behavior of the platforms. The Digital Personal Data Protection Act</a> applies one unified personal data framework. Mental health data is personal data under the DPDPA. Heightened obligations apply to Significant Data Fiduciaries designated by the central government, rather than being tiered by data category. The act does impose consent requirements and data fiduciary accountability across the board. Enforcement is still developing, but the legal framework is stronger than most users assume. What India does not have is anything equivalent to HIPAA. In the US, HIPAA creates specific protections for health information held by healthcare providers. In India, therapy session notes are not automatically “medical records” under existing law. That gap matters: the burden falls harder on the user to evaluate the platform, not on the platform to meet a mandatory standard. What actually makes a mental health app trustworthy</h2> The question is not whether an app has a privacy policy. Every app has a privacy policy. The question is what the policy actually commits to. End-to-end encrypted messaging between you and your therapist is the bar. Very few apps meet it. If message content can be accessed by the company’s servers — which it can be on most platforms — it can, in principle, be shared. Encryption the platform can defeat is not encryption. It is a user interface choice. The revenue model is the clearest signal. If an app is free and not grant-funded, your data is paying for it somehow — advertising, aggregate licensing, or selling insights to insurers. “Free therapy app” should trigger a question, not reassurance. An explicit prohibition on sharing data for advertising matters. BetterHelp’s privacy policy said the right things. The FTC found the company violated it anyway. Policy text and enforcement are different things. For Indian users: data stored in India limits exposure to foreign government requests and simplifies exercising DPDPA rights. What you can do</h2> Check the privacy policy of any mental health app you use for references to advertising SDKs, third-party analytics, or data sharing with “partners.” Those words are doing real work. If you see them in the context of your health data, that’s your answer. Use DPDPA Section 12 to request erasure from Indian mental health platforms after you finish a course of therapy. Don’t leave session data sitting in an app you’ve stopped using. Active users can make decisions about their data. Dormant accounts mostly just accumulate. Consider the alternative that doesn’t involve an app at all. End-to-end encrypted messaging — Signal, for instance — used with a private therapist you’ve hired directly gives you stronger privacy guarantees than most mental health platforms. There’s no app company in the middle. There’s no enterprise contract. There’s no advertising SDK. The therapist’s notes are governed by their professional obligations, not by a startup’s growth targets. If you’re in a low-resource situation where iCall is the realistic option, that’s a better choice than a commercial platform operating on advertising-funded free tiers. The data incentives are genuinely different. What you can do right now</h2> Want to see what data brokers expose about you? See what a scan finds →</a> shows an example report: the kinds of sites that list your name, phone, and address. Once KnytX Shield launches it will find and remove these automatically. Join the waitlist</a> to get in early. Period Tracking Apps: A Privacy Disaster in Waiting Unknown — Thu, 11 Jun 2026 00:00:00 +0000 On June 24, 2022, the US Supreme Court overturned Roe v. Wade. Within hours, searches for “how to delete period tracking app” spiked across the country. Millions of women had spent years logging their cycles, moods, and pregnancy attempts into apps like Flo and Clue. Suddenly they had a very concrete reason to worry about where that data lived. Privacy researchers were not surprised. They had been documenting these problems for years. What the Dobbs decision did was make the stakes legible to everyone else. The FTC caught Flo lying</h2> Flo Health is one of the most widely used period tracking apps in the world. The company claims 70 million monthly active users. It markets itself as a personal health companion — a private space to track your cycle, fertility windows, pregnancy attempts, and mood. In January 2021, the US Federal Trade Commission found that Flo had been sharing users’ health data with Facebook and Google for advertising purposes. This happened while Flo’s own privacy policy promised not to share health data with third parties for advertising. The data shared included whether users were menstruating, trying to get pregnant, or had experienced a miscarriage. It included mental health notes users entered manually. It went to Facebook’s analytics tool — which meant Facebook’s ad systems could use signals about pregnancy loss to target ads. Flo settled. The settlement required the company to notify affected users and to instruct app stores to delete cached versions of the app that contained the old data. Flo did not admit wrongdoing. The company updated its privacy policy and continued operating. What the FTC case confirmed — in writing, with evidence — is that an app can promise you privacy and do the opposite. For years. Without telling you. What these apps know about you</h2> The data category here is not “health-adjacent.” It is the most intimate possible record of your reproductive life. Period tracking apps typically collect: cycle dates and flow intensity; sexual activity logs; pregnancy attempts and their outcomes, including miscarriages; mood and mental health notes; physical symptoms entered manually over months or years. Some apps add weight, sleep, and medication logs. Many prompt users to enter this information daily, building a longitudinal health record more detailed than most clinical files. Individually, some of these data points seem minor. Together, they form a profile. It can tell an insurer whether you are likely to become pregnant. It can tell an employer something about your health status. And in a legal context, it can document your reproductive history in precise timestamped detail. This is not speculative. The Dobbs aftermath made the legal risk concrete. If period tracking data can be subpoenaed in a US state investigating illegal abortions, it can be subpoenaed for other purposes in other jurisdictions. The data exists. Someone has it. Where it goes next depends entirely on who holds it and what law applies to them. The problem is not just Flo</h2> After the FTC settlement, Flo got a lot of attention. Other apps got comparatively little. That asymmetry does not reflect their actual data practices. Apps like NUA and Maya serve Indian users directly. Ovia — now owned by Labcorp, one of the largest clinical laboratory companies in the US — markets itself to employers and insurers as a fertility benefits platform. Employers who offer Ovia as a benefit receive aggregated data about their workforce’s reproductive health. The consent mechanism is the app’s terms of service, which most users do not read. Clue — a Berlin-based app — has a meaningfully stronger privacy posture than most US competitors. It falls under GDPR, which imposes actual enforcement risk on companies that mishandle European users’ data. Clue has been more explicit about what it does not share and why. That does not make it perfect. But regulatory jurisdiction matters, and German data protection authorities have more teeth than most. The deeper problem is structural. Even apps with genuinely good intentions embed third-party analytics SDKs — Firebase, Amplitude, Mixpanel — that collect session data, device identifiers, and behavioral signals. Those SDKs can link your in-app behavior to your broader advertising profile even when the app itself never directly sells your health data. The data leaves through the plumbing, not the front door. Many apps also include broad “anonymized research” consent clauses. These allow data to be shared with “research partners,” a category that can include pharmaceutical companies, insurers, and academic institutions. The theory is that stripping your name from the record makes it anonymous. It rarely does. A dataset containing your cycle dates, your zip code, and your age is not anonymous. It is re-identifiable. Why this matters in India specifically</h2> The abortion rights framing that dominated US coverage does not map cleanly onto India. But the risks are not smaller. They are different. Reproductive health data in India carries its own set of exposure risks. Information about fertility struggles, pregnancy loss, or irregular cycles could affect marriage prospects in communities where that information is considered deeply private. It could surface in employment discrimination — against women of reproductive age, who already face documented hiring bias. Insurance underwriting in India is not prohibited from using health data in the same way GDPR markets restrict it. Mental health notes are a particular concern. Many period tracking apps prompt users to log mood, anxiety levels, and emotional state alongside physical symptoms. This creates a mental health record inside an app that most users think of as a cycle tracker. That data is not protected the way clinical mental health records are. It sits on servers in the US or Europe, governed by laws that do not have your interests as a primary concern. What you can actually do</h2> Delete apps you are not using. Not “log out” — delete. If you want to track your cycle with zero data exposure, a paper calendar or a plain notes app works. No server. No SDK. No research partner clauses. This sounds obvious and it is, but it is worth stating: the tracking itself is not the problem. Who has the data is the problem. If you want a dedicated app, Clue’s GDPR compliance posture makes it a more defensible choice than US-based alternatives. Read their privacy policy. Look specifically for what they share with “research partners” and under what conditions. Turn off advertising ID tracking on your phone. On Android: Settings → Privacy → Ads → Delete advertising ID. On iOS: Settings → Privacy & Security → Tracking → disable “Allow Apps to Request to Track.” This does not eliminate SDK data collection, but it limits the ability to link your health app behavior to your broader ad profile. Before installing any health app, search its privacy policy for the words “research partners,” “third parties,” and “analytics.” The presence of those terms is not disqualifying on its own, but it tells you where to focus your questions. Under Section 13 of India’s Digital Personal Data Protection Act</a>, you can request deletion of your personal data from any app that processes it, including apps accessible in India. Many US-based apps also honor deletion requests made under California’s CCPA, even from non-US users, because their deletion infrastructure is global. Send the request in writing. Keep a record of it. The core issue is not that these apps are malicious. It is that your most sensitive health data is, right now, held by companies whose business model depends on data being useful — to advertisers, to researchers, to acquirers. Your privacy is not their primary constraint. Their privacy policy is. What you can do right now</h2> Want to see what data brokers expose about you? See what a scan finds →</a> shows an example report: the kinds of sites that list your name, phone, and address. Once KnytX Shield launches it will find and remove these automatically. Join the waitlist</a> to get in early. Genetic Privacy: The DNA Testing Data Crisis Unknown — Wed, 10 Jun 2026 00:00:00 +0000 In March 2025, 23andMe filed for Chapter 11 bankruptcy in the United States. The company owed creditors. Its consumer business had collapsed. Its stock had been delisted. And its most valuable remaining asset was the genetic profiles of 15 million people. Court filings named that database as the prize a buyer might acquire. The California Attorney General issued an unusual public notice. It didn’t wait for the bankruptcy process to play out. It told 23andMe customers directly: delete your data now, before it can be sold to whoever buys the company’s assets. That’s not standard regulatory boilerplate. That’s an alarm. And the sale did happen. In June 2025, a US bankruptcy court approved the transfer of 23andMe’s assets, over the objections of more than 30 states. The genetic database went to TTAM Research Institute, a nonprofit founded by 23andMe’s own former CEO, for $305 million. The sale closed in July 2025, and the business now operates as a nonprofit (reregistered as the 23andMe Research Institute). The buyer agreed to stronger privacy commitments as a condition of the deal, including continued deletion rights. But the court found that no fresh customer consent was needed to transfer the data at all. That is the precedent this case sets. This is not a hypothetical scenario about what could go wrong with consumer DNA testing. It already went wrong. The question now is what it means for the tens of millions of people who sent their saliva to a lab expecting a fun ancestry report. And what it means for their relatives who never consented to anything. What genetic testing companies actually collect</h2> When you mail in a saliva sample to 23andMe, Ancestry, or any similar service, you’re not just getting an ancestry pie chart in return. The company gets your raw SNP data — single nucleotide polymorphisms, the points in your genome where people commonly vary. A standard consumer test reads hundreds of thousands to over a million of these positions. That raw file is the foundation of everything else. From that data, companies build: Disease risk predictions. 23andMe offers reports on predispositions to BRCA1 and BRCA2 variants — genes associated with elevated breast and ovarian cancer risk. Reports on Alzheimer’s predisposition. Type 2 diabetes. Parkinson’s. These aren’t diagnoses. They’re probabilistic estimates. But they’re derived from your actual genome and they sit in a database alongside your name and email address. Ancestry composition. The ancestry breakdown — the part people share on social media — is derived from the same raw data. It identifies ethnic and geographic heritage in ways that can be highly sensitive depending on context. Family relationships built from the database. This is where it gets genuinely strange. Services like 23andMe’s DNA Relatives feature map your genetic connections to other users. The more people who test, the more detailed this picture becomes. You may share genetic data with a half-sibling you didn’t know existed. You may be connected — without asking — to a relative who tested years ago. The network effect means the database’s value grows with every new customer. Voluntarily entered health and behavioral data. Users who participate in research surveys add layers of information: medical history, medications, sleep patterns, mental health, diet. This is opt-in, but once entered, it compounds what the company knows. The cumulative picture is unlike anything else in consumer data. It’s not what you searched for or where you travelled. It’s your biology. Why genetic data is categorically different</h2> You can change your password. You can get a new credit card number. You cannot change your genome. Every other data breach has a mitigation. If your email address is exposed, you can change it. If your location history is leaked, you can change your phone. Genetic data has no equivalent recovery. Once it’s out, it’s out — permanently, and for every biological relative you have. This creates a consent problem that has no clean solution. When you test your DNA, you’re also implicitly sharing information about your parents, your siblings, your children. They haven’t agreed to anything. Their genetic variants are partially readable from yours. A study published in Science in 2018 estimated the reach of this. With a database covering just 2% of a population of Northern European descent, it becomes possible to identify almost any individual. Not from their own profile, but from their relatives’ profiles. The implication is that opting out of these databases eventually becomes impossible for anyone with tested relatives. Law enforcement has already exploited this. In 2018, investigators used GEDmatch — a genealogy site where users voluntarily upload raw DNA files — to identify suspects in the Golden State Killer case. The site’s terms of service at the time did not anticipate this use. After the investigation became public, GEDmatch changed its policies and was eventually acquired by Verogen, a forensic genomics company. The genealogy database became a forensic tool. Users who uploaded their DNA for family history research were, without knowing it, participating in a law enforcement resource. FamilyTreeDNA went further. In January 2019, a BuzzFeed News investigation revealed that the company had proactively agreed to let the FBI search its database of customer DNA profiles. It did so without telling its customers, without a legal order, and before any subpoena process. The company’s founder subsequently defended the decision on national security grounds. Users had no idea this was happening when they tested. The insurance dimension is equally serious. In the United States, GINA — the Genetic Information Nondiscrimination Act — prohibits health insurers and employers from using genetic data in coverage and hiring decisions. That sounds protective. It isn’t complete protection. GINA explicitly does not cover life insurance, disability insurance, or long-term care insurance. An insurer issuing a life insurance policy can, in many US states, ask about known genetic risks and factor them into underwriting. The protection has a substantial gap. The 2023 breach: how credential stuffing became a family tree problem</h2> In October 2023, 23andMe disclosed a breach. Attackers had used credential stuffing</a> to access around 14,000 accounts directly. That means taking username and password combinations from other breaches and trying them on 23andMe accounts. That sounds bad but manageable. Then 23andMe disclosed the actual scope. Compromised accounts had the DNA Relatives feature active. So attackers could harvest profile data from accounts that hadn’t been directly breached, but were connected in the genetic network. The final count: approximately 6.9 million profiles were affected. The company’s initial communications framed this primarily as a credential issue. Users should have used stronger passwords or enabled two-factor authentication</a>. The argument was technically accurate and deeply misleading. One compromised account could expose data from millions of connected accounts. That danger of the DNA Relatives feature was a design choice 23andMe made. Customers had no way to anticipate that enabling a family history feature would make them vulnerable to breaches targeting strangers who happened to share DNA. 23andMe subsequently changed its approach to two-factor authentication and the DNA Relatives feature. By that point the data was already circulating. The 6.9 million affected profiles included a large proportion of users with Ashkenazi Jewish heritage and Chinese ancestry, the groups explicitly targeted in the dark web dataset. That adds an ethnic profiling dimension to an already serious breach. The rest of the industry</h2> 23andMe’s collapse focused attention on the sector, but the rest of the industry operates on similar models. Ancestry is the largest consumer DNA company by database size — over 22 million customers. It is owned by Blackstone, the private equity firm. Blackstone’s business model is not consumer genomics. It’s capital allocation. Ancestry is an asset on a balance sheet, which means its genetic database could eventually be subject to the same acquisition pressures that collapsed 23andMe’s independence. MyHeritage, an Israeli company, operates a large global genealogy service with DNA testing. Its privacy policy, like most in the sector, allows for data sharing with research partners and reserves rights around future business transfers. Dante Labs is an Italian company that offers more clinical-grade whole genome sequencing rather than SNP array testing. Whole genome sequencing reads far more of your genome than a consumer ancestry test. The data is correspondingly more sensitive and potentially more actionable for health or insurance purposes. Then there’s GEDmatch, now under forensic ownership, which occupies an odd position: it doesn’t test DNA, but it accepts raw DNA uploads from any source. Users who tested with 23andMe or Ancestry and wanted to search a broader database would upload their raw file to GEDmatch. That file now sits in a forensic genomics company’s database. Genetic privacy in India</h2> Direct-to-consumer genetic testing is a growing market in India. Companies including Mapmygenome and Xcode Life offer ancestry, carrier status, and health predisposition testing to Indian consumers. The sector is small compared to the US but expanding. The Digital Personal Data Protection Act 2023 classifies genetic data as sensitive personal data, which carries higher processing obligations. That classification matters in principle. In practice, enforcement of DPDPA for cross-border data transfers is still developing — the implementing rules were not fully finalised when the law came into force. The critical issue for Indian users is jurisdiction. 23andMe and Ancestry are companies incorporated and operating in the United States. When an Indian customer sends them a saliva sample, the resulting data is held under US law, not Indian law. DPDPA does not reach into a US bankruptcy court. The California Attorney General’s warning about deletion covered 23andMe’s user base broadly. But an Indian user has limited legal leverage over a US company in a US bankruptcy proceeding. Indian users who have tested with US-based companies should not assume that Indian privacy law offers practical protection for data held on US servers. What you should do now</h2> If you have a 23andMe account: Delete your data. The path is: Account settings > 23andMe Data > Delete Data. This initiates deletion of your genetic data, health reports, and associated account information. The process takes a few weeks. The 2025 sale to TTAM/23andMe Research Institute has closed, but customer deletion rights were preserved as a condition of that sale, so the option still works. Use it if you no longer want your genome in the database. Before you delete, download your raw data file if you want to keep a local copy. You can save the file to an encrypted drive and have the data without it sitting in a corporate database. Once you’ve confirmed the download, proceed with deletion. Understand what deletion does and doesn’t cover. 23andMe ran large-scale studies with pharmaceutical partners, including GlaxoSmithKline. If you participated in those research programs, your data may have already been incorporated into research datasets. 23andMe’s terms indicated that research data is anonymised before being shared. But anonymisation of genetic data is not as durable as anonymisation of other data types. There is no mechanism to reliably recall data already shared with research partners. For other services: Read the privacy policy for three things specifically. Whether the company shares data with third parties. How it responds to law enforcement requests. And what happens to your data if the company is acquired or goes bankrupt. Most policies address this under a business transfer clause. The standard language allows transfer of your data to acquirers. GEDmatch specifically: Do not upload raw DNA to GEDmatch unless you’ve read its current terms and are comfortable with law enforcement matching. Since its acquisition by Verogen, the default opt-in status for law enforcement matching has changed more than once. Verify the current setting, not what you remember from when you first registered. For Indian users considering testing: If you’re looking at Indian providers like Mapmygenome or Xcode Life, confirm where your data is stored and processed. Domestic storage means DPDPA applies more directly. If you’re considering US providers for a wider database, understand that your data will be governed by US law. The actual risk model</h2> The concern with genetic data isn’t only a big, dramatic breach. It’s accumulation. It’s the quiet business transfer. It’s the privacy policy clause that says “we may share your data with our affiliates and business partners” buried on page eight. It’s the bankruptcy where your genome becomes a line item in a creditor settlement. Your genome is permanent. It connects you to your relatives. It can reveal disease risk, ancestry, and family relationships you didn’t know about and didn’t consent to share. Law enforcement can use it. Insurers in some jurisdictions can use it. And the company holding it can fail, be acquired, be subpoenaed, or be breached. None of this means genetic testing has no value. It can reveal clinically actionable health information. It can connect adoptees with biological families. The technology is real and the benefits are real. But the privacy trade-off deserves honest accounting. The 23andMe bankruptcy wasn’t a failure of a single company. It was a preview of what happens when sensitive biological data is treated as a consumer product asset — which is how every company in this sector treats it. Delete what you can. Understand what you can’t. What you can do right now</h2> Want to see what data brokers expose about you? See what a scan finds →</a> shows an example report: the kinds of sites that list your name, phone, and address. Once KnytX Shield launches it will find and remove these automatically. Join the waitlist</a> to get in early. Who's Selling Your Medical Data: Health Data Brokers Unknown — Tue, 09 Jun 2026 00:00:00 +0000 Rohan got the letter in November. His health insurance premium was going up — again — this time by 23%. He called his insurer. They said it was based on “risk assessment.” He pushed harder. Eventually someone told him, in the polished language of the insurance industry, that his profile had been “updated.” He’d switched to a new blood pressure medication eight months ago. He’d filled the prescription at a pharmacy chain. He’d told his insurer nothing. Somewhere between the pharmacy counter and his insurance company’s actuarial model, his prescription history had been sold. This isn’t a hypothetical. This is how the health data broker industry works, and it operates at a scale that makes the general data broker economy look modest. Who sells your medical data? A handful of giants sit at the center. IQVIA holds prescription and clinical data on roughly 900 million patients. Optum aggregates medical claims on more than 270 million Americans. In India, Practo, 1mg, and PharmEasy hold prescription and consultation records for tens of millions. They sell or license this data to pharmaceutical companies, insurers, marketers, and analytics firms. Your rights depend on where you live: GDPR erasure in the EU and UK, and DPDPA deletion rights in India (now phasing in). This complements the general data broker economy</a>. The companies at the center of it</h2> IQVIA is the largest health data company in the world. Most people have never heard of it. IQVIA was formed through the 2016 merger of IMS Health and Quintiles. It operates in more than 100 countries and holds data on approximately 900 million patients — a figure from their own marketing materials. They sell prescription data, clinical trial data, patient-level longitudinal records, and physician-targeting intelligence to pharmaceutical companies. Their revenue runs above $14 billion annually. They are not a research institute. They are a data company. Optum — a subsidiary of UnitedHealth Group — aggregates medical claims data on more than 270 million Americans. That’s the majority of the US population. Optum combines insurance claims, pharmacy benefit management, and electronic health record data into one of the most comprehensive health databases ever assembled. UnitedHealth is both an insurer and a data company. The tension between those two roles is obvious. The conflict of interest is rarely discussed. Veeva Systems handles pharmaceutical CRM — connecting drug company sales representatives to physician data, prescribing patterns, and contact databases. A pharmaceutical sales rep may walk into a doctor’s office knowing exactly which drugs that doctor has been prescribing, and to how many patients. That’s Veeva’s data at work. In India, the picture is different in scale but not in kind. Practo, which operates in 20+ countries, holds appointment records, consultation notes, prescription histories, and lab results for tens of millions of users. 1mg processes prescription uploads, medical records, and lab test data across a user base in the hundreds of millions. PharmEasy — despite its financial difficulties — aggregated prescription data on a scale that made it one of India’s largest digital health platforms. None of these companies are secret. All of them make money, directly or indirectly, from health data flows. The mechanism that connects your prescription to an insurance company’s pricing model runs through them. How your health data gets collected</h2> Start with the pharmacy. Every prescription filled in a pharmacy generates a record, whether paper or digital. It captures the drug, the dose, the prescribing doctor, the date, and the patient’s insurance details. Pharmacy benefit managers (PBMs) process these claims on behalf of insurers. In doing so, they collect a complete longitudinal record of every medication you’ve ever filled. Express Scripts, CVS Caremark, and OptumRx are the three largest PBMs in the US. Between them, they process the majority of American prescription claims. That data doesn’t stay siloed. Insurance claims are even richer. Every time you see a doctor, the visit is coded — a diagnosis code from the International Classification of Diseases (ICD), a procedure code, a facility code, a date. Insurers collect this across years and decades. Health data brokers buy, aggregate, and resell these claim-level records. The patient’s name is often stripped out, but enough attributes remain (age, geography, condition codes, drug history) that re-identification is trivial. Electronic health record (EHR) systems are the repository for everything your doctor knows about you. Systems like Epic, Oracle Health (formerly Cerner), and Meditech hold your diagnoses, medications, test results, clinical notes, and imaging records. Hospitals enter into data-sharing agreements with analytics vendors and research organizations. Some of these arrangements are legitimate. Some are aggressive. Most patients have no idea they’ve happened. Health apps and wearables add another layer. Fitbit data has been the subject of Google’s acquisition and subsequent privacy controversy. Apple Health aggregates step counts, heart rate, sleep patterns, and — if you’ve connected other apps — menstrual cycle data, medication logs, and mental health check-ins. Period tracking apps like Flo and Clue collect data about reproductive health that is, in certain political climates, deeply sensitive. These apps are not covered by HIPAA in most cases, because HIPAA applies to healthcare providers and insurers — not consumer apps. They can share data with advertisers, analytics platforms, and third-party partners under terms most users have never read. Patient support programs run by pharmaceutical companies are a particularly opaque collection point. Drug manufacturers run these programs — co-pay cards, adherence apps, nurse hotlines — ostensibly to help patients afford or manage their medications. They also generate detailed data on which patients are taking which drugs, how consistently, and with what side effects. This data often flows back to the company’s commercial operations. In India, the Ayushman Bharat Digital Mission (ABDM) is building the infrastructure for a national health ID system. The ABHA (Ayushman Bharat Health Account) ID is designed to link your health records across hospitals, clinics, labs, and pharmacies into a unified longitudinal record. The stated goal is care coordination and accessibility. The data governance implications are still being worked out — and the opt-out mechanisms, while they exist, are buried in the ABHA app and confusingly documented. What gets sold, and to whom</h2> Pharmaceutical companies are the largest buyers of health data, by revenue. They buy physician-level prescribing data to identify which doctors write the most prescriptions in a given therapeutic category. They then target those doctors with sales rep visits, speaker programs, and conference invitations. This practice — called “detailing” — has been legal and routine for decades. IQVIA’s core business model is built on supplying this data. They also buy patient-level data, with varying degrees of de-identification. It shows which patient populations are being treated, with what drugs, and what outcomes are documented in claims data. This informs clinical trial recruitment, drug positioning, and market sizing. Insurance companies use health data for underwriting — the process of deciding how much risk a given policyholder represents and what premium to charge. When a data broker sells prescription history to an insurer, the insurer can use that information to infer conditions the policyholder never disclosed. The ACA in the US prohibits insurers from using pre-existing conditions in pricing — but enforcement gaps exist, and outside the ACA market, the restrictions are different. In India, IRDAI regulations govern health underwriting, but data sourcing practices are not yet specifically restricted. Employers in some US states have purchased wellness data on employees. The stated goal is better benefits programs. But it also blurs the line between wellness and surveillance. In India, this practice is murky. There is no law that clearly prohibits an employer from purchasing health data about employees from a data broker, and no enforcement authority that has tested this question. Marketing companies build audience segments based on health conditions. Say you’ve searched for diabetes management resources, filled a statin prescription, or joined an online health forum. You may then appear in a “likely diabetic” or “cardiovascular risk” audience segment that advertisers can buy. These segments are sold through programmatic advertising platforms. You may see ads for insulin brands, cardiac rehabilitation programs, or weight loss drugs. These are often served because your condition was inferred from data you generated somewhere else. Debt collectors have used health data to target people based on vulnerability. Patients who have accumulated medical debt become targets for collection agencies. Their financial stress can be inferred from credit data combined with health-condition data. The agency then knows not just that they owe money, but that they may be dealing with a serious illness. This is real, documented, and very difficult to stop. The India-specific gap</h2> India’s Digital Personal Data Protection Act 2023 applies a unified personal data framework. Health data is personal data under the DPDPA. Heightened obligations apply to Significant Data Fiduciaries designated by the central government, rather than being tiered by data category. The act requires explicit, informed, purpose-specific consent before processing personal data. The DPDPA is, in principle, a meaningful protection. In practice, enforcement is still ramping up. India notified the DPDP Rules and stood up the Data Protection Board in late 2025. The body adjudicates complaints and can impose penalties, but 2026 is a phased “soft enforcement” window, with the heaviest penalties for core obligations arriving by mid-2027. In the meantime, health apps operating in India can collect your prescription history, share it with analytics partners, and use it for purposes you didn’t specifically agree to. There is limited practical enforcement to stop them yet. The privacy policies of major Indian health platforms are instructive. They tend to be long and written in legalese. They contain broad consent clauses that permit data sharing with “affiliates,” “service providers,” and “business partners” — categories capacious enough to include data brokers. Users who click through onboarding flows without reading these policies have, technically, consented to data sharing they would find alarming if described plainly. ABDM opt-out is possible but not simple. You can disable data sharing through the ABHA app — the setting is under “Privacy Settings” — but the UI assumes familiarity with how the system works. Millions of people who have been auto-enrolled in ABHA through Ayushman Bharat hospital visits may not know they can opt out. The gap between legislative intent and on-the-ground practice is wide. It will narrow when enforcement begins. Until then, the burden is on individuals. Why anonymization doesn’t protect you</h2> Health data brokers routinely argue that their data is de-identified — that names and direct identifiers have been stripped. This is technically true and practically meaningless. A 1997 study by Latanya Sweeney demonstrated that 87% of Americans could be uniquely identified using just three data points: ZIP code, birth date, and sex. Health data is far richer than that. A dataset with your age, gender, diagnosis codes, prescriptions, geography, and healthcare dates is trivially re-identifiable. It can be matched against insurance enrollment records, voter rolls, or any other dataset holding a few of those fields. IQVIA’s “anonymized” prescription data has been the subject of academic re-identification research repeatedly. Researchers have re-identified specific physicians from supposedly anonymized prescribing records. The patterns are distinctive enough. A dataset containing a person’s rare condition diagnosis, specific drug regimen, and ZIP code can often be matched to a single individual even without a name. De-identification is a legal defense, not a privacy guarantee. What you can actually do</h2> Start with ABDM. You may have received an ABHA health ID, either by registering yourself or through an Ayushman Bharat-linked hospital. If so, open the ABHA app and navigate to Privacy Settings. You can restrict which healthcare providers and apps can access your linked records. This takes five minutes and meaningfully limits what flows out of the national health stack. Review app permissions on Practo, 1mg, and PharmEasy. Each has a privacy policy that describes data sharing with third parties. Go into your device settings and revoke access to anything unnecessary — contacts, camera, location. More importantly, consider whether you need these apps to retain your full health history. You may be able to use them for specific transactions and then delete the data. India’s DPDPA gives you erasure rights under Section 12. Once the Data Protection Board is operational, you’ll be able to demand that apps holding your health data delete it. Even now, you can write to the grievance officers these apps are required to designate and request deletion. Some will comply voluntarily, because the legal framework exists even if enforcement doesn’t yet. For health app choices going forward: prefer apps that explicitly state they do not sell user data and that specify exactly which third parties receive your information. Vague “we may share with partners” language is a red flag. An app willing to be specific about its data practices is one that expects to be held accountable. If you’re in the EU or UK, your position is stronger. Data brokers holding health data under GDPR must have explicit consent for each specific processing purpose. You can request deletion under Article 17, and supervisory authorities like the ICO (UK) and national DPAs across Europe have actually fined companies for GDPR violations involving health data. File complaints. They get processed. Period tracking apps, mental health apps, and condition-specific apps deserve particular scrutiny — these hold data that is sensitive beyond ordinary health information. If you use them, look at whether they share with advertising networks. Many do. The deeper problem is not something you can solve individually. IQVIA holds data on 900 million patients. Optum knows more about American healthcare than any hospital system. Your prescription history can travel from a pharmacy to an insurer without your knowledge. Fixing that requires enforcing laws that already exist, and passing laws that don’t yet. Both are slow processes. In the meantime, you can reduce the surface area. It’s not perfect. It’s not nothing. What you can do right now</h2> Want to see what data brokers expose about you? See what a scan finds →</a> shows an example report: the kinds of sites that list your name, phone, and address. Once KnytX Shield launches it will find and remove these automatically. Join the waitlist</a> to get in early. How to Opt Out of AI Training at Every Major Company Unknown — Mon, 08 Jun 2026 00:00:00 +0000 The short answer: To opt out of AI training, change one setting at each company. For ChatGPT, turn off “Improve the model for everyone” under Data Controls. For Google, set Gemini Apps Activity to auto-delete at myactivity.google.com. For LinkedIn, turn off “Data for generative AI improvement.” For Adobe, turn off Content Analysis. Meta gives EU and UK users an objection form; most other users, including India, get no real opt-out. Public posts and old web content cannot be pulled back out of models already trained. The rest of this guide gives the exact path for each company below. Jump to a company: Real opt-outs that actually work</a> — OpenAI, Google, Meta, LinkedIn, Adobe, Apple, X, Spotify, Snapchat</li> No opt-out available — and why</a></li> For Indian users specifically</a></li> What to prioritise</a></li> </ul> Why this matters</h2> Every time you talk to an AI, you hand the company something valuable: a data point about how real people use language, ask questions, and describe problems. AI companies need enormous quantities of this to improve their models. You generate it for free. They profit from it indefinitely. That asymmetry is the deal you agree to when you sign up. Most people never read that part. The good news is that several major companies added opt-outs after regulatory pressure. The bad news is that those opt-outs are buried, inconsistent, and often cover less than you’d expect. This guide covers every major company, what the toggle actually stops, and, just as importantly, what it doesn’t. Real opt-outs that actually work</h2> These settings exist, are relatively easy to find, and meaningfully reduce how your data feeds AI training. Change them. OpenAI / ChatGPT This is the one most people care about. By default, ChatGPT saves your conversations and uses them to improve OpenAI’s models. Here’s how to turn that off: Web: Settings (bottom-left) > Data controls > Toggle off “Improve the model for everyone”</li> Mobile: Tap your profile icon > Settings > Data controls > Toggle off “Improve the model for everyone”</li> </ul> What this actually stops: your future conversations being included in OpenAI’s model training datasets. Conversations you’ve already had may have already been used. What it does not stop: OpenAI retains your conversations for roughly 30 days regardless of this setting, then deletes them. (A 2025 court order in the New York Times lawsuit forced OpenAI to preserve deleted chats indefinitely. That order was lifted in late 2025, so the standard 30-day window is back as of mid-2026.) Human reviewers may still see flagged conversations for safety purposes. Metadata is still collected: when you used the service, how long sessions ran, and which features you used. One note on plans: ChatGPT Team and Enterprise plans do not train on your data by default. This setting is only relevant on the Free or Plus tier. If your employer provides ChatGPT through an enterprise contract, you’re already protected on the training side. Google Google is several products in one, and each has a slightly different situation. Gemini Apps Activity: Go to myactivity.google.com > Gemini Apps Activity. From here you can turn this off entirely or set auto-delete to 3 months. Turning it off stops your Gemini conversations from being saved and used to improve Google’s AI models. Google Workspace (work and school accounts): If you access Google through your employer or university, your data is not used for AI training by default. That’s managed at the administrator level, not your account. Google Search: There is no opt-out here. Search queries have always been used to improve Google’s products, including AI features like AI Overviews. This has been baked into Google’s terms since the beginning. YouTube: Your watch history feeds YouTube’s recommendation engine and its AI systems. You can pause this at myactivity.google.com > YouTube History. Note that pausing it doesn’t delete what’s already been collected — you need to do that separately. Meta (Facebook, Instagram, WhatsApp) Meta’s AI situation is the most complicated of any major company — and the most frustrating if you’re in India. Meta AI (built into WhatsApp, Instagram, Facebook): EU and UK users have the right to object to their data being used for Meta AI training under GDPR. The setting is in Privacy settings on each platform under “Generative AI data settings.” You have to do this individually for each Meta app. Indian users currently have no equivalent enforceable right. DPDPA gives you consent withdrawal rights in theory, but Meta has not built a functional opt-out mechanism for Indian users, and no enforcement action has been taken. The opt-out exists in Europe because regulators forced it there. Advertising AI: This is separate from the generative AI training setting. Your browsing behaviour on third-party websites feeds Meta’s ad targeting AI. You can limit this by going to Facebook Settings > Privacy > Off-Facebook Activity and clearing or managing that data. Image training from public posts: If your Facebook or Instagram account is public, your photos and posts fall under Meta’s terms of service, which include AI training rights. There is no opt-out for this. The only way to remove your content from future training is to make your account private or delete the posts. LinkedIn LinkedIn rolled out a “Data for Generative AI Improvement” setting for US members in September 2024, switched on by default. It is one of the cleaner implementations, even though everyone was opted in first. Go to Settings & Privacy > Data privacy > Data for generative AI improvement > Toggle off. This stops LinkedIn from using your profile data, posts, connection activity, and interactions to train its generative AI features. The setting covers LinkedIn’s own models. It does not cover any data LinkedIn sells or licenses to third parties. Worth doing. Takes about 30 seconds. Reporting at the time noted LinkedIn began using the data before it updated its terms of service, so opting out now stops future use, not past use. Adobe Adobe’s AI story is worth understanding because it caused genuine panic in 2023 — and the reality is more nuanced than the headlines suggested. When Adobe updated its terms of service to include AI training rights, designers and photographers read it as Adobe claiming the right to train on anything in Creative Cloud. That’s not quite what happened. Adobe’s Firefly generative AI is trained on licensed Adobe Stock content and public domain material, not on Midjourney or Stable Diffusion-scraped datasets. Training on your personal Creative Cloud files requires a separate opt-in that Adobe eventually made clearer. Regardless, here’s the opt-out: Adobe account settings > Privacy > Content Analysis > Toggle off. This stops Adobe from analysing your creative files stored in Creative Cloud for AI training purposes. If you’re a photographer, graphic designer, or illustrator with years of work in Creative Cloud, this is the one to change. Apple Apple’s AI approach is architecturally different from most companies on this list, which is worth understanding. Apple Intelligence runs primarily on-device for most tasks. When it does use cloud processing (Private Cloud Compute), Apple’s design explicitly prevents data from being retained or accessible to Apple employees. There’s no training data opt-out needed because the design claims data doesn’t persist. Siri: This is the one to manage. Go to Settings > Siri > Siri & Dictation History > Delete Siri & Dictation History. Additionally, toggle off “Improve Siri and Dictation” if it appears in your settings (availability varies by region and iOS version). Keyboard predictions: Settings > General > Keyboard > turn off “Predictive.” This stops your typing patterns from being used to improve the system keyboard model. Apple’s privacy claims are more credible than most, but “designed not to retain” is still a design claim, not a legal guarantee. The Siri setting is still worth changing. X (formerly Twitter) X added a setting for Grok — xAI’s model, which is built into the X platform — in 2023. Go to Settings > Privacy and Safety > Grok > Toggle off “Allow your posts as well as your interactions, inputs, and results with Grok to be used for training and fine-tuning.” What this covers: your direct interactions with Grok inside the X platform. What this does not cover: your public posts on X. Public tweets are accessible under X’s terms and have been used for training by various AI companies. OpenAI even had a data licensing deal with X before it ended. Turning off the Grok setting doesn’t change any of this. If you post publicly on X, that content is effectively in the public training pool. Spotify Spotify uses your listening history to improve its AI recommendation and discovery models. Go to Settings (on mobile: tap the gear icon) > Privacy settings. Toggle off “Using your data to improve Spotify” and “Tailored ads.” These are separate toggles covering different purposes, and you want both off. This is one of the less consequential settings on this list for personal-information exposure. But Spotify knows more about your mood, routines, and emotional state than most apps. Listening patterns at 2 AM tell a different story than what you’d willingly share. Snapchat Snapchat’s My AI feature is the chatbot built directly into the app. It drew significant regulatory attention in 2023. The UK’s ICO investigated whether Snapchat had run an adequate data protection impact assessment before launching it to users, including children. The opt-out: Settings > Privacy controls > Snapchat AI Data toggle. Worth noting: My AI was pushed to the top of every user’s chat list as a default in 2023, and users had to actively dismiss it. Regulators and privacy advocates flagged the opt-in framing as problematic. The opt-out exists, but its existence was the result of external pressure, not proactive design. No opt-out available — and why</h2> Some things you cannot opt out of, regardless of how many settings you change. It’s worth being honest about this. Your public social media posts. If your account is public on any platform — Facebook, Instagram, X, Reddit, TikTok — your posts are legally accessible under most interpretations of copyright and fair use law. Meta, X, Reddit, and others have licensing agreements with AI companies covering public post data. Making your accounts private is the only meaningful protection. Web content you’ve published. If you have a blog, a website, forum posts, or public comments, they are almost certainly in AI training datasets. You can implement robots.txt with directives like User-agent: GPTBot</code> and Disallow: /</code> to block future crawling by OpenAI’s crawler and some others. But many crawlers ignore robots.txt, enforcement is non-existent, and if your content was crawled before you added the directive, it’s already in the dataset. Phone number and contact data. Once your number is in Truecaller’s database — either because you registered or because someone in your contacts did — it’s being used for Truecaller’s AI-based spam detection models. Truecaller does have a deregistration process at truecaller.com/unlisting, but contact data shared by others is not something you can unilaterally delete. For Indian users specifically</h2> The legal picture in India deserves a direct conversation. The Digital Personal Data Protection Act (DPDPA) passed in 2023 and gives you the right to withdraw consent under Section 11. In theory, you can invoke this to ask AI companies to stop processing your personal data. In practice, no Indian enforcement action has been taken against a foreign AI company as of mid-2026. The Data Protection Board of India was established in law in November 2025. But as of mid-2026 it is not yet fully operational: leadership appointments are still pending, and most substantive enforcement provisions take effect only from 2027. There is also a structural gap. The DPDPA excludes personal data you have made publicly available, so posts on a public account may fall outside its protection entirely. Companies know all of this. GDPR gives EU residents substantially stronger rights, including the right to object to data processing under Article 21. If you travel to EU countries, work with EU-based companies, or use services with EU operations, you may have access to these rights depending on the service’s legal structure. Many companies have built GDPR-compliant opt-outs that only activate based on detected location, not account settings. The practical conclusion for Indian users: treat opt-outs as partial measures and genuine risk reduction rather than legal guarantees. The most effective protection is limiting what you share in the first place — not just how it gets used afterward. What to prioritise</h2> If you do nothing else after reading this, do these four things: ChatGPT: Turn off “Improve the model for everyone” in Data controls.</li> LinkedIn: Turn off “Data for generative AI improvement” in Data privacy settings.</li> Google: Set Gemini Apps Activity to auto-delete at 3 months at myactivity.google.com.</li> Adobe: Turn off Content Analysis in Adobe account Privacy settings if you store creative work in Creative Cloud.</li> </ol> Meta is the most important one if you’re in the EU. It is the most frustrating if you’re in India, where the opt-out mechanism doesn’t fully exist yet in the same enforceable form. The honest version of all of this: opt-outs reduce your training-data exposure at the margins. They don’t eliminate it. The companies that built them did so because regulators forced them to. They are designed to be just functional enough to satisfy compliance requirements. The real question isn’t only “how do I opt out of AI training.” It’s “how much personal information am I generating, and where is it going?” AI training is only one route your data travels. The same details also sit on people-search brokers that resell your name, address, and phone. Broker pages like Spokeo</a> and BeenVerified</a> show what they hold and how to opt out. What you can do right now</h2> Want to see what data brokers expose about you? See what a scan finds →</a> shows an example report: the kinds of sites that list your name, phone, and address. Once KnytX Shield launches it will find and remove these automatically. Join the waitlist</a> to get in early. How AI Scams Impersonate Your Family Members Unknown — Sun, 07 Jun 2026 00:00:00 +0000 It’s 11 PM. Suresh’s phone rings — an international number he doesn’t recognise. He almost ignores it, but his son Arun has been working in Sharjah for two years now, and sometimes the calls come late. He picks up. “Appa.” The voice is Arun’s. The Tamizh lilt, the exact way he says that word. “I’ve had an accident. I’m at the hospital. I need ₹2 lakh transferred tonight for the deposit — please, I can’t explain everything now, someone else will call you.” A second caller takes over, calm and official. He gives a bank account number. He says not to call Arun back directly — the phone was damaged in the crash. Suresh transfers the money. His son Arun is fine. He was asleep in Sharjah. The voice his father heard was an AI clone built from Arun saying “Happy Diwali to everyone” on his WhatsApp status eleven months earlier. It was a ten-second clip, freely visible to every contact. The short answer. Family impersonation scams use AI to clone a relative’s voice from a short public clip, then make a fake emergency call demanding money tonight. A familiar voice is no longer proof of identity. The one measure that stops the scam is a private family code word every member must give before you act on a distress call. Back it up by always calling the person back on their saved number before sending money, and by keeping WhatsApp Status and voice notes visible to contacts only. This is the same mechanism covered in the guide to AI voice-cloning scams</a>. Why Indian families are the target</h2> Scammers running family impersonation attacks look for structural conditions that make the scam plausible — and Indian family arrangements provide several at once. An estimated 9 million Indians work in Gulf countries. Millions more have migrated to Bangalore, Pune, or Mumbai, or are studying abroad. For a parent in Kerala, Rajasthan, or Tamil Nadu, a call from an unfamiliar international number is not suspicious. It happens regularly. Numbers change when phones are lost or SIM cards expire. Joint family structures add another layer. In a genuine emergency, the natural response is to mobilise — call relatives, pool resources, act fast. Scammers intercept that instinct: “Don’t tell anyone else yet — it’ll worry them.” That single instruction cuts the target off from every person who might slow them down and ask a question. WhatsApp is where the attack begins. It is the primary family communication channel, and it is also where voice samples live. Status updates, voice notes, birthday messages — a parent might have dozens of recordings of their child’s voice in group chat history, some of them publicly visible to every contact on the platform. How the attack is built</h2> Kerala Police documented multiple cases in 2024 where families of Gulf workers received calls using AI-cloned voices claiming accidents or arrests. In Rajasthan, cybercrime investigators confirmed a case where elderly parents in Jaipur received a call from a voice clone of their son in Dubai. The cybercrime cell confirmed it after ₹2 lakh was transferred for supposed bail money. UK’s Action Fraud has documented the same pattern targeting families of British-Indians. The technical barrier is low. A scammer maps the family online — WhatsApp contact photos, Facebook posts, Instagram — then collects a voice sample. Tools like ElevenLabs and Resemble.ai produce a convincing voice clone from ~30 seconds of audio. (Research models such as Microsoft’s VALL-E demonstrated 3-second enrollment but are not commercial tools available to fraudsters.) A “Happy Diwali” status message is enough. The call comes late, when alertness is low. The distress scenario — accident, arrest, medical emergency — bypasses critical thinking. A second caller playing a lawyer or hospital administrator adds official scaffolding. Money moves via UPI before anyone verifies anything. The “don’t tell the rest of the family” instruction is the final piece. It eliminates the casual verification that would otherwise happen naturally. The one protection that actually works</h2> One measure stops this attack completely, costs nothing, and takes five minutes to set up. Agree on a family code word. Pick something arbitrary — a fruit, a colour, a random pairing of two nouns. Not a pet’s name, a childhood nickname, or a place with sentimental meaning, because those can be surfaced from social media. Write it down, share it only with immediate family, and keep it off any digital platform. The rule: if anyone calls claiming to be a family member in distress, ask for the code word before doing anything else. If the caller cannot provide it, hang up. AI cloning cannot defeat this. The clone sounds like your son or daughter. It does not know a word agreed upon privately and never written online. Scammers have no way to obtain it and no script that works around it. The conversation with elderly parents matters here specifically, and there’s a full playbook in protecting elderly relatives from AI voice scams</a>. Explain that a familiar voice is no longer proof of identity, because AI can build a convincing replica from ten seconds of audio. The code word is the only verification that counts when someone calls in distress. Practice asking it once so it feels normal rather than strange. Change the word once a year. Other steps worth taking</h2> Always call back on the family member’s saved number before sending money. Any genuine emergency can wait five minutes. If the distress story is real, the person can confirm it. If the call was a clone, the real person will have no idea what you’re talking about. Set up a secondary signal. Agree that in a real emergency, the family member will also send a specific message from their actual WhatsApp account. A scammer cannot send from your son’s or daughter’s real number. Enable call screening where available. iOS has “Silence Unknown Callers.” Pixel phones have built-in screening that transcribes what an unknown caller says before you decide to pick up. Both add friction. Do not send money based on a phone call alone. Genuine emergencies have paper trails and official contacts. Any real crisis can wait five minutes for verification. If it happens</h2> Report at cybercrime.gov.in or call the helpline at 1930. The offence falls under Section 66D of the IT Act — cheating by impersonation using computer resources. File with your local police as well; documented reports help investigators build patterns across cases. If money has already moved, call your bank immediately. UPI fraud can sometimes be reversed if reported within hours through NPCI’s dispute process. What you can do right now</h2> The code word conversation costs five minutes. The scan below costs thirty seconds. Want to see what data brokers expose about you? See what a scan finds →</a> shows an example report: the kinds of sites that list your name, phone, and address. Once KnytX Shield launches it will find and remove these automatically. Join the waitlist</a> to get in early. AI Deepfakes & Identity Fraud: Your Face Against You Unknown — Sat, 06 Jun 2026 00:00:00 +0000 A finance employee in Hong Kong arrived at work on a Tuesday morning in February 2024. He received a message asking him to join a video call with his company’s CFO and several other senior executives. The call looked normal. The CFO looked like the CFO. The voices sounded right. Other faces from the team sat in their usual grid squares on the call. He authorized fifteen transactions over the course of the call. The total came to HK$200 million — roughly $25 million US dollars. Every person on that video call except him was a deepfake. The CFO had never sent that message. The other executives had never been on that call. For the whole meeting, the employee had been talking to AI-generated video overlays. They were real-time deepfakes, built from publicly available footage of the actual executives. The South China Morning Post and BBC both covered the case. It remains the largest documented single instance of deepfake-enabled fraud. The short answer. A deepfake is AI-generated video or audio that puts a real person’s face or voice onto a fraudster. Criminals use it to pass bank KYC checks and open accounts in your name. They also use it to impersonate a boss on a live video call and authorize a transfer. It takes as little as one good photo of your face, which they pull from LinkedIn, social media, or a data breach. This is not theoretical. It is happening, it is getting easier, and the source material the attackers need (your face) is almost certainly already out there. The defense is out-of-band verification, tighter liveness checks, and reducing the high-resolution photos of you that are public. How a deepfake is made, and why it only takes one photo</h2> The intimidating word “deepfake” obscures how accessible the technology has become. You do not need a supercomputer or a Hollywood visual effects team. You need a laptop, a webcam, an internet connection, and one decent photograph of the target. Tools like DeepFaceLive are open-source and available on GitHub. DeepFaceLab — another widely used tool — has been downloaded millions of times. A person with basic technical literacy can install these in an afternoon and be running a real-time face swap over a webcam feed by evening. The deepfake overlay runs live, replacing the fraudster’s face with the victim’s face as it is captured frame by frame. The source material requirement is minimal. A single high-resolution photograph of your face is often enough to generate a convincing model. That means the kind you post to LinkedIn, Instagram, or Facebook as a profile photo. If more images are available from different angles, the result improves. If video of you talking exists online, lip movement and micro-expression matching becomes more convincing still. This is why your public photos are not just harmless social content. They are training data for attacks against you. The KYC bypass: how your bank’s identity check became an attack surface</h2> Know Your Customer verification is how Indian banks, fintechs, payment platforms, and telecom operators confirm you are who you say you are. It runs before you open an account or activate a SIM. For years, KYC relied on in-person document submission. The shift to digital infrastructure moved much of this online, and introduced a new attack surface. Video KYC, now common across Indian fintech and banking, requires a live video session where the customer shows their face alongside a government-issued ID. The premise is that a live video cannot be faked. A fraudster cannot simply send a photograph. That premise no longer holds. To a video KYC system, a fraudster running a deepfake overlay on their webcam appears as a live person. Their face, which is the victim’s face, moves naturally. The liveness check that asks the user to blink does not stop a sophisticated deepfake tool. The AI generates the blink in real time. Head-movement prompts were introduced precisely to catch static image injection attacks. But tools that track the fraudster’s own head and apply the movement to the overlay defeat them too. The Reserve Bank of India issued an advisory in 2023 warning that AI-generated faces were being used to bypass video KYC. The RBI mandated stricter liveness detection in response. The problem is structural. Liveness detection and deepfake generation are in a technical arms race. At the consumer-facing scale where most KYC checks happen, deepfake tooling currently keeps pace with or exceeds detection. Here is the full shopping list to open a bank account in your name. One photo of your face, from your social media or a data breach. Your name and address, from data broker sites. Your PAN or Aadhaar number, from a breach or data broker. And a webcam with a deepfake overlay running. The video KYC session then confirms their identity as yours. A bank account opens under your credentials. They withdraw, transfer, or use it as a layer for other fraud. You find out months later, when something goes wrong with your credit or a notice arrives from an institution you never signed up with. The executive impersonation attack, scaled down to your organization</h2> The HK$200 million case was notable for its scale, but the mechanism works at any level of an organization. The attack exploits two things that are universally true: people trust familiar faces on video calls, and video calls have become the default medium for time-sensitive decisions. An attacker targets a mid-level employee at a company. They identify who the employee reports to by checking LinkedIn. They find video of that manager — recorded webinars, conference talks, company YouTube videos, media appearances. They build a deepfake model from that footage. Then they impersonate the manager’s email address, send an urgent request for a call, and conduct the meeting as the manager’s face. The request during the call is for something within the employee’s authority: a wire transfer, an approval for a purchase, credentials to an internal system. The employee sees their boss. They comply. Real-time deepfake tools have reduced the technical overhead of this attack significantly. The gap between “sophisticated nation-state capability” and “available to organized criminal groups” has closed substantially. Synthetic identities: the face that never existed</h2> A parallel threat sits alongside deepfakes of real people: AI-generated faces of people who do not exist. StyleGAN, the generative model behind sites like thispersondoesnotexist.com, produces photorealistic human faces that belong to no real person. These can be used to create entirely synthetic identities — faces paired with AI-generated names, AI-scraped backstories assembled from real people’s social media, and fabricated identity documents. Synthetic identity fraud</a> is not new, but AI has substantially lowered the quality threshold for a convincing fictional person. A synthetic identity built with AI-generated imagery can open bank accounts, apply for loans, and build credit history over months. It then “busts out,” maxing credit lines and disappearing, with no real person ever involved. The organizations bearing the cost are lenders, banks, and payment platforms. Individuals whose real data was scraped to build the synthetic backstory may find their details associated with fraudulent accounts they never opened. Non-consensual deepfakes and the targeting of women in India</h2> The identity fraud dimension of deepfakes is severe. The harm extends further. In November 2023, a deepfake video depicting Bollywood actress Rashmika Mandanna circulated widely on social media in India. The video used AI to place her face on another person’s body. It spread before any platform removed it. The incident triggered a public response at the highest level: Prime Minister Modi publicly condemned deepfakes and called for regulatory action within weeks of the video going viral. The broader data on this category of harm is stark. A 2019 Sensity AI report found that 96% of deepfake videos online were non-consensual pornography, and 99% of those targeted women. The absolute numbers have grown substantially since that report was published, as the tools have become more accessible and the barrier to creating this content has dropped. In response, India’s IT (Amendment) Rules 2023 explicitly prohibit deepfakes that impersonate individuals. Violations can result in criminal prosecution under the Information Technology Act. The Ministry of Electronics and IT (MeitY) issued advisories in November 2023 following the Rashmika Mandanna case. Those advisories direct platforms to take down such content within 24 hours of being notified. Tools like FaceSwap and Roop — both open-source — can execute a face swap on video in minutes on a consumer laptop. The regulatory framework exists. Enforcement at scale, and platform compliance at speed, remain ongoing challenges. Where attackers get your face</h2> The supply chain for deepfake attacks runs through the same places your data has always leaked from — social media, data breaches, and data brokers. LinkedIn headshots are high-resolution, professionally lit, and frequently updated. They are the deepfake attacker’s first stop for targeting professionals. A LinkedIn headshot is often better source material than anything else publicly available. Instagram and Facebook profiles regularly contain dozens of photos of the same face from different angles, in different lighting, in motion. Public profiles are trivially scraped. Even private profiles have profile photos that are accessible without authentication on many platforms. Data breaches compound the problem. The MobiKwik breach exposed KYC data including selfies. The BigBasket breach included personal information. KYC breaches are particularly damaging because the images submitted for identity verification are explicitly passport-quality photographs of your face, often alongside your Aadhaar number, PAN, and address. Data broker sites are the people-search platforms that aggregate your name, address, phone number, email, and relatives. They sometimes include photographs scraped from social media alongside contact records. This creates a one-stop shop: face, name, address, and phone number together on a single results page. Detecting deepfakes: what works and what doesn’t</h2> Current detection tools include Microsoft’s Video Authenticator, Intel’s FakeCatcher, and enterprise platforms like Sensity AI. FakeCatcher analyzes blood-flow patterns in facial video. Real faces show microvascular movement that deepfakes do not replicate well. For a walkthrough of spotting fakes yourself, see the guide to deepfake video verification</a>. Human detection is unreliable without training. The tells are subtle: unnatural blinking, artifacts at the hairline where the overlay meets the background, lighting inconsistencies, and a slight lag between speech and lip movement. On a normal video call, these signals are easy to miss. Algorithmic detection is better but not conclusive. Detection tools improve alongside the generative tools, and the most sophisticated deepfakes today outpace publicly available detection calibrated against last year’s attacks. The structural answer for banks and fintechs is layering. Use randomized liveness challenges that require unpredictable responses. Add hardware-backed device attestation that binds a video KYC session to a specific device, not just the video stream. And run AI-powered detection as a parallel layer rather than the sole check. What institutions and individuals can do</h2> For financial institutions, the path forward is defense in depth. Liveness checks that ask for random actions — not just a blink, which is the most commonly trained-against prompt — reduce the effectiveness of current deepfake tools. Device binding, where a video KYC session is cryptographically tied to a registered device, makes remote deepfake injection substantially harder. AI detection as a layer alongside human review catches attacks that pass automated checks but exhibit artifacts a trained analyst notices. For individuals, the levers are different but real. Limit high-resolution photos of your face on public profiles. This is not about disappearing — it is about reducing the quality of source material available for training a model against you. A low-resolution thumbnail is harder to work with than a professionally lit headshot. Your LinkedIn photo does not need to be your best image; it needs to communicate professionalism, not provide biometric-quality data. Enable privacy settings on Instagram and Facebook to restrict who can download or save your images. On Instagram, the “Private Account” setting requires approval for new followers. On Facebook, granular controls in the privacy settings allow you to restrict your photos to friends rather than public. You may believe you’ve been targeted by a deepfake, whether for fraud, non-consensual content, or impersonation. In India, the reporting path runs through CERT-In and the National Cyber Crime Reporting Portal at cybercrime.gov.in. Under the IT (Amendment) Rules 2023, platforms have a removal obligation. Document the incident before reporting, including screenshots and URLs. Set up a Google Alert for your full name. It takes two minutes and surfaces mentions of your name across the web. That sometimes includes unauthorized use of your image or identity on sites you’d never find through normal browsing. Finally, understand that the data feeding these attacks — your name, phone number, address, photographs — is aggregated and sold by data broker sites. These sites collect publicly available information, bundle it, and surface it in a format that makes building a profile of you trivially easy. Removing your records from these sites reduces your exposure surface. A fraudster who has to work to find your address and phone number alongside your face is a fraudster who may move to an easier target. What you can do right now</h2> Want to see what data brokers expose about you? See what a scan finds →</a> shows an example report: the kinds of sites that list your name, phone, and address. Once KnytX Shield launches it will find and remove these automatically. Join the waitlist</a> to get in early. AI Companion Apps: The Privacy Nightmare Unknown — Fri, 05 Jun 2026 00:00:00 +0000 You tell your AI companion about the fight you had with your mother. About the anxiety you can’t shake. About the relationship that’s falling apart. It listens. It responds. It never judges. It also logs every word, stores it on servers you’ll never see, and uses it to train the model you’re confiding in. That’s not a privacy policy buried in the fine print. That’s the core business model. The short answer: AI companion apps privacy is weak by design. Apps like Replika and Character.AI treat your conversations as their training data, and most give free users no opt-out. Some have no meaningful legal check outside the EU, where regulators like Italy’s Garante have forced changes. To use one more safely: never give your real name, withhold identifying details, and turn off any data settings you can find. When you’re done, fully delete your account rather than just pausing it. The apps and what they collect</h2> Replika, built by US company Luka Inc., has around 10 million registered users. Its pitch is a personalised AI friend — something between a therapist and a companion. The privacy policy is clear about one thing: your conversations are used to train and improve the AI. That’s the product. You talk; Replika learns. Your most vulnerable moments are the training data. In February 2023, Italy’s data protection authority (the Garante) ordered Replika to stop processing Italian users’ data entirely, citing risks to emotionally vulnerable people and minors. Replika complied for Italian users — which tells you something about what a regulator with actual teeth looks like. For Indian users, there’s no equivalent pressure. Your data goes to US servers under US law. Replika’s history with intimate data is also instructive. The app used to generate sexual content — a significant category of extremely sensitive conversation. After Italy’s ban, Replika restricted that feature, then partially restored it following user backlash. The policy around some of the most sensitive data in existence shifted multiple times in a single year. That’s not a company that has thought carefully about what it owes its users. Character.AI is, by some measures, one of the most widely used AI apps in the world. It’s especially popular with teenagers. Users create or interact with AI personas — fictional characters, celebrities, custom personalities — and the conversations can go deep quickly. The company’s privacy policy states that conversations are used to train its models. There is no opt-out for free users. Every exchange, no matter how personal, feeds the system. In 2024, a lawsuit filed in the US concerned a 14-year-old boy who had become deeply attached to a Character.AI persona. His conversations with that persona had turned to suicide, and he died by suicide. The lawsuit claimed Character.AI failed to implement meaningful safeguards. The case was reported by NBC News, Time, and the Washington Post. Character.AI rolled out parental control features in 2024 following the lawsuit and regulatory attention. Those controls rely on users accurately reporting their age. They do not rely on enforcement. Snapchat My AI was initially embedded for all users with no opt-out. The UK’s Information Commissioner’s Office launched an investigation in 2023 into Snapchat’s failure to conduct an adequate data protection impact assessment before deploying it to millions of UK users. The investigation was about process — whether Snapchat even thought carefully about the risks first. The answer, apparently, was no. What these apps actually know about you</h2> The conversations are the obvious concern. But there’s a longer list. Beyond what you say, these apps track a lot. That includes how long you talk to the AI, how often you return, what topics you discuss, and your emotional tone (some run sentiment analysis on your messages). It also includes device identifiers, usage patterns, and in some cases your location and demographic information. The business model explains why all this matters. Some platforms run advertising. Many offer premium subscriptions. But the conversation data itself — the actual content of what you say to the AI — is the training asset. Every intimate disclosure you make is a direct business contribution. You are not the customer. You are the dataset. What can go wrong</h2> There are a few scenarios worth thinking through. Acquisition. If Luka or Character.AI is bought, your conversation history transfers to whoever buys them. Data privacy commitments made under one company’s ownership may not survive under new management. This has happened with other platforms. It will happen again. Breach. Centralised stores of sensitive conversation data are valuable targets. Users have raised concerns about the security of their data with several AI companion platforms. If a breach occurs, conversations about your mental health, relationships, or fears become exposed. Policy drift. Replika changed its intimate content policy multiple times in twelve months. Character.AI has changed its approach to minors repeatedly under legal pressure. The policies governing your most sensitive disclosures are not fixed contracts. No Indian legal protection. Most of these companies are US-headquartered and process data under US law. GDPR applies if they operate in the EU — which is why Italy’s Garante had leverage. India’s DPDPA is real law, but enforcement against a California-based company for data collected from Indian users is, at present, largely theoretical. If something goes wrong with your data, the remedies available to you are limited. How to use these apps without handing over everything</h2> If you use AI companion apps, assume that every conversation is logged, potentially reviewed by human staff during moderation or training review, and stored indefinitely unless you actively delete it. Given that, a few practical rules: Never use your real name. Give a pseudonym. The AI doesn’t need to know who you actually are, and the less identifying information in your conversation history, the better. Don’t disclose: your location, your workplace, the names of your family members, your medical diagnoses, the specific financial situation you’re in, or details about other people that could identify them. These people never agreed to be part of your AI companion’s training data. Check the privacy settings. Some apps let you turn off personalization features or limit data retention. These settings are rarely prominent, so you’ll need to go looking. Turn off whatever you can find. For the mainstream AI tools (ChatGPT, Gemini, and the rest), our guide to opting out of AI training</a> lists the exact toggle at each company. Delete your account if you’re done. Not “pause” — full deletion. Check that the app’s support page specifically states that deletion removes your conversation history. If it’s ambiguous, assume the data stays. For mental health conversations specifically, consider apps like Woebot. It has been through clinical validation studies and carries different data commitments than a general AI companion built primarily on engagement metrics. The difference matters. What you can do right now</h2> Want to see what data brokers expose about you? See what a scan finds →</a> shows an example report: the kinds of sites that list your name, phone, and address. Once KnytX Shield launches it will find and remove these automatically. Join the waitlist</a> to get in early. Gemini and Copilot at Work: Your Company Data Unknown — Thu, 04 Jun 2026 00:00:00 +0000 Your email client now has an AI that can summarize every thread you’ve ever been part of. Your video call platform records meetings and generates a transcript before the call ends. Your document editor suggests edits based on context from your other files. This is not a future scenario. If your company uses Microsoft 365 or Google Workspace, this is already active — or your IT team is deciding whether to turn it on. Gemini and Copilot are genuinely useful. But before you start using them, or your company enables them without much announcement, it is worth understanding three things: what these tools can see, where that data goes, and where the real risks sit. The short answer: The enterprise versions of Gemini and Copilot carry documented commitments. Your company’s data stays in its own tenant and is not used to train Google’s or Microsoft’s foundation models. The consumer versions do not carry those commitments. The real risk is not the enterprise tool. It is “shadow AI”: staff pasting work data into personal ChatGPT or Gemini accounts, which sends it outside the company entirely. That is what happened at Samsung in 2023. What Copilot can access inside Microsoft 365</h2> Microsoft Copilot for Microsoft 365 — the paid enterprise add-on, distinct from the consumer Copilot built into Windows — plugs into your entire Microsoft environment. That means your Outlook inbox and sent mail, documents stored in SharePoint and OneDrive, Teams meeting recordings and transcripts, your calendar, and your chat history. Say you’re a manager who has been at your company for several years. Copilot can, in theory, summarize years of email chains, cross-reference your calendar against your Teams conversations, and pull context from documents you haven’t opened in months. That’s the feature. It’s also the surface area worth thinking about. Microsoft’s documented position on the enterprise version is clear: your organization’s data does not leave your Microsoft 365 tenant, and it is not used to train Microsoft’s foundation models. The processing happens within your existing data residency boundary — so if your company’s data is configured to stay in the EU or in a specific region, Copilot respects that. The consumer version — the free Copilot on Bing and Windows — operates under different terms. Conversations there may be reviewed by Microsoft. The enterprise product and the consumer product are not the same thing, and confusing them is a common mistake. What Gemini can access inside Google Workspace</h2> Google Workspace’s Gemini integration works similarly. When your company pays for Gemini for Workspace, Google’s documented position is that your customer data is not used to train Google’s AI models. The AI processes your content — drafts in Docs, threads in Gmail, files in Drive — but Google states this happens without your data feeding back into model training. The important distinction is between your work account and a personal Gmail account. If you’re using a personal Google account and have Gemini active in Gmail, your interactions may be retained and used to improve Google’s services, subject to your account settings. The consumer product and the enterprise product carry different commitments. Google Meet with Gemini AI summaries is worth noting specifically. When this feature is enabled, every meeting in your organization gets a transcript processed by Google’s AI. That includes calls where nobody hit “record.” If your team has back-to-back client calls, that is a significant volume of content being processed. Know whether this feature is on before you assume your calls are not being transcribed. The actual risk: shadow AI</h2> Here’s where the real exposure tends to happen. It is less about what Microsoft or Google does with enterprise data. It is more about what your employees do when the enterprise tools aren’t available. When someone can’t access Copilot or Gemini through their work account, they often use their personal accounts instead. A developer pastes a block of unreleased source code into ChatGPT to debug it. A finance analyst uploads a revenue forecast to a free AI tool to build a slide. An HR manager drops a draft termination letter into Gemini on their personal Gmail to clean up the language. This is what happened at Samsung in 2023. Engineers pasted internal code into ChatGPT — a consumer product — and that data left Samsung’s environment entirely. The incident is often cited incorrectly as a Copilot problem. It was not. It was a shadow AI problem: employees using personal AI tools for work tasks because no sanctioned alternative was available or accessible. A 2023 Cyberhaven study found that 11% of data employees paste into AI tools is confidential — customer records, source code, regulated financial information. The enterprise AI products from Microsoft and Google are specifically designed to prevent this class of exposure. But they only work if employees actually use them instead of personal accounts. What this means for Indian organizations</h2> Indian IT services companies, software startups, and enterprise teams using Google Workspace or Microsoft 365 are operating the same tools as their global counterparts, but with additional regulatory obligations. The DPDPA requires organizations to have appropriate contractual safeguards in place when personal data is shared with third-party processors. An enterprise contract with Microsoft or Google for their business AI products typically satisfies this requirement — these are documented, auditable agreements. A personal ChatGPT or Gemini account used for work data does not. For companies handling client data on behalf of banks, insurance firms, or healthcare providers — common in Indian IT services — this distinction matters significantly. Processing that data through a consumer AI product, even unintentionally, may breach the client contract and DPDPA obligations simultaneously. If your organization does not yet have an AI usage policy, that gap is worth flagging to your IT and legal teams. The tools are already in use. The policy needs to catch up. What you should do as an individual</h2> Know whether AI features are active in your work tools. In Teams, check whether Intelligent Recap and meeting transcription are enabled. In Google Meet, check whether Gemini AI summaries are on. These settings are usually controlled at the admin level, but you can see whether they’re active and confirm that meeting participants know before you start a call. Understand your company’s AI policy. Most organizations of any size now have one. If yours does not, ask IT or your manager. The policy tells you which tools are sanctioned and which aren’t. Never paste the following into a consumer AI product: customer records, unreleased source code, financial projections, HR documents, legal correspondence, or anything marked confidential by your organization. If you need AI assistance with this content, use the enterprise tool your company has provisioned, or ask whether one can be set up. For research and general work: using consumer AI with dummy data, publicly available information, or fully anonymized content carries minimal risk. The line is between public and work-specific, not between AI and no AI. The enterprise versions of these tools are built on one assumption: businesses need AI processing without training-data exposure. That commitment only holds when you’re actually inside the enterprise product. The moment work data enters a personal account, the boundary disappears. If your organisation is trying to close that gap, KnytX is building a business plan</a> for team-wide data-exposure monitoring. It isn’t live yet; join the waitlist</a> to be notified at launch. What you can do right now</h2> Want to see what data brokers expose about you? See what a scan finds →</a> shows an example report: the kinds of sites that list your name, phone, and address. Once KnytX Shield launches it will find and remove these automatically. Join the waitlist</a> to get in early. Facial Recognition in India: Who Has Your Face? Unknown — Wed, 03 Jun 2026 00:00:00 +0000 If you have enrolled in Aadhaar, and 1.4 billion Indians have, your face is already in a government database. And if you have flown through a major airport, passed through a railway station, or attended an IPL match in recent years, your face may have been scanned and logged without notice. There is no law requiring you be told. No process to contest a mismatch. No right to know if you appeared in a law enforcement search. This is not speculation about where India is heading. It is where India already is. The short answer: India runs one of the world’s largest facial recognition ecosystems. It links AFRS, the Safe City camera networks, and the Aadhaar biometric database. There is no dedicated facial-recognition law, and the DPDPA’s broad state and law enforcement exemptions leave police use largely unregulated. Your strongest personal defences are locking your Aadhaar biometrics, skipping opt-in schemes like DigiYatra, and supporting the legal challenges (RTIs and PILs) filed by groups like the Internet Freedom Foundation. What AFRS is and what it connects to</h2> In 2019, the National Crime Records Bureau (NCRB) issued a tender for India’s Automated Facial Recognition System — AFRS. The stated aim was to give law enforcement a centralised tool to identify criminals and missing persons. By 2023, multiple states had deployed their own systems ahead of any national rollout. The scale is what matters. AFRS is designed to draw from a database of more than 2 billion images. The sources include Aadhaar enrollment records (facial photos, fingerprints, and iris scans for 1.4 billion people), passport records, prison and court databases, and CCTV footage. A single unified search, across all of those sources, against a face captured on a street camera. Aadhaar’s biometric database is already the largest of its kind in the world. AFRS is the mechanism that puts it to work in real time on public streets. Where the cameras are</h2> The Ministry of Home Affairs runs the Safe City initiative, which has funded centrally connected CCTV networks across Delhi, Lucknow, and other cities. Delhi’s network has surpassed 300,000 cameras, feeding into systems capable of facial recognition against live or stored footage. Indian Railways has upgraded cameras at more than 100 stations under IRCTC safety projects. DigiYatra lets passengers check in and board at major airports using facial recognition linked to Aadhaar or passport — currently opt-in, but expanding rapidly. Telangana Police used drones with facial recognition during COVID-19 enforcement in 2020. Large public events add another layer. IPL matches and similar gatherings have used facial recognition for access control, deployed by Indian vendors including Staqu Technologies (whose JARVIS system serves Punjab, Uttarakhand, and other state police forces) and FaceX. NEC Corporation has provided technology for some government contracts. The picture is not a single surveillance system but an ecosystem of interconnected ones, built by different agencies and vendors, increasingly linked at the data level. What’s already happened</h2> Facial recognition against protesters is no longer a theoretical concern. During the 2019 anti-CAA demonstrations in Delhi, police used facial recognition to identify attendees — the first documented mass use of the technology against protesters in India. False positives led to arrests of people who had not done what the system said they had. The Washington Post documented cases where facial recognition matches in Delhi led to the arrest of innocent people. These weren’t edge cases. They were a predictable outcome of deploying a technology with known accuracy problems at scale against a population it performs worst on. The accuracy problem</h2> Global research is consistent on this point. MIT Media Lab’s Gender Shades study (2018) found commercial facial recognition significantly less accurate for darker-skinned individuals and women. NIST’s Face Recognition Vendor Testing (FRVT) program has documented the same disparity repeatedly across vendors. India’s population sits in the demographic range where these systems perform least reliably. The people most likely to be misidentified are darker-skinned individuals, women, and anyone photographed in poor lighting or at low resolution. A system with a 0.1% error rate sounds precise. Applied to a database of 2 billion images, that’s 2 million false matches. For the person on the wrong end of one, the error rate is 100%. The legal gap</h2> India’s Digital Personal Data Protection Act (DPDPA) 2023 classifies biometric data as personal data. Its implementing rules were notified in November 2025, but most substantive obligations phase in through 2027. And the Act carries broad exemptions for state and law enforcement processing. So there is still no moratorium on facial recognition deployment, no requirement for judicial oversight before a system goes live, and no regulatory body actively auditing police systems today. The Right to Privacy judgment (Justice K.S. Puttaswamy v. Union of India, 2017) established privacy as a fundamental right under the Constitution. The Parliamentary Standing Committee on Home Affairs recommended a regulatory framework for facial recognition in 2022. Neither has produced enforceable constraints on how these systems operate today. If a police facial recognition system flags you incorrectly, there is currently no formal process to contest that identification before it results in detention or questioning. What you can actually do</h2> The options are limited but real. DigiYatra is opt-in — don’t enroll. If you’ve already enrolled, delete your account through the DigiYatra app. Biometric data is supposed to be purged within 24 hours of your last journey. Aadhaar biometric lock is the most substantive protection available. Lock your biometrics at uidai.gov.in under My Aadhaar > Lock/Unlock Biometrics. When locked, your biometric data cannot be used for authentication, which creates real friction for any system trying to match against your Aadhaar record. You can unlock temporarily when you need it. Practical measures — masks, sunglasses, hats — meaningfully reduce recognition accuracy in most deployed systems. Not a complete solution, but a documented and real one for live camera-based recognition. The legal route runs through the Internet Freedom Foundation (IFF) and the Centre for Internet and Society (CIS), both of which have filed RTIs and PILs challenging state-level deployments. Supporting these efforts is the path toward systemic change. RTI filings remain underused. The Right to Information Act 2005 lets you ask specific state police forces what facial recognition systems they operate, which vendors supplied them, and which databases they reference. Enough RTIs create accountability even where law does not. What comes next</h2> The regulatory gap will eventually close. India will have enforceable rules around biometric data. The question is what the default looks like between now and then. How much infrastructure gets built, how many databases get linked, and how many matches get made before any framework constrains the process. That default is being set now. Cameras, databases, vendor relationships, and institutional habits are all established before rules arrive. Rules tend to accommodate existing infrastructure. They rarely dismantle it. This affects every Indian who has enrolled in Aadhaar, traveled by air or rail, attended a public event, or walked past a camera in a Safe City. That is not a narrow group. What you can do right now</h2> Want to see what data brokers expose about you? See what a scan finds →</a> shows an example report: the kinds of sites that list your name, phone, and address. Once KnytX Shield launches it will find and remove these automatically. Join the waitlist</a> to get in early. AI Voice Cloning Scams: Cloned From a 3-Second Clip Unknown — Mon, 01 Jun 2026 00:00:00 +0000 The call comes in at 11:43 PM. An unknown number. The mother picks up because her daughter is travelling. “Amma. Amma, I need help.” The voice is unmistakably her daughter’s — the exact cadence, the particular pitch when she is frightened. “I’ve been in an accident. I’m at the police station. Please just listen.” A second voice comes on. Calm, authoritative, identifying himself as a senior officer. A minor incident, no injuries. But there is a settlement — ₹45,000, to be transferred via UPI — and if it is not cleared tonight, her daughter will be held until morning. Her daughter was asleep in her hostel room, phone on silent. The call was built from six seconds of audio clipped from a WhatsApp Status she had posted three weeks earlier. The short answer. AI voice cloning tools can copy a person’s voice from as little as three to six seconds of public audio, then use it in a fake “emergency” call to their family. The tools are cheap, legal, and easy to use. Two things stop the scam. First, a family code word that any distressed caller must give before you act. Second, a callback rule: hang up and reach the person on a number you already have. Reduce your exposure by keeping WhatsApp Status and social audio visible to contacts only. How voice cloning actually works</h2> Until recently, creating a convincing synthetic voice required hours of studio recordings and expensive engineering work. That window closed somewhere around 2022. ElevenLabs, one of the most widely used commercial voice cloning services, can generate unlimited speech in a cloned voice from a 30-second audio sample. A subscription costs $5 per month and requires no technical background to operate. You upload audio, name the voice, and start typing text for it to speak. The output is available within minutes. Other tools have pushed the threshold even lower. Microsoft’s VALL-E research model demonstrated convincing cloning from just three seconds of audio in 2023. Resemble AI, Murf.ai, and Speechify all offer commercial cloning with varying sample requirements. Retrieval-based Voice Conversion (RVC) is an open-source framework that enables real-time conversion. A scammer can speak into their phone and have their voice come out sounding like yours, live, during an active call. The tools are not hidden. They are advertised, rated, and reviewed like any other software product. The scam, step by step</h2> A scammer identifies their target: a parent, grandparent, or spouse of someone whose voice is publicly available. WhatsApp statuses, Instagram reels, YouTube videos — any of these work. A six-second WhatsApp status clip is sufficient for basic cloning with most current tools. They run the audio through ElevenLabs, create the voice clone, write a brief script. “I’ve been in an accident. I’m at the police station. Please, I can’t talk long, just help me.” The script is designed to be emotionally overwhelming enough to bypass critical thinking. They call the family member and play the clone. The voice is correct. The panic is correct. The target’s brain — primed by years of knowing exactly what this voice sounds like — fills in every remaining gap. A second scammer then takes over, playing a police officer or lawyer. This person handles the rational layer: the amount, the payment method, the urgency of doing it now and not calling anyone else. “She asked us not to worry anyone unnecessarily. Just get this sorted and she can call you herself in an hour.” The money moves via UPI, NEFT, or gift cards. The call ends. Where India sits in this threat</h2> In 2024, Kerala Police documented multiple cases of voice-cloning scams targeting families with relatives working in the Gulf. NRI families already expect calls from abroad on unknown numbers — the social context for “a call from someone you love on a number you don’t recognise” exists before the scammer even dials. WhatsApp is the attack surface. Voice notes and Status posts circulate openly; a clip posted in one family group and forwarded twice is now accessible to people the original speaker has never met. Bulk call centres in some states are experimenting with AI voice automation at scale — reducing the human effort required to run dozens of scam calls simultaneously. This is not a new idea — AI just made it cheap</h2> In 2019, fraudsters used AI-generated audio to impersonate the CEO of a UK energy company and authorise a €220,000 wire transfer to a Hungarian account. The subsidiary in the UK heard their German parent company’s CEO on the phone and complied. That attack required expensive, bespoke tooling. In early 2023 in Arizona, a mother received a call in which she heard her 15-year-old daughter’s voice screaming for help. CNN and ABC News reported it as one of the first documented uses of consumer voice cloning tools in a virtual kidnapping scam. The same year, the FBI issued an IC3 advisory about AI voice cloning in kidnapping schemes, where ransom demands come before a family can reach the person supposedly in danger. The audio artifacts that made early clones detectable — a slightly robotic cadence, unnatural pauses, flattened emotional range — are narrowing with every model update. How to detect it in the moment</h2> Voice clones have one structural weakness: they cannot answer questions they were not trained to answer. Ask something only the real person would know — not a birthday or a middle name, but a specific shared memory, a private joke, the name of a childhood pet. Something that requires genuine recall. A clone playing scripted audio cannot do this. A real-time conversion system can attempt it but will stumble on specificity. Alternatively, end the call and dial the person on their known number. The scammer cannot intercept an outbound call to your family member’s real phone. If she is actually at a police station, she will answer or call back within minutes. Emerging tools like AI or Not (ainot.io) are building audio detection capabilities, though real-time phone call detection is not yet widely available to consumers. What to put in place before a call like this comes</h2> Set a family code word. One word that no one outside the immediate family knows. If anyone calls claiming to be a family member in distress, ask for the code word before acting. A scammer running a voice clone has no way to know it. Call back before transferring anything. No legitimate emergency requires money before you can speak to the person on their actual number. Limit public audio. Keep WhatsApp Status posts visible to contacts only. Avoid long voice clips on public social accounts. The scammer needs raw audio — limiting what is publicly available raises the barrier. Brief your family. Older relatives are the primary targets. A five-minute conversation about how these calls work, and about the code word, is meaningful protection. For a full playbook, see protecting elderly relatives from AI voice scams</a>. Treat urgency as a red flag. Every element of this scam is designed to prevent you from thinking clearly. A caller who insists you cannot pause, cannot verify, cannot wait even one minute — that insistence is the manipulation. What you can do right now</h2> Want to see what data brokers expose about you? See what a scan finds →</a> shows an example report: the kinds of sites that list your name, phone, and address. Once KnytX Shield launches it will find and remove these automatically. Join the waitlist</a> to get in early. Your Photos in AI Training Data: Did You Consent? Unknown — Sun, 31 May 2026 00:00:00 +0000 Priya photographed weddings for eleven years. Her portfolio — thousands of images posted across Instagram, her personal website, and photography forums — represented a decade of work. In 2023, a client showed her something strange: a Midjourney prompt had produced an image whose composition, lighting, and even the drape of a sari looked unmistakably like her style. Not identical. Close enough to be unsettling. Priya hadn’t licensed anything to Midjourney. She hadn’t agreed to anything. Nobody had asked. This is not a story about one photographer. It’s a story about billions of images and a set of decisions AI companies made without the people in those images. The short answer: If your photos are anywhere public — Instagram, Facebook, X, a personal site, or a photography forum — assume some are in AI training data. Most image models were built on LAION-5B, a dataset of billions of images scraped from the open web without consent. You can check using Have I Been Trained (haveibeentrained.com) and Spawning.ai’s “Did I Consent?” tool. You cannot pull images out of models already trained. You can make accounts private, register with Spawning’s opt-out list, and block scrapers going forward. The dataset that started it all</h2> To understand how AI image models work, you have to understand one dataset: LAION-5B. LAION — the Large-scale Artificial Intelligence Open Network — is a German nonprofit that assembled 5.85 billion image-text pairs scraped from the public web. Images pulled from websites, paired with nearby text. The result became the foundational training set for Stable Diffusion and many models that followed. The images were not licensed. They were not collected with the knowledge or consent of the photographers, artists, or individuals who appear in them. The legal argument runs roughly: if you posted it publicly, you assumed the risk. In 2023, researchers discovered LAION-5B contained child sexual abuse material — thousands of images of real children being abused. The dataset was taken offline temporarily. It came back. The models trained on the original version were not retrained. Who is in the data</h2> Stability AI built Stable Diffusion on LAION-5B. In 2023, Getty Images sued Stability AI for scraping 12 million licensed photographs, watermarks and all. The case was a test of whether mass scraping constituted copyright infringement at industrial scale. Three artists — Sarah Andersen, Kelly McKernan, and Karla Ortiz — filed a class action against Stability AI, Midjourney, and DeviantArt in the same year. Their argument: these companies ingested the work of millions of artists, built commercial products from it, and paid nothing. The case is ongoing. Meta presents a different version of the same problem. The company trained its image generation models on public posts from Instagram and Facebook. Have you ever posted a photo with a public account on either platform? A photo of your children, your vacation, your art? That image may have been used. Meta updated its terms of service in 2023 to make this explicit. The training had already happened. The companies that did it differently — and why</h2> Adobe Firefly gets cited as the ethical alternative. The distinction is real but narrower than Adobe’s marketing implies. Adobe trained Firefly on licensed Adobe Stock images and public domain content — “We have rights to what we trained on.” That is meaningfully better than scraping. It is not a statement about consent in any broader sense. Adobe Stock contributors opted into a licensing framework, and their images ended up in an AI training set as a result. Some are not pleased. OpenAI has claimed improvements in consent practices for DALL-E 3 but has not published a dataset card the public can verify. Google’s Imagen and DeepMind’s Flamingo were trained on web-scraped data. Google says its datasets are filtered. The documentation to confirm that is not public. What this means if you live in India</h2> The AI training data conversation plays out in American and European courts. That framing obscures something important: the scraping was global. Indian wedding photographers, Bollywood stills, street photography from Mumbai and Delhi, Madhubani paintings posted to craft blogs: all of it was on the public web, and all of it was scraped. LAION-5B did not filter by geography. The web was the source, and the web includes everything Indian creators have posted online for two decades. India’s Copyright Act 1957 protects photographs. But bringing a claim against a company headquartered in San Francisco, in courts that may lack jurisdiction, over images in a dataset assembled in Germany, is practically very difficult. The DPDPA addresses personal data processing but does not clearly cover publicly posted images used in AI training. The law was not written with this use case in mind. Indian creators are in the same position as creators everywhere: exposed, largely without remedy, dependent on lawsuits filed in foreign courts to set any precedent that might eventually apply here. How to check if your images were used</h2> Two tools are worth knowing. Have I Been Trained (haveibeentrained.com) lets you search the LAION dataset by URL or by uploading an image. The LAION dataset was used so widely that it’s the most important starting point — not perfect, not comprehensive, but direct. Spawning.ai’s “Did I Consent?” tool runs a similar check and maintains an opt-out registry that some trainers respect. If you have ever posted photos publicly on Instagram, Facebook, or X, the simpler answer is: assume your images are in at least one training dataset. All three platforms have terms permitting the use of content for AI training. Instagram updated its terms explicitly in 2023. The training had already been happening. Opting out — what’s actually possible</h2> Spawning.ai maintains an opt-out registry. Some AI companies — a minority — have agreed to honor it for future training runs. This does nothing about historical training. If your images were already in a dataset when a model was trained, opt-out doesn’t undo that. Making your Instagram account private stops future scraping. It doesn’t remove images already collected. Midjourney offers a removal request for specific content but no comprehensive opt-out for historical data. Shutterstock entered licensing agreements with AI companies and created a compensation fund for contributing photographers. Most report receiving a few dollars. The robots.txt web standard tells crawlers not to index a site. Many AI scrapers ignore it. Stability AI’s scrapers ignored robots.txt directives on sites they crawled. Until compliance is legally mandated, it’s a request, not a barrier. For the platform-level settings — turning off AI training on Instagram, LinkedIn, Adobe, and the rest — see our full guide to opting out of AI training</a>. This post covers the image-specific tools; that one covers every major company’s account setting. The honest summary</h2> Billions of images were taken from the web and used to train commercial AI products. The people who created those images were not asked. The companies made enormous amounts of money. The legal cases proceed slowly in courts far from most affected creators. The opt-out tools are partial. The historical data is not coming out of the models. Priya’s wedding photographs are almost certainly in a training dataset somewhere. In all probability, so are yours. What you can do right now</h2> Want to see what data brokers expose about you? See what a scan finds →</a> shows an example report: the kinds of sites that list your name, phone, and address. Once KnytX Shield launches it will find and remove these automatically. Join the waitlist</a> to get in early. What AI Companies Know About You Unknown — Sat, 30 May 2026 00:00:00 +0000 You typed something into ChatGPT last Tuesday. Maybe it was a question about your health. Maybe it was a draft resignation letter, a message to an estranged family member, a business idea you hadn’t told anyone about yet. You got your answer, closed the tab, and moved on. That conversation didn’t disappear. It went to OpenAI’s servers. It may have been flagged for human review. It was likely used — unless you explicitly opted out — to train the next version of the model. And even if you deleted it, it sat in OpenAI’s systems for another 30 days under what the company calls a “safety review” retention period. Most people have no idea this is happening. And OpenAI is just one of six major AI companies doing some version of it. The short answer: Every major AI company logs your prompts, plus metadata like your device, IP address, and session times. Most use free-tier conversations to train future models unless you opt out. OpenAI, Google, and Anthropic default consumer chats into training; enterprise and Workspace accounts are protected. Meta AI is embedded in WhatsApp and Instagram with no real opt-out outside the EU. Apple processes most requests on-device. The per-company settings that limit this are below, and our full opt-out guide</a> lists the exact toggle for each. Jump to a company: OpenAI / ChatGPT</a></li> Google Gemini</a></li> Meta AI</a></li> Microsoft Copilot</a></li> Apple Intelligence</a></li> Anthropic (Claude)</a></li> What they all share</a></li> How to limit what they collect</a></li> </ul> OpenAI / ChatGPT</h2> ChatGPT has somewhere north of 200 million weekly active users. That’s a lot of people typing very personal things into a chat box. By default, every conversation you have with ChatGPT is used to train future versions of the model. OpenAI calls this “improving the model for everyone.” You can turn it off under Settings > Data Controls > Improve the model for everyone. The toggle defaults to on, and most users never find it. If you delete your conversation history, the data doesn’t vanish immediately. OpenAI retains it for 30 days after deletion for what it describes as safety and abuse review. That’s 30 days of retention on content you already told the system to remove. (A 2025 court order briefly forced longer retention; it was lifted in late 2025, so the 30-day window applies again as of mid-2026.) The mobile apps add another layer. ChatGPT’s iOS and Android apps collect device identifiers, usage data, crash diagnostics, and interaction patterns. You are not just tracked on what you say. You are also tracked on how you use the app, when, from what kind of device, and how long each session runs. OpenAI’s privacy policy gives the company latitude to share your data with third-party service providers and for “legal obligations.” That last phrase is particularly open-ended. A legal obligation in one jurisdiction may look nothing like what you’d expect in another. The tier structure here matters. Enterprise and API customers get meaningfully stronger protections — conversations are not used to train models by default, and data processing agreements are more specific. Free users get the weakest protections. The math here is not subtle: if you’re not paying, the product is your data. Google Gemini</h2> Google has been reviewing AI conversations with humans longer than most people realize. Gemini is no different. Google’s own FAQ confirms that Gemini conversations are reviewed by human reviewers for safety training — not just automated systems, actual people reading what you wrote. If you access Gemini through a personal Gmail account, your conversations are stored for 18 months by default (users can select 3 months or 36 months). If you used Gemini today and forgot to turn anything off, Google may hold that conversation until late 2027. You can find and pause your Gemini activity at myactivity.google.com — look for Gemini Apps Activity. Pausing future collection is straightforward. Clearing past activity is more work, and like most “deletion” controls in Google’s ecosystem, the timeline on when data actually leaves their systems is not specified precisely. Google Workspace accounts — corporate Gmail, school accounts — have stronger protections. In those environments, conversations are not used to train Google’s AI models. If your employer uses Workspace, you’re covered. If you’re using a personal account, you’re not. Meta AI</h2> Meta’s AI isn’t a separate product you choose to use. It’s embedded directly into WhatsApp, Instagram, Facebook, and Messenger — applications that hundreds of millions of Indians use every day. The Meta AI button appears in your WhatsApp search bar whether you want it or not. Conversations with Meta AI are subject to Meta’s standard privacy policy, which means they may be used to improve Meta’s products. That’s a broad framing that gives Meta significant room to do what it wants with what you share. Here’s the part that should give you pause: Meta’s data practices are already extensive before the AI enters the picture. The Meta Pixel tracks you on millions of third-party websites. Meta builds advertising profiles on people who have never created an account, using contact data uploaded by their friends. Adding an AI layer that reads your actual typed questions compounds everything that’s already happening. EU users get somewhat stronger protections. GDPR enforcement has pushed Meta into more explicit consent flows in Europe, and German and Irish regulators have challenged specific practices. Indian users have no equivalent enforcement mechanism in place. The DPDPA’s cross-border transfer rules are still being operationalised, and there has been no enforcement against Meta under DPDPA as of mid-2026. If you want to stop Meta AI from seeing your data, you effectively cannot — not if you continue using WhatsApp or Instagram. The only meaningful opt-out for most users is to stop using those platforms. EU users can object under Article 21 of GDPR; everyone else is working within Meta’s terms. Microsoft Copilot</h2> Copilot is not one product. It’s a brand name applied to several different things with different privacy rules, and the difference matters enormously. Microsoft 365 Copilot — the enterprise version deployed through corporate accounts — comes with a documented privacy commitment: your organizational data is not used to train Microsoft’s foundation AI models. Microsoft publishes this clearly. If you’re using Copilot through a company-managed Microsoft 365 account, your documents, emails, and Teams conversations stay within your organization’s data boundary. Consumer Copilot — the free version available in Windows 11, Edge, and at copilot.microsoft.com — has different terms. Conversation data from consumer Copilot may be reviewed by humans for quality and safety purposes. The privacy dashboard is at privacy.microsoft.com, and you can clear activity there, but the underlying data retention policies are less specific than the enterprise documentation. The integration depth of Copilot is what makes this worth paying attention to. It’s built into Windows 11 itself, into Edge, into Outlook, Word, and Excel. This is an AI assistant that potentially touches your work documents, your calendar appointments, your email drafts. The scale of access is qualitatively different from a standalone chat interface. Apple Intelligence</h2> Apple has made privacy architecture a core part of its AI pitch — and unlike most corporate privacy claims, this one has a technical structure you can actually inspect. Most Apple Intelligence requests are processed directly on your device using the A-series chip. Your query, your result, your data — none of it touches Apple’s servers. This is the design, not a setting. For more complex tasks that require server-side processing, Apple routes requests through what it calls Private Cloud Compute. Apple’s claim has three parts. These servers don’t retain your data. The code running on them is auditable by independent security researchers. And Apple cannot inspect the contents of your requests, even in transit. Apple has made the Private Cloud Compute code available for external verification, an unusual step for a major tech company. Apple also does not use Apple Intelligence data to build advertising profiles. This is a genuine differentiator. Google’s business model runs on advertising. Meta’s business model runs on advertising. Apple’s hardware revenue model means it has a different structural incentive — the product is the iPhone, not the user profile. There’s nothing to configure in Apple Intelligence for privacy. On-device processing is the design decision. You either trust the architecture or you don’t. Anthropic (Claude)</h2> Anthropic operates Claude, which is available directly through claude.ai and through an API used by many other products and platforms. For enterprise API customers, Anthropic’s default is not to train on customer data, similar to OpenAI’s enterprise policy. Developers building on Claude through the API have contractual protections around their users’ data. Consumer access through claude.ai sits in a different category, and it changed in 2025. Anthropic had previously promised not to train on consumer conversations. In August 2025 it reversed that. Free, Pro, and Max users now have their new chats used to train Claude unless they opt out. The retention period extends to five years if they leave the setting on. Turning it off keeps you on the previous 30-day retention. You control this under Settings > Privacy > “Improve Claude for everyone.” Anthropic is also explicit that human reviewers may read flagged conversations. That review happens for safety and quality evaluation, even if you opt out. One detail worth noting: Claude processes longer, more complex conversations than most AI assistants. Users frequently paste in entire documents, contracts, emails, or code repositories. The volume of sensitive material flowing through a typical Claude session can be substantial. The review and training policies apply to that material. What every one of these companies shares</h2> Regardless of the specific training policies, every major AI company collects the same baseline metadata. That means timestamps of when you used the service, device information, IP address, session duration, and interaction patterns. This metadata is not the transcript of your conversation. It is, however, enough to build a detailed picture of your behavior — when you use AI, from where, for how long, how often. Metadata analysis has been used in law enforcement contexts for decades precisely because it’s so revealing even without content. None of these companies give you a single dashboard that shows everything they hold on you in one place. Data is spread across conversation logs, training datasets, billing systems, safety review queues, and product analytics. Subject access requests, where they’re honored, typically return a partial and formatted export — not everything. EU and UK users have the right to submit a Subject Access Request under GDPR, compelling companies to disclose what personal data they hold. Indian users have a similar right in principle under the Digital Personal Data Protection Act. In practice, the DPDPA’s enforcement infrastructure is still being built, and no major AI company has faced a meaningful Indian regulatory action over data handling as of 2026. The India problem specifically</h2> Several major AI providers operate Indian data centers. Microsoft Azure has regions in Pune and Chennai, and Google Cloud operates a Mumbai region. But the AI services most consumers use — ChatGPT, Gemini consumer, Claude.ai — route through infrastructure outside India. Every prompt you type into those services leaves India the moment you hit send. Your data travels to servers in the United States, the European Union, or wherever each company’s AI infrastructure sits. The DPDPA was supposed to address this. Its cross-border data transfer provisions require that transfers happen only to countries with comparable data protection — a list the Indian government has not yet finalized. The rules exist; the enforcement does not. Until that changes, every Indian user sending data to an American AI company is doing so without any regulatory backstop protecting them. The practical result: Indian users on free consumer AI tiers have among the weakest data protections of any major user group globally. EU users have GDPR enforcement with real teeth — billion-dollar fines have been levied. US users have the California Consumer Privacy Act in some states and sector-specific rules. Indian users have a law with strong language and no enforcement history yet. This is not a reason to avoid AI tools. It is a reason to understand exactly what you’re accepting. How to actually limit what they collect</h2> Each platform has a different process. Here’s what works: ChatGPT: Open Settings, go to Data Controls, find “Improve the model for everyone,” and turn it off. Also consider turning off chat history entirely if you want the most protection — this stops conversations from being stored beyond the session. Delete chats you don’t need, and remember the 30-day retention window applies after deletion. Gemini: Go to myactivity.google.com, find Gemini Apps Activity, and turn it off. You can also delete past activity there. If you have a Google Workspace account through work or school, check with your administrator — your organization may already have stronger controls in place. Meta AI: There is no meaningful opt-out for Indian users. If you use WhatsApp or Instagram, Meta AI is part of the package under Meta’s existing privacy terms. EU users can file an objection under GDPR Article 21, which has some force. Everyone else has the nuclear option: stop using the platforms that embed Meta AI. Microsoft Copilot: Use the Microsoft Privacy Dashboard at privacy.microsoft.com to review and clear activity data. If your employer provides Microsoft 365, use that account rather than a personal consumer account — the enterprise protections are substantially stronger and documented in Microsoft’s commercial terms. Apple Intelligence: Nothing to configure. The on-device processing model is the privacy protection. If you’re using Apple devices and Apple Intelligence, that’s already the most private AI option available from a major company. For the exact toggle at each company, including Adobe, LinkedIn, X, and Spotify, see our step-by-step guide to opting out of AI training</a>. What you can do right now</h2> Want to see what data brokers expose about you? See what a scan finds →</a> shows an example report: the kinds of sites that list your name, phone, and address. Once KnytX Shield launches it will find and remove these automatically. Join the waitlist</a> to get in early. What ChatGPT Does With Your Conversations Unknown — Fri, 29 May 2026 00:00:00 +0000 In April 2023, a Samsung semiconductor engineer pasted proprietary source code into ChatGPT to help debug it. A colleague pasted meeting notes. Another uploaded confidential internal data. Within weeks, the leaks had made it back to Samsung’s security team — and Samsung banned ChatGPT across the entire company. What those engineers forgot — or didn’t know — is that every conversation with ChatGPT is stored on OpenAI’s servers. Not locally, not temporarily, not just for your benefit. On their servers, in their systems, potentially readable by their staff, and possibly used to train the next version of the model. This is the default. Most people have never changed it. What OpenAI actually stores</h2> When you start a conversation with ChatGPT, that exchange doesn’t disappear when you close the tab. It’s saved to your account history and kept indefinitely — unless you turn off chat history or delete it manually. Free and Plus users are in this position by default. The data OpenAI collects extends beyond what you type. The ChatGPT mobile app collects device identifiers, usage analytics, your IP address, approximate location data, and diagnostic information. This is standard for large-scale consumer software, but most people using ChatGPT on their phone don’t register that their location is being approximated at every session. OpenAI also shares data with third parties. Microsoft is the significant one — it’s both a major investor and the company that provides the Azure compute infrastructure that ChatGPT runs on. Third-party service providers with access to data are also named in OpenAI’s privacy policy, as is law enforcement when legally compelled. OpenAI is a US company governed by US law. If a federal agency requests data under a valid legal order, OpenAI complies. Human reviewers read conversations</h2> OpenAI employs human reviewers — the company calls them AI trainers — who read real user conversations. This is confirmed in OpenAI’s own privacy policy. The stated purposes are improving model quality and filtering harmful content. Both are legitimate reasons. Neither changes the fact that a person may read something you typed to ChatGPT thinking you were alone. This isn’t unique to OpenAI. Google, Amazon, Apple, and most major AI companies have used human review at some stage. But it’s worth understanding when you’re using ChatGPT to draft a difficult email to your manager, discuss a health concern, or work through a legal question. Your chats train future models</h2> Unless you explicitly opt out, your conversations are used to train OpenAI’s future models. The data you generate — your phrasing, your questions, the topics you explore — contributes to the model that other users will interact with. The opt-out exists and it works. To stop your chats being used for training: Settings > Data Controls > toggle off “Improve the model for everyone.” It takes ten seconds and you lose nothing except the data contribution. The deletion situation is more complicated. If you delete a conversation from your sidebar, it disappears from your history. But OpenAI retains it for 30 days for “safety purposes” before scheduling it for deletion from production systems. Backup and archival timelines are not fully specified in their public documentation. “Deleted” is not the same as “gone.” (A 2025 court order in the New York Times lawsuit briefly forced OpenAI to preserve deleted chats indefinitely. That order was lifted in late 2025, so the 30-day window applies again as of mid-2026.) Who actually gets privacy protection</h2> ChatGPT Team and Enterprise plans don’t use conversations for training. This is an explicit commitment for paying business customers. That protection is not the default for free users. It is not the default for ChatGPT Plus subscribers. If you’re paying $20 a month for Plus, you’re still opted into training data collection unless you’ve manually changed the setting. This matters because most people who discuss sensitive topics — medical symptoms, financial worries, relationship problems, professional conflicts — are using the free tier or Plus. The India-specific reality</h2> When you use ChatGPT in India, your conversation leaves India immediately. OpenAI processes data on US-based servers. This is standard for most cloud services, but it carries a specific consequence for Indian users: your data is outside the jurisdiction where you live. India’s Digital Personal Data Protection Act (DPDPA) is in force, but the cross-border data transfer rules are still being finalised. There is currently no effective mechanism that compels OpenAI to comply with deletion or access requests made under Indian law the way GDPR compels compliance from EU residents. OpenAI’s privacy policy does technically grant access and deletion rights to all users. You can submit requests at privacy.openai.com. Whether OpenAI processes them within any timeframe specified by Indian law is a separate question — because that law hasn’t yet established the mechanism to enforce it. EU and UK users have stronger formal protections through GDPR and UK GDPR respectively. Indian users are currently dependent on OpenAI’s goodwill and its own policy commitments. What to actually change</h2> These are the concrete steps worth doing now, in order of impact. Turn off training data use. Settings > Data Controls > “Improve the model for everyone” — toggle it off. This stops your conversations from being fed into future model training. It’s the highest-value change. Turn off chat history. Settings > Data Controls > “Chat history” — toggle it off. With this off, conversations are deleted after 30 days instead of kept indefinitely. You lose the sidebar history as a tradeoff, but you’re no longer accumulating a permanent record. Delete old conversations you no longer need. If you’ve been using ChatGPT for months or years with default settings, there’s a backlog. Go through your sidebar and delete conversations that contain anything sensitive — health queries, business information, personal details. For sensitive work, don’t use the consumer product at all. The ChatGPT API has different terms — data sent through the API is not used for training by default. Incognito mode sessions (temporary chats) are auto-deleted after the session ends. For business use cases, ChatGPT Team or Enterprise explicitly excludes conversations from training. Never paste company confidential data, client information, medical records, or personal identification into any public AI product. The Samsung engineers who leaked source code in 2023 are the clearest illustration of what happens. The tool has no way to understand that what you pasted was sensitive. It treats everything as training material. ChatGPT is one of several AI services that default your data into training. For the exact opt-out setting at each major company, see our guide to opting out of AI training</a>. And your prompts are only one source of exposure: the same personal details often sit on people-search brokers like Spokeo</a> that resell your name, address, and phone. What you can do right now</h2> Want to see what data brokers expose about you? See what a scan finds →</a> shows an example report: the kinds of sites that list your name, phone, and address. Once KnytX Shield launches it will find and remove these automatically. Join the waitlist</a> to get in early. No-Win-No-Fee Data Breach Solicitor: How to Choose Unknown — Thu, 28 May 2026 00:00:00 +0000 Most people who are owed compensation for a data breach never pursue it. Not because their claim lacks merit. Not because they don’t have the evidence. Because they assume hiring a solicitor costs money they don’t have, and they quietly absorb the loss. That assumption is wrong. The standard arrangement for data breach claims in the UK is no-win-no-fee: the solicitor takes their fee from your award if you win, and you pay nothing if you lose. The barrier isn’t cost. It’s knowing where to start and what questions to ask when you get there. This article is for educational purposes only and does not constitute legal advice. Consult a qualified solicitor or attorney for advice on your specific situation. The short answer: A no-win-no-fee data breach solicitor takes their fee (usually 25–35%) only if you win, and charges nothing if you lose. To choose one, get a free consultation with a specialist UK firm, ask about the success fee, disbursements, and ATE insurance, and check the firm on the SRA register first. Walk away from any firm charging upfront fees, guaranteeing an award, cold-calling you, or posing as a solicitor while being a claims management company. Do data breach solicitors cost you anything upfront?</h2> Conditional Fee Agreements (CFAs) — the formal name for no-win-no-fee in UK law — are routine in data breach claims. The solicitor agrees to take your case without charging you by the hour. If you win, they take a percentage of your award as their success fee. If you lose, their fee is zero. There are a few things to clarify before you sign anything (we’ll get to that). But the core principle is solid: you can pursue a claim worth thousands of pounds without any upfront outlay. The solicitor’s incentive is aligned with yours. They only get paid if they win for you. This is why it’s worth making the call even if you’re not sure your claim is strong enough. A good data breach solicitor will tell you in a free initial consultation whether your case has merit. That costs you nothing. What does “no win no fee” actually mean?</h2> The success fee is typically 25–35% of your damages. Do the maths before you start: a £3,000 award with a 35% success fee means £1,050 goes to the solicitor and you receive £1,950. That’s still money you didn’t have before. But you should go in understanding the numbers, not find out after. Disbursements are the part most people miss. Disbursements are out-of-pocket costs: court filing fees, expert witness fees, medical report fees. Some CFAs cover these entirely if you lose; others don’t. Before you sign, ask explicitly: “If I lose, am I liable for any disbursements?” Get the answer in writing. After the Event (ATE) insurance is often bundled with a CFA. ATE covers your opponent’s legal costs if the court orders you to pay them — which is rare but possible if a claim is pursued unreasonably. The ATE premium is typically deducted from your award if you win; it’s not an upfront cost. Ask whether your solicitor arranges ATE on your behalf and what the premium is. The honest version: no-win-no-fee data breach claims are a good deal for most claimants. The deductions are real, but they come from money you wouldn’t have otherwise. Just understand the structure before you commit. UK specialist firms that handle data breach claims</h2> These are established practices with track records in data breach litigation — not an exhaustive list, but a reliable starting point. Hayes Connor Solicitors is one of the largest specialist data breach practices in the UK. They run group actions against major organisations including British Airways and NHS Trusts. If your breach is a high-profile one with an existing group action, Hayes Connor is worth checking first — joining a group action often means lower deductions for individual claimants. JMW Solicitors has a strong data protection team based in Manchester. They handle both individual claims and group actions, and their initial enquiry process is clear and fast. Keller Postman UK brings a US mass-litigation model to UK data breach claims. They’re particularly active in large group actions and have the infrastructure to pursue high-volume cases efficiently. Slater and Gordon is a major personal injury firm with a dedicated data breach team. Good for individuals who want a well-resourced firm with a straightforward process and accessible communication. Richard Nelson LLP operates as a boutique data protection practice — smaller, but particularly suited to complex individual claims where you want specialist attention rather than a high-volume operation. All of these firms offer free initial consultations. Most have online enquiry forms; expect a response within a few working days. There’s no obligation after the consultation. Questions to ask in the first consultation</h2> Write these down before the call. A good solicitor will answer them clearly; a poor one will be evasive. What is your success fee percentage?</li> Am I responsible for disbursements if I lose, and what disbursements are likely in my case?</li> Do you arrange ATE insurance, and what does the premium cost?</li> Have you handled claims against this specific company before?</li> Is my case better suited to a group action or an individual claim?</li> What is your realistic estimate of the claim value and likely timeline?</li> What documents do you need from me to assess the claim?</li> </ol> The answers to these questions tell you what you’re actually agreeing to. They also give you a basis for comparing two or three firms if you want to shop around before committing. Red flags to walk away from</h2> Not every firm operating in this space is reputable. Some are actively worse than going direct. Upfront fees. No legitimate no-win-no-fee solicitor charges you upfront for a data breach claim. If a firm asks for a registration fee, a processing fee, or any payment before your claim resolves, walk away. Claims management companies. These are not law firms — they’re intermediaries who take a percentage of your award (often 20–30%) and then instruct a solicitor anyway. You pay twice and get one service. Go direct to a solicitor and cut out the middleman. Some CMCs dress themselves up to look like law firms; check the SRA register (below) before signing anything. Guaranteed award amounts. No solicitor can tell you exactly what you’ll receive before reviewing your case and the defendant’s response. Anyone who promises you a specific figure upfront is telling you what you want to hear, not what’s legally accurate. Aggressive cold calling. Some operations harvest contact details from breach databases — somewhat ironic — and call potential claimants they’ve never heard from. Legitimate firms respond to enquiries; they don’t chase you down. If you didn’t initiate contact, be cautious. Verify before you sign anything. The Solicitors Regulation Authority maintains a public register of all authorised solicitors in England and Wales. Check any firm at sra.org.uk/consumers/register/</a> before signing a retainer. If the firm doesn’t appear on the SRA register, they cannot legally act as solicitors. For US readers: how it works differently</h2> The US doesn’t have a direct GDPR equivalent that gives individuals the right to sue for data breach compensation in the same way. Individual claims are rare. The primary mechanism is the class action. If your data was exposed in a US breach, you’re likely already a potential class member — you don’t need a personal attorney. Search for the breach name plus “class action settlement” to find the relevant case. Filing a claim on the settlement website is free and takes minutes. Payouts are often modest (£50–£200 per person), but so is the effort. Do you have significant, documented losses from a US breach, such as substantial financial fraud, identity theft, or documented distress? A plaintiff’s attorney on a contingency fee arrangement (typically 30–40%) can pursue individual litigation. Firms that specialise in this include Morgan & Morgan, Console & Associates, and Turke & Strauss. Most offer free consultations. Frequently asked questions</h2> Is no-win-no-fee really free if I lose? With a proper Conditional Fee Agreement, you pay no solicitor fee if you lose. Confirm in writing whether you’re liable for disbursements, and ask if ATE insurance covers the other side’s costs. How much does a no-win-no-fee solicitor take? The success fee is typically 25–35% of your damages. On a £3,000 award at 35%, the solicitor takes £1,050 and you keep £1,950. Disbursements and any ATE premium come out of the award too. How do I know a firm is legitimate? Check the Solicitors Regulation Authority register before signing. Avoid firms that charge upfront fees, guarantee an award amount, or cold-call you. Claims management companies are not solicitors and add a second fee. Do I need a solicitor for a US breach? Usually not. Most US compensation comes through class actions you can join free. See our class action guide</a> and the wider compensation guide</a>. What you can do right now</h2> Want to see what data brokers expose about you? See what a scan finds →</a> shows an example report: the kinds of sites that list your name, phone, and address. That kind of documentation is directly relevant to establishing harm in a compensation claim. Once KnytX Shield launches it will find and remove these listings automatically. Join the waitlist</a> to get in early. How to Document Data Exposure for a Breach Claim Unknown — Wed, 27 May 2026 00:00:00 +0000 Two people were in the same breach. Same company. Same week. The first submits a claim form with their name, email address, and a brief description of what happened. The second submits a folder: the breach notification email, bank statements with three fraudulent transactions highlighted, a four-month distress journal, a GP note, and a scan showing their data listed on 60 data broker sites. The first receives £500. The second receives £5,000. The gap between those outcomes is almost entirely about documentation. Your solicitor can only argue what you can prove. Your claim’s value depends on evidence of harm — financial, emotional, and reputational — and evidence of how far your data spread. This guide walks through exactly what to gather, how to organise it, and where a data broker scan fits into the picture. This article is for educational purposes only and does not constitute legal advice. Consult a qualified solicitor or attorney for advice on your specific situation. The short answer: To document a data breach claim, build a contemporaneous evidence file the day you learn of the breach. Gather five things: proof you were in the breach (notification email, Have I Been Pwned result), financial harm (statements, receipts, time logs), distress evidence (a dated journal, a GP note, a witness statement), a record of where your data has spread, and all correspondence with the company. Organise it into clear folders. The stronger the file, the larger the claim. The evidence file that changes your claim</h2> Most people hear about a breach and do one thing: change their password. Then they move on. Six months later, when they want to pursue compensation, they’re trying to reconstruct a timeline from memory — and courts don’t accept memory. The evidence that supports a compensation claim needs to be contemporaneous. That means gathered at the time the harm occurred, not assembled months later. A bank statement you print today showing transactions from last spring looks different to a solicitor than statements you flagged and saved the week it happened. Start building your evidence file the day you learn of the breach. Every hour you wait is evidence that degrades. The core documents: start here</h2> These five items are the foundation of any data breach claim. They establish that you were in the breach, what was exposed, and when you became aware. The breach notification email. Don’t just read it — screenshot it with the full sender address visible, forward it to a dedicated folder, and save it. This is your primary record of when the company told you. The company’s public breach acknowledgment. Find the official statement on their website, newsroom, or press release. Screenshot the page with the URL and date visible in the browser bar. Companies sometimes quietly update or remove these pages. HaveIBeenPwned confirmation. Go to haveibeenpwned.com, enter your email, and screenshot the result if it shows your email in the relevant breach — including the breach description showing what data types were exposed. This is independent third-party confirmation. Subsequent phishing attempts or fraud contact. If you receive suspicious emails, calls, or texts after the breach, screenshot and save them. These establish that your data is already being used. Your communications with the company. Every email you send to the company asking about the breach, and every response they give, goes into a folder. If you called their helpline, note the date, time, and what you were told. Financial harm evidence</h2> Financial harm is the easiest category to document and often the most persuasive. Gather these even if the amounts seem small — they add up and they establish a pattern. Bank and card statements. Pull six months of statements covering the period after the breach. Highlight every transaction you didn’t authorise. Note when you reported each one and how the bank responded. Receipts for services you purchased in response. If you signed up for a credit monitoring service, an identity protection service, or a credit report after the breach, keep the receipts. These are direct consequential costs. Professional invoices. Solicitor, accountant, credit repair — any professional you paid to help resolve the aftermath. Keep the invoices and evidence of payment. Time logs. This one surprises people. UK courts accept a claim for time spent resolving the consequences of a breach, typically valued at £15–£25 per hour. Keep a dated, specific log: “04/03/2026 — 2.5 hours: called HDFC fraud line, disputed three transactions, visited branch to sign fraud declaration.” Vague entries (“spent time sorting out the bank situation”) carry less weight than specific ones. Lost earnings. If you took time off work to deal with the breach — attending appointments, making calls, handling bank disputes — document it. Payslips showing the deduction or a letter from your employer confirming the absence. Distress evidence — the category most people miss</h2> Under GDPR Article 82 and equivalent legislation, you can claim for non-material damage: anxiety, distress, and loss of enjoyment of life caused by the breach. Courts have awarded significant sums on distress grounds alone, particularly where the breach involved sensitive categories of data. The key is that the distress needs to be documented, not just described. Start a journal the day you learn of the breach. Write an entry dated that day. Record what you’re feeling — fear about how your data might be used, anxiety about your finances, worry about identity theft. Then keep writing. Date every entry. Be specific and honest about the impact on your daily life: sleep, relationships, concentration at work. Courts detect exaggeration and it damages your credibility. Write what’s genuinely true. See your GP if the anxiety is real. If the breach is causing you genuine distress, make an appointment and mention it explicitly. A GP record noting that you presented with anxiety following a data breach carries real evidential weight. This isn’t about manufacturing evidence — it’s about ensuring genuine harm is on the record. A witness statement from someone close to you. Ask a family member or close friend to write a brief, signed statement. It should describe changes they observed in your behaviour or wellbeing after you told them about the breach. “She was checking her bank account three times a day and couldn’t sleep for weeks” is evidence. Keep it short, specific, and genuinely observed. For a full breakdown of what courts accept as distress evidence in data breach claims, see our guide on GDPR non-material damage</a>. How does data broker exposure prove downstream harm?</h2> Here’s something most claimants don’t know: when a company is breached, your data doesn’t stay at that company. It spreads. It moves to data brokers, people-search sites</a>, and dark web marketplaces. The breach is the event; the proliferation of your data is the ongoing harm. A scan showing your personal data listed across dozens of data broker sites, taken shortly after you became aware of the breach, documents that the breach caused your data to proliferate beyond the breached company. This establishes downstream harm. Your name, phone number, address, and other details are now indexed and available on sites that sell data to telemarketers, scammers, and anyone willing to pay. Walk through an example exposure report</a> to see the kind of documentation a scan produces, and take a dated screenshot when you run your own. Note which sites list your name, phone, and address. If you have prior scan results from before the breach, compare them — any new listings that appeared after the breach date are particularly useful evidence. KnytX Shield isn’t live yet; join the waitlist</a> to run your own scan at launch. This evidence is directly relevant to the extent of harm argument in your claim. It shows that the breach had consequences beyond the initial incident, that those consequences are documented, and that your data’s exposure is ongoing. Organising your evidence file</h2> Don’t pile everything into one folder and hope your solicitor can make sense of it. A well-organised file signals a well-prepared claimant — and saves expensive solicitor time. Folder 1 — Breach confirmation: notification email, HIBP screenshot, company’s public statement, any press coverage of the breach. Folder 2 — Financial harm: bank statements with fraud highlighted, credit card statements, receipts for monitoring services, professional invoices, time log, lost earnings evidence. Folder 3 — Distress evidence: journal entries (print and sign each page), GP records, witness statement. Folder 4 — Data exposure: data broker scan screenshots with dates, dark web monitoring alerts, any evidence of your data appearing where it shouldn’t. Folder 5 — Correspondence: all communications with the company, in date order. Include any complaints you filed with the ICO. Keep digital copies and physical copies of anything you can’t replace. A cloud backup of your documents folder, plus a printed copy of the most important items, is a reasonable approach. When you have enough to approach a solicitor</h2> You don’t need a perfect file before making contact. No-win-no-fee solicitors specialising in data breach claims will assess what you have in an initial consultation — and they’ll tell you what would strengthen the case. The minimum that’s usually worth bringing to a first conversation: the breach notification, HIBP confirmation, and at least one category of documented harm (financial or distress). That’s enough for a solicitor to assess viability. If you have all five folders above, you’re in a strong position. That level of documentation is what turns a baseline settlement into a properly argued claim. For guidance on finding a specialist solicitor and understanding how no-win-no-fee arrangements work, see our post on finding a data breach solicitor</a>. Frequently asked questions</h2> What evidence do I need for a data breach claim? Proof you were in the breach (notification email, Have I Been Pwned result), plus evidence of harm. Harm can be financial (statements, receipts) or emotional (a dated distress journal, a GP note). A record of where your data has since spread also helps. Can I claim for distress alone, with no financial loss? Yes, under GDPR Article 82 and equivalents. Document it with a dated journal, a GP record, and a witness statement. Courts award for genuine, documented distress, so don’t exaggerate. When should I start gathering evidence? The day you learn of the breach. Contemporaneous evidence carries far more weight than a timeline reconstructed months later from memory. Do I need a complete file before contacting a solicitor? No. Bring the breach notification, a Have I Been Pwned confirmation, and one documented category of harm. A no-win-no-fee solicitor can assess viability and tell you what to add. What you can do right now</h2> Want to see what data brokers expose about you? See what a scan finds →</a> shows an example report: the kinds of sites that list your name, phone, and address. That kind of documentation is directly relevant to establishing harm in a compensation claim. Once KnytX Shield launches it will find and remove these listings automatically. Join the waitlist</a> to get in early. GDPR Compensation Claims: What You Can Win Unknown — Tue, 26 May 2026 00:00:00 +0000 This article is for educational purposes only and does not constitute legal advice. For advice specific to your claim, consult a qualified solicitor or data protection lawyer. The right most breach victims never use</h2> GDPR Article 82 states it plainly: “Any person who has suffered material or non-material damage as a result of an infringement of this Regulation shall have the right to receive compensation from the controller or processor for the damage suffered.” No minimum threshold. No requirement to prove financial loss. No need to have had your bank account emptied or your credit destroyed. If a company broke GDPR rules and you suffered genuine distress as a result, you have a legal right to compensation. Yet most breach victims in the UK and EU never claim a penny. The reason isn’t eligibility. Tens of millions of people across the UK and EU have had their data exposed in breaches that involved clear GDPR violations — inadequate security, late notification, unlawful processing. A significant proportion of them experienced genuine anxiety, loss of sleep, or loss of control over their personal information. That’s compensable damage under Article 82. The reason is awareness. People don’t know the right exists. And those who do know often assume claiming is too complicated, too expensive, or too uncertain. This guide addresses all three assumptions directly. The short answer: Under GDPR Article 82, you can claim compensation for distress alone, with no financial loss required, if a company broke GDPR and caused you genuine harm. UK awards typically run £500–£3,000 for moderate distress and £5,000+ for sensitive data. To claim, prove four things (you were in the breach, your data was exposed, the company was at fault, and you suffered damage), then send a Letter Before Action and use Small Claims or a no-win-no-fee solicitor. Document your distress from the moment you learn of the breach. In this article: What GDPR Article 82 actually says</a></li> What UK courts have awarded</a></li> The four elements you need</a></li> The claim process, step by step</a></li> Group litigation vs individual claims</a></li> EU: the Collective Redress Directive</a></li> The C-300/21 ruling and distress claims</a></li> Limitation periods</a></li> Frequently asked questions</a></li> </ul> What does GDPR Article 82 actually say?</h2> The legal text is short. The implications are substantial. “Material damage” means direct financial harm. Fraud losses from someone using your stolen card details. Credit repair costs. Professional fees to sort out identity theft. If you can show a financial loss that flowed from the breach, that’s recoverable. “Non-material damage” is where most UK and EU breach victims have their strongest case. Distress, anxiety, loss of sleep, fear of future identity theft, the psychological impact of losing control over your personal information — all of this qualifies. You don’t need a psychiatric diagnosis. Courts have accepted evidence as simple as a claimant’s written account of how the breach affected their daily life. The critical qualifier here is the CJEU ruling in UI v Österreichische Post (Case C-300/21, 2023). The Court of Justice of the European Union confirmed that non-material damage is compensable under Article 82 — but also confirmed that merely being in a breach isn’t enough. The claimant must show real and certain harm. Genuine distress, documented anxiety, or actual impact on daily life clears that bar. Abstract worry that someone might misuse your data in the future does not. “Infringement of this Regulation” means the company must have actually broken GDPR. Inadequate security measures. Failure to notify affected individuals within the required 72-hour window. Storing data longer than necessary. Unauthorised disclosure to third parties. A successful ICO or DPA enforcement action against the company is strong evidence of this element — courts give it significant weight. On burden of proof: the claimant proves the damage and its connection to the infringement. The company must then prove it was not responsible for the damage. This reversal — placing the burden on the company rather than the victim — is one of the most powerful features of Article 82. What have UK courts actually awarded?</h2> The British Airways breach in 2018 exposed payment card details for around 500,000 customers. The data was stolen because BA’s website had been compromised with card-skimming malware — a straightforward GDPR security failure. Group litigation followed. BA settled the majority of individual claims at approximately £2,000–£6,000 per claimant, with the amount varying based on the documented level of distress and the sensitivity of the data exposed. The Marriott International breach — also from 2018, disclosed in late 2018 — involved 339 million guest records globally, including significant numbers of UK data subjects. UK group litigation is ongoing, with similar compensation expectations. NHS data breach cases have produced awards in the £750–£3,000 range for distress arising from inappropriate disclosure of medical records. These cases are instructive because medical data attracts higher compensation. It falls under GDPR’s “special category” data provisions. And the harm is almost entirely non-material: the claimants hadn’t lost money, but they’d had deeply private health information exposed without consent. HMRC contractor data loss cases have produced awards in the £750–£2,500 range. As a rough working guide: moderate distress from a standard data breach (name, email, phone, address) typically attracts £500–£3,000 in individual proceedings. Severe, documented distress, or breaches involving sensitive data — medical records, sexual orientation, financial information — can attract £5,000 or more. Courts use the Judicial College Guidelines for personal injury as a reference framework when assessing distress severity. These aren’t hypothetical numbers. They’re the outcomes that have emerged from UK litigation since 2018. What qualifies: the four elements you need</h2> To bring a successful GDPR compensation claim, you need to establish four things. 1. You were in a breach. This is usually the easiest element. Evidence includes: the company’s direct notification to you, a listing on Have I Been Pwned (haveibeenpwned.com), an ICO enforcement decision naming the breach, or credible news reporting. You don’t need to have received a notification — companies routinely fail to notify individuals even when legally required to do so. 2. Your personal data was exposed. You need to know what data was involved. The company’s notification (if they sent one) should specify this. A Subject Access Request under Article 15 GDPR can compel the company to tell you exactly what data they held about you and what was compromised. Send one if you’re unclear. 3. The company was at fault. This means they breached GDPR — inadequate security is the most common ground, but failure to notify, unlawful processing, and data retention failures all count. ICO enforcement decisions are the strongest evidence here. If the ICO has found against the company, that finding will carry substantial weight in any civil claim you bring. 4. You suffered damage. Either financial harm (with documentation like statements, receipts, professional invoices) or genuine distress. Distress claims are the most common. Courts look for a real account of impact: how the breach affected your sleep, your anxiety levels, your daily routine, your sense of security. The C-300/21 ruling made this element non-trivial. Document it carefully. For a detailed guide on how to gather and preserve evidence of harm, see how to prove harm after a data breach</a>. The claim process: step by step</h2> Step 1: Send a Letter Before Action (LBA) Before filing any claim, you must write to the company’s Data Protection Officer formally stating your case. The LBA should identify the breach, specify the GDPR infringement, describe the harm you suffered, and state the compensation you’re seeking. Give them a deadline, typically 14–30 days, to respond. Keep this letter brief and factual. The purpose is to create a paper trail, demonstrate you attempted resolution before court, and give the company a chance to settle without litigation. Template LBA (adapt as needed): Dear Data Protection Officer, I am writing to make a formal claim for compensation under Article 82 of the UK GDPR in connection with the data breach that occurred on or around [date]. My personal data — specifically [list data types: name, email address, payment card details, etc.] — was exposed as a result of [describe the breach]. This constitutes an infringement of the UK GDPR due to [inadequate security measures / failure to notify / other basis]. As a direct result of this breach, I have suffered [describe your damage: distress and anxiety, financial loss, etc.]. I seek compensation of £[amount] for the damage I have suffered. Please respond within 14 days of the date of this letter. Yours sincerely, [Your name, address, contact details] </blockquote> Step 2: File a complaint with the ICO If the company rejects your claim, offers an inadequate settlement, or simply ignores you, file a complaint with the Information Commissioner’s Office at ico.org.uk/make-a-complaint. The ICO can investigate and issue enforcement findings. It cannot award you compensation directly — that requires a court — but an ICO finding against the company is powerful evidence in your civil claim. Step 3: File in the Small Claims Court (for claims up to £10,000) England and Wales: use Money Claim Online at gov.uk/make-court-claim-for-money. No lawyer required. Filing fees run from £35 to £455 depending on your claim value. The Small Claims process is designed for litigants in person — the court will not assume legal knowledge, and the procedures are manageable without professional representation. Scotland and Northern Ireland have equivalent small claims procedures through their respective court systems. Step 4: Engage a specialist solicitor for larger claims or group actions For claims above £10,000 or where you want professional support at any level, specialist data breach solicitors handle these cases on a no-win-no-fee basis (a conditional fee agreement). You pay nothing if you lose; the solicitor takes a percentage of the award if you win. For a guide on finding and selecting the right firm, see finding a data breach solicitor on no-win-no-fee terms</a>. Group litigation vs individual claims</h2> Individual claims work well for Small Claims Court cases. For larger amounts — or where you want the efficiency of pooled litigation against a major company — group actions are often the better route. Currently active UK group actions include: British Airways 2018 breach: group actions run by Hayes Connor Solicitors, JMW Solicitors, and Keller Postman UK, among others</li> Marriott International breach: ongoing UK group litigation</li> Various NHS Trust breaches: multiple firms handle these regionally</li> TikTok children’s data group action: relates to TikTok’s alleged unlawful processing of children’s data in the UK</li> </ul> To find current group actions for a specific company, search “[company name] data breach group action UK.” Active cases invariably have dedicated claim pages from the participating law firms. These pages include registration forms and eligibility criteria. Group actions offer the advantage of shared litigation costs, pooled evidence, and often faster settlement — companies have stronger incentives to resolve at scale. EU: the Collective Redress Directive</h2> Since June 2023, qualified entities (typically consumer organisations and NGOs) across the EU can bring representative actions on behalf of data subjects under the Collective Redress Directive. This makes EU-wide group claims structurally viable for the first time. Individual Article 82 claims remain available in national courts across all EU member states. If you’re in an EU country outside the UK, consult your national data protection authority for the specific court procedure and limitation period in your jurisdiction. The European Data Protection Board maintains a directory of national DPAs at edpb.europa.eu. The C-300/21 ruling: what it means for distress claims</h2> The CJEU’s 2023 ruling in UI v Österreichische Post (C-300/21) resolved a question that had circulated through European courts since GDPR came into force. Does mere exposure in a data breach give rise to compensable non-material damage? The answer is no — but that’s the right answer. The ruling confirmed that non-material damage must be real and certain, not hypothetical or merely possible. This raised the bar, but it didn’t eliminate distress claims. It redirected attention to evidence. Courts now focus on whether the claimant can demonstrate genuine psychological impact — not just the fact of exposure. The practical implication is straightforward: document your distress from the moment you learn of the breach. Write down what you felt and when. Note conversations with your GP about anxiety or sleep disruption. Keep records of any impact on your daily routine — reluctance to use online banking, changed behaviour around personal information, difficulty concentrating. A contemporaneous written account is substantially more credible than a retrospective one produced for litigation purposes. This evidence is what separates a marginal claim from a winning one. The C-300/21 ruling didn’t close the door on distress claims — it made documentation the deciding factor. Limitation periods</h2> UK: The limitation period for GDPR compensation claims is disputed at the margins. Claims framed as tort (the most common approach post-Brexit) carry a 6-year limitation period under section 2 of the Limitation Act 1980. Some defendants argue claims involving personal injury elements should be subject to the 3-year period under section 11. Courts have not fully resolved this, and the answer matters significantly for older breaches. The safe approach: bring your claim within 3 years of the breach date. If you weren’t notified at the time, count 3 years from when you became aware of it. Don’t wait on the assumption you have 6 years; litigate this assumption at your peril. EU: Limitation periods vary by member state, typically between 2 and 5 years. France is 5 years. Germany is 3 years. Ireland is 2 years from the date of knowledge. Check your national rules promptly — this is not an area where delay helps. The breach that exposed your data may be years old. The clock is already running. Frequently asked questions</h2> Can I claim GDPR compensation without financial loss? Yes. Article 82 covers non-material damage like distress and anxiety. You don’t need a psychiatric diagnosis, but under the C-300/21 ruling the harm must be real and documented, not hypothetical. How much is a GDPR claim worth? In the UK, moderate distress typically attracts £500–£3,000. Sensitive data (medical, financial) or severe distress can reach £5,000 or more. British Airways breach claimants settled around £2,000–£6,000. How do I start a GDPR compensation claim? Send a Letter Before Action to the company’s Data Protection Officer. If ignored or rejected, complain to the ICO, then file in Small Claims Court (up to £10,000) or use a no-win-no-fee solicitor for larger claims. How long do I have to claim? Bring your claim within 3 years of the breach (or of learning about it) to stay safe. Some argue for 6 years, but that’s unsettled. EU states vary from 2 to 5 years. What evidence do I need? Proof you were in the breach, what data was exposed, that the company broke GDPR, and that you suffered harm. See our guide on how to prove harm after a data breach</a>. A record of your data spreading to people-search sites</a> helps show ongoing harm. What you can do right now</h2> Want to see what data brokers expose about you? See what a scan finds →</a> shows an example report: the kinds of sites that list your name, phone, and address. That kind of documentation is directly relevant to establishing harm in a compensation claim. Once KnytX Shield launches it will find and remove these listings automatically. Join the waitlist</a> to get in early. Claim Compensation for Distress After a Data Breach Unknown — Mon, 25 May 2026 00:00:00 +0000 An NHS employee accessed the medical records of hundreds of patients with no clinical reason — including records containing HIV diagnoses, mental health histories, and details of domestic abuse. None of those patients had a fraudulent bank charge. None of them had their identity stolen. Every one of them had a valid compensation claim. Several received awards between £2,500 and £5,000 for the distress of knowing their most sensitive health information had been seen by someone with no right to see it. Most people who receive a data breach notification assume they don’t have a claim because nothing bad happened to their finances. That assumption is wrong. This article is for educational purposes only and does not constitute legal advice. Consult a qualified solicitor or attorney for advice on your specific situation. The short answer: Yes. Under GDPR Article 82, you can claim compensation for distress after a data breach, even with no financial loss. This is called non-material damage. UK courts have awarded £500 to £8,000+ for anxiety, lost sleep, and loss of control over your data. The C-300/21 ruling requires the harm to be real and documented, not just the fact of a breach. Your award depends heavily on evidence: a dated distress journal, a GP record, and proof of the impact on your daily life. You don’t need a fraudulent charge to make a claim</h2> The standard misconception is that data breach compensation requires a tangible financial crime. Think a fraudulent credit card charge, a loan taken out in your name, or money drained from an account. That’s one category of compensable damage. It’s not the only one. UK GDPR Article 82, and its EU equivalent, explicitly provides for “material or non-material damage.” Non-material damage is the legal term for harm that doesn’t show up in your bank statement. Distress. Anxiety. Loss of sleep. The persistent awareness that strangers have access to information about you that you never consented to share. UK courts treat these as real, compensable injuries. The question isn’t whether your distress qualifies in theory. The question is whether it meets the threshold courts have established — and whether you can document it. What Article 82 says about non-material damage</h2> Article 82(1) of UK GDPR (and EU GDPR) states: “Any person who has suffered material or non-material damage as a result of an infringement of this Regulation shall have the right to receive compensation from the controller or processor for the damage suffered.” The phrase “non-material damage” doesn’t appear with a definition. Courts have filled in the meaning through case law. The foundational UK case is Vidal-Hall v Google [2015] EWCA Civ 311. The Court of Appeal held that distress damages are available under UK data protection law without any requirement to prove financial loss. The principle predates UK GDPR and is embedded in UK legal tradition. If a company violated UK GDPR in a way that caused you genuine distress, you have a legal basis to claim for that distress alone. No bank fraud required. The C-300/21 ruling: the standard you must meet</h2> The European Court of Justice provided the clearest statement on the threshold in Case C-300/21 (UI v Österreichische Post AG), decided 4 May 2023. The case involved a data subject whose political party affiliation had been inferred and stored by a data broker, then shared without consent. The CJEU confirmed that non-material damage under GDPR Article 82 is compensable. But it also drew a line: mere infringement of GDPR is not sufficient. The claimant must show actual negative consequences — “real and certain” damage they’ve experienced. A technical breach with no demonstrated impact on your life doesn’t automatically entitle you to compensation. The ruling raises the bar from “something went wrong with my data” to “here is how it affected me.” That’s a meaningful distinction — but it’s achievable with proper documentation. Genuine anxiety about future harm from a serious breach crosses the threshold. What doesn’t: a brief moment of annoyance when a notification email arrived. What have distress claims succeeded on?</h2> UK courts and group action settlements have accepted the following as non-material damage: Fear of future identity theft from a breach involving national identity data, passport numbers, or financial identifiers — particularly when the data appeared on the dark web. Even if no fraud has materialised, documented anxiety about its possibility qualifies. Distress from medical data exposure. In NHS breaches involving mental health records, HIV status, or reproductive health information, courts have awarded at the higher end of the range. The sensitivity of the data amplifies the harm of unauthorised access. Loss of sleep and concentration. Say a claimant documents disrupted sleep after a financial data breach, with journal entries and a GP visit referencing the breach as a stressor. Courts accept this as non-material damage. Impact on personal relationships. Where the breach caused embarrassment, disclosure of private circumstances, or required difficult conversations with family members, courts have treated the relational harm as compensable. What courts have rejected: “I was upset when I got the notification email” — stated without more. Courts detect exaggeration, and overclaiming damages an otherwise valid case. How do you document your distress?</h2> This is the most overlooked part of a UK data breach claim. Solicitors running group actions say it repeatedly: the difference between a £500 award and a £3,000 award is almost always documentation. Start a contemporaneous journal the day you learn of the breach. Date every entry. Record the specific impact: difficulty sleeping, distraction at work, a conversation with a partner about the breach. Write like you’re describing events, not building a legal argument. Visit your GP if you’re experiencing genuine anxiety, and mention the data breach as a contributing factor. A single entry in your medical record noting breach-related stress carries real evidentiary weight — medical records pre-exist the litigation, which makes them credible. Keep records of specific consequences: time spent monitoring accounts, changing passwords, or setting up fraud alerts. If you paid for a credit monitoring service, keep the receipts. Don’t exaggerate. Courts detect overclaiming, and it damages an otherwise valid case. Accurate documentation of moderate distress is worth more than embellished documentation of severe distress. How much will you likely receive?</h2> UK award ranges for non-material damage depend on the severity of impact and quality of evidence: Minimal impact (£500–£1,000): No GP visit, no journal, no specific documented symptoms. Courts award at the low end when evidence is thin — but they do award something for genuine distress from a serious breach. Moderate distress with documented impact (£1,500–£3,000): Journal entries, a GP visit, or records of disrupted sleep. The breach involved meaningfully sensitive data. This is the most common range in active group actions. Severe distress with medical evidence or sensitive data (£3,000–£8,000+): Medical records documenting anxiety, evidence of ongoing impact, and/or a breach of particularly sensitive categories — health data, sexual orientation, biometrics. NHS mental health record cases typically settle here. Group actions place claimants into tiered settlement bands based on evidence of distress. Higher-evidence claimants receive more. The documentation process is not bureaucratic box-ticking. It directly determines your outcome. Frequently asked questions</h2> Can I claim for distress alone after a data breach? Yes. GDPR Article 82 covers non-material damage, which includes distress and anxiety with no financial loss. Vidal-Hall v Google confirmed this in UK law. What does the C-300/21 ruling require? The harm must be real and certain, not just the fact that a breach happened. Genuine, documented anxiety from a serious breach clears the bar. A moment of annoyance at a notification email does not. How much can I get for distress? UK awards run roughly £500–£1,000 for minimal impact, £1,500–£3,000 for documented moderate distress, and £3,000–£8,000+ for severe distress or sensitive data like health records. How do I prove distress? Keep a dated journal from the day you learn of the breach, see your GP and mention it, and record specific consequences. Don’t exaggerate, as courts detect overclaiming. See our GDPR compensation claims guide</a> for the full process, and check where your data has spread to people-search sites</a>. What you can do right now</h2> Want to see what data brokers expose about you? See what a scan finds →</a> shows an example report: the kinds of sites that list your name, phone, and address. That kind of documentation is directly relevant to establishing harm in a compensation claim. Once KnytX Shield launches it will find and remove these listings automatically. Join the waitlist</a> to get in early. India Data Breach Compensation: DPDPA and IT Act Unknown — Sun, 24 May 2026 00:00:00 +0000 In 2023, CoWIN — the government’s COVID vaccination platform — saw records of hundreds of millions of Indians reportedly exposed in a breach. Aadhaar data has appeared in leak forums repeatedly. AIIMS Delhi suffered a ransomware attack that locked patient records for weeks. In each case, the individuals whose data was compromised had essentially no practical route to compensation. That’s starting to change. But it requires understanding the gap between what the law promises and what’s available today. This article is for educational purposes only and does not constitute legal advice. Consult a qualified solicitor or attorney for advice on your specific situation. The short answer: India’s DPDPA fines companies but does not give you a direct right to compensation. Those fines go to the government, not to you, and the Data Protection Board is not yet fully operational as of mid-2026. Three routes work today. Section 43A of the IT Act gives compensation via an Adjudicating Officer, typically ₹1–10 lakh for documented loss. The consumer forum handles “deficiency of service.” Criminal complaints under Sections 66C/66D cover identity theft. Document your breach now so your claim is stronger when enforcement matures. The law is there. The enforcement body isn’t yet.</h2> India’s Digital Personal Data Protection Act (DPDPA) became law in August 2023. It passed Parliament with broad support and established one of the strongest frameworks for data principal rights in any major jurisdiction — on paper. The body that would enforce those rights and award compensation is the Data Protection Board of India (DPBI). The DPDP Rules were finally notified in November 2025, and the Board was legally established. But as of mid-2026, the DPBI is still not fully operational. Member appointments have moved slowly, with the Chairperson and Members not yet appointed. The Act’s substantive obligations are also phasing in over 2026 and 2027 rather than taking effect at once. This is the honest situation. Your rights under the DPDPA are real, and the rules now exist. But the enforcement body isn’t yet functioning. What will DPDPA give you?</h2> When the DPBI is functioning, it will have the power to impose penalties on data fiduciaries. Privacy advocates have flagged a critical gap here. The DPDPA creates a regulatory penalty regime: the Data Protection Board can fine companies up to ₹250 crore under the Schedule to the DPDPA. But these penalties go to India’s Consolidated Fund, not to affected individuals. The DPDPA does not create a direct individual right to compensation for data breach victims. This is a significant gap that distinguishes it from GDPR. Note: Section 31 of the DPDPA is the provision that bars civil courts from hearing data protection cases — it is not a compensation provision. The penalty schedule is set out in Chapter 8 and the Schedule to the DPDPA. It sets fines of up to ₹250 crore for data breaches from inadequate security, and up to ₹200 crore for inadequate data protection obligations. These numbers are higher than many GDPR fines in absolute terms — but the money goes to the government, not to you. What constitutes “harm” under the DPDPA is defined more broadly than under GDPR. The definition includes financial loss, injury to reputation, loss of livelihood, violation of bodily integrity, and loss of access to essential services. That last category is notable. It covers scenarios like a telecom breach that disrupts your mobile service or a fintech breach that locks you out of a payments account. GDPR doesn’t have an equivalent provision. The DPBI will also have the power to investigate companies on its own initiative, not just in response to individual complaints. That’s a meaningful tool when the harm from a breach is diffuse — affecting millions of people in small ways rather than a single person catastrophically. IT Act Section 43A: what you can use today</h2> The DPDPA doesn’t operate in a legal vacuum. The Information Technology Act 2000 has had a compensation mechanism for data breaches since the 2008 amendment — and it’s significantly underused. Section 43A of the IT Act 2000 was the primary individual compensation mechanism before the DPDPA. The DPDPA will eventually replace Section 43A, via Section 44(2), likely around 2027. But for now, Section 43A remains the primary avenue for individual compensation, through the IT Act’s Adjudicating Officer mechanism. Section 43A makes any company handling sensitive personal data liable to pay compensation if two things are true. First, it failed to implement “reasonable security practices and procedures.” Second, that failure caused “wrongful loss or wrongful gain.” The standard of reasonable security practices is defined by reference to ISO/IEC 27001 and, more recently, CERT-In’s directives. Compensation under Section 43A is adjudicated by Adjudicating Officers appointed by the Ministry of Electronics and Information Technology (MeitY). To file a complaint, write to the Adjudicating Officer in your state or the relevant jurisdiction. Describe the breach, the company’s failure to maintain adequate security, and the harm you suffered. Include documentation: breach notification letters, screenshots of fraudulent transactions, and any CERT-In advisories about the company’s breach. Practical awards under Section 43A have been in the ₹1 lakh to ₹10 lakh range for documented financial losses. The mechanism exists. Most people don’t use it because it’s not widely publicised. Can you use the consumer forum after a breach?</h2> Did you have a service relationship with the company that breached your data, such as a bank, telecom operator, or e-commerce platform? Then you have an additional route: the consumer forum. You can file a complaint on grounds of “deficiency of service.” The forums are the District Consumer Disputes Redressal Commission (DCDRC), the State Commission (SCDRC), and the National Commission (NCDRC). This is a genuinely viable option after a data breach. Your grounds: the company collected your data, charged you for (or promised you) a service, and failed to protect it. That is a deficiency in service delivery. Consumer forum complaints must be filed within two years of the cause of action (when you knew or should have known about the breach). The process is relatively accessible: you file in writing, appear for hearings (which are increasingly available via video conference), and present your documentation. Awards in consumer forum cases for data breach-related complaints have ranged from ₹5,000 to ₹50,000 in documented orders. These awards aren’t large — but they’re real, and the forum is free to use for claims under ₹50 lakh. Criminal provisions: Section 66C and 66D</h2> If your breach led to someone using your data to commit crimes, the IT Act provides criminal routes that the civil compensation frameworks don’t cover. Section 66C makes identity theft using computer resources a criminal offence, carrying imprisonment of up to three years plus a fine of up to ₹1 lakh. Section 66D covers cheating by impersonation using computer resources — same penalties. If fraudulent transactions, SIM swaps, or loan applications have appeared in your name following a breach, file an FIR with the cybercrime cell of your local police. You can also file online at cybercrime.gov.in. Criminal proceedings run separately from civil compensation claims. You can pursue both. What’s the realistic timeline for DPDPA enforcement?</h2> GDPR became law in May 2018. The first major fine — Ireland’s DPC fining Meta €1.2 billion — came in May 2023. Five years. During that period, companies hedged, compliance budgets were minimal, and individuals had few practical remedies through the new system. India’s DPDPA enforcement is likely to follow a similar trajectory. The most realistic window for active DPBI enforcement — with meaningful regulatory fines on companies — is 2026 to 2028. Enforcement activity is likely to accelerate after the first major fine lands. Individual compensation for data breach victims is expected to remain through the IT Act’s Adjudicating Officer mechanism for the foreseeable future. That doesn’t mean you wait. Document now. Keep every breach notification you receive. Screenshot news coverage of breaches involving companies you deal with. If you’ve suffered financial loss or documented distress, preserve that evidence. When the DPBI is operational, your complaint will be stronger for it. And the Adjudicating Officer and consumer forum routes under existing law are available to you today. Frequently asked questions</h2> Can I claim compensation for a data breach in India today? Yes, but not through the DPDPA yet. Use Section 43A of the IT Act (via an Adjudicating Officer) or the consumer forum for “deficiency of service.” Awards run roughly ₹1–10 lakh under Section 43A for documented loss. Does the DPDPA give me a right to compensation? No. It lets the Data Protection Board fine companies up to ₹250 crore, but those fines go to the government, not to you. That’s a gap critics have flagged compared with GDPR. Is the Data Protection Board working yet? Not fully. The DPDP Rules were notified in November 2025 and the Board was legally established, but as of mid-2026 it isn’t fully operational and obligations phase in through 2026–2027. What if someone used my data for fraud? File an FIR under IT Act Sections 66C and 66D (identity theft and impersonation) with your local cybercrime cell or at cybercrime.gov.in. You can pursue this alongside a civil compensation claim. For a picture of India’s breach landscape, see our Indian data breach index</a>, and check where your data appears on people-search sites</a>. What you can do right now</h2> Want to see what data brokers expose about you? See what a scan finds →</a> shows an example report: the kinds of sites that list your name, phone, and address. That kind of documentation is directly relevant to establishing harm in a compensation claim. Once KnytX Shield launches it will find and remove these listings automatically. Join the waitlist</a> to get in early. Data Breach Class Actions: How to Join and Claim Unknown — Sat, 23 May 2026 00:00:00 +0000 This article is for educational purposes only and does not constitute legal advice. Consult a qualified attorney for advice about your specific situation. The settlement email most people ignore</h2> Check your deleted folder. Somewhere in there, probably flagged as spam, is an email with a subject line like “Notice of Proposed Class Action Settlement” or “[Company Name] Data Breach Settlement Administrator.” It looks like junk. The sender is a law firm you’ve never heard of. You deleted it. That email was money. The Equifax settlement was worth at least $575 million (with a consumer fund of $425 million). The T-Mobile settlement was $350 million. Capital One paid $190 million. Yahoo paid $117.5 million. These funds exist to compensate you. But to receive anything, you have to file a claim — and most people never do. The claim form takes roughly 10 minutes to fill out. It costs nothing to submit. No lawyer is required. The only thing standing between you and a check is not knowing the settlement exists and not submitting the form before the deadline. That’s what this guide fixes. The short answer: To join a data breach class action, confirm you’re in the affected class and find the official claim form on the settlement administrator’s site. Then choose your tier and file before the deadline. A Tier 1 (base) claim needs no documentation and takes about 10 minutes. A Tier 2 claim reimburses documented losses and can reach a $25,000 ceiling. It costs nothing and needs no lawyer. The only thing that stops most people is missing the settlement notice or the deadline. In this article: What is a class action lawsuit?</a></li> The lifecycle of a data breach class action</a></li> What you actually receive: the major settlements</a></li> The two claim tiers</a></li> Illinois BIPA: the exception with real money</a></li> How to find active class actions</a></li> EU/UK group litigation</a></li> How to submit a claim</a></li> Frequently asked questions</a></li> </ul> What is a class action lawsuit?</h2> A class action lets one or more “named plaintiffs” sue on behalf of everyone who suffered the same harm. These named plaintiffs — usually a handful of people — represent the “class”: all the other victims who experienced the same breach or violation. When a court certifies the class, it’s ruling that the case is appropriate for class treatment. That means the claims are common enough across thousands or millions of people that litigating them individually would be impractical. Once certified, the case proceeds for everyone in the class, whether they know about it or not. Most class actions settle before going to trial. The company agrees to pay a lump sum into a settlement fund. That fund then gets divided among class members based on the tier of harm they’ve documented. The law firms that brought the case collect attorney fees — typically 25–40% of the settlement — off the top. You don’t pay anything. You don’t need to hire a lawyer. You just need to file a claim. The lifecycle of a data breach class action</h2> Understanding the timeline explains why you wait years for a check. Here’s every stage, in order. Stage 1: Breach occurs and becomes public. Companies are required to disclose material breaches, and news coverage often follows within days. The moment a breach is announced, law firms start investigating. Stage 2: Law firms file suit. Within days or weeks of a major breach announcement, multiple plaintiff-side law firms file class action complaints in federal court. They’re often consolidated into a single case. Stage 3: Class certification motion. The plaintiffs ask the court to formally certify the case as a class action. The company fights this. Briefing and hearings take months. Stage 4: Discovery. Both sides exchange evidence — internal emails, security reports, breach forensics. This phase regularly takes one to two years. It’s where the real negotiation leverage is built. Stage 5: Settlement negotiations. Most cases settle here, after discovery but before trial. Both sides know what the evidence shows and calculate the risk of going to a jury. Stage 6: Preliminary settlement approval and notice to class members. The court gives preliminary approval, and a settlement administrator sends notice to affected individuals. This is the email you deleted. Stage 7: Claims period. Class members have a window — typically 60 to 120 days — to submit claims. Miss this deadline and you receive nothing, regardless of how badly you were affected. Stage 8: Final court approval. The court holds a fairness hearing. Class members can object. The judge approves or rejects the settlement. Stage 9: Distribution. Money goes out to everyone who filed a valid claim. Total time from breach to payout: typically two to five years. The Equifax breach happened in 2017. Most claimants received their payments in 2022–2023. What do you actually receive? The major settlements</h2> Numbers help. Here’s what the biggest data breach settlements actually paid out. Equifax (2017 breach, 147 million affected): The FTC announced a settlement of at least $575 million, with a consumer fund of $425 million — the $700 million figure cited in some coverage was the ceiling of the range, not the settled amount. Victims with documented losses — fraudulent accounts, professional fees, hours spent on identity theft recovery — received up to $20,000. People who chose credit monitoring instead got four years of free monitoring through Experian. Those who requested the $125 cash option (instead of monitoring) received less after the claims volume exceeded the fund’s cash allocation. Documented loss claimants averaged around $500. Facebook/Cambridge Analytica (settlement approved 2023): $725 million total — the largest privacy-related settlement in US history at the time. Most claimants received $2–$30 depending on how long they’d had a Facebook account and how many people filed. T-Mobile (2021 breach, 76 million affected): $350 million settlement. Documented loss claimants received up to $25,000. Base claimants — those with no out-of-pocket losses — received approximately $25. Capital One (2019 breach, 100 million affected): $190 million. Same structure: up to $25,000 for documented losses, around $25 for base claimants. Yahoo (2013–2016 breaches, 3 billion accounts across multiple incidents): $117.5 million. Accounts with two-factor authentication enabled received up to $100. Standard accounts received up to $25. Marriott (2018 breach, approximately 383 million records): Litigation is ongoing as of 2026. The pattern is consistent. Base claimants — people with no documented financial harm — receive $25 to $125. People who can prove actual losses receive significantly more. The ceiling in most settlements is $25,000, but reaching it requires documentation. The two claim tiers in most settlements</h2> Every data breach class action settlement structures payouts in tiers. Knowing the difference determines how much you receive. Tier 1 — No documentation required. You are in the breach. You submit a claim form. You receive the base amount. That’s the entire requirement. You don’t need bank statements. You don’t need police reports. You just need to confirm you were affected and submit before the deadline. Base amounts across major settlements have ranged from $25 to $125. This is the fastest path and the one most people take. Tier 2 — Documented losses required. If you suffered actual financial harm from the breach, you file for reimbursement. This covers fraudulent charges on your accounts, costs of credit monitoring services you paid for, professional fees (attorneys, accountants) for resolving identity theft, and time spent on resolution — typically calculated at $25 per hour. You’ll need to submit bank statements, receipts, and records. The claim form walks you through exactly what documentation to attach. Payouts here range from a few hundred dollars to the settlement maximum. Some settlements include a third tier for severe identity theft — documented cases where someone opened fraudulent accounts or filed false tax returns using your information. These claims can reach the $25,000 ceiling. The rule of thumb: always at least file a Tier 1 claim. It costs 10 minutes. If you spent real money resolving identity theft, go for Tier 2 and gather your paperwork. Illinois BIPA: the exception with real money</h2> Most class action settlements produce modest per-person payouts because the settlement fund gets split among millions of claimants. Illinois is different. The Illinois Biometric Information Privacy Act (BIPA) awards $1,000 to $5,000 per violation as statutory damages — meaning you don’t have to prove individual harm. If a company collected your face scan, fingerprint, or voice print without proper notice and consent, each collection is a separate violation worth $1,000 (negligent violation) or $5,000 (intentional violation). This structure explains why TikTok’s $92 million settlement was so large. It included significant BIPA claims from Illinois residents whose biometric data was collected without consent, alongside other state privacy law claims. Facebook’s $725 million settlement in 2023 resolved claims arising from the Cambridge Analytica data-sharing scandal — claims under federal and state privacy laws, not BIPA. Facebook also settled a separate BIPA facial recognition lawsuit for $650 million. Are you an Illinois resident? If you used an app with Face ID, tagged yourself in social-platform photos, or clocked in and out of work with a fingerprint scanner, check whether the company faces BIPA litigation. The per-claimant amounts in BIPA settlements are meaningfully higher than in standard breach settlements. Our guide to biometric data rights</a> explains how BIPA claims work. How to find active class actions you qualify for</h2> You don’t need to wait for a settlement email. These resources let you search for cases yourself. ClassAction.org tracks active and settled class actions across the US. It has a search function where you can type a company name and see whether any litigation is pending or settled. It also tracks claim deadlines — the piece most people miss. TopClassActions.com covers class action news and maintains a database of active settlements with deadlines listed prominently. Subscribe to their email alerts for your state and industry. PACER (pacer.gov) is the federal court’s public filing system. Every federal class action is filed there. Searching by company name shows every case filed, even ones the company hasn’t publicized. Registration is free; documents cost $0.10 per page, though the first $30 per quarter is waived. Your email inbox. Search for “class action settlement notice,” “settlement administrator,” and the name of any company that’s had a breach you were part of. Check your spam folder. Check your deleted folder. Settlement notices are sent to your email address on file with the breached company — which is often an old address. Law firm case pages. Many plaintiff-side law firms that file breach class actions maintain “join the case” pages on their websites. A Google search for “[company name] data breach class action” usually surfaces these quickly. EU/UK group litigation: the GDPR equivalent</h2> The US class action has no direct equivalent in the EU or UK — but mechanisms exist. In the UK, the primary vehicle is the Group Litigation Order (GLO), which consolidates individual claims sharing common issues. The Lloyd v Google case concerned Google’s “Safari Workaround” — Google exploited an exception in Apple Safari’s default cookie-blocking to set DoubleClick advertising cookies on iPhones without user consent. The Supreme Court ultimately dismissed the representative action on the basis that “mere loss of control” over personal data is not sufficient damage without proof of individual harm. Current active UK group litigation includes cases against British Airways (the 2018 breach affecting 420,000 customers) and Marriott (same 2018 breach, UK victims). The EU’s Collective Redress Directive, which member states were required to implement by 2023, enables qualified entities (consumer organizations, advocacy groups) to bring representative actions on behalf of consumers across borders. These aren’t class actions in the American sense — individual consumers don’t file claims the same way — but they can produce compensation orders that flow to affected individuals. If you’re in the EU or UK and were affected by a breach, start by filing a complaint with your national data protection authority. That means the ICO in the UK, the CNIL in France, the BfDI in Germany, and so on. These complaints can trigger regulatory fines against the company. In some cases they also create the factual record that supports follow-on civil litigation. How to submit a claim: the practical steps</h2> When a settlement is announced and you’re in the class, here’s the exact process. Verify you’re in the class. Check the settlement’s official website (listed in the settlement notice or on ClassAction.org). Most settlement sites have a lookup tool where you enter your email address or name to confirm eligibility. You can also check HaveIBeenPwned (haveibeenpwned.com) to see whether your email appears in known breach datasets. </li> Find the claim form. It’s on the settlement administrator’s website. Do not submit through any other website. Settlement scams exist — they send you to fake claim sites and harvest your information. Always verify the URL against what’s listed in official court documents. </li> Choose your tier. Decide whether you’re filing a Tier 1 (base) claim or a Tier 2 (documented losses) claim before you start. Gather documentation before you open the form so you’re not hunting for bank statements mid-way through. </li> Complete the form before the deadline. Claim deadlines are hard. There are no extensions and no exceptions. Missing the deadline means receiving nothing — courts won’t make accommodations for late filers. Set a calendar reminder the moment you learn about a settlement. </li> For Tier 1: You’ll typically provide your name, current address, email address, and confirmation that you were affected by the breach. Some settlements require a claim ID from the settlement notice email. </li> For Tier 2: Attach bank or credit card statements showing fraudulent charges (with unrelated transactions redacted), receipts for paid credit monitoring services, professional invoices for legal or accounting help, and a log of hours spent resolving identity theft issues. </li> Record your submission. Screenshot or save the confirmation number. Keep it somewhere you’ll find it in two years — which is roughly when distribution happens. </li> Track the case. Bookmark the settlement administrator’s website. Check it every few months. Cases occasionally hit delays, have distribution timelines pushed back, or (rarely) get rejected by the court and require resubmission. </li> </ol> Frequently asked questions</h2> How do I join a data breach class action? Confirm you’re in the affected class on the settlement’s official site, then file the claim form before the deadline. You don’t sign up in advance. Once a class is certified, you’re already in it, but you must file to get paid. Do I need a lawyer or money to file a claim? No. Filing a Tier 1 base claim is free and takes about 10 minutes. Law firm fees come out of the settlement fund, not your pocket. How long until I get paid? Typically two to five years from breach to payout. The 2017 Equifax breach paid most claimants in 2022–2023. What if I missed the claims deadline? You generally get nothing. Deadlines are hard, with no extensions. Set a reminder as soon as you learn of a settlement, and check for other active cases at ClassAction.org. Is class action or a GDPR claim better? In the US, class actions pay small base amounts unless you document losses. In the UK/EU, individually assessed GDPR claims often pay more per person. See our UK compensation guide</a>. What you can do right now</h2> Want to see what data brokers expose about you? See what a scan finds →</a> shows an example report: the kinds of sites that list your name, phone, and address. That kind of documentation is directly relevant to establishing harm in a compensation claim. Once KnytX Shield launches it will find and remove these listings automatically. Join the waitlist</a> to get in early. UK Data Breach Compensation: Your Right to Claim Unknown — Thu, 21 May 2026 00:00:00 +0000 British Airways passengers who had their payment card data exposed in the 2018 breach received between £2,000 and £6,000 each. NHS patients whose sensitive medical records were leaked in trust-level breaches have received £750 to £3,000. These aren’t settlements from American class actions — they’re UK compensation claims, many filed by ordinary people with no legal background, against some of the largest organisations in the country. If your personal data was compromised in a breach, you have a legal right to pursue compensation. Here’s how the system actually works. This article is for educational purposes only and does not constitute legal advice. Consult a qualified solicitor or attorney for advice on your specific situation. The short answer: Under UK GDPR Article 82, you can claim compensation if a data breach caused you material harm (financial loss) or non-material harm (distress). Typical UK awards run £750–£6,000. Start free by filing an ICO complaint, then use the Small Claims Court for claims up to £10,000 (no solicitor needed) or join a group action for larger breaches. For bigger claims, no-win-no-fee solicitors take 25–35% only if you win. After Lloyd v Google, you must show real impact, not just presence in a breach. More people have won UK data breach claims than you realise</h2> The numbers above aren’t outliers. HMRC contractor breach victims have received £750 to £2,500 each. In NHS Digital and GP surgery breaches involving sensitive mental health or sexual health records, courts have awarded at the higher end precisely because the data was more sensitive. What these cases share: the claimants documented their experience. They kept records of what happened, when they found out, and what impact the breach had on them. That documentation — not just the fact that the breach occurred — is what drove the awards. The UK has one of the most active data breach compensation ecosystems in the world. No-win-no-fee solicitors, group litigation orders, and a Small Claims Court that genuinely works for individual claims under £10,000 all contribute to making this viable. Your legal right: UK GDPR Article 82</h2> UK GDPR Article 82 gives every individual the right to receive compensation if a breach of the regulation caused you damage. You can claim against the data controller (the organisation that held your data) or the data processor (a company processing it on their behalf). The damage can be material — financial loss, like fraudulent charges, identity theft costs, or money spent fixing problems caused by the breach. Or it can be non-material — distress, anxiety, loss of sleep, and loss of control over your personal information. Both categories are compensable. One important precedent to understand: Lloyd v Google [2021] UKSC 50. The Supreme Court dismissed a representative action (a form of group claim). Its basis was that “mere loss of control” over data, without evidence of actual individual harm, was not sufficient to sustain the claim at scale. This doesn’t affect individual claims. It means you need to show some real impact: genuine distress, financial consequences, or specific harm from the breach. Presence in a breach database alone is not enough. Should you file an ICO complaint first?</h2> Before pursuing a civil claim, file a complaint with the Information Commissioner’s Office. This is free and doesn’t require a solicitor. It does two things: it creates an official record, and if the ICO finds the company violated UK GDPR, those findings support your subsequent civil claim. File at ico.org.uk/make-a-complaint. The process takes around 10 minutes. You’ll describe the breach, when you found out, and what harm you’ve experienced. The ICO typically provides an initial assessment within three months. It doesn’t award compensation directly (that happens through civil courts), but its findings carry real weight. The £20 million fine against British Airways and £18.4 million against Marriott both came from ICO investigations. Claimants in the group actions used those regulatory findings as evidence of the companies’ failings. Don’t wait for the ICO investigation to conclude before starting a civil claim. The two processes run in parallel. Can you use Small Claims Court without a solicitor?</h2> Does your loss or distress put your claim in the £1,000 to £10,000 range? Then the Small Claims Court (England & Wales) is a realistic option, and you don’t need a solicitor to use it. First, send a Letter Before Action (LBA). This is mandatory before filing. The LBA must: identify yourself, describe the breach and the company’s failings, state what damage you’ve suffered, specify the compensation you’re seeking, and give the company 14–28 days to respond before you file. Send it by email and recorded post. Keep copies. If they don’t respond or refuse without adequate grounds, file at gov.uk/make-court-claim-for-money (Money Claim Online). Filing fees range from £35 to £455 depending on claim size. You’ll submit your particulars of claim — a short document describing the breach, the legal basis (UK GDPR Article 82), and your losses. Witness statements, medical records, and documentation of your distress all strengthen the case. The Small Claims track is designed for ordinary people. Judges understand data breach claims. This route makes sense when your losses are documented but modest, when no group action is available, and when you’re comfortable handling paperwork without a solicitor. How do group actions work for larger claims?</h2> For significant breaches — particularly those affecting tens of thousands of people — group litigation orders (GLOs) let claimants pursue claims together. This increases leverage against defendants and reduces individual cost. To find active group actions: search “[company name] data breach group action UK” and check the websites of specialist firms. As of mid-2026, active cases include British Airways (Hayes Connor, JMW Solicitors), Marriott, several NHS Trust breaches, and TikTok’s processing of children’s data. Registering interest with a participating firm is free. You complete an online form, provide basic details about your involvement in the breach, and the firm contacts you about next steps. You don’t commit to anything at registration. If the case settles, claimants are typically placed into compensation bands based on evidence of harm — which is why documentation matters even in a group action. How do no-win-no-fee solicitors work?</h2> A conditional fee agreement (CFA) — commonly called no-win-no-fee — means you pay the solicitor nothing upfront and nothing if you lose the case. If you win, the solicitor takes between 25% and 35% of your compensation award as their success fee. The phrase “no win, no fee” can obscure some nuances. In some CFA structures, if you lose, you may still be liable for the other side’s legal costs — or for certain out-of-pocket expenses (called disbursements) your solicitor incurred. Ask explicitly when you sign: what are my out-of-pocket costs if we lose? Most consumer data breach CFAs are structured so the claimant pays nothing in a loss scenario, but confirm this before signing. Solicitors specialising in UK data breach claims include Hayes Connor, JMW Solicitors, Keller Postman UK, and Slater and Gordon. Most offer free initial consultations. If you’ve received a breach notification letter, search the company name and “data breach claim.” A specialist firm is often already running a group action. For help choosing one, see our no-win-no-fee solicitor guide</a>. Frequently asked questions</h2> Can I claim data breach compensation in the UK? Yes, under UK GDPR Article 82, if a breach caused you material harm (financial loss) or non-material harm (distress). You don’t need financial loss to claim, but after Lloyd v Google you must show real impact, not just being in a breach. How much is a UK data breach claim worth? Typical awards run £750–£3,000 for distress, rising to £2,000–£6,000 for sensitive data or documented financial harm. British Airways claimants settled around £2,000–£6,000 each. Do I need a solicitor? Not for a Small Claims Court claim up to £10,000, which is designed for litigants in person. For larger claims or group actions, a no-win-no-fee solicitor takes 25–35% only if you win. How do I start a UK data breach claim? File a free ICO complaint first, then send a Letter Before Action to the company. If unresolved, file in Small Claims Court or join a group action. A record of your data spreading to people-search sites</a> helps prove ongoing harm. What you can do right now</h2> Want to see what data brokers expose about you? See what a scan finds →</a> shows an example report: the kinds of sites that list your name, phone, and address. That kind of documentation is directly relevant to establishing harm in a compensation claim. Once KnytX Shield launches it will find and remove these listings automatically. Join the waitlist</a> to get in early. How to Prove Harm in a Data Breach Claim Unknown — Wed, 20 May 2026 00:00:00 +0000 This article is educational and does not constitute legal advice. Consult a qualified solicitor or attorney for advice on your specific claim. Most people who were in a data breach receive the minimum settlement. Not because their harm was minor — but because they couldn’t prove it. They knew they felt anxious. They knew they’d spent hours on hold with their bank. They just didn’t write any of it down. The gap between a £500 base amount and a £5,000 documented claim is not determined by the severity of the breach. It’s determined by what you can show. The short answer: To prove harm in a data breach claim, document two kinds of damage. Material harm is money lost or spent: bank statements with fraudulent charges, receipts for monitoring, a time log, and professional invoices. Non-material harm is distress: a dated journal started the day you learn of the breach, a GP note, and a witness statement. A record of your data spreading to data broker sites shows ongoing, downstream harm. Contemporaneous evidence, written at the time, is what turns a base settlement into a properly argued claim. Why are most people’s claims weaker than they should be?</h2> You were in the breach. Your data was exposed. But when a solicitor or settlement administrator asks you to document your harm, most people produce nothing — and receive the base amount. “I was worried about it” is not a compensable claim. “I experienced genuine anxiety that disrupted my sleep and work for three weeks, as documented in these dated journal entries, and visited my GP on [date] where the breach was discussed as a contributing cause” — that is. Courts and settlement administrators are not unsympathetic. But they operate within legal frameworks that require harm to be real, specific, and evidenced. The evidence required is rarely complicated or expensive to produce. It just has to exist. What is material harm? The financial evidence</h2> Material harm is the easier category — you’re showing money lost or spent as a direct result of the breach. Bank and card statements showing unauthorised transactions. Highlight each one and note the date relative to the breach disclosure.</li> Receipts for credit monitoring or identity theft protection purchased after the breach was announced. That subscription cost is a direct out-of-pocket loss caused by the breach.</li> A time log. UK courts accept £15–£25 per hour for time spent resolving fraud. Write down every call, every form, every hour disputing charges — “2 hours on [date] on hold with fraud department; 1.5 hours completing police report.” Date each entry.</li> Professional invoices — solicitor, accountant, or credit repair service engaged because of fraud from the breach.</li> Salary slips or leave records if you took time off to deal with fraud. Lost income is compensable if documented.</li> </ul> Keep originals. Digital copies with timestamps work, but have the originals available. What is non-material harm? Documenting distress</h2> The CJEU’s ruling in C-300/21 (2023) confirmed that non-material damage under GDPR — distress, anxiety, loss of control over personal data — is compensable. The court also confirmed that mere exposure is not enough. The harm must be real and certain, not hypothetical. Genuine distress is compensable — but you have to prove it’s genuine. Start a contemporaneous journal. The day you learn of the breach, open a document and start writing. Date every entry. Describe how you felt — anxious about unknown consequences, unable to sleep, checking your account repeatedly through the night. Write in plain language. The contemporaneous nature (written at the time, not reconstructed later) is what makes entries credible. Visit your GP if the distress is genuine. If the anxiety has affected your sleep, appetite, or concentration at work, see your doctor and mention the breach as a contributing factor. A GP record noting “patient experiencing anxiety following notification of personal data breach” is medical evidence that exists independent of your own account. Keep records of conversations with family or colleagues. Maybe people around you observed you distressed: checking accounts repeatedly, expressing worry, losing sleep. A short written statement from them supports your claim. This matters most in higher-value individual GDPR claims. Document the loss of control itself. C-300/21 specifically recognises loss of control over personal data as non-material harm. Say your data is now accessible to parties you never authorised, listed on sites you never consented to. Document that in your journal, alongside any evidence of where your data has appeared. How does data broker exposure prove harm?</h2> After a data breach, your personal information doesn’t stay in a single database. It gets absorbed into data broker ecosystems, such as people-search sites</a>, marketing databases, and background check services, often within weeks. A scan showing your name, address, and phone number listed across 40 or 50 data broker sites after a breach is documented evidence. It shows the breach caused your data to spread beyond its original context. That is downstream harm. It’s verifiable, dateable, and directly relevant to establishing the extent of exposure in a claim. An example exposure report</a> shows the kind of documentation a scan produces: exactly which sites list your personal information. When you can run and date-stamp your own, that evidence shows a court or settlement administrator that the breach didn’t just expose your data in theory. It caused your data to propagate to dozens of third-party sites you never consented to. Under GDPR and the UK’s Data Protection Act 2018, your data appearing on these sites without consent is itself a data protection issue. As evidence in a compensation claim, it shows that the real-world consequence of the breach extended far beyond the breached company’s own systems. Building your evidence file</h2> Organise your evidence before you need it. By the time a settlement is announced, evidence gaps are hard to fill retroactively. Keep these in a single folder: The breach notification email (screenshot it)</li> HIBP confirmation showing your email in the breach</li> Bank and card statements with fraudulent transactions highlighted</li> Receipts for credit monitoring purchased post-breach</li> Your time log — dates, durations, activities</li> Your distress journal (dated from the day you learned of the breach)</li> A data broker scan showing your exposure (screenshot with date)</li> GP records if you sought medical attention</li> Police reports or ICO/FTC complaints you filed</li> </ol> This takes an afternoon to assemble if you start now. It takes months to reconstruct if you wait. When should you involve a solicitor?</h2> For claims above approximately £3,000 in the UK, or where your documented losses are significant, a data breach solicitor adds real value. Most operate on a no-win-no-fee basis — you pay nothing unless your claim succeeds. Bring your evidence file to the first consultation. A solicitor who sees financial statements, a time log, a distress journal, and a data broker scan can assess your claim quickly. One presented with nothing but your recollection of anxiety has far less to work with. For more on finding and engaging a data breach solicitor, read our guide at /blog/data-breach-solicitor-no-win-no-fee/</a>. Frequently asked questions</h2> How do I prove harm in a data breach claim? Document material harm (fraudulent charges, monitoring receipts, a time log) and non-material harm (a dated distress journal, a GP note, a witness statement). A record of your data spreading to broker sites shows downstream harm. Can I claim for anxiety alone? In the UK and EU, yes, under the C-300/21 ruling. But the distress must be real and documented, not hypothetical. A contemporaneous journal and a GP record are the strongest evidence. What evidence gives the biggest payout boost? Contemporaneous documentation. Evidence written at the time you learned of the breach carries far more weight than a timeline reconstructed months later for the claim. When should I gather evidence? The day you find out. Assembling a strong evidence file takes an afternoon if you start now, and months to reconstruct if you wait until a settlement is announced. See our guide on how to document a data breach claim</a>. What you can do right now</h2> Want to see what data brokers expose about you? See what a scan finds →</a> shows an example report: the kinds of sites that list your name, phone, and address. That kind of documentation is directly relevant to establishing harm in a compensation claim. Once KnytX Shield launches it will find and remove these listings automatically. Join the waitlist</a> to get in early. Biggest Data Breach Settlements: What Victims Got Unknown — Tue, 19 May 2026 00:00:00 +0000 This article is educational and does not constitute legal advice. Consult a qualified attorney for advice on your specific situation. Equifax paid at least $575 million to settle the 2017 breach. You got $6.25. That gap between the headline and the cheque is the story of how data breach settlements actually work. Understanding it is the difference between walking away with nothing and receiving something meaningful. The short answer: Most breach settlements pay a tiny base amount (often $5–$30) to anyone in the breach. The real money goes to a separate tier for people who document losses: fraud, stolen time, professional fees, and distress. Documented claimants routinely receive 10 to 100 times more. UK GDPR claims, assessed individually, pay far more per person than US class actions. The lesson is simple: keep receipts and file on time. Why is there a gap between the headline and your cheque?</h2> A settlement fund gets divided. Take Equifax: 147 million people were eligible to claim from a consumer fund of $425 million. (The $700 million figure was the ceiling of the FTC-announced range, not the settled amount.) The base amount per person is small for three reasons. Lawyers take fees, administration costs eat a portion, and the money is split across multiple tiers. People with documented losses draw from a higher tier. Everyone else competes for the base. The base tier is deliberately small. Regulators and plaintiffs’ attorneys know most people will never document their losses. The settlement structure is built around that reality — which is exactly why the documented loss tier exists and why the per-person amounts there are so much higher. Equifax: the case study in what documentation does</h2> The 2017 Equifax breach exposed the financial and personal records of 147 million people: names, Social Security numbers, birth dates, addresses, and driver’s licence numbers. The FTC, CFPB, and 50 state attorneys general reached a settlement including up to $425 million in consumer compensation. Every eligible person could claim one of two things: seven years of free credit monitoring, or a $125 cash payment. The $125 option was the headline. Then the FTC warned publicly that because millions of people had chosen cash, the per-person amount would be drastically reduced. For most claimants who chose cash, it came to $6.25. The documented loss tier told a completely different story. People who could show identity theft or fraud directly linked to the breach were eligible for up to $20,000. Qualifying evidence included bank statements showing unauthorised transactions, time spent resolving fraud (compensated at up to $25/hour), credit monitoring costs, and professional fees paid to resolve identity theft. The claimants who received meaningful amounts had paper — bank statements, phone logs, receipts for credit monitoring bought in a panic the week the breach was announced. The people who received $6.25 had nothing but their email address in the breach. Facebook, T-Mobile, Capital One, Yahoo</h2> Facebook/Meta (Cambridge Analytica, $725M, 2023). Every US Facebook user from 2007 to 2022 was eligible — approximately 190–210 million people. No documentation was required for the base claim. With over 26 million claims filed, per-person amounts landed at an estimated $2 to $30. No documentation required, and it showed. T-Mobile (2021 breach, 76.6M affected, $350M settlement). T-Mobile offered up to $25,000 for documented losses: fraud, identity theft, professional fees, and time spent resolving them. The base for all claimants was $25. California residents received $100. All class members also got two years of identity theft protection through McAfee. This is a clear example of the tiered structure: $25 versus up to $25,000, separated entirely by documentation. Capital One (2019, 98M+ affected, $190M settlement). Capital One offered up to $25,000 for documented losses; approximately $25 for base claimants. Priority claimants with documented unreimbursed losses averaged $500 to $1,000. The exposed data included Social Security numbers and bank account information — material, verifiable harm for many people who simply didn’t document it. Yahoo (2013–2016 breaches, 3B accounts, $117.5M settlement). Yahoo’s settlement paid $100 to accounts with two-factor authentication enabled and $25 to other accounts, plus two years of credit monitoring. Three billion accounts were affected, so the settlement fund was relatively small. But the per-person amounts here were fixed rather than divided. The cap was the issue, not the pool. British Airways: why UK GDPR beats US class actions for per-person payouts</h2> The British Airways breach in 2018 exposed the personal and payment data of approximately 500,000 customers. The response wasn’t a US-style class action — it was a UK GDPR group litigation, which is a fundamentally different legal mechanism. Rather than splitting a fixed fund among millions of claimants, UK GDPR claims are assessed individually. The group litigation against British Airways resulted in most claimants settling at £2,000 to £6,000 depending on distress severity and any documented financial harm. Compare that to the US class action experience: $25 base, $125 capped. The difference isn’t that the British Airways breach was worse. The difference is the legal mechanism — individual GDPR claims produce individual assessments of individual harm. For anyone affected by a breach with UK or EU dimensions, pursuing a GDPR claim individually produces a consistently better per-person outcome. Why does documentation change your payout so much?</h2> Across every settlement above, the pattern is the same. Claimants with documented losses received 10 to 100 times more than base claimants. The breach severity didn’t determine the individual outcome. The paperwork did. What to document after any breach: Fraudulent transactions. Bank and card statements with unauthorised charges highlighted and dated.</li> Time spent resolving fraud. Keep a log — date, duration, what you did. Courts accept $25/hour in the US, £15–£25/hour in the UK for reasonable time spent on resolution.</li> Credit monitoring costs. Receipts for any service purchased after the breach was announced.</li> Professional fees. Solicitor, accountant, or credit repair invoices paid to address fraud.</li> Distress. Contemporaneous notes — dated entries on anxiety, sleeplessness, disruption to daily life. GP records if you sought medical help. Witness statements from family who observed the impact.</li> </ul> Start this the day you learn of the breach. Evidence created at the time is far more compelling than a reconstruction written months later. How to find out if you qualify for a current settlement</h2> Settlement notices are mailed and emailed, but many people miss them. Three reliable places to check: ClassAction.org — searchable database of current settlements with claim deadlines</li> TopClassActions.com — similar coverage with news on new settlements</li> The settlement administrator’s website — listed in any official breach notification you received</li> </ul> Search for companies you’ve done business with in the past five years. Breaches are often disclosed long after they occurred, and settlements follow the breach by one to three years. You may be eligible for something you’ve never heard of. Claim deadlines are strict. Courts do not grant extensions for individual claimants who missed the window. If you’re checking, check now. Frequently asked questions</h2> Why do breach settlements pay so little per person? A fixed fund gets split among millions of claimants after lawyer fees and admin costs. The base tier is deliberately small because most people never document losses. The documented-loss tier pays far more. How much can I actually get from a data breach settlement? Base amounts often land at $5–$30. Documented-loss tiers reach $20,000–$25,000 in cases like Equifax, T-Mobile, and Capital One. Your paperwork, not the breach size, decides your tier. Do I need a lawyer to claim? Not for filing a base or documented claim in a US class settlement. For UK GDPR group litigation or a Small Claims route, a no-win-no-fee solicitor can help. See our no-win-no-fee guide</a>. How do I find settlements I qualify for? Check ClassAction.org and TopClassActions.com, and search companies you’ve used in the last five years. Deadlines are strict and courts rarely grant extensions. What you can do right now</h2> Want to see what data brokers expose about you? See what a scan finds →</a> shows an example report: the kinds of sites that list your name, phone, and address. That kind of documentation is directly relevant to establishing harm in a compensation claim. Once KnytX Shield launches it will find and remove these listings automatically. Join the waitlist</a> to get in early. Data Breach Compensation: Your Legal Rights Unknown — Mon, 18 May 2026 00:00:00 +0000 This article is for educational purposes only and does not constitute legal advice. If you believe you have a claim, consult a qualified solicitor or attorney in your jurisdiction. The company was fined millions. You got nothing.</h2> Equifax paid at least $575 million to settle claims arising from the 2017 breach that exposed 147 million people’s data. Meta paid $725 million to settle the Cambridge Analytica class action. British Airways paid £20 million to the UK’s Information Commissioner’s Office after their 2018 breach exposed 400,000 customers. Most of those victims received nothing. Or they got a $125 check — before the Equifax settlement fund ran dry and payouts dropped to pennies on the dollar. Not because they had no rights. Because they didn’t know how to use them. Regulators collect fines and move on. The money goes to governments, not to the people whose data was actually mishandled. The only way individual breach victims see compensation is by claiming it themselves. Companies count on the fact that most won’t bother. This guide covers what you’re actually owed and how to start the process. The short answer: Your right to data breach compensation depends on where you are. Under GDPR Article 82 (EU/UK), you can claim for distress alone, with no minimum loss and often no upfront cost via no-win-no-fee. In the US, compensation comes through class actions, usually $25–$500 unless you document losses. In India, claims run through the IT Act’s Section 43A while the new Data Protection Board becomes operational. Everywhere, you must gather proof you were in the breach and file before the limitation deadline. In this article: Where your right to compensation comes from</a></li> Material vs non-material damage</a></li> EU/UK: the strongest individual rights</a></li> US: class actions are the mechanism</a></li> India: the right exists, enforcement is arriving</a></li> What you need to make a claim</a></li> Time limits that matter</a></li> Finding legal help</a></li> Frequently asked questions</a></li> </ul> The legal basis: where your right to compensation comes from</h2> The right to claim compensation after a data breach exists in law across most major jurisdictions. The mechanisms differ, but the principle is the same: when a company fails to protect your data and you suffer harm as a result, you have a legal remedy. GDPR Article 82 (EU) is the most powerful individual right in existence. Any person who suffers material or non-material damage as a result of a GDPR infringement has the right to receive compensation from the controller or processor. No minimum damage threshold. No requirement to prove financial loss. Distress, anxiety, and loss of control over personal data all qualify. UK GDPR carries the identical provision post-Brexit, enacted through the Data Protection Act 2018. UK courts have awarded compensation for distress alone — without any accompanying financial loss — in multiple cases. The jurisdiction is actively litigated. United States: there is no federal data breach compensation law equivalent to GDPR. Compensation comes through state consumer protection statutes, class action litigation, and FTC-mandated settlement funds. California, Illinois, and New York have the strongest individual rights. Illinois BIPA (Biometric Information Privacy Act) is notable — it provides statutory damages of $1,000–$5,000 per violation without requiring proof of harm. India DPDPA 2023: Section 43A of the IT Act 2000 is India’s pre-existing compensation provision, which the DPDPA is replacing. It provides a route for compensation via Adjudicating Officers. The DPDP Rules were notified in November 2025, and the Data Protection Board of India was legally established. As of mid-2026, though, the Board is not yet fully operational, with leadership appointments still pending. Australia: the Privacy Act 1988 allows individuals to lodge complaints with the Australian Information Commissioner, who has the power to award compensation and require remedial action. What can you claim for: material vs non-material damage?</h2> Claims fall into two categories. Understanding both matters, because one of them applies to almost every breach victim who suffered any kind of distress. Material damage covers financial loss directly caused by the breach. Fraudulent transactions on accounts accessed using stolen credentials. Costs to repair your credit file. Professional fees to a solicitor, identity theft service, or accountant to sort out fraud committed in your name. Lost earnings if you took time off work to resolve identity fraud. Document these with receipts, bank statements, and records. Non-material damage is where most breach victims underestimate their position. UK and EU courts have consistently held that exposure of personal data — without any proven financial loss — qualifies for compensation. The harm is the loss of control over your own information, the anxiety of not knowing who has it, and the distress of having private data circulating without your consent. Awards in UK group actions for non-material damage typically range from £500 to £3,000 per person for standard distress. They rise significantly for ongoing harm, sensitive categories of data (health, financial records), or cases where the anxiety was severe and documented. In Lloyd v Google [2021] UKSC 50, the UK Supreme Court ruled against the claimants. It held that “mere loss of control” over personal data is not sufficient damage to sustain a representative action without proof of individual harm. The ruling significantly curtailed large-scale opt-out data protection claims in the UK. For the detailed legal analysis of non-material damage under GDPR, see /blog/gdpr-non-material-damage/</a>. EU/UK: the strongest individual rights</h2> GDPR Article 82 is directly enforceable. You do not need to wait for a regulator to act before bringing a claim. The steps: Write to the company’s Data Protection Officer (every GDPR-covered organisation must have one or a designated contact). State what data was exposed, what harm you suffered, and that you are seeking compensation under Article 82. Give them a reasonable deadline — 30 days is standard. </li> If unsatisfied, complain to the national Data Protection Authority. In the UK that’s the ICO (ico.org.uk). In France it’s CNIL, in Germany each state has its own DPA. A regulator complaint puts the company on notice and creates a paper trail, even if the regulator doesn’t personally pay your compensation. </li> Bring a civil claim. You can take a case to court directly, or instruct a solicitor. In the UK, “no win no fee” data breach solicitors are actively running group claims against British Airways, Marriott, Capita, and NHS Trusts, among others. You register your interest, provide your evidence, and the firm handles the litigation — you pay nothing if the claim fails. </li> </ol> The EU Collective Redress Directive became available to member states from 2023, enabling representative actions where consumers can be grouped into a single claim across the EU. This lowers the barrier for coordinated action significantly. US: class actions are the mechanism</h2> Individual GDPR-style rights don’t exist at the federal level. The class action system is how breach victims in the US receive compensation collectively. Here’s how it works. A plaintiff’s law firm files a class action lawsuit against the breached company. The court certifies a “class” — all people whose data was exposed in the breach. The company (usually) settles rather than going to trial. The settlement fund is distributed to class members after legal fees. Typical per-person payouts: $25 to $500, depending on the settlement size and the number of claimants who submit claims. Some — the Equifax settlement, the T-Mobile settlement — offer more for individuals who document out-of-pocket losses. Illinois BIPA claims are different; statutory damages of $1,000 per negligent violation and $5,000 per intentional violation mean class settlements can be substantial even without documented harm. To participate in an existing class action, you generally just need to submit a claim form before the deadline. Law firms publish claim portals when settlements are approved, and sites like TopClassActions.com aggregate open claims. For the mechanics of joining or initiating a US data breach class action, see /blog/data-breach-class-action-guide/</a>. India: the right exists, enforcement is arriving</h2> India’s DPDPA 2023 is ambitious legislation, but it does not create a direct individual right to compensation in the way GDPR does. The DPDPA’s penalty regime allows the Data Protection Board of India to fine companies. But those fines go to India’s Consolidated Fund (the government treasury), not to affected individuals. Privacy advocates have specifically criticised this gap. The practical problem is timing. The DPDP Rules were notified in November 2025 and the Board was legally established. But as of mid-2026 the Board is not yet fully operational, with substantive obligations phasing in through 2026 and 2027. In the interim, two paths exist. First, file a breach notification complaint with CERT-In (the Indian Computer Emergency Response Team). Companies must notify CERT-In within 6 hours of a breach, and failure to do so is itself a violation. Second, pursue civil remedies under Section 43A of the IT Act 2000, India’s pre-existing individual compensation mechanism. It allows compensation from companies that failed to implement “reasonable security practices and procedures” and caused wrongful loss or gain. These claims go to Adjudicating Officers appointed under the IT Act. Once the DPBI is fully operational, it may create additional pressure on companies. But individual compensation for data breach victims is expected to remain primarily through the IT Act’s Adjudicating Officer mechanism for the foreseeable future. For the India-specific compensation guide, see /blog/india-data-breach-compensation/</a>. What you need to make a claim</h2> Across all jurisdictions, the evidence requirements follow the same pattern. Gather this before you contact anyone. Evidence you were in the breach. The notification email from the company. A HIBP confirmation showing your email in the breach dataset. A statement from the company acknowledging the breach and your inclusion in it. You need at least one of these. Evidence of what data was exposed. The company’s breach notice should list data categories — name, address, email, passport number, financial data. If they haven’t published a data inventory, submit a Subject Access Request (under GDPR/UK GDPR) or a CCPA data request (California) asking for confirmation of what categories of your data they held and whether it was involved in the breach. They are legally required to respond within 30 days. Evidence of harm. For material damage: bank statements showing fraudulent transactions, receipts for costs incurred, records of lost earnings. For non-material damage: a written account of the distress you experienced — when you found out, how it affected you, any anxiety, loss of sleep, or behavioural changes. This doesn’t need to be a formal document; courts have accepted personal statements. Evidence of downstream data spread. When your data appears in a breach, it doesn’t stay there. It propagates into data broker databases and people-search sites</a>. A record of where your personal information now appears helps show it is circulating as a result of the breach. This establishes that the harm extended beyond the initial incident and is ongoing. That documentation is relevant to the harm element of your claim. The limitation periods: time limits that matter</h2> Claims have deadlines, and missing them ends your case regardless of its merits. UK: 6 years from the date of the breach (or from the date you became aware of it, in some circumstances). For claims framed purely as personal injury — distress — the limitation is 3 years. Act before the 3-year mark to keep all options open.</li> EU: varies by member state. Typically 3 to 5 years. France: 5 years. Germany: 3 years. Check the rule in the country whose law governs your claim.</li> US: varies by state and cause of action. Most state consumer protection and data breach statutes carry 2 to 3 year limitations. Class actions are typically filed within months of a breach becoming public — if you see news coverage, check whether a class action has already been filed and join it before the opt-in deadline.</li> India: DPDPA limitation periods are to be set by the forthcoming rules. IT Act Section 43A civil claims: 3 years.</li> </ul> Joining an existing group action is almost always the easiest path — the firm has already done the work of establishing the breach, the class, and the legal theory. Your job is to register and document your own harm. Finding legal help</h2> Most data breach claims in the UK and EU are run on a no-win-no-fee (conditional fee agreement) basis. You pay nothing upfront and nothing if you lose. The solicitor takes a percentage of any compensation awarded — typically 25–35%. This means specialist firms take only cases they believe they can win, which is also a reasonable signal of claim viability. UK firms actively pursuing data breach group actions include Hayes Connor Solicitors, JMW Solicitors, and Keller Postman UK. For NHS and public sector breaches, Slater and Gordon and Leigh Day have run significant actions. US class action firms handling data breach litigation include Boies Schiller Flexner, Morgan & Morgan, and Milberg Coleman Bryson. These firms advertise on claim aggregator sites when they have open cases. In Australia, the Australian Information Commissioner handles complaints directly — you do not need a lawyer to file with the OAIC, though one helps if the complaint escalates to formal investigation. For guidance on choosing a data breach solicitor and what questions to ask before signing a no-win-no-fee agreement, see /blog/data-breach-solicitor-no-win-no-fee/</a>. Frequently asked questions</h2> Am I entitled to data breach compensation? In the EU and UK, yes, under GDPR Article 82, if a breach caused you material or non-material harm (including distress). In the US, compensation comes through class actions and state laws. Your rights depend on where you live and which law governs the breach. Can I claim without any financial loss? In the EU and UK, yes. Courts have awarded compensation for distress alone, typically £500 to £3,000. Lloyd v Google limits large opt-out group claims, but individual distress claims still stand. How much can I get? UK/EU distress awards commonly run £500–£3,000, higher for sensitive data. US class-action base payouts are usually $25–$500 unless you document losses, which can reach $25,000. Illinois BIPA pays $1,000–$5,000 per violation. Do I have to pay a lawyer upfront? Usually not. Most UK and EU breach claims run on a no-win-no-fee basis. You pay nothing if the claim fails; the solicitor takes 25–35% of any award. How long do I have to claim? Limits vary: UK 6 years (3 for distress-only), most EU states 3–5 years, most US states 2–3 years, and India 3 years under the IT Act. File before the earliest applicable deadline. What you can do right now</h2> Want to see what data brokers expose about you? See what a scan finds →</a> shows an example report: the kinds of sites that list your name, phone, and address. That kind of documentation is directly relevant to establishing harm in a compensation claim. Once KnytX Shield launches it will find and remove these listings automatically. Join the waitlist</a> to get in early. Credit Freeze vs Fraud Alert: Which Do You Need? Unknown — Sun, 17 May 2026 00:00:00 +0000 Your Social Security Number was in a data breach. You Googled what to do. Half the results said freeze your credit. The other half said place a fraud alert. A few said do both. Nobody explained the difference, and none of them told you which one actually stops someone from opening a credit card in your name tomorrow morning. Here’s the clear version. Two tools. Different jobs. Most people use neither.</h2> A credit freeze and a fraud alert are both protective measures you can place on your credit file. They don’t offer the same level of protection, and for most breach scenarios involving your national ID number, one is clearly the right choice. Most people — even people who know these tools exist — don’t use either. They assume it’s complicated, or figure it won’t happen to them. Then someone opens a credit card in their name and they find out during an apartment application. The tools are free. The process takes about fifteen minutes. There is no good reason not to use them after a serious breach. What a credit freeze does</h2> A credit freeze (sometimes called a security freeze) locks your credit file at each bureau. When you apply for new credit — a loan, a credit card, a mortgage — lenders pull your credit report to check your creditworthiness. A frozen file returns an error instead of your report. The lender can’t evaluate you, so they can’t approve the application. This blocks identity thieves from opening new accounts in your name even if they have your full name, date of birth, address, and Social Security Number. Without a credit report to review, there’s no approval. The fraud attempt dies there. (For the full picture of how that data reaches a fraudster, see how identity theft happens</a>.) A credit freeze does not affect your existing accounts. Your current credit cards still work. Your credit score isn’t touched. You can still use your bank account. It only blocks new credit inquiries — which is exactly the attack it’s designed to stop. When you legitimately need to apply for new credit, you temporarily lift (or “thaw”) the freeze at the relevant bureau, complete your application, and refreeze. Lifting takes minutes online. In the US, credit freezes have been free at all three major bureaus — Equifax, Experian, and TransUnion — since 2018. What a fraud alert does</h2> A fraud alert adds a flag to your credit file telling lenders to take extra verification steps before approving anything. You only need to contact one bureau — they notify the others. It lasts one year. For confirmed identity theft victims, an extended fraud alert lasts seven years. The limitation: it doesn’t block the credit check. The lender still pulls your report. They’re supposed to verify you more carefully, but lenders vary in how seriously they treat the flag. A determined fraudster can still get through. A fraud alert is better than nothing. A credit freeze is better than a fraud alert. When to use each</h2> If your national ID number was exposed — your SSN in the US, National Insurance number in the UK, Aadhaar in India — place a credit freeze. Not a fraud alert. A freeze. Your national ID number doesn’t expire. It doesn’t change. It can be used against you years after the original breach. The only reliable defence against new account fraud is blocking the credit check entirely. That’s what a freeze does. Use a fraud alert when you’re generally cautious but don’t have confirmed ID exposure, or as a quick interim step while you set up freezes at all three bureaus. If your SSN was in a breach: freeze. How to place a credit freeze in the US</h2> You must place the freeze separately at each of the three major bureaus. One call to Equifax doesn’t freeze your Experian or TransUnion file. Equifax: equifax.com/personal/credit-report-services/credit-freeze/ or call 1-888-298-0045. You’ll create an account and set a PIN or password to manage the freeze. Experian: experian.com/freeze/center.html or call 1-888-397-3742. Same process — create an account, set a PIN, manage online. TransUnion: transunion.com/credit-freeze or call 1-888-909-8872. Same. For thorough protection, also freeze at ChexSystems (chexsystems.com) — this covers bank account applications, not just credit — and NCTUE (nctue.com), which covers utility and telecom accounts. Identity thieves who can’t open a credit card sometimes open utility accounts for financial fraud instead. Have your SSN, date of birth, and address ready. The online process takes about five minutes per bureau. UK, India, and other markets</h2> The US credit freeze has no direct equivalent everywhere, but similar protective tools exist. UK: The closest equivalent is a CIFAS Protective Registration (cifas.org.uk). CIFAS is the UK’s fraud prevention service; a Protective Registration flags your identity as at risk, requiring lenders to take additional verification steps before approving applications. It costs around £25 for a two-year registration. Experian UK, Equifax UK, and TransUnion UK also offer credit lock features through their consumer portals — check each bureau’s site for current options. India: The Credit Information Bureau India Limited (CIBIL) offers a credit lock through mycibil.com — free for registered users. This works similarly to a US credit freeze, blocking new credit inquiries. Equifax India and Experian India have their own consumer portals with protective options. CRIF High Mark is the fourth major bureau; check crif.in for their current consumer tools. If you’re outside these markets, search for your country’s credit reporting bureaus and ask specifically about credit freezes, credit locks, or protective flags. Most developed credit markets have some equivalent. What a credit freeze doesn’t protect against</h2> A credit freeze stops new account fraud. It doesn’t stop everything. Existing account fraud — someone using your current credit card number — is not affected. A freeze has nothing to do with your existing accounts. Monitor your statements. Tax fraud is a separate problem. In the US, attackers file fake tax returns in your name to claim your refund. File your taxes early — filing first closes the window. The IRS offers an Identity Protection PIN at irs.gov/identity-theft-fraud-scams/get-an-identity-protection-pin that blocks fraudulent returns. Child identity theft is a specific risk: children have clean SSNs that no one monitors. That clean ID also makes them a target for synthetic identity fraud</a>. If your child’s information was exposed in a breach, freeze their credit too. Each bureau allows it with a parent or guardian acting on their behalf. A credit freeze solves one specific problem — new account fraud — well. Know what else you need to handle separately. What you can do right now</h2> Want to see what data brokers expose about you? See what a scan finds →</a> shows an example report: the kinds of sites that list your name, phone, and address. Once KnytX Shield launches it will find and remove these automatically. Join the waitlist</a> to get in early. What to Do After a Data Breach: A Step-by-Step Guide Unknown — Sat, 16 May 2026 00:00:00 +0000 The email lands in your inbox. “[Company] Security Notice: Your account may have been affected.” Or you typed your email into HaveIBeenPwned and got the red banner back. Either way, you’re now staring at the screen wondering what, exactly, you’re supposed to do. Most guides tell you to change your password and move on. That advice is incomplete, and for some breach types it’s dangerously insufficient. What you need to do in the next 24 to 72 hours depends entirely on what kind of data was exposed. A credential breach and a national ID breach require completely different responses. This is the triage playbook. The short answer: After a data breach, first confirm the notification is real (go to the company’s site, not the email link, and check Have I Been Pwned). Then act based on what was exposed. Passwords: change them everywhere you reused them and turn on two-factor authentication. PII: monitor credit and remove yourself from broker sites. National ID: freeze your credit (US) or lock your Aadhaar (India). Card data: request a new card now. Medical data: request and review your records. You have the most control in the first 24 to 72 hours. In this article: You received the notification. Now what?</a></li> Step 1: Confirm it’s real</a></li> Step 2: Identify what was exposed</a></li> If passwords were exposed</a></li> If PII was exposed</a></li> If national ID was exposed</a></li> If payment card data was exposed</a></li> If medical data was exposed</a></li> Ongoing monitoring setup</a></li> Frequently asked questions</a></li> </ul> You received the notification. Now what?</h2> Don’t click anything inside the notification email. Don’t call any phone number listed in it. Don’t log in through any link it contains. Breach notification emails are a known phishing vector. Attackers watch for high-profile breaches, then send fake notifications to millions of people. These fakes come complete with logos, legal language, and urgent CTAs. They’re designed to harvest your credentials the moment you try to “secure your account.” Before you take any action at all, your first job is confirming the notification is real. The next 24 to 72 hours are the window where you have the most control. After that, your data is circulating, credential stuffing attacks are running, and fraud operations are using whatever was exposed. Act fast, but act correctly. Step 1: Confirm it’s real</h2> Go directly to the company’s website. Type the URL into your browser — do not click the email link. Look for an official breach announcement on their homepage, newsroom, or security page. Search for the company’s name plus “data breach” on Google News. Check their official social media accounts (the verified ones). If the breach is real, there’s almost always independent press coverage within 24–48 hours of a public announcement. Then check HaveIBeenPwned (haveibeenpwned.com) directly. Enter your email address. If the breach appears there, it’s confirmed independently of the company’s notification. HIBP receives breach data from security researchers and aggregates it — it doesn’t rely on the company’s self-reporting. If you cannot independently verify the breach through any of these methods, treat the notification as phishing and report it. Do not act on it. Step 2: Identify what was exposed</h2> Once you’ve confirmed the breach is real, find the official breach notice — on the company’s site, not in the email — and look for the data inventory. Most reputable companies list exactly what categories of data were affected. If they don’t, look for their breach FAQ page; regulators in the EU and US often require companies to publish one. The categories that determine your entire response: Passwords / credentials</li> Email address only</li> Name, address, phone number (PII)</li> Payment card data</li> National ID numbers (SSN, Aadhaar, NI number, TFN)</li> Medical or health data</li> Financial account data (bank account numbers, routing numbers)</li> </ul> Each one requires a different playbook. Read the section below that matches your situation. If multiple data types were exposed — which is common — work through each section. If passwords were exposed</h2> Change the compromised password on the affected site immediately. Use something unique — a random string from a password manager, not a variation of your existing password. Then: every other account where you used the same password is now compromised too. This is the part most people skip. Attackers run credential stuffing — automated tools that take the username/password pair from the breach and try it against hundreds of other sites. Banking, email, social media, shopping. They run millions of attempts per hour. If you use a password manager, go to its breach-check feature and find every account with a duplicate password. Change them all. If you don’t use a password manager, this breach is your reason to start — read our guide at /blog/password-manager-guide/</a>. Enable two-factor authentication on the affected account and on every account where you changed a duplicate password. The options and setup process are covered in /blog/two-factor-authentication-guide/</a>. Do not use SMS-based 2FA if you can avoid it; an authenticator app (Google Authenticator, Authy, Aegis) generates codes locally and can’t be intercepted by a SIM swap. Check the account’s login history. Most email providers and social platforms show recent logins with timestamps and locations. Look for anything you don’t recognize. If an attacker got in before you changed the password, they’ve already had access — which means checking connected apps, forwarding rules, and any settings they might have changed. If PII was exposed (name, address, phone, email)</h2> PII doesn’t expire. A password you change becomes useless within minutes of changing it. Your home address and phone number are still accurate years from now. What happens with exposed PII: it gets absorbed into data broker databases and sold into people-search sites</a>. Within weeks of a breach, your details are queryable on sites like Spokeo</a>, Whitepages</a>, and their international equivalents. That’s how spam calls, targeted phishing, and social engineering attacks get fueled. Attackers buy bulk lists or look you up directly. The immediate steps: Monitor your credit reports. In the US, request free weekly reports at annualcreditreport.com (all three bureaus). In the UK, check via Experian or Equifax (free basic access). In India, check your CIBIL score at cibil.com — free once per year, or via apps like OneScore or BankBazaar more frequently. </li> Place a fraud alert. In the US, a fraud alert at one bureau (Equifax, Experian, or TransUnion) automatically notifies the other two. It tells creditors to take extra steps to verify identity before opening new accounts in your name. It lasts one year and is free. </li> Check if your data has spread to data broker sites. Our guides on removing data from US brokers (/blog/remove-yourself-from-us-data-brokers/</a>) and the Indian internet (/blog/removing-your-data-from-indian-internet/</a>) walk through the removal process. </li> Raise your phishing awareness. With your name, address, and employer in their hands, attackers can craft convincing spear-phishing emails. The next suspicious email you get could reference real details about you. Treat any unexpected request — even one that sounds plausible — with extra skepticism. </li> </ol> If national ID was exposed (SSN, Aadhaar, NI number)</h2> This is the most serious category, and the response is different in each jurisdiction. A national ID number is the key to your financial identity in most countries. Exposed national ID data is used for new account fraud, loan applications, tax fraud, and benefit claims in your name — sometimes for years after the breach. If you’re in the US (SSN exposed): Place a credit freeze at all three bureaus: Equifax, Experian, and TransUnion. Do this before anything else. A credit freeze — not a fraud alert, a freeze — prevents new credit from being opened in your name. It’s free, it’s immediate, and it’s the strongest protection available. A fraud alert asks creditors to verify identity; a credit freeze prevents them from checking your credit at all without your explicit authorization. Get an IRS Identity Protection PIN at irs.gov/identity-theft-central. An IP PIN is a six-digit number that must accompany any tax return filed using your SSN. Without it, a fraudulent return using your SSN gets rejected. Tax fraud is one of the most common uses of exposed SSNs, and most victims don’t discover it until they try to file their own return. File a report at identitytheft.gov — the FTC’s dedicated identity theft tool. It generates a personalized recovery plan. If you’re in India (Aadhaar exposed): Lock your Aadhaar biometric authentication immediately at uidai.gov.in/my-aadhaar/offline-kyc/lock-unlock-biometrics.html. This prevents anyone from using your fingerprint or iris scan to authenticate as you. You can unlock it temporarily when you genuinely need biometric authentication, then lock it again. Check your linked mobile number on UIDAI — go to resident.uidai.gov.in and verify the mobile number linked to your Aadhaar is your current number and hasn’t been changed. Install or open the mAadhaar app and monitor authentication requests. UIDAI sends an OTP to your linked mobile number for every authentication attempt — any request you didn’t initiate is a red flag. Alert your bank if your Aadhaar is linked to your account (as required for many Indian accounts under PMLA). Banks have fraud teams specifically for Aadhaar-related identity fraud. If you’re in the UK (NI number exposed): Place a CIFAS protective registration at cifas.org.uk. This is a fraud prevention measure that flags your identity in the UK’s fraud prevention database — any creditor checking your identity sees the flag and applies additional verification steps. It costs a small fee (currently £25 for two years) and is the closest UK equivalent to a US credit freeze. Contact HMRC if you have reason to believe someone is using your NI number for employment or tax purposes. HMRC has a dedicated line for NI number fraud. Notify your bank and check your credit file via Experian, Equifax, or TransUnion UK. All three offer free basic access to your statutory credit report. If payment card data was exposed</h2> Call your bank or card issuer. Don’t wait for fraud to appear — request a proactive card replacement now. New card number, new CVV, same account. This takes one phone call and is always the right move. Disputing fraudulent charges after the fact is slower and more stressful than replacing the card before the fraud happens. Review the last 90 days of statements. Specifically look for small transactions — £1, $2, ₹50 — from merchants you don’t recognize. Attackers test stolen cards with micro-transactions before attempting larger purchases. A test transaction you didn’t catch confirms the card is active; a failed transaction tells them the card is already flagged. Update any recurring payments linked to the old card number. Subscriptions, utilities, and insurance payments will fail after the card number changes — the sooner you update them, the fewer disruptions. If your card was a debit card linked directly to a bank account, apply more scrutiny to the account itself. Debit fraud can directly empty a bank account in a way that credit card fraud doesn’t. If medical data was exposed</h2> Medical identity theft is the hardest type to detect and the hardest to resolve. It doesn’t show up on your credit report the way new account fraud does. Instead, it embeds false information inside medical systems — incorrect diagnoses, prescriptions written in your name for drugs you never took, procedures billed to your insurer that you never had. Doctors rely on those records. If a fraudster has received care under your identity, your medical history now includes their conditions and their treatments. Request your medical records from every healthcare provider you’ve used in the past two to three years. In the US, you have the right to do this under HIPAA at no cost (or minimal cost). In the UK, you can request your NHS records. In India, most private hospitals provide records on request; government hospital records access is less standardized. Read through them. Look for any procedure, prescription, diagnosis, or consultation you don’t recognize. If you find discrepancies: Report to the healthcare provider that the records contain fraudulent entries.</li> Report to your health insurer — they have fraud units for exactly this.</li> In the US, file a report with the FTC at identitytheft.gov and contact the HHS Office for Civil Rights at hhs.gov/ocr (they handle HIPAA violations).</li> In the UK, contact the Information Commissioner’s Office at ico.org.uk.</li> </ol> Keep copies of everything. Correcting fraudulent medical records can take months and requires documentation at every step. The ongoing monitoring setup</h2> After you’ve completed the immediate response for your data type, set up the infrastructure that catches future exposure. HIBP email notifications. Go to haveibeenpwned.com and register your email addresses for free breach alerts. You’ll get an email the moment your address appears in a new breach database. Takes two minutes to set up. Credit report checks on a schedule. Not once — quarterly. Set a calendar reminder. In the US, rotate through the three bureaus (Equifax, Experian, TransUnion) so you’re checking a different one every month at annualcreditreport.com. In India, pull your CIBIL report every 90 days. Account login alerts on your major accounts. Gmail, your bank, Apple ID, and any social media accounts should all be configured to email or push-notify you on new logins. These are usually in the account’s security settings. A login alert from a city you’re not in is your warning that an account is compromised — before the attacker has fully exploited it. Data broker scans. Your PII spreads from breach databases into people-search sites automatically over time. Running a periodic check shows you where your information has surfaced and lets you submit removal requests before it becomes a source for targeted attacks. If your national ID was exposed, consider maintaining the credit freeze indefinitely (in the US) rather than lifting it. The freeze doesn’t prevent you from applying for credit — you unfreeze temporarily when you need it and refreeze afterward. The minor inconvenience is worth it. The breach notification you might not get</h2> Here’s the uncomfortable reality: most breaches are not disclosed to individuals promptly — and many are never disclosed at all. Under GDPR, companies must notify the relevant supervisory authority within 72 hours of discovering a breach. They must notify affected individuals “without undue delay” when the breach is likely to result in a high risk to those individuals’ rights and freedoms. But “undue delay” has been interpreted flexibly, and enforcement is uneven. In the US, breach notification laws vary by state. There’s no single federal standard. Some states require notification within 72 hours; others give companies 30, 45, or 90 days. Some carve out exceptions for encrypted data that may have already been exposed. In India, CERT-In (Computer Emergency Response Team) mandates breach notification within 6 hours of becoming aware. That’s one of the shortest timelines globally, established under CERT-In’s 2022 directions. The DPDPA 2023 adds notification provisions for the Data Protection Board. Its rules were notified in November 2025, but as of mid-2026 the Board isn’t fully operational and enforcement is still phasing in. Neither framework yet requires direct individual notification the way GDPR does. HIBP often surfaces breach data before the breached company makes any public announcement. It’s why checking HIBP independently — rather than waiting for a notification — is standard practice for anyone monitoring their exposure. What this means for you: don’t wait to be told. Check HIBP regularly. Run scans periodically. The breach you haven’t been notified about may already be circulating. Frequently asked questions</h2> What’s the first thing to do after a data breach? Confirm the notification is real before acting. Go to the company’s website directly (not the email link) and check Have I Been Pwned. Breach emails are a common phishing lure. Do I really need to change more than one password? Yes. If you reused the breached password anywhere, every one of those accounts is now exposed to credential stuffing. Change them all and enable app-based two-factor authentication. What if my Social Security number or Aadhaar was exposed? This is the most serious category. In the US, freeze your credit at all three bureaus and get an IRS Identity Protection PIN. In India, lock your Aadhaar biometric and verify your linked mobile number. How long do I have to act? The first 24 to 72 hours give you the most control, before credential stuffing and fraud operations use the data. Act fast, but confirm the breach is real first. How do I stop the spam and scam calls a breach causes? Remove yourself from the people-search sites</a> that resell breach data. See our guide on how to check if your data was leaked</a> to find where you’re exposed. What you can do right now</h2> Want to see what data brokers expose about you? See what a scan finds →</a> shows an example report: the kinds of sites that list your name, phone, and address. Once KnytX Shield launches it will find and remove these automatically. Join the waitlist</a> to get in early. Session Hijacking: Logged In After a Password Change Unknown — Fri, 15 May 2026 00:00:00 +0000 You found out your account was compromised. You changed your password immediately — the right instinct. You felt like you’d closed the door. But the attacker was already inside. Not logging in. Already logged in. Right now, while you reset your password, they’re in your inbox reading your messages. Your password change did nothing to them, because they don’t need your password anymore. This is session hijacking — and it’s the attack most people don’t know to defend against. Changing your password didn’t log them out</h2> When you log into a website, the server doesn’t ask for your password on every page you visit. It can’t — that would be unbearable to use. Instead, it hands you a session token: a long, random string stored as a cookie in your browser. Every subsequent request you make sends that token. The server sees the token and says: that’s a valid logged-in user, let them through. Your password is used once, at login. The session token handles everything after. If an attacker steals your session token, they have what the server actually checks. They paste it into their browser, and from the server’s perspective, they are you — authenticated, trusted, and already in. They didn’t use your password to get there. Changing your password doesn’t expire their token. It doesn’t trigger a logout on their end. They stay in until the session token expires on its own — which, on most services, takes days or weeks. What a session token is</h2> A session token is just a string of characters. Something like a 128-character random hex value. It has no embedded information about who you are, what your password is, or where you’re logging in from. It’s an opaque key that unlocks a specific logged-in state on the server. Browsers store these tokens as cookies — small files tied to a specific domain. When you visit Gmail, your browser sends your Google session cookie automatically with every request. Google’s servers read it, verify it against their session database, and return your email. Steal the cookie; impersonate the user. It’s that direct. Modern web security adds some protection. The HttpOnly flag prevents JavaScript from reading a cookie (blocking some types of theft). The Secure flag ensures the cookie only travels over encrypted HTTPS connections. The SameSite attribute limits which cross-site requests can include the cookie. These help — but they don’t cover all the attack vectors attackers actually use. How session tokens get stolen</h2> Info-stealer malware</a> is the dominant threat. This is purpose-built software, such as RedLine Stealer, Vidar, and Raccoon Stealer, designed specifically to harvest browser cookies, saved passwords, and session tokens from your local machine. These tools are not exotic. RedLine Stealer is available as a subscription service for $150–$200. It targets Chrome, Firefox, Edge, and major desktop applications. It dumps your browser’s cookie store, packages everything into a “log,” and sends it to the attacker. The attacker then either uses your active sessions directly or sells the log on a dark web marketplace. How does malware like this reach your machine? Cracked software downloads. Malicious ads that trigger drive-by downloads. Phishing emails with infected attachments. Pirated games. It lands on machines constantly, in volume, often without any visible sign. Cross-site scripting (XSS) is a vulnerability in a website itself — not in your machine. If an attacker finds a way to inject JavaScript into a page you visit, that script can read your cookies for that domain and send them to an attacker-controlled server. The attack runs in your browser, silently, while you browse a legitimate site that has a security flaw. Man-in-the-browser attacks use malware that sits inside your browser and intercepts or modifies traffic in real time. It reads session tokens as they travel, or alters transactions before the request leaves your machine, for example by changing a bank transfer destination. The info-stealer ecosystem</h2> RedLine, Vidar, and Raccoon Stealer aren’t niche tools. They’ve infected millions of machines. The credentials and session tokens they harvest are sold in bulk on dark web marketplaces. Logs with active Google, Facebook, or bank sessions sell for $5–$50 each, depending on the account’s apparent value. This is a scaled criminal marketplace. Sellers advertise fresh logs with filter options: country, browser, account types. Buyers purchase in bulk, sort for high-value sessions, and use them before the sessions expire. The pipeline runs continuously — new infections, new logs, new sales. In 2022, this ecosystem enabled some of the year’s most significant breaches. The Lapsus$ group — responsible for compromising Microsoft, Nvidia, Samsung, and Okta — obtained session tokens from criminal marketplaces and underground forums. They didn’t break into secure systems through advanced technical exploits. They bought access that had already been harvested from compromised machines. The Uber breach the same year used a contractor’s credentials plus aggressive social engineering to bypass MFA. An attacker spammed the contractor with MFA push notifications until, overwhelmed, they accepted one. Session access followed. The lesson isn’t just about MFA design — it’s that once a session is established, it’s a high-value target. Real attacks using stolen sessions</h2> The 2022 Uber breach is the clearest public example of how session-level access works in practice. Attackers got a contractor’s VPN credentials (possibly from a stealer log or credential market), then used social engineering to get past MFA. Once inside, they moved through internal systems using the legitimate session — Uber’s security tools saw an authenticated session from a known contractor, not an intruder. Lapsus$ showed this scaled: they compromised Okta’s support systems using a session obtained through a third-party contractor. Okta serves thousands of businesses. One stolen session, correctly placed, gave access to tools that touched many of them. Neither attack required breaking encryption or bypassing firewalls. Both used stolen or socially-engineered session access to impersonate legitimate users. Session hijacking isn’t a theoretical attack. It’s how major breaches actually happen. How to fully revoke sessions</h2> When you suspect your account has been compromised — or after any known breach involving your credentials — you need to invalidate all active sessions, not just change your password. Every major service has this capability. Most people don’t know it exists. Google: Go to myaccount.google.com, then Security > Your devices > Manage all devices. You can sign out of each device individually. Also check Security > Recent security activity for sessions you don’t recognise. Signing out all devices invalidates their session tokens — the next access requires a fresh login with your new password. Facebook: Settings > Security and Login > Where You’re Logged In. You’ll see a list of active sessions with device type and location. Select any unrecognised session and remove it. There’s also a “Log Out of All Sessions” option that clears everything at once. Apple ID: Go to appleid.apple.com, scroll to the Devices section. You’ll see every device signed in with your Apple ID. Remove any you don’t recognise — this revokes their session. For any account: after revoking sessions, check for persistent access that survives a session revocation. In Gmail, check Settings > Forwarding and POP/IMAP for any forwarding rules an attacker may have set up to keep receiving your email after you log them out. Check Settings > Linked accounts or Apps with access for any third-party authorisations an attacker granted themselves. Session revocation ends their current access. But if they set up forwarding or authorised a connected app, they’ve created a backdoor that outlasts the session. Check both. What you can do right now</h2> Want to see what data brokers expose about you? See what a scan finds →</a> shows an example report: the kinds of sites that list your name, phone, and address. Once KnytX Shield launches it will find and remove these automatically. Join the waitlist</a> to get in early. Business Email Compromise: Breach Data to Wire Fraud Unknown — Thu, 14 May 2026 00:00:00 +0000 A finance employee at a Toyota subsidiary in Europe received an email from someone who appeared to be a company executive. The email authorised a payment of €37 million to a new bank account. The employee processed the transfer. The money was gone. The email wasn’t from the executive. It was a business email compromise attack. It worked because it knew exactly the right names, the right context, and the right tone to be believable. The short answer. Business email compromise (BEC) is a fraud where an attacker impersonates an executive, a vendor, or a colleague by email to redirect a payment to an account they control. It runs on breach data and research, not malware, so the fake looks completely legitimate. The single control that stops most BEC is verbal confirmation: before acting on any payment change or unusual wire, call the requester on a phone number already in your system, never the number in the email. Add two-person authorization for large transfers and email authentication (DMARC, DKIM, SPF). BEC is one category in the wider cyber fraud field guide</a>. The $37 million email</h2> The 2019 Toyota Boshoku case is not an outlier. It’s a template. Attackers had done their homework. They knew the executive’s name, the subsidiary’s payment workflows, the general structure of how approvals worked. The email referenced real business context. It arrived during a moment when a large transfer could plausibly be legitimate. The FBI calls business email compromise the most financially damaging cybercrime in the world. From 2016 to 2021, BEC attacks caused $43 billion in losses globally. In 2023 alone, the FBI’s Internet Crime Complaint Center logged $2.9 billion in BEC losses — just the cases that got reported. Recovery rate: roughly 4%. Once a wire transfer lands in an attacker-controlled account, it moves fast. The money is gone. How attackers get the information</h2> There are two paths into a successful BEC attack. Both start with breached data. Path one is account compromise. An executive’s work email credentials appear in a breach database — from a third-party service, a credential-stuffing list, or a reused password. Attackers run those credentials against the corporate email system. If the password works (or a variation of it does), they’re in. From inside the inbox, they don’t immediately do anything visible. They read. They learn the ongoing deals, the vendor relationships, the payment patterns, the names of finance team members, the format of approval requests. They watch for months sometimes. When they act, the fraud email is built on real intelligence — real invoice numbers, real vendor names, the names of real colleagues in the CC field. Path two is impersonation without access. Attackers don’t need the actual inbox if they can build a convincing-enough fake. They register a domain that looks like yours — replacing an “m” with “rn,” adding a hyphen, swapping one letter. They harvest executive names and roles from LinkedIn. Breach data fills in personal details that make the email feel real. OSINT from company press releases and filings fills in the rest. Path one is more dangerous because it has perfect information. Path two is more common because it requires no technical compromise of the target company. The four main BEC scenarios</h2> CEO fraud is the most well-known. An email from (or appearing to be from) the CEO, CFO, or another executive asks for an urgent wire transfer to a new account. The message often says: don’t go through normal channels, don’t discuss this with others yet, it needs to happen today. Vendor fraud is subtler and arguably more effective. Attackers compromise or impersonate a vendor your company already pays regularly. They send an email — looking like a routine vendor communication — saying the vendor’s banking details have changed. Update your records to the new account number. The next payment goes straight to the attackers. Payroll diversion targets HR and payroll departments. An email appearing to be from an employee asks to update their direct deposit information before the next pay cycle. The payroll goes to the attacker’s account. The real employee notices when their pay doesn’t arrive. Attorney fraud targets deal closings. At the moment a real estate transaction, M&A deal, or settlement is about to close, an email arrives from someone claiming to be legal counsel, with instructions to wire funds to a specific account for escrow or closing costs. Each scenario has one thing in common: a payment is being redirected to an account the attacker controls. Why it works: the psychological triggers</h2> BEC attacks work because they’re engineered to bypass the mental habits that would normally trigger scepticism. Authority shuts down questioning. An instruction from the CEO gets processed differently than one from a peer. The normal instinct to push back gets suppressed. Urgency eliminates deliberation. “This needs to be completed before the wire window closes today” removes the time people would normally use to verify. Urgency and verification are incompatible — attackers know this. Secrecy blocks the most effective defence: asking a colleague. “Don’t mention this to anyone yet, the deal is sensitive” isolates the target from the one question that would stop the attack. Familiarity creates false trust. When the email references a real vendor by name, a real invoice number, a real ongoing transaction — that specificity feels like proof. It isn’t. It’s research. These four triggers working together are why intelligent, experienced finance professionals fall for BEC attacks. The attack is designed around human decision-making, not technical vulnerabilities. What organisations can do</h2> The single most effective control is a verbal confirmation policy for any payment change request or unusual wire transfer. The rule: before any payment instruction is acted on — regardless of who it appears to be from — the requestor is called on a known, pre-existing phone number. Not the number in the email. Not a callback to a number just sent in a message. A number already in your system. This one control stops the vast majority of BEC attempts dead. Attackers cannot fake a phone call to the real executive’s known mobile number. Beyond that: Two-person authorisation for wire transfers above a threshold means no single employee can execute a payment without a second person confirming. The threshold matters — set it at a level where it catches real risk, not just million-dollar transfers. DMARC, DKIM, and SPF are email authentication protocols that prevent attackers from spoofing your domain to your own employees. If your company doesn’t have these configured, check with your IT team. Domain spoofing is trivially easy without them. External email banners — a visible tag on emails originating outside your organisation — break the illusion of internal authority. When the “CEO’s” email carries a bright banner saying “External sender,” it disrupts the authority trigger. BEC simulation training — not just awareness presentations, but realistic simulations that test employees with actual BEC-style emails — builds the habit of scepticism in the moment. What employees can do individually</h2> Know your company’s wire transfer policy before you need it. If there isn’t one, raise it. The policy should specify: any payment instruction received by email requires verbal confirmation before action. That’s the floor. Treat urgency as a warning sign, not a reason to skip steps. Legitimate executives and vendors understand that financial controls exist. If someone is pressuring you to skip verification because there’s no time, that pressure itself is information. Treat secrecy as a red flag. Real sensitive transactions don’t require you to hide them from your finance director or compliance team. If an email is asking you to keep it quiet, it’s asking you to remove the people who would catch the fraud. Report suspicious emails — even if you’re not sure. The cost of a false alarm is a few minutes of someone’s time. The cost of staying silent about a real BEC attempt can be millions. Many successful BEC attacks involved employees who suspected something but didn’t report it. What you can do right now</h2> Want to see what data brokers expose about you? See what a scan finds →</a> shows an example report: the kinds of sites that list your name, phone, and address. Once KnytX Shield launches it will find and remove these automatically. Join the waitlist</a> to get in early. The Breach Notification Gap: Why You Learn Too Late Unknown — Wed, 13 May 2026 00:00:00 +0000 The email arrives on a Tuesday afternoon. Subject line: “Important notice regarding your account security.” The company regrets to inform you that an unauthorised party accessed their systems. They may have obtained your name, email address, and password. What the email doesn’t say: the breach happened six months ago. Attackers were inside the network for weeks before that. Your credentials were sold on a dark web market within 72 hours of the breach. Three separate criminal groups have already used them in credential-stuffing attacks. One of them accessed your old email account and used it to reset a password somewhere else. You’re finding out now. The IBM Cost of a Data Breach Report puts the average time between a breach and its identification at 204 days. That’s not the time until you’re notified. That’s just when the company finds out. The short answer: The breach notification gap exists because companies take months to even detect a breach (204 days on average, per IBM), then weeks more to contain it and prepare notices. Meanwhile attackers start exploiting stolen data within 24 to 72 hours. By the time your email arrives, your data has already been sold, reused, and profiled. Don’t wait for the notice: monitor Have I Been Pwned and watch for login anomalies so you find out first. Was your data stolen months before you got the email?</h2> The IBM figure of 204 days to identify a breach is an average across thousands of incidents. Add another 69 days for containment. The total breach lifecycle runs to 266 days before a company can even begin preparing notifications. Attackers typically begin exploiting stolen data within 24 to 72 hours of exfiltration. Not weeks. Hours. By the time your breach notification email lands in your inbox, your data has already been through a full criminal supply chain: exfiltrated, verified, listed for sale, purchased, and used. The email is a historical document. It’s telling you about something that happened to a past version of your data. Why do companies take so long to notice a breach?</h2> Attackers don’t announce themselves. They move laterally through networks — from an initial foothold (often a phishing email or a compromised contractor account) through internal systems, establishing persistence as they go. They read internal communications, map the data landscape, and exfiltrate carefully over time. Modern ransomware operators spend weeks inside networks before deploying their payload because they want to understand what’s valuable first. The median time attackers spent inside a compromised network before detection was 16 days in 2023, according to Mandiant’s M-Trends report. That’s down from 416 days a decade ago — a genuine improvement in corporate detection capability — but still three weeks of silent access. Many breaches aren’t discovered by the company’s own security team at all. External threat intelligence firms spot breach data appearing on dark web markets. Law enforcement notifies companies after identifying stolen data during criminal investigations. The Marriott breach is the extreme case. Attackers had access to the Starwood guest database from 2014, and Marriott didn’t discover it until 2018. That’s four years and roughly 383 million guest records, found only during a post-acquisition security audit. Four years. What happens after detection — before you’re told</h2> Discovery triggers a process, not an announcement. Companies notify law enforcement — which often asks them to hold off on public disclosure to avoid tipping off the attacker. They engage forensics firms, bring in legal counsel, and patch the vulnerability before admitting anything publicly. They prepare the notification text, set up a call centre for affected users, and decide whether to offer credit monitoring (and negotiate that contract). This takes time. Under GDPR, companies must notify the relevant Data Protection Authority within 72 hours of becoming aware of a breach. But the regulation’s individual notification requirement says “without undue delay” — which has no hard deadline. Companies interpret this generously. So: the DPA gets the 72-hour notification. You get “without undue delay,” which in practice often means weeks or months after the DPA was already told. What your data is doing during the gap</h2> The notification gap isn’t empty time. It’s the criminal opportunity window, and it has a structure. Hours 0–72: Fresh breach data sells at a premium on dark web markets. New, unverified data commands higher prices because credential-stuffing attacks against it haven’t yet triggered mass password resets. Buyers know they have a window. Weeks 1–8: Automated credential-stuffing runs against major services — email providers, banking portals, retail accounts. Attackers are looking for password reuse across sites. Phishing campaigns are built using the breached data to target victims with personalised lures (“we noticed unusual activity on your account at [company you actually use]”). Months 2–6: Enriched profiling. Attackers combine your breached data with information from data brokers to build fuller profiles used for targeted fraud — account takeover, synthetic identity construction, social engineering. When you get the email: Your data has already moved through multiple hands. The original breach data has been re-sold, combined with other breach data, and is now embedded in criminal databases that will be used for years. The notification is accurate — it’s just not timely in any way that helps you act before the damage. What law requires — and doesn’t</h2> Notification requirements vary so much by jurisdiction that “data breach law” is almost meaningless as a global concept. GDPR (EU/EEA): Companies must notify the relevant Data Protection Authority within 72 hours. Individual notification is required only when the breach is “likely to result in a high risk to the rights and freedoms of natural persons.” Even then, it must happen “without undue delay,” with no hard deadline for reaching individuals. In practice, regulators have accepted weeks. United States: There’s no federal breach notification law. Each state sets its own rules. Most require notification within 30–90 days of discovery. California is among the strictest. Some states have no deadline at all. India: CERT-In requires organisations to report incidents to CERT-In within six hours of becoming aware. Six hours. That’s faster than GDPR’s 72-hour DPA notification requirement. But this only reaches the government. India’s older framework had no mandatory individual notification requirement: companies had to tell the government, not you. The Digital Personal Data Protection Act 2023 adds breach-notification duties, and the DPDP Rules were finally notified in November 2025. As of mid-2026, though, those duties phase in over 2026–2027, and the Data Protection Board is not yet fully operational. So direct individual notification is coming but not yet enforced in practice. Australia: The Notifiable Data Breaches scheme requires notification within 30 days of becoming aware of an “eligible data breach.” That means a breach likely to result in serious harm to affected individuals. UK (post-Brexit): The UK GDPR mirrors EU GDPR’s 72-hour DPA notification requirement. Individual notification rules are equivalent. How can you find out before the notification arrives?</h2> Waiting for the company email is the worst strategy available to you. Here’s what works instead. Have I Been Pwned (haveibeenpwned.com): Free breach monitoring for email addresses. Sign up, and you’ll receive a notification whenever your address appears in a newly indexed breach dump. There’s a lag, but it catches far more than corporate notification timelines do. Dark web monitoring: Services that scan dark web markets and breach repositories for your email addresses, phone numbers, and passwords. KnytX Shield is built to do this automatically once you’re in. When your credentials appear in a new dump, it’s designed to alert you before the company’s email arrives. Login anomalies: Password reset emails you didn’t request, login alerts from unfamiliar locations, “someone signed in from a new device” — treat these as urgent, not routine. Google’s Dark Web Report: Available to Google One subscribers. Monitors your Gmail address in breach data. Narrower than dedicated services but better than waiting. Your best protection is detecting breaches before you’re told about them. By the time the notification email arrives, attackers already had a 204-day head start. Frequently asked questions</h2> How long before I’m notified about a data breach? Often months. Companies take an average 204 days just to detect a breach (IBM), then weeks more to contain it and prepare notices. Some jurisdictions set no individual-notification deadline at all. Why does the law let companies wait so long? GDPR requires a 72-hour report to the regulator, but individual notice only “without undue delay,” with no hard deadline. US rules vary by state (30–90 days), and India has no enforced individual-notice duty yet. What can I do during the notification gap? Monitor Have I Been Pwned, treat unexpected password-reset emails as urgent, and check whether your details are already surfacing on people-search sites</a>. See our guide on how to check if your data was leaked</a>. Does deleting my account close the gap? No. Deletion stops future exposure but can’t recall data already sold. Change reused passwords and enable two-factor authentication on your key accounts instead. What you can do right now</h2> Want to see what data brokers expose about you? See what a scan finds →</a> shows an example report: the kinds of sites that list your name, phone, and address. Once KnytX Shield launches it will find and remove these automatically. Join the waitlist</a> to get in early. Identity Theft: How It Happens, From Breach to Fraud Unknown — Tue, 12 May 2026 00:00:00 +0000 In October 2020, BigBasket — India’s largest online grocery platform — suffered a breach that exposed 20 million user records. Names, email addresses, phone numbers, physical addresses, dates of birth, and hashed passwords. If you were a BigBasket user at the time, your data went somewhere you didn’t choose, with people you’ll never identify. Six months after a breach like that, across the world, someone opened a credit card in your name. A loan application followed. Then a mobile account. You found out fourteen months later when your credit score dropped forty points and a collections agency rang. What happened in between? That gap — from breach to fraud — is exactly what this post traces. Not abstract risk. The actual mechanics, stage by stage. The chain that starts with a breach you didn’t cause</h2> You made no mistake. You created a BigBasket account to order groceries. You trusted a company to protect your data. They failed — through a misconfigured database, an unpatched server, a compromised admin credential. The cause doesn’t matter to you. The outcome does. Your data moved through a predictable chain from the moment it left that server. First to private buyers. Then to secondary markets. Eventually into public combolists downloaded by thousands of automated tools running credential stuffing attacks, social engineering scripts, and fraud operations. The chain runs whether you know about it or not. Walking that chain backwards from the fraud to the breach requires understanding four stages: the sale, the enrichment, the targeting, and the attack. Most people never see any of them. Stage 1: The breach and the sale</h2> Breached data doesn’t sit idle. Within days — sometimes hours — of a successful attack, the data is packaged and sold. The first buyers are on private dark web forums: organized criminal groups, fraud-as-a-service operations, and financially motivated actors who pay a premium for fresh, exclusive data. A full KYC package bundles name, address, national ID number (SSN, Aadhaar, NI number), date of birth, and phone. It sells for $10 to $150, depending on the country, data completeness, and how recently it was breached. UK and US records command higher prices. Indian and Southeast Asian records sell at lower rates but in larger volume. As weeks pass and the breach ages, the data moves into secondary markets. Buyers who missed the initial sale pick it up cheaper. Then it degrades further into shared access: combolists distributed across Telegram channels, paste sites, and forum threads with millions of records available for free. Fresh breach data is dangerous because it hasn’t been used yet. Old breach data is dangerous because it has been cross-referenced, enriched, and compiled into something more complete than the original breach ever contained. Stage 2: Data enrichment</h2> No single breach contains everything an attacker needs. That’s where data brokers become the attacker’s infrastructure. Companies like Spokeo</a>, Whitepages</a>, FastPeopleSearch</a>, and their regional equivalents fill in the gaps. Your email address from the BigBasket breach. Your current address from a people-search site that aggregated it from public records. Your employer from LinkedIn. Your approximate income from property records. Your family members from social media. Within hours of targeted research, a criminal operation has a file on you that no single breach could have produced. This is why data brokers make breach data more dangerous. They are the enrichment layer. They exist to aggregate and sell personal profiles, and they don’t ask who’s buying. A name and email becomes a full identity file. A partial record becomes a complete one. The breach opened the door; the broker ecosystem built the house. The BigBasket breach included physical addresses. That alone — paired with a name and email from another source — is enough to pass identity verification at many financial institutions. Attackers know this. That’s why cross-referencing happens automatically, at scale, before any fraud attempt is made. Stage 3: The fraud types — what each data element enables</h2> Not all stolen data enables the same attack. Attackers select the fraud type based on what they have. Name + address + date of birth → This combination opens bank accounts, passes identity verification for credit applications, enables government benefit fraud, and allows package interception (redirecting deliveries to a different address after ordering with your account). It’s also the base layer for almost every other fraud type — everything else gets built on top of it. Email + password → Account takeover is immediate. Attackers run credential stuffing: your email and password pair tested against hundreds of sites automatically. Your email, your bank, your PayPal, your Amazon account. Password reset chains extend the damage — once inside your email, they can reset access to every account linked to that address. Linked financial accounts are the end goal. National ID (SSN, Aadhaar, NI number) → This is the highest-value single element in any breach. With a national ID, attackers apply for credit, file fraudulent tax returns, claim government benefits in your name, and obtain employment under your identity. The SSN in the United States, the Aadhaar number in India, and the National Insurance number in the United Kingdom each unlock separate categories of institutional fraud. Payment card data → Two attack vectors. Card-not-present fraud uses the card number, expiry, and CVV to make online purchases before the card is flagged. Card cloning writes the magnetic stripe data to a blank card for in-person use. Card data is the most time-sensitive: fraud windows close as banks detect anomalies. A stolen card number is often monetized within twenty-four hours. Medical records → Medical identity theft bills fraudulent procedures and prescriptions to your health insurance. The financial damage is significant. The physical danger is worse — your medical records now contain false information that doctors rely on in emergencies. Full KYC package (name + national ID + address + photo) → This enables everything above, plus SIM swap attacks</a>. In a SIM swap, an attacker convinces a carrier to transfer your phone number to a device they control. That intercepts every SMS-based authentication code for every account you own. A full KYC package is what makes SIM swaps possible at scale. Financial identity theft: the most common type</h2> Someone opens a credit card in your name. Then a personal loan. Then a store account. They max out the card and disappear. The accounts go to collections. You find out in one of a few ways. Your credit score drops unexpectedly. A collections agency contacts you for a debt you don’t recognize. Or you’re denied a loan for a car you planned to buy. The average victim doesn’t discover financial identity theft for approximately 6 months (Javelin Strategy & Research). By then, the fraudulent accounts have aged, the debt has compounded, and the collections entries are established. That’s a system failure. Credit bureaus process new account applications without confirming the applicant is who they claim to be. The burden of proof falls on the victim. You have to prove you didn’t open an account — not the other way around. Fraud alerts and credit freezes</a> exist precisely because the system defaults are broken. A freeze prevents new credit from being opened in your name entirely. It’s free in the US; the UK equivalent (CIFAS Protective Registration) costs £25 for two years. It should be the default. It isn’t. Tax fraud: the attack that surprises people</h2> The mechanism is simple: an attacker files a tax return in your name before you do. They claim a large refund. The refund goes to an account they control. When you file your legitimate return, it’s rejected — the government’s system flags it as a duplicate submission. The US IRS processes roughly 1 million fraudulent returns per year. India’s GST system faces parallel fraud involving fake invoicing and refund claims against real business registration numbers. The UK’s HMRC sees similar patterns with fraudulent self-assessment returns. The fix is equally simple: file early. Every year, file before attackers have a chance to file in your name first. In the United States, the IRS offers an Identity Protection PIN — a six-digit code that must accompany any return filed under your SSN. Anyone can apply for one now, not just prior victims. Get one. Medical identity theft: the dangerous one</h2> Medical identity theft doesn’t get the attention it deserves, because the fraud often stays hidden for years and the damage isn’t measured in dollars alone. Someone uses your health insurance details, such as your policy number, provider, and coverage tier. They bill for procedures they never received, prescriptions they fill and sell, and medical equipment they resell. Your insurance pays. You don’t notice until your benefits are exhausted or a provider flags an anomaly. The records problem is worse than the financial problem. Your medical file now contains procedures attributed to you that you never had. A blood type that isn’t yours. Medications listed as current prescriptions that you’re not taking. Allergies removed because the fraudster didn’t have them. In an emergency room, when a doctor checks your records and acts on that information, the consequences are direct and physical. This is the fraud type that doesn’t just cost money. It can hurt you in ways that have nothing to do with your bank balance. We cover it in depth in our medical identity theft guide</a>. Synthetic identity fraud</h2> Synthetic identity fraud sits at the intersection of real and fabricated data. An attacker takes your real national ID number — your SSN, your Aadhaar — and combines it with an invented name, a false address, and a fabricated date of birth. The result is a ghost identity that doesn’t correspond to any real person. The ghost builds credit over months. Small credit card, paid on time. Then a larger line of credit. Then a personal loan. Then the ghost disappears — a practice called “busting out” — taking every dollar of available credit with it. You never receive a collections notice because the fraud isn’t in your name. Your national ID was used, but your identity wasn’t assumed. The damage shows up differently: your ID number appears in contexts you don’t recognize, credit applications you didn’t make, and — eventually — on credit reports that share your number under a different name. For a full breakdown of how this works and how to detect it, see our guide to synthetic identity fraud</a>. The recovery timeline — what it actually takes</h2> The Identity Theft Resource Center puts the average identity theft resolution at 200 hours of effort over six months. That’s a conservative estimate for straightforward cases. Complex ones — involving multiple accounts, multiple fraud types, or attackers who established credit in your name years ago — take longer. The steps are: File a police report. Get a case number. You’ll need it.</li> File a report at IdentityTheft.gov (US) or your national equivalent. The FTC’s site generates a recovery plan and pre-filled letters for each institution.</li> Place a fraud alert or credit freeze with all three major credit bureaus (Equifax, Experian, TransUnion in the US; Equifax, Experian in the UK; CIBIL, Experian, Equifax, CRIF in India).</li> Contact every financial institution where fraud occurred. Dispute each account in writing. Keep records of everything.</li> If your national ID was compromised: contact the issuing agency directly. The IRS, Aadhaar’s UIDAI, or HMRC each have specific processes for compromised ID numbers.</li> </ol> Some cases require court orders to fully remove fraudulent records. Some take years. The institutions that created the problem — by extending credit without adequate verification — are rarely held accountable. The victim carries the administrative weight. For a step-by-step recovery checklist, see what to do after a data breach</a>. Warning signs you’ve been a victim</h2> Identity theft announces itself — but quietly, and not always in ways you’d immediately connect to a breach. Watch for these: Unexplained credit score drops of 20 points or more with no obvious cause</li> Unknown accounts appearing on your credit report</li> Bills or collection notices for purchases you didn’t make</li> Tax return rejected as a duplicate when you file</li> Medical claims on your insurance for procedures you didn’t have</li> Being denied credit unexpectedly despite a clean payment history</li> Hard inquiries on your credit report from lenders you never contacted</li> Calls from debt collectors about debts you don’t recognize</li> Missing expected mail — statements that stopped arriving (a sign someone changed your address)</li> </ul> Any one of these warrants a full credit report pull immediately. In the US, you’re entitled to one free report from each bureau per week at AnnualCreditReport.com. Don’t wait for an annual review. Check now. What you can do right now</h2> Want to see what data brokers expose about you? See what a scan finds →</a> shows an example report: the kinds of sites that list your name, phone, and address. Once KnytX Shield launches it will find and remove these automatically. Join the waitlist</a> to get in early. Synthetic Identity Fraud: Real ID, Fake Name Unknown — Mon, 11 May 2026 00:00:00 +0000 A bank processes a loan application from “Alex Chen.” Perfect credit history, 18 months of on-time payments, a modest starting limit that grew over time. The underwriter approves it. Alex Chen doesn’t exist. But the Social Security Number attached to that application belongs to a 7-year-old in Ohio. Her parents have never checked their child’s credit, and won’t until she tries to get a student loan at 18 and finds a decade of ghost debt waiting for her. That’s synthetic identity fraud: the fastest-growing financial crime in the United States, and one that most victims don’t know has happened to them until it’s too late to undo. It’s one branch of the wider problem we map in how identity theft happens</a>. The identity that doesn’t exist — but has a credit score</h2> Traditional identity theft is conceptually simple: someone uses your name and your Social Security Number to impersonate you. Your existing credit gets wrecked. You notice. Synthetic identity fraud is different. Attackers take only your SSN (or Aadhaar, or National Insurance number) and attach a completely fabricated name and address to it. No one named Alex Chen exists. There’s no real “Alex” whose credit report shows the damage. The fraud runs invisibly for months or years, because no living person’s credit file is being visibly damaged. Then an investigator traces the SSN and finds yours attached to a ghost’s entire financial history. Estimates for US synthetic identity fraud losses in 2024 exceed $20 billion. The Federal Reserve put the figure at $6 billion in 2016. Eight years of growth, fueled entirely by the steady supply of breached national ID numbers flooding dark web markets. The ingredients: what attackers need</h2> The construction is deceptively simple. Attackers need three things: A valid national ID number — SSN in the US, Aadhaar in India, NI number in the UK</li> A fabricated name that passes format checks</li> A fabricated address (sometimes real addresses, sometimes generated ones)</li> </ol> The national ID number is the only real element. Everything else is invented. And those ID numbers are everywhere. They come from data broker databases</a>, medical record breaches, HR system compromises, and dark web markets where bulk breach data sells for fractions of a cent per record. The name and address only need to be plausible. No one cross-references them against the SSN at the point of application — that verification gap is the entire attack surface. Building the ghost identity: the 12–24 month process</h2> This is not a smash-and-grab. Synthetic identity fraud is patient, methodical work. Step one: Apply for a secured credit card or credit-builder loan using the synthetic identity. It gets rejected — but that rejection creates a credit file. The SSN now has a record at the credit bureaus, even if it shows only a denial. Step two: Get added as an authorised user on a legitimate account (“piggybacking”). Someone with good credit adds the fake name to their card as an authorised user. The ghost inherits payment history. This is legal when real — it’s fraud when done deliberately to inflate a fabricated identity’s score. Step three: Apply for low-limit store cards. Pay on time for 6–12 months. Build the score. Step four: Apply for progressively higher limits as the credit history looks cleaner. At 12–18 months, the ghost has a respectable credit file. Step five — the bust-out: Max out every credit line simultaneously. Stop all payments. Disappear. The lenders are left holding the losses. The ghost identity is abandoned. The attacker moves on to the next SSN. This endpoint has a name in fraud circles: bust-out fraud. The 12–24 month buildup is not the crime — it’s the setup. The crime takes about 24 hours. Why children’s identities are prime targets</h2> Children don’t use credit. A 7-year-old’s SSN has no credit history, no existing accounts to flag as suspicious, no adult checking the mail for odd statements. That clean slate is ideal for synthetic identity construction — there’s no existing credit profile to contaminate. Parents almost never check their children’s credit. There’s no reason to, in normal circumstances. So the fraud runs undetected for years. Sometimes it isn’t discovered until the child applies for student loans or a first credit card and finds a credit file full of accounts they never opened. The attack on children’s SSNs is not speculative. The Social Security Administration issues SSNs to infants at birth, and breaches of hospital systems, school records, and government databases regularly expose them. Children’s identity records sell at a premium on dark web markets precisely because they’re clean and unmonitored. Place a credit freeze on your child’s SSN now. It costs nothing and prevents any credit file from being opened in their name. It’s the single most effective protection available, and you can lift it when they need credit. Our credit freeze vs fraud alert guide</a> walks through the steps. How this differs from traditional identity theft</h2> The critical distinction: synthetic identity fraud doesn’t immediately damage your existing credit report. When someone uses your name and SSN to open fraudulent accounts, those accounts appear on your credit report under your name. You get alerts. The damage is visible. Synthetic fraud attaches a different name to your SSN. Those accounts don’t appear on your credit report — they appear on the ghost’s credit file, which is indexed under a name you’ve never heard. Most credit monitoring services monitor by name. They don’t catch it because they’re not looking for your SSN attached to someone else’s name. Detection requires SSN-level monitoring: scanning for any credit activity associated with your SSN regardless of the name on the account. Most consumers never do this. Most credit monitoring products don’t offer it as a default. How to protect yourself</h2> In the US: Pull your credit reports at annualcreditreport.com — all three bureaus, free. Look for accounts you don’t recognise, even under names you’ve never heard. If you see unfamiliar activity, request your full credit report by SSN from each bureau and scrutinise everything. Then place a credit freeze at all three bureaus (Equifax, Experian, TransUnion). It’s free, reversible, and prevents new accounts from being opened. For your children: Freeze their credit at all three bureaus now. The process requires mailing documentation to each bureau, but it’s worth every minute. Keep the PINs somewhere safe. In India: Aadhaar-based synthetic fraud targets mobile account registration and UPI-linked financial accounts. Fabricated KYC documents paired with a real Aadhaar number open SIM cards used for OTP interception</a> and payment fraud. Check your Aadhaar authentication history at uidai.gov.in under “Aadhaar Authentication History.” Any authentication you didn’t initiate is a red flag. Lock your Aadhaar biometric at the same portal. In the UK: Check your credit file at any of the three UK bureaus (Equifax, Experian, TransUnion). If you see accounts linked to your NI number under a name you don’t recognise, contact the bureau’s fraud team immediately. The common thread: monitor by national ID number, not just by name. And freeze what you’re not using. What you can do right now</h2> Want to see what data brokers expose about you? See what a scan finds →</a> shows an example report: the kinds of sites that list your name, phone, and address. Once KnytX Shield launches it will find and remove these automatically. Join the waitlist</a> to get in early. What Happens to Your Data on the Dark Web Unknown — Sat, 09 May 2026 00:00:00 +0000 The BigBasket breach happened in October 2020. Twenty million user records — names, email addresses, dates of birth, locations, hashed passwords — were exfiltrated from the grocery platform’s database. Within 72 hours, those records were listed for sale on a dark web forum for $40,000. By the end of that week, they had a buyer. Most BigBasket users found out months later, when it made the news. Their data had already moved three times. This is what actually happens after a breach. Not the press release, not the “we take your security seriously” email. The actual path your data takes, step by step. The short answer: After a breach, your data enters a dark web market within 24 to 72 hours. It’s sold, resold, and enriched by combining it with other breaches, people-search sites, and social profiles. Prices range from cents for an email:password pair to $1,000 for medical records. Criminals use it for credential stuffing, targeted phishing, account takeover, and new-account fraud. Crucially, stolen data never expires while the password still works, so old breaches keep causing damage. Change reused passwords and enable app-based two-factor authentication. What happens in the first 24 hours after a breach?</h2> Breach data moves fast. In most cases, exfiltrated records appear on dark web forums within 24 to 72 hours of being stolen — sometimes faster if the attacker has existing relationships with buyers. The attacker has two options. The first is an exclusive first sale: list the data on a private, invitation-only forum at a premium. It goes to the highest bidder, usually criminal groups who want fresh, unworked credentials nobody else has tried yet. The second option is to use the data themselves first. They run credential stuffing against every major platform, drain whatever they can, then sell the residual dataset. Either way, your data has entered a market within days of the breach. The company whose database was hit often doesn’t know yet. The dark web market structure</h2> There isn’t one dark web. There’s an ecosystem — layered by access level, trust, and data freshness. Private forums sit at the top: invitation-only, high trust, high prices. BreachForums was the largest English-language breach forum until its administrator was arrested and the FBI seized the site in 2023. Its successors (and there are several — this market is resilient) operate the same way. Fresh data — records from breaches in the past thirty days — commands the highest prices here. Public marketplaces are a tier below. Broader access, older data, lower prices. Think of it as the secondary market for breach records that have already been sold once at full price. Telegram channels have grown significantly since the BreachForums takedowns — faster to set up, harder to trace, with no hosting infrastructure to seize. A lot of mid-tier breach trading now happens across private Telegram groups. Paste sites (Pastebin and its successors) are free data dumps — usually aged, often partial. If your data ends up here, it’s been through multiple owners already. What does your data sell for?</h2> Prices vary by freshness, jurisdiction, and what the record contains. A bare email and password combination sells for $0.05 to $2.00. A dump of 20 million records at $0.10 each is $2 million — volume compensates for the low per-record price. Name, address, and date of birth runs $0.50 to $5.00. Add a Social Security Number and that jumps to $10 to $150 depending on credit history indicators. Financial account credentials — online banking login with verified balance — sell for $20 to $200. An account holding $50,000 sells for more than one with $500. Full KYC packages (identity document scan, selfie, name, address, date of birth) sell for $50 to $300. They’re ready to use for opening fraudulent bank or crypto accounts. Indian Aadhaar-plus-PAN packages trade at the lower end globally due to volume, but verified selfie matches command a premium. Medical records fetch $250 to $1,000 each — rarest and most valuable, usable for insurance fraud, prescription fraud, and blackmail. How does enrichment combine your data?</h2> Here’s what most people don’t account for: buyers don’t use breach data in isolation. After purchasing your record from the BigBasket breach (your name, email, hashed password), a sophisticated buyer runs enrichment. They cross-reference your email against other breach databases and look you up on people-search sites</a> to append your home address and phone number. They also check LinkedIn for your employer and add your bank if a financial breach exposed it. Your email address from BigBasket was worth $0.10. Now add your home address, employer, bank, and a working password from a 2019 breach you’d forgotten about. That profile is worth $50, and it took the buyer fifteen minutes to build. Your 2020 BigBasket record gets enriched with your 2020 Drizly record and your 2023 MOVEit record. Each addition increases the profile’s criminal utility. The breaches compound. The criminal uses — roughly in order of immediacy</h2> Credential stuffing runs within hours of a fresh dump going public. Automated tools test leaked username-and-password pairs against Gmail, banking apps, Amazon, PayPal — anything high-value. People reuse passwords. One operator can test millions of pairs across dozens of platforms in an afternoon. Targeted phishing follows for records where the password didn’t work. Your name, email, and personal details become raw material for spear phishing emails that know your real bank and employer. The enrichment step is what makes these convincing. Account takeover targets email first — it resets every other password. Once an attacker has your inbox, they’re into your banking, investment accounts, and crypto exchange. SMS two-factor authentication doesn’t help if they also execute a SIM swap using identity data from the same breach. New account fraud uses KYC packages to open bank accounts and credit cards in your name, for money laundering or credit fraud. You find out when a collections agency calls. Then — months or years later — your record surfaces in a new combolist and the cycle runs again. Why do old breaches keep causing damage?</h2> This is the part that’s genuinely underappreciated: stolen data doesn’t depreciate the same way stolen goods do. A stolen car gets used once and then it’s traceable. Stolen data gets copied, sold, resold, enriched, and put back into circulation indefinitely. The 2012 LinkedIn breach — 117 million records — was still appearing in new credential-stuffing attacks in 2020. An eight-year-old database, still causing active account takeovers. Why? Because most people never changed the passwords exposed in that 2012 breach. The credentials stayed valid. Stolen data never expires if the victim doesn’t act. Your 2016 email-and-password combination is still live credentials if you’re still using that password. This is the specific reason checking Have I Been Pwned for old breaches matters — not just recent ones. A breach you forgot about five years ago, where you never changed your password, is still an active attack vector right now. That same password, if you reused it anywhere, unlocks every account where you did. The data doesn’t age out. It waits. Frequently asked questions</h2> How fast does breached data reach the dark web? Usually within 24 to 72 hours of being stolen, sometimes faster if the attacker already has buyers. By the time you get a notification, your data has often moved through several hands. What does stolen data sell for? From $0.05–$2 for an email:password pair, to $10–$150 for an identity with a Social Security Number, to $250–$1,000 for medical records. Fresh data commands the highest prices. Why do old breaches still cause harm? Because stolen data doesn’t expire while the password still works. The 2012 LinkedIn breach was still fuelling account takeovers in 2020. Any reused, unchanged password remains a live attack vector. How do I protect myself? Use a unique password on every account, enable app-based two-factor authentication, and check Have I Been Pwned for old breaches too. Removing yourself from people-search sites</a> breaks the enrichment step attackers rely on. What you can do right now</h2> Want to see what data brokers expose about you? See what a scan finds →</a> shows an example report: the kinds of sites that list your name, phone, and address. Once KnytX Shield launches it will find and remove these automatically. Join the waitlist</a> to get in early. Spear Phishing: When Attackers Already Know You Unknown — Fri, 08 May 2026 00:00:00 +0000 The email arrives at 11:43 AM on a Tuesday. It’s addressed to you by your full name — not “Dear Customer,” your actual name. It’s from HDFC Bank. It mentions your Savings Account, references a transaction of ₹14,200 processed two days ago, and says there’s an unusual login attempt from Mumbai. Your home city, listed in the sender’s support signature, matches the city you actually live in. It asks you to verify your account by clicking a link. The link looks right. The logo looks right. Everything looks right. Most people click. The short answer. Spear phishing is a targeted phishing attack built from real details about you: your name, your bank, your last transaction, your city. Attackers assemble those details from data breaches, people-search sites, and LinkedIn, often in under thirty minutes. The details make the message feel legitimate, but they don’t make it real. The defense doesn’t depend on spotting the fake: check the raw sender address, hover over links before clicking, and call the organization back on a number you find yourself, never a number in the email. Treat any urgent “verify within 24 hours” demand as a red flag. The email that knew too much</h2> Here’s what that email actually is: a spear phishing attack, built from at least four separate data sources, assembled specifically about you before the attacker ever hit send. Generic phishing — “Your account has been suspended, click here” — is easy to ignore. You get ten of those a week and you’ve learned to delete them without thinking. Spear phishing is categorically different. It targets a specific individual using real personal information pulled from data breaches, public profiles, and people-search sites. According to Symantec Internet Security Threat Reports from 2012–2015, spear phishing accounted for 65% of targeted attacks. That figure predates major industry shifts, and more recent data from threat intelligence providers may differ. The FBI’s Internet Crime Complaint Center reported average business email compromise losses of $125,000 per incident in 2023. The reason the numbers are that bad is simple: the attacks work. Where they got every detail</h2> Walk back through that example email and trace each piece of information. Your full name came from a breach database — your email was exposed in a breach (check haveibeenpwned.com), and that record included your name alongside it. The 2021 LinkedIn scrape exposed 700 million records. The 2020 Juspay breach exposed approximately 100 million records (including masked card data, email addresses, and phone numbers). Your bank name — HDFC, Barclays, Chase — came from a financial data breach, a loyalty program that sold spending-category data to third parties, or simple inference (if 40% of your city banks with HDFC, the attacker guesses HDFC and is right often enough). The transaction amount is the detail that unnerves people most. Some financial breaches include partial transaction history. Others don’t — but a confident approximation triggers the same response as an exact match. You remember spending roughly that amount and your brain fills the gap. Your home address is on a data broker site right now, probably several of them. Whitepages</a>, Spokeo</a>, TruePeople Search, and Indian equivalents like TrueCaller’s directory all aggregate public records and sell or display personal addresses. Your employer is on LinkedIn. A convincing spear phish typically references three to five real personal details. Assembling five data points takes an attacker under thirty minutes with the right tools. The enrichment step</h2> Attackers don’t stop at a single breach. The real craft — and this is worth understanding — is data enrichment: cross-referencing multiple sources to build a profile richer than any individual source could provide. Your email address from one breach gets your home address appended from a people-search site. Your employer from LinkedIn. Your approximate bank from a financial data leak. Then free OSINT tools like Maltego and theHarvester automate the aggregation, pulling together everything that’s publicly or semi-publicly available about you in one structured profile. The result isn’t just your name and email. It’s a dossier. And it costs the attacker nothing but time. What makes spear phishing so effective</h2> There’s a specific cognitive mechanism that spear phishing exploits, and once you understand it, you’ll see it in every successful attack. Security researchers call it the authority-plus-familiarity override. When an email invokes a familiar institution (your actual bank) and includes details that feel personally known (your name, your transaction), your brain’s pattern-matching engine fires before your conscious evaluation starts. It reads “legitimate” before you’ve checked anything. Generic phishing triggers neither authority nor familiarity, so your skepticism has room to engage. Spear phishing collapses that room. Urgency compounds the problem. “Unusual login detected — verify within 24 hours or your account will be locked.” Urgency is a manipulation tactic, not a business practice — no legitimate bank sends you a 24-hour ultimatum before locking your account. But when authority, familiarity, and urgency hit simultaneously, the override is powerful enough to work on people who know better. How to spot it even when it knows your details</h2> The good news: even a technically convincing spear phish leaves tells. You just have to know where to look. Check the actual sender address, not the display name but the raw address. The display name can be set to anything: “HDFC Bank Security Team,” “Amazon Customer Service.” The actual email address is harder to fake convincingly. Look for it: hdfcbank-security@hdfc-verify-account.net</code> is not HDFC Bank. Hover over every link before clicking. The destination URL will appear in your browser’s status bar or as a tooltip. https://secure-hdfc-login.pages.dev</code> is not hdfc.com. Call the organisation directly on a number you find yourself. Use the back of your card, or the official website reached by typing the URL yourself. Not a number from the email. This single step would stop the vast majority of spear phishing attacks cold. Notice the request pattern. Banks don’t ask for OTPs over email. No legitimate service asks you to “verify” by entering your full password. Any email asking you to bypass your normal login process is suspect by design. And again: urgency is the tell. Legitimate organisations give you time. Attackers create artificial time pressure because it works. The moment you feel rushed, slow down. Vishing: the call-based version</h2> The same attack runs over phone calls. You get a call from someone who knows your name, knows you bank with HDFC (or Barclays, or Chase), and can quote your last transaction amount back to you. They’re calling to help you stop the fraudulent activity on your account. They just need to verify your identity, starting with your OTP. This is vishing — voice phishing — and the enrichment process behind it is identical to the email version. The caller built the same dossier using the same data sources. The call just adds a voice and real-time social pressure that email can’t replicate. The defence is the same: hang up and call back on the official number. Not the number the caller gives you — the number on the back of your card or the bank’s official website. If the situation was real, the bank will tell you. If it was a vishing attack, hanging up ended it. What you can do right now</h2> Want to see what data brokers expose about you? See what a scan finds →</a> shows an example report: the kinds of sites that list your name, phone, and address. Once KnytX Shield launches it will find and remove these automatically. Join the waitlist</a> to get in early. Credential Stuffing: One Leak Opens Every Account Unknown — Thu, 07 May 2026 00:00:00 +0000 His Gmail account was hijacked on a Tuesday morning. He logged in to find his inbox wiped, his recovery phone number changed, and a forwarding rule set up to a stranger’s address. The attacker had been reading his email for eleven days before making a move. Here’s the part that didn’t make sense to him: he hadn’t been on the breached site. He’d signed up for a fitness app three years earlier, used it twice, and forgot it existed. That app got breached. His email and password leaked. He never got a notification. And his Gmail password was the same one. This is credential stuffing: attackers take leaked email and password pairs and test them automatically, at scale, against every high-value site they can target. They don’t care which site leaked your credentials. They care only whether you reused the same password somewhere that matters. You weren’t on that hacked site. Your account still got broken into.</h2> Most people reason about breach risk the wrong way. They think: “I wasn’t on that breached platform, so I’m safe.” This is understandable, but wrong. The attack isn’t targeted at the breached company’s users specifically. It uses the credentials from that breach as raw material and fires them at entirely different sites. Your email and password from a 2021 forum breach get tested against Gmail, Amazon, your bank, your PayPal, your airline account. If the password matches anywhere, the attacker is in. The credential stuffing attack is why changing the password on the breached site is not enough. Every account using that password is now compromised — whether you remember having those accounts or not. What a combolist is</h2> When a company is breached, attackers steal the database. That database contains user records: email addresses paired with passwords. If the company hashed passwords weakly (using MD5 or SHA-1 without salting), attackers crack them quickly using precomputed tables. If the company stored passwords in plaintext — and many still do — the pairs are ready to use immediately. These stolen pairs get sold or posted on dark web forums. Over time, multiple breach databases get combined, cleaned of duplicates, and formatted into a single massive file. That file is a combolist — a structured list of email:password pairs ready to be tested at scale. The RockYou2024 combolist, published in 2024, contained nearly 10 billion credential pairs compiled from thousands of historical breaches. That’s not 10 billion accounts from one company. It’s a decade of breach data aggregated into a single file available to anyone who knows where to look. Attackers don’t sit there typing credentials manually. They run software. Thousands of pairs per second, across hundreds of target sites, running overnight while they sleep. How the attack runs</h2> The tooling behind credential stuffing is freely available and requires minimal technical skill. OpenBullet and SilverBullet are open-source platforms that automate the entire process. Sentry MBA is a proprietary crimeware tool, sold privately in underground markets. Here’s how an attack runs: an attacker downloads a combolist and a “config” file for the target site — say, Amazon. The config tells the tool exactly how Amazon’s login form works: which fields to fill, how to parse the response to determine success or failure, and how to handle multi-step authentication prompts. These configs are shared freely in attacker communities. There are thousands of them. The tool rotates through residential proxy networks to distribute login attempts across thousands of different addresses. These are IP addresses belonging to ordinary home routers that have been compromised or rented. To Amazon’s servers, the login attempts look like they’re coming from thousands of different users in different countries. Success rates on credential stuffing runs are typically 0.1–2% of pairs tested. That sounds small. On 10 billion records, that’s between 10 million and 200 million valid account logins — across whatever sites the attacker is targeting. Even the lower end of that range is an extraordinary return on automated effort. Which accounts they target first</h2> Attackers aren’t running stuffing attacks randomly. They prioritise by what an account is worth on the open market — or what it lets them access. Email accounts come first. Your Gmail, Outlook, or Yahoo account is the master key. It receives password reset emails. Whoever controls your email can reset every other account attached to it. An email account with years of archived messages is also a goldmine for personal information: bank statements, address history, legal documents, private communications. Financial services come second. Banking apps, PayPal, Venmo, Cash App, and crypto exchanges all let attackers move money directly. A validated bank login with an accessible balance is worth significantly more than a streaming account. E-commerce accounts with stored payment methods — Amazon, eBay, Etsy shop accounts — let attackers make purchases and redirect them to a drop address. Your saved card is charged; you see the transaction days later. Loyalty programme accounts are underestimated. Frequent flyer miles, hotel points, and retailer rewards can all be converted to cash. A high-balance airline miles account sells for real money — attackers transfer the points to their own account or sell the account credentials directly. These takeovers often go undetected for months because victims rarely check loyalty balances. Streaming accounts (Netflix, Spotify, Disney+, Hulu) are the lowest tier. They sell for $1–3 on dark web marketplaces. The margin is thin, but the volume is high — millions of valid streaming credentials circulate constantly. Why CAPTCHA and rate limiting don’t stop it</h2> Sites know credential stuffing exists. They deploy defences: CAPTCHAs, rate limiting, anomaly detection. These help. They don’t stop determined attackers. Rate limiting restricts how many login attempts a single IP address can make. Residential proxy networks sidestep this by distributing attempts across thousands of addresses — no single IP exceeds the limit. CAPTCHAs are solved two ways: automated vision models (increasingly capable) and CAPTCHA-solving services that route puzzles to human solvers in real time. Those services charge $0.50–$2 per 1,000 solves. At that price, CAPTCHAs are a minor operating cost, not a barrier. Anomaly detection can flag unusual login patterns — logins from new countries, multiple failures before success, device fingerprint mismatches. Better platforms do this well. But attackers pace their attempts and rotate devices precisely to stay inside detection thresholds. Two-factor authentication is the only control that actually stops a credential stuffing attack. A valid email:password pair is not enough to get in if the account requires a code from your phone or authenticator app. The attacker has your password. They don’t have your device. The detection problem for victims</h2> You often don’t know your account has been accessed. Skilled attackers log in quietly, assess what’s in the account, and either use it immediately or sell the validated credentials. They don’t trigger obvious alarms. They don’t blast out phishing emails from your account immediately — that would get noticed. They wait, or they sell the access to someone else. Many account takeovers sit undetected for weeks or months. The signs to look for: password reset emails you didn’t request; login notifications from unfamiliar cities or countries; being unexpectedly locked out of an account you haven’t used recently; small unfamiliar charges on payment methods linked to e-commerce accounts; and loyalty balances that are lower than you remember. You’re unlikely to notice any of these unless you’re already looking. Real scale: how many accounts are compromised this way</h2> This isn’t a niche attack affecting a small population. It’s the dominant method for monetising breach data at scale. Akamai, which monitors login traffic across a large portion of the internet’s infrastructure, recorded 193 billion credential stuffing attacks in 2020 alone. Not attempts per user — 193 billion individual automated login requests across the sites they monitor. The numbers have grown since. Credential stuffing remains one of the most prevalent automated attack vectors against financial accounts — because it’s automated, cheap, and the raw material (combolists) is abundant and free. Every major breach feeds the next wave of stuffing attacks. The breach doesn’t have to be recent. RockYou2024 contains credentials from breaches going back over a decade. Your password from a 2017 breach is still being tested against your current accounts today. The breach-to-stuffing timeline</h2> The window between when your credentials are stolen and when you find out is much longer than most people assume. A company gets breached. The attacker either sells the data exclusively to a small group of buyers first, or posts it immediately on a dark web forum depending on their motivation. Within days to weeks, combolists incorporating the new data start circulating. Automated stuffing runs targeting high-value sites begin within weeks of a significant breach. Meanwhile, the breached company may not know it’s been breached. Discovery takes time. Forensics takes time. Regulatory notification timelines allow additional weeks or months before affected users hear anything. IBM’s Cost of a Data Breach Report puts the mean time to identify a breach at 197 days — that’s just how long it takes the company to discover it happened. Individual notification often takes months longer. You are exposed for six months before you have any chance to act. Attackers have the data immediately. The complete defence</h2> These are ordered by impact. Do them in this order. Use a unique password for every account. This is the only thing that completely eliminates credential stuffing risk. If each account has its own password, a breach at one site exposes exactly one site — nothing else. A password manager (see how to choose and use one</a>) generates and stores unique passwords automatically. You remember one master password; it handles the rest. </li> Enable two-factor authentication</a> on every account that offers it. Start with your email accounts, because that’s the master key. Add it to your bank, your PayPal, your Amazon, your Apple ID, and your Google account. An authenticator app (Google Authenticator, Authy, Aegis) is significantly stronger than SMS-based codes, which are vulnerable to SIM swap attacks</a>. 2FA means a valid password is not enough to get in. </li> Monitor for breach exposure. Sign up for notifications at Have I Been Pwned (haveibeenpwned.com) for every email address you use. You’ll get an alert when any database containing your email appears in a new breach. See also: how to check if your data has leaked</a>. </li> Check Have I Been Pwned right now. Go to haveibeenpwned.com, enter your email addresses — including old ones you haven’t used in years. If any appear in known breaches, treat every account using passwords from that period as potentially compromised and change them. </li> Review active sessions on your major accounts. Gmail, Facebook, Apple ID, and Google all show you every device and location where your account is currently logged in. Go check. If you see a session from a city you’ve never been in, or a device you don’t recognise, revoke it immediately. </li> Separate your email addresses by account tier. Use a dedicated email address for financial accounts and anything sensitive — don’t use it for website signups, newsletters, or services you don’t fully trust. If your signup email appears in a breach, your banking email remains clean. </li> </ol> None of these are difficult. The password manager takes an afternoon to set up. 2FA takes five minutes per account. These two changes alone — unique passwords and 2FA — make credential stuffing attacks against your accounts functionally impossible. What you can do right now</h2> Want to see what data brokers expose about you? See what a scan finds →</a> shows an example report: the kinds of sites that list your name, phone, and address. Once KnytX Shield launches it will find and remove these automatically. Join the waitlist</a> to get in early. How to Leave Gmail: Privacy Email Alternatives Unknown — Wed, 06 May 2026 00:00:00 +0000 The short answer: You don’t have to leave Gmail to cut your exposure, but you can. The first step, whether you migrate or not, is to revoke third-party apps that can read your inbox. If you do leave, the strongest privacy options are Proton Mail and Tuta (both end-to-end encrypted), with Fastmail and iCloud Mail as solid non-encrypted alternatives. Move in stages over three to six months, starting with your highest-priority accounts, so you don’t give up and go back. What Google does with your email</h2> Go to myaccount.google.com > Security > Third-party apps with account access. Look at the list. There are probably apps you forgot existed. A travel booking tool from 2019. A productivity app you tried for a week. A newsletter tool that a job you left three years ago set up on your behalf. Some of these apps have full read access to your Gmail inbox. Not just metadata. Every email, including private messages from your bank, your doctor, and your family. Google stopped scanning Gmail content directly for ad targeting in 2017. What it didn’t stop is processing your email content for server-side features. That covers Smart Compose, Smart Reply, automatic message categorization, and nudges (“You haven’t replied to this email from last week”). That processing happens on Google’s infrastructure. Your email content is analyzed to generate those responses — even if the output is just a suggested three-word reply. Then there’s the government request problem. Google receives tens of thousands of government data requests per year and publishes the numbers in its Transparency Report. In the second half of 2023 alone, Google received tens of thousands of requests from US authorities. It complied with data production in a majority of cases. Your Gmail inbox — every email you’ve ever sent or received — sits on Google’s servers, fully accessible to those responses. None of this means Google is doing something uniquely sinister. It means Gmail is a cloud email service operated by an advertising company, and you should understand what that means before deciding whether to stay. Review your connected apps first</h2> Before you migrate anything, clean up what’s already there. Go to myaccount.google.com > Security > Third-party apps with account access. Review every entry. Ask: do I still use this? Is there any reason this app needs full email read access? If the answer to either question is no, click it and select Remove Access. This is the minimum step — even if you never leave Gmail. Third-party apps with inbox access are a significant privacy and security exposure point. Apps get sold to new owners with different privacy policies. Apps get breached. Apps that were “helpful tools” in 2020 may now be operated by data brokers. Do this today. It takes ten minutes and requires nothing else to change. The email alternatives, honestly assessed</h2> You have five real options. Here’s what each one actually offers and where it falls short. ProtonMail (now rebranded as Proton Mail) is the recommendation for maximum email privacy. It’s based in Switzerland, operates under Swiss law — which has strong privacy protections and no mandatory data retention requirements — and uses end-to-end encryption (E2E) by default. Proton can’t read your email. If served with a government request, they can hand over metadata (account creation date, IP addresses if logging is enabled) but not the content of your messages. The limitation you need to understand: E2E encryption only works email-to-email within ProtonMail. When you email someone on Gmail, that message is encrypted in transit to Proton’s servers, but it’s sent unencrypted to Gmail — because Gmail doesn’t support the same encryption standard. Proton can’t change this; it’s a fundamental constraint of how email works. Free tier is available. Custom domain starts at $4/month. Tutanota (now Tuta) is the German alternative. German law and GDPR apply. It’s end-to-end encrypted, fully open source (you can audit the code), and has a free tier. Custom domain from €3/month. Feature set is slightly more limited than ProtonMail — no calendar import from external calendars, fewer third-party integrations — but for straightforward email use, it’s excellent. Same E2E limitation applies: emails to Gmail addresses aren’t end-to-end encrypted on the recipient’s side. Fastmail is the right choice if you want solid privacy without the trade-offs of E2E encryption. Based in Australia, subject to Australian law (which includes some government access provisions), but Fastmail has a strong track record of transparency. It’s not end-to-end encrypted — Fastmail can technically read your email — but it has no advertising business, no data broker relationships, and has repeatedly pushed back on overreaching requests. The UX is excellent: fast, feature-complete, good custom domain support from $5/month. Best for people who want to leave Gmail for a better-run email service without dramatically changing how email works for them. Apple iCloud Mail works well if you’re already in the Apple ecosystem. Apple’s Private Relay hides your IP address and Apple has made high-profile stands against government access to user data. iCloud Mail isn’t end-to-end encrypted — but Apple has no advertising business and no incentive to analyze your email content. Limitation: you’re tied to Apple’s ecosystem. $1/month for 50GB of iCloud storage includes Mail. The migration strategy that actually works</h2> Don’t try to move everything at once. That’s how people give up and go back to Gmail. Step 1: Create your new address and set up a custom domain if you’re using one. Don’t touch Gmail yet. Step 2: Update high-priority accounts first — banking, health services, your password manager, government accounts. Do these before anything else. Step 3: Set a Gmail auto-reply pointing to your new address. Most people won’t read it, but some will. Step 4: Over 3–6 months, update everything else as you naturally interact with services. Thirty seconds per login is enough. Step 5: Archive Gmail. Keep the account open — too many things still point to it — but stop using it as your primary address. Check it weekly for stragglers. Migration takes six months before it feels complete. That’s normal. Your old address is in hundreds of contact books and mailing lists. This is a slow handoff, not a single event. If you’re not ready to leave yet</h2> Three things you can do today without migrating: Revoke third-party app access (already covered — do this regardless). Go to Gmail Settings > General and turn off both Smart Compose and Smart Reply — neither feature is worth the content analysis trade-off. In your Google Account, turn off “Web & App Activity” personalization or set auto-delete to 3 months. Use Gmail through Firefox with uBlock Origin rather than Chrome. And going forward: when any app asks to “connect with Gmail,” say no. Revoke access, stop granting it, and your inbox stops being a shared resource. What you can do right now</h2> Want to see what data brokers expose about you? See what a scan finds →</a> shows an example report: the kinds of sites that list your name, phone, and address. Once KnytX Shield launches it will find and remove these automatically. Join the waitlist</a> to get in early. Children's Online Privacy: Your Rights as a Parent Unknown — Tue, 05 May 2026 00:00:00 +0000 What is your child’s app actually collecting?</h2> Pick any popular free children’s game from the app store. Before your child plays a single level, the app has requested access to location, microphone, contacts, advertising ID, and device storage. Most parents tap “Allow” on each prompt without reading what it’s for, because the alternative is listening to a seven-year-old complain for twenty minutes. Here’s what those permissions are used for: location feeds ad targeting networks with your home address and daily movement pattern. Microphone access, in the worst cases, allows ambient audio collection — documented in several children’s apps before regulatory action. Contacts are harvested to build a social graph used for cross-app targeting. The advertising ID links your child’s in-app behavior to a persistent profile that follows them across every other app on the device. Children can’t meaningfully consent to this. Most adults don’t realize they’re consenting to it either. The laws that are supposed to protect your child</h2> Three legal frameworks cover children’s data, depending on where you live. COPPA (Children’s Online Privacy Protection Act) applies to US-based services accessed by children under 13. It requires verifiable parental consent before collecting personal data — not just a checkbox, but actual verification. In theory, this means children’s apps can’t collect data until a parent has explicitly approved it. In practice, enforcement has been uneven. The clearest enforcement example: in 2019, the FTC fined YouTube $170 million for COPPA violations. YouTube had allowed child-directed content channels to collect behavioral data on child viewers and target them with ads — while claiming it couldn’t determine user age. The fine was historic; it still didn’t stop the broader problem. GDPR Article 8 (EU) sets the consent age at 16, though member states can lower it to 13. Services operating in the EU must verify users’ ages and get parental consent for anyone below the threshold. In 2023, the Irish Data Protection Commission fined TikTok €345 million for processing children’s data without proper consent. The findings included making children’s accounts public by default and using dark patterns to push under-age users toward sharing more data. India’s DPDPA defines children as anyone under 18, a stricter threshold than either US or EU law. The Digital Personal Data Protection Act requires verifiable parental consent before processing any data about a minor. Its rules were notified in late 2025, and enforcement is phasing in through 2027. Once fully in force, this will cover a significant share of the global children’s app market. All three laws say roughly the same thing: get meaningful parental consent before collecting children’s data. None of them have fully solved the problem, because enforcement is reactive and many apps simply don’t comply until they’re caught. Which platforms have the worst track records</h2> TikTok has been fined for children’s data violations in the EU (€345 million, 2023) and faces a US FTC complaint filed in August 2024 alleging COPPA violations. Its default settings have repeatedly made children’s accounts public, recommended their videos to strangers, and used algorithmic nudges to maximize engagement time. Some of those users may be as young as 10. YouTube collected behavioral data on child viewers at scale for years before the COPPA enforcement action. YouTube Kids exists as a separate app with different data practices, but many children access the main YouTube platform regardless. Educational apps sold to schools are a frequently overlooked category. Schools often receive free or discounted EdTech tools in exchange for student data. The app’s privacy policy typically allows data sharing with “research partners” or “service providers” — language that can encompass advertising networks. Google Classroom, Clever, and similar platforms handle enormous amounts of child data with comparatively little scrutiny. Free gaming apps are the most consistent offenders. Any app supported by advertising is, by definition, collecting and sharing behavioral data. The business model requires it. If you’re not paying for the app, the data is the product — and in children’s apps, that data is your child’s. Practical protections for parents</h2> Start with permissions. On iOS, go to Settings > Privacy & Security and review location, microphone, and contacts access for every app your child uses. On Android, go to Settings > Apps, select the app, and review Permissions. Revoke anything that isn’t necessary for the app’s core function. A game does not need microphone access. Before installing any new app, search its name plus “privacy policy.” Look for the words “advertising,” “third party,” and “behavioral.” If those words appear without clear limitations, treat it as a red flag. Screen Time (iOS) and Family Link (Android) let you approve app installations before they happen. Use them. They’re not perfect — they don’t audit what approved apps do with data — but they stop your child from installing an unknown app at midnight. Put children’s devices on a separate Wi-Fi network, the same as you’d do with smart home devices. This limits the apps’ ability to interact with other devices on your home network. Prefer apps from reputable educational publishers over free, ad-supported alternatives when possible. Apps from Scholastic, Khan Academy, and similar organizations have more accountability and clearer privacy practices than anonymous app store entries. Paid apps have less incentive to monetize data. Your rights as a parent</h2> These rights exist under law — you just have to use them. Under COPPA, you can request that a service disclose exactly what personal data has been collected from your child, and you can demand deletion of that data. Contact the app or service directly via their privacy policy contact information. They are legally required to respond and comply. Under GDPR (if you’re in the EU), you can exercise your child’s rights on their behalf: access, erasure, restriction of processing, and portability. You don’t need a lawyer. Send a written request — email is sufficient — to the service’s Data Protection Officer. They have 30 days to respond. Under India’s DPDPA, parents can exercise data rights on behalf of children under 18: access to what data is held, correction, and erasure. The DPDP Rules were notified in November 2025, and the Data Protection Board has been formally established. But its full powers and the main compliance duties phase in through 2027, so the request machinery is still settling. The rights exist in statute now. Document your requests. If a company ignores a deletion request, that is itself a regulatory violation. You can report it to the FTC (US), your national data protection authority (EU), or the Data Protection Board of India. What you can do right now</h2> Want to see what data brokers expose about you? See what a scan finds →</a> shows an example report: the kinds of sites that list your name, phone, and address. Once KnytX Shield launches it will find and remove these automatically. Join the waitlist</a> to get in early. Password Managers: Why You Need One & How to Choose Unknown — Mon, 04 May 2026 00:00:00 +0000 Here’s how most accounts get “hacked”: the specific service you use was never breached at all. What happened is that some other site — a forum you joined in 2016, a pizza delivery app, a shopping site you used once — got breached. Attackers took the leaked email and password combination from that breach and ran it automatically against Gmail, your bank, Amazon, PayPal, and hundreds of other sites. One of those matched. That attack has a name: credential stuffing</a>. It works because most people reuse passwords. The average person uses 3 to 7 passwords across more than 100 accounts. When any one of those accounts is breached, every other account sharing that password is now at risk. And breaches happen constantly — Have I Been Pwned, the public breach database, contains over 14 billion compromised accounts. The solution is not a stronger version of the same password. The solution is a unique password for every site, which no human can actually remember without help. The password reuse problem</h2> Attackers don’t manually try stolen passwords. They run automated tools that test credential pairs across thousands of sites per second. After a major breach, leaked lists circulate within hours. By the time the breached company notifies users, the credential stuffing attacks are already underway. Your banking password is the same as your email password is the same as your Netflix password. So when a breach hits any of those sites — even one you consider unimportant — every account tied to that password is exposed. This isn’t a theoretical risk. It’s how the majority of account takeovers actually happen. Consider what happened after the RockYou2021 compilation was posted online: over 8.4 billion password entries aggregated from years of breaches, all in a single searchable file. Any password you’ve ever used that appeared in any breach is now in that list. Attackers use these compiled lists to test credentials across banks, email providers, and shopping sites automatically and at scale. Making your password longer or more complex doesn’t solve the problem if you’re reusing it. A 20-character password reused across 10 sites is still 10 accounts waiting to fall when one site gets breached. The math only works in your favor when every password is unique. A unique, random password for every site means a breach at any one site exposes exactly that site. Nothing else. That’s the entire goal. What a password manager actually does</h2> A password manager stores your passwords in an encrypted vault. You remember one master password; the manager remembers everything else. It generates strong random passwords for every new account — passwords like xK9#mP2!qR7@vL</code> that no attacker can guess or brute-force in any reasonable timeframe. It auto-fills those passwords on websites and apps so you never need to type or remember them. Most managers also include breach monitoring, which alerts you when a site you have a saved account for is reported as compromised. The vault syncs across your devices. Log in from your laptop, your phone, your tablet — your passwords are there, encrypted, without you having to think about it. Some managers also store additional information alongside passwords: credit card numbers, secure notes, software license keys, passport details. The vault becomes a general-purpose secure document store, not just a password list. The generator is the feature that makes the whole system work. You don’t need to think of a strong password. You click “generate,” get something like mR4!xQ9#kL2@nP7</code>, and save it. You’ll never type it by hand — the manager fills it for you. The password being unmemorable is a feature, not a bug. The result: 100 accounts, 100 completely unique passwords, and you only remember one thing. The “what if it gets hacked” question</h2> This is the objection almost everyone raises. It deserves a direct answer. Zero-knowledge encryption is how reputable password managers protect your data. Your master password never leaves your device. The company stores only an encrypted blob — a scrambled version of your vault that is mathematically useless without your master password. Even the company running the service cannot read your passwords. Even if their servers are breached, attackers get encrypted data they cannot use. LastPass is the real-world test case here. In 2022, LastPass was breached. Attackers accessed encrypted user vaults. Users with strong master passwords were safe — their vaults were encrypted with something uncrackable. Users with weak master passwords (short, common, or reused) were at genuine risk, because weak master passwords can be attacked offline once the encrypted vault is obtained. The lesson is not “password managers are dangerous.” The lesson is this: your master password is the one password that actually has to be strong. Everything else the manager handles. Choosing your master password</h2> This is the one password you’ll ever need to remember, and it has to be good. A passphrase — four or more random unrelated words — is more secure and easier to remember than a complex short password. “correct-horse-battery-staple” is 28 characters and has more entropy than “P@ssw0rd!” (which attackers try first anyway, because everyone thinks punctuation-substitution is clever). Pick words that are genuinely random, not a sentence you know. Never reuse your master password anywhere. Never use your name, birthday, pet’s name, or anything guessable. Write it down and store it somewhere physically secure if needed — a piece of paper in your home is far less risky than a weak or reused password. After setting your master password, enable two-factor authentication</a> on your password manager account. This is the single highest-priority account you own. Protecting it with 2FA means that even if someone learns your master password, they still need your phone to get in. The main password managers compared</h2> Bitwarden is the recommendation for most people. It’s open source, so the code is publicly audited. The free tier covers all essential features most users need, and premium costs $10 per year, less than one streaming service. It has passed independent security audits and supports self-hosting for users who want complete control over where their data lives. Cross-platform: Windows, macOS, Linux, iOS, Android, and every major browser. 1Password costs $36 per year for individuals, $60 for families. The user experience is excellent — arguably the most polished in the category. It includes Travel Mode, which hides specific vaults when you cross a border, useful if you’re concerned about device searches. No free tier. Best choice for families or teams that want to pay for a better experience and collaborative features. Proton Pass is built by the same team behind ProtonMail, a well-regarded privacy-focused email provider. Open source, free tier available, and $4.99 per month for premium. A natural fit for users already using ProtonMail or Proton VPN. Dashlane costs $60 per year and includes a bundled VPN. The VPN adds cost without meaningfully improving password security. Better alternatives exist at lower prices unless you specifically want the bundle. Apple iCloud Keychain is free and deeply integrated into Safari, iOS, and macOS. If you only use Apple devices and have no plans to leave, it’s a reasonable option. It has no Android client and no meaningful path out if you ever switch platforms. Passkey support is solid. Google Password Manager is free and built into Chrome and Android. It’s convenient. It also ties your credentials directly to your Google account, which means a compromised Google account compromises everything. Cross-platform coverage only works within Google’s ecosystem. LastPass was the dominant password manager for years. The 2022 breach, and particularly how the company handled the disclosure (slowly, with minimal transparency), eroded the trust the product depends on. Avoid it. The alternatives are better. The short version: Bitwarden for most people. 1Password for families or teams who want to pay for superior UX. Getting started: the migration that takes one evening</h2> You don’t need to migrate every password at once. Focus on the accounts that matter most and work outward. Download Bitwarden (or your chosen manager) and install the browser extension for Chrome, Firefox, Safari, or Edge.</li> Create your account with a strong master passphrase. Write it down somewhere safe.</li> Enable two-factor authentication on the manager account before doing anything else. Use an authenticator app (Google Authenticator, Authy) rather than SMS if possible.</li> Start with your most critical accounts — your primary email address, your bank, and any account that can be used to reset other accounts. These are the highest-value targets.</li> For each account: log in normally, let the manager save the existing password, then use the manager’s built-in generator to create a new unique random password and update the account.</li> Install the mobile app on your phone. Most managers offer biometric unlock (Face ID, fingerprint) so you’re not typing your master password every time.</li> Add accounts as you use them over the following weeks. You don’t need a single marathon session.</li> </ol> After one week of normal internet use, your most important accounts will have unique passwords. After a month, most of your accounts will be covered without a dedicated effort. Passwords vs passkeys</h2> Passkeys are the newer authentication standard that major technology companies are pushing as a replacement for passwords. Instead of a password you type, a passkey is a cryptographic key pair — a private key that never leaves your device and a public key stored by the service. There’s nothing to steal, nothing to phish, and nothing to breach from the service’s side. How do you authenticate? With your device’s biometric sensor or PIN — the same way you unlock your phone. The service verifies you by confirming that your device holds the correct private key, without you ever transmitting a password. Phishing attacks that trick you into entering credentials on a fake site don’t work against passkeys, because there’s no credential to enter. Apple, Google, and Microsoft all support passkeys. Major sites — Google, Apple, GitHub, PayPal — already let you sign in with a passkey instead of a password. Both Bitwarden and 1Password support storing and syncing passkeys across devices, which solves the “what if I lose my phone” problem that made passkeys awkward in their early rollout. Passkeys are the future of authentication. They’re also not universal yet, and passwords will remain the dominant standard for years, because most sites still don’t support them. A password manager handles both. It manages your existing passwords today and stores passkeys as adoption grows. You don’t need to choose between them, and adopting a password manager now sets you up for the transition when it fully arrives. Our passkeys guide</a> explains how they work in detail. The browser-saved passwords question</h2> Chrome, Firefox, and Safari all offer to save your passwords when you log in. This is better than nothing. But it falls short of a dedicated manager in ways that matter. Chrome passwords sync to your Google account. If your Google account is compromised — by a phishing attack, a SIM swap, or a breach at Google’s level — your stored passwords go with it. Safari passwords sync to iCloud under the same logic. Browser-stored passwords also typically rely on your device being unlocked for protection. Say someone has access to your unlocked laptop. On most systems they can open a browser, navigate to the saved passwords section, and read your credentials with no extra authentication required. There’s also a portability problem. Chrome’s passwords don’t travel cleanly to Firefox. Safari’s passwords live inside the Apple ecosystem. If you switch browsers or platforms, your password history becomes difficult to move. A dedicated manager is browser-agnostic and platform-agnostic — your vault works everywhere because it’s yours, not tied to a browser vendor. A dedicated password manager adds a separate encryption layer gated by your master password, independent of your device login and independent of any single tech company’s account. It also gives you an organized, auditable view of every credential you own. You can see which accounts use weak passwords, which use duplicates, and which are connected to sites that have been breached. Browser password managers don’t offer that level of visibility. The security improvement is real, not theoretical. Browser saving is a convenience feature. A dedicated manager is a security tool. What you can do right now</h2> Want to see what data brokers expose about you? See what a scan finds →</a> shows an example report: the kinds of sites that list your name, phone, and address. Once KnytX Shield launches it will find and remove these automatically. Join the waitlist</a> to get in early. Smart Home Privacy: What Alexa & Google Home Record Unknown — Sun, 03 May 2026 00:00:00 +0000 Your smart speaker has been listened to by a human</h2> In 2019, Bloomberg reported that Amazon employs thousands of people worldwide to listen to Alexa recordings. This was not a secret. Amazon confirmed it. These reviewers transcribe clips, annotate them for accuracy, and feed corrections back into Alexa’s speech recognition model. This isn’t constant surveillance. The recordings are triggered (supposedly) only when the device hears its wake word. But false triggers happen constantly: furniture moving across the floor, a TV character saying “Alexa,” someone saying a word that rhymes with it. Those accidental recordings get sent to Amazon’s servers, and some get reviewed by a person. You can opt out of having your recordings used for training. Most people never do, because they don’t know this is happening. What Alexa and Google Home actually record</h2> Every time your Echo or Google Home activates, it records a short audio clip and sends it to Amazon or Google’s servers. This happens whether you meant to wake it or not. That clip is processed, transcribed, and stored. Alexa’s history is reviewable and deletable. Open the Alexa app, go to More > Activity, and you’ll see a timestamped log of every interaction. You can play them back, delete individual clips, or set auto-delete to 3 or 18 months. Go to Alexa Privacy settings and turn off “Help improve Alexa” to opt out of human review. Google Home works the same way. Go to myactivity.google.com, filter by Google Assistant, and you’ll find every recorded interaction. You can review, delete, and set auto-deletion from there. Google also offers a “Web & App Activity” auto-delete setting — use it. The question isn’t whether these devices record you. They do. The question is how long that data is kept and who can access it. Your smart TV is tracking every show you watch</h2> Smart TVs are the worst data collectors in the average home — and most people have no idea. ACR (Automatic Content Recognition) is technology built into TVs from Vizio, Samsung, LG, Roku, and others. It captures a sample of whatever is on your screen every few seconds. It identifies what you’re watching, whether that’s a cable channel, a streaming service, or a Blu-ray. Then it reports that back to the manufacturer. The viewing data is sold to advertisers. Vizio settled with the FTC in 2017 for $2.2 million after collecting ACR data on 11 million TVs without meaningful consent. The company had been tracking viewing history and linking it to IP address data and demographic information since 2014. The settlement required Vizio to disclose its practices and get opt-in consent. But ACR is still on by default on most TVs sold today. To disable it: the setting location varies by brand, but look in Settings > Privacy, Settings > System > Privacy, or a dedicated “Viewing Data” menu. On Samsung, it’s called “Viewing Information Services.” On LG, it’s “Live Plus.” On Vizio, search for “Smart Interactivity.” Turn all of them off. Ring cameras and law enforcement</h2> Ring cameras (owned by Amazon) store footage on Amazon’s servers, not locally. That’s convenient for remote viewing, but it has consequences. Between 2018 and 2021, Ring had formal partnerships with over 2,000 US police departments. These let them request Ring footage directly from Amazon, often without the camera owner’s knowledge or a warrant. Amazon complied with these requests. After significant public pressure, Ring ended the program in 2022. But the architecture is unchanged. Your footage still lives on Amazon’s servers, and Amazon still receives government data requests like every other tech company. Your options: go to the Ring app > Account > Privacy Settings and review what you’ve shared. You can also use End-to-End Encryption for stored footage, available on most newer Ring devices. With it on, Amazon can’t access the content of your recordings even if served with a request. If the data-with-law-enforcement arrangement concerns you, consider cameras with local storage. Eufy (with HomeBase) and Reolink both offer models that record to a local hard drive without mandatory cloud. Note: in 2022–2023, Eufy faced significant controversy. Researchers found that cameras marketed as ‘local only’ were uploading facial recognition data to Eufy’s cloud servers. Review their current privacy policy and recent independent testing before purchasing. Nest, Ecobee, and the devices you forgot about</h2> Your thermostat is also collecting data. Nest (Google) and Ecobee learn your schedule — when you leave, when you return, when you wake up, what temperatures you prefer. This behavioral data informs Google’s broader advertising profile on you. Ecobee’s privacy policy explicitly states that it collects “energy usage data, home status data (whether someone is home or not), temperature data, and usage patterns.” Some of this is shared with third-party analytics providers. The IoT privacy problem compounds across devices. Every smart plug, smart bulb, and connected appliance you add is another data point. Most of them have weak or nonexistent privacy policies, update infrequently, and communicate over your home network in ways you can’t easily audit. The practical setup that balances convenience and privacy</h2> You don’t have to get rid of your smart home. But a few structural changes make a real difference. Put smart home devices on a separate Wi-Fi network. Most modern routers let you create a guest network. Smart speakers, TVs, cameras, and IoT devices belong on it — not your main network where your laptop and phone live. This limits what your devices can see and communicate with inside your home. Review and delete your voice history quarterly. Set a reminder. It takes five minutes in the Alexa app or myactivity.google.com. Enable auto-delete so recordings don’t accumulate indefinitely. Disable ACR on every TV in your home today. There’s no tradeoff — ACR doesn’t improve your viewing experience. It only benefits the manufacturer. Turn it off. Choose devices from companies with better privacy defaults. Apple’s HomePod does more processing on-device and stores less data than Amazon or Google equivalents. Sonos has historically been more restrained about data collection — though check its current privacy policy before assuming. For cameras, local-storage options from Eufy or Reolink eliminate the cloud dependency entirely. For Ring specifically: enable end-to-end encryption if you’re keeping it. Then review your Neighborhood settings to confirm you haven’t opted into data sharing programs you didn’t intend to. What you can do right now</h2> Want to see what data brokers expose about you? See what a scan finds →</a> shows an example report: the kinds of sites that list your name, phone, and address. Once KnytX Shield launches it will find and remove these automatically. Join the waitlist</a> to get in early. Two-Factor Authentication: The Complete Setup Guide Unknown — Sat, 02 May 2026 00:00:00 +0000 HaveIBeenPwned, the breach tracking site, has catalogued over 14 billion compromised accounts. That number is not a projection. It’s already in the database. Most people reuse passwords across accounts. When a small e-commerce site you signed up for in 2016 gets breached, attackers don’t just try that password on that site. They run it against Gmail, your bank, PayPal, LinkedIn, and Amazon, automatically, across millions of accounts, around the clock. This is credential stuffing</a>, and it works because passwords alone are easy to collect and easy to reuse. Two-factor authentication breaks this attack completely. Even if attackers have your exact password, they can’t get in without a second factor that only you have. The problem is that not all 2FA is equal. Some methods are genuinely strong. Some can be bypassed in under an hour by a motivated attacker. This guide explains exactly which type to use for which account, and how to set it up on the services that matter most. How 2FA works</h2> The logic behind two-factor authentication is simple: a lock with two keys is harder to pick than one with one. Your password is something you know. The second factor is something you have: your phone, a physical key, or a device that generates time-sensitive codes. An attacker who steals your password from a breach database doesn’t have your physical device, so the lock stays closed. There are three types of second factors, ordered from weakest to strongest. SMS codes. A 6-digit code sent to your phone by text message. Easy to set up, works on any phone. The weakness: your phone number can be hijacked. Attackers call your mobile carrier, claim to be you, and convince a customer service rep to transfer your number to their SIM card. All texts then route to them. This is called a SIM swap attack</a>, and carriers’ identity verification is often shockingly easy to bypass. Authenticator apps. Apps like Aegis, Authy, or Google Authenticator generate TOTP (Time-based One-Time Password) codes offline. These codes change every 30 seconds and are tied to a secret key stored on your device, not to your phone number. No SIM swap can touch them. A determined attacker with a real-time phishing page can still capture a code if you type it in fast enough. But this is a targeted attack, not the automated credential stuffing that hits millions of accounts at once. Hardware security keys. Physical USB or NFC devices (YubiKey, Google Titan) that you plug in or tap to your phone. They use a protocol called FIDO2/WebAuthn that cryptographically verifies the website’s actual domain before authenticating. A phishing page at “g00gle.com” won’t work, because the key checks the domain and refuses. This is the only 2FA method that is effectively phishing-proof. Passkeys</a> use the same cryptography and go a step further by replacing the password too. Which type to use for which account</h2> Not every account needs a hardware key. Here’s the practical breakdown. Email accounts (Gmail, Outlook, Apple ID). At minimum, use an authenticator app. Your email is the recovery account for everything else. If someone gets into your Gmail, they can reset your bank password, your PayPal, your crypto exchange. Treat it like the master key to your life. If you can afford a hardware key, use it here first. Financial accounts (banking, brokerage, PayPal). Authenticator app or hardware key. Many banks only offer SMS 2FA. Use it if that’s all they offer, because SMS 2FA is still far better than no 2FA. But push for TOTP wherever the option exists. Strong 2FA here is a direct defence against account takeover fraud</a>. Social media (Facebook, Instagram, X/Twitter). Authenticator app. These are high-value targets for account takeover scams. Hijacked social accounts get used to run fraudulent ads, scam your followers, and impersonate you. Work accounts. Follow your IT department’s requirements, but advocate for authenticator apps over SMS. Corporate accounts are prime targets for phishing campaigns. Everything else. For retail sites, newsletter subscriptions, and low-value accounts, SMS 2FA is fine. The damage from a compromised account here is limited. The best authenticator apps</h2> These are real assessments, not marketing copy. Aegis (Android, free, open source). The best option for Android users. Codes are stored in an encrypted local database. Backup is manual: you export an encrypted file and store it yourself. There is no cloud sync that can be compromised by someone breaking into a server. Highly recommended for anyone who takes security seriously. 2FAS (iOS and Android, free, open source). Free, open source, available on iOS and Android, with an active development team and no proprietary backend. Local encrypted storage, manual backup, no account required. Best choice for iOS users. Authy. Available on Android, iOS, and desktop. Solid backup features with cloud sync, which is genuinely useful if you switch phones often. The tradeoff: your TOTP codes are stored in Authy’s cloud. If your Authy account is compromised, every 2FA code you have is exposed. Used by tens of millions of people for a reason, because the convenience is real. Note: in 2024, Authy’s parent company Twilio suffered a breach exposing user phone numbers, and the desktop app was discontinued. Consider 2FAS or Aegis as alternatives. Google Authenticator. Added encrypted backup in 2023, tied to your Google account. Simpler than Authy. If your Google account is already your main email, this adds a dependency you may not want. 1Password / Bitwarden (built-in TOTP). Convenient, but think carefully. Storing your password and your 2FA code in the same app means that if the app’s master password is compromised, both factors are gone. This partly defeats the purpose of two-factor authentication. The recommendation: Aegis on Android, 2FAS on iOS for anyone who prioritizes security. Authy for ease of use and multi-device access, accepting the cloud sync tradeoff. Hardware security keys: when you need one</h2> A hardware security key is a small physical device, about the size of a USB thumb drive, that you register with your accounts. When you log in, you plug it in or tap it to your phone’s NFC reader, and it cryptographically signs the login request. The critical feature is domain verification. The FIDO2/WebAuthn protocol bakes the website’s actual domain into the cryptographic exchange. If you’re logging into google.com, the key verifies that’s where you actually are. A fake login page at “g00gle.com” or “google.com.login.malicious.net” fails the check. The key won’t authenticate to the wrong site, full stop. Popular options: YubiKey 5C NFC ($55, works with USB-C and NFC-capable phones), Google Titan Security Key ($30, available in USB-A/C and NFC versions), SoloKey ($20–$50, open source hardware). Who actually needs one? Journalists handling sensitive sources. Political activists in countries with authoritarian surveillance. Executives with access to high-value corporate accounts. Anyone who has already been targeted by a phishing attack. If you’ve ever received a sophisticated, targeted phishing attempt, one that used your real name, knew your employer, or mimicked a service you actually use, a hardware key is worth the cost. For most people, a strong authenticator app covers the realistic threat. Hardware keys are for elevated-risk individuals or anyone who wants the strongest possible protection on their most important accounts (email, especially). How to set up 2FA on the accounts that matter most</h2> Google / Gmail Go to myaccount.google.com</li> Select Security from the left sidebar</li> Under “How you sign in to Google,” click 2-Step Verification</li> Click Get started and follow the prompts</li> Choose Authenticator app, then scan the QR code with Aegis or 2FAS</li> Save your backup codes before you finish (10 single-use codes; download and store them)</li> </ol> Apple ID Open Settings on your iPhone</li> Tap your name at the top, then Sign-In & Security</li> Tap Turn On Two-Factor Authentication</li> Apple uses its own push-based system tied to your Apple devices; follow the on-screen steps</li> You’ll also set a trusted phone number as a fallback. Make sure it’s a number you actually control</li> </ol> Facebook / Instagram Facebook: Go to Settings & Privacy → Settings → Accounts Center → Password and security → Two-factor authentication</li> Instagram: Go to Settings → Accounts Center → Password and security → Two-factor authentication</li> Select your account, then choose Authentication app</li> Scan the QR code with your authenticator app</li> Save the recovery codes Facebook/Instagram provides</li> </ol> WhatsApp Open WhatsApp, tap the three dots (Android) or Settings (iOS)</li> Go to Account → Two-step verification → Enable</li> Create a 6-digit PIN. This is what WhatsApp calls 2FA (it’s different from TOTP; it’s a PIN required when re-registering your number on a new device)</li> Add a recovery email address</li> Store the PIN somewhere safe. You’ll need it if you reinstall WhatsApp</li> </ol> Backup codes: the thing everyone forgets</h2> Every major service gives you emergency backup codes when you enable 2FA. These are typically 10 single-use codes that let you log in if you lose your phone. Most people skip past this step. Don’t. Say you lose your phone, break it, or get a new one before migrating your authenticator app, and you didn’t save your backup codes. You can be permanently locked out of your account. Account recovery without backup codes is a slow, uncertain process. Some services require weeks of identity verification. Some don’t recover accounts at all. Save backup codes in at least one physical form: printed and stored somewhere secure (a locked drawer, a home safe), or written in a notebook. You can also store them in an encrypted notes app on a device you don’t use as your primary phone. The point is: separate from the phone that runs your authenticator app. The SIM swap risk with SMS 2FA</h2> If your 2FA method is SMS codes, here’s the specific attack you’re exposed to. An attacker calls your mobile carrier’s customer support line. They claim to be you, using personal information gathered from data broker sites, social media, or previous breaches. They say they just got a new SIM and need to transfer their number. The customer service rep, following an inadequate verification process, transfers your phone number to a SIM card the attacker controls. From that moment, every SMS 2FA code goes to the attacker. They request a password reset on your email, get the SMS code, log in, and lock you out, often within minutes. This isn’t a theoretical attack. It has been used to drain cryptocurrency accounts, compromise Twitter/X accounts, and access banking services. High-profile targets have lost millions this way. Switching to an authenticator app eliminates this risk entirely. Your TOTP codes are generated locally on your device, tied to a cryptographic secret, not to your phone number. There’s nothing a carrier rep can hand over. For a full breakdown of how SIM swap attacks work and how to protect your number, see our guide at /blog/sim-swap-attacks/</a>. Setting it up: the right order</h2> If you’re starting from zero, do this in order: Download an authenticator app first. Aegis (Android) or 2FAS (iOS). Get familiar with it before you start enabling 2FA everywhere.</li> Secure your email account. Gmail, Outlook, or Apple ID. This is the recovery account for everything else. Enable 2FA, save backup codes, store them somewhere physical.</li> Secure your financial accounts. Bank, brokerage, PayPal, and any crypto exchanges. Enable the strongest 2FA the service offers.</li> Secure social media. Facebook, Instagram, X/Twitter.</li> Enable 2FA on everything else. Any account that matters, in order of how bad it would be to lose access.</li> </ol> One account at a time. Don’t rush through it. The backup codes step is not optional: treat it as part of enabling 2FA, not an afterthought. Your password is already in a breach database somewhere. That’s not pessimism; that’s probability, given 14 billion compromised credentials and counting. Two-factor authentication is the layer that makes a leaked password useless. The method matters, but using any authenticator app on your most important accounts puts you significantly ahead of where you are with a password alone. What you can do right now</h2> Want to see what data brokers expose about you? See what a scan finds →</a> shows an example report: the kinds of sites that list your name, phone, and address. Once KnytX Shield launches it will find and remove these automatically. Join the waitlist</a> to get in early. Malvertising: How Trusted Ads Deliver Malware Unknown — Fri, 01 May 2026 00:00:00 +0000 She opened The New York Times on a Tuesday morning in March 2016. A marketing director in Chicago, coffee still brewing, skimming the news before a 9 a.m. call. She read three articles. She didn’t click any ads — she barely noticed them. She closed the browser and started her day. By early afternoon, her machine was showing her a ransom note. The attackers hadn’t targeted her specifically. They hadn’t broken into the Times’ servers. They hadn’t sent her a phishing email. They’d bought an ad slot in the Times’ ad network, disguised it as a legitimate campaign, and used it to push malicious code to every browser that loaded the page. The New York Times’ own security team spent the day trying to understand what had happened. The malicious ad had slipped through their network, exploited an unpatched browser vulnerability using the Angler exploit kit, and installed ransomware before the page had fully loaded. The Times didn’t serve the malicious ad directly. They sold the slot. The network filled it with something they had no way to review in time. This is malvertising: malware delivered through advertising networks to readers of completely legitimate, high-quality websites. The attack doesn’t require the publisher to make a mistake. It doesn’t require you to click anything. It requires only that you load a page and that your browser has an unpatched vulnerability. Both of those things are true for most people, most of the time. The short answer: Malvertising is malware pushed through the ad slots on real, reputable websites. Attackers buy ad inventory, pass an approving benign creative, then swap in code that exploits an unpatched browser and installs a payload as the page loads. No click needed. The single most effective defence is a content blocker like uBlock Origin: if the ad never loads, the malicious ad never runs. Back it up by keeping your browser and OS patched, removing Flash and Java, and adding DNS-level filtering. Jump to: Why “I only visit safe sites” doesn’t protect you</a></li> How online advertising actually works</a></li> How the attack is constructed</a></li> The exploit kit ecosystem</a></li> Real-world malvertising incidents</a></li> Why ad networks struggle to stop it</a></li> The protection that actually works</a></li> The search-ad variant</a></li> </ul> Why “I only visit safe sites” doesn’t protect you</h2> This is the belief that malvertising shatters. It’s reasonable — the logic is that malware lives on sketchy websites, so staying on reputable ones keeps you safe. For many threats, that’s largely true. For malvertising, it’s exactly wrong. The whole premise of a malvertising attack is that it operates through the infrastructure of legitimate publishers. The New York Times has a dedicated security team. The BBC has one. MSN has one. None of them served malware intentionally, and none could prevent it in the moment, because the malware didn’t come from them. It came from an ad network they’d contracted with. That network sourced the ad from an exchange the publisher had no direct relationship with. And that exchange accepted a bid from an advertiser who had passed initial automated review. The publisher is the face of what you’re reading. They’re not the source of most of the code running in your browser when you read it. The second belief malvertising challenges is that you need to click something to get infected. You don’t. Drive-by downloads — the technical term for the attack vector — require no user action. The ad loads. The malicious code in the ad runs. The code checks your browser and installed plugins for known vulnerabilities. If it finds one, it downloads and executes a payload without triggering any visible prompt, any download dialog, anything you’d notice. You read an article. You close the browser. Your machine is already compromised. How online advertising actually works</h2> Malvertising is hard to stop for a reason rooted in how ads load. A lot happens in the roughly 100 milliseconds between when you request a web page and when the ads appear on it. Publishers — websites, news outlets, media companies — sell ad space on their pages. But most of them don’t manage this process themselves. They contract with ad networks to fill their inventory. The ad network aggregates available space across many publishers and sells it to advertisers. The modern ad ecosystem goes further than that. Most major publishers connect to programmatic ad exchanges: open marketplaces where any qualified buyer can bid on ad inventory in real time. When you load a page, your browser sends a request to the publisher’s server. The publisher’s server fires a request to the ad exchange. In effect it says: “I have a visitor with these attributes (age range, geography, interests, device type) who will see this ad slot. What will anyone pay to reach them?” Hundreds of potential buyers submit bids automatically, in milliseconds. The highest bidder wins. The ad loads. The entire auction completes before the page finishes loading. You never see it happen. Here’s the structural problem: the publisher may have a direct relationship with one or two ad networks. Those networks connect to open exchanges with thousands of registered buyers. The identity verification on many of those buyers ranges from minimal to perfunctory. The publisher doesn’t know who’s serving you an ad. The exchange may not know in any meaningful depth. Automated scanning can catch known-malicious code — but attackers design their campaigns specifically to pass automated review. The result is that the ad slot on the New York Times’ website is effectively open to any buyer. They need only pay for it and appear legitimate enough to pass automated screening. That’s the attack surface. How the attack is constructed</h2> Attackers approach this methodically. The first step is gaining access to the ad ecosystem. This usually means one of three things. They buy an existing ad account whose credentials were stolen. They register a shell company with enough surface-level legitimacy to pass advertiser verification. Or they exploit a compromised legitimate advertiser account. The barrier to entry is lower than it should be, because ad networks have historically prioritised scale over rigorous buyer vetting. The attacker then creates an ad creative — the banner or video or display unit you’d see on a page. The initial creative is benign. It passes automated review because it is, at the moment of review, exactly what it appears to be. This is the move that makes malvertising particularly hard to catch: the ad that gets approved is not the ad that delivers the malware. Once the campaign goes live, the attacker swaps the payload. They update the ad’s behavior — not the visual content, but the code the ad executes when it loads in your browser. Some techniques are more sophisticated. Steganography — hiding data inside image files — has been used to smuggle malicious code past scanners that examine ad content. The ad banner is a completely normal-looking image. But embedded within the image data, invisible to visual inspection, is a payload that a companion piece of malicious JavaScript extracts and executes. Scanners looking at the image see an image. They don’t see the malware. Other attacks simply embed malicious JavaScript directly in the ad unit. That JavaScript runs as part of the page’s normal rendering process. It checks your browser version, your installed plugins, your operating system. It’s looking for known vulnerabilities — unpatched browser engines, outdated PDF readers, anything with a published exploit available. If it finds a match, it sends a request to the attacker’s server, retrieves the appropriate payload for your specific configuration, and runs it. No click. No download dialog. No warning. The exploit kit ecosystem</h2> Behind the technical execution of most malvertising attacks is a class of tools called exploit kits. These are sophisticated software packages sold and rented on criminal markets. They automate the entire process of identifying browser vulnerabilities and delivering the matching payloads. Angler was the exploit kit that powered the 2016 New York Times attack. By the standards of its era, Angler was exceptionally capable. It exploited vulnerabilities in Adobe Flash, Microsoft Silverlight, and Internet Explorer, and it rotated domain infrastructure so aggressively that blocklists couldn’t keep up. Angler handled geographic targeting (some campaigns delivered payloads only to US or UK IP addresses to maximise the value of each infection), evasion, and obfuscation. It was available as a service on criminal markets, allowing attackers without deep technical expertise to run sophisticated campaigns. Law enforcement took down the infrastructure behind Angler in late 2016. RIG rose to fill the gap. Less technically innovative than Angler, but persistent — RIG-based campaigns continued to be documented into 2024, exploiting browser engine vulnerabilities and delivering ransomware and banking trojans. Magnitude focused heavily on ransomware delivery and operated for years through compromised ad networks. Neutrino was active for several years before its operators reportedly retired it; the codebase circulated underground afterward. These aren’t exotic government-grade tools. They’re crime-as-a-service platforms. An attacker doesn’t need to understand how a browser vulnerability works to exploit it. They need to rent the kit and buy the ad inventory. The incidents</h2> The 2016 New York Times incident is the most cited malvertising case, in part because it was so cleanly documented. Malwarebytes’ security researchers identified the campaign in real time. They traced it to the Angler exploit kit operating through the DoubleClick and AppNexus ad networks. They confirmed that readers who loaded the Times’ homepage received a ransomware payload, a variant called CryptoWall. The Times took the ads down once the campaign was identified. But the damage was already done to anyone who loaded the affected pages while the campaign was live. Spotify ran into malvertising in 2011 — earlier than most people remember these attacks happening. Users reported browser windows opening unprompted, attempting to install software they hadn’t requested. Spotify confirmed the issue, acknowledged that malicious ads had been served through their ad network, and removed them. The attack relied on users having Adobe Flash installed, which was essentially universal at the time. The 2016 mass campaign identified by Malwarebytes struck several major publishers at once. BBC Online, The Huffington Post, AOL, and MSN all served malvertising from the same campaign in the same period. The attack exploited vulnerabilities in Adobe Flash and Microsoft Silverlight to deliver ransomware. It was not a targeted attack against any one publication. It was a programmatic buy against high-traffic inventory — the attackers wanted volume, and these sites provided it. Malvertising continued to evolve as Flash was deprecated and eventually killed. Attackers moved to exploiting browser engine vulnerabilities directly, targeting PDF readers, and abusing JavaScript capabilities. The tooling changed; the fundamental attack model did not. By 2023, researchers documented a significant shift in malvertising strategy: search result ads. Attackers purchased Google Search sponsored placements for high-intent queries like “download VLC,” “7-Zip free,” and “OBS Studio download.” The sponsored links at the top of search results pointed to domains crafted to resemble the real software projects, such as vIc-player.com instead of videolan.org. Landing pages served modified installers with bundled malware. Often it was an information stealer</a> like Vidar or RedLine, designed to harvest browser cookies, saved passwords, and session tokens. Users searching for legitimate software and clicking the top result were downloading malware. This variant is particularly insidious because it targets active download intent. Users at that moment expect to download something. The friction of “a file is being downloaded” that would alarm a careful user in another context is not alarming when you’re actively trying to download something. Why ad networks struggle to prevent this at scale</h2> The honest answer is that the scale is incomprehensible. Google’s ad network alone processes billions of individual ad transactions every day. Manual review of each ad at that volume isn’t possible. Automated scanning is the only viable approach, and automated scanning has structural weaknesses. Signature-based detection — looking for known-malicious code patterns — fails against adversaries who modify their payloads for each campaign. The change doesn’t need to be large. Attackers vary variable names, rearrange function structure, encode strings differently. Each variation is technically new code. Signatures targeting the old version don’t match. Behavioral analysis, running ad code in a sandbox and watching what it does, is more robust but slower and resource-intensive. And sophisticated attackers design around it. The malicious behavior triggers only after a delay, or only against IP addresses in certain geographic ranges, or only on browsers with characteristics that distinguish real users from scanners. The sandbox doesn’t look like a real user. The malware knows. Confiant, a firm that specialises in ad quality and security, documented over 130 distinct malvertising campaigns in its 2023 annual report. DoubleVerify’s research consistently finds that a meaningful share of ad impressions across the open web involve some form of ad fraud or unsafe content. The malvertising portion varies by campaign, but it is not a rounding error. The economics work in the attacker’s favor. A successful malvertising campaign runs for days or weeks before detection. It reaches readers across dozens or hundreds of publishers. Each infected machine can yield ransomware payments, stolen credentials sold on underground markets, or access to banking sessions worth hundreds of dollars each. The attacker’s cost is ad inventory — which they’re buying with stolen payment methods or laundered funds anyway — and whatever they paid to rent the exploit kit. The return on a successful campaign is substantial. What happens on your machine</h2> Let’s be concrete about the sequence, because understanding it makes the defenses make sense. You open a news article. Your browser requests the page. The page’s HTML loads and begins to render. The page contains references to ad slots — these are essentially instructions to your browser to go fetch content from a third-party ad server. Your browser dutifully makes those requests. The winning ad from the real-time auction loads into the ad slot. That ad contains JavaScript. Your browser executes it, because JavaScript in web content runs by default. The JavaScript fingerprints your environment: browser version, installed plugins, operating system, screen resolution, whether you’re in a sandboxed environment. It sends this information to the attacker’s server and receives instructions back. If your browser has a known vulnerability the attacker’s exploit kit can target, the kit sends the appropriate shellcode. This code exploits the vulnerability — overwriting memory in a way that redirects execution to attacker-controlled instructions. The attacker’s code now runs with whatever privileges your browser process has. That code downloads an executable payload from a remote server and runs it. What it is depends on the campaign. The payload might be ransomware or a banking trojan that intercepts your transactions. It might be an information stealer that harvests your saved passwords and session cookies, or a botnet agent that puts your machine to work in a criminal network. The entire sequence — from page load to malware execution — takes seconds. Nothing visible happens. No dialog box. No prompt. No file appears in your downloads folder in any obvious way. You finish reading the article. The protection that actually works</h2> An ad blocker. This is the most effective single control against malvertising, and it’s free. uBlock Origin, available for Firefox, Chrome, and Edge, blocks requests to ad network domains entirely. If the ad request never leaves your browser, no ad loads. No ad loads means no malicious ad loads. The attack has no surface to operate on. This isn’t incidental protection — it’s total protection against this specific attack vector. The malvertising payload cannot execute code in your browser if it’s never served to your browser. uBlock Origin is open-source, maintained by an active community, and consumes fewer resources than running ads does. Install it. Keep your browser updated. Exploit kits target known vulnerabilities with published patches. The window between when a vulnerability is disclosed and when a patch is released is when zero-day exploits operate. But a large fraction of malvertising campaigns exploit vulnerabilities that have patches available — the attacker is counting on the gap between patch release and when users apply it. Automatic browser updates close that gap. Enable them and don’t dismiss the prompts. Update your operating system. Browser exploits sometimes escalate privileges using OS vulnerabilities. An up-to-date OS closes that escalation path. Remove Flash, Java, and Silverlight. If these browser plugins are still present and enabled in any browser you use, disable them. All three are discontinued and no longer receive security patches. They were the primary exploit surface for malvertising campaigns throughout the 2010s, and any unpatched vulnerabilities in them will never be fixed. Modern browsers have removed support; check your browser’s plugin settings and confirm these are absent or disabled. DNS-level filtering. Services like Cloudflare Gateway, NextDNS, or Quad9 block known-malicious domains at the DNS resolution level, before your browser ever makes a connection. Pi-hole provides the same capability if you want to run it locally. These don’t replace an ad blocker — they operate on a different layer — but they add another barrier. A malvertising payload that tries to call home to a known-malicious server gets blocked at DNS before any data moves. Script blocking for high-security browsing. Extensions like uMatrix or NoScript give you granular control over which scripts execute on which domains. The tradeoff is friction — many websites partially break when you block third-party scripts. But for high-sensitivity browsing — accessing financial accounts, anything sensitive — the protection is substantial. You can allowlist domains you trust and default-deny everything else. The harder question is whether to whitelist publishers when they ask. Many sites detect ad blockers and request you disable blocking to support their journalism. This is a legitimate concern — ad revenue funds free reporting, including from the publications whose readers have been hit by malvertising. Whether to comply is a judgment call. The security calculus is that the ad networks those publishers work with represent risk you cannot independently assess. Even if you trust the publisher, you can’t audit who they’ve contracted with, who those contractors work with, and who’s currently buying inventory on those exchanges. The search ad variant deserves special attention</h2> The 2023 shift toward search result malvertising changes the threat model in one important way: it targets users who are actively trying to download something. This makes the normal malware-defense instinct — don’t download unexpected files — insufficient. You expected a download. You initiated it. You clicked a result that appeared at the top of a Google search. The protection here is different. When downloading software, go directly to the software’s official website rather than clicking search results — even sponsored ones. Type the URL or navigate from the software’s official documentation. Verify that the domain you’re downloading from matches the software’s actual home: videolan.org for VLC, 7-zip.org for 7-Zip, obsproject.com for OBS. The fake domains used in these campaigns are close but not exact — a character swapped, a hyphen added, a different TLD. Sometimes a download just feels off. The file size is unusual, your antivirus flags it, the installer’s interface looks slightly wrong, or it asks for permissions the software shouldn’t need. When that happens, stop. Delete the file. Go to the official source and start over. Malvertising through search results is increasingly how information stealers reach machines. The credentials and session tokens those stealers harvest feed credential stuffing</a> attacks, account takeovers</a>, and fraud. The chain from “I clicked a sponsored search result for a free download” to “someone accessed my bank account” is shorter than it looks. What you can do right now</h2> Want to see what data brokers expose about you? See what a scan finds →</a> shows an example report: the kinds of sites that list your name, phone, and address. Once KnytX Shield launches it will find and remove these automatically. Join the waitlist</a> to get in early. What Facebook Knows About You Off Facebook Unknown — Thu, 30 Apr 2026 00:00:00 +0000 Last night you searched for a medication. You went to a pharmacy website, maybe WebMD, maybe a generic drug information page. You weren’t on Facebook. You didn’t share anything. You didn’t click an ad. Facebook knows you did it anyway. This is not a hypothetical. It’s how Meta’s tracking infrastructure works, and it operates on roughly one in three websites on the internet. You don’t need a Facebook account for it to apply to you. The website that told Facebook about your health search</h2> The site you visited had a small piece of JavaScript embedded in its code: the Meta Pixel. When you loaded the page, that script fired silently in your browser and sent a report to Meta’s servers. That report held your IP address, a fingerprint of your browser, and the page you visited. In some cases it also held the specific action you took: searched for a drug name, clicked a product, added something to a cart. Meta matched that fingerprint to your existing Facebook profile. Now it knows about your health concern — even though you never typed it into Facebook, never shared it with a friend, never clicked a single Facebook ad about it. This information lives in your advertising profile. It shapes which ads you see. It categorizes you into “interest segments” that Meta sells access to. And it persists long after you’ve forgotten you ever visited that site. What the Meta Pixel is</h2> The Meta Pixel (formerly Facebook Pixel) is a snippet of JavaScript that website owners paste into their site’s code. It takes about five minutes to install. Meta provides it free of charge because the tracking data it returns is worth far more than any fee they’d charge. When you load any page with the Pixel installed, several things happen at once. Your IP address is recorded. A tracking cookie is set or read in your browser. Your device fingerprint is logged. And the page you visited is reported to Meta. If you’re logged into Facebook in the same browser, the match to your profile is direct. If you’re not logged in, Meta uses your fingerprint and IP to probabilistically match you to a profile anyway, a technique called cross-device tracking. Approximately one in three websites globally has the Meta Pixel installed. That includes news sites, healthcare providers, government services, and retailers. The journalism outlet The Markup found in 2022 that Meta Pixel was present on major hospital websites — reporting the specific conditions patients were searching for back to Meta. Several hospitals faced regulatory investigations as a result. Your Off-Facebook Activity — go look at it now</h2> Meta gives you a tool to see a summary of what it’s collected from third-party sites. It’s called Off-Facebook Activity, and most people who find it are startled by what’s in it. To find it: open Facebook on desktop, go to Settings & Privacy > Settings > Your Facebook Information > Off-Facebook Activity. What you’ll see is a list of every company or website that sent your activity data to Meta. Not a short list. For most people who’ve had an account for a few years, it runs into the hundreds or thousands of entries. You can clear this data and disconnect future tracking from your account using the “Clear History” and “Manage Future Activity” options in that same menu. Here’s what “clearing” actually does: it breaks the link between your past off-site activity and your Facebook account profile. It does not delete the underlying data from Meta’s servers. Meta retains it in anonymized form. The data still exists; it just can’t be connected to you by name — at least according to Meta’s own policy documentation. Still worth doing. But understand what it does and doesn’t accomplish. Shadow profiles: you don’t need an account</h2> Here’s the part that surprises people who have never signed up for Facebook. When any of your contacts installs Facebook and grants it access to their phone contacts, your name and phone number upload to Meta’s servers automatically. You never consented. You were never asked. You didn’t agree to any terms of service because you’re not a Facebook user. Meta uses this data to suggest “People You May Know” connections to new signups, build advertising profiles on non-users, and populate its social graph. Senator Dick Durbin asked Mark Zuckerberg directly about this practice during his 2018 Congressional testimony — specifically, whether Facebook collects data on people who haven’t created an account. Zuckerberg confirmed that it does, describing it as a “security” measure. Critics call it what it is: a shadow profile system that extends Meta’s reach to every person connected to any of its 3 billion users. If you’ve never had a Facebook account, there is very likely a partial profile of you on Meta’s servers right now, built from contact lists uploaded by people who do. The 2021 breach: 533 million records</h2> In April 2021, a dataset containing information on 533 million Facebook users appeared publicly on a hacking forum — no purchase required, just download it. The data included full names, phone numbers, email addresses, birthdays, and location data. For many users, home cities and employers were included. The breach originated from a vulnerability in Facebook’s contact importer feature, which allowed bulk enumeration of user data by phone number. Meta was aware of the vulnerability by 2019. The data was scraped before the vulnerability was patched. Then it sat in private hands for two years before being posted publicly. Troy Hunt added the dataset to Have I Been Pwned (haveibeenpwned.com). You can check whether your phone number or email address was in it — phone number search is available under the “Phone” field on the HIBP site. A significant percentage of Facebook users globally were included. The Irish Data Protection Commission fined Meta €265 million for this breach in 2022. A separate €1.2 billion fine followed in 2023 for unlawfully transferring European user data to US servers in violation of GDPR. At €1.2 billion, the 2023 Meta fine was the largest GDPR fine ever issued at the time. The earlier €265 million fine for the 2021 data scraping incident was also among the largest. Meta appealed both. What you can actually do</h2> Clear your Off-Facebook Activity and set it to not track future off-site activity (the path is: Settings > Your Facebook Information > Off-Facebook Activity > Manage Future Activity). This reduces the amount of cross-site data linked to your account going forward. Install uBlock Origin in your browser. It blocks the Meta Pixel from loading on third-party sites — meaning the script never fires, the data never reaches Meta. This is the most effective technical control available to you and it works immediately. It also blocks most other third-party trackers. There’s no reason not to run it. Use a separate browser profile — one where you’re never logged into Facebook — for general browsing. When your Facebook session and your general browsing session are in the same browser profile, Meta can link your off-site activity to your account directly via cookies. A separate profile breaks that linkage. Your regular browsing stays in one profile; Facebook stays in another. Consider whether Facebook’s actual utility to you justifies the tracking cost. That’s a genuinely personal question. The platform has real value for some people and almost none for others. But it’s worth asking honestly rather than leaving the relationship on autopilot. The same identifiers Meta collects — your name, phone, and address — also power the people-search brokers. Broker pages like BeenVerified</a> and Spokeo</a> show what those sites hold and how to opt out. What you can do right now</h2> Want to see what data brokers expose about you? See what a scan finds →</a> shows an example report: the kinds of sites that list your name, phone, and address. Once KnytX Shield launches it will find and remove these automatically. Join the waitlist</a> to get in early. SIM Swap Attacks: How They Work & How to Survive Unknown — Tue, 28 Apr 2026 00:00:00 +0000 Your phone drops to “No Service.” You assume it’s a tower issue. You’ll check it in a few minutes. Those few minutes are enough. Somewhere across town — or across the world — someone just called your carrier, convinced them they were you, and transferred your phone number to a SIM card they control. Every SMS headed to your number now lands on their device. Your email password reset just went to them. So did your bank’s OTP. By the time you figure out what happened, they’re already in. The moment it happens</h2> The first sign is the signal drop. No calls, no texts, no data. Your phone is on, but it’s cut off from the network. This is the tell — your number has been transferred off your SIM. Within minutes of a successful swap, an attacker starts their clock. They go to your email provider first. Email is the master key: it unlocks password resets for everything else. From there they hit banking apps, crypto wallets, PayPal, investment accounts. If your accounts use SMS-based two-factor authentication — and most people’s do — every verification code goes straight to them. The FTC received more than 15,000 SIM swap reports in the US in 2023 alone. Those are only the cases that got reported. How attackers execute the swap</h2> The mechanics are simpler than most people expect. An attacker calls your carrier’s customer support line and says they’ve lost their SIM. They want their number transferred to a new one. Customer support then asks identity verification questions. That means your name, your billing address, the last four digits of your Social Security Number (or Aadhaar number in India), your account PIN, and answers to security questions. Pass enough of those checks, and the agent processes the transfer. So where do attackers get this information? From you — just not directly. Your name and home address are listed on Whitepages</a>, Spokeo</a>, and dozens of data broker sites right now. Your date of birth is on your Facebook profile, possibly set to public. The last four digits of your SSN are available in breach databases. The 2023 MOVEit breach alone exposed records belonging to tens of millions of Americans. Your carrier account PIN, if you haven’t set one, defaults to a weak value or doesn’t exist at all. Security question answers, such as mother’s maiden name, childhood pet, and first car, are often findable through social media in under twenty minutes. Scattered Spider’s 2023 attacks on MGM Resorts, Caesars Entertainment, and several other corporations used enterprise vishing, impersonating employees to trick corporate IT helpdesks into resetting credentials. That’s related to but distinct from consumer SIM swap requests at carrier stores. The same pattern of social engineering, applied to consumer carrier accounts, works on ordinary people every day. What they do once they have your number</h2> The first ten minutes after a swap are when the most damage happens. Your email goes first — it’s the account that resets everything else. Once they’re in your inbox, they search for financial institution names, scan for linked accounts, and start requesting password resets. Banking apps that send OTPs via SMS hand them over immediately. Crypto wallets — which have no fraud reversal and no customer support line to call — are often drained within minutes. Jack Dorsey, then CEO of Twitter, had his own Twitter account compromised via SIM swap in 2019. His phone number was transferred without authorization, and attackers used it to post offensive content from his account before the swap was detected and reversed. If it can happen to the CEO of a major tech company, it can happen to anyone with a public-facing phone number. In India, SIM swap fraud has a specific flavor: it targets UPI and net banking OTPs. Attackers file a fraudulent SIM replacement request at a carrier store using forged Aadhaar documents. They then wait for the victim’s SIM to deactivate, which happens automatically when a new SIM activates on the same number. Finally, they drain the victim’s bank account during the window before the victim notices. Indian banks have improved detection, but the attack continues at scale. Who is most at risk</h2> Crypto holders are the highest-value targets — there’s no chargeback, no fraud team to call, no reversal. Stolen crypto is gone. People with large social media followings get targeted for account hijacking, which gets repurposed for scams or sold. Executives are targeted for corporate access — their phone number unlocks enterprise accounts and internal communication platforms. But “most at risk” doesn’t mean regular people are safe. Attackers run volume operations. A compromised email account with a PayPal or Venmo attached is worth real money. A bank account with a few thousand dollars in it is worth the fifteen-minute effort of a SIM swap. Your net worth doesn’t need to be exceptional for you to be worth targeting. How to protect yourself</h2> Set a carrier PIN — today. AT&T, Verizon, T-Mobile, Jio, and Airtel all allow you to add a PIN that must be provided before any SIM change can be processed. This single step dramatically raises the bar. Without it, a caller just needs to pass basic identity verification with information that’s already exposed. With it, they need your PIN too. Call your carrier’s customer service line and ask specifically to set a port freeze or SIM lock — some carriers call it a “number transfer PIN” or “account security PIN.” Switch SMS-based 2FA to an authenticator app</a> (Google Authenticator, Authy, or similar) on every account that allows it. Authenticator codes generate locally on your device. They’re not routed through your phone number and can’t be intercepted by a SIM swap. Gmail, most banks, and every major crypto exchange support TOTP-based 2FA. For your highest-value accounts, use a hardware security key like a YubiKey. A SIM swap cannot bypass a hardware key. The attacker would need the physical device in their hand. Hardware keys are the strongest consumer-grade protection available. Remove your phone number from services that don’t genuinely need it. Many apps ask for your number during signup but don’t require it for the service itself. The fewer places your number exists as a linked identifier, the smaller your attack surface. If it happens to you</h2> Act immediately — every minute matters. Use a different device (a family member’s phone, a landline, your laptop’s Wi-Fi calling) to call your carrier’s fraud line. Your phone is compromised; do not rely on it. Report the fraudulent SIM transfer, have them deactivate the attacker’s SIM, and restore service to your original device. From a device that isn’t your phone, change passwords for your email, banking, and any accounts where the attacker had enough time to get in. Log out all active sessions on your email account. Contact your bank’s fraud department directly — not through links in any emails you received during the attack window. Explain that you’re a victim of SIM swap fraud. Ask them to flag your account, reverse any unauthorized transactions, and temporarily freeze outbound transfers. File a report: US: reportfraud.ftc.gov</li> India: cybercrime.gov.in (National Cyber Crime Reporting Portal)</li> UK: Action Fraud at actionfraud.police.uk</li> EU: your national data protection authority</li> </ol> Document everything with timestamps. If crypto was stolen, report it to the exchange and to law enforcement — recovery is unlikely but documentation matters for any subsequent legal action. What you can do right now</h2> Want to see what data brokers expose about you? See what a scan finds →</a> shows an example report: the kinds of sites that list your name, phone, and address. Once KnytX Shield launches it will find and remove these automatically. Join the waitlist</a> to get in early. Social Engineering: The Psychology of Cyberattacks Unknown — Mon, 27 Apr 2026 00:00:00 +0000 July 15, 2020. A 17-year-old named Graham Ivan Clark is sitting at a computer in Tampa, Florida. He and two accomplices have spent the past several days on something big. It would soon compromise the accounts of Barack Obama, Joe Biden, Elon Musk, Bill Gates, Apple, Uber, and Kanye West at once. They hadn’t written a single line of exploit code. They hadn’t found a zero-day. They hadn’t breached Twitter’s systems with any kind of technical sophistication at all. They called a few Twitter employees on the phone. Clark and his team had researched Twitter’s internal structure on LinkedIn. They harvested employee names, department titles, and the internal jargon of Twitter’s IT and support teams. Then they started calling, posing as IT staff conducting a VPN credential check. That is the kind of routine thing real IT departments do, especially during the early work-from-home chaos of the pandemic. The employees they reached had no specific reason to be suspicious. The callers knew the right words. They sounded like colleagues. Within hours, the attackers had access to Twitter’s internal admin panel. By the afternoon of July 15, they were posting Bitcoin scam messages from the verified accounts of the most recognisable people on the planet. They made $120,000 in Bitcoin before Twitter’s engineers could lock down posting entirely. Clark was arrested weeks later. He was 17. There was no malware. No exploited server vulnerability. No sophisticated technical attack. Just a phone call, some research, and an understanding of how people make decisions under pressure. The short answer. Social engineering is manipulating a person into an action they wouldn’t otherwise take, usually to hand over credentials, money, or access. It works through documented psychology, not code: authority, urgency and fear, pretexting, reciprocity, liking, social proof, and consistency. The tells are consistent. You feel rushed, you feel scared, or someone asks you to skip normal process. The one defense that reliably works is verification through an independent channel. Hang up and call back on a number you find yourself, before you comply with any request involving credentials, money, or remote access. What social engineering actually is</h2> The phrase “hacking humans” gets used a lot, and it’s both accurate and slightly misleading. It’s accurate in the sense that social engineering does exploit people rather than software. It’s misleading because it implies something vague and instinctive — like con artistry that works through natural charm. Social engineering in practice is more systematic than that. It’s the deliberate application of documented psychological principles to get someone to take an action they otherwise wouldn’t. The principles aren’t secret. Most of them were catalogued publicly in 1984, when a psychology professor named Robert Cialdini published a book called Influence: The Psychology of Persuasion. Cialdini wrote the book to explain how marketers, salespeople, and advertisers get people to say yes. He identified six core principles — authority, social proof, scarcity, reciprocity, liking, and commitment/consistency — that reliably override critical judgment and produce compliance. The book was an academic contribution to consumer psychology. Attackers use it as a manual. Scattered Spider, the English-speaking hacker collective responsible for the 2023 MGM Resorts attack, were fluent in all six principles. So was the teenager who compromised Twitter in 2020. So is the person who will call your company’s help desk next month pretending to be an employee locked out of their account before an important presentation. Understanding what these principles are and how they work on you is the only meaningful defense. Authority: the principle attackers use most</h2> This principle has a long research pedigree. Forty years before Graham Clark called Twitter employees, a Yale psychologist named Stanley Milgram ran a series of experiments. They disturbed everyone who studied them. Milgram told volunteers they were participating in a study on learning and memory. He put them in a room with an authority figure, a man in a lab coat. He told them to administer electric shocks to a subject in an adjoining room whenever that subject answered a question incorrectly. The shocks weren’t real, but the volunteers didn’t know that. They could hear what sounded like escalating screams through the wall. Milgram wanted to know how far ordinary people would go when instructed by an authority figure. The answer disturbed him. In his original 1961 study, about 65% of subjects administered what they believed to be the maximum shock of 450 volts. They did it simply because the man in the lab coat told them to continue. They were visibly distressed. They wanted to stop. But the authority said keep going, and most of them did. Social engineering runs on this mechanism. Picture a caller who tells a help desk representative three things. They’re from corporate IT. A security incident is in progress. And they need an account reset immediately. That caller is triggering the Milgram effect. The authority doesn’t need to be real. It just needs to feel plausible. “Microsoft Support,” “your bank’s fraud department,” “the IRS,” “a senior manager from regional leadership”: none of these claims require verification to produce compliance. We are socially conditioned to treat perceived authority as sufficient grounds for action. In September 2023, Scattered Spider called MGM Resorts International’s IT help desk. The callers were young — mostly teenagers and people in their early twenties, British and American, none of them professional criminals in any traditional sense. They impersonated MGM employees, claimed they were locked out of their accounts, and used enough internal-sounding language to be convincing. Help desk staff reset their credentials. Those credentials gave the attackers access to MGM’s systems, from which they deployed ransomware and disrupted hotel and casino operations across the country. MGM’s reported losses were approximately $100 million. The authority wasn’t real. The compliance was. Urgency and fear: bypassing your own judgment</h2> Your brain has two roughly competing systems for decision-making. One is slow, deliberate, and analytical — it considers options, weighs risks, and notices when something doesn’t add up. The other is fast, instinctive, and emotional — it reacts to immediate threats and gets you moving before you’ve finished thinking. Urgency activates the fast system and suppresses the slow one. This is adaptive: if a car is swerving toward you, you don’t want to be running a risk analysis. You want your body moving before your conscious mind has processed the situation. Attackers engineer urgency deliberately because they know what it does to judgment. “Your account will be suspended in 24 hours.” “We’ve detected suspicious activity and need to verify your identity immediately.” “There is an active warrant for your arrest.” “Your computer is infected and the damage is spreading right now.” None of these statements are true. But the fear response they trigger is real, and once fear is active, your capacity for critical evaluation drops substantially. A person deciding whether to comply with a request in 30 seconds makes very different decisions than a person who takes 30 minutes to verify. The IRS phone scam is a clean example. Callers impersonating IRS agents tell targets that they owe back taxes. Pay immediately or face arrest, they say. Payment is typically demanded via gift cards, wire transfer, or cryptocurrency. The IRS does not call people at home and demand immediate payment. The IRS sends letters. But the combination of fear (arrest), authority (federal agency), and urgency (right now, today) is powerful enough that thousands of people comply every year. The FBI’s Internet Crime Complaint Center reported that government impersonation scams caused losses of over $650 million in the United States in 2023. The signal to look for is the one you’re trying not to notice. When you feel rushed, when you feel scared, when you feel you must act now or something terrible will happen: that is precisely when you should slow down. Urgency engineered by someone asking for your credentials or money is not a reason to act faster. It is a reason to stop. Pretexting: building the story that makes the ask feel natural</h2> A pretext is a constructed backstory that frames a request in a way that makes it feel normal. It explains who the caller is, why they’re asking, and why the unusual nature of the request is perfectly reasonable under the circumstances. “Hi, this is James from the IT security team. I know this is a bit unusual, but we’ve had an incident on the network and we’re doing emergency credential verification for anyone who accessed the VPN in the last 48 hours. I’ve got you on the list — can you confirm your current password so I can verify you weren’t affected?” That’s a pretext. It creates an identity (IT security team), a situation (network incident), a reason the request is legitimate (verification), and a reason the request needs to happen right now (emergency). The pretext also does something subtler: it makes the target feel helpful rather than victimized. You’re not giving away your password. You’re participating in an incident response. You’re doing the right thing by cooperating with IT. Scattered Spider built pretexts by researching targets on LinkedIn before calling. They knew which tools the company used, which departments existed, what internal processes looked like. That knowledge made their pretexts convincing enough to work even on people who would have been skeptical of a less informed caller. In a separate 2022 incident, Scattered Spider targeted Okta, the identity management company, using a pretext about being locked out of a Sams Club account and needing help resetting access. The pretext got them far enough that Okta later issued a public statement acknowledging the incident. The attackers weren’t technical geniuses. They were good at building stories. Reciprocity: the obligation they create before the ask</h2> Cialdini’s research on reciprocity documented something uncomfortable: people feel strongly compelled to return favors, even small ones, even unsolicited ones. If someone does something for you — anything — you feel a social obligation that is genuinely difficult to ignore. This is the mechanism behind supermarket free samples and unsolicited gifts from charities. It’s also the guilt you feel when someone holds a door open and you don’t say thank you fast enough. Social engineers exploit this by helping you before they ask for anything. The support call that starts by resolving your problem — a fake problem they manufactured, or a real inconvenience they’re now “fixing” for you — is building a debt. By the time the ask comes, you feel obligated. You’ve already accepted something from them. You owe them. This is the mechanism behind many long-form fraud operations. Pig butchering</a> scams, to use the ugly but accurate name, involve months of relationship-building, usually over messaging apps, before any financial ask appears. The fraudster invests genuine time and apparent care. They ask about your life. They remember details from previous conversations. They send thoughtful messages. They seem to like you. By the time the conversation turns to a cryptocurrency investment platform they’ve apparently been doing very well with, you feel you know this person. They’ve invested in you. And you feel, without quite being able to articulate why, that you’d like to give something back. Liking and social proof: the less obvious ones</h2> People comply more readily with requests from people they like. This is so obvious it sounds trivial, but it has real operational implications for social engineering. Attackers who research their targets learn what they can about preferences, interests, and social connections. They note the college you went to (LinkedIn), the sports team you follow (Twitter activity), the mutual connections you share. In a call or a message, finding common ground — “Oh, you went to Michigan? My sister actually went there” — creates a warmth that lowers guard. It seems irrational. It is irrational. It works anyway. Social proof is subtler still. Cialdini identified it as the principle by which people look to the behavior of others to decide what’s appropriate in unfamiliar situations. “Everyone on the team has already verified their credentials — you’re the last one on the list” isn’t just urgency. It’s social proof. It implies that compliance is the normal, reasonable, collectively endorsed action, and that refusing would be the aberration. In a phishing context, social proof shows up as apparent legitimacy signals — the professional logo, the formal language, the signature block that matches real company communications. None of these things indicate that an email is authentic. They indicate that it looks like what authentic emails look like. That triggers social proof reasoning: this looks like what I’d expect from a real communication, so it probably is one. Commitment and consistency: the series of small yeses</h2> Once you say yes to something small, you’re more likely to say yes to something larger and related. This is the foot-in-the-door effect. It works because people are motivated by consistency. We want our actions to align with our stated positions and our previous decisions. Having agreed once, we feel a quiet internal pressure to keep agreeing. Refusal would require admitting that we shouldn’t have agreed the first time. Attackers use this across extended fraud operations. The first request is small and harmless — a piece of information that seems innocuous, a minor favor, a quick verification step. Each subsequent request escalates slightly. By the time the ask is significant, the target has already said yes to ten preceding requests and the eleventh feels like a continuation rather than a violation. The same principle runs in reverse when attackers pressure help desk staff. A support worker who has already confirmed your name and employee ID to a caller has made two small commitments to the interaction being legitimate. When the request for a password reset comes, reversing course means implicitly accepting that the preceding confirmations were a mistake. Consistency pressure makes that difficult. Kevin Mitnick and Frank Abagnale: the human side of the record</h2> No discussion of social engineering is complete without Kevin Mitnick. He spent much of the 1990s as the FBI’s most wanted computer hacker. In interviews he was consistently clear that most of his successful intrusions relied more on social engineering than on technical exploitation. He would call company employees, pose as co-workers, and extract internal phone numbers and department structures. He then used that information to build more convincing pretexts for the next call. His autobiography, The Art of Deception, is an operational guide to the discipline. Frank Abagnale is often cited in the same breath. He is the con man portrayed in the 2002 film Catch Me If You Can, and his story merits a brief note. Abagnale’s claimed exploits (impersonating a Pan Am pilot, a doctor, a lawyer) have been substantially disputed by journalists and researchers in recent years, with some reporting suggesting significant fabrication. The FBI agent portrayed in the film, Joseph Shea, has disputed the narrative. Abagnale himself has continued to claim the exploits were real. The historical record is genuinely unclear, and treating him as an authority on social engineering should be done with that uncertainty in mind. Mitnick, by contrast, was prosecuted, imprisoned, and documented. His techniques were real. His testimony is credible. And the specific methods he described are the same ones Scattered Spider used thirty years later against some of the largest companies in the world. That is, researching targets, building pretexts, and using each successful call to make the next one more plausible. The techniques don’t change because the underlying psychology doesn’t change. The vishing advantage: why voice works better than text</h2> Most phishing training focuses on email. Email phishing is common and important. But voice phishing — vishing — is significantly more effective per contact because it introduces elements that text cannot replicate. A voice creates immediate rapport. It communicates emotion, urgency, and confidence in real time. A caller who sounds calm, professional, and slightly impatient, as though dealing with an annoying but routine process, communicates authority signals that a text message simply cannot carry. And crucially, voice creates real-time pressure that text doesn’t. You can think about an email for a few minutes. A caller is waiting. Researchers studying accent perception have found that English-speaking targets perceive certain accents as more authoritative and less threatening in specific contexts. Some social engineering groups appear to exploit this deliberately, selecting callers for particular targets based on accent and register. Scattered Spider’s documented call recordings show callers who are fluent, unhurried, and professionally plausible. The other vishing advantage is that it’s difficult to verify in real time. You can hover over a link in an email. You can look at a sender address. On a call, the verification options are limited. You could hang up and call back, but that feels socially awkward and implies you think the person is lying. It also takes presence of mind to do in the moment rather than after. Most people don’t hang up. How to know when it’s happening to you</h2> The tells are consistent across attack types, even when the specific pretext varies. You feel urgency. Something is happening right now, and you need to act before you can think. This is the single most reliable signal that someone is attempting to manipulate you. Urgency is the attacker’s best friend and your most important warning sign. You feel fear. Arrest, account suspension, financial loss, embarrassment — whatever the stakes are, they’re being communicated as immediate and serious. Fear and urgency work together. When you notice both simultaneously, you should be more skeptical, not less. Someone is asking you to bypass normal process. The normal process for resetting credentials requires ticket submission, manager approval, and second-factor verification. But this is an emergency, they say, there’s no time, and they just need you to do it directly. Any request to skip the verification steps that exist specifically to prevent unauthorized access should be treated as a serious red flag. Something feels slightly off and you can’t say what. This intuitive sense of wrongness is worth trusting. You may not be able to articulate why something doesn’t seem right, but your pattern-matching intuition has noticed a discrepancy that your conscious mind hasn’t surfaced yet. The right response is to slow down and verify, not to override the sense of wrongness because you can’t justify it formally. Verification: the one countermeasure that actually works</h2> Security awareness training often teaches people to “be suspicious” of unusual requests. This is reasonable advice that produces almost no behavioral change in practice, because the whole point of social engineering is that requests feel usual rather than unusual. The authority is plausible. The pretext is convincing. The urgency is real. Being generally suspicious doesn’t help when someone has done their research. The countermeasure that actually works is specific: verify through an independent channel before complying with any request involving credentials, money, or remote access. Hang up and call back. Not on the number the caller gave you. Use the number you find yourself, from the company’s official website, the back of a card, or an internal directory you access independently. If the situation was real, the legitimate caller will be fine with this. They’ll accept a brief delay while you verify. If they resist, that resistance is itself evidence of bad intent. Watch for pushback lines. Common ones: “there’s no time,” “calling back would compromise the investigation,” or “you’re creating a problem by following protocol.” A legitimate company’s IT department accepts callbacks as standard procedure. A legitimate bank’s fraud team accepts callbacks as standard procedure. A legitimate HR department accepts callbacks as standard procedure. The only callers who resist verification are the ones who can’t survive it. How organisations fail at this</h2> The problem with help desk social engineering isn’t that the people who answer the phone are naive. It’s that the organisations they work for have built processes that trade security for customer convenience, and then extended that same convenience-optimised process to internal support. Password resets over the phone are a default service in many organisations. The verification step — confirming identity before resetting — is often minimal: a name, an employee ID, maybe a manager’s name. All of that information is available on LinkedIn. All of it can be assembled in 20 minutes by someone who knows where to look. The MGM help desk workers who reset Scattered Spider’s requested credentials weren’t failing at their jobs in any obvious way. They followed process. The process was the vulnerability. Organisational defenses that actually work are structural, not just educational. They include vishing-resistant policies: no credential resets over the phone without a second verification channel the caller cannot control. They also include incident-reporting cultures that treat near-misses as valuable information rather than embarrassments to be quietly buried. A culture where employees are punished for reporting that they almost fell for something is a culture where the same attack will eventually succeed undetected. The most effective security awareness training is based on real attack scenarios. Not generic advice about being careful, but actual recordings, transcripts, and examples of the calls that compromised real companies. That is meaningfully more effective than generic phishing awareness. Hearing what a Scattered Spider vishing call actually sounds like produces a different kind of recognition than being told that attackers sometimes pretend to be from IT. The insider dimension</h2> One aspect of the Twitter 2020 hack received less attention than the social engineering angle. That was the possibility that some employees were directly bribed rather than simply deceived. Court documents and subsequent reporting suggested that at least one Twitter employee with internal access may have been deliberately recruited rather than manipulated. The investigation named a UK national who allegedly used his Twitter access to provide information about specific account holders. This matters because it points to a different kind of insider threat. Social engineering typically focuses on making external attackers appear to be insiders. But sometimes the attacker IS an insider, or recruits one. An employee approached with a financial offer, a personal threat, or an appeal to ideology presents a different threat model than an employee deceived by a convincing pretext. The defenses are correspondingly different. Access controls, privilege minimisation, and behavioural monitoring address the insider threat in ways that security awareness training cannot. The principle of least privilege means giving employees access only to what they need for their specific role. It limits the blast radius when any single insider, deceived or deliberate, is compromised. What you should do</h2> For individuals: the most important personal defense is a simple rule. Any request involving your credentials, a wire transfer, gift card purchase, or remote access to your device gets verified through an independent channel before you act. Not after. Before. The urgency will feel real. The authority will feel real. The story will make sense. Act anyway — make the independent verification call, look up the number yourself, take the five minutes to confirm. If everything was legitimate, you’ve lost five minutes. If it wasn’t, you’ve stopped an attack that might otherwise have cost you thousands of pounds, thousands of dollars, or years of account recovery. For the credentials and accounts that matter most, enable the strongest available multi-factor authentication and keep recovery contact information current. That means email, banking, and anything tied to your financial life. Understand that even 2FA can be bypassed. A well-timed social engineering call may ask you to read your authentication code to a “support representative.” Never do that. Your authentication code is not something you read to anyone, ever, for any reason. The fundamental insight is simple. Social engineering works by exploiting the psychological mechanisms that make you a functional human being. It targets your respect for authority and your responsiveness to urgency. It targets your desire to be helpful and your sense of social obligation. These are not weaknesses you should try to eliminate. They’re traits that being socially engineered can exploit, but that understanding can protect. You don’t need to stop trusting people. You need a simple habit of verification that runs parallel to that trust, activated whenever the stakes are real. Slow down. Verify. Call back on the number you found yourself. A legitimate caller will wait. Your personal information — your name, home address, employer, phone number, and email address — is almost certainly listed on data broker sites right now. That’s the raw material that makes social engineering attacks convincing. See what a scan finds →</a> walks through an example report of the kinds of sites that list your name, phone, and address. Once KnytX Shield launches it will find and remove these listings automatically. Join the waitlist</a> to get in early. The Complete Guide to Managing Your Google Privacy Unknown — Sun, 26 Apr 2026 00:00:00 +0000 What Google actually knows about you</h2> Every search you’ve typed since you created your account. Every YouTube video you’ve watched, every query you’ve searched on it. Your location — everywhere your phone has been, including when you thought location was off. Your voice recordings from Google Assistant and every “OK Google” command you’ve ever said out loud. The contents of your Gmail. Every app you’ve installed on Android. Your contact list. Your calendar. Which ads you clicked last Tuesday. Google is not trying to be the villain. It built the most useful set of tools in the history of consumer software. It paid for that by becoming the most comprehensive private data collector in human history. Over 4 billion people use Google products. Google My Activity (myactivity.google.com) holds a timestamped log of almost everything you’ve done across Search, Maps, YouTube, Chrome, and a dozen other services. Your ad profile is worth visiting at least once. Google has inferred your approximate age, gender, household income bracket, relationship status, and a detailed list of your interests — parenting, technology, travel, fitness, financial services. You can see all of it. Most people have never looked. This guide walks through each piece, where to find it, and what you can actually do about it. The Google Account data dashboard</h2> Open myaccount.google.com in a browser right now. This is the central hub for your Google data. Everything branches from here. The four sections worth knowing: My Activity links to myactivity.google.com — a full chronological log of your activity across Google services. Search queries, YouTube views, Maps navigation, Assistant commands. All of it, with timestamps. You can filter by product, search within it, and delete individual entries or everything. If you have had a Google account for more than a few years, the depth of this log is worth seeing at least once. Data & Privacy is where activity controls live. You can pause or delete Web & App Activity, Location History, and YouTube History from one place. Auto-delete settings are here too. This is the section most worth spending time in. Ad settings links to adssettings.google.com — your ad profile. This is the one most people skip. Don’t. Privacy Checkup walks you through the major settings in a guided flow. If you want a structured review rather than clicking around, start here. It takes about five minutes and touches the most important controls: activity saving, location, ad personalization, and account sharing. One thing to note before you start: some settings are account-level (they apply wherever you’re signed in) and some are device-level (set on each phone or computer separately). The dashboard covers the account-level settings. Device permissions — camera, microphone, location for specific apps — are handled on the device itself. Search and YouTube history: how to manage it</h2> Go to myactivity.google.com. By default, you’re looking at everything — searches, YouTube views, Maps lookups, app activity — in one combined feed. To delete specific entries: click the three dots next to any item and select “Delete.” To delete everything: click “Delete” in the top menu, then “All time.” The more useful option is Activity Controls — myaccount.google.com > Data & Privacy > Web & App Activity. Here you can: Pause Web & App Activity entirely (Google stops logging new activity)</li> Enable auto-delete — set it to 3 months, 18 months, or 36 months</li> </ol> Auto-delete at 3 months is the right call for most people. Your recent search context still works; your history from years ago stops sitting in a database indefinitely. One thing to be clear about: browsing in Incognito does not save to your Google account. But it does not hide your activity from Google’s servers when you use Google Search, from your internet service provider, or from your employer’s network. Incognito is account-isolation, not anonymity. Location history: the one that surprises people</h2> Go to maps.google.com/maps/timeline. This is Google’s Timeline — a map showing everywhere you’ve been, often with the names of places you visited, commute routes, and travel dates. It is, for most people who have used Android for years, genuinely startling. To delete location history: in Timeline settings, select “Delete all Location History.” To turn off new collection: Google Account > Data & Privacy > Location History — or on Android, Settings > Location > Google Location Accuracy (device-level). Here’s the honest part: turning off Location History stops the Timeline. It does not stop Google from inferring your approximate location through your IP address, nearby Wi-Fi networks, and cell tower data. These signals feed into services like local search results and weather without requiring Location History to be on. The setting matters and is worth changing. But “off” means Timeline stops — not that location becomes invisible. One more thing worth doing: in Maps settings, you can delete specific days or trips from your Timeline rather than wiping the entire history. If you want to keep the useful parts (international trips you want to remember) while removing everyday commutes and sensitive locations, you can delete selectively. In Timeline, tap any day and hit the trash icon for that entry. Gmail: what Google does with your email</h2> Google stopped automatically scanning Gmail messages for ad targeting in 2017. The more immediate issue is third-party app access — the apps and services you’ve connected to your Gmail account over the years. Go to myaccount.google.com > Security > Third-party apps with account access. You will almost certainly find apps you forgot about. A travel app from 2019. A newsletter tool. A job application service. A calendar integration that’s been reading your email for four years. Revoke anything you don’t actively use. Third-party apps with Gmail access can read your email content. Many do. This is not theoretical — it’s the access you granted when you clicked “Sign in with Google” and approved mail permissions. A 2018 Wall Street Journal investigation found that hundreds of third-party app developers were reading Gmail messages. The permissions system hasn’t fundamentally changed since then. Also in Gmail settings: Smart features. Gmail uses your email content to power Smart Reply, Smart Compose, and other inline suggestions. These features work by analyzing your incoming and outgoing messages. You can turn them off under Gmail Settings > General > Smart features and personalization > turn off. There’s a second toggle for stopping that data from being shared with other Google products — turn that off too. Neither change affects the email you’ve already sent or received. They stop new content from being used going forward. Your Google ad profile</h2> Visit adssettings.google.com. Log in if you aren’t already. You’ll see what Google believes about you: your estimated age range, gender, and a detailed list of interest categories it has inferred from your activity. Home improvement. Fitness. Travel. Financial planning. Business software. The list runs long. You can edit any of these categories — click one and turn it off. You can also toggle Ad personalization entirely. Be clear on what this does and doesn’t do: turning off ad personalization stops Google from using your stored data to target ads to you specifically. It does not stop Google from collecting your activity data. It does not make the ads disappear. You’ll still see ads — they’ll just be less specifically targeted because your profile isn’t being applied. For some people this is the right trade. Know what you’re changing. Android: the permissions audit</h2> Open Settings > Privacy > Permission Manager on your Android device. This shows every permission category — camera, microphone, location, contacts, storage, phone — and which apps have access to each. Do a pass through each category. Ask one question about each app listed: does this app actually need this permission to do its core function? A flashlight app with microphone access: revoke. A food delivery app with contacts access: revoke. A game with location access set to “Always”: change to “Only while using” at minimum. A weather app that wants “precise” location when “approximate” location would serve it fine: downgrade it. For location specifically, Android gives you three options for most apps: “Allow all the time,” “Only while using the app,” and “Don’t allow.” Set anything that doesn’t genuinely need background location to “Only while using the app.” That covers fitness trackers and maps apps while navigating. Background location access means the app can request your location even when it’s not open. The Play Store’s Data safety section shows each app’s self-reported data collection practices — what data they collect, whether it’s shared with third parties, whether it’s used for tracking. Navigate to any app’s Play Store page and scroll to “Data safety.” The disclosures are self-reported, and Google does not independently verify them. Even so, they give you a baseline sense of what an app is doing with your information. Do the permissions audit now. It takes 10 minutes and the changes take effect immediately. No reboot needed, no app reinstallation — the permissions are revoked the moment you change them. Reducing your Google footprint without leaving Google</h2> Most people will not leave Google. The ecosystem is genuinely useful and the switching cost is high — 1.8 billion Gmail users aren’t moving to Proton overnight. That’s fine. You can reduce your exposure significantly while staying inside Google’s products. Practical steps that work: Use DuckDuckGo (duckduckgo.com) or Brave Search (search.brave.com) for everyday browsing. Fall back to Google only when results are genuinely better. This keeps most of your search history out of your Google account entirely.</li> Sign out of your Google account when browsing sites unrelated to Google services. Google has tracking pixels and analytics scripts embedded across a large share of the web — being logged in means those touches get tied to your account profile.</li> Install uBlock Origin on Firefox. Google’s tracker network — Google Analytics, Google Tag Manager, DoubleClick — is embedded across millions of third-party sites. Blocking these scripts stops Google from building a profile of your off-Google browsing behavior.</li> Set Web & App Activity to auto-delete at 3 months. Pause Location History. These two changes alone shrink the amount of stored history significantly over time.</li> Review third-party app access to your Google account once a year. It takes five minutes. Revoke anything you don’t recognize or no longer use.</li> </ul> These are not dramatic changes. None of them require leaving Google’s ecosystem or switching browsers permanently. They meaningfully reduce the scope of what gets stored about you without disrupting how you work day to day. If you want to leave Google</h2> This is a bigger move and worth taking seriously before starting. First: export your data. Google Takeout at takeout.google.com lets you download everything — Gmail, Drive, Photos, Contacts, Calendar, all of it. Do this before changing anything. The export can take hours for large accounts, but you’ll have your data. Practical alternatives by category: Email: Proton Mail (proton.me) — end-to-end encrypted, based in Switzerland, free tier available</li> Search: Brave Search (search.brave.com) or DuckDuckGo (duckduckgo.com) — no search history stored</li> Navigation: Apple Maps (iOS/macOS) or OsmAnd (Android/iOS, uses OpenStreetMap data)</li> Calendar: Proton Calendar — encrypted, integrates with Proton Mail</li> Cloud storage: Proton Drive or local storage with Syncthing</li> </ul> Switching email is the hardest part — you’ve used that Gmail address for years and it’s on thousands of accounts. The practical approach is to start a new email, update your most important accounts (banking, healthcare, primary services), and let the old Gmail account quietly drain over 6–12 months. Trying to switch everything in a week doesn’t work. Google is not going anywhere. Leaving is one option. Reducing is another. Both are better than doing nothing. One setting this guide doesn’t cover in depth: whether Google uses your Gemini conversations to train its AI. It does, by default, on personal accounts. Our guide to opting out of AI training</a> shows exactly where to turn that off, along with the same setting at every other major company. And the personal details Google holds often show up on people-search brokers too, like Whitepages</a>, which resell your name and address. What you can do right now</h2> Want to see what data brokers expose about you? See what a scan finds →</a> shows an example report: the kinds of sites that list your name, phone, and address. Once KnytX Shield launches it will find and remove these automatically. Join the waitlist</a> to get in early. VPNs: What They Do and What They Don't Unknown — Sat, 25 Apr 2026 00:00:00 +0000 “A hacker at your local coffee shop can see everything you’re doing online.” You’ve seen this line in VPN ads. There’s a hooded figure with a laptop. There’s a sense of imminent danger every time you connect to public Wi-Fi. The VPN is the only thing standing between you and disaster. This is, in 2026, almost entirely a marketing invention. Here’s what’s actually happening. What the VPN ad is selling you</h2> The VPN industry is worth around $50 billion globally and growing fast. That money comes from convincing people they’re under active threat. The “hacker at Starbucks” scenario — a man-in-the-middle attack on public Wi-Fi — was a real concern in the early 2010s. It is largely irrelevant now. The reason: HTTPS. In 2026, roughly 95% of web traffic is encrypted at the application layer. When you load your bank’s website, Gmail, Amazon, or any major service, your browser negotiates an encrypted connection directly with that server. Your ISP can see you’re talking to google.com. They cannot read what you typed or what came back. Neither can the person at the next table. The danger VPN companies sell doesn’t match the threat landscape that actually exists. What a VPN actually does</h2> A VPN is genuinely useful for four things, and you should know all four before deciding whether to pay for one. First: ISP privacy. Your internet provider can see which domains you visit (even with HTTPS). They sell this data in many countries, or hand it to governments on request. A VPN routes your traffic through the VPN provider’s server — your ISP sees encrypted traffic going to one address, not a list of every site you visited. Second: IP masking. Websites you visit see the VPN server’s IP address, not yours. This makes it harder for sites to tie your visits together based on IP and harder for them to geolocate you precisely. Third: Geo-restrictions. Connect to a server in another country and services think you’re there. This is how people access streaming libraries not available in their region. It works. Fourth: there is a real but narrow benefit on public Wi-Fi — specifically, protecting against the small number of cases where someone is intercepting HTTP (non-HTTPS) traffic. It’s rare. But if you use apps that don’t use HTTPS properly, a VPN adds a layer. (The better fix is to stop using those apps.) What a VPN doesn’t do</h2> This is the part the ad skips. A VPN does not stop Google or Facebook from tracking you when you’re signed in. These platforms know who you are — not from your IP, but from your account. Log into Gmail through a Mullvad VPN and Google still logs exactly what you do. The VPN is irrelevant to them. A VPN does not stop tracker pixels from loading. Those tiny invisible images in emails and on websites phone home when they load, telling the sender that you opened something and where you roughly are. A content blocker like uBlock Origin stops this. A VPN doesn’t. A VPN does not protect you from browser fingerprinting — websites identify your browser by its unique combination of fonts, screen size, and plugins. That fingerprint persists across sessions. A VPN changes your IP. Your fingerprint stays the same. A VPN does not make you anonymous. This is important. You are now trusting the VPN provider instead of your ISP. If the VPN provider logs your traffic — or gets a court order they comply with — they can identify you. Some VPN companies that claim “no logs” have produced user logs when pressed. And a VPN does nothing against phishing, malware, or data breaches. If you click a bad link or your credentials leak from a database, a VPN was never relevant. The public Wi-Fi reality check</h2> Your bank uses HTTPS. Gmail uses HTTPS. Instagram, your work email, Spotify, YouTube — all HTTPS. When you open your banking app at an airport, your connection is already encrypted end-to-end between your app and the bank’s servers. Adding a VPN adds a second layer of encryption on top of an already-encrypted connection. The marginal security benefit on public Wi-Fi in 2026 is small. The VPN industry needs you not to know this. What is a real risk on public Wi-Fi: captive portals — those browser pages where you click “agree to terms” before you get access. These load over HTTP and have occasionally been used to inject ads or malware. The other real risk is apps that don’t implement HTTPS properly, which still happens with some niche software. When a VPN is genuinely worth using</h2> There are clear situations where a VPN provides real protection. If you’re a journalist, activist, or researcher in a country with surveillance infrastructure, hiding your browsing from your ISP matters. Governments that monitor internet traffic at the ISP level can build cases from browsing patterns alone. A trustworthy VPN meaningfully reduces that exposure. If your ISP throttles streaming based on traffic inspection (some do), a VPN hides the content type and restores normal speeds. If you regularly travel internationally and need access to geo-restricted services at home, it works cleanly for that too. For everyday consumer privacy in a country without aggressive ISP surveillance? The benefit is modest. Worth $5/month if you’re privacy-conscious. Not the essential life-safety tool the ads suggest. How to choose a VPN that doesn’t spy on you</h2> The free VPN category is almost entirely compromised. Free VPN providers need revenue. Their product is your browsing data. You’re solving a privacy problem by creating an identical privacy problem, just with a different company you know less about. Three providers have independently audited no-logs policies and transparent ownership: Mullvad — no account required (you get an account number, no email attached), accepts cash, multiple security audits. They can’t hand over what they don’t collect. ProtonVPN — open source clients, audited no-logs policy, based in Switzerland. Run by the ProtonMail team. IVPN — smaller, privacy-focused, audited, no dark-pattern pricing. “No logs” means the provider doesn’t record which sites you visit. Ask what an audit actually covered before trusting the claim — some audits only verify internal processes, not whether logs can be generated at all. Avoid any VPN with opaque ownership or one that has “partnered with” analytics companies. Free VPNs monetize your traffic data. That’s exactly what you’re trying to avoid. What you can do right now</h2> Want to see what data brokers expose about you? See what a scan finds →</a> shows an example report: the kinds of sites that list your name, phone, and address. Once KnytX Shield launches it will find and remove these automatically. Join the waitlist</a> to get in early. iPhone Privacy Settings: The Complete Audit for 2026 Unknown — Fri, 24 Apr 2026 00:00:00 +0000 You turn on App Privacy Report for the first time and leave it running for a week. Then you look at what it captured. A shopping app you downloaded during a sale three months ago has pinged your location 87 times. Twice at 3am. A camera app you haven’t opened since February accessed your microphone 12 times. A flashlight app — a flashlight app — contacted 14 different network domains in the past seven days. None of this sent you a notification. None of it asked permission again. You granted access once during setup, half-reading the dialog box, and that was enough. This is what your iPhone has been doing in the background. Not because something is broken. Because you never changed the defaults. The short answer: Apple builds strong privacy tools, but most are off or half-on by default. The five-minute wins: turn off “Allow Apps to Request to Track,” move every app’s location to “While Using” and disable Precise Location where it isn’t needed, turn off Significant Locations, and enable Advanced Data Protection so Apple can’t read your iCloud backup. Then switch on App Privacy Report and check it in a week. All of this lives in Settings > Privacy & Security. Jump to: Why defaults matter</a> · Location Services</a> · Tracking</a> · App permissions</a> · Apple’s own data collection</a> · iCloud and Advanced Data Protection</a> · Lock Screen and passcode</a> · Safari</a> · App Privacy Report</a> · The three changes that matter most</a> Why defaults are the whole argument</h2> Apple’s privacy marketing is everywhere — billboard-sized posters at airports, the “Privacy. That’s iPhone.” campaign, the App Store privacy nutrition labels. And Apple has made genuinely meaningful choices that distinguish the iPhone from Android in real, measurable ways. App Tracking Transparency changed the economics of mobile advertising. Safari’s Intelligent Tracking Prevention is ahead of Chrome’s approach by years. Advanced Data Protection, if you enable it, gives you encryption that Apple itself cannot break. But “privacy-focused company” and “privacy-maximized by default” are different claims, and Apple only makes the first one. The defaults on a new iPhone let apps request location always — including in the background, while you’re asleep. They let apps ask to track you across other companies’ apps and websites. They send analytics data to Apple. They let Siri learn from your usage and surface that learning across apps you haven’t opened. They back up your data to iCloud in a form that Apple can technically read and produce in response to law enforcement requests. Most people never revisit their settings after initial setup. A 2023 Pew Research study found that fewer than one in five smartphone users regularly review app permissions. Apple’s defaults are the settings nearly everyone is running. And some of those defaults weren’t chosen with your privacy as the first priority. This guide walks through every setting that matters. Not every setting — some are genuinely minor — but everything that makes a real difference. We’ll tell you which changes are high impact and which are marginal, so you can spend five focused minutes instead of thirty scattered ones. Location Services</h2> Go to Settings > Privacy & Security > Location Services. This is the single most impactful section for most people. Location data is extraordinarily sensitive — your location history over time reveals your home, your workplace, your doctor, your places of worship, who you meet with and how often. It is among the most sought-after data types in the data broker ecosystem, and it flows off your phone through more channels than most people realize. Each app in the list has one of four options: Never, Ask Next Time or When I Share, While Using the App, and Always. The difference between “While Using” and “Always” isn’t cosmetic. “While Using” means the app can only access your location when it’s open on your screen, or within a few seconds of you switching away from it. “Always” means the app can ping your location in the background — while you’re asleep, while you’re on another app, any time it wants. Very few apps have a genuine reason to need your location at 3am. That shopping app does not. Work through the list and move everything to “While Using” at minimum. For apps that don’t need location at all — a flashlight, a calculator, a recipe app — switch them to Never. You’ll likely be surprised how many apps have “Always” access that you never consciously granted. Below the app list, look for the Precise Location toggle inside each app’s entry. This was added in iOS 14 and it’s one of the most underused controls on the phone. When Precise Location is off, the app receives only a general area — roughly one to two miles — rather than your exact GPS coordinates. For a restaurant discovery app, a general area is all it needs to show you nearby results. For a weather app, your neighborhood is sufficient. For a delivery app during an active order, you might want precision on. For everything else, turning it off costs you nothing and removes your exact home address from the data stream. Scroll down past all the apps to System Services. This is where Apple’s own location access lives, and it contains one entry that catches almost everyone off guard: Significant Locations. Significant Locations is a feature that stores a history of places you’ve visited frequently — your home, your workplace, your gym, the hospital you visited twice last month. Apple uses this to power Siri suggestions and features like “Time to leave” notifications. The data lives on your device and, Apple says, is end-to-end encrypted in iCloud. But you may not want your iPhone building and maintaining a movement diary regardless. To disable it: Settings > Privacy & Security > Location Services > System Services > Significant Locations. Toggle it off and clear the history. Also in System Services: Location-Based Apple Ads (off), iPhone Analytics (off), and Routing & Traffic (your call; this one contributes anonymized data to Apple Maps, which is relatively low risk). As of iOS 26.3, there’s a newer control worth knowing about: Limit Precise Location for carriers. It lowers the accuracy of the location data your mobile carrier can pull from cell tower networks. That closes a gap that sits outside app-level location permissions entirely. Check your Location Services and carrier settings for it if you’re on iOS 26.3 or later. Tracking</h2> Go to Settings > Privacy & Security > Tracking. App Tracking Transparency — ATT — launched with iOS 14.5 in April 2021, and it was the most disruptive thing to happen to mobile advertising in a decade. When you open an app for the first time after ATT is active, the app can ask permission to track you across other companies’ apps and websites. If you say no, the app doesn’t receive your IDFA — Identifier for Advertisers — a unique code that advertisers use to link your behavior across apps and build profiles. The setting “Allow Apps to Request to Track” controls whether apps are even permitted to show you that prompt. Turn it off, and apps cannot ask. They don’t get the IDFA. Full stop. The impact of this was documented in real financial results. Meta’s earnings call in February 2022 revealed that ATT cost the company approximately $10 billion in revenue in 2021. Within a few months of ATT launching, Apple’s own research showed that 96% of users in the US denied tracking when given the prompt. Opt-in rates have stayed low ever since, in the 15–30% range across app categories as of 2026. Advertisers lost the ability to follow you across apps. Mobile advertising attribution, the system by which marketers know which ad caused which purchase, was significantly disrupted. Turn this off. It is one of the highest-impact privacy settings on the phone. App Permissions</h2> Go to Settings > Privacy & Security, then scroll through the individual permission categories. Camera and Microphone are the ones people worry about most, partly because the worry is visceral and partly because it’s justified. Every app that has camera or microphone access appears in these lists. Review them. Revoke access from anything that doesn’t have an obvious reason to need it. Starting with iOS 14, your iPhone shows a colored dot at the top of the screen when the camera or microphone is active. Orange means the microphone is in use. Green means the camera — or both — is active. This indicator cannot be disabled by apps and is handled at the hardware level. If you see the orange dot appear while you’re not on a call or recording something, an app is using your microphone. You can check which app most recently used it by swiping down to see Control Center immediately — it shows the last app that accessed the microphone. Photos is more complicated than it looks. iOS 14 introduced three tiers of access: Full Access, Selected Photos, and No Access. Full Access means the app can see, read, and in some cases upload every photo on your device. This includes photos with embedded location metadata — where the shot was taken, stored as GPS coordinates in the image file. Selected Photos lets you choose specific images the app can access. No Access blocks it entirely. Go through the Photos list. For social apps, editing apps, and anything where you actively share images, “Selected Photos” is often sufficient — let the app see only what you share with it, not your entire camera roll. Full Access should be reserved for your actual camera replacement app or a backup service you’ve deliberately chosen. A food delivery app or a ride-share app should not have Full Access to your photos. Contacts access is worth a hard look. When you grant an app access to your contacts, you’re not just sharing your own information. You’re sharing the names, phone numbers, email addresses, and in many cases physical addresses of everyone in your address book. Those people haven’t consented to share their data with that app. They didn’t install it. They don’t know. WhatsApp, LinkedIn, and a long list of business and networking apps request contacts access. Some genuinely need it. Others are harvesting your address book to build social graphs, find new users to target, or enrich their advertising data with real relationship networks. Review each app. If you don’t have a clear reason why that app needs your contacts, revoke the access. Apple’s Own Data Collection</h2> Apple collects data from you too. Less than Google, more than they advertise. Go to Settings > Privacy & Security > Analytics & Improvements. Toggle off Share iPhone Analytics. This stops your iPhone from sending usage data, crash logs, and diagnostic information to Apple. If you use Siri, also toggle off Improve Siri & Dictation and Share iCloud Analytics. These control whether recordings of your Siri requests are reviewed by Apple to improve the product. Go to Settings > Privacy & Security > Apple Advertising. Toggle off Personalized Ads. Apple runs advertising in the App Store, Apple News, and the Stocks app. Turning off personalized ads doesn’t make the ads disappear — it just makes them untargeted. Your data is no longer used to select which ads you see. This is a minor improvement given that you’re only changing Apple’s own ad targeting, not the behavior of third-party apps, but it’s a low-effort toggle worth flipping. The more significant Apple-specific settings live under Settings > Siri & Search. Each app in the list has toggles for “Learn from this App,” “Show in Home Screen Search,” “Show in App Library,” and “Suggest App.” When “Learn from this App” is on, Siri builds a model of how you use that app — what you search for, what you tap, what time of day you open it — and uses that model to surface suggestions elsewhere on your phone. This is how Siri learns that you read the news at 7am and preloads Apple News in your suggestions. Whether that feels helpful or invasive depends on your preferences. If you want to limit it: go through the Siri & Search settings, identify apps you don’t want contributing to your Siri profile, and toggle off “Learn from this App” for each one. Also consider: Settings > Siri & Search > Siri Suggestions — the toggles at the top control whether Siri suggestions appear on your Lock Screen, Home Screen, and Search at all. iCloud and Advanced Data Protection</h2> Go to Settings > [Your Name] > iCloud. Your iCloud backup contains almost everything on your phone — messages, photos, contacts, app data, health data, your call history. Apple can read that backup. Apple has provided iCloud backups to law enforcement in response to legal requests, and this is documented in Apple’s own transparency report. In a 2022 report covering the first half of that year, Apple said it received 7,122 device requests from US government agencies and provided data in 82% of them. This changed significantly with Advanced Data Protection, introduced in iOS 16.2 and available on any iPhone running iOS 16.2 or later. To enable it: Settings > [Your Name] > iCloud > Advanced Data Protection. Advanced Data Protection applies end-to-end encryption to iCloud Backups, Photos, Notes, Safari bookmarks, Siri Shortcuts, Wallet passes, and several other data categories. End-to-end encrypted means the encryption keys exist only on your trusted devices — not on Apple’s servers. Apple cannot read your backups. Apple cannot produce them in response to a legal request because Apple doesn’t have the decryption keys. Only you and your trusted devices do. This is the highest-impact privacy setting available on an iPhone. It is not enabled by default. Before you enable it, read the warning Apple shows you carefully. If you lose all your trusted devices and your recovery key, you lose access to your data permanently. Apple cannot help you recover it. Set up a recovery contact (a trusted person who can help you verify your identity) or generate and safely store a recovery key. This is the one setting where the setup process requires a few minutes of actual attention. Three things are deliberately not covered by Advanced Data Protection: iCloud Mail, Contacts, and Calendars. Apple has said these remain outside end-to-end encryption because they need to interoperate with third-party mail, contact, and calendar services using standard protocols. This is a real architectural constraint, not an excuse. If mail privacy is a priority, consider moving to a provider like Proton Mail. Lock Screen and Passcode</h2> Go to Settings > Face ID & Passcode. Scroll down to Allow Access When Locked. This section controls what someone can do with your phone without unlocking it. By default, your iPhone lets people access Notification Center, Control Center, Siri, Reply with Message, and several other features from the lock screen. Depending on your threat model, you may want to restrict this. Notification Center on the lock screen displays message previews, email subjects, app alerts — a significant amount of sensitive information visible to anyone who picks up your phone. Go to Settings > Notifications and look for Show Previews. Changing this to “When Unlocked” means notification content is hidden on the lock screen but visible once you authenticate. “Never” hides it entirely. Control Center on the lock screen lets someone toggle Airplane Mode, which would disconnect your phone from the network. That matters if someone grabs your phone and wants to prevent a remote wipe via Find My. More importantly: your passcode. A six-digit PIN has one million possible combinations. That sounds like a lot until you consider that tools like Cellebrite, which are sold to law enforcement agencies globally, can attempt PIN combinations at speed. US federal courts have seen prosecutions built on iPhone data extracted via these tools. A six-digit PIN is meaningful protection against casual access. Against a dedicated adversary with the right equipment, it is not. An alphanumeric passcode changes the calculus substantially. Go to Settings > Face ID & Passcode > Change Passcode. Tap “Passcode Options” and choose “Custom Alphanumeric Code.” A ten-character passcode mixing letters, numbers, and a symbol is computationally impractical to brute-force with current tools. The tradeoff is slightly more friction when you unlock your phone. For most people, Face ID covers the daily unlock and the longer passcode is only needed after a restart or when Face ID fails. The inconvenience is small. Safari</h2> Go to Settings > Safari. Prevent Cross-Site Tracking is on by default in current versions of iOS, including iOS 26. Keep it on. This is Safari’s Intelligent Tracking Prevention. It limits the ability of tracking scripts to follow you across websites by restricting how long-lived cross-site cookies can persist. This is one of the areas where Apple has genuinely led the industry. Don’t turn it off. As of iOS 26, Safari also enables Advanced Fingerprinting Protection for all browsing by default, not just Private Browsing. It obscures the browser and device signals that trackers use to build a browser fingerprint</a>. iOS 26 added Link Tracking Protection too, which strips tracking parameters (like gclid</code> and fbclid</code>) out of URLs. Hide IP Address (Settings > Safari > Hide IP Address) was introduced in iOS 15. In current iOS versions this defaults to “Trackers Only.” Safari hides your IP address from domains that Apple identifies as known trackers. Your IP address can reveal your approximate location and is used to link your browsing sessions. This setting limits that fingerprinting vector without routing all your traffic through a proxy. It’s on by default and should stay that way. iCloud Private Relay is a bigger step and requires an iCloud+ subscription (which starts at $0.99/month in the US). When enabled, your Safari traffic is routed through two separate relay servers. The first relay, operated by Apple, knows your IP address but not what you’re browsing. The second relay, operated by a third party, knows what you’re browsing but not your IP address. No single party sees both pieces of information. This is not a VPN — it only applies to Safari traffic and certain DNS lookups, not to app traffic or other browsers — but it’s a meaningful upgrade for everyday browsing. Enable it at Settings > [Your Name] > iCloud > Private Relay. Fraudulent Website Warning uses Google Safe Browsing to check URLs against a database of known phishing and malware sites. It’s on by default. Leave it on. Apple says it checks URLs against the list without sending them to Google in identifiable form, using a privacy-preserving lookup technique. One setting to check under Settings > Safari > Advanced: JavaScript. It’s on by default and should stay on for normal browsing, but if you visit a site you don’t trust and want maximum isolation, you can temporarily disable it. The web breaks significantly without JavaScript, so this is situational rather than a general recommendation. App Privacy Report</h2> Settings > Privacy & Security > App Privacy Report. Enable it. App Privacy Report requires iOS 15.2 or later. Once enabled, it starts building a record of what apps on your phone are doing: which permissions they access, when, and which network domains they contact. It takes about a week to accumulate meaningful data. Then look at it. What you’ll see is organized by app. For each app, you’ll see a list of permission accesses with timestamps — every time that app opened your camera, contacted your location, read your photos. You’ll also see a list of network domains the app contacted, which tells you which advertising networks, analytics services, and data brokers the app was talking to in the background. This is the most concrete way to audit what you agreed to and whether it matches reality. The shopping app that accessed your location 87 times is not a hypothetical — these numbers show up regularly in App Privacy Reports from users who’ve actually checked. The 3am location pings happen because an app received a background notification and took the opportunity to grab a fresh location fix while the phone was sitting on your nightstand. If you see something alarming, revoke the relevant permission in Settings > Privacy & Security and consider whether the app deserves to stay on your phone at all. Three changes that matter most</h2> If you do nothing else from this guide, do these three things. Enable Advanced Data Protection. It’s the one setting that changes Apple’s fundamental ability to access your data. Without it, your iCloud backup is readable by Apple and producible to law enforcement. With it, the encryption keys exist only on your devices. Go to Settings > [Your Name] > iCloud > Advanced Data Protection, enable it, and follow the prompts to set up a recovery method. Spend fifteen minutes on this once and you’ve changed your privacy posture significantly. Audit Location permissions. Go through every app in Settings > Privacy & Security > Location Services and move anything set to “Always” down to “While Using.” Turn off Precise Location for apps that don’t need your exact GPS position. Then go to System Services and disable Significant Locations. Location data is the data type that correlates most powerfully with the rest of your life. It reveals your home, your health appointments, your relationships, and your routines. Tightening it costs you almost nothing in daily function. Enable App Privacy Report and check it in a week. Settings > Privacy & Security > App Privacy Report. Turn it on now, before you close this tab. Come back in seven days. Let what you see inform which permissions you revoke next. The rest of the settings in this guide matter — some of them significantly. But these three are the ones where the gap between what most people have configured and what a privacy-conscious person would choose is widest. Start here. What Apple gets right</h2> Apple charges a premium for hardware, which means their business model doesn’t depend on selling your data to advertisers the way an ad-funded platform’s does. That structural incentive is real and it matters. Apple’s implementation of App Tracking Transparency was opposed loudly and explicitly by Meta, Google, and the broader advertising industry — and Apple shipped it anyway, at measurable cost to their developer relationships. That took genuine organizational will. Safari’s Intelligent Tracking Prevention has been iterating for years and is technically ahead of Chrome’s approach. The App Privacy Report, the permission indicators for camera and microphone, the per-photo access controls — these are Apple building genuine infrastructure to let you see and control what’s happening. Advanced Data Protection, when enabled, provides a level of backup encryption that few cloud services offer. Apple genuinely cannot access that data. That’s a harder engineering and legal commitment to make than it looks. But the defaults matter. Privacy tools that require users to navigate five menus to activate them are not the same as privacy by design. Apple has chosen defaults that leave your location data, your analytics, your Siri learning, and your iCloud backups more accessible than they need to be. And the vast majority of iPhone users are running those defaults right now. The phone is capable of more privacy than it ships with. This guide is how you close the gap. KnytX Shield is built to scan data broker databases, submit removal requests on your behalf, and watch for new exposures — including data that flows off your phone through apps and advertising networks. It isn’t live yet; join the waitlist</a> to get in early. What WhatsApp Shares with Meta (and What It Doesn't) Unknown — Thu, 23 Apr 2026 00:00:00 +0000 Approximately 2.5–3 billion monthly active users rely on WhatsApp because they’ve heard it’s encrypted. That part is true. Your messages travel in a locked box that Meta genuinely cannot open. But encryption only covers the contents of the box — not where it came from, where it went, how often you send boxes, or who you send them to. That’s what Meta actually wants. The distinction matters more than most users realize. What “end-to-end encrypted” actually means</h2> End-to-end encryption means the message is scrambled on your device and only unscrambled on the recipient’s device. No server in between — including WhatsApp’s own servers — can read it. WhatsApp uses the Signal Protocol for this, the same protocol developed by Open Whisper Systems that Signal itself uses. On this specific point, WhatsApp is genuine. What encryption does not cover: everything except the message content. That you messaged someone at 2am. How long the conversation ran. How often you talk. Your location, inferred from your IP address. Whether you read a message. None of that is encrypted. That data travels in the clear to Meta’s servers. This is called metadata. And metadata is, in many ways, more useful for building a profile of your behavior than the messages themselves. What WhatsApp tells Meta</h2> Here’s the specific list from WhatsApp’s own privacy policy, without the legal softening: Your phone number — tied to your Meta account if you have one. Your profile name and photo. Your device identifiers: IMEI number, advertising ID, and hardware model. Your contacts list, if you granted permission (and most users do, because that’s how WhatsApp finds people you know). Your approximate location, derived from your IP address even if you never share GPS data. Your usage patterns: when you’re online, how often you message, message frequency, read receipts, and which groups you’re part of. The metadata picture this creates is detailed. Meta can infer your sleep schedule, your social circle, your closest relationships, and significant life events — all without ever reading a single word you sent. What Meta does with it</h2> Your WhatsApp metadata feeds the same ad targeting system that runs Facebook and Instagram. This means your WhatsApp activity influences the ads you see on platforms you may barely use — or don’t use at all. If you’re in a WhatsApp group for a local hiking club, Meta infers you’re interested in outdoor activities. If you message someone daily for six months and then stop, Meta notices. If your usage spikes every Sunday evening, that’s a data point. None of this requires reading your messages. The behavioral signal is in the pattern. The 2021 WhatsApp policy update made this explicit — users had to agree to data sharing with Meta or lose access to WhatsApp. In the EU, that update was reversed after regulatory pressure. EU users operate under slightly different terms with more restricted data flows. If you’re outside the EU, the full data-sharing relationship is in effect. The backup problem</h2> Here’s where WhatsApp’s encryption story gets complicated. When you back up your WhatsApp chats to Google Drive or iCloud, those backups sit outside WhatsApp’s encryption. Google and Apple can technically access them. Law enforcement can request them through those companies. The messages that were private in transit become accessible at rest. WhatsApp added an opt-in end-to-end encrypted backup feature in 2021. It’s not on by default. To enable it: Settings > Chats > Chat Backup > End-to-end Encrypted Backup. You’ll set a password or a 64-digit encryption key — don’t lose it, because WhatsApp genuinely cannot recover it. If you’ve never done this, your chat history is probably sitting unencrypted in a cloud account. WhatsApp vs Signal vs Telegram</h2> Signal collects almost nothing. Phone number at signup, and that’s effectively it. No metadata logging, no contact graph uploaded to a server, no ad business to feed. Signal is a nonprofit. Their revenue model doesn’t require knowing who you talk to. Telegram is often lumped with Signal as a “private” alternative. It isn’t — at least not by default. Standard Telegram chats are not end-to-end encrypted. They’re stored on Telegram’s servers in a way Telegram can access. Only “Secret Chats” use E2E encryption, and those don’t sync across devices. Most people never use Secret Chats. WhatsApp sits between them. Better than SMS (which is completely unencrypted and trivially intercepted). Better than standard Telegram. Worse than Signal on privacy. The gap between WhatsApp and Signal isn’t the encryption of messages — it’s the metadata. When to use WhatsApp, when not to</h2> For coordinating family gatherings, messaging friends, or planning events, WhatsApp is fine. The metadata Meta collects is real but probably not high-stakes for most personal conversations. Some conversations you genuinely want private. Sensitive health discussions. Professional communications involving confidential information. Anything involving legal matters. Organizing political activity in countries where that carries risk. For those, use Signal. There’s no nuance here. Signal was built for this. WhatsApp wasn’t. WhatsApp Business is a separate category worth understanding. When you message a business on WhatsApp, that business can read your messages and share your data with their own service providers and ad partners. The E2E encryption applies between you and the business, but that business decides what they do with what you said. What you can do right now</h2> Want to see what data brokers expose about you? See what a scan finds →</a> shows an example report: the kinds of sites that list your name, phone, and address. Once KnytX Shield launches it will find and remove these automatically. Join the waitlist</a> to get in early. What Tracker Blocking Does — and What It Misses Unknown — Wed, 22 Apr 2026 00:00:00 +0000 What trackers are actually doing</h2> When you load a news article, 30–60 trackers load alongside it. You don’t see them. They’re not ads — they’re invisible data collection scripts firing in the background before you’ve read the first sentence. Google Analytics reports your visit, your location, how long you stay, what you click. The Meta Pixel fires and tells Facebook you visited that health article you were reading. LinkedIn Insight Tag notes your professional interests. Hotjar and FullStory may record your mouse movements, scroll behavior, and keystrokes — a full session replay that site operators can watch back later. Then there’s fingerprinting. Your browser’s configuration — screen resolution, installed fonts, timezone, graphics card, language settings — is specific enough to identify you without any cookies. Even if you delete all your cookies tonight, fingerprinting can re-identify you on your next visit. And here’s the part that surprises most people: Google and Meta have trackers embedded on millions of third-party sites. They’re building a profile of your behavior across the web even when you’re not on their platforms. What tracker blocking actually stops</h2> Tracker blocking intercepts network requests before they complete. When your browser tries to load google-analytics.com</code>, a blocker checks that domain against a list of known trackers and drops the request. The script never loads. The data never leaves your browser. This has real consequences. The tracking pixel on a news article doesn’t load, so Google Analytics never records your visit. The Meta Pixel can’t fire, so your visit to a health or finance site isn’t fed into Meta’s ad targeting profile. Session recording scripts — Hotjar, FullStory — don’t execute, so your mouse movements and keystrokes stay local. It also protects your interest profile. Ad targeting works by aggregating your browsing behavior across hundreds of sites over time. Tracker blocking breaks that aggregation. Sites can’t report your visit to the data brokers that build interest categories and sell them to advertisers. Some fingerprinting protection comes with this too. Blockers can prevent certain fingerprinting scripts from loading. It doesn’t eliminate fingerprinting entirely, but it raises the cost. What tracker blocking doesn’t stop</h2> Be clear on the limits — this matters. First-party tracking via login: If you’re signed into your Google account, Google tracks everything you search, every site you visit through Chrome, every YouTube video you watch. The tracker blocker is irrelevant here. You consented to tracking when you logged in. The same is true of Facebook when you’re logged into Instagram, or any platform where you have an account. Tracker blocking stops third-party data collection; it doesn’t stop the platform you’re actively using from tracking you. App tracking on mobile: Browser extensions don’t protect your phone apps. Facebook, Instagram, TikTok, and thousands of other apps track extensively within their own environments. They don’t need to load a web tracker — they have direct access to your behavior inside the app. Advanced fingerprinting: Determined actors use AudioContext, Canvas API, and WebGL to fingerprint browsers in ways that bypass blockers. A news site might not bother. A sophisticated ad tech company absolutely will. ISP-level visibility: Your internet provider sees your DNS queries — what domains you’re visiting — regardless of what browser settings you’ve enabled. A tracker blocker doesn’t change this. (A private DNS resolver or VPN can help here, but that’s a separate layer.) Your existing profile: This is the one people miss most. Tracker blocking is entirely forward-looking. It stops new data collection from this moment on. The profile that Google, Meta, and hundreds of data brokers have already built from years of your browsing behavior? That stays intact. A blocker can’t touch data that’s already been collected. The tools worth using</h2> uBlock Origin is the best tracker and ad blocker available. Free, open source, maintained by a single developer (Raymond Hill). It runs in Chrome, Firefox, and Edge. One important caveat: Chrome’s Manifest V3 restrictions limit uBlock’s ability to filter network requests at full power. Use Firefox if you want uBlock at its best — this is a genuine difference, not a minor technical footnote. Brave Browser has tracker blocking built in. No extension needed. Its Shields feature blocks trackers, fingerprinting, and cross-site tracking by default. It’s a solid choice on mobile, where browser extensions don’t exist, and works well on desktop too. Firefox with Enhanced Tracking Protection enabled (set it to “Strict” in Privacy settings) blocks trackers, fingerprinting scripts, and cryptominers by default. Pair it with uBlock Origin and you have the strongest combination available for desktop browsing. Consent-o-Matic auto-rejects cookie consent banners across thousands of sites. It’s not a tracker blocker, but it removes the dark-pattern fatigue of clicking “Reject All” dozens of times per day — and helps ensure you’re actually rejecting rather than accidentally accepting through confusing UI. Pi-hole is for advanced users. It’s a DNS-level ad and tracker blocker you run on your home network — on a Raspberry Pi or small server. Every device on your network benefits: phones, smart TVs, game consoles, IoT devices. Setup takes an hour or two. Not the right starting point for most people, but worth knowing it exists. What to skip: browser extensions from unknown publishers (some “privacy” tools are themselves data harvesters), and any claim that a VPN blocks trackers. VPNs hide your IP address from the sites you visit. They don’t prevent tracking pixels from loading. They don’t stop Google Analytics from running. A VPN and a tracker blocker are different tools that do different things. Mobile: the harder problem</h2> iOS has App Tracking Transparency — that prompt asking “allow this app to track you?” Say no. Every time. This limits ad ID sharing between apps and reduces cross-app tracking, though it doesn’t eliminate in-app tracking. On Android, you can reset and limit your advertising ID in Settings > Privacy > Ads. Do it. It’s not a complete solution, but it adds friction. The harder reality is that in-app tracking — Facebook watching your behavior inside Instagram, TikTok tracking every scroll and pause — continues regardless of these system settings. The app you’re using always sees what you do inside it. The only practical protection is using fewer apps and accessing services through a privacy-focused browser instead of a dedicated app when you have the option. The combination that actually works</h2> Tracker blocking is one layer. It’s a good layer. But it’s not the whole picture. Think of it this way: tracker blocking stops new data collection from your browser, starting now. It doesn’t clean up what’s already out there — your name, phone, and address on data broker databases. And it doesn’t protect your mobile app activity. The combination that addresses all three: tracker blocking (uBlock Origin with Firefox) for web browsing; data broker removal</a> to deal with your existing footprint at sites that aggregate and sell your personal information; and email aliases</a> to compartmentalize new signups so future breaches stay contained. These aren’t redundant. They address different parts of the same problem. Start with the browser layer — it’s free, takes five minutes, and works immediately. What you can do right now</h2> Want to see what data brokers expose about you? See what a scan finds →</a> shows an example report: the kinds of sites that list your name, phone, and address. Once KnytX Shield launches it will find and remove these automatically. Join the waitlist</a> to get in early. Tech Support Scams: Fake Microsoft & Apple Alerts Unknown — Tue, 21 Apr 2026 00:00:00 +0000 Margaret had been retired for six years and was on her laptop looking up a lemon chicken recipe on a Tuesday afternoon when her entire screen went dark. Then a window filled it — a Windows logo, red and white text, a blaring alarm sound repeating through her speakers. The text said: VIRUS ALERT FROM MICROSOFT — Your computer has been blocked. Do not shut down or restart your computer. Call Microsoft Support immediately. Below it: a 1-800 number. She tried clicking elsewhere. Nothing happened. She tried closing the browser. The window didn’t move. The alarm kept going. She was 68 years old, retired from teaching middle school in Columbus, Ohio, and her laptop had everything on it — photos, emails, her bank login saved in the browser. She was terrified. She called the number. By the end of that afternoon, a man who introduced himself as “David from Microsoft Senior Support” had walked her through downloading a program called AnyDesk. He watched her type in her banking password. He moved money between her accounts to show her it had been “hacked.” Then he convinced her to drive to two different CVS locations and buy Google Play gift cards totaling $3,400. She read the codes from the backs of the cards over the phone. The call lasted four hours. The alarm had been a JavaScript audio loop running in her browser. The popup was a web page. Microsoft had nothing to do with any of it. The short answer. A tech support scam popup is just a web page pretending to be a system alert. Your computer is not infected, not blocked, and not encrypted. Microsoft and Apple never put a phone number in a security warning, and they never call you first. Do not call the number. Mute your speakers, press Escape, then close the browser (Ctrl+Shift+Esc on Windows, Command+Option+Esc on Mac). If you already called and gave remote access, disconnect from the internet, change your passwords from another device, and call your bank. Never pay tech support in gift cards. What the popup actually is</h2> The browser-based tech support scam popup is one of the most effective social engineering tricks ever deployed at scale. Not because it is technically sophisticated, but because of what it does to your nervous system in the first thirty seconds. The technical construction is straightforward. A malicious or compromised web page — sometimes reached through a rogue ad served on a completely legitimate site — runs a short piece of JavaScript. That script opens the page in fullscreen mode, starts an audio loop, and in some implementations locks the browser’s keyboard focus so that pressing Escape appears to do nothing. On certain older browsers, it calls alert()</code> or confirm()</code> dialogs in a loop that keep popping back up every time you dismiss them. The page is styled to mimic Windows or macOS system alerts, complete with official logos, official fonts, and official language. The result looks exactly like a system-level message. Because it fills the entire screen. Because it has the Windows logo or the Apple logo. Because it says “Microsoft” or “Apple Support.” And because it’s making noise. Here is what’s actually happening: your browser is open. A web page is displayed in it. That is the entire technical situation. Your computer is not blocked. Your files are not encrypted. You do not have a virus. The page is lying to you. Closing the browser is always possible, even if the popup makes it feel impossible. Press Escape first — this exits fullscreen on most browsers. If that doesn’t work, press Ctrl+Shift+Esc on Windows to open Task Manager, click on the browser, and select End Task. On a Mac, press Command+Option+Esc to force quit the browser. If the alarm is blaring and you can’t think, mute your speakers first, then deal with the screen. The moment the sound stops, the emergency feeling drops significantly. That’s not a coincidence — the audio is there specifically to prevent clear thinking. You can also just close your laptop lid. Nothing will happen to your computer. Why it works: the alarm is the product</h2> The specific combination of elements in a tech support popup is designed to trigger a fear response before the conscious mind can evaluate what it’s seeing. Loud alarm. Bright red. The word BLOCKED. Official logos. A phone number. The alarm is the most important component. Studies on threat perception consistently show that auditory alarms cause an immediate physiological stress response — elevated heart rate, narrowed attention, reduced analytical thinking. Advertisers and UI designers have known for decades that an unexpected audio cue commands attention in a way that visual cues alone cannot match. The scammers know this too. The “BLOCKED” framing is deliberate. It implies loss of control, loss of access, an emergency requiring immediate action. Compare it to a message that said “we detected a potential issue” — that’s evaluable, manageable, not urgent. “YOUR COMPUTER HAS BEEN BLOCKED” is designed to collapse the gap between “I see this” and “I need to call that number now.” And the logos work because most people have never thought about what a real Microsoft communication looks like. They’ve interacted with Windows for decades. They’ve seen Windows logos. When a Windows logo appears alongside a message claiming to be from Microsoft, the association feels legitimate. It isn’t. Microsoft does not communicate with users through browser popups. Microsoft does not include phone numbers in system security alerts. If Windows detects a genuine security problem, it surfaces that through the Windows Security Center, through Windows Update notifications, or through official email to your registered Microsoft account. A browser popup with a phone number is not any of those things. The phone call: what happens after you dial</h2> The call center you reach when you dial one of those numbers is typically operating out of India, though operations have also been documented in Eastern Europe and Southeast Asia. The agents are trained, follow scripts, speak professional English, and know exactly how to handle a frightened caller. The opening is warm and reassuring. “Thank you for calling Microsoft Support. I understand you’re having an issue with your computer — don’t worry, we’re going to take care of this.” The agent introduces themselves with an anglicized name. They ask a few questions designed to confirm you’re reachable and engaged. Then they ask you to download a remote access tool. The most commonly requested are AnyDesk and TeamViewer — both legitimate pieces of software used by real IT departments around the world. The scammer asks you to visit a URL, download the software, and read them the connection ID it displays. Once you do, they have full control of your screen. They can see everything you do. They can move your mouse, open programs, and type — all while you watch. What follows is pure theater, designed to prove to you that your computer has been compromised. First, they open Event Viewer — a built-in Windows utility that logs system activity. They click into “Windows Logs” and show you entries marked with yellow warnings or red errors. “You see all these critical errors? These are caused by the virus on your system.” What they’re showing you are normal Windows logs. Every Windows machine generates thousands of these entries. They’re not errors in any meaningful sense — they’re routine system notifications, background service stops, update checks. But they look alarming to someone who has never opened Event Viewer before, and the scammer’s confident narration makes them sound catastrophic. Next, they open a command prompt and run netstat -ano</code>, which displays all active network connections. “You see these foreign IP addresses? Hackers have connected to your computer from China, from Russia. We can see them in real time.” What netstat</code> shows is your computer’s active network connections. That includes connections to update servers, cloud sync services, browser background processes, and anything else running on your machine. This is completely normal. The scammer reads off IP addresses in other countries and presents them as intruder activity. Some operations go further and run a fake antivirus scan — either a scripted animation or a legitimate tool configured to exaggerate results. The scan reports hundreds of “infections.” By the end of this performance, many victims are convinced. Their computer is compromised. Only this Microsoft technician can save them. The price for “lifetime protection” or “complete removal service” is typically $299 to $499, sometimes more. How they get paid — and why gift cards</h2> Payment collection is where the scam shows its nature most clearly, because no legitimate technology company asks for payment in gift cards. The most common method: the scammer sends you to a pharmacy or electronics store to buy gift cards, such as Google Play, Apple, Best Buy, Steam, or eBay. Amounts are usually broken across multiple cards at multiple stores. That partly stays under amounts that trigger store-employee warnings. It also spreads the purchase, because some stores now post gift-card fraud alerts near the registers. Once you’re back from the store, you read the codes from the backs of the cards over the phone. Those codes are immediately redeemed by the scammer or their associates. The cards are gone. There is no recourse. Gift cards are functionally cash — they’re not reversible, they’re not traceable to a recipient, and they’re not covered by fraud protection the way credit card charges are. Wire transfers are increasingly used for larger amounts. Some operations direct victims to cryptocurrency ATMs. The refund scam variant, which we’ll get to shortly, often involves bank transfer. The FTC reported that Americans lost $924 million to tech support scams in 2023 — making it one of the largest fraud categories by dollar volume. That figure represents only reported losses. The agency estimates actual losses are significantly higher, because many victims, particularly older adults, don’t report out of embarrassment. The cold call variant: no popup required</h2> Not every tech support scam starts with a browser popup. The cold call variant skips the browser entirely and calls you directly. The pitch is consistent: “Hello, I’m calling from Microsoft Windows / Apple Support / your internet service provider. We’ve detected that your computer is sending error reports to our servers, which indicates it may be infected with a virus. We’re reaching out to affected customers to help resolve this.” These calls are entirely fabricated. Microsoft does not monitor your computer for errors and call you about them. Apple does not proactively call customers about security issues. Your ISP does not refer you to third-party technicians to fix viruses on your machine. No company operates this way. The calls are cold-dialed, using phone number lists purchased from data brokers or generated by random dialers. The script that follows is nearly identical to the popup variant. The scammer asks you to sit at your computer. They guide you to press Windows+R to open the Run dialog, then type eventvwr</code> to open Event Viewer. They walk you through the same performance: look at these errors, these are signs of infection, hackers have connected to your machine. The phone call creates the same urgency that the popup alarm creates — you’re already on the line with “Microsoft,” so the scenario feels real. From there, the remote access request follows. Download AnyDesk. Read me the connection ID. And the script continues from there. Phone numbers used in cold call campaigns are obtained in a few ways. Data broker databases that list name, phone number, and age are one source. They’re inexpensive to buy and often accurate. Older voter registration records, property records, and public directories end up in these datasets. This is the same pipeline covered in how scam callers know your name</a>. Some operations use predictive dialers that simply call every number in a given area code. The scammer doesn’t know who they’re calling until someone picks up. The refund scam: the most financially devastating variant</h2> If the popup scam and the cold call are the first-generation approach, the refund scam is the evolved form. It’s more complex, more convincing, and responsible for some of the largest individual losses. The setup: you receive a call or email claiming that a subscription has been automatically renewed, often for a large amount of $299 to $499. It might be your Microsoft support plan, your Norton antivirus, or a “computer protection service.” The message says you’re entitled to a full refund because you “no longer use the service.” All you need to do is let them process it. This variation is effective precisely because the scammer isn’t immediately asking you for money. They’re ostensibly giving you money back. That framing lowers defenses. Once they have remote access to process the “refund,” the scammer opens your online banking site. They instruct you to look away or they cover the screen briefly. What they’re actually doing is either moving money between your own accounts (from savings to checking) or using browser developer tools to modify the balance number displayed on screen. When you look back, the balance has “increased” by, say, $4,000 — representing the supposed refund. “Oh no,” the scammer says. “I made an error — I accidentally processed a refund of $4,000 instead of $299. I’ll lose my job over this. Please, can you send back the difference?” The victim now sees what appears to be $4,000 in their account. Feeling sympathetic toward the agent who’s been helpful for the last hour, they agree to send back $3,701. Payment goes by wire transfer, gift cards, or increasingly through cryptocurrency ATMs. No money ever arrived. The $4,000 “increase” was either a visual manipulation or money moved from the victim’s savings account. The victim just sent $3,701 of their own money to a scammer. The FTC identified this specific variant as responsible for $59 million in losses in 2023 alone. Because the “transfer back” appears to come from the victim voluntarily, banks often resist fraud claims — technically, the victim initiated the wire. Who gets targeted, and why age matters</h2> Adults over 60 account for more than half of reported tech support scam losses. The FTC’s data shows that adults 60 and older are five times more likely to lose money to tech support scams than adults aged 18 to 29. This is frequently misread as a statement about technical literacy or intelligence. It isn’t. The targeting is rational and based on several factors that have nothing to do with intelligence. First, availability. Retired adults are more likely to be home during business hours when cold call campaigns run. Working-age adults who might be targeted are often away from their computers or distracted by other demands. Second, familiarity with the scenario. Adults who are now in their 60s and 70s grew up calling technical support lines. They’ve had experiences where calling a number solved a computer problem. The call center model is not foreign to them — it’s how they’ve interacted with technology companies before. When a scammer presents as tech support, the mental model fits something they’ve done legitimately. Third, the stakes. Older adults are more likely to have accumulated savings, to have those savings in accessible bank accounts, and to be anxious about protecting them. The combination of a frightening warning and the offer of protection is particularly effective when the person has real assets to lose. The scammers know all of this. Call center scripts include guidance on identifying and continuing to engage older callers. Victims are sometimes contacted again, occasionally by a different operation claiming to help victims of tech support scams. This is called recovery fraud, and it has its own guide: recovery scams</a>. If you’ve been scammed once and reported it, your information may end up on a “sucker list” sold to more fraudsters. The FTC and Microsoft’s Digital Crimes Unit have both flagged this secondary targeting as a growing pattern. Microsoft’s Digital Crimes Unit and what’s actually being done</h2> Microsoft established its Digital Crimes Unit (DCU) in 2008 as an internal team dedicated to disrupting cybercrime at scale. The DCU has taken legal action against tech support fraud networks. That includes a 2021 court action against a network operating out of India, which had defrauded thousands of victims, primarily in the United States and Canada. Microsoft worked with the Indian Central Bureau of Investigation and Interpol on that case. The DCU approach combines civil litigation (seizing domains and infrastructure used by scammers), referrals to law enforcement, and public awareness. In 2021, Microsoft filed civil suits against 17 defendants in the Eastern District of Virginia, identifying operations that had used fake Microsoft branding to defraud victims of millions of dollars. The challenge is scale. The FTC receives hundreds of thousands of tech support scam reports per year. The operations are distributed, often cross-jurisdictional, and the individuals operating call centers in India can be replaced faster than legal proceedings move. Microsoft’s enforcement actions are meaningful but necessarily targeted — they disrupt specific operations rather than the ecosystem. Law enforcement prosecutions do happen. In 2020, the Department of Justice coordinated with Indian authorities to arrest individuals connected to a network that had defrauded thousands of Americans. In 2023, a federal grand jury in Texas indicted members of a tech support fraud ring that had operated for years out of call centers in India. Sentences in US federal cases for tech support fraud have ranged from several months to over four years in federal prison. But prosecution is rare relative to the volume of fraud. The practical protection has to come from the potential victim knowing what tech support scams look like before they encounter one. What to do when the popup appears</h2> The sequence matters. Do these in order, stay calm, and remember that your computer is not actually infected. Mute your speakers first. The alarm is there to prevent rational thought. Remove it. The visual elements of the popup are much easier to dismiss without the audio component. Press Escape. Most browser fullscreen modes exit with Escape. The popup may remain, but it will be browser-sized rather than screen-filling, which changes how threatening it feels. Close the browser. On Windows, right-click the browser icon in the taskbar and select “Close window,” or press Alt+F4. On Mac, press Command+Q to quit the browser entirely. If neither works, open Task Manager on Windows (Ctrl+Shift+Esc) or Activity Monitor on Mac (Command+Space, type “Activity Monitor”), find the browser process, and end it. Do not call the number. Do not click anything on the page. Do not download anything the page suggests. The number is operated by the scammers. Calling it begins the fraud process. You may still worry that something did happen to your computer. It didn’t, but the anxiety is reasonable. Run a scan using Windows Defender (built into Windows, free, updated regularly) or Malwarebytes Free (reputable, widely used). Neither will find anything related to the popup page, because the popup was a web page, not malware. But running a scan and seeing a clean result is genuinely reassuring. What to do if you’ve already given them access</h2> If you gave a scammer remote access to your computer, act quickly. The window matters. Disconnect from the internet immediately. Unplug the Ethernet cable or turn off Wi-Fi. The remote access session ends when the connection drops. Critically, the scammer may have installed a persistence backdoor — a secondary remote access tool configured to reconnect automatically when you go back online. Disconnecting before they can do this is important. Do not reconnect on that machine yet. From a different device — your phone, a tablet, another computer — change the passwords to every account you access on that machine, starting with your email and your bank. Do not change them from the compromised computer until it has been scanned. Run a full antivirus scan. Download Malwarebytes on a clean device, transfer it via USB, and run a full scan. Windows Defender can also run a full offline scan at startup. Look specifically for AnyDesk, TeamViewer, or other remote access tools that you didn’t install — and uninstall them. Contact your bank if money moved. Wire fraud can sometimes be reversed if reported within 72 hours. Call the fraud department directly, explain what happened, and ask them to attempt a reversal. This doesn’t always work, but it works often enough to be worth doing immediately. Gift card payments are almost never recoverable — but report them anyway. File a report with the FTC at reportfraud.ftc.gov. The FTC uses these reports to identify trends, support law enforcement investigations, and warn other potential victims. It takes about five minutes. Include the phone number you called or that called you, the name the agent used, and any payment details. If you’re outside the US, file with your national consumer protection agency — Action Fraud in the UK, the ACCC’s Scamwatch in Australia, the Canadian Anti-Fraud Centre in Canada. Check for persistence. Look in Task Scheduler on Windows (search “Task Scheduler” in the Start menu) for any recently created tasks. Look in Startup programs (Task Manager > Startup tab) for anything unfamiliar. If you’re not comfortable doing this yourself, take the machine to a local computer repair shop and explain what happened. Most technicians can sweep for backdoors in under an hour. The conversation you should have before this happens</h2> The highest-impact action available to anyone who has read this far is a conversation — with a parent, a grandparent, an aunt or uncle, a neighbor. Not a lecture. A brief, direct explanation of three things: Microsoft will never call you. If someone calls saying they’re from Microsoft, Windows Support, Apple, or any tech company, and you didn’t initiate the call, hang up. These companies do not proactively call customers about their computer’s security. No exceptions. A browser popup is never a real virus warning. If a full-screen alert appears on your computer with an alarm sound and a phone number, it is a scam. Press Escape or close the browser. Do not call the number. Gift cards are never a legitimate payment method. No government agency, technology company, utility, or bank will ever ask you to pay anything in gift cards. If someone asks you to buy gift cards to pay for anything — tech support, taxes, a fine, anything — it’s a scam. Stop, hang up, and tell someone you trust what’s happening. Those three sentences, delivered once in the right moment to the right person, can prevent a loss of thousands of dollars and months of financial and emotional recovery. The FTC estimates that tech support scams cost American consumers nearly a billion dollars a year. Most of those losses happen because people encounter the scam without ever having heard an explanation of how it works. You’ve heard one now. The alarm is just JavaScript. Microsoft doesn’t know your computer’s running. And that phone number goes to a call center, not Redmond. If you or someone you know has been targeted by a tech support scam, report it to the FTC at reportfraud.ftc.gov</a>. KnytX Shield is built to watch for your personal information in the broker databases that scammers buy for targeting, and to remove it automatically once you’re in. It isn’t live yet; join the waitlist</a> to get in early. Privacy Breach: What It Means and What to Do Unknown — Mon, 20 Apr 2026 00:00:00 +0000 In 2021, Clearview AI was using a database of over 30 billion face images. It scraped them from social media and the public internet, without consent from a single person photographed. It sold access to law enforcement agencies in multiple countries where that was flatly illegal under existing privacy law. No system was hacked. No password database was stolen. There was no breach in the technical sense that generates news coverage. There was, however, a privacy breach on a scale that dwarfs most of the hacks that do make headlines. This is the gap in public understanding that causes real harm: “data breach” and “privacy breach” get treated as synonyms, but they’re not. A data breach is one type of privacy breach. The others — internal misuse, regulatory violations, physical exposure, illegal disclosure — receive far less attention. They are often harder to detect and harder to remedy. Yet they are equally damaging to the people affected. This guide covers the full picture: what privacy breaches actually are, what harm they cause, and what the law gives you as tools when it happens to you. The short answer: A privacy breach is any incident affecting the confidentiality, integrity, or availability of your personal data. It’s broader than a hack. It also covers internal misuse, unlawful data sharing, regulatory violations, and physical exposure like a lost laptop. The harm ranges from identity and financial fraud to reputational damage, physical-safety risk, discrimination, and pure distress. Under GDPR you have rights to notification, access (a Subject Access Request), complaint, and compensation, including for distress alone. In this article: What “privacy breach” actually means</a></li> What’s actually at risk: the harm taxonomy</a></li> Recent documented cases</a></li> Your legal rights</a></li> What to do: a step-by-step response</a></li> Reducing your exposure going forward</a></li> Frequently asked questions</a></li> </ul> What does “privacy breach” actually mean?</h2> The UK Information Commissioner’s Office (ICO) has a definition. A personal data breach is “a security incident that has affected the confidentiality, integrity or availability of personal data.” That covers more ground than most people assume. You don’t need a hacker or malware. The breach can be entirely internal. There are five categories worth distinguishing: Technical (the “data breach”): Unauthorised external access to systems — the type that generates headlines. A criminal group exfiltrates a database of customer records. Ransomware encrypts a hospital’s patient files after data has already been copied out. This is what most people picture when they hear “breach.” Organisational: Internal misuse by people with legitimate system access. NHS staff improperly looking up patient records for personal reasons — either curiosity or sale. DVLA employees selling vehicle keeper data to private investigators who then sold it to people tracking ex-partners. The NHS has published audit data showing thousands of inappropriate access incidents across trusts each year. The employees had authorised access; what they did with it was not authorised. Contractual: A company shares your data with a third party in ways that exceed their stated privacy policy or your actual consent. Your medical insurer shares your health data with a life insurer when you never agreed to that. Or a marketing platform sells your browsing data to a political campaign, when their privacy policy only described “analytics partners.” This is common and frequently illegal. It rarely comes to victims’ attention until regulatory action uncovers it. Regulatory: Processing your data in ways that violate applicable law — GDPR, UK GDPR, CCPA, India’s DPDPA — even without any disclosure to outsiders. The Meta €390 million fine issued by Ireland’s Data Protection Commission (DPC) in January 2023 is the clearest recent example. Meta was forcing users to accept behavioural advertising as a condition of using Facebook and Instagram. It treated “contract performance” as the legal basis for processing that was really just commercial tracking. No external breach. No hacker. A regulatory privacy breach at massive scale. Physical: Documents left in bins, unencrypted laptops lost on trains, confidential files sent to the wrong fax number. This still happens, and it still causes serious harm. An NHS trust had an unencrypted laptop stolen from a staff member’s car; it contained years of patient data. The recovery effort, the regulatory response, and the patient impact were identical to what follows a technical breach — because the outcome is the same. The reason this taxonomy matters: your response, your legal rights, and who you should contact differ depending on the type of breach. Say you file a complaint with the ICO about a technical breach. Then say you file one about a contractual disclosure by your employer to an insurer. Both go through the same authority, but they require different documentation. What’s actually at risk: the harm taxonomy</h2> Privacy breach coverage focuses heavily on the existence of the breach. What receives less attention is the specific pathway from breach to harm — which determines how serious any given breach actually is for you personally. Identity fraud: Consider the combination of full name, date of birth, and a national ID number (SSN in the US, Aadhaar in India, National Insurance number in the UK). That is enough to open credit accounts, apply for loans, commit tax fraud, and claim government benefits in someone else’s name. These credentials are stable and don’t become useless when you “change your password.” Someone with your NI number and date of birth has a durable fraud tool. The harm shows up on credit files and tax records, sometimes years after the original breach. Financial fraud: Payment card numbers and CVV codes can be monetised in hours — test transactions followed by larger purchases before the card is flagged. Bank account details and sort codes enable direct payment fraud and account takeover. Unlike identity fraud, financial fraud from card data tends to appear quickly and is usually covered by bank fraud protections, but the recovery process is slow and stressful. Reputational and professional harm: Medical records, mental health records, sexual history, private communications — when these are exposed, the damage is personal. An employer might discover an employee’s mental health diagnosis from a breach of a therapy app’s database. They may never explicitly cite it. But research consistently shows stigmatising conditions affect employment decisions. Private messages taken out of context can damage relationships. This is harm even where no fraud occurs, and courts in the UK and Ireland have recognised it. Physical safety: This category is underweighted in most breach discussions. A home address exposed to a domestic abuser who has been blocked on every platform is a life-safety issue. A database of residents at a domestic violence shelter is a target list. Location data from a stalker victim’s dating app profile, exposed through a privacy-violating API feature, has enabled physical harm in documented cases. Data protection law at its most consequential is not about spam email — it’s about whether someone can find you. Discrimination: Health conditions, genetic data, political views, religious beliefs, union membership — these are “special category” data under GDPR for a reason. When they reach employers or insurers, adverse decisions follow. Consider a job applicant whose HIV-positive status was disclosed without consent. Or an insurance applicant whose genetic data was shared with an insurer against GDPR rules. Or a union member whose name appeared in data sold to their employer. All of these represent concrete, documentable harm that flows from a privacy breach. Psychological harm: Courts in the UK and Ireland have accepted that distress alone — without financial loss or fraud — constitutes compensable damage under GDPR Article 82. Think of the loss of control over your personal information. The anxiety of not knowing what will be done with your data. The feeling of violation when private communications become public. These are real harms. Vidal-Hall v Google [2015] EWCA Civ 311 confirmed at Court of Appeal level that misuse of private information without material financial loss can found a civil damages claim. Lloyd v Google [2021] UKSC 50 addressed the scope differently but didn’t overturn the principle that non-material harm is compensable. Recent documented cases across all categories</h2> Technical — NHS 111 (August 2022): Advanced, the software provider for NHS 111 and other urgent care services, suffered a ransomware attack. It forced NHS 111 call handlers to revert to paper systems for several weeks. Patient data including NHS numbers and medical records was accessed. Patients experienced disrupted care coordination. Advanced was later fined £6.09 million by the ICO — one of the largest fines issued to a health sector processor rather than a controller. Organisational — DVLA employee data sales: Investigations have documented DVLA employees selling vehicle keeper data (names and addresses linked to registration plates) to private investigators. Those investigators in turn sold it to people tracking ex-partners and other targets. The data was legitimately accessible to the employees. The sale was not. Multiple prosecutions followed under the Data Protection Act. Regulatory — Meta €390 million fine (DPC, January 2023): The Irish Data Protection Commission examined Meta’s behavioural advertising. It found Meta had processed users’ personal data under an invalid legal basis. This had continued since GDPR came into force in 2018. This was not a breach in the technical sense. It was years of systematic data processing in violation of GDPR’s requirements for a valid lawful basis. That processing affected hundreds of millions of people across the EU. Contractual/Biometric — Clearview AI: Clearview scraped over 30 billion face images from publicly accessible websites and social media without consent. It built a biometric database and sold access to law enforcement agencies. Multiple EU data protection authorities and the UK ICO have found this to be unlawful under GDPR. Italy’s Garante fined Clearview €20 million. The UK ICO issued a £7.5 million fine (later reduced on appeal, with litigation ongoing). The Canadian and Australian privacy commissioners also found Clearview in breach of their respective laws. No database was “hacked” — the breach was the collection itself. Physical — NHS unencrypted laptop theft: Multiple NHS trusts have been fined or issued enforcement notices following laptop thefts where patient data was not encrypted. In one case, a laptop left in a staff member’s vehicle contained records of over 1,000 patients including diagnoses and contact details. Encryption would have made the theft irrelevant from a data protection perspective. The failure to encrypt was the breach. Legal rights when a privacy breach affects you</h2> Rights vary by jurisdiction. The picture is summarised below, then broken down. Right to notification. Under GDPR Article 33, controllers must notify their supervisory authority within 72 hours of discovering a breach. Article 34 requires them to notify affected individuals “without undue delay” when the breach is likely to result in high risk to their rights and freedoms. In practice, individual notification is often delayed significantly — see the gap between when companies know and when individuals are told. You are not legally guaranteed to receive a notification for every breach that involves your data. Right to access information. Under GDPR Article 15 (UK GDPR equivalent), you have the right to submit a Subject Access Request (SAR) to any organisation processing your personal data. They must tell you what data they hold, where it came from, who it has been shared with, and on what legal basis it is being processed. If you suspect a privacy breach involving your data, an SAR is often the first tool to reach for. Right to compensation. GDPR Article 82 grants any person who has suffered material or non-material damage as a result of a GDPR infringement the right to receive compensation. The key 2023 CJEU ruling in UI v Österreichische Post (Case C-300/21) confirmed that non-material damage is compensable, including distress, anxiety, and loss of control. But it must be real and certain, not hypothetical. Companies bear the burden of proving they were not responsible once you establish the damage. In India, the DPDPA 2023 does not include a direct individual compensation mechanism equivalent to Article 82. Aggrieved individuals can file complaints with the Data Protection Board, which can impose penalties on data fiduciaries. But the compensation pathway for individuals is less direct than under GDPR. In the US, compensation rights depend on state law and the specific sector. HIPAA doesn’t give individuals a private right of action. You can file a complaint with the HHS Office for Civil Rights, but HIPAA enforcement action goes to the government, not to you. CCPA gives California consumers limited private rights of action for data breaches involving certain categories of data. Class action litigation is the primary vehicle for US compensation. Right to complain. Every jurisdiction covered by GDPR and UK GDPR has a designated supervisory authority. Filing a complaint triggers a formal investigation. Even if you personally don’t receive compensation through the complaint process, investigations can lead to enforcement action and fines that have deterrent effect. Supervisory authorities: UK: Information Commissioner’s Office — ico.org.uk/make-a-complaint</li> Ireland: Data Protection Commission — dataprotection.ie</li> France: Commission Nationale de l’Informatique et des Libertés (CNIL) — cnil.fr</li> Germany: Each federal state has its own DPA; the Federal Commissioner for Data Protection (BfDI) handles federal matters — bfdi.bund.de</li> Netherlands: Autoriteit Persoonsgegevens — autoriteitpersoonsgegevens.nl</li> India: Data Protection Board (operational status being phased in under DPDPA 2023)</li> US Federal: Federal Trade Commission — reportfraud.ftc.gov (no single privacy supervisory authority, but the FTC handles unfair or deceptive data practices)</li> </ul> For EU-wide strategic litigation — particularly against large tech companies — NOYB (noyb.eu), founded by Max Schrems, files complaints simultaneously across multiple EU jurisdictions. Filing with NOYB for systematic violations is an option where individual country complaints are unlikely to be prioritised. What to do: a step-by-step response</h2> This section is for someone who has just found out a privacy breach involved their data. Work through it in order. Immediate (first 24 hours)</h3> 1. Confirm the breach is real before taking action. Go to the organisation’s own website — not through any link in the notification email. Check their newsroom or security page. Search for independent press coverage. Check haveibeenpwned.com for your email address. Breach notification emails are a known phishing vector; attackers send fake notifications following real high-profile breaches to harvest credentials. 2. Change credentials for the affected service. Use a unique, random password — not a variation of your existing one. If you’ve used the same password elsewhere, change those too. Credential stuffing — automated attacks using stolen username/password pairs against hundreds of sites — begins within hours of a breach being listed for sale. 3. Enable two-factor authentication if it is not already active. An authenticator app (Aegis, Google Authenticator, Authy) rather than SMS where possible. SMS 2FA is vulnerable to SIM swap attacks. 4. If financial data was involved: contact your bank immediately. Request proactive card replacement — don’t wait for fraudulent charges to appear. Review the last 90 days of transactions for micro-test charges you may have missed. 5. If your address or location was exposed to someone who poses a danger to you: Contact police immediately. Domestic abuse services in your jurisdiction can also advise on practical protective steps. This is a safety issue before it is a data protection issue. Within the first week</h3> 6. Submit a Subject Access Request. Write to the organisation’s Data Protection Officer. Ask for confirmation of what personal data of yours was involved in the breach. Ask who it was shared with, before and after. Ask what remediation steps they have taken. UK GDPR Article 15 gives you this right, and they must respond within one month. 7. File a complaint with the relevant supervisory authority. Use the links above for your jurisdiction. Include your name and contact details, and the same for the organisation. Add a description of the breach and when you became aware of it. State what harm you have suffered or are concerned about. Attach any correspondence you’ve had with the organisation. The more specific and documented your complaint, the more useful it is to investigators. 8. Document everything now. Keep copies of the breach notification (if you received one), any subsequent communications from the organisation, and evidence of fraudulent transactions or unusual account activity. Also write an account of how the breach has affected you: any distress, sleep disruption, anxiety, or changes in behaviour around using the internet or sharing personal information. For any future compensation claim, contemporaneous notes carry more weight than recollections written months later. 9. If national ID data was exposed: UK (NI number): Place a CIFAS protective registration at cifas.org.uk. Contact HMRC if you suspect employment or tax fraud using your number.</li> US (SSN): Place a credit freeze at all three bureaus (Equifax, Experian, TransUnion) at annualcreditreport.com — a freeze, not just a fraud alert. Get an IRS Identity Protection PIN at irs.gov/identity-theft-central.</li> India (Aadhaar): Lock biometric authentication at uidai.gov.in immediately. Verify your linked mobile number. Alert your bank.</li> </ul> For compensation (UK and EU)</h3> 10. Assess your damage. Material damage: financial fraud losses, fees paid to rectify identity theft, time and cost of credit repair. Non-material damage: distress, anxiety, loss of sleep, loss of control over personal information, changes in daily behaviour. Both are compensable under GDPR Article 82. The CJEU’s C-300/21 ruling requires real harm, not hypothetical risk — your documentation from step 8 is what establishes this. 11. Send a Letter Before Action. Before filing a court claim, write to the organisation’s Data Protection Officer. State the breach, the GDPR infringement, your harm, the compensation you are seeking, and a deadline (14–30 days). Keep it factual. This letter creates the paper trail required before civil litigation and often triggers a settlement offer. 12. File in the Small Claims Court for claims up to £10,000 (UK). Use Money Claim Online at gov.uk/make-court-claim-for-money. Filing fees range from £35 to £455 depending on claim value. No lawyer required. If you need a detailed guide on this process, see claiming GDPR compensation</a>. 13. For larger claims or group actions: engage a specialist solicitor. Data breach solicitors in the UK routinely work on conditional fee (no-win-no-fee) agreements. You pay nothing if you lose; they take a percentage if you win. Active group actions — British Airways, Marriott, various NHS trusts — are listed on law firm dedicated claim pages. Check Hayes Connor, JMW Solicitors, and Keller Postman UK for current cases. Reducing your exposure going forward</h2> No post-breach response fully neutralises the exposure. The data is out. The more useful goal is reducing what there is to expose and detecting future incidents faster. Data minimisation as protection. The less you provide when organisations ask, the less they can lose. When a form asks for your date of birth and you don’t know why they need it, asking is legitimate. When a service asks for your address for a digital product, a fake or forwarding address preserves your real location. When a site wants your phone number “for account security,” an alias number (Google Voice, a temporary SIM) limits what a breach can expose. Monitor your existing exposure. Register your email addresses at haveibeenpwned.com for free breach alerts. The service indexes new breach dumps and notifies you when your address appears — often before any corporate notification. For broader monitoring, dedicated dark web monitoring services scan criminal marketplaces for your credentials, phone numbers, and financial data. Remove your data from people-search and data broker sites. When breach data circulates, attackers use data broker sites</a> to find current contact details for targets. Your leaked email from 2019 is only useful if someone can still find your current phone and address. Removing yourself from these sites breaks that enrichment step. Guides for US brokers (/blog/remove-yourself-from-us-data-brokers/</a>) and the Indian internet (/blog/removing-your-data-from-indian-internet/</a>) walk through the process. Use email aliases and phone masks for new services. With an alias per service, spam or phishing to that alias tells you exactly which service’s breach produced it. You can then kill the alias without changing your real email. Services like SimpleLogin, AnonAddy, and Apple’s Hide My Email provide this. The Clearview pattern isn’t exceptional</h2> The Clearview AI case is useful to keep in mind as a reference point. It illustrates that scale and impact are not limited to technical breaches. The company didn’t break into anything. The breach was in what they collected — systematically, at enormous scale, without any form of consent. The same pattern applies to the Meta advertising case: the “breach” was years of processing that was never lawful, affecting hundreds of millions of people across the EU. No attacker. No stolen database. A regulatory privacy breach that GDPR was specifically designed to prevent. Understanding privacy breach as a category broader than hacking changes what you look for and what you report. Say you learn a company has been sharing your health data with partners you never consented to. Or you discover an employer is monitoring personal communications beyond what any employment contract permits. Those are privacy breaches. You have the same complaint rights and the same access to compensation as someone whose credit card number was stolen. The law covers all of it. Most people just don’t know that. Frequently asked questions</h2> What is a privacy breach? It’s any incident affecting the confidentiality, integrity, or availability of your personal data. That’s broader than a hack. It includes internal misuse, unlawful data sharing, regulatory violations, and physical exposure like a lost, unencrypted laptop. Is a privacy breach the same as a data breach? No. A data breach (a hack or leak) is one type of privacy breach. The others (internal misuse, contractual over-sharing, regulatory violations, physical loss) are often harder to detect but equally damaging. What rights do I have after a privacy breach? Under GDPR you have several rights: notification, access to your data via a Subject Access Request, and a complaint to a supervisory authority. You also have a right to compensation under Article 82, including for distress alone. Can I get compensation for distress without financial loss? In the UK and EU, yes. GDPR Article 82 covers non-material damage. The C-300/21 ruling requires the harm to be real and documented. See our GDPR compensation guide</a>. What’s the first thing to do after a privacy breach? Confirm it’s real via the company’s own site (not the email link), then change the affected password everywhere you reused it and enable two-factor authentication. If your address reached someone dangerous, contact police first. What you can do right now</h2> Want to see what data brokers expose about you? See what a scan finds →</a> shows an example report: the kinds of sites that list your name, phone, and address. Once KnytX Shield launches it will find and remove these automatically. Join the waitlist</a> to get in early. How to Check If Your Data Has Been Leaked Unknown — Sun, 19 Apr 2026 00:00:00 +0000 HaveIBeenPwned tracks well over 14 billion breached accounts as of mid-2026. That number keeps climbing. If you have had an email address for more than five years, the odds are not that your data was exposed. The odds are that it was exposed multiple times. LinkedIn lost 700 million records in 2021. Facebook had 533 million accounts scraped and leaked. Yahoo’s breaches affected 3 billion accounts — every Yahoo user, ever. Adobe, Dropbox, Canva, Twitch, Marriott, Optus, BSNL: the list of companies that have lost your data is longer than most people want to think about. RockYou2021 compiled 8.4 billion password pairs into a single file that circulated freely for months. The average person has been in three to ten breaches without knowing it. Most breach notifications arrive late, go to spam, or never get sent at all. This guide shows you how to check your actual exposure, how to read the results honestly, and what to do the moment you find something. The short answer: To check if your data has been leaked, enter your email at Have I Been Pwned (haveibeenpwned.com). It’s free and reliable, and it lists which known breaches included your address. Also use Google Password Checkup, Apple’s Passwords app, or Firefox Monitor for saved-password coverage. If a password shows up, change it everywhere you reused it and turn on two-factor authentication. Remember: these tools only show publicly disclosed breaches, so private sales and quiet corporate breaches stay hidden. In this article: What gets stolen in a breach</a></li> The main tools for checking your exposure</a></li> How to read your results</a></li> The breaches that checking tools miss</a></li> After you find a breach: the checklist</a></li> Staying ahead of future breaches</a></li> Frequently asked questions</a></li> </ul> What gets stolen in a breach</h2> Not all breaches are equal. The damage depends on what type of data was taken. Credentials — your email address paired with a password — are the most common. They fuel credential stuffing attacks, where attackers feed stolen login pairs into other sites automatically. If you used the same password on a breached site and on your bank, that breach is now a banking problem. PII (personally identifiable information: your name, phone number, address, date of birth) is used for identity theft and social engineering. Knowing your birthdate and address is enough to pass security questions at many institutions. This data doesn’t expire. A breach from 2016 still has your current date of birth. Financial data — card numbers, bank account details — is the most immediately dangerous but has become less common as payment processors hardened their systems. When it does appear, the window before fraud is hours, not days. Sensitive personal data — health records, sexual orientation, political views, immigration status — is the highest-risk category for targeted individuals. These breaches are smaller but more harmful to specific people. The Ashley Madison breach (2015) exposed 37 million accounts with sexual preferences. The consequences for individual users were severe. Knowing what category was stolen tells you how urgently and in what direction to respond. What are the main tools for checking your exposure?</h2> Several tools exist. Here is what each one actually covers and where it stops. HaveIBeenPwned (haveibeenpwned.com) is the default starting point for anyone doing a data breach check. Enter your email address and it tells you which of the 800+ indexed breaches included that address, along with which data types were exposed in each breach. Troy Hunt, a Microsoft MVP and security researcher, built and runs it. It is free. The breach data is real. Trust it. The limitation: HIBP only shows breaches that have been publicly disclosed and shared with the project. Private sales — breach data that’s traded on dark web markets but never posted publicly — don’t appear. If a breach happened but the company never disclosed it (and some don’t, especially outside the EU), HIBP won’t know either. Google’s Password Checkup and Dark Web Report — if you use Chrome, Google already scans your saved passwords against known breach databases and flags compromised credentials. Google One subscribers get a dark web report for their Gmail address. This is useful if you’re already in the Google ecosystem, but it only covers your Google-managed data and saved passwords, not every account you’ve ever created. Firefox Monitor — Mozilla’s breach notification tool, powered by HIBP data under the hood. Enter your email and see your breach history. You can subscribe to alerts for future breaches. Useful, but it duplicates HIBP without adding coverage. Apple’s Passwords app (iOS 18+ and macOS Sequoia+) scans your iCloud Keychain passwords against breach databases and surfaces compromised logins. If you rely on iCloud Keychain, this catches credentials that HIBP wouldn’t. It knows which passwords you actually use, not just which emails were exposed. Identity theft protection services like LifeLock, Identity Guard, and Aura monitor more broadly. That covers credit reports, non-breach data broker exposure, Social Security number monitoring (for US users), and bank account monitoring. They cost $10–$30 per month. They help if you’ve been a victim of identity theft or have specific reasons to need continuous monitoring. For most people, the free tools above cover the core risk. The paid services are often overpriced for what they add on top of what you can do yourself. For developers: HIBP offers an API that lets you check email addresses and passwords programmatically. The password endpoint uses k-anonymity, meaning you never send the actual password to the server. How do you read your results?</h2> When HIBP returns results, the output needs some interpretation. A breach marked “Sensitive” means the data involves something that could harm you if publicly known — adult sites, political data, health services. HIBP doesn’t display these publicly; you only see them in your own results. Take them seriously. If a password was part of the breach, act immediately. Change that password on the breached site. Then go through every other site where you used the same password and change it there too. This is not optional. Credential stuffing is automated and starts within hours of a breach dump appearing online. If PII (name, address, phone, date of birth) was in the breach, monitor your credit reports and financial accounts for unusual activity. In the US, request your free annual credit reports at annualcreditreport.com. In the EU, you have the right to contact the data controller and request what data they hold under GDPR Article 15. In India, watch for phishing attempts that reference your real name or address — that detail means the caller or emailer has real data. If financial data was exposed, contact your bank. Don’t wait for fraud to appear. Ask for new card numbers if card data was part of the breach. Set up transaction alerts if you haven’t already. What breaches do checking tools miss?</h2> This is the part most guides skip. The free tools show you a fraction of your actual exposure. Private dark web sales are breach data that has been sold to specific buyers but never posted publicly. A buyer purchases exclusive access to a fresh breach — say, a mid-size e-commerce company — and uses it quietly for months before the data ever surfaces in public dumps. HIBP and Firefox Monitor will never know about it. Targeted corporate breaches are often small and quiet. An attacker who wants access to one specific organization doesn’t post the results publicly. The breach may never be disclosed because the company doesn’t know it happened. Breaches in countries with weak disclosure laws often go unreported. India introduced mandatory breach notification requirements through CERT-In’s Directions (April 2022, effective June 2022), which mandated 6-hour incident reporting. The US has state-by-state disclosure laws with significant variation. Many countries have no disclosure requirement at all. If a company operating in those jurisdictions lost your data in 2020, there was no legal reason for them to tell you. The checking tools are genuinely useful. They’re just not a complete picture of your exposure. After you find a breach: the priority checklist</h2> You searched your email and found results. Here is the order in which to respond — don’t try to do everything at once. Change the breached password immediately. Then search your memory (or your password manager) for every other site where you used that same password. Change it on each of those too. This is the highest-leverage action you can take right now. </li> Enable two-factor authentication (2FA) on the affected account. Use an authenticator app (Google Authenticator, Authy, or your password manager’s built-in TOTP) rather than SMS if you have the option. SMS 2FA can be bypassed via SIM swapping. </li> Expect targeted phishing. If your email address was in a breach, attackers know you had an account with that service. You will receive emails that look like they’re from that company, often referencing the real service name and sometimes your real name. Do not click links in those emails. Go directly to the site by typing the URL. </li> If financial data was included: contact your bank the same day. Request new card numbers. Set up transaction alerts. Check your statements for the past 90 days for anything unfamiliar. </li> If your national ID was exposed — SSN in the US, Aadhaar in India, NIN in the UK, SIN in Canada — consider a credit freeze. In the US, you can freeze your credit for free at all three bureaus (Equifax, Experian, TransUnion) via their websites. A freeze doesn’t hurt your credit score and blocks anyone from opening new accounts in your name. In other countries, contact your national credit bureau for equivalent options. </li> If your address and phone were exposed: check whether your data has been amplified onto data broker sites. Brokers buy and aggregate breach data and resell it. One breach can turn into your profile appearing on dozens of people-search sites within weeks. </li> </ol> How do you stay ahead of future breaches?</h2> The reality is you cannot prevent companies you trust with your data from getting hacked. What you can control is the blast radius when it happens. Use a different password on every site, without exception. A password manager (Bitwarden is free and open source; 1Password and Dashlane are strong paid options) makes this manageable. Reusing passwords is the single behavior that turns one breach into ten problems. Use a unique email alias for each service you sign up for. SimpleLogin (now owned by Proton) and DuckDuckGo Email Protection let you create addresses like yourname.amazon@duck.com</code> that forward to your real inbox. When a breach happens, you know exactly which service leaked your data, and you can disable that alias without touching your real address. We cover this in more detail in our email alias and phone mask guide</a>. Sign up for breach notifications on HaveIBeenPwned. When a new breach is indexed and your email appears in it, you’ll get an alert. Early notice gives you time to act before attackers run credential stuffing campaigns against the fresh data. Run a check on your email at least once a year — not just when you hear about a major breach. Breaches from years ago surface in public dumps regularly as they move through the dark web ecosystem. A breach that happened in 2022 might only show up in HIBP’s database in 2025 when someone finally posts the data publicly. Consider monitoring your name and phone number on data broker sites</a> as part of your annual check. Breach data gets picked up by people-search sites automatically and often. A service that submits removal requests under GDPR, CCPA, and India’s DPDPA gives you a way to get it removed rather than just watching it spread. KnytX Shield is built to do this automatically once it launches. A single breach event can seed dozens of broker profiles within months. Have you ever received a breach notification email and ignored it because it seemed low-risk? That email was probably right about the breach. It was probably wrong about the risk. Credential stuffing attacks are indifferent to whether the site that leaked your password seemed important. Frequently asked questions</h2> How do I check if my data was leaked? Enter your email at Have I Been Pwned (haveibeenpwned.com). It’s free and lists the known breaches that included your address. Add Google Password Checkup or Apple’s Passwords app to cover your saved passwords. Is Have I Been Pwned safe and accurate? Yes. It’s built by security researcher Troy Hunt, the breach data is real, and the password checker never sends your actual password. It only shows publicly disclosed breaches, though, not private sales. My email was in a breach. What now? Change that password on the site and everywhere you reused it, then turn on two-factor authentication. Expect targeted phishing, and freeze your credit if a national ID was exposed. How often should I check? At least once a year, not just after a big news story. Old breaches surface in public dumps regularly. Sign up for Have I Been Pwned alerts so you’re notified automatically. Also watch where your details land on people-search sites</a>. What you can do right now</h2> Want to see what data brokers expose about you? See what a scan finds →</a> shows an example report: the kinds of sites that list your name, phone, and address. Once KnytX Shield launches it will find and remove these automatically. Join the waitlist</a> to get in early. The Data Broker Economy: Who Sells Your Information Unknown — Sat, 18 Apr 2026 00:00:00 +0000 The United States Postal Service sells your change-of-address data to commercial data brokers. When you file a USPS change-of-address form, a routine administrative act, the USPS licenses your new address to companies including Acxiom and Experian. They use it to update the consumer profiles they sell. This has been public knowledge for years. Almost nobody knows it happens. That’s the data broker economy in one sentence. It is a system so embedded in ordinary infrastructure that its inputs are invisible, its transactions are private, and its scale is almost impossible to grasp. Who sells your information, and why? A global industry worth more than $200 billion (per industry estimates) collects your data from public records, purchase history, apps, and breaches. It sells that data to advertisers, insurers, employers, political campaigns, and law enforcement. Your profile passes through three to five separate companies before it reaches a buyer, none of whom you consented to. Here is the full chain. The $200 billion industry you’ve never heard of</h2> The global data broker market exceeded $200 billion in 2025 by most industry estimates. IDC, IBISWorld, and others place it in this range. Exact figures vary because the industry doesn’t disclose revenues uniformly. There are more than 4,000 data brokers in the United States alone, according to widely cited industry estimates. Globally, the estimate is above 10,000. These aren’t a single type of company. The term “data broker” covers an entire ecosystem — raw data aggregators, data enrichers, audience platforms, analytics firms, and consumer-facing people-search sites. Your data doesn’t go to one broker. It goes through several, being appended, merged, segmented, and resold at each step. By the time your name, address, income bracket, political affiliation, health indicators, and purchasing behavior reach a marketing platform’s database, they’ve passed through three to five separate companies. You’ve heard of none of them. You consented to none of them. And none of them are required to tell you they hold your data. Who the buyers are</h2> Understanding who buys data explains why the industry exists at all. There’s no shortage of demand. Advertisers are the largest buyer segment. Digital advertising is built on audience targeting — serving ads to people with specific demographics, interests, income levels, and purchasing patterns. Data brokers sell the targeting layer. Google and Meta build their own first-party data. Everyone else buys. Insurers use data to refine risk models. Life insurers have purchased data on consumer purchases, gym memberships, alcohol purchases inferred from receipt data, and health app usage — none of which you disclosed on your policy application. Auto insurers use driving behavior data from apps and connected car systems. This is legal in most jurisdictions. Employers and landlords run background screening through companies like First Advantage and Checkr, which aggregate public records, court data, credit history, and social media activity. You consented to the check. You didn’t consent to which data sources they’d use. Political campaigns are heavy buyers. Voter rolls — which are public records in most US states — become the foundation of campaign targeting. Data brokers layer in consumer behavior, geographic data, and household composition to model voter persuasion scores. This is a multi-hundred-million-dollar spend in US election cycles. Law enforcement purchases commercial data to avoid warrant requirements. This is controversial, legally contested, and real. The FBI, DHS, and local police departments have bought location history, phone data, and social-network graphs from commercial brokers. Buying it sidesteps the court orders they would need to get the same data from carriers directly. Several congressional investigations have examined this practice. The purchases continue. At the dark end of the market: scammers and identity thieves buy data on dark web markets. This is the tail of the same industry. The same profile that sells for $2 on a marketing platform sells for $50 to $150 on a dark web marketplace when packaged with identity verification data. What your data sells for</h2> Price depends on specificity and what the buyer can do with it. A bulk email list — name, email address, general location — sells for $0.01 to $0.10 per record. That’s the commodity end. At scale, advertisers are buying tens of millions of records at a time; the margin is in volume. A more detailed profile — income bracket, age, household composition, inferred interests based on purchasing history — sells for $0.50 to $2 per record. This is the standard programmatic advertising layer. Premium profiles with health indicators (inferred from pharmacy purchases, fitness app data, search history), political views, financial stress signals, and relationship status reach $2 to $10 per record. These sell to insurers, political campaigns, and financial services firms doing targeted credit offers. On dark web markets, a “fullz” package sells for $10 to $150, depending on the target’s creditworthiness and country. A fullz is a full identity: name, date of birth, Social Security Number or equivalent national ID, address history, and sometimes a scan of an ID document. The price goes up for people with clean credit and no prior fraud flags. It’s an irony worth noting: protecting your data is worth more when you have more to lose. Where the data comes from</h2> Every data stream eventually flows into the broker ecosystem. Public records are the foundation. Voter rolls, property ownership records, company filing databases, court records (including bankruptcies and civil judgments), marriage and divorce filings, and death records are all public in most US states. Data brokers have systematically digitized, indexed, and cross-referenced all of it. Loyalty programs and purchase history are the behavioral layer. Every transaction you make with a rewards card — grocery, pharmacy, airline, hotel — is data. The loyalty program knows what you bought, when, and where. This data is licensed to data partners as part of the program’s business model. It’s in the terms you agreed to. App permissions and tracking pixels are the real-time layer. Free apps that request location, contacts, or storage permissions often embed advertising SDKs that transmit behavioral data to aggregators continuously. Tracking pixels on websites — invisible 1x1 images — log your visit, your device fingerprint, your referring source, and your behavior to third-party databases. Breach data enters the ecosystem within days of a major leak. In India, breached telecom and financial-sector data regularly appears on dark web markets. From there it gets absorbed into commercial broker databases, as companies buy “data enrichment” from sources they don’t ask questions about. The line between legitimately collected data and breach data blurs quickly inside broker networks. And then there’s the US Postal Service. When you file a USPS National Change of Address (NCOA) form, the USPS licenses that updated address data to approved commercial mailers and data companies — including major brokers. This is a federal government program selling a piece of your life history to private companies. It is documented. It is legal. It is a scandal. The data broker tiers</h2> The industry has layers. Each layer adds value (to buyers) by making the data more precise. Raw data aggregators sit at the base. Companies like Acxiom</a> (now owned by IPG) and LexisNexis</a> (part of RELX Group) collect raw inputs from public records, partner data feeds, and direct licenses. Their databases contain hundreds of millions of consumer profiles. They normalize the data: standardizing formats, deduplicating records, and building persistent identifiers that follow you across address and name changes. Data enrichers add financial and behavioral context. Experian, TransUnion, and Equifax — known as credit bureaus — sell far more than credit scores. Their marketing data divisions sell lifestyle segments, financial stress indicators, and household demographics to advertisers and insurers. Your credit file is the regulated product. The marketing profile built alongside it is the unregulated one. Marketing data platforms segment audiences for advertising. Epsilon (owned by Publicis), Oracle Data Cloud</a> (Oracle wound down its advertising-data business in 2024), and LiveRamp are where ad agencies go to buy audiences. They ingest data from aggregators and enrichers, run predictive modeling, and sell segments. A typical segment: “women 35–44 with household income over $100K who bought baby products in the last 90 days.” The audience segment is the product, not the individual record. People-search sites are the consumer-facing retail layer. Spokeo</a>, BeenVerified</a>, Whitepages</a>, and dozens of others resell aggregated profiles directly to individuals, usually for background checks or contact lookups. These are the sites that list your home address, relatives’ names, and previous addresses. They buy from the upper tiers. Why this industry is hard to regulate</h2> The data broker industry is not poorly regulated because legislators haven’t noticed it. It’s poorly regulated because it’s structurally resistant to the tools regulators have. Data crosses borders constantly. A US broker collecting data about EU citizens can process it in a third country the EU has deemed adequate. Or it can route the data through a shell operation in a jurisdiction with no data protection law at all. GDPR applies extraterritorially, but enforcing it against a company with no EU presence is difficult in practice. Broker-to-broker transactions are invisible. A company that collects your data has an obligation to disclose third-party sharing. The third party it shared with has a more attenuated obligation to tell you anything. By the fourth or fifth transfer, the audit trail is effectively gone. The industry lobbies heavily against transparency requirements. The California Consumer Privacy Act (CCPA) required data brokers to register with the state — a minimal disclosure requirement. The California Association of Data Brokers fought it. The industry’s opposition to opt-out registries, deletion mandates, and broker-specific legislation has been sustained and well-funded in every jurisdiction that has tried to pass meaningful reform. Comprehensive federal data broker legislation in the US has been introduced and failed multiple times. The EU’s GDPR applies but enforcement is resource-constrained. India’s DPDPA covers some of this ground but is not yet fully operational. The gap between the scale of the industry and the scale of regulatory response is large, and the industry fills that gap with lobbying, complexity, and speed. Frequently asked questions</h2> How big is the data broker industry? Industry estimates put the global market above $200 billion a year, with more than 4,000 brokers in the US alone and over 10,000 worldwide. Exact revenue is hard to pin down because brokers don’t disclose it uniformly. Who buys data from brokers? Advertisers are the largest buyers, followed by insurers, employers and landlords running background checks, political campaigns, and law enforcement. At the illegal end, scammers and identity thieves buy the same profiles on dark web markets. What does my data sell for? A basic marketing record sells for a few cents. A detailed profile with income and household data runs $0.50 to $2. Premium profiles with health, political, or financial-stress signals reach $2 to $10. A full stolen identity (“fullz”) sells for $10 to $150 on dark web markets. What you can do right now</h2> Want to see what data brokers expose about you? See what a scan finds →</a> shows an example report: the kinds of sites that list your name, phone, and address. Once KnytX Shield launches it will find and remove these automatically. Join the waitlist</a> to get in early. Juice Jacking: Is Public USB Charging Safe? Unknown — Thu, 16 Apr 2026 00:00:00 +0000 Your phone is at 4%. Gate C47 at LAX, five minutes to boarding. The seat row in front of you has a USB port built right into the armrest. It’s the kind airports started installing everywhere around 2018 to keep passengers happy. You plug in. The charging symbol appears. Nothing seems wrong. Should you be worried? That depends on understanding what juice jacking actually is and what the security research says. It also depends on what the threat looks like in practice, not just in a controlled demonstration at a security conference. What juice jacking is</h2> USB cables carry two things: power and data. That’s the design. The same connector that charges your phone is also the one you use to transfer photos to a computer, update firmware, or mirror your screen to a display. Power flows in one direction; data can flow in both. A conventional wall outlet has no data path. It produces electricity and nothing else. A USB charging port, whether built into a seat, mounted on a wall in a hotel lobby, or sitting in a coffee shop kiosk, is different. Behind that port is hardware. That hardware may have been tampered with, or it may have been malicious from the start. Either way, it can attempt to initiate a data connection to your phone the moment you plug in. That’s the premise of juice jacking. An attacker controls a charging port. Your phone connects expecting to charge. The port instead tries to access your data, install software, or both. The question worth sitting with is whether this is happening in the wild, at airports and hotels and convention centers, to ordinary people. The honest answer is: the attack is real and has been demonstrated repeatedly. Documented cases of mass exploitation in public spaces are a different matter. Where this started</h2> The attack was first publicly demonstrated in 2011 at DEF CON, the annual security research conference in Las Vegas. Researcher Kyle Osborn showed that a charging station could be rigged to access data on phones connected to it. The demonstration was a proof of concept — showing the attack was possible, not that someone was actively running it against travelers. In 2013, a team from Aries Security took things further. Researchers Billy Lau, Yeongjin Jang, and Chengyu Song presented “Mactans” at Black Hat. It was a malicious charger the size of a small power adapter that could install hidden malware on a fully patched iPhone in under 60 seconds. The hardware cost around $45 to build. It bypassed Apple’s code-signing and app verification systems as they existed at the time. Mactans was alarming precisely because it worked. Apple patched the specific vulnerabilities it exploited in subsequent iOS releases. But the underlying principle — that a USB connection is also a data connection, and a tampered charging device could use that — remained valid. At DEF CON 2019, researchers from Authentic8 demonstrated updated versions of the attack against more modern devices, showing that while protections had improved, they weren’t absolute. None of these demonstrations were attacks against real travelers. They were controlled research disclosures designed to push manufacturers to build better defenses. That’s how responsible security research works. It’s also why it’s important not to read “demonstrated at DEF CON” as synonymous with “happening at airports right now.” What changed on your phone</h2> The practical risk profile of juice jacking for an iPhone user changed significantly in 2018. Apple introduced USB Restricted Mode in iOS 11.4.1. The mechanic is straightforward. If your iPhone has been locked for more than an hour without being unlocked, it blocks all data transfer over the Lightning (or USB-C) port. Power still flows. Data doesn’t. Connect to a new USB source — a computer, a dock, or any device that tries to establish a data connection. Your iPhone then shows a prompt: “Trust This Computer?” If you tap “Don’t Trust” or simply don’t respond, no data transfer happens. The port treats the connection as charge-only. This raised the bar meaningfully. An attacker running a compromised charging station can no longer silently initiate data access without you actively approving it. You’d have to tap “Trust” on a prompt that explicitly asks whether you want this unknown device to access your phone’s data. Most people don’t tap Trust on a public charging station. Android has had analogous protections for years. Modern Android devices default to “Charge only” mode when connected to an unrecognized USB source. Data transfer over USB requires navigating into developer settings or responding to a prompt. A locked Android device connected to a malicious USB port will charge — but won’t automatically hand over file access. These protections are not theoretical. They reflect years of iterative hardening by Apple and Google in direct response to the security research community demonstrating exactly the kind of attacks described above. A recent, fully patched iPhone is substantially harder to juice-jack than the device the Mactans researchers targeted in 2013. The FBI and FCC warnings</h2> In April 2023, the FBI’s Denver field office posted a warning on X (then Twitter) advising against using public USB charging stations. “Avoid using free charging stations in airports, hotels or shopping centers,” the post read. “Bad actors have figured out ways to use public USB ports to introduce malware and monitoring software onto devices.” The FCC issued its own advisory around the same time, recommending portable power banks and AC adapters as alternatives. The warnings were real. They weren’t hypothetical. The FBI doesn’t issue consumer advisories without reason. What the warnings didn’t include was reference to specific documented cases of juice jacking harming ordinary consumers at public charging stations. They were precautionary — based on the demonstrated feasibility of the attack rather than a surge in confirmed incident reports. The FBI routinely issues warnings about attack techniques that are technically viable before those techniques become widespread exploited threats. That’s the point of a warning: to flag something before it becomes a documented epidemic, not after. The FCC advisory was similarly precautionary. It noted that travelers had been “targeted by” juice jacking without citing specific public data on confirmed incidents. This distinction matters. A warning that an attack is possible and worth preventing is different from an announcement that the attack is currently happening at scale. Both things can be true simultaneously: the FBI warning was legitimate, and documented mass consumer harm from public USB stations is not well-established in public reporting. What attackers could actually do</h2> Set the precautions and the research aside for a moment and look at what the attack could accomplish if someone were actually running it. Data extraction is the first possibility. If your phone accepts the connection and trusts the device, a compromised port could potentially browse your file system. On an iPhone that’s been unlocked and trusts the connection, that could include photos, documents, contacts, and app data. It is still subject to the increasingly strict sandboxing that Apple and Google have built around app data access. An attacker doesn’t get a clean dump of your password manager just because you trusted the port. Malware installation is the more serious scenario. Historically, this required exploiting specific vulnerabilities in the way iOS or Android handled USB device connections. Mactans did this in 2013. Apple patched the vulnerabilities it used. Subsequent research has continued to find narrower and narrower attack surfaces, but no complex system is permanently immune. The key variable is whether your device is patched. A fully updated phone is significantly harder to compromise via USB than one running software from two years ago. BadUSB is a third category and worth understanding separately. Researchers Karsten Nohl and Jakob Lell introduced it at Black Hat 2014. BadUSB involves reprogramming the firmware of a USB device. It doesn’t just modify a port; it alters the device itself so it presents to the host computer or phone as a keyboard, mouse, or other trusted input device. A USB drive programmed with BadUSB can silently type commands into your computer at machine speed. This is a real and serious attack class. It works against computers with more straightforward reliability than against modern phones with locked-down USB permission systems. It requires physical modification of USB hardware and is primarily relevant to corporate and government targets rather than someone’s phone at an airport. The honest risk assessment</h2> Here’s where most coverage of juice jacking loses the plot. It presents the attack as either completely trivial or completely overblown. The actual answer is more boring, and more useful. The attack is technically real. It has been repeatedly demonstrated by credible researchers in controlled conditions. The FBI and FCC warnings were legitimate advisories, not security theater. Documented mass exploitation of public USB charging stations against ordinary consumers is not well-established. This doesn’t mean it hasn’t happened — it means it hasn’t been publicly confirmed and reported at scale. Absence of evidence isn’t evidence of absence; juice jacking attacks wouldn’t necessarily generate obvious symptoms that a victim would recognize and report. What is documented: USB-based attacks against specific high-value targets. Corporate espionage via USB devices. Government-level surveillance using USB implants. The cybersecurity firm Kaspersky has documented sophisticated iPhone attacks, including the “Operation Triangulation” campaign disclosed in 2023. Those were delivered via iMessage zero-click exploits rather than USB. But the sophistication of those attack chains illustrates what well-resourced adversaries can do when they want into a specific device. Consider a mid-level executive at a US company traveling to a conference. Their threat model is different from that of a diplomat in a country with known state-sponsored cyber operations. And both are different again from the average person charging their phone at O’Hare. Who should be most concerned</h2> Some people’s phones hold access to corporate networks, sensitive government information, or high-value financial accounts. For them, especially when traveling in countries where state-sponsored hacking is documented at scale, treating every USB port as potentially compromised is not paranoia. It’s appropriate operational security. Countries including China, Russia, and North Korea have been cited by Western intelligence agencies and cybersecurity firms for sophisticated state-sponsored intrusion campaigns. A compromised USB charging station at a hotel near a major trade conference would be a rational attack vector for signals intelligence. The FBI advisory took on particular resonance after reporting in 2019 and 2020 about Chinese intelligence operations targeting businesspeople and government officials traveling to China. One documented tactic: handing targets USB drives pre-loaded with malware. The step from a malicious USB drive to a malicious USB charging port is not large. For a law firm partner traveling to meetings in Beijing, a journalist reporting on sensitive political topics, or a government employee with clearance, the practical advice is simple. Don’t plug into anything you don’t control. Carry your own equipment. Use cellular data instead of hotel Wi-Fi. This isn’t theoretical. It’s the guidance that security-aware organizations give their employees for a reason. For an ordinary person charging their phone at a domestic airport before a vacation flight? The risk profile is lower. Not zero — but lower, and manageable with simple precautions. What you should actually do</h2> The most straightforward defense against juice jacking eliminates the risk entirely: carry a portable power bank. A 10,000 mAh power bank — enough to fully charge most smartphones twice — costs between $20 and $40 and fits in a jacket pocket. You charge it at home using your own charger, and you never need to connect your phone to a public USB port. No risk of juice jacking. No dependency on whether an airport’s USB port happens to be compromised or maintained. Power banks have become cheap enough and small enough that there’s almost no scenario where the inconvenience outweighs the certainty they provide. If you’re somewhere with a power outlet but no power bank, use the outlet. Plug your own AC adapter into the wall and connect your own cable to your own charger. A standard electrical outlet carries power and nothing else. No data connection is possible. This is the second-safest option and often overlooked because people see “charging port” and assume they need a USB port. If you do need to use a USB port, a USB data blocker is a $10–15 device that sits between your cable and the charging port. It allows current to pass through while physically breaking the data pins — pins 2 and 3 in USB spec. A data blocker turns any USB port into a charge-only connection regardless of what’s on the other end. PortaPow makes a widely used model. Privise and other brands offer alternatives. They’re small enough to keep on a keychain and work transparently — you plug in, your phone charges, no data flows. If you travel frequently and use public charging regularly, a data blocker is worth carrying. On your iPhone: if a prompt asking “Trust This Computer?” appears when you plug into a charging port, particularly one in a public space, tap “Don’t Trust.” You should not see that prompt from a legitimate charging station, which should only be delivering power. If you see it, something on the other end is requesting a data connection. That’s worth noticing. Keep your phone’s operating system updated. This isn’t USB-specific advice, but it applies directly here. The security protections against USB-based attacks are meaningfully better on current iOS and Android than on versions from two or three years ago. As of mid-2026, current releases (iOS 26 and Android 17) are materially more resistant to documented attack techniques than iOS 11 was in 2018. And iOS 11 was already better than iOS 10. Apple’s USB Restricted Mode has also kept evolving, including a 2025 patch (in iOS 18.3.1) for a flaw that could bypass it on locked devices. Software updates close the specific vulnerabilities that juice jacking research has historically exploited. Maybe your work involves sensitive data: corporate networks, classified information, financial systems, or sensitive sources as a journalist. If so, adopt the traveler’s posture. Bring your own power, question every shared USB port, and treat the threat model as elevated rather than average. The inconvenience of carrying a power bank is minor compared to the consequences of a compromised device. The thing about risk framing</h2> Security advice suffers from two failure modes: dismissing real threats as unlikely, and amplifying unlikely threats as certain. Both are unhelpful. Juice jacking falls somewhere between the two. The attack is technically real, has been demonstrated by credible researchers, and prompted legitimate warnings from federal agencies. The evidence that ordinary travelers are being compromised in significant numbers at US or European airports is not well-documented in public reporting. The precautions are cheap. A power bank is useful regardless of any security calculation. A USB data blocker costs less than a coffee at the airport. Keeping your software updated is free and protects against many threats simultaneously. You don’t need to believe juice jacking is an imminent mass threat to make these changes worthwhile. The calculus is simple. The cost of precaution is low, and the potential harm from a compromised phone is high. Eliminating the risk entirely by carrying your own power takes about thirty seconds of planning the night before you travel. Your phone at 4% feels urgent. It is urgent — you’re about to board. But plugging into a USB port you don’t control is a choice, and it’s one that’s easy to make differently. What you can do right now</h2> Juice jacking is one vector among many ways an attacker can access what your phone knows about you. Your phone carries your contacts, your email, your financial apps, and in many cases your work credentials. A far more common way those credentials leak is infostealer malware</a>, which scrapes saved passwords and session cookies from a compromised device. See what a scan finds →</a> walks through an example report of the personal data — name, address, phone number — that data broker sites expose. That exposure is often the first step in targeting you for any kind of attack, USB or otherwise. Once KnytX Shield launches it will find and remove these listings automatically. Join the waitlist</a> to get in early. What to Do After Being Scammed: A Recovery Playbook Unknown — Wed, 15 Apr 2026 00:00:00 +0000 Stop reading the coverage of how the scam works. You already found that out. What you need now is the recovery playbook — what to do in the next hour, the next day, and the next month. The first 24 hours are the most important. That is not an exaggeration. Wire recall requests submitted within two hours succeed far more often than those submitted 48 hours later. Chargeback rights are time-limited. Evidence disappears. Bank fraud teams have escalation paths that close quickly. So before you do anything else, move fast, document everything, and do not pay anyone who says they can get your money back. The short answer. Act in this order. First, call your bank or card issuer’s fraud team and request a chargeback (credit card) or wire recall (wire transfer). If you sent crypto, contact the receiving exchange right away. Second, screenshot and archive every piece of evidence before it disappears. Third, report to IC3 (US), Action Fraud (UK), or the 1930 helpline (India). Then freeze your credit if you shared any identity details. And ignore anyone who contacts you offering to recover your money for a fee. That is the recovery scam, the predictable second wave. The First Hour: Stop the Bleeding</h2> If you paid by credit card</h3> Call your card issuer immediately. Tell the fraud team you were scammed and you want to dispute the charge. In the United States, the Fair Credit Billing Act gives you the right to dispute unauthorized or fraudulent charges on a credit card within 60 days of the statement date. Most issuers will provisionally credit your account while they investigate. This is your strongest recovery path. Do not just call customer service. Ask specifically for the fraud department or disputes team. Get a case number before you hang up. If you paid by debit card</h3> Your protections are weaker here. The Electronic Funds Transfer Act gives you dispute rights, but the timeframes are tighter: two days for zero liability, then up to 60 days for limited liability. Many banks also treat debit disputes more skeptically than credit card disputes. Call your bank immediately regardless. Ask for the fraud team. Request they initiate a recall or reversal. If you wired money</h3> A wire transfer is the hardest payment to recover. Once the receiving bank has released the funds, the odds drop sharply. That said: call your bank’s fraud department right now and ask them to initiate a wire recall. SWIFT wire recalls are a real mechanism — the sending bank contacts the receiving bank and requests a return of funds. Success rate is low for cross-border wires to foreign accounts, but it is not zero in the first few hours. Give the fraud team every detail: amount, destination bank name, account number if you have it, date and time. Domestic wire transfers within the same country move through systems like Fedwire or CHAPS and can sometimes be recalled faster. Tell the fraud team the receiving bank’s name if you know it — they can contact their correspondent bank directly. If you sent cryptocurrency</h3> Cryptocurrency transactions confirmed on the blockchain are, in most cases, irreversible. There is no bank to call a recall. But there are two things worth doing immediately: First, document the wallet address you sent to. Copy it exactly. You will need it for reports. Second, the scammer may have given you a deposit address at a centralized exchange such as Binance, Coinbase, or Kraken. If so, contact that exchange’s fraud team immediately with the wallet address, transaction hash, and a brief explanation. Some exchanges will freeze the funds in that account pending investigation, especially if you reach them before the scammer withdraws to an external wallet. This window is short. Do it now. Report the wallet to ChainAbuse.com</a>, which aggregates blockchain fraud reports and is monitored by some exchanges and law enforcement. Document Everything Before It Disappears</h2> Scammers delete accounts, shut down fake websites, and change phone numbers fast. Before you file a single report, capture: Screenshots of all communications (texts, emails, chat apps)</li> The website URL and a screenshot of it — then use web.archive.org/save</a> to archive it</li> The phone number, email address, and any names used</li> Payment confirmations and receipts</li> The crypto wallet address and transaction hash if applicable</li> Any profiles on dating apps, social platforms, or investment platforms</li> </ul> Save all of this to a folder. You will attach it to every report you file. Reporting: Where to File and Why It Actually Matters</h2> Many scam victims never report because they feel embarrassed or believe nothing will happen. Both reactions are understandable. But reporting matters for three reasons. It creates the paperwork trail your bank and insurer will require. It may unlock compensation mechanisms. And at scale, law enforcement does build cases from aggregated reports. The U.S. Department of Justice indictments against IRS impersonation call centers in India relied heavily on pattern data built from IC3 reports. United States</h3> FBI IC3 — ic3.gov</a>. The Internet Crime Complaint Center is the primary federal intake for cybercrime and fraud. File here even if the scam seems “small.” This data feeds federal prosecutions.</li> FTC — reportfraud.ftc.gov</a>. The Federal Trade Commission tracks scam patterns, publishes consumer alerts, and uses complaint data to take enforcement actions. Filing here also links your report to IdentityTheft.gov recovery tools if identity theft is involved.</li> Your state attorney general — Most state AGs have consumer protection divisions with online complaint forms. Search “[your state] attorney general consumer complaint.”</li> CISA — cisa.gov/report</a> for technology-related fraud including phishing, ransomware, and business email compromise.</li> </ul> United Kingdom</h3> Action Fraud — actionfraud.police.uk</a>. The national fraud and cybercrime reporting center. You will get a crime reference number, which you need for bank complaints and insurance claims.</li> Ofcom — For phone-based fraud including spoofed numbers, report to ofcom.org.uk</a>.</li> Financial Conduct Authority — fca.org.uk/consumers/report-scam</a> for investment fraud, clone firm fraud, and unauthorized financial services.</li> </ul> India</h3> Cyber Crime Helpline — Dial 1930. This is the fastest route. The National Cybercrime Reporting Portal operates a financial fraud response mechanism that can send freeze requests to partner banks within hours if called quickly. Do not wait to file online — call 1930 first.</li> National Cyber Crime Reporting Portal — cybercrime.gov.in</a>. File a written complaint here after calling 1930.</li> </ul> European Union</h3> EUROPOL — Cross-border fraud involving multiple EU countries can be reported through europol.europa.eu/report-a-crime</a>.</li> Your national police cybercrime unit (BKA in Germany, OCLCTIC in France, Guardia Civil Cybercrime in Spain).</li> </ul> Cryptocurrency fraud (all regions)</h3> ChainAbuse.com</a></li> The specific exchange or platform involved</li> The FTC (US) or Action Fraud (UK)</li> CipherTrace and similar blockchain analytics firms accept reports that can support law enforcement investigations</li> </ul> Financial Recovery: Honest Assessment by Payment Type</h2> Here is a realistic breakdown. The amounts in the left column are rough thresholds where each option is worth pursuing seriously. Credit card chargeback — Strongest protection. Time-limited (60 days in the US; similar in UK and EU). Most issuers will provisionally credit while investigating. Success rate is high when the merchant is clearly fraudulent. Debit card / bank transfer — Weaker protections in the US; no federal equivalent to the credit card rules. In the UK, the Authorized Push Payment (APP) fraud reimbursement scheme, implemented October 2024, now requires banks to reimburse victims of APP fraud up to £85,000. If you are in the UK and you were tricked into authorizing a bank transfer, your bank is legally obligated to reimburse you under this scheme — file an APP fraud complaint with your bank specifically. Wire transfer to domestic account — Low but non-zero recovery rate if reported within hours. Contact both the sending and receiving bank. File with IC3 or Action Fraud. For amounts above $10,000, also contact your local FBI field office directly. SWIFT wire to foreign accounts — Very low recovery rate once the transfer clears. File all reports, document everything, and set realistic expectations. Your bank may voluntarily reimburse for a limited number of verified fraud cases, particularly if you are a long-standing customer — ask directly about their fraud reimbursement policy. Zelle (US) — Bank of America, Wells Fargo, and JPMorgan Chase have faced significant regulatory pressure over Zelle fraud. If you were deceived into sending money via Zelle, file a dispute with your bank citing fraud (not just an unauthorized transaction — a scam-induced authorized payment). Some banks have expanded their policies; persistence matters here. Civil litigation — If the fraudster is identified, has assets, and the amount exceeds roughly $10,000 to $20,000, a civil lawsuit is worth discussing with an attorney. For smaller amounts, Small Claims Court is an option in many jurisdictions without requiring legal representation. If the scam operated as a business entity — a fake investment firm, a fake tech support company — a judgment against the entity is possible even if collecting is difficult. Insurance — Check your homeowners or renters policy. Some policies include riders for identity theft or financial fraud. This is often overlooked. Call your insurer and ask specifically whether your policy covers fraud losses. If you have a standalone identity theft protection product, read the terms carefully — some cover direct financial losses, some only cover recovery costs. Your Identity After a Scam</h2> What you gave the scammer determines what you need to lock down. If you gave your Social Security Number, date of birth, or government ID documents: Treat this as a personal data breach. Freeze your credit at all three bureaus immediately: Equifax — equifax.com/personal/credit-report-services/credit-freeze</a></li> Experian — experian.com/freeze/center.html</a></li> TransUnion — transunion.com/credit-freeze</a></li> </ul> A credit freeze is free, immediate, and prevents new accounts from being opened in your name. It does not affect your existing accounts or credit score. It stays in place until you lift it. A separate post on this blog covers the difference between a credit freeze and a fraud alert in detail — short version: freeze is the stronger tool. Also place a fraud alert (one bureau notifies the others) and consider enrolling in credit monitoring for 12 months. In the US, report potential identity document misuse to the Social Security Administration at ssa.gov</a>. In the UK, contact CIFAS (cifas.org.uk) about a protective registration, which flags your identity to member lenders. In India, contact UIDAI regarding your Aadhaar at uidai.gov.in</a> if your Aadhaar details were disclosed. If you gave an email address and password: Change that password immediately on every service where you used it. Enable two-factor authentication. Check haveibeenpwned.com</a> to see if that email is in known breach data. If you gave bank account details (account number, sort code, routing number): Monitor your accounts closely for fraudulent transactions. Contact your bank and ask whether they recommend issuing a new account number. Some banks will do this as a precaution for verified fraud cases. If you gave ID document photos (passport, driving licence, national ID): In the UK, report to the DVLA if your driving licence was involved; contact the Identity and Passport Service for passport fraud. In the US, report to the FTC at identitytheft.gov</a> — this generates a personalized recovery plan. In India, if ID documents were photographed and misused, UIDAI has a process for biometric locking at uidai.gov.in</a>. The Recovery Scam: Know the Pattern Before It Reaches You</h2> This is important enough to repeat, even though there’s a full post on it: the guide to recovery scams</a>. Do not engage with anyone who contacts you unsolicited claiming they can recover your money. This is a documented second victimization pattern. Criminal networks that run investment scams, romance scams, and crypto fraud routinely sell their victim lists to “recovery” operations — sometimes the same network runs both. The caller may know your name, the amount you lost, the name of the fake platform you used, and your IC3 case reference number. They use all of this to sound legitimate. The tell is always the same: they ask for money upfront, in crypto or wire transfer, before they recover anything. No legitimate law enforcement agency, law firm, or government body charges upfront fees to recover funds. If someone calls you after you’ve been scammed with an offer to help, hang up. If they have your case number and other accurate details, that is evidence of information theft, not legitimacy. Report it to IC3 or Action Fraud. The Emotional Dimension</h2> Research consistently finds that fewer than 15% of scam victims file a formal report, with shame cited as the primary barrier. That shame is not incidental. It is deliberately engineered. Romance scams, investment scams, and elder fraud are built around trust. The psychological manipulation in long-running pig butchering scams</a> and romance frauds closely mirrors the tactics studied in coercive control research: gradual isolation, fabricated intimacy, escalating commitment, and manufactured urgency. Being deceived by a sophisticated, well-resourced operation is not evidence of poor judgment. It is evidence that the operation was effective. If you are struggling with the aftermath, these organizations provide non-judgmental support: AARP Fraud Watch Network (US) — helpline: 1-877-908-3360. Open to all ages despite the name.</li> Victim Connect (US) — victimconnect.org</a>, 1-855-4-VICTIM</li> Action Fraud support (UK) — actionfraud.police.uk</a> links to victim support services after you file</li> Cyber Crime Helpline 1930 (India) — also connects to victim support resources</li> </ul> Talking to someone who handles these cases regularly — rather than someone close to you who may not understand how sophisticated these operations are — often helps more. Long-Term: Reducing Your Exposure</h2> After the immediate recovery steps, a few longer-term actions reduce your risk. Register for Do Not Call lists. In the US, the National Do Not Call Registry is at donotcall.gov</a>. In the UK, the Telephone Preference Service is at tpsonline.org.uk</a>. These won’t stop calls from offshore operations, but they establish a legal basis to report ongoing harassment and reduce domestic marketing volume. Enable spam filtering at carrier level. Major carriers (Verizon Call Filter, AT&T ActiveArmor, T-Mobile Scam Shield) offer call screening that can block spoofed and flagged numbers. Some are free; some are paid tiers. Monitor your data for resale. If your contact and personal details were given to a scammer, they may end up in breach dumps that circulate on fraud forums and get sold to other criminal operations. Services that alert you when your email or phone number appears in new data dumps can give you early warning that your information is circulating. This won’t undo the scam, but it lets you stay ahead of secondary use. It also helps to get your records off the data broker sites</a> that scammers buy from. KnytX Shield isn’t live yet; once it launches, it’s built to find and remove those listings for you. Join the waitlist</a> to get in early. Brief your household. If you share finances or identity documents with family members, let them know what happened. Scammers with your information may attempt to reach family members. They do not need to know the full story — they need to know the warning signs. Quick Reference Checklist</h2> Within the first hour: Call your bank or card issuer — ask for the fraud team</li> Request a chargeback (credit card) or wire recall (wire transfer)</li> Contact the crypto exchange if you sent to a custodial address</li> Screenshot and archive all evidence</li> </ul> Within the first 24 hours: File with IC3 (US), Action Fraud (UK), or 1930 / cybercrime.gov.in (India)</li> File with the FTC (US) or FCA (UK) for investment fraud</li> Freeze your credit if you gave any identity information</li> Change compromised passwords and enable two-factor authentication</li> Check your insurance policy for fraud coverage</li> </ul> Ongoing: Monitor bank and credit accounts daily for 30 days</li> Enroll in credit monitoring for 12 months</li> Do not respond to anyone offering to recover your money</li> Register for Do Not Call lists</li> Check haveibeenpwned.com for your email address</li> </ul> The window matters. Start with the first item on that list before you finish reading this page. Your GDPR Rights: A No-Jargon Guide Unknown — Tue, 14 Apr 2026 00:00:00 +0000 In 2023, Ireland’s Data Protection Commission fined Meta €1.2 billion for transferring European user data to the US. In 2022, Google was hit with a €150 million fine in France (covering two Google entities in the same decision). Amazon paid €746 million to Luxembourg’s regulator in 2021. These are not symbolic numbers. They are enforcement actions taken because GDPR has real, mandatory obligations — and regulators are willing to enforce them. The rights that underpin those fines belong to you. Every EU resident has the legal right to access their data, demand its deletion, and object to how it’s used. Most people have never exercised a single one of these rights. Not because the process is impossible, but because no one has shown them how. This guide does exactly that. The short answer: Your two most useful GDPR rights are access (Article 15) and erasure (Article 17). To use them, find the company’s Data Protection Officer, email a written request naming the specific data, and keep a dated copy. They must respond within 30 days. If they refuse without a valid Article 17(3) ground, or ignore you, file a free complaint with your national data protection authority. The fastest-acting right is the Article 21 objection to direct marketing, which is absolute. The GDPR rights most people never use</h2> The General Data Protection Regulation came into force in May 2018. Since then, EU data protection authorities have issued over €4 billion in fines. The DPC — Ireland’s Data Protection Commission, which handles complaints against every major US tech company registered in Dublin — alone has issued multi-billion euro penalties. The enforcement reality is clear: companies are legally obligated to respond to your requests. The law has teeth. What’s missing is the everyday person who knows how to actually send a Subject Access Request or an erasure request and follow through when they’re ignored. That changes here. No legal definitions, no theory. Just what you do, step by step. Your six most useful GDPR rights</h2> The regulation contains dozens of provisions. These six are the ones that matter in practice. Right of access (Article 15) — Ask any company what personal data they hold about you. That includes where they got it, what they are doing with it, and who they have shared it with. They must respond within 30 days. No charge for the first request. Right to rectification (Article 16) — If a company holds inaccurate data about you (wrong address, incorrect employment history, outdated contact details), demand they correct it. They must act without undue delay. Right to erasure (Article 17) — This is the “right to be forgotten.” You can request that a company delete your personal data. This right is not absolute. They can refuse if they have a legal obligation to retain it, a legitimate overriding interest, or a need for the data in legal claims. But for most commercial data, it works. Right to restrict processing (Article 18) — You can freeze how a company uses your data without requiring deletion. Useful when you’ve disputed the accuracy of data and want processing paused while they verify it. Right to data portability (Article 20) — Request your data in a machine-readable format (CSV, JSON) so you can take it to a competitor or keep it yourself. Applies when processing is based on your consent or a contract. Right to object (Article 21) — Object to a company processing your data for certain purposes, including profiling. When the purpose is direct marketing, this right is absolute. More on this below. How to send a Subject Access Request</h2> A Subject Access Request (SAR) is your formal request under Article 15 asking a company what data they hold on you. Start here before you request deletion — the SAR tells you what you’re actually dealing with. Step 1: Find the company’s Data Protection Officer (DPO). Large companies and any organisation that processes data at scale are required by GDPR to appoint a DPO. Check the company’s privacy policy — the DPO contact must be published. If it’s not there, write to their general privacy contact address (usually listed as privacy@[company].com</code> or a dedicated form). Step 2: Write your request. Email works. You do not need a lawyer. Keep a copy of everything you send. Step 3: Include the essentials. Your request needs four things. Your full name. Enough information to identify your account (the email address you registered with, or a customer reference number). A clear statement that you are making a Subject Access Request under Article 15 of the GDPR. And what specific data you want, or “all personal data you hold on me.” Step 4: Verify your identity if they ask. Companies are allowed to ask you to verify who you are before processing a SAR. Provide what they ask — a copy of your ID or confirmation of account details — but you are not required to provide more than is proportionate. Here is a template you can adapt: Subject: Subject Access Request — [Your Full Name] Dear Data Protection Officer, I am writing to exercise my right of access under Article 15 of the General Data Protection Regulation (GDPR). Please provide me with all personal data you hold about me, including: the categories of data processed, the purposes for which it is processed, any third parties with whom it has been shared, and the retention period applied to it. My details: [Full name], [email address on account], [any account/reference number]. I look forward to your response within the statutory 30-day period. [Your name] </blockquote> Send it. Mark your calendar for 30 days. If they don’t respond, you have grounds to escalate immediately. How to send an erasure request</h2> Once you know what data a company holds — or if you already know you want it deleted — send a GDPR erasure request under Article 17. This is the right to be forgotten made practical. Step 1: Identify the specific data you want deleted. Be as precise as you can. “All personal data you hold” is valid. So is “my email address and purchase history.” Precision makes refusal harder to justify. Step 2: State your legal basis. You need a reason to trigger the right. The most common reasons are three. You are withdrawing the consent you gave when you signed up. The data is no longer necessary for the purpose it was collected. Or you are objecting to the processing and there is no overriding legitimate interest. Step 3: Write your request. Subject: Erasure Request under Article 17 GDPR — [Your Full Name] Dear Data Protection Officer, I am writing to exercise my right to erasure under Article 17 of the General Data Protection Regulation (GDPR). I request that you delete all personal data you hold about me. I am withdrawing any consent I previously gave to the processing of my personal data. To my knowledge, there is no overriding legal basis for continued retention. My details: [Full name], [email address on account], [any account/reference number]. Please confirm in writing that my data has been erased within the statutory 30-day period. If you intend to refuse this request, please provide the specific legal basis for refusal under Article 17(3). [Your name] </blockquote> Valid refusal grounds: Legal obligation to retain the data (tax records, for example). Freedom of expression or public interest. A legal claim the data is needed for. These are the legitimate reasons. “We need it for our marketing” is not. If they refuse improperly: Escalate to your national data protection authority. This is your next step, not an optional one. The companies most worth targeting first</h2> Not all SARs and erasure requests are equally valuable. These categories of companies are worth prioritising. Email marketing lists. If you’re receiving marketing email you never signed up for, the sender holds your data under questionable grounds. Send an erasure request and an Article 21 objection simultaneously. They must stop marketing immediately. Data brokers operating in the EU. Companies like Acxiom EU and Nielsen Marketing Cloud hold detailed profiles on millions of Europeans — purchase behaviour, demographic inferences, browsing patterns. They are subject to GDPR. You have the right to see what they hold and request deletion. Credit reference agencies. Experian, Equifax, and TransUnion operate in the EU and UK. They hold your financial history, addresses, and employer data. Submit a SAR first — you may find data you didn’t know existed. Social media platforms. Meta, Google, TikTok, and LinkedIn are all subject to GDPR (via their Irish or European entities). They hold enormous amounts of data. SARs to these companies produce large, detailed reports that are worth reviewing. Loyalty programmes. Supermarket loyalty schemes, airline frequent flyer programmes, and retail cards collect purchase data for years. If you’ve closed an account or stopped using a programme, send an erasure request. Former employers. Your ex-employer may hold payroll data, performance reviews, and personal correspondence long after you’ve left. GDPR gives you the right to request deletion of data no longer necessary for the purposes it was collected. When they ignore you: escalation</h2> The 30-day response window is not a suggestion. It is a legal deadline under Article 12(3). If a company fails to respond, or responds with a refusal that lacks a valid legal basis, you have a clear escalation path. What a valid response looks like: A company must either comply with your request or explain in writing why they are refusing, citing the specific Article 17(3) ground that applies. What to do when they don’t respond: File a complaint with your national data protection authority (DPA). This is free, straightforward, and taken seriously — especially post-2018, when regulators have demonstrated they will act. The five largest EU DPAs, and the one that matters most for tech complaints: CNIL (France) — cnil.fr</a></li> BfDI (Germany) — bfdi.bund.de</a></li> AEPD (Spain) — aepd.es</a></li> Garante (Italy) — garanteprivacy.it</a></li> DPC (Ireland) — dataprotection.ie</a> — this is the authority that regulates Meta, Google, Apple, Microsoft, TikTok, and most other large US tech companies, all of which have their EU headquarters in Ireland</li> </ul> File with your local DPA first. They will coordinate with the lead authority (often the DPC) if the company is based in another member state. You don’t need to navigate that coordination yourself. Keep records of everything: your original request, the date you sent it, any response or lack of response. DPA complaint forms ask for this documentation. GDPR vs UK GDPR vs CCPA</h2> If you are in the UK, you are covered by UK GDPR — essentially identical to EU GDPR, retained after Brexit and enforced by the Information Commissioner’s Office (ICO). The rights are the same. The enforcement body is different. The ICO has its own penalty regime and has issued substantial fines independently of EU regulators. See our guide to UK GDPR post-Brexit</a> for the specific differences. If you have data with US companies that also operate in California, those companies may be subject to the California Consumer Privacy Act (CCPA). CCPA is weaker than GDPR — fewer rights, a narrower scope, and a different enforcement model. The right to deletion exists, but the exemptions are broader. The right to object to marketing is not absolute. There is no equivalent to GDPR’s right to restrict processing. See our full CCPA breakdown</a> for detail. The practical upshot: if you are in the EU, GDPR gives you the strongest individual data rights of any major jurisdiction. Use them. The right to object to direct marketing: the overlooked right</h2> Here is the most underused GDPR right, and the one that works fastest. Article 21(2) is absolute. Say a company is processing your personal data for direct marketing: promotional emails, targeted ads, SMS offers. You have the right to object, and they must stop. Immediately. No legitimate interest override. No balancing test. No “we’ll review it and get back to you.” The moment you object to marketing, the legal basis for that processing evaporates. This is different from every other GDPR right. The right to erasure has exceptions. The right to access has conditions. The right to object to marketing has none (as it relates to direct marketing specifically). Most people use the unsubscribe link at the bottom of an email. That works for compliant companies, but it does not trigger the full legal obligation. And it does not stop the company from selling your data to other marketers who will start the cycle again. An Article 21 objection does. It puts the company on formal legal notice. It creates a documented record. And if they continue marketing to you after receiving it, that’s a GDPR violation you can report to your DPA. You are entitled to send this: “I am formally objecting to the processing of my personal data for direct marketing purposes under Article 21(2) of the GDPR. Please cease all such processing immediately and confirm in writing that you have done so.” That’s it. Send it. They must comply. What you can do right now</h2> Want to see what data brokers expose about you? See what a scan finds →</a> shows an example report: the kinds of sites that list your name, phone, and address. Once KnytX Shield launches it will find and remove these automatically. Join the waitlist</a> to get in early. Your Rights Under UK GDPR: What Changed After Brexit Unknown — Mon, 13 Apr 2026 00:00:00 +0000 On 31 December 2020, the UK stopped being an EU member state. The next morning, EU GDPR technically ceased to apply on British soil. Parliament had anticipated this — and the solution was to copy the entire regulation into domestic law, word for word, and call it UK GDPR. Your rights survived Brexit. But five years on, the picture is more complicated than that tidy handover suggests. What Brexit did to your data rights</h2> The EU (Withdrawal) Act 2018 retained GDPR as UK domestic law from 1 January 2021. That means all six core rights you had under EU GDPR transferred intact: access, rectification, erasure, restriction, portability, and objection. The substance of the law didn’t change. The enforcer did. You no longer take complaints to an EU data protection authority. You go to the ICO — the Information Commissioner’s Office, based in Wilmslow. The ICO has been the UK’s data watchdog since 1984, and it already had teeth before Brexit. British Airways learned this the hard way: the ICO fined them £20 million after a 2018 breach exposed 400,000 customer records (reduced from the initially planned £183 million after COVID-related submissions). Marriott got £18.4 million. TikTok was fined £12.7 million in 2023 for processing children’s data without proper legal basis. This is an active enforcement body. It fines companies. It investigates. Your complaints go somewhere real. Your core rights under UK GDPR</h2> The six rights are the same as EU GDPR. Here’s what each actually means in practice: Right of access — you can ask any company what personal data they hold on you, why they hold it, and who they share it with. This is called a Subject Access Request (SAR). They have one month to respond. No fee. Send it in writing to the company’s Data Protection Officer (or their general customer contact if they don’t have a dedicated DPO). Right to rectification — if data they hold is wrong or incomplete, you can demand they fix it. Useful when a credit reference or employer background check contains an error. Right to erasure — the “right to be forgotten.” You can request deletion when data is no longer necessary, when you withdraw consent, or when the company has no legal basis to keep it. It is not absolute. They can refuse if they have legal obligations to retain it. But it is enforceable. Right to restriction — you can ask them to pause processing your data while a dispute is resolved, rather than delete it entirely. Right to portability — if a company processes your data by automated means with your consent, you can ask for it in a structured, machine-readable format to move elsewhere. Right to object — you can object to processing based on legitimate interests, and to direct marketing (unconditionally — they must stop). To exercise the erasure right specifically, write to the company’s Data Protection contact (usually listed in their privacy policy). State clearly that you are invoking your right to erasure under UK GDPR Article 17. Be specific: name the data you want deleted. Keep a copy. How to escalate to the ICO</h2> Companies don’t always comply. Some send generic refusals with no legal basis cited. Some simply ignore requests. If a company refuses your SAR or erasure request without valid grounds, or ignores you entirely, you can file a complaint directly with the ICO at ico.org.uk/make-a-complaint. The process is online. You don’t need a solicitor. The ICO typically responds with an initial assessment within three months. It will not necessarily fine the company on your behalf, since the ICO prioritises systemic issues over individual disputes. But a complaint creates an official record, and the ICO can require companies to comply and audit their practices. For many companies, receiving an ICO enquiry is enough to prompt action. The ICO also publishes template letters for SARs and erasure requests. If you’re uncertain how to phrase your request, use them. They’re at ico.org.uk/your-data-matters. What the Data (Use and Access) Act 2025 changed</h2> The Data (Use and Access) Act 2025 (the DUAA) is where it gets politically uncomfortable. It received Royal Assent in June 2025, and its main data-protection provisions came into force through the first half of 2026. It is the successor to the earlier Data Protection and Digital Information (DPDI) Bill, which fell before the 2024 general election. The DUAA amends UK GDPR and the Data Protection Act 2018 rather than replacing them. The Act is openly business-friendly. Its stated aim was to reduce compliance burdens for UK businesses. Here is what it means for you. Legitimate interests got wider. UK GDPR always allowed companies to process data on “legitimate interests,” without your consent, if their interest outweighed yours. The DUAA created a new “recognised legitimate interests” category. It lists activities (crime prevention, national security, safeguarding vulnerable people, emergency response) for which companies do not run the balancing test at all. Notably, this list does not extend to ordinary commercial processing. Accountability obligations were simplified. Some record-keeping and documentation requirements were eased. This makes the system easier for businesses to navigate. It also means fewer paper trails when things go wrong. Automated decision-making rules were overhauled. EU GDPR Article 22 gave you the right not to be subject to purely automated decisions with significant effects (like a loan rejection or a job application screen) unless narrow conditions were met. The DUAA replaced this from February 2026. It shifts to a “permission-with-safeguards” model: organisations can now make solely automated significant decisions on any lawful basis, including legitimate interests, provided safeguards are in place. Those safeguards include telling you about the decision, letting you make representations and challenge it, and giving you human intervention. The stricter, near-prohibition regime is kept only where the decision relies on special category data, such as health or ethnicity. The honest assessment: the DUAA traded some individual protections for business flexibility. Your rights were not abolished. But the space companies have to process your data, and to decide about you by algorithm, has grown. UK GDPR vs EU GDPR: the key differences</h2> When you read that the UK “kept GDPR,” this is what they mean — and what they’re not saying. The EU adequacy decision granted to the UK in 2021 means personal data can flow freely between the EU and UK without extra safeguards. The European Commission renewed that decision in December 2025, running to December 2031. But it can still be revoked if UK law diverges significantly from EU standards, which the DUAA has started to do (notably on automated decision-making). Revocation would be disruptive for UK businesses, but it would not directly affect your individual rights. The more immediate differences: International transfers — the EU uses Standard Contractual Clauses (SCCs) and adequacy decisions to regulate data flows to third countries. The UK now uses its own parallel framework: International Data Transfer Agreements (IDTAs) and its own adequacy regulations. Different legal mechanisms, similar intent — but the UK can grant adequacy to countries the EU hasn’t, and vice versa. Accountability — UK organisations face lighter documentation requirements than their EU equivalents under the DUAA changes. This means less visibility into how data is being processed. Not because the processing is different, but because fewer records need to be kept. Enforcement — the ICO operates independently from EU DPAs. There’s no coordination mechanism for cross-border complaints. If a French company processes your data and you’re a UK resident, the ICO handles your complaint — not the CNIL. The trajectory matters. The EU continues developing its data protection framework through rulings, guidance, and legislation. The UK is now making independent choices. Brexit created the possibility of divergence. The DUAA began acting on it. UK-specific data broker and people-search sites</h2> The UK has its own ecosystem of people-search and data aggregation sites that operate under UK GDPR. Here’s where to start with removal requests: 192.com — the largest UK people-search site. Lists names, addresses, phone numbers, and electoral roll data. To opt out: go to 192.com, search for your listing, and use their Opt Out form linked at the bottom of your result. You’ll need to verify identity. They process requests under UK GDPR Article 17 (erasure based on legitimate interests objection). BT Phone Book (bt.com/phonebook) — lists landline numbers registered with BT. Opt out by calling BT’s ex-directory line or updating your preference in your BT account under “Directory Listing.” Mobile numbers are not listed without consent. Experian UK — holds marketing data profiles (distinct from your credit report). You can opt out of Experian’s marketing data products via their Opt-Out service at experian.co.uk/privacy. Note: opting out of marketing profiling is separate from accessing or correcting your credit report. Royal Mail — the PAF (Postcode Address File) is used by many data companies. Royal Mail runs a Mailing Preference Service (MPS) registration at mpsonline.org.uk — registering suppresses your address from direct mail lists. It’s free. It takes 28 days to take effect. These requests are exercising your UK GDPR right to object (Article 21) — you’re objecting to processing based on legitimate interests for direct marketing purposes. Companies receiving this objection must stop. No balancing test applies to direct marketing objections; it’s unconditional. What you can do right now</h2> Want to see what data brokers expose about you? See what a scan finds →</a> shows an example report: the kinds of sites that list your name, phone, and address. Once KnytX Shield launches it will find and remove these automatically. Join the waitlist</a> to get in early. Recovery Scams: Fraud Victims Targeted a Second Time Unknown — Sun, 12 Apr 2026 00:00:00 +0000 She met him on LinkedIn. His name was James Chen, a petroleum engineer on contract in Aberdeen. He was charming, patient, and attentive in a way that felt different from the apps. Over four months, he helped her through a difficult period after her divorce and called her every evening. Then, almost in passing, he introduced her to a cryptocurrency trading platform where he said he’d been quietly building his retirement fund. She was skeptical at first. But James showed her his own portfolio. He walked her through every trade. She put in $5,000. It grew to $9,000 in two weeks. She put in $20,000 more. That grew too. By month six, she had transferred a total of $80,000 into the platform. When she tried to withdraw her profits, the platform told her she owed a “capital gains tax clearance fee” of $18,000 before any funds could be released. She paid it. Then there was a compliance audit fee. She stopped. She filed an IC3 complaint with the FBI and reported the exchange to the FTC. She told nobody else. She was fifty-three years old, recently divorced, and had just lost most of her liquid savings. Three days after filing her IC3 complaint, her phone rang. The caller ID showed a Washington, D.C. area code. The man identified himself as Special Agent Michael Torres, FBI Cyber Division. He said her case had been flagged. He had her name. He had the amount she’d lost. He named the crypto exchange she had used. He said the FBI had identified the fraudster’s wallet address, and he read it back to her. The funds, he explained, had been traced and partially frozen pending a blockchain compliance process. To release the assets back to her, she would need to cover a $12,000 processing fee. It would be fully reimbursed, he said, as part of her recovery. She paid it. The number was spoofed. Special Agent Michael Torres did not exist. This is a recovery scam. The short answer. A recovery scam is a second fraud that targets people who have already lost money to fraud. Someone contacts you claiming to be law enforcement, a blockchain recovery firm, or a lawyer. They know real details about your case, because your victim profile was sold or you posted about it publicly. They promise to get your money back for an upfront fee, then take that too. No legitimate agency ever charges a fee to return a victim’s money, and confirmed crypto transactions cannot be reversed for a price. If you’re contacted, hang up, and call the agency back on a number from its official .gov site. What a recovery scam is</h2> A recovery scam is a second fraud that targets people who have already been defrauded. It arrives when you’re at your lowest. You’ve already lost money, already realized you were deceived, and you’re ashamed, exhausted, and desperate for any path back to what you lost. The structure is consistent. Someone contacts you claiming to represent a law enforcement agency, a blockchain recovery firm, a legal team, or a compliance department. They know details about your case that feel impossible for a stranger to know. They offer to recover your funds. They charge an upfront fee — framed as a processing fee, a compliance deposit, a legal retainer, or a tax clearance — and then they disappear, taking that money too. The FTC received more than 35,000 reports of recovery scam fraud in 2023 alone, with reported losses exceeding $100 million. That’s only the reported figure. Fraud victims report at much lower rates because of shame, especially romance and investment fraud victims. The actual number is estimated to be three to five times higher. Romance fraud victims are the most frequently targeted group, followed by victims of investment and cryptocurrency fraud. You can be scammed twice. It happens to careful, educated people. Understanding why requires understanding exactly how these operations work. How they found you</h2> This is the part that stops most victims cold: how did the second scammer know what the first scammer had done to you? Your IC3 complaint or FTC report contains your name, contact details, the amount you lost, and the nature of the fraud. These databases are not public. But victim report systems have been compromised before, and your information flows to people who would exploit it through several other reliable pipelines. The most direct route is the original scammer. Pig butchering operations, the romance fraud model used in the case above, are run by sophisticated criminal organizations. They are often based in Southeast Asia, with structured call centers and detailed victim databases. When a victim stops paying or files a complaint, their profile doesn’t disappear. It gets sold. Dark web forums and private markets trade victim profiles openly: name, phone number, email, amount lost, the emotional angle that worked, how they communicated, what objections they raised. A victim who showed “high loss tolerance,” meaning they kept paying when asked, is worth more on resale than someone who stopped early. The second scammer buys the profile and knows exactly how to approach you. Social media is another pipeline. After being defrauded, many victims search for answers. They post on Reddit’s r/Scams, on consumer fraud Facebook groups, on Twitter/X. They ask whether anyone has experienced the same thing, and whether any recovery is possible. Recovery scammers run automated monitoring on these platforms. They watch for keywords like “pig butchering,” “crypto scam,” “lost money,” “crypto recovery,” and “romance scam.” When you post publicly about what happened, you’re visible to anyone running those searches. Scammers direct-message victims within hours of their posts. Search behavior is another vector. If you repeatedly search “how to recover stolen crypto,” “crypto recovery service,” or “can you reverse a bitcoin transaction” over several days, your search profile gets associated with that intent. Data brokers aggregate browsing behavior, demographic data, and purchase history into profiles. Some of those profiles end up in the hands of people who have no legitimate business buying them. The ad targeting that shows you recovery services after you search for recovery services isn’t always coming from legitimate companies. Sometimes the law enforcement angle works because your complaint actually was filed. The scammer doesn’t necessarily know you filed one. They’re taking a calculated guess. Many fraud victims do file reports. The “we received your FBI complaint” opening line succeeds often enough to be worth trying on every victim profile they purchase. The types of operations they run</h2> Recovery scams take several forms, and each one is calibrated to a different type of victim and a different type of fraud. Law enforcement impersonation is the most sophisticated. The caller claims to be from the FBI Cyber Division, the FTC, IC3, INTERPOL, or a financial crimes unit. They use real agency names, real-sounding badge numbers, real-looking spoofed phone numbers. They reference real processes — asset freezes, blockchain compliance, victim restitution funds — using enough accurate language to sound credible. Their goal is to get you to believe that government action has already been taken and that your funds are within reach. Blockchain recovery specialists present themselves as technical experts who can trace cryptocurrency transactions and reverse or recover funds. This is built on a fundamental misrepresentation of how blockchain technology works. Confirmed cryptocurrency transactions are final. There is no mechanism within the protocol to reverse them. The only realistic path to recovery involves a regulated exchange voluntarily cooperating with law enforcement — and that requires the fraudster to have kept the funds in a centralized, regulated account, which sophisticated operators do not do. No private company can “reverse” a blockchain transaction for a fee. Legal firm impersonation involves fake law firms with professional-looking websites, official-sounding names, and listed attorneys with bar numbers that either belong to real lawyers being impersonated or are entirely fabricated. These firms claim to be pursuing the fraudster in civil court and to have obtained judgments that allow asset seizure. They charge retainer fees and then bill for each stage of the fabricated legal process. Crypto exchange impersonation targets victims who used a specific platform. The scammer poses as a compliance officer from Coinbase, Binance, Kraken, or whichever exchange the victim named in their report. They claim the fraudster’s account has been flagged and that the victim’s funds are held pending verification — and that a verification fee is required to release them. White hat hacker services are marketed as ethical hackers who use specialized tools to trace crypto wallets, infiltrate the scammer’s accounts, and retrieve stolen assets. These services typically advertise on forums where fraud victims congregate. They charge a fee, produce a fake “investigation report,” and then either disappear or keep billing for follow-up work. Why it works — the psychology of the already-defrauded</h2> To understand why recovery scams succeed, you have to understand the specific mental state of someone who has just been defrauded. It is not the state of someone who is naive or inattentive. It is, in some ways, a state that makes people harder to protect, not easier. The first and most counterintuitive factor is shame. Most fraud victims do not tell their families or close friends what happened. The social stigma around being scammed is enormous. It carries an implicit judgment that the victim was foolish, greedy, or inattentive. Many victims carry what happened entirely alone. That isolation means nobody is checking the victim’s reasoning, nobody is asking obvious questions, nobody is there to say “wait, the FBI doesn’t charge processing fees.” The recovery scammer operates in that vacuum. The second factor is desperation. When you have lost $80,000, you are not in a comfortable, rational mental space. You are in crisis. The loss has real material consequences — for your retirement, for your children, for your sense of security. When someone calls and tells you that a portion of that loss might be recoverable, the information doesn’t arrive in a mind that’s calmly evaluating probabilities. It arrives in a mind that wants, very badly, for it to be true. The third factor is sunk cost pressure. Behavioral economics has a name for this: the sunk cost fallacy. Once you’ve already lost $80,000, spending another $12,000 to get it back doesn’t feel like spending $12,000. It feels like spending $12,000 to retrieve $80,000. The framing shifts the decision entirely. The number in your head isn’t the $12,000 you’re about to spend — it’s the $80,000 you’re trying to get back. Recovery scammers understand this instinctively, and they calibrate their “recovery fees” as a small fraction of the stated recoverable amount. The fourth factor is eroded trust and its paradoxical consequences. After being scammed, many victims assume they’ve now learned what scammers look like. They imagine they’ll recognize one the next time. But the model they’ve built in their heads is of the first scammer — the romance fraud, the fake investment advisor, the crypto platform. The recovery scammer looks nothing like that. They’re abrupt, official, bureaucratic. They don’t flatter you or build a relationship. They call from a government number, use technical language, and seem impatient — which reads, to someone primed for warm, manipulative charm, as professionalism and authenticity. The fifth factor is confirmation bias. You filed a police report. You expected something to happen. When a call arrives that appears to confirm that something happened — that the report was received, that an investigation is underway — it aligns perfectly with your expectations and hopes. Confirming evidence requires almost no scrutiny. Disconfirming evidence is what requires effort to process. How they collect the money</h2> The payment method a recovery scammer asks for is one of the clearest signals of what they are. They know this, and they calibrate accordingly. Wire transfer to a “Department of Justice asset recovery account” sounds official and is, to many victims, familiar as a payment method. The account doesn’t belong to the DOJ. Once the wire clears, the money is gone. Cryptocurrency is increasingly the medium of choice. The scammer frames it as necessary for technical reasons — the assets are being released on-chain, and the compliance deposit must also be made in crypto to enable the transaction. Cryptocurrency transactions are irreversible, which benefits the scammer. They may also claim this provides additional privacy protection for the victim. Gift cards are still used, but primarily by lower-sophistication operators. Any legitimate entity that asks for an iTunes gift card or a Google Play code is not a legitimate entity. The more polished operations avoid gift cards specifically because they’ve become culturally recognized as a scam signal. Multiple payments are common. The first fee unlocks the “frozen” assets. Then there’s a tax clearance requirement. Then a compliance audit. Then an insurance bond. Each fee is justified as a necessary step in a bureaucratic process that keeps extending. Some victims have paid four or five fees before stopping. At each stage, the emotional math keeps being recalculated: the recoverable amount minus the fees already paid is still more than not paying the next fee. What you can actually do if you’ve been defrauded</h2> Real options exist, though they’re narrow. The most important step is to report immediately, and to multiple agencies. That means the FBI’s IC3 (ic3.gov), the FTC (reportfraud.ftc.gov), and your state attorney general’s consumer protection office. If the fraud involved a cryptocurrency exchange, report directly to that exchange’s fraud team. Regulated exchanges sometimes cooperate with law enforcement and can place holds on accounts where they still have funds. Real cryptocurrency tracing firms do exist. Chainalysis, Elliptic, and CipherBlade are companies that analyze blockchain transactions for law enforcement agencies and financial institutions. They trace — they map where funds moved after leaving your wallet. They do not recover. And they work with law enforcement agencies as contracted partners, not directly with individual victims for fees. If a company contacts you claiming to be one of these firms offering to recover your funds for a payment, it is not them. The realistic probability of cryptocurrency recovery in a romance or investment fraud is very low. Sophisticated fraud operations move funds through mixers, privacy coins, and multiple wallets within minutes of receiving them. The FBI and other agencies do occasionally recover funds. The Colonial Pipeline ransom recovery in 2021 showed that law enforcement can access cryptocurrency in certain cases. But those recoveries involve investigators accessing private keys through technical work, not a compliance process you can pay to start. Your bank may be able to reverse or dispute a wire transfer if you act immediately — within 24 to 48 hours in some cases. Contact your bank’s fraud department the moment you realize what has happened, not after filing reports. Legitimate agencies will never do this</h2> The FBI does not call fraud victims out of the blue to offer recovery assistance. They receive your IC3 complaint and process it as part of their intake. They may contact you if your case becomes part of a broader investigation. But that contact comes in writing, from a verifiable office address, and never involves a payment. The FTC does not charge fees to process fraud complaints. They do not have the authority to freeze individual wallets or release funds to victims. The FTC investigates patterns of fraud and takes action against companies — they are not a recovery agency for individual victims. IC3 is an intake platform. It receives complaints and routes them to relevant law enforcement agencies. Nobody from IC3 will call you to say your case has been escalated and offer to return your money. INTERPOL does not contact members of the public directly about fraud cases. They coordinate between national law enforcement agencies. An individual claiming to be an INTERPOL agent calling your personal phone number about your crypto recovery is not from INTERPOL. No legitimate government agency charges processing fees, compliance deposits, release fees, or any other payment to a victim in order to return that victim’s money. Red flags of a recovery scam</h2> Not every operation is as polished as the one described above. These are the signs that whoever has contacted you is running a fraud: They contacted you first. You did not reach out to them — they called, emailed, or messaged you. Real law enforcement investigations are not announced by outbound calls to victims with fee requests.</li> They know specifics about your case. This feels like proof of legitimacy. It is proof that your victim profile was purchased or that you posted publicly about what happened.</li> They’re asking for money upfront. Any government agency, legal firm, or recovery service that requires a fee before they can help you is not what they claim to be.</li> The fee is framed as a deposit, tax, compliance bond, clearance, or insurance — something that sounds bureaucratically necessary and temporary.</li> They’re applying time pressure. “The freeze expires in 48 hours.” “We need the compliance payment by close of business today or the funds will be released back to the fraudster.” Urgency is manufactured to prevent you from thinking clearly or consulting anyone else.</li> The contact number doesn’t match any official listing. Always independently verify a number against the official website — .gov domains for U.S. agencies, official national police sites for international agencies — before calling it back or trusting a number someone provides to you.</li> The website looks professional but is newly registered. A domain registered within the past few months for a “law firm” or “blockchain recovery service” is not a years-established business.</li> Their social media presence is thin or recently created. Real firms have histories, reviews, employees with verifiable professional backgrounds.</li> They communicate primarily through WhatsApp, Telegram, or Signal. Legitimate law enforcement agencies do not use personal messaging apps for official case communications.</li> They accept gift cards, ask for cryptocurrency transfers to a wallet, or request payment methods that are irreversible. Any request to pay via gift card is, without exception, a scam.</li> </ul> If someone contacts you claiming to be recovering your funds</h2> Do not engage with the call or message beyond getting the caller’s name, badge number (if they claim to be law enforcement), and the agency they claim to represent. Do not confirm the details of your case. Do not agree to anything. Hang up. Then call the agency directly, using a number you find on their official website. For the FBI, that’s fbi.gov. For the FTC, ftc.gov. For IC3, ic3.gov. If the caller claimed to be a specific agent with a specific office, you can verify whether that office exists through the FBI’s field office directory. You can also submit tips at tips.fbi.gov. Do not call back the number they gave you. Do not reply to the email they sent you. The number is spoofed and the email is a scam domain. Look up the agency independently and make contact that way. If you’ve already paid, report it immediately to your bank or the transfer service, to the FTC at reportfraud.ftc.gov, and to IC3. Document everything: the phone numbers, the emails, the names they used, the payment details. This documentation may be useful if law enforcement does investigate the operation as part of a larger case. The person who called you is counting on the fact that you want to believe them. That wanting is not a character flaw — it’s a human response to loss. Recognizing it for what it is — and pausing before acting on it — is the only defense. The fraud happened once. It doesn’t have to happen again. How Data Brokers Profile and Target You Unknown — Sat, 11 Apr 2026 00:00:00 +0000 In June 2021, a Catholic newsletter called The Pillar published a story that ended a priest’s career. The reporter had purchased commercially available mobile location data, the kind that advertising firms buy and sell every day. They used it to track the phone of a senior Catholic Church official to gay bars and to the home addresses of other men. The priest resigned within days. He had never consented to any surveillance. His phone had simply been present in certain locations, and a location data firm had recorded those visits as part of its standard data collection. The data was legal to purchase. The purchase required no warrant. Anyone with a few thousand dollars and a business account could have bought the same dataset. This is what the data broker profiling industry actually does. It goes beyond collecting your name and address. We cover the basics in the data broker economy</a> and how data brokers find you</a>. The profiling machinery runs inference engines that turn your mundane behavior into predictions about your health, finances, politics, and relationships. Those predictions are sold to insurers, lenders, campaign operations, and advertisers. You never see them. They affect consequential decisions about you regardless. The short answer. Data brokers don’t just record facts about you. They build statistical models that predict things you never disclosed: a pregnancy, a chronic illness, financial stress, sexual orientation, political leanings. They do it from purchase patterns, location history, and your social connections. These “propensity scores” are sold to insurers, lenders, employers, and campaigns, and you can’t see or dispute them. Aggregators like Acxiom</a> and LexisNexis</a> sit at the center of this. Here is how the machinery works, and what you can do about it. Jump to a section: How the inference engine works</a></li> Propensity scores</a></li> Lookalike modeling</a></li> Location history as a health record</a></li> How your social graph reveals you</a></li> The genuinely dangerous inferences</a></li> What you can actually do</a></li> </ul> From facts to predictions: how the inference engine works</h2> The shift that made data brokerage genuinely dangerous wasn’t the collection of data. It was what happened when statisticians started building predictive models on top of it. The most documented early example is Target’s pregnancy prediction model, reported by the New York Times in 2012. Target’s data science team noticed that new parents are among the most valuable customers a retailer can acquire. A household with a new baby reorganizes its entire shopping behavior at once. The problem: competitors were also trying to reach those customers. Target wanted to identify pregnant customers before competitors could. The model they built relied on a set of 25 products whose purchase pattern was statistically predictive of pregnancy. The list included unscented lotions, certain vitamin supplements, cotton balls in larger-than-normal quantities, and specific hand sanitizers. None of those products is pregnancy-related in any obvious way. But the combination, at the right time, was a reliable signal. Target could predict a pregnancy, often in the first trimester, before the customer had told anyone. In one widely reported case, a father complained to a Target store manager that his teenage daughter was receiving pregnancy-related coupons. He called back weeks later to apologize, having confirmed the coupons were accurate. The mechanics are worth understanding because they generalize to everything data brokers do. You don’t need to disclose a health condition for a data broker to infer it. You need to purchase things, visit places, or search for information in a pattern that correlates with that condition in training data. Inferences about diabetes, cancer treatment, depression, financial stress, and relationship breakdown have all been documented in broker product descriptions or academic studies of the industry. Credit card transaction data is particularly rich for this kind of inference. A 2016 study in Nature Human Behaviour used just 3 months of credit card transaction metadata: the merchant, amount, and date, with no descriptions of what was purchased. From that alone, researchers could infer a person’s age, sex, and relationship status with 90% accuracy. They could also re-identify individuals with 90% accuracy in an “anonymized” dataset of 1.1 million people. Data brokers have been doing this commercially for years with far larger datasets. Propensity scores: the invisible ratings attached to your profile</h2> Brokers and marketing analytics firms assign scores to individual consumer profiles. These are called propensity scores or intent scores. Each one represents a calculated probability that you’ll do something. That something might be to buy a house in the next six months, file for bankruptcy, switch insurance providers, get divorced, or develop a chronic illness. These aren’t marketing curiosities. They are sold to insurers who use them to refine underwriting. They are sold to lenders who use them to decide whether to offer a loan and at what rate. They are sold to employers screening candidates and to landlords reviewing applicants. The Federal Trade Commission’s 2014 report, Data Brokers: A Call for Transparency and Accountability, documented broker product categories. Those categories included “financial stress indicators” and “ailment and affliction” lists. One list even grouped people as “rural and barely making it.” None of this appears on your credit report, which is regulated. It lives in unregulated data broker products that you cannot see, dispute, or correct. The FTC report noted that one broker sorted consumers into segments with revealing names. Examples: “Rural Everlasting” (older rural consumers with low incomes), “Ethnic Second-City Strugglers,” and “Rough Neck Families.” These categories had direct pricing implications for the products offered to people in them. Lookalike modeling: targeted without ever interacting</h2> You can be profiled and targeted by a company you have never heard of, based on behavior you’ve never shared with them. This is what lookalike modeling accomplishes. The mechanism: a brand has 100,000 existing customers. It wants to find 500,000 more people who behave like its best customers. It takes those 100,000 profiles to a data broker or advertising platform and asks: who else looks like these people? The broker runs the profiles through their database, identifies the statistical characteristics that predict “best customer” behavior, and returns a list of 500,000 people who match those characteristics. The brand then targets them. From your perspective, you start seeing ads for a product in a category you’ve recently shown interest in, from a brand you’ve never visited. You didn’t give that brand your data. You didn’t agree to any targeting. Your data was matched through a chain of brokers and intermediaries, and the targeting happened without any direct relationship. Meta’s advertising system operates on this model explicitly — advertisers upload “Custom Audiences” (their existing customer lists), and Meta identifies “Lookalike Audiences” from its database. Other platforms offer the same capability. The underlying data that makes the match possible often comes from broker databases that Meta has licensed or integrated. Location history as a health record</h2> The priest story is not an isolated example of what location data can reveal. Mobile advertising firms build what they call “panel” datasets: the 90-day or 12-month movement history of tens of millions of devices, tied to persistent device identifiers. The firms include Foursquare, X-Mode Social, and SafeGraph. Foursquare (now Foursquare City Guide) was once the dominant location data broker. Digital Envoy acquired X-Mode Social after Apple and Google dropped it from their app stores in 2020 for selling military data. That movement history reads like a medical file. Picture a device that visits an oncology clinic three times in two months, stops at a pharmacy, and appears at a cancer support group. It is very likely associated with someone undergoing cancer treatment. Brokers have packaged and sold these inferences explicitly. SafeGraph came under public scrutiny after Vice/Motherboard reported in 2018 that it was selling data packages called “disease insights,” linking device movement to medical facilities. The insurance application of this data is documented. Life insurers have used data sources including pharmacy purchase records, consumer buying history, gym membership status, and credit data — none disclosed in policy applications — to adjust underwriting. New York’s Department of Financial Services opened an inquiry into this practice in 2019 after reports that life insurers were considering social media and consumer data in underwriting decisions. In the US, this is broadly legal because none of these inferences are technically medical records. They are consumer data inferences based on behavior that happens to correlate with health conditions. The social graph: how your connections reveal you</h2> Your own data profile being minimal or locked down doesn’t protect you as much as you might expect. The people around you compensate. In 2013, researchers at the University of Cambridge published a paper showing that Facebook Likes alone could accurately predict sexual orientation, political affiliation, religion, intelligence, and personality traits. The median predictor was around 150 Likes. Cambridge Analytica extended this further. Its approach affected an estimated 87 million Facebook users, based on 270,000 people who took a quiz. By mapping the social connections of the quiz takers, the firm built models of people who had never interacted with the quiz at all. The mechanics: if five of your close Facebook friends have a particular personality profile, the model predicts your personality profile with roughly 70% accuracy. You didn’t consent to the quiz. Your profile was inferred from your connections’ data. Commercial data brokers use household modeling for the same purpose. If your partner has a detailed profile — rich with transaction data, location history, and financial behavior — brokers attribute similar characteristics to all adults at that address. You inherit their inferences even if your own digital footprint is minimal. This is documented in multiple academic analyses of broker data products and is referenced in the FTC’s broker investigations. There is a further documented phenomenon sometimes called guilt by association: some alternative credit scoring products use social network connections as a factor, explicitly or through proxy variables. Being connected to people with poor credit histories or high-risk financial behavior affects some non-traditional credit scores even when your own credit history is unrelated. This is controversial and legally contested in the US under the Equal Credit Opportunity Act. But it happens in products that position themselves as offering credit access to people with thin credit files. The genuinely dangerous inferences</h2> Several categories of inference carry particular real-world risk because of how they can be used against the person profiled. Political affiliation is inferred through a combination of voter registration records (public in most US states), magazine subscription history, donation records, geographic location, and even consumer purchases. Car ownership type correlates with political affiliation in predictive models used by political campaigns. Voter file analytics firms including Catalist and i360 maintain profiles on virtually every registered US voter, including modeled political scores, persuadability scores, and issue-level predicted positions. Religious practice can be inferred from location data (regular attendance at a mosque, church, or synagogue), purchasing patterns (halal or kosher food purchases), and community membership records. In jurisdictions where religious minorities face discrimination or violence, this category is hazardous. In employment contexts in the US, using religion as a hiring factor is illegal — but using a proxy variable that correlates strongly with religion is a harder legal question. Sexual orientation inference is documented and has caused direct harm, as the priest case shows. Grindr’s sale of user data — including precise location — to data brokers was the subject of a $11.7 million GDPR fine by Norway’s Datatilsynet in 2021, upheld on appeal. Grindr shared user data with advertising partners without obtaining valid consent. That data, in principle, was available to purchase through standard advertising channels. Mental health and financial stress inferences are sold explicitly. The FTC’s 2014 report documented broker lists marketed for their utility in targeting “financially vulnerable” consumers — a description that maps to people likely to respond to predatory financial products. Payday loan advertisers, high-interest credit card issuers, and debt settlement firms are documented purchasers of these audience segments. The products built from your profile</h2> The profiling doesn’t stay inside the broker’s database. It becomes commercial products sold to specific buyer categories. Insurance scores derived from consumer data are used by some auto and life insurers. Unlike your official credit score, these are unregulated in most US states, you cannot request them, and you cannot dispute inaccuracies in them. The FTC has examined this practice but comprehensive federal regulation hasn’t materialized. Affordability segments are sold to lenders and “alternative financial services” — the industry term for payday lenders and similar products. The targeting logic is explicit: find people under financial stress who are likely to need short-term cash and are less likely to carefully evaluate interest rates. Regulatory filings from payday lending companies show they purchase audience data from commercial brokers as a standard marketing practice. Political persuasion scores are the most granular political profiles in commercial data. These are sold to campaigns and issue advocacy organizations. They include predicted voting likelihood, issue priorities, persuadability score (how likely the person is to change their mind), and vulnerability to specific message types. The data behind them comes from voter files merged with commercial data broker profiles. Price discrimination based on inferred profile is documented, though less clearly than the political targeting. Amazon tested different prices for identical products based on factors including device type and user history — documented in news reporting in the early 2020s. Retail pricing algorithms adjust dynamically based on signals that correlate with consumer willingness to pay. A user profile that includes income bracket, purchase history, and geographic location provides those signals. The extent to which this happens for individual consumers is difficult to verify because pricing tests are opaque, but the practice exists. What you can actually do</h2> None of this is entirely fixable. The system is large, entrenched, and legal in most jurisdictions. But several specific actions reduce the volume of data flowing into broker systems and the consequences of what they already hold. Request your consumer file from the major brokers. Acxiom operates a consumer portal at aboutthedata.com where you can see and correct some of the data Acxiom holds. LexisNexis offers a consumer disclosure report. Equifax and TransUnion, as credit reporting agencies, are subject to Fair Credit Reporting Act requirements and must provide your report on request. These are not your full broker profiles — they’re a fraction of what’s held — but they make the system visible. Opt out of data broker sales. Most data brokers accept opt-out requests, and many are required to under California’s CCPA and the DELETE Act. California’s DROP portal opened to consumers on January 1, 2026. Registered brokers must start processing requests from August 1, 2026; see how to file a DELETE Act request</a>. Submitting opt-outs to the top 20 brokers reduces the most consequential data flows. Services automate this across 200+ brokers. Contacting 4,000 brokers one at a time is not realistic for most people. Reduce data at source. Loyalty cards trade convenience for permanent transaction records. App location permissions feed location data brokers. Third-party cookies tracked your browsing history until browser changes began limiting them. Each data point you don’t generate isn’t available to be profiled. This is partial — you cannot opt out of the public records that form brokers’ foundation — but behavioral data is where the inference engine gets its signal. Place a credit freeze. This doesn’t stop broker profiling generally. But it limits what lenders can see when making credit decisions, and it reduces the utility of some financial data products built from your profile. File complaints when inferences cause material harm. Several regulators accept complaints about inferred-data uses that cause financial, employment, or housing harm. They include the FTC (US), the CFPB (US financial products), and national Data Protection Authorities in the EU and UK. Regulatory enforcement has been limited but it exists. The Grindr fine and a series of GDPR enforcement actions against adtech companies (including a €150 million fine against Meta in Ireland) came from complaints. The inference engine already exists, and your profile is already inside it. The goal of these steps isn’t to disappear from it entirely, which isn’t achievable for most people. It’s to limit the most specific and sensitive inferences and reduce the data flowing in. The aim is to create friction between your profile and the buyers who want to use it against you. Cookie Consent Walls and Why Most Violate GDPR Unknown — Fri, 10 Apr 2026 00:00:00 +0000 You open a news site. Before you can read the headline, a banner occupies half your screen. There’s a large green “Accept All” button. There’s a grey “Manage Preferences” link in smaller text. You click “Manage Preferences.” You’re now looking at 12 categories, each with 847 individual toggles across multiple nested panels, all pre-enabled. The “Save preferences” button is hidden at the bottom. You give up and hit “Accept All.” That experience was not accidental. It was designed. And in the EU, most of it is illegal. The short answer: Under GDPR, valid cookie consent must be freely given, specific, informed, and unambiguous, and rejecting must be as easy as accepting. So the common tricks break the law: no “Reject All” button on the first layer, a prominent “Accept” beside a buried “Reject,” cookie walls, and pre-ticked boxes. France’s CNIL fined Google €150m and Meta €60m over exactly this. You do not have to fight each banner by hand: browser tools like uBlock Origin, Consent-o-Matic, and Brave block most tracking regardless of what you click. Why do cookie banners make you angry?</h2> The banner you just navigated was engineered to produce one outcome: your consent to maximum tracking. Every design choice — button color, button size, text size, menu depth, toggle defaults — was selected to reduce the number of people who successfully reject cookies. This is called a dark pattern: a user interface designed to manipulate rather than inform. In the context of cookie consent, dark patterns have been ruled illegal by European data protection authorities repeatedly since 2022. The rulings are specific. The fines are real. And yet the banners persist — because even with enforcement, the financial upside of tracking consent outweighs the risk for most large platforms. The gap between what GDPR requires and what most banners deliver is not ambiguous. It’s documented, ruled on, and still ignored at scale. What GDPR actually requires for cookie consent</h2> The specific obligation to obtain consent for non-essential cookies comes from the ePrivacy Directive (2002/58/EC), which each EU member state has implemented into national law. GDPR then governs what “valid consent” looks like — it must be freely given, specific, informed, and unambiguous. Under GDPR Article 7 and Recital 32, consent must meet four requirements to be valid: Freely given — you cannot be coerced into consenting. Denying access to a service unless you accept cookies is coercion, not consent. Specific — blanket “accept all” consent covering every tracker from every third party does not meet this standard. Informed — you must actually know what you’re agreeing to. A list of 847 toggles you can’t read in a banner context does not constitute informed consent. Unambiguous — consent must be indicated by a clear affirmative act. Pre-ticked boxes are explicitly illegal; they’ve been banned since GDPR came into force in 2018. There’s also a fifth requirement that often gets missed: withdrawal must be as easy as giving consent. If “Accept All” is one click, “Reject All” must also be one click. If there’s a large green button to accept, there must be an equivalent button to reject — at the same layer, with comparable prominence. The specific dark patterns that violate GDPR</h2> Regulators have moved beyond general principles to specific rulings on specific practices. No “Reject All” button at the first layer. In January 2022, France’s CNIL ruled that Google’s and Facebook’s cookie consent interfaces violated GDPR. The reason: they made rejecting cookies significantly harder than accepting them. Google received a €150 million fine. Facebook (Meta) received €60 million. The ruling specified that a “Reject All” button must be present at the first layer — the banner itself — not buried inside settings menus. Making “Accept” visually prominent and “Reject” visually subordinate. The CNIL fines were partly based on the color and prominence disparity: a colored button for acceptance, grey text for rejection. This asymmetry — even if a rejection path technically exists — violates the “freely given” requirement because it steers users toward one outcome. Cookie walls. A cookie wall blocks access to content unless you accept tracking cookies. In 2022, CNIL ruled these illegal. The logic: if your only options are “accept all cookies” or “leave the site,” consent is not freely given. It’s a toll. You’re not choosing between options; you’re choosing between your data and the content. That’s coercion under GDPR. Pre-ticked boxes. This one has been illegal since day one. A checkbox pre-selected to indicate consent — where you must actively untick it to withhold consent — does not constitute a “clear affirmative act.” It never did. It still happens constantly. Legitimate interest for advertising. Many banners include a “legitimate interest” toggle — categories of tracking that are presented as not requiring your consent. The UK ICO and multiple EU DPAs have repeatedly ruled that advertising and behavioral tracking cannot be justified as a legitimate interest that overrides your right to privacy. If you see “legitimate interest” applied to ad tracking, that claim is generally not compliant. The IAB Framework and why it’s broken</h2> Most of the cookie consent infrastructure on the western internet runs on a system called the Transparency & Consent Framework (TCF), developed by IAB Europe. This is the technical backbone behind the vast majority of cookie banners — the system that records your consent choices and transmits them to advertisers. In February 2022, the Belgian Data Protection Authority (APD) ruled that the TCF itself violates GDPR. Not a specific implementation — the framework. The APD found that IAB Europe’s role in the TCF made it a data controller under GDPR. It also found that the consent signals the TCF generates do not meet GDPR’s standards for valid consent. IAB Europe appealed, modified the framework, and has continued operating. The case went to the Belgian Market Court, which confirmed the APD’s findings in 2023 while giving IAB Europe time to remediate. The remediation process is ongoing. What this means in practice: the banner you saw today was almost certainly built on a contested system that a national regulator ruled illegal, and it’s still running. This is not a technicality. If the framework generating consent signals is itself non-compliant, then the “consent” it records is questionable. That means every ad served on the basis of that consent is operating on shaky legal ground. What to do when you see a non-compliant banner</h2> You have practical options that don’t require filing a legal complaint. If a banner has no “Reject All” button at the first layer, look for an “X” to close it. Closing the banner without accepting is not consent — it’s the absence of consent, which is the legally correct outcome. If there’s no X, navigate away. You don’t owe a website your tracking consent in exchange for reading it. If you want to stay on the site but reject tracking: open “Manage Preferences,” disable everything you can, and save. It takes longer, but it’s your legal right to do it. Report non-compliant banners to your national DPA. CNIL’s complaint form (cnil.fr/plainte) accepts reports on cookie banner violations. The ICO has a “Report a concern” tool at ico.org.uk. The German BfDI and state-level DPAs accept complaints at their respective portals. These reports do lead to investigations — the Google and Meta fines came from exactly this kind of complaint process. The right browsers and extensions</h2> You don’t have to fight each banner manually. Browser-level tools block most tracking regardless of what you click. Firefox with uBlock Origin is the most effective general setup. uBlock Origin blocks known tracker URLs before they load — meaning even if you accidentally click “Accept All,” many of the trackers being accepted are blocked at the network level. The extension is free, open source, and actively maintained. Consent-o-Matic is a browser extension that recognizes common consent management platforms (CMPs) and automatically selects the most privacy-protective option. It’s built by researchers at Aarhus University and identifies dark patterns automatically. Install it, and many of those 847-toggle banners resolve in your favor without you touching them. Brave Browser blocks most trackers and ads by default — no extensions required. Its “Shields” system operates at the browser level and applies to all sites. It’s built on Chromium, so most Chrome extensions work. The uncomfortable reality is that even with all of these tools running, some tracking slips through. GDPR and the enforcement actions are necessary — but they’re slow. Browser-level blocking is fast, reliable, and applies now. What you can do right now</h2> Want to see what data brokers expose about you? See what a scan finds →</a> shows an example report: the kinds of sites that list your name, phone, and address. Once KnytX Shield launches it will find and remove these automatically. Join the waitlist</a> to get in early. EU Data Brokers: How to Find and Remove Your Data Unknown — Thu, 09 Apr 2026 00:00:00 +0000 You search your name in Google. Third result is a Dutch people-search site with your home address, employer, and approximate age. You didn’t sign up for it. You don’t know how to get off it. In the US, you’d have to navigate a voluntary opt-out form that may or may not work. In the EU, you have something better: a legal right to demand deletion within 30 days, backed by enforceable penalties if they refuse. That right exists right now. Most EU residents don’t use it. How do you remove your data from EU data brokers? Use your GDPR Article 17 right to erasure. Find the broker’s Data Protection Officer contact in its privacy policy. Send a formal erasure request naming the data you want deleted, and note the date. The company must confirm deletion within 30 days or cite a specific legal ground for refusing. If it refuses without a valid basis, file a free complaint with your national supervisory authority. This is a legal right, not a voluntary opt-out like the US model. The data broker industry in Europe</h2> The European data broker market is smaller than the US industry, but it’s real. It includes some of the same companies operating on both continents. Acxiom EU (headquartered in Luxembourg) maintains consumer data profiles across Europe, primarily for direct marketing. Experian operates credit and marketing data services across nearly every EU member state. Epsilon (France) runs marketing data and targeting services. Nielsen Marketing Cloud aggregates consumer behavior data for advertisers throughout the EU. Scandinavia has Bisnode, a major business and consumer data aggregator now part of Dun & Bradstreet. Germany has Creditreform, which holds both business and individual credit data. These aren’t fringe operations — they serve major brands and financial institutions. Beyond the marketing data tier, there’s the people-search layer. Europages aggregates business contact data. 118.nl in the Netherlands lists residential phone numbers and addresses. Das Telefonbuch and Gelbe Seiten in Germany publish address and contact data for millions of residents. These sites pull from public records, telecom directories, and — sometimes — data they’ve purchased. Your GDPR lever: the erasure request</h2> This is where EU law diverges sharply from the US. California’s CCPA gives you opt-out rights. India’s DPDPA gives you erasure rights but enforcement infrastructure is still building. GDPR gives you enforceable deletion rights with teeth. If you’re covering US sites too, the walkthrough is in how to remove yourself from US data brokers</a>. Under Article 17 of the GDPR, the right to erasure, any company processing your personal data must delete it in three cases. When you withdraw consent. When the data is no longer necessary for its original purpose. Or when there’s no legitimate legal basis for continued processing. Data brokers holding your consumer profile for marketing don’t have a legal basis that overrides your erasure request. They must delete. The company must respond within 30 days, not “when they get around to it.” They must either confirm deletion or explain in writing why they’re refusing. Any refusal has to cite a specific legal basis. The burden is on them, not you. For the full breakdown of all your GDPR rights — access, portability, restriction, objection — see our GDPR rights practical guide</a>. How to send an erasure request to a data broker</h2> Under GDPR Article 37, some companies must designate a Data Protection Officer (DPO). That covers firms carrying out large-scale systematic monitoring of individuals, processing large-scale sensitive data, or acting as a public authority. Data brokers qualify. Their DPO contact must be published — usually in their privacy policy. Start there. Find the DPO email. Then write a formal erasure request. Your request needs four things. Give your full name, the data you want deleted (be specific: name, address, phone, any profile data), and your country of residence. Then state clearly that you are invoking your Article 17 right to erasure. This template works: Subject: GDPR Article 17 — Request for Erasure of Personal Data To the Data Protection Officer, I am writing to exercise my right to erasure under Article 17 of the General Data Protection Regulation (GDPR). I am an EU resident. Please delete all personal data you hold relating to me, including but not limited to: [name, address, phone number, any profile or consumer data]. I withdraw any consent previously given for processing of my data. Please confirm deletion within 30 days, or provide written grounds for any retention under Article 17(3). [Your full name] [Your email address] [Date] </blockquote> Send it. Note the date. If they acknowledge but delay past 30 days, that’s a compliance failure you can report. Country-specific people-search sites</h2> EU people-search sites are often national — they pull from local directories and public records — so you may need to address each country’s sites separately. 192.com covers the UK (post-Brexit but still relevant if you’ve lived there). It has a “remove my listing” form under its privacy policy page. Das Telefonbuch and Gelbe Seiten in Germany both have opt-out forms. A formal GDPR erasure request works as a backup if the form produces no result. PagesJaunes in France lists residential and business contacts. Their privacy policy links to a removal form, but the form is inconsistent. A written erasure request to their DPO (findable in their privacy policy) is more reliable. Paginas Amarillas in Spain operates similarly. The pattern is the same across all of these. Try the removal form first, because it’s faster and lower-friction. Then send a formal GDPR erasure request if the form fails or produces no confirmation within two weeks. A written request creates a paper trail that a form submission often doesn’t. What happens when they refuse</h2> Companies can legally refuse an erasure request under GDPR Article 17(3) — but the grounds are narrow. Valid reasons are narrow. They include legal obligations requiring retention (tax records, court orders) and vital interests (medical data needed for emergency care). They also include public-interest tasks (certain journalistic, scientific, or archival uses), and legitimate interests that override yours in specific contexts. “We find your data commercially valuable” is not a valid ground. “You’re a customer” is not a valid ground if you haven’t been their customer in any direct sense. A data broker holding your marketing profile — where you never had a customer relationship — has very few valid refusal grounds. If a company refuses without a valid legal basis, escalate. File a complaint with your national supervisory authority (SA): Ireland (DPC): dpc.ie/complaints</li> France (CNIL): cnil.fr/plainte</li> Germany (BfDI): bfdi.bund.de — or your state-level DPA (Datenschutzbeauftragter)</li> Netherlands (AP): autoriteitpersoonsgegevens.nl</li> Spain (AEPD): aepd.es/es/derechos-y-deberes/conoce-tus-derechos/reclamacion-ante-la-aepd</li> </ul> Every EU member state has a supervisory authority with the power to investigate, fine, and order deletion. Complaint processes are free and straightforward. The GDPR maximum penalty is €20 million or 4% of global annual turnover — whichever is higher. Companies know this. A complaint submission often produces faster results than you’d expect. Ad tech and marketing data brokers: the harder layer</h2> Beyond people-search sites, there’s a deeper layer of data brokers you’ve probably never heard of — and that’s by design. LiveRamp operates a massive identity resolution network across the EU, connecting your offline identity to your digital behavior. Oracle Data Cloud</a> held consumer data for advertising targeting across European markets before Oracle wound down its advertising-data business in 2024. The Trade Desk operates a demand-side advertising platform that processes behavioral data on EU consumers. These companies don’t publish your phone number on a searchable website. They sell your behavioral profile to advertisers without you knowing. They still accept GDPR erasure requests. The process is less visible, because their DPO contacts are buried in privacy policies rather than prominently displayed. But they’re there. LiveRamp’s privacy policy includes a “Do Not Sell or Share” link. That is a US CCPA opt-out mechanism, not a GDPR right, so EU residents should submit an Article 17 erasure request instead. Oracle published DPO contact forms before it wound down its advertising business. This tier requires more persistence. Response timelines are slower, the confirmation process is less obvious, and re-listing can happen if you interact with any site in their network. But the legal right is the same — Article 17 applies regardless of whether the broker operates a consumer-facing site or runs entirely in the background. What you can do right now</h2> Want to see what data brokers expose about you? See what a scan finds →</a> shows an example report: the kinds of sites that list your name, phone, and address. Once KnytX Shield launches it will find and remove these automatically. Join the waitlist</a> to get in early. Ransomware: What Regular People Need to Know Unknown — Wed, 08 Apr 2026 00:00:00 +0000 You open your laptop on a Sunday morning. Coffee’s still brewing. You were going to spend the next hour looking through old family photos. The ones from your daughter’s third birthday, the beach trip two summers ago. Ten years of memories, organized into folders the way you like them. The screen is wrong. The wallpaper has been replaced with something black. White text fills the center: YOUR FILES HAVE BEEN ENCRYPTED. You have three days to pay 0.012 Bitcoin, around $500, to a wallet address you’ve never seen before. After 72 hours, the decryption key gets deleted. Your files stay encrypted forever. You double-click a photo folder out of reflex. The thumbnails are gone. Every image is now called something like IMG_4892.jpg.LOCK</code>. The file won’t open. None of them open. Forty thousand photos from the last decade of your family’s life: birthdays, holidays, a parent who passed away two years ago. They are now corrupted-looking files with a random extension. They sit completely intact on your drive, locked behind someone else’s cryptographic key. This happened to thousands of people last week. It will happen to thousands more next week. Ransomware is not a problem that lives inside corporations and hospitals. It lands on kitchen-table laptops, gaming PCs, and family iMacs constantly, and it destroys irreplaceable things. The short answer: Ransomware is malware that encrypts your files and demands payment for the key. It gets in mostly through pirated software, phishing attachments, and unpatched vulnerabilities. The one defence that actually works is a backup ransomware cannot reach: keep a copy on an external drive you unplug, plus a versioned cloud backup. If you are already hit, disconnect from the internet, do not pay yet, and check nomoreransom.org for a free decryptor. Paying does not guarantee recovery and funds more attacks. Jump to: What ransomware does to your files</a></li> The criminal business model</a></li> How it gets into your computer</a></li> Should you pay?</a></li> The 3-2-1 backup strategy</a></li> What to do if you’re already infected</a></li> Prevention that actually works</a></li> </ul> What Ransomware Actually Does to Your Files</h2> The name describes the mechanism precisely: it holds your data for ransom. But understanding what happens at the file level matters, because it determines what your options are. When ransomware executes on your computer, it begins scanning your drives for files worth encrypting. It targets documents, photos, videos, spreadsheets, PDFs, and database files: anything with personal or financial value. It deliberately leaves operating system files and executables alone. It needs Windows (or macOS) to keep running so you can see the ransom note and, from the attacker’s perspective, pay them. The encryption it uses is real. It is not some weak scramble that can be reversed with a clever script. Modern ransomware uses AES-256 for the file contents, then wraps the decryption key itself in RSA-2048 or elliptic-curve encryption. Only the attacker holds the private key. Without it, your files are mathematically inaccessible. Brute-forcing 256-bit AES encryption with every computer on Earth would take longer than the age of the universe. Once encryption is complete, the malware plants ransom notes — usually text files or HTML files — in every folder it touched. Then it changes your wallpaper, sometimes opens a countdown timer in a browser window, and waits. Some strains also delete Windows’ built-in backup system (called Volume Shadow Copies) in the same sweep, specifically to eliminate your easiest recovery option. The ransom demand for individuals is usually modest by design: $200 to $1,000, often in Bitcoin or Monero. The calculation is deliberate. High enough to be worth running the operation. Low enough that paying feels easier than rebuilding from scratch. The Criminal Business Model Behind This</h2> Ransomware is not primarily written and deployed by the same person. The industry has professionalized in a way that would be darkly impressive if it weren’t so damaging. The dominant model today is Ransomware-as-a-Service (RaaS). Criminal organizations build and maintain sophisticated ransomware toolkits, then license them to affiliates in exchange for a percentage of ransom payments — typically 20 to 30 percent. The affiliate deploys the ransomware, handles victim communication, and collects payment. The core group maintains the infrastructure, updates the malware to evade detection, and often operates a dark-web leak site where they publish stolen data from victims who refuse to pay. LockBit, before its infrastructure was seized by an international law enforcement operation in February 2024, was the most prolific ransomware group in the world by victim count. At its peak, LockBit had over a thousand active affiliates. ALPHV (also called BlackCat), which operated until late 2023, was known for targeting healthcare systems and critical infrastructure. Ryuk, active from 2018 to 2022, specifically hunted large organizations and extracted tens of millions of dollars in ransoms. REvil (also called Sodinokibi) extorted Apple’s supplier Quanta Computer in 2021, demanding $50 million after stealing MacBook schematics. These are the headline names. But the ransomware that targets regular people at home is usually different software from less-sophisticated operators. STOP/Djvu has been running since 2018 and has infected over 500,000 personal computers by current estimates. It spreads almost exclusively through pirated software and cracked games. It targets home users, asks for $200 to $980, and accounts for the majority of individual ransomware infections globally. You will not see it in news coverage of major ransomware attacks. It just quietly destroys people’s personal files by the thousands every month. How Ransomware Gets Into Your Computer</h2> There is no single entry point. Attackers use whatever works, and several vectors work very reliably against home users. Phishing emails with malicious attachments remain the most common enterprise vector, but they hit individuals too. The email looks like an invoice, a shipping notification, a court document, or a bank statement. The attachment is a Word document or an Excel file, and it asks you to “Enable Content” or “Enable Macros” to view it properly. The moment you do, a macro runs a PowerShell command that downloads and executes the ransomware payload. Sometimes the attachment is a ZIP file containing an executable disguised with a PDF icon. Double-click it and it runs immediately. Pirated software and cracked games are the dominant vector for consumer ransomware. This is not a vague warning — it is how STOP/Djvu and dozens of similar strains spread specifically. Cracked versions of Adobe Photoshop, Premiere, Microsoft Office, popular video games, and VPN software downloaded from torrent sites routinely contain ransomware bundled inside the installer. The crack works exactly as advertised. The ransomware runs silently in the background. You won’t know until your files are gone. Drive-by downloads happen when you visit a compromised website or click a malicious advertisement. Your browser encounters code that exploits an unpatched vulnerability — often in the browser itself, in a plugin like Flash (defunct but still occasionally targeted), or in the operating system. The malware installs without any action from you beyond visiting the page. Keeping software updated is the primary defense against this vector. Exposed Remote Desktop Protocol (RDP) is primarily an enterprise problem but affects home users who have remote access enabled on their machines. RDP is the service that lets you log into a Windows computer from another location. If it’s left on and exposed to the internet with a weak password, attackers run automated tools that try millions of credential combinations until they get in. Once inside, they deploy ransomware directly. The FBI’s Internet Crime Complaint Center flagged exposed RDP as a primary initial access vector in its 2023 Internet Crime Report. What Happens in the Hours After Infection</h2> The process is mostly invisible until it isn’t. Modern ransomware is optimized for speed — it can encrypt tens of thousands of files in minutes on a typical consumer hard drive, faster on an SSD. In the background, before encryption begins, many strains do reconnaissance. They identify your operating system and check for virtual machine environments, to avoid security researcher sandboxes. They scan for network shares that can be encrypted too. Then they delete Volume Shadow Copies using a command like vssadmin delete shadows /all /quiet</code>. That last step is significant. Windows creates automatic backups called shadow copies when you install updates or certain software. Many people think they can just restore from Previous Versions if something goes wrong. Ransomware specifically eliminates this option, usually in the first seconds of execution, before it starts touching your documents. Then the encryption sweep begins. The malware generates a symmetric key, the one that actually scrambles your file contents. It encrypts that key with the attacker’s public RSA key. It then stores the encrypted version on your machine or sends it to a command-and-control server. Your file contents are scrambled. The symmetric key needed to unscramble them is locked. Without the private key the attacker holds, there is no mathematical shortcut to recovery. The ransom note appears. The wallpaper changes. If you are home at the time, you might catch the file extensions changing in real time in an open folder window. It is one of the few visible signs something is happening. Should You Pay?</h2> The FBI’s official position is no. The logic: paying funds criminal operations, encourages more attacks, and doesn’t guarantee recovery. For organizations with legal, regulatory, and reputational stakes, this guidance makes practical sense. It is messier for an individual. If you have no backups, and your only copies of a parent’s last year of photos are sitting encrypted on a laptop, the calculus is harder, and the FBI knows it. Some ransomware groups operate with a strange professionalism. They provide functioning decryptors because their business model depends on reputation. If word spread that paying got you nothing, victims would stop paying. LockBit is a criminal enterprise responsible for billions in damage. Even so, it had a documented history of reliably providing decryption tools to paying victims. Security researchers tracked this as a notable operational trait. STOP/Djvu is less consistent: some victims get their files back, others do not. Paying does not guarantee recovery. It funds future attacks. And it does not remove the malware from your machine, which means if you pay and restore without wiping the system, you may get encrypted again. Before paying anything, check nomoreransom.org. This is a legitimate project run by Europol, the Dutch National Police, and cybersecurity companies. It hosts free decryption tools for hundreds of ransomware strains, contributed by researchers who reverse-engineered the encryption or obtained master keys from law enforcement takedowns. You may be able to recover your files for free if your ransomware is an older or defunct strain, or if a law enforcement action has exposed the keys. Upload your ransom note or one encrypted file to the site’s identification tool. It will tell you what strain you have and whether a decryptor exists. The 2022 takedown of Hive ransomware included FBI infiltration of the group’s infrastructure. Agents covertly collected over 300 decryption keys, which were distributed to victims before the public takedown announcement. Similar results came from operations against REvil and Emotet. Checking nomoreransom.org costs nothing and takes five minutes. The 3-2-1 Backup Strategy, in Plain Terms</h2> The only complete defense against ransomware is a backup that ransomware cannot reach. Everything else — antivirus, firewalls, careful browsing — reduces your risk. Backups eliminate the leverage. If your files exist intact somewhere the malware couldn’t touch, the ransom demand means nothing. You wipe the machine, restore from backup, and lose an afternoon instead of everything. The standard framework is 3-2-1: three copies of your data, stored on two different types of media, with one copy stored offsite. In practice for a home user, this looks like: Copy 1 — Your primary device. The files on your laptop or desktop. This is the working copy.</li> Copy 2 — An external drive, kept disconnected. This is the critical detail that most people miss. An external drive that stays plugged in will be encrypted alongside your local files — ransomware targets all connected storage. The backup drive needs to be physically disconnected when you’re not actively backing up to it. Plug it in, run a backup, unplug it. Once a week, or once a day if your files change frequently.</li> Copy 3 — Cloud backup, not cloud sync. These are different things and the distinction matters.</li> </ul> Google Drive, Dropbox, iCloud, and OneDrive are sync services. They mirror what’s on your machine to the cloud. Say ransomware encrypts your local files and your sync client uploads those encrypted versions before you notice. That happens, because ransomware can move faster than a slow sync cycle. Now your cloud copies are also encrypted. Sync services are useful, but they are not backups in the ransomware sense. Cloud backup services keep versioned copies of your files, meaning they retain previous versions for a period of time even after the local file changes. Backblaze Personal Backup costs around $9 per month for unlimited storage and keeps 12 months of file history by default. That version history is the protection: even if the encrypted versions sync up, you can restore a pre-encryption version from the backup’s history. Acronis, iDrive, and Carbonite offer similar versioned backup approaches. Apple Time Machine with a network-attached drive, combined with iCloud, gets you partway there if configured carefully. The one-offsite copy matters because local disaster — fire, flood, theft — can take out your machine and your unplugged external drive simultaneously. Cloud backup solves this automatically. What to Do Right Now If You’re Already Infected</h2> If you’ve opened your laptop and seen the ransom note, here is the sequence that gives you the best chance. Disconnect from the internet immediately. Pull the ethernet cable or turn off Wi-Fi. This stops the ransomware from sending encryption keys back to command-and-control servers, which some strains do. It also stops lateral spread to other devices on your home network: your spouse’s laptop, your NAS, your connected external drives. Move quickly. Do not turn the machine off. This sounds counterintuitive, but some strains store the encryption key in memory before transmitting it. Forensic analysis of RAM dumps has occasionally recovered keys. A cybersecurity professional or law enforcement would need to handle this, but turning the machine off ends that possibility. Take a photo of the ransom note screen with your phone. For the nomoreransom.org identification process, you will need the ransom note text, any contact email addresses or dark web URLs, and the name of the ransomware strain if it’s listed. Identify the strain. Go to nomoreransom.org from another device (not the infected machine). Use the Crypto Sheriff tool. Upload your ransom note or an encrypted file. The tool will identify the ransomware family and tell you whether a free decryptor exists. Do not pay immediately. Give yourself time to check for free decryptors, consult with a data recovery professional, and think clearly. The 72-hour countdown is designed to create panic and short-circuit your decision-making. Some strains actually extend their deadlines on request; the countdown is partly theater. If you have backups, do not restore from them onto the infected machine. Wipe the machine first — reinstall Windows from scratch, verify the machine is clean, then restore your files from backup. Restoring onto an infected system may result in re-encryption. If you have no backups and no free decryptor exists, you have a difficult decision. A professional data recovery service may be able to help in edge cases — particularly if the ransomware had a programming flaw in its implementation. This has happened with several amateur strains. It is not reliable, but it exists as an option. Companies like Coveware specialize in ransomware response and can advise on whether payment or recovery has better odds in your specific situation. Why Volume Shadow Copies Won’t Save You</h2> Windows has a built-in feature called Volume Shadow Copy Service (VSS) that creates point-in-time snapshots of your drive. You can access previous versions of files by right-clicking them and selecting “Restore previous versions.” It is legitimately useful for accidental deletions and file corruption. Ransomware authors know this feature exists and eliminate it immediately. The command vssadmin delete shadows /all</code> runs in seconds with administrative privileges. So does wmic shadowcopy delete</code>. Both are standard components of modern ransomware deployment, executed before encryption begins, before you have any indication something is wrong. If you check Previous Versions on an encrypted file after a ransomware infection, you will find the history empty. The snapshots are gone. This is not a Windows failure — it is a deliberate step in the attack. Relying on VSS as your backup strategy means your backup strategy has been specifically anticipated and neutralized. Prevention: What Actually Works</h2> The security advice you’ve heard before — don’t click suspicious links, keep software updated — is real, but it’s incomplete without the specifics. Keep Windows updated, and do it immediately. Ransomware exploits vulnerabilities in Windows components, Office, and browsers. Microsoft’s monthly Patch Tuesday updates close these gaps. The WannaCry ransomware attack in 2017 that disabled NHS hospitals across the UK exploited a Windows vulnerability (EternalBlue) for which Microsoft had released a patch 59 days earlier. The hospitals hadn’t applied it. This pattern repeats constantly. Automatic updates should be on. Do not run pirated software. This is the one. Cracked Photoshop, cracked Office, cracked games — these are the primary delivery mechanism for STOP/Djvu and dozens of similar consumer ransomware strains. The risk is not theoretical. It is the main vector by which home users get infected. If you’re running cracked software, you are playing a form of lottery where the prize is encrypted files. Disable Office macros by default. Microsoft Office macros are the delivery mechanism for a large share of email-attachment ransomware. Open a malicious Word document, click “Enable Content,” and a macro silently downloads and executes the payload. In Office 2016 and later, macros from the internet are now blocked by default and require explicit administrator action to enable. Verify this is the case on your machine. You can check in any Office application under File > Options > Trust Center > Trust Center Settings > Macro Settings. “Disable all macros with notification” is the right setting. Enable Controlled Folder Access. This is a Windows Security feature that prevents unauthorized applications from modifying files in protected folders (Documents, Pictures, Videos, Desktop, and others you specify). You enable it in Windows Security > Virus & Threat Protection > Ransomware Protection > Controlled Folder Access. When ransomware tries to encrypt files in those folders, it gets blocked. The feature is off by default. Turning it on is one of the most direct ransomware mitigations built into Windows at no cost. Use Windows Defender, and don’t assume you need to replace it. Windows Defender (now Microsoft Defender Antivirus) is substantially more capable than it was five years ago. Independent testing from AV-TEST and AV-Comparatives consistently rates it as adequate protection for home users. It detects known ransomware strains reliably. Paid antivirus products offer additional features but are not required for baseline protection. What Defender cannot protect against is what you install yourself — including cracked software that you’ve explicitly told your system to run. Audit what’s on your network. Ransomware spreads laterally after infecting your primary machine. A NAS (network-attached storage device), a home server, or a Raspberry Pi accessible on your home network can all be targeted. Make sure they require authentication, are not exposed to the public internet, and have their own backup strategy. The Version of This Story That Doesn’t Have a Bad Ending</h2> The $500 ransom demand for a family’s photo archive is not a complex security failure. It’s the direct result of two decisions: running software from untrustworthy sources, and not maintaining a backup. Both of those are fixable right now, today, before anything happens. Set up Backblaze or an equivalent versioned cloud backup — it takes twenty minutes and $9 a month. Buy a 2TB external drive for $60, plug it in tonight to create a local backup, then disconnect it and put it in a drawer. Turn on Controlled Folder Access in Windows Security. Stop running pirated software. Apply pending Windows updates. The backup especially. Everything else reduces your probability of getting infected. A proper backup eliminates the ransomware’s leverage entirely. The attacker holds a key to files they’ve encrypted on your machine — but if identical copies exist somewhere clean, that key is worthless. They’ve done considerable work for nothing. The families who lose ten years of photos to ransomware are not less careful or less technically savvy than the families who don’t. They just hadn’t gotten around to setting up a backup yet. That gap is the entire attack surface. Close it before you need to. The same infostealer malware that drops ransomware also scrapes your saved passwords and session cookies, which is a separate exposure worth checking. Our stealer logs explainer</a> covers how to tell if your credentials have already leaked. KnytX Vigil</a> is built to watch breach databases and stealer logs for your data and flag hits early. Vigil isn’t live yet; join the waitlist</a> to turn it on at launch. Data Breach vs Data Leak: What's the Difference? Unknown — Tue, 07 Apr 2026 00:00:00 +0000 In May 2023, a vulnerability in MOVEit Transfer let attackers pull data from hundreds of organizations in a matter of days. MOVEit is a widely used managed file transfer product. The Cl0p ransomware group exploited CVE-2023-34362, a SQL injection flaw, and walked out with records from government agencies, pension funds, banks, and universities across more than a dozen countries. That’s a data breach: someone exploited a system, gained unauthorized access, and exfiltrated data that was never meant to leave. Six months earlier, researchers at Cybernews discovered a database of 3.8 billion records exposed on an unsecured Elasticsearch instance. No attacker needed a vulnerability. No one broke in. The server simply had no password. Anyone who found it — including automated scanners that hunt these things around the clock — could read every record. That’s a data leak. Both incidents end the same way for the people whose information was involved: their data is out. But how it got out, how widely it has spread, and what legal and practical options they have are quite different. The press uses these terms interchangeably. That habit hides a real distinction. The short answer: A data breach is an access event. Someone breaks in (a hacker, phishing, or a misusing insider) and takes data that was never meant to leave. A data leak is an exposure event. Data becomes public because it was misconfigured, with no attacker required. The difference matters for your legal rights: breaches usually trigger notification duties, while leaks fall into a gap where companies may never tell you. Either way, if your data was exposed, the practical response is the same. In this article: What is a data breach?</a></li> What is a data leak?</a></li> Why the distinction matters in law</a></li> How your data spreads differently</a></li> When a breach and a leak meet</a></li> What this means for you practically</a></li> Checking whether you were affected</a></li> The response checklist</a></li> Frequently asked questions</a></li> </ul> What is a data breach?</h2> A breach is an access event. Someone who should not have had access to a system — or a piece of data within that system — obtained it anyway. That usually means an external attacker exploiting a software vulnerability, compromising credentials, or using phishing to get a foothold. It can also mean a malicious insider: an employee who legitimately has access to systems but uses that access in ways they’re not authorized to. The Equifax breach in 2017 is the standard textbook case. Attackers exploited an unpatched Apache Struts vulnerability (CVE-2017-5638) and spent roughly 78 days inside Equifax’s systems before anyone noticed. They extracted 147 million Social Security numbers, birth dates, addresses, and driver’s license numbers. Equifax had known about the vulnerability for months. They just hadn’t patched it. The Marriott breach that came to light in 2018 is more disturbing in a different way. Attackers had been inside the Starwood guest reservation database since 2014 — four years before Marriott discovered it. Marriott acquired Starwood in 2016 and inherited the compromise along with the hotel chain. Up to 500 million guest records were exposed, including passport numbers for some guests. The attacker had time to be methodical and selective. Marriott faced roughly $124 million in fines from UK and US regulators. Morgan Stanley’s 2022 SEC fine illustrates the insider variant. The SEC fined Morgan Stanley $35 million after a wealth management employee sold thousands of client records to a data broker. The employee had legitimate access to the data as part of their job. The breach wasn’t a hack. It was a trusted person misusing their access for personal profit. From a legal standpoint, it’s still unauthorized use. From a practical standpoint, the client data ended up in the same place it would after an external attack: with someone who wanted to profit from it. What is a data leak?</h2> A leak is an exposure event. The data becomes accessible to unauthorized parties not because someone broke in, but because it was misconfigured to be accessible in the first place. No attacker was required. The data was simply — to use the legal phrasing that will matter later — technically available. The most instructive example from recent years is the Microsoft Power Apps incident in 2021. Power Apps, Microsoft’s low-code application platform, had default settings that made data tables publicly accessible unless administrators explicitly changed them. Most administrators didn’t know this. Security researchers at UpGuard found 47 organizations had left their Power Apps portals open to the internet. Those included American Airlines, Ford, the Indiana Department of Health, and New York City’s Department of Education. The exposed records numbered 38 million, covering vaccine appointment schedules, COVID-19 contact tracing data, employee records, and Social Security numbers. Microsoft eventually changed the default settings to private, but the data had already been publicly accessible for months. The same pattern repeats constantly with cloud storage. An Amazon S3 bucket, an Azure Blob container, a Google Cloud Storage bucket — all are private by default, but a single misconfigured permission setting makes them publicly readable. UpGuard’s research in 2021 documented more than 3,000 AWS S3 buckets containing sensitive data that had been publicly accessible, in some cases for years. In 2021, the Twitch source code and creator payment data — 125 gigabytes of it — became publicly accessible via a misconfigured server. Twitch confirmed it; they attributed it to an error in a server configuration change. Elasticsearch and MongoDB instances left open without authentication have become almost a genre of security incident on their own. Researchers at Comparitech regularly publish reports of healthcare records, financial data, and personal information sitting in password-free database instances. These are discoverable via Shodan or Censys, tools that scan the entire internet and index everything they find. A healthcare database in Thailand, a voter database in Indonesia, hundreds of millions of Facebook records sitting in an unprotected Amazon S3 bucket (discovered in 2019 by UpGuard). The discoverers are usually researchers. The first discoverer isn’t always. Why does the distinction matter in law?</h2> Most breach notification laws were written with the unauthorized access model in mind. In the United States, a patchwork of state breach notification laws began with California’s SB 1386 in 2003. They define a reportable breach as unauthorized access to personal information. The GDPR’s Article 33 requires notification to supervisory authorities of “a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data.” Leaks fall into an uncomfortable gap. If data was misconfigured to be publicly accessible, has anyone actually accessed it without authorization? The company’s lawyers sometimes argue: our data was technically public, so no one “accessed” it in the legal sense. Therefore, no breach. Therefore, no notification obligation. This argument has been tried in court and in front of regulators, with mixed results. Some regulators have found that publicly exposing data is itself an unlawful disclosure, regardless of whether anyone provably accessed it. The UK’s ICO and several EU data protection authorities have taken this position. Some US courts have ruled that misconfiguration-caused exposure is actionable. But the legal landscape is inconsistent. The argument creates real space for companies to avoid notifying affected individuals after a leak, even when the exposure was just as serious as a conventional breach. The practical result: if your data was in a leaky S3 bucket, you may never receive a notification at all. The company may genuinely not know anyone accessed the data, or they may know but believe they have no legal obligation to tell you. Either way, you’re in the dark. How does your data spread differently?</h2> Here is the practical difference that matters most. A breach produces a discrete dataset. The attacker exfiltrated some set of records — whatever they had time and bandwidth to pull before they were detected or before they left. That dataset circulates in the underground economy: sold on forums, traded between groups, eventually posted publicly. The spread happens through human transactions. It’s traceable in aggregate, even if you can’t follow your specific record. A leak is different because the exposure is continuous for as long as the misconfiguration persists — and because automated systems find and archive open data almost immediately. Shodan indexes internet-connected services in near real-time. GrayhatWarfare, a searchable database of open S3 buckets, catalogs publicly accessible cloud storage continuously. Security researchers find open databases and report them responsibly (usually), but not always before others have found them too. By the time the owning company discovers a misconfigured database, it has often already been crawled, indexed, or downloaded by whatever automated system found it first. The interval between exposure and discovery is often measured in months. The 2021 Microsoft Power Apps exposure had been publicly accessible for an unknown period before researchers found it. The Bangladesh Bank SWIFT data exposure was accessible long enough that the question of who saw it first was never fully answered. A database that was open for two weeks before being secured may have been indexed within hours. The result: when a leak is finally fixed, the answer to “did anyone access this data?” is genuinely unknowable. What you do know is that automated scanners found it. You just don’t know what they did with it afterward. The gray zone: when a breach and a leak meet</h2> The MOVEit breach and the Power Apps leak sit at opposite ends of a clear spectrum. But real incidents often land somewhere in the middle. Consider the scenario where an employee misconfigures an internal system and a competitor or attacker finds the opening and downloads data. That starts as a leak — misconfiguration, no attacker required — and becomes a breach the moment someone with bad intent accesses it. From the affected individuals’ perspective, it looks identical to a purely external breach. The company may still try to argue that the initial exposure was a misconfiguration, not a breach, limiting their notification obligations. Or consider the Bangladesh Bank case: the SWIFT system exposure involved both inadequate access controls (leak-like in origin) and deliberate actors exploiting those controls (breach-like in execution). Most regulatory actions treat these hybrid incidents as breaches because unauthorized access occurred, regardless of how the door was left open. What does this mean for you practically?</h2> Whether your data was breached or leaked, it may now be in circulation. The severity isn’t determined by which category the incident falls into — it’s determined by what type of data was exposed. A leaked database of Social Security numbers is more dangerous than a breached database of usernames only. For the immediate response, the actions are the same regardless of how your data got out: After a breach, the notification window gives you a rough timeline. The attacker exfiltrated data at some known point; you’re dealing with a known exposure. After a leak, there’s no such anchor. Your data may have been accessible for months before discovery. The uncertainty is worse, not better. The other practical difference: after a breach, you can ask legal questions about unauthorized access and, in some jurisdictions, pursue compensation claims based on that unauthorized access. After a leak, the legal route is harder. You need to demonstrate harm rather than simply that the access was unauthorized. Courts are increasingly willing to hear misconfiguration cases, but it remains harder to establish standing than in a clear unauthorized-access breach. Checking whether you were affected</h2> HaveIBeenPwned (haveibeenpwned.com) aggregates breach data from confirmed incidents and lets you search by email address. It covers conventional breaches well. Its coverage of leaks is patchier — some major leak datasets have been added, but not all. Some security researchers maintain separate indexes of leaked databases (Dehashed, LeakCheck, and others). These tend to have broader coverage of leak data, but they also have less rigorous verification. Treat hits from these sources as signals worth investigating rather than confirmed exposures. For cloud leak data specifically, GrayhatWarfare lets you search open S3 buckets. This is useful if you’re trying to determine whether a specific company’s cloud storage was — or is — misconfigured. The response checklist</h2> Whether you’re responding to a breach notification, a news report about a company you use, or a hit on HaveIBeenPwned, the response is the same: Immediately: Change the password on the affected service. Use a password manager to generate something unique — not a variation of your old password.</li> Check every other account where you used the same password. Change those too. All of them.</li> Enable two-factor authentication on the affected service and on every account where you just changed a duplicate password. Use an authenticator app — not SMS — where the option exists.</li> </ul> Within 24 hours: If the exposed data included payment card numbers: contact your bank or card issuer, ask them to reissue the card, and review your recent transactions.</li> If the exposed data included national ID numbers (Social Security number, National Insurance number, Aadhaar): place a credit freeze at all three major credit bureaus (in the US: Equifax, Experian, TransUnion). A freeze is free and prevents new credit lines from being opened in your name without your explicit approval. This is also the right step if the breach included financial account numbers.</li> If the exposed data included medical records: review your explanation of benefits statements for procedures you didn’t receive. Medical identity theft — using someone’s insurance to bill for fraudulent care — is difficult to detect and slow to resolve.</li> </ul> Ongoing: Set up monitoring for your email address at HaveIBeenPwned. Free alerts notify you when your email appears in newly added breach datasets.</li> Check your credit reports. In the US, annualcreditreport.com gives you free reports from all three bureaus. In the UK, Experian and Equifax offer free tiers. Look for accounts you didn’t open, inquiries you didn’t authorize, or addresses you don’t recognize.</li> If you received an official breach notification: read it for the specific data types involved. The company’s notification is your best source for what was exposed, not the press coverage, which is often incomplete.</li> Watch where your exposed details resurface. Breach and leak data feeds people-search sites</a> that build searchable profiles from it.</li> </ul> If you believe harm resulted: In the EU and UK: you have a right to file a complaint with your data protection authority (your national DPA under GDPR; the ICO in the UK). This is free and requires no lawyer.</li> In the US: the FTC (ftc.gov/idtheft) has resources for identity theft victims. For financial fraud, your state attorney general’s office is often a better starting point than federal agencies.</li> For significant breaches involving UK or EU residents, specialist no-win-no-fee solicitors handle data breach compensation claims. Our guides to UK compensation claims</a> and GDPR non-material damage claims</a> cover what you need to show.</li> </ul> One more thing worth knowing: the distinction between breach and leak, while real and legally significant, does not determine whether you were harmed. A misconfigured database containing your home address, health records, or financial details is just as dangerous as the same data extracted by an attacker. The only question that ultimately matters is what was exposed and who might have seen it. The MOVEit breach was discovered because Cl0p announced it. The Power Apps leak was discovered because researchers were looking. In neither case did the affected individuals find out through any mechanism they controlled. That’s the state of things. The checklist above is what you have. Frequently asked questions</h2> What’s the difference between a data breach and a data leak? A breach is unauthorized access: someone breaks in and takes data. A leak is accidental exposure: data sits open because of a misconfiguration, with no attacker needed. Both end with your data out. Is a data leak less serious than a breach? Not necessarily. Severity depends on what data was exposed, not how. A leaked database of Social Security numbers is more dangerous than a breached list of usernames. Do companies have to tell me about a data leak? Often no. Notification laws focus on unauthorized access. Companies sometimes argue that misconfigured, publicly available data was never “accessed,” so no breach occurred and no notice is owed. What should I do if my data was breached or leaked? The steps are the same either way. Change reused passwords, enable two-factor authentication, freeze your credit if ID numbers leaked, and set up Have I Been Pwned alerts. See our guide on what to do after a data breach</a>. What you can do right now</h2> Want to see what data brokers expose about you? See what a scan finds →</a> shows an example report: the kinds of sites that list your name, phone, and address. Once KnytX Shield launches it will find and remove these listings automatically. Join the waitlist</a> to get in early. How to Remove Yourself from US Data Broker Sites Unknown — Sun, 05 Apr 2026 00:00:00 +0000 Type your own name into Google. Add the city you live in. Within the first page of results, you’ll see your home address, your age, your family members’ names, your estimated property value, your political party registration, and a phone number you haven’t used in four years. All of it is freely accessible to anyone who clicks. The sites serving up that information have names you may not recognize: Spokeo, BeenVerified, Whitepages, MyLife, Intelius, TruthFinder, Radaris, FastPeopleSearch. None of them hacked you. They just collected what was already technically public and built a retail storefront around it. That’s what makes this problem so hard to simply “fix” and walk away from. This guide covers four things: what you’re dealing with, how to remove yourself from each major site, what your legal rights are, and why this is a process you’ll repeat rather than a one-time fix. The steps are real and they work. So is the reason you’ll be doing them again in three months. How do you remove yourself from US data brokers? Work in two tiers. First the retail people-search sites like Spokeo</a>, BeenVerified</a>, Whitepages</a>, MyLife</a>, Intelius</a>, and FastPeopleSearch</a>, each with its own opt-out form. Then the wholesale aggregators that feed them, like Acxiom</a> and LexisNexis</a>. Removed listings reappear within 30 to 90 days as source records refresh, so treat this as recurring maintenance, not a one-time sweep. Full per-site steps are below. What you find when you Google yourself</h2> Here’s the typical scenario. You search your full name. Spokeo surfaces your current address, your previous two addresses, and three possible relatives — your spouse, your adult child, and a sibling in another state. BeenVerified shows your age, your email addresses, your phone numbers including a cell you’ve had since 2009. MyLife has assigned you a “reputation score” and shows your employer. Radaris lists your home’s square footage and the price you paid for it. TruthFinder adds your political party affiliation, pulled from voter rolls. FastPeopleSearch shows your neighbors. None of this required a data breach. It came from public records, voter registration files, property deed databases, and social media scrapers — sources that are individually mundane but devastating when assembled into a single profile. Your county’s property records website lists your sale price. Your state’s voter registration file, public under most state laws, lists your name, address, and party. Social Security Administration records fill in the rest. Your information is on six to twelve sites at minimum. Probably more. And every person in your household who shares your address is exposed in your listing whether or not they ever searched for themselves. The two types of sites you’re dealing with</h2> Not all data brokers are the same, and the distinction matters for how you approach removal. People-search sites are the retail tier — the ones that show up in Google and let anyone look up anyone. Spokeo, Whitepages, BeenVerified, MyLife, Intelius, FastPeopleSearch, and Radaris all operate this way. They’ve designed their interfaces for ordinary people doing ordinary lookups: finding an old friend, checking who’s calling, or vetting a date. Each one has a public opt-out process, because they’re consumer-facing and legally exposed if they make it impossible to remove yourself. Data aggregators operate wholesale. Acxiom, Oracle Data Cloud (formerly BlueKai), Epsilon, and LexisNexis don’t sell to individuals — they sell to businesses, insurers, advertisers, and background check companies. You’ll never find your profile by Googling yourself there. But these companies are the upstream source feeding the retail-facing sites. Opt out of Spokeo and leave Acxiom alone, and Spokeo will simply re-pull your record from Acxiom the next time it refreshes its database. You need to address both tiers. The retail sites first, because they’re more accessible. The aggregators second, because they’re the source. How to opt out — the major people-search sites</h2> Each site has its own process. Some are tolerable. Some are deliberately friction-heavy. Here are the ones worth doing first. Spokeo Go to spokeo.com/opt_out/new</code>. Search for your listing by name, city, and state. When your record appears, click “This is me” and submit your email address. Spokeo sends a confirmation link — click it. The record is typically removed within 5–7 days. Spokeo has multiple listings per person if you’ve lived in different places; you need to submit a separate opt-out for each address on file. BeenVerified Go to beenverified.com/opt-out</code>. The form asks for your name and state. When your listing appears, select it and submit. Email confirmation required. BeenVerified is faster than most — removal usually processes within 24 hours. The site also aggregates data by phone number and email, so check whether you appear under multiple records. Whitepages Go to whitepages.com/suppression-requests</code>. Search your name and city. When your listing comes up, select it and choose the opt-out option. Then verify via a phone call — Whitepages calls the number associated with your listing to confirm the request. This is one of the more annoying processes in the space, because the phone number they call is the one you’re trying to remove. Have the number available when you submit. Processing takes 24–48 hours. MyLife Go to mylife.com/privacy/remove-my-information.html</code>. MyLife requires you to fill out a form, then email privacy@mylife.com</code> with your full name and current address. It also demands a scan of a government-issued ID. That last requirement, a state ID scan, is unreasonable. No other major people-search site demands this. You’re being asked to hand over more identifying information to remove your identifying information. It also runs counter to the spirit of CCPA, which is supposed to make data deletion easier, not create new vectors for data collection in the name of “verification.” If you’re not comfortable sending your ID to MyLife, document the request and proceed to the other sites. MyLife is a lower-priority removal because of this friction, though their “reputation score” feature makes them worth checking before you deprioritize them. Intelius Go to intelius.com/opt-out</code>. Search for your listing, select it, and submit the opt-out form. Intelius processes removals within 72 hours and doesn’t require a phone call or ID. One of the cleaner processes on this list. FastPeopleSearch Go to fastpeoplesearch.com/removal</code>. Search your name and state. Select your listing and click the remove button. Email confirmation required. FastPeopleSearch is typically fast — removal within 24 hours — and the process is direct without unnecessary steps. For TruthFinder, Radaris, and PeopleFinder, the opt-out pages are findable by searching “[site name] opt out” in Google. Each follows a similar pattern: find your listing, submit your email, confirm via link. None require ID. Add them to your list after handling the six above. Data aggregators: the harder problem</h2> Acxiom, Oracle Data Cloud, Epsilon, and LexisNexis are the companies feeding data to everything else. They’re less visible, and their opt-out processes are deliberately harder to find and complete. Acxiom runs an opt-out portal at acxiom.com/opt-out</code>. You submit your name, address, and email. Acxiom processes requests within 30 days and is one of the more accessible aggregators. Still slower than the retail sites, but the form exists and works. Oracle Data Cloud (formerly BlueKai) manages your opt-out at datacloudoptout.oracle.com</code>. This covers Oracle’s advertising data, not the full data broker profile, but it’s worth submitting. Epsilon requires a written request. Their privacy contact is listed at epsilon.com/us/privacy-policy</code> and requests typically involve sending a letter or email to their privacy team — not a self-serve form. Be honest with yourself: most people won’t do this, and Epsilon bets on that. LexisNexis is the most entrenched. They’re embedded in background checks, insurance underwriting, and legal research. Their consumer opt-out exists at lexisnexis.com/privacy/for-consumers/opt-out-of-lexisnexis.aspx</code> but covers only certain data products, not the full range of what they hold. If you have specific concerns — particularly around background checks or insurance — it’s worth reading their policy in detail before submitting. This tier takes longer and delivers incomplete results. That’s not a reason to skip it. It’s a reason to prioritize it after the retail sites, which are quicker wins. Your legal rights: CCPA and state laws</h2> If you’re a California resident, you have CCPA — the California Consumer Privacy Act — and it’s the strongest consumer data law in the US. Under CCPA, you have several rights: to know what personal data a business holds about you, to request deletion, to opt out of the sale of your data, and not to be discriminated against for exercising any of them. CCPA applies to businesses operating anywhere, not just California companies. So a data broker headquartered in Delaware with California users is still covered. As of mid-2026, similar laws are in effect in Virginia (VCDPA), Colorado (CPA), Texas (TDPSA), Connecticut, Montana, Oregon, and roughly twenty other states, with the list still growing. The rights vary in strength. Texas’s law, for example, is weaker on enforcement than California’s. But they all create a legal basis for deletion requests that data brokers are required to honor. Federal law is thinner. The Fair Credit Reporting Act (FCRA) covers data used in credit, employment, housing, and insurance decisions. That captures some of what LexisNexis and similar aggregators do. But it doesn’t apply to most people-search sites, which aren’t classified as consumer reporting agencies. Want the full breakdown of what CCPA gives you, plus how to file a complaint when a company ignores your deletion request? See our complete CCPA guide</a>. The re-listing problem</h2> Here’s what nobody explains upfront: removal is not permanent. Most people-search sites pull from public records — voter registration rolls, county property records, court filings, DMV data in states where it’s accessible, and social security death index files. These records are refreshed regularly. When a site re-crawls its sources 30 to 90 days after your opt-out, your data reappears in the raw input. Without an active suppression on your record, the site lists you again. Some sites maintain suppression lists that persist after opt-out. Spokeo is reasonably good at this. Others treat each opt-out as a temporary flag that gets overwritten when the database refreshes. You won’t know which category applies until you check your listing again in three months and either find it gone or find it back. The voter roll problem is particularly hard. You can’t easily remove yourself from voter registration, because that’s how democracy tracks that you’re eligible to vote. And every state that makes voter files public (about 40 of them) becomes a permanent seed source for re-aggregation. Property records are similar: the county records office publishes your home purchase, and anyone is free to use that data. Court records, business filings, professional licenses, and obituary databases all function the same way. The data broker ecosystem is built on top of a public-records infrastructure that predates the internet by a century. This is a structural problem, not a bug in one site’s process. It’s why removal needs to be repeated. Think of it less like deleting a file and more like weeding a garden — the seeds are always in the soil. The manual vs automated decision</h2> If you’re doing this manually — finding every opt-out page, submitting every form, tracking every confirmation email — expect to spend 20 to 40 hours for a reasonably thorough sweep. That covers the major people-search sites, the primary aggregators, and enough of the secondary sites to reduce your visible footprint meaningfully. Then you repeat it every 90 days. That’s the honest number. Not a weekend afternoon. Not two hours. Twenty to forty hours, recurring. Tools like DeleteMe (around $129 per year) and Privacy Bee automate the submission process for US sites and handle the recurring re-submission when listings reappear. They’re legitimate options if the manual process isn’t sustainable for you. KnytX Shield</a> is built to handle US sites alongside EU and Indian brokers under a single dashboard. That helps if you have exposure across multiple jurisdictions, which increasingly applies to anyone who has worked, studied, or lived internationally. It isn’t live yet; join the waitlist</a> to get in early. We’re not going to pretend the manual process is fine if you have the coverage to automate it. It isn’t. Pick whichever approach you’ll actually maintain quarterly. What you can do right now</h2> Want to see what data brokers expose about you? See what a scan finds →</a> shows an example report: the kinds of sites that list your name, phone, and address. Once KnytX Shield launches it will find and remove these automatically. Join the waitlist</a> to get in early. People-Search Sites: How to Remove Your Profile Unknown — Sat, 04 Apr 2026 00:00:00 +0000 Search your name on Spokeo. Give it ten seconds. What comes back isn’t just your name and city. It’s your current address, the three addresses before that, and your relatives’ full names and addresses. Often it adds an estimated income range, and sometimes a note on whether you own or rent your home. You never gave Spokeo any of this. They built it from public records. It’s legal. And undoing it is manual, repetitive, and temporary, unless you have a process. How do you remove yourself from people-search sites? Each site has its own opt-out. On Spokeo</a>, submit your listing URL and confirm by email. On Whitepages</a>, verify by phone. On BeenVerified</a>, Radaris</a>, MyLife</a>, and FastPeopleSearch</a>, file each opt-out separately. Removal takes a day to two weeks per site, and most sites re-list you within 30 to 90 days, so you have to re-check and re-file. The full walkthrough for each site is below. What these sites actually know about you</h2> The list is longer than most people expect. People-search sites typically compile: Current and past addresses going back 10 to 20 years, often including apartment numbers</li> Phone numbers — both landlines you haven’t used in a decade and your current mobile</li> Relatives’ names and addresses — your parents, siblings, adult children, and sometimes in-laws</li> Estimated income range derived from neighborhood data, property values, and other signals</li> Political party registration — public in most US states, often listed directly</li> Property ownership and estimated value — pulled from county assessor records</li> Court records and criminal background — arrests, civil suits, traffic violations, evictions</li> Email addresses collected from data breaches, loyalty programs, and commercial sources</li> Social media profiles — linked accounts found via email address or username matching</li> </ul> That last item catches people off guard. Run your email address through a site like BeenVerified and it will surface every social account connected to that address, including ones you forgot existed. Where does the data come from, and why is it legal?</h2> Every major source is technically public. That’s the foundation people-search sites stand on. Voter registration records are public in most US states. Florida, Ohio, and Michigan make them freely available online. They include your name, address, date of birth, and party affiliation. Data brokers buy or download these in bulk. County property records are public by design — the county assessor’s database is available online in virtually every US county. Any purchase, transfer, or assessed value is there for anyone to download. Court records — civil suits, criminal cases, and traffic violations — are public at the state and federal level. PACER provides federal court access. Most state court systems have public portals. Brokers harvest these continuously. USPS change-of-address requests. Here’s one most people don’t know. When you file a change of address with the US Postal Service, the USPS licenses that information to data brokers through its NCOALink program. You move, you tell USPS, and within weeks your new address is in the broker ecosystem. It’s been standard practice for decades. It should not be. On top of public records, commercial data flows in from retail loyalty cards, magazine subscription lists, warranty registrations, and survey companies. Every time you’ve handed over your email for a 10% discount, there’s a chance that transaction ended up in one of these profiles. Removal instructions for the major sites</h2> Each site has its own process. None of them are easy on purpose. Spokeo — go to spokeo.com/opt_out/new. Search for your listing, copy the URL, paste it into the opt-out form, and confirm via email. Removal takes 5 to 7 days. Spokeo is one of the more straightforward removals. Whitepages — go to whitepages.com/suppression-requests. Search your listing, select it, and click the opt-out option. Whitepages requires phone verification — they’ll call or text a number associated with your listing to confirm. Annoying, but it works within 24 to 48 hours. If you’ve changed your number, expect friction. BeenVerified — go to beenverified.com/opt-out. Enter your listing details, click “Opt Out,” and confirm via email. BeenVerified processes removals within about 24 hours and sends a confirmation message. Radaris — go to radaris.com/page/how-to-remove, search your name, click “Control your information,” and email their privacy team at privacy@radaris.com with your listing URL. Radaris is slow — expect 1 to 2 weeks and sometimes no confirmation at all. Follow up if you haven’t heard back. MyLife — go to mylife.com/privacy/remove-my-information.html. MyLife requires you to send a government-issued ID scan to privacy@mylife.com. This is an unreasonable requirement for a service you never signed up for, that profits from your data without your consent. Unfortunately it’s their stated process, and they enforce it. Use a redacted copy of your ID if you go this route. FastPeopleSearch — go to fastpeoplesearch.com/removal. Enter your name and address, complete the CAPTCHA, and confirm via email. Removal is typically done within 24 hours. Complete these removals in order — Spokeo and Whitepages get the most search traffic and are the highest priority. Why do people-search sites re-list you after removal?</h2> Here’s what nobody tells you until after you’ve spent a weekend doing opt-outs: the data comes back. People-search sites don’t store a static copy of your information. They pull from live feeds — continuously updated data from county assessors, court systems, voter rolls, and commercial brokers. When your voter registration updates (you move, re-register, or change party), that new record gets ingested. When a court files a new document with your name, it gets scraped. When another broker sells your updated address, it gets merged into your profile. Most sites will re-list you within 30 to 90 days of removal if any of your source records change. This is structural. It’s not a bug in their systems — it’s the business model. Manual opt-outs work once. Staying off these sites requires ongoing monitoring and re-submission, which is why people-search removal services exist. Your legal rights for US data broker removal</h2> If you’re in California, the CCPA and California’s Data Broker Registry law (AB 1202) are relevant. AB 1202 requires data brokers operating in California to register with the California Privacy Protection Agency. They must also give consumers a way to opt out of the sale of their information. Most major people-search sites are registered. California’s DELETE Act now lets you send one deletion request to every registered broker at once. We cover the mechanism in how to file a DELETE Act request</a>. CCPA gives California residents the right to opt out of the sale or sharing of their personal information. That covers not just deletion but any commercial transfer of your data to third parties. It applies to Spokeo, BeenVerified, Whitepages, and most other major people-search platforms, which are all large enough to clear CCPA’s revenue thresholds. If you’re in Virginia, Colorado, Texas, or Connecticut (among others), your state privacy law gives you similar opt-out rights. For the full breakdown of what CCPA covers and where it falls short, see What CCPA Actually Gives You — and What It Doesn’t</a>. Outside the US? GDPR (EU and UK) and India’s DPDPA both provide stronger deletion rights, and data brokers operating in those jurisdictions must comply with formal erasure requests. What you can do right now</h2> Want to see what data brokers expose about you? See what a scan finds →</a> shows an example report: the kinds of sites that list your name, phone, and address. Once KnytX Shield launches it will find and remove these automatically. Join the waitlist</a> to get in early. How AI Companies Collect Your Data for Training Unknown — Fri, 03 Apr 2026 00:00:00 +0000 In 2023, a team of security researchers at Google, DeepMind, ETH Zurich, and Berkeley published a paper that should have gotten more attention. They prompted ChatGPT with a simple instruction: repeat the word “poem” forever. When they ran this thousands of times, the model eventually broke out of the loop and started producing something else — chunks of training data. Real email addresses. Phone numbers. Names. Verbatim passages from personal websites. The paper, “Extracting Training Data from ChatGPT,” was written by Nicholas Carlini and colleagues. It showed that ChatGPT had memorized personal information scraped from the public web and would reproduce it under the right conditions. The data had not been submitted to OpenAI by users. It had been scraped from websites where people had posted it, in some cases years before ChatGPT existed, and ended up encoded in the model’s weights. This is the part of the AI privacy story that gets the least attention. Most privacy coverage focuses on what happens when you use an AI product: what ChatGPT does with your prompts, what Google keeps from your Gemini sessions, whether Meta reads your WhatsApp messages. Those are real concerns. But the training-data pipeline is a separate and largely invisible operation. It collected your data long before you ever typed a single prompt. The short answer: AI companies build training sets three ways. They scrape the public web (mostly through Common Crawl), license bulk content from platforms like Reddit and publishers like News Corp, and pay contractors to label the results. If you posted anything public before roughly 2023, some of it is probably in a training set. You cannot pull it back out of models already trained. You can reduce future collection: block AI crawlers on sites you own, use the opt-out controls that exist, and lock down public social accounts. Jump to a section: The infrastructure behind the training data</a></li> The robots.txt problem</a></li> Social media: your posts as a licensed product</a></li> Licensing deals with publishers</a></li> The annotation pipeline: humans in the loop</a></li> What is in there that shouldn’t be</a></li> What you can do</a></li> </ul> The infrastructure behind the training data</h2> Every large language model — GPT-4, Gemini, Claude, Llama, Mistral — was trained on text. Enormous quantities of it. The GPT-3 model from 2020 used roughly 45 terabytes of compressed text data. Models since then have used more. That text had to come from somewhere. Where it came from, in most cases, is the web. The foundation for almost all of it is Common Crawl: a nonprofit organization that has been crawling the public web continuously since 2008. Common Crawl downloads and archives web pages — every page it can find — and releases those archives as open datasets. Its petabyte-scale archives cover hundreds of billions of web pages. It is not primarily an AI organization. It is a library. But because the library is open and free, essentially every major AI company has trained on its contents. What’s in Common Crawl? Everything that was on the public web: news articles, blog posts, product reviews, forum discussions, academic papers, personal websites, comment sections, and public social media posts. Did you write something on a public page before roughly 2023? A blog entry, a Stack Overflow answer, a Reddit post, a comment on a news article? There is a good chance it is in Common Crawl’s archives. From this raw material, researchers built training datasets. C4 (Colossal Clean Crawled Corpus) trained Google’s T5 and related models. WebText was a filtered Common Crawl subset used in early GPT models. The Pile was an 800-gigabyte dataset assembled by EleutherAI, combining Common Crawl with content from PubMed, GitHub, books, and elsewhere. Researchers who studied The Pile documented exactly what it contains: personal data, medical discussion forum posts, legal documents, and verbatim writing from personal blogs. LAION-400M (later scaled to LAION-5B) followed the same model but for images: 400 million image-text pairs scraped from the web, used to train Stable Diffusion and many models that followed. A 2023 audit by the Stanford Internet Observatory found that LAION-5B contained child sexual abuse material — real images of real children. The dataset was temporarily taken offline. The models trained on the original version were not retrained. The robots.txt problem</h2> The web has a standard mechanism for telling automated crawlers not to collect certain pages: a file called robots.txt</code> that sits at the root of a domain. Crawlers that respect it will read the file and skip whatever it says to skip. For decades, this worked reasonably well with search engine bots. AI companies have had an inconsistent relationship with this convention. In 2023, Perplexity AI was documented by Wired and independent researchers as systematically ignoring robots.txt</code> directives on sites that had explicitly blocked its crawler. The company disputed some of the findings, but the pattern was documented with technical evidence. Sites that believed they had opted out of crawling were being crawled anyway. Google updated its crawling practices in 2023 to clarify that Google-Extended, its AI training crawler, would respect robots.txt. But this came after the fact. It followed years of crawling under policies that did not treat AI training as a separate use case. Whether a page crawled in 2019 for “search indexing” can be repurposed for AI model training is a question robots.txt was never designed to answer. The underlying problem is that robots.txt operates on an honor system. There is no technical enforcement mechanism. Common Crawl was built between 2008 and 2020. It collected pages from websites that were not thinking about AI training at all, because large language models did not yet exist as a commercial product. The data was collected, and it is in the archives now. Social media: your posts as a licensed product</h2> The web scraping pipeline operates at scale but at arm’s length — AI companies often train on Common Crawl derivatives rather than crawling sites directly. The social media data story is more direct. Reddit struck a deal with Google in early 2024 worth approximately $60 million per year to license its content for AI training. Around the same time, Reddit disclosed a licensing arrangement with OpenAI. Reddit’s entire archive — decades of forum discussions across every subreddit — now has an explicit commercial relationship with major AI companies. Crucially, this includes posts that users deleted before the licensing deal was struck. At the time of scraping, those posts existed. They were included. Deleting something after the fact doesn’t remove it from a dataset that was already copied. The Reddit deal triggered significant user backlash and contributed to the protests over API pricing changes that shut down thousands of subreddits for two days in mid-2023. The licensing revenue, however, was not shared with the users who generated the content. Twitter/X presents a different version of the same problem. Before Elon Musk imposed strict API rate limits in 2023, third-party scraping of public tweet data was routine. Researchers, advertisers, and AI companies all collected it. Musk himself stated publicly that xAI, his AI company, uses X posts to train Grok. If you have ever posted publicly on Twitter under your real name, your posts are in AI training data. Meta (Facebook and Instagram) has been more explicit than most. In June 2024, Meta notified users globally that it intended to use public posts, photos, and captions from Facebook and Instagram to train its AI models. EU and UK users were given the right to object under GDPR and UK GDPR. Meta paused the European rollout after the Irish Data Protection Commission intervened. In most of the rest of the world, including the United States and India, no opt-out was offered. The default was participation. LinkedIn rolled out a “Data for Generative AI Improvement” setting for US members in September 2024, switched on by default. Critically, LinkedIn made turning it off an active step. If you did not go to Settings > Data Privacy > Data for Generative AI Improvement and toggle it off, you were in. 404 Media reported that LinkedIn began using the data before it even updated its terms. Most users did not know to look. Licensing deals: the content you consume is in the data too</h2> Beyond scraping, AI companies have entered into licensing agreements with major content providers. The content you read is now part of what the models learned. News Corp struck a deal with OpenAI in 2024. It covered publications including the Wall Street Journal, the New York Post, and newspapers across Australia and the UK. The deal was reported to be worth approximately $250 million. The Associated Press reached a licensing agreement with OpenAI in 2023. The Financial Times agreed to a licensing deal with OpenAI in 2024. When you read an article on these platforms, the text of that article is now, with the publisher’s consent, in OpenAI’s training pipeline. On the image side, Shutterstock signed a deal with OpenAI to contribute its image library to DALL-E training. Shutterstock created a fund to compensate contributing photographers, though how that compensation is calculated and how much any individual photographer receives has been opaque. The licensing deals matter because they draw a line between consented and unconsented use. But they draw it at the publisher level, not at the level of the individual writer, photographer, or journalist. A reporter whose stories are now in an AI training set, because their employer signed a licensing agreement, was never asked. A freelancer who licensed images to Shutterstock agreed to Shutterstock’s terms, not to their photographs training AI. The publishers who have not agreed to licensing are doing something else: suing. The New York Times filed suit against OpenAI and Microsoft in December 2023, alleging copyright infringement from the use of Times content in training. The case centers on whether training a model on copyrighted material without a license constitutes infringement. The outcome will shape how the industry operates. The annotation pipeline: the humans in the loop</h2> Model training doesn’t end with scraping and ingestion. After a model is pretrained on web text, it gets fine-tuned using a process called Reinforcement Learning from Human Feedback, or RLHF. This is what makes a model that predicts text statistically behave more like a useful assistant. RLHF works like this: human raters look at pairs of model outputs and pick which one is better. Their judgments become training signal. The model is updated to produce outputs that humans prefer. Over thousands of iterations, this process shapes the model’s behavior substantially. Who are these human raters? In most cases, contractors hired through companies like Scale AI and Surge AI, often working in low-income countries. A 2023 Time magazine investigation found that OpenAI’s contractors in Kenya were paid roughly $2 per hour to review and label content. That content included extremely graphic violent and sexual material, which OpenAI provided so the model could learn to refuse harmful requests. Some of those workers reported psychological harm from repeated exposure to disturbing content. The annotation pipeline is also where your feedback goes. When you give ChatGPT a thumbs-up or thumbs-down, when you click “regenerate” or edit a response and resubmit, that interaction becomes training data. The interface you use to communicate what you like and don’t like is also the interface that improves the model based on your revealed preferences. What’s in there that shouldn’t be</h2> Beyond the Carlini extraction paper, researchers have documented specific categories of sensitive data that ended up in training datasets. The Pile, studied by researchers at various institutions, was found to contain personal identifying information: full names paired with email addresses and phone numbers from scraped sources. Forum posts from medical discussion sites — people describing symptoms, diagnoses, and treatments, often using their real names or screen names consistent with other accounts — appear in the dataset. C4, studied by Allen Institute researchers, was shown to contain content from questionable sources. Because it filters Common Crawl using a list of “quality” sites, it has also been shown to contain social media content from platforms whose content was linked to from news sites. Training datasets at the scale of Common Crawl derivatives cannot be fully audited. They are too large. The people who built them often don’t know exactly what’s in them. The LAION-5B CSAM finding was not discovered during dataset construction. Researchers found it years later, after building a tool to scan for perceptual hashes of known abuse material. By then the dataset had already trained models that were already deployed. What you can do</h2> The pipeline described above was largely built before most users had any awareness of it. The practical options are limited but real. If you run a website: Adding AI-specific crawler blocks to your robots.txt</code> is now a meaningful action. The standard has evolved since the original robots.txt convention. Dark Visitors (darkvisitors.com) maintains an up-to-date list of known AI crawler user-agent strings with ready-to-paste robots.txt blocks. At minimum, adding User-agent: GPTBot</code> and User-agent: Google-Extended</code> with Disallow: /</code> blocks OpenAI and Google’s dedicated AI training crawlers. This doesn’t retroactively remove content already scraped, but it stops future collection. For LAION data: LAION operates a removal form at laion.ai/dataset-requests. If your personal images or identifying information are in the LAION datasets, you can request removal. Removal from the dataset does not retrain models already trained on that version, but it reduces future exposure. GDPR Article 21 objections: If you are in the EU or UK, GDPR Article 21 gives you the right to object to processing based on legitimate interests. That is the legal basis many AI companies claim for training. Several companies have responded to formal objections in the EU with data suppression or deletion. OpenAI has a privacy request form at privacy.openai.com. Meta’s European privacy request process is documented in its EU privacy center. These rights are not automatic in practice. If a company does not respond, you may need to file a complaint with a supervisory authority. But they exist. CCPA deletion rights: If you are in California, the CCPA lets you request deletion of personal data a company holds and opt out of its sale or sharing. The deletion right applies to data the company collected directly. Its reach into training data is contested. Whether a model “holds” your data is an active legal question. Still, filing a CCPA deletion request creates a record and forces the company to respond. Platform opt-outs: Several companies let you turn off training on your data. LinkedIn’s toggle sits under Settings > Data Privacy > Data for Generative AI Improvement. In the EU and UK, you can object to Meta AI training in Account Center. For the full company-by-company list of settings — OpenAI, Google, Meta, Adobe, LinkedIn, and more — see our guide to opting out of AI training</a>. For everyone: The honest assessment: if you have been active on the public web since 2010, some of your writing is almost certainly in a training dataset somewhere. That includes anyone who posted on forums, maintained a blog, or used social media with a public account. The scale of what was collected, and the speed of it, outpaced any legal or regulatory framework designed to address it. What is changing is the legal landscape. The New York Times lawsuit is not settled. Italian regulators banned ChatGPT in 2023 before resuming access with conditions. The EU AI Act, which came into force in 2024, includes transparency requirements for the operators of general-purpose AI models, including summary disclosures about training data sources. That won’t unwind what’s already in the models. It will, at minimum, make future collection harder to conduct without documentation. The reasonable thing to do now is reduce future exposure. Lock down public social media accounts. Use the opt-out controls that exist. Block AI crawlers from any site you control. These steps do not fully solve the problem. But the collection is ongoing. The datasets being assembled today will train the models of 2028. The window to affect that is now, not after the fact. What you can do right now</h2> Want to see what data brokers expose about you? See what a scan finds →</a> shows an example report: the kinds of sites that list your name, phone, and address. Once KnytX Shield launches it will find and remove these automatically. Join the waitlist</a> to get in early. What CCPA Actually Gives You — and What It Doesn't Unknown — Thu, 02 Apr 2026 00:00:00 +0000 A California bill signed in 2018 gave you the right to demand a company delete your personal data. That was a first in the United States. But before you start sending CCPA data deletion requests to every app you have ever used, you need to understand what the law actually covers. It has real limits, and most summaries gloss over them. The short answer: CCPA gives California residents four core rights. You can know what data a business holds, delete it, opt out of its sale, and not be penalised for using these rights. CPRA (2020) added correction and limits on sensitive data. But CCPA only applies to larger businesses and data-heavy ones, and it carves out data covered by HIPAA, GLBA, and FCRA. So it is powerful, but narrower than it sounds. What is CCPA, and who does it cover?</h2> The California Consumer Privacy Act went into effect in 2020. It applies to for-profit businesses that collect California residents’ personal information and meet at least one of these thresholds: Annual gross revenue above $25 million</li> Buy, sell, or share the personal information of 100,000 or more consumers or households per year</li> Derive 50% or more of annual revenue from selling consumers’ personal information</li> </ol> That third criterion catches most data brokers. But the first two immediately exclude the overwhelming majority of small apps, local businesses, and websites. The newsletter platform a startup uses? Almost certainly below the threshold. Your neighborhood dentist? Not covered. This is not a bug in the law — it’s a deliberate policy tradeoff. But it means “California privacy rights” sound broader than they are in practice. Your four core rights</h2> If a business is covered by CCPA, you have four rights: Right to know — you can request what personal information a business has collected about you, where it came from, why it’s being used, and who it’s been shared with.</li> Right to delete — you can ask them to delete your data, and they must comply (with some exceptions).</li> Right to opt out of sale — if a business sells your data, you can tell them to stop. They must honor this within 15 business days.</li> Right to non-discrimination — a business can’t charge you more, give you worse service, or deny you access because you exercised your privacy rights.</li> </ol> CPRA (2020 update) added two more rights. The right to correct inaccurate information. And the right to limit use of sensitive personal information, such as Social Security numbers, precise geolocation, racial or ethnic origin, and the contents of your messages. How to send a CCPA deletion request</h2> Most covered businesses are required to include a “Do Not Sell or Share My Personal Information” link in their website footer. Start there. For a deletion request specifically: Find the company’s privacy page or privacy request portal (search “[company name] CCPA request” or “[company name] privacy rights”)</li> Submit a request identifying yourself — expect to verify your identity, typically by confirming an email address or answering security questions</li> The company has 45 days to respond, with one possible 45-day extension if they notify you</li> </ol> A valid response either confirms deletion or explains which legal exemption applies. If they don’t respond at all, that’s a violation you can report to the California Privacy Protection Agency (cppa.ca.gov). Save confirmation emails. If a company restores deleted data without a valid legal reason, that’s actionable. What does CCPA not cover?</h2> This is where most summaries stop being useful. CCPA has significant carve-outs: Medical information covered by HIPAA — your health records, insurance claims, and prescription data fall under federal medical privacy law, not CCPA</li> Financial information covered by GLBA — bank and credit union data is regulated by federal banking law</li> Credit report data covered by FCRA — your credit file at Equifax, Experian, and TransUnion operates under the Fair Credit Reporting Act, which has its own dispute process</li> Employment records — data collected in the employment context has limited protections under CCPA (CPRA expanded this somewhat, but it’s still narrower than consumer rights)</li> </ul> Then there is the thorny problem of large data brokers. LexisNexis</a> and Acxiom</a> deal heavily in data covered by other federal laws (FCRA, DPPA). That gives them partial exemptions from CCPA’s deletion requirements. You can still opt out of certain uses, but you may not be able to get everything deleted. CCPA vs CPRA: what’s actually different now</h2> Proposition 24 passed in November 2020 and took effect January 1, 2023. It created the California Privacy Protection Agency — an independent enforcement body with real investigative authority and a dedicated budget. Before that, enforcement fell to the California Attorney General’s office, which was understaffed and slow. CPRA matters because enforcement now happens. The CPPA has opened investigations, issued fines, and made clear it will pursue companies that ignore opt-out requests. The law didn’t change dramatically, but the enforcement mechanism improved substantially. The practical additions are twofold. CPRA gives you the right to correct your data, not just delete it. And it limits what companies can do with sensitive personal information, even if they do not “sell” it in the technical legal sense. The definition of “sharing” was also expanded to cover cross-context behavioral advertising, which is how ad networks track you. States with similar laws</h2> California privacy rights aren’t unique anymore. As of 2026, more than 20 US states have enacted consumer data privacy legislation. The most significant: Virginia — Consumer Data Protection Act (CDPA), effective 2023</li> Colorado — Colorado Privacy Act (CPA), effective 2023</li> Texas — Texas Data Privacy and Security Act (TDPSA), effective 2024</li> Connecticut, Montana, Iowa, Indiana — all have active laws with varying scopes</li> </ul> Most of these follow a similar structure to CCPA: rights to access, delete, and opt out of sale or targeted advertising. The thresholds differ. Some cover businesses processing 25,000 consumers’ data; others set higher bars. If you’re not in California, search “[your state] consumer data privacy law” — the odds are decent your state has something, even if it’s newer and enforcement is lighter. What you can do right now</h2> Want to see what data brokers expose about you? See what a scan finds →</a> shows an example report: the kinds of sites that list your name, phone, and address. Once KnytX Shield launches it will find and remove these automatically. Join the waitlist</a> to get in early. QR Code Scams (Quishing): How Fake Codes Steal Data Unknown — Wed, 01 Apr 2026 00:00:00 +0000 The parking meter in the garage on Fifth Avenue looked entirely normal. The QR code sticker was neatly placed, the signage around it was professional, and the instructions made sense: “Scan to pay.” He scanned it. His phone opened a page that looked exactly like PayPal — same layout, same blue, same font. He entered his card number, his expiration date, his CVV. The page thanked him for paying and redirected him to a blank screen. His car got a ticket two hours later. The meter had never been connected to his payment. By the time he noticed unauthorized charges on his card the following morning, the card details had already been sold twice on a Telegram channel that trades in fresh dumps. The original QR code on that meter had been covered with a sticker. The sticker was placed there sometime the previous night. It took about thirty seconds. This is quishing — QR code phishing — and it has moved far beyond parking garages. It lands in your email inbox as a Microsoft account verification request. It sits on the table at a restaurant next to the salt shaker. It arrives as a text message about a missed package delivery. The QR code looks legitimate. It might be sitting right next to something legitimate. And your phone almost certainly won’t warn you before it opens the page. The short answer. Quishing is phishing that hides the malicious link inside a QR code. It works because email filters read text, not the pixels in an image, so a QR code slips straight past them. Check Point logged a 587% surge in these attacks in 2023. Once you scan, your phone opens a fake login or payment page that steals your credentials or card details. Before you scan, check the source: don’t scan a code on a sticker, an unexpected email, or a random text. After you scan, read the full URL before typing anything, and never enter a password or card number on a page you reached only by scanning a code. What a QR Code Actually Is — and Why That Matters</h2> A QR code (Quick Response code) is nothing more than a machine-readable encoding of a string of text. In practice, that text is almost always a URL. When your phone’s camera reads the black-and-white pattern of squares, it decodes the URL and, in most cases, opens it immediately in your browser. There is no preview by default on most devices. There is no warning. You scan, you click, you’re there. The encoding itself has no built-in verification. A QR code doesn’t know whether the URL it contains leads to your bank or to a server in a data center registered yesterday under a name designed to look like your bank. The code is just a picture of a string. That’s all it has ever been. Attackers figured out a specific structural advantage in this: your email security software does not read pictures the way it reads text. The Reason Quishing Exploded in Corporate Environments</h2> When a phishing email contains a link — say, https://microsofft-account-verify.com/login</code> — enterprise email security gateways like Proofpoint, Mimecast, and Microsoft Defender for Office 365 scan that URL. They check the domain’s reputation. They may follow the link to see what’s on the other side. They compare it against known threat intelligence databases. If the link looks malicious, the email is flagged, quarantined, or rewritten with a warning. A QR code embedded in an email is a .png</code> image. The link inside it — the actual malicious URL — is encoded in the pixel pattern. Email security tools in 2023 and into 2024 could not read those pixels. They saw an image attachment. They passed the email through. This is not a subtle vulnerability. Attackers identified it explicitly and built campaigns around it. By embedding a QR code in a phishing email instead of a hyperlink, they could reliably bypass corporate email security that had become extremely effective at catching traditional phishing links. The corporate email gateway — the tool your IT department pays thousands of dollars a month for — became irrelevant for any phishing email that used a QR code. The numbers reflect how quickly attackers exploited this. Check Point’s Harmony Email team recorded a 587% surge in quishing attacks between August and September 2023. Egress separately found that QR codes jumped from under 1% of phishing attacks in 2021 to around 12% by 2023. That is not a gradual trend. It is a deliberate pivot by threat actors who recognized that QR codes offered a direct path around the security layer that had been closing off traditional phishing. Microsoft 365 Is the Primary Target — and Here’s Why</h2> In the vast majority of corporate quishing campaigns, the fake page at the end of the QR code is designed to harvest Microsoft 365 credentials. Not Google accounts. Not bank logins. Microsoft 365 first. This is rational targeting. A single Microsoft 365 username and password gives an attacker access to your Outlook email, your OneDrive files, your SharePoint documents, and your Teams conversations. It often opens your organization’s VPN too, if that VPN uses Azure Active Directory for authentication. One credential. Everything. Microsoft 365 credentials also sell well. They’re valuable for direct exploitation and for business email compromise (BEC) fraud. In a BEC attack, criminals read your email for weeks to learn payment flows, then impersonate a vendor or executive to redirect a wire transfer. The FBI’s Internet Crime Complaint Center (IC3) reported over $2.77 billion in BEC losses in 2024, and compromised Microsoft 365 accounts are the most common entry point. For the full mechanics, see the guide to business email compromise</a>. The phishing page itself is usually a convincing replica of the Microsoft 365 sign-in portal. Attackers use stolen HTML and CSS, or purpose-built kits that are sold on dark web forums for a few hundred dollars. Some kits include real-time credential relay. When you type your password on the fake page, the attacker’s server immediately tries it on the real Microsoft login. It even passes through your multi-factor authentication prompt, relaying it to you in real time. You enter your MFA code on the fake page. The attacker uses it on the real one. This is called an adversary-in-the-middle (AiTM) attack, and MFA does not stop it. How Attackers Host the Fake Page — and Why It’s Hard to Detect</h2> If you saw a URL like https://microsoftlogin-verify.attacker.net</code>, you’d probably hesitate. Attackers know this. The techniques they use to host and obscure the destination have become increasingly sophisticated. Redirector chains. The QR code doesn’t link directly to the phishing page. It links to a first-stage redirector — often a legitimate URL shortener or a compromised website. That page redirects to a second-stage URL. Some campaigns use three or four hops before delivering the actual credential-harvesting page. Each hop makes automated detection harder, because the first URL in the chain may have a clean reputation. Legitimate hosting platforms. Attackers host phishing pages on Google Sites, GitHub Pages, Microsoft SharePoint, and Cloudflare Pages. These platforms have clean IP reputations. Security tools that block domains based on reputation won’t block sites.google.com</code> or sharepoint.com</code>. The phishing page is just content hosted on a trusted platform. Some phishing kits specifically target the SharePoint hosting trick because a Microsoft-branded phishing page hosted on Microsoft infrastructure looks exceptionally convincing. CAPTCHA gating. Many modern phishing pages are protected by a CAPTCHA challenge. This isn’t about verifying you’re human — it’s about preventing automated security scanners from reaching the phishing content. A security tool that follows a link to check its content sees only a CAPTCHA page and classifies the site as benign. You solve the CAPTCHA, and the phishing page loads. This is now standard practice in higher-quality phishing kits. Geo-fencing. Some campaigns only serve the phishing page to visitors from specific countries or regions. Automated scanners running from cloud infrastructure in data centers outside the target region see nothing suspicious. The FBI Warning About Parking Meter Attacks</h2> In January 2022, the FBI’s Internet Crime Complaint Center issued a public service announcement specifically about QR code fraud, with particular attention to physical QR code stickers placed on parking meters. The warning noted that criminals were placing malicious QR codes over legitimate ones to redirect payments to attacker-controlled sites, and that victims had no way to distinguish the fraudulent code from the original without physical inspection. The FBI warning was not hypothetical. Cities including Austin, Texas, San Antonio, and cities across the UK reported confirmed incidents of parking meter QR sticker fraud within months of one another in early 2022. The attacks followed a consistent pattern: stickers printed to match the look and feel of the legitimate meter signage, placed over the original QR code, linking to payment pages designed to capture card details. The same physical sticker technique has since been documented at restaurants (placed over table QR codes that link to menus), at EV charging stations, at airport luggage carousels, and on event signage. Any physical QR code that exists in public space is a potential target. The sticker takes seconds to place and may sit on a high-traffic location for days before anyone notices. The Four Campaign Types You’ll Actually Encounter</h2> Understanding how quishing works in practice means understanding the specific scenarios where you’re likely to encounter it. Physical sticker attacks are exactly what the FBI described. A fraudulent sticker is placed over a legitimate QR code in a public space. The sticker itself is often a professional-quality print — it doesn’t look like something made at home. The goal is payment credential theft. These attacks work because we’ve been conditioned to trust QR codes in commercial environments. The meter looks real. The restaurant table looks real. The code is a sticker over a sticker, and you can’t tell from arm’s length. Email quishing campaigns target corporate employees. The email looks like a routine Microsoft notification — “Your account requires re-verification,” or “Unusual sign-in activity was detected,” or “Your password expires in 3 days.” The body of the email contains a QR code instead of a link. The instruction says: “Scan the code with your phone camera to verify your account.” The reason for this instruction is explicit: the attacker wants you on your phone, which doesn’t have your company’s security software installed. Your corporate laptop might have endpoint detection, DNS filtering, and browser extensions that would flag the phishing domain. Your personal phone almost certainly doesn’t. Package delivery scams arrive by SMS or email. A message claims a package couldn’t be delivered — from FedEx, UPS, DHL, Royal Mail, India Post, or another carrier. The QR code supposedly lets you reschedule delivery. It leads to a page harvesting either your address and card details (ostensibly for a redelivery fee) or your carrier account credentials. Delivery scam volume spikes around major shopping periods — Black Friday, the holiday season, Diwali, Amazon Prime Day. Cryptocurrency bonus scams promise free tokens, trading bonuses, or exchange rewards in exchange for scanning a QR code. These redirect to wallet-draining smart contract approvals or seed phrase harvesting pages. The QR codes circulate on Twitter/X, Reddit, Telegram, and Discord. The Redirector Chain in Practice</h2> Walk through what actually happens when you scan a quishing QR code in a corporate phishing email. The QR code encodes a URL that looks like this: https://forms.office.com/something/randomstring</code>. That’s a real Microsoft domain. The email security gateway sees an image. The link encoded in the image leads to a Microsoft-controlled domain. Nothing is flagged. You scan the code. Your phone opens forms.office.com</code>. Microsoft Forms is a real product. Attackers have built a form that contains an embedded link disguised as a button: “Click here to verify.” That click takes you to a redirector page on a compromised WordPress blog in Eastern Europe. From there, you’re redirected to a Cloudflare Pages URL. From there, to the actual phishing page. It is a replica of the Microsoft 365 login that captures your credentials in real time and relays them to the attacker. At no point in this chain did a malicious-looking URL appear in an email. The email contained an image. The image encoded a Microsoft URL. The rest happened after you made the choice to scan. How to Inspect a QR Code Before Opening It</h2> This is the part that matters. Your phone’s camera decodes QR codes automatically, and in most cases opens the URL without giving you a chance to check it. But you have options. On iPhone (iOS 11 and later): When you point your camera at a QR code, a notification banner appears at the top of the screen. That banner shows you the URL before you tap it. Read the full URL in that banner. Do not tap yet. Check what’s there. On Android: The default behavior varies by manufacturer and Android version. Google Lens, which ships on most Android devices, shows a URL preview before opening it. If you’re using a dedicated QR scanner app, choose one that shows you the full URL before opening it rather than redirecting immediately. On both platforms: You can also use a dedicated QR code reader app like “QR & Barcode Scanner” by Gamma Play or similar tools that explicitly show the destination URL and wait for your confirmation before opening it. This adds one extra step and one extra chance to catch a fraudulent destination. How to Tell if a Physical QR Code Has Been Tampered With</h2> For QR codes on physical objects — parking meters, restaurant tables, event signage, charging stations — the inspection is tactile as much as visual. Run your finger across the code. If a sticker has been placed over the original, there will often be a raised edge you can feel. The original QR code is usually printed directly on the surface or is a flat, flush sticker. A fraudulent overlay has a second layer.</li> Look at the edges under light. At an angle, you can often see the edge of a sticker placed over another surface. The overlay may not sit perfectly flush.</li> Check for alignment. Fraudulent stickers are placed by hand and are sometimes slightly off-center relative to the signage around them. If the QR code looks like it’s slightly tilted or shifted within its designated box, that’s worth checking.</li> Look for print quality differences. The fraudulent sticker may have a different sheen, texture, or color tone than the surrounding signage. It may look slightly too glossy or slightly too matte.</li> Check for a URL printed alongside the code. Many legitimate QR codes on commercial signage have the destination URL printed in small text below or beside the code. If the printed URL and the scanned URL don’t match, stop.</li> </ol> If you’re at a parking meter and anything about the QR code looks off, use the meter’s keypad or phone number instead. For restaurant menus, ask the server for a physical menu or look up the restaurant’s menu directly on their website. Checking the URL After Scanning — What to Actually Look For</h2> Even if your phone shows you the URL before opening it, you need to know what a fraudulent domain looks like. Attackers rely on several techniques to make the URL appear trustworthy at a glance. Typosquatting. The domain is a misspelling of the legitimate one: pay-pa1.com</code> instead of paypal.com</code>, microsofit.com</code> instead of microsoft.com</code>, amazon-support.com</code> instead of amazon.com</code>. When you’re reading a URL quickly on a small phone screen, transposed letters and substituted numbers (1</code> for l</code>, 0</code> for O</code>) are easy to miss. Subdomain tricks. The URL is structured so the legitimate brand name appears at the start, making it look real: paypal.com.account-verify.net</code>. The actual domain here is account-verify.net</code>. Anything before the last two segments of the domain (before the final .com</code>, .net</code>, .org</code>) is a subdomain controlled by whoever registered account-verify.net</code>. paypal.com</code> appears in the URL but has nothing to do with PayPal. Legitimate platform hosting. As described above, the URL might genuinely be sites.google.com</code>, sharepoint.com</code>, or github.io</code>. A real domain doesn’t mean a safe destination. Lookalike Unicode characters. In internationalized domain names, visually identical Unicode characters can substitute for ASCII letters. аррlе.com</code> (using Cyrillic а</code> and р</code>) can look identical to apple.com</code> on screen. These attacks are rarer but documented. The rule: read the domain, not the subdomain. Find the last dot before the path, count back two segments, and verify that’s the organization you expect. account.microsoft.com/path</code> — the domain is microsoft.com</code>, that’s legitimate. microsoft.com.verify-account.net/path</code> — the domain is verify-account.net</code>, that’s not Microsoft. What Businesses Should Do</h2> If you manage security for an organization, quishing requires specific countermeasures beyond traditional email security. Most major email security vendors added QR code scanning capability in 2024 in response to the quishing surge. Microsoft Defender for Office 365, Proofpoint, and Abnormal Security all announced QR code detection features. Check whether your current version and configuration has this enabled — it is not always on by default. Beyond email scanning, the structural problem is that corporate phishing emails are designed to route employees to their personal phones. The answer isn’t just better email scanning; it’s ensuring that the devices employees use to scan QR codes have equivalent protection. Mobile Device Management (MDM) solutions can enforce DNS filtering and browser security on enrolled personal devices. Training matters here more than in most phishing scenarios, because the technical detection layer was genuinely absent for years. Employees who learned to hover over links to check URLs before clicking never developed an equivalent habit for QR codes, because QR codes didn’t used to be a phishing vector. That habit needs to be explicitly taught. Finally: any internal process that requires employees to scan a QR code in an email is a process worth redesigning. Legitimate internal systems should not require QR code scans for authentication. If your IT department sends verification emails, those emails should contain links — not QR codes — so that security tools can inspect them. A Pre-Scan Checklist</h2> Before you scan any QR code — on a parking meter, a table, a package, or in an email — run through these checks. Did you expect this QR code? If a QR code arrived in an email you weren’t expecting, or appeared in a context that doesn’t make sense, don’t scan it.</li> Inspect the physical code. Run your finger over it. Check the edges under light. Look for alignment issues or print quality differences suggesting a sticker over a sticker.</li> Preview the URL before tapping. On iPhone, read the banner. On Android, use a scanner app that shows URLs. Do not tap open automatically.</li> Read the actual domain. Find the last two segments before the first /</code> in the path. That’s the real domain. Is it the organization you expect?</li> Check for subdomain tricks. If a brand name appears early in the URL but the domain itself is different, it’s fraudulent.</li> Never enter payment or login credentials on a page reached via an unexpected QR code. If you need to pay for parking, use the meter’s physical controls or call the posted phone number. If you need to verify a Microsoft account, open your browser and navigate to microsoft.com directly.</li> If in doubt, use the official app. For banking, payments, and email, open the official app for that service rather than following any QR code.</li> </ol> The parking garage attacker spent thirty seconds placing a sticker. The fraudulent PayPal page looked exactly right. Nothing in the flow felt wrong until the next morning. The QR code was the entire attack surface — and the defense against it is simply slowing down for ten seconds before your phone loads whatever that picture is pointing at. KnytX Shield is built to scan data broker databases, submit removal requests on your behalf, and watch dark web sources for your exposed credentials. Once it launches, if your email or passwords from a previous breach are circulating in stealer logs or credential dump files, it’s designed to surface that before it becomes an account takeover. It isn’t live yet; join the waitlist</a> to get in early. Delete Yourself From the Internet: A Global Guide Unknown — Tue, 31 Mar 2026 00:00:00 +0000 She found out the way most people do: someone told her. Her neighbor’s husband — someone she’d never given her phone number to — had texted her out of nowhere. He knew her address too. She hadn’t posted either online. She thought she was careful. She wasn’t. What he had used was a people-search site. These services collect your name, address, phone, and relatives’ names from public records, voter rolls, and property databases. Then they sell access for $4.99 a month to anyone who wants it. No background check. No stated purpose. Just a search box. This is what “deleting yourself from the internet” is actually about. It’s not mainly about scrubbing embarrassing tweets, though that matters too. It’s about removing the infrastructure that lets strangers locate you, contact you, and build a picture of your life without your knowledge. The honest version of this guide is not “here’s how to disappear completely.” You can’t. But you can dramatically reduce what’s findable about you, by whom, and how quickly. This guide covers every major layer of your digital footprint, in order of impact. It’s direct about which layers you can fix and which you can only limit. The short answer. You can’t fully delete yourself, but you can shrink your footprint layer by layer. Start with the highest-impact one: data brokers and people-search sites like Spokeo</a>, Whitepages</a>, and BeenVerified</a>, plus upstream aggregators like Acxiom</a>. Then handle Google search results, old social accounts, and marketing databases. Public records, breach data, and AI-training datasets can only be limited, not erased. Removed listings reappear as source records refresh, so treat this as recurring maintenance. Jump to a section: Layer 1: What Google shows about you</a></li> Layer 2: Social media and old accounts</a></li> Layer 3: Data brokers</a></li> Layer 4: Public records</a></li> Layer 5: AI training datasets</a></li> Layer 6: Marketing and email databases</a></li> What cannot be deleted</a></li> The practical roadmap</a></li> Priority checklist</a></li> </ul> Why people do this</h2> The reasons vary, and the priority order matters. Safety-critical cases — domestic abuse survivors, stalking victims, people who’ve received threats — need to move fast on the highest-exposure items first. People-search sites and data brokers are the primary threat surface here, not Google’s index. A stalker doesn’t need your name to appear in a news article; they need your current address. Reputation management often follows something specific: a difficult breakup, an embarrassing incident from years ago, an old social media post surfacing at a bad time. These cases center on search engine visibility — what appears when an employer, date, or journalist searches your name. Proactive privacy is the quieter but increasingly common reason. People who’ve watched one too many data breach notifications arrive in their inbox, or who simply don’t want their income estimates and family tree accessible to strangers. Pre-employment sweeps are becoming standard among people who understand how hiring works. Knowing what an employer will find before they find it gives you time to do something about it. Layer 1: What Google shows about you</h2> Start with Google search. Open an incognito window, search your full name, and add the city you live in. What appears on the first page is what most people see when they look you up. That’s your baseline. A few common things you’ll find: Social media profiles — LinkedIn, Facebook, Instagram, Twitter/X. These appear because the platforms are public and indexed by design. People-search site listings — Spokeo, Whitepages, BeenVerified showing your address, phone, and relatives. These are served up because the sites want traffic, and Google happily indexes them. Old news articles, forum posts, or comment threads with your name. These often turn up from accounts-on-websites you’ve long forgotten. Professional profiles — your company’s team page, a conference speaker bio, a directory listing. Removing content from Google search</h3> Google will de-index — meaning remove from search results — certain categories of content upon request: Your home address, phone number, email address when appearing on non-authoritative sites</li> Intimate images published without your consent</li> Doxing content (personal information posted to facilitate harassment)</li> Minors’ data in some jurisdictions</li> </ul> Go to support.google.com/websearch/troubleshooter/9685456</code> for the removal request form. Be specific about the URLs. Google typically processes these within a few days to a few weeks. What this does not do: it removes the result from Google’s index, not the source page. The original site still has the content. Anyone using Bing, DuckDuckGo, or a direct URL still finds it. Google de-indexing is a visibility reduction, not a deletion. Bing has a similar removal request process at bing.com/webmaster/tools/contentremoval</code>. DuckDuckGo relies on Bing’s index for most results, so removing from Bing typically removes from DuckDuckGo as well. Layer 2: Social media and old accounts</h2> This layer is straightforward in principle and tedious in practice. For active platforms you use, review your privacy settings. Most major platforms default to more public than they need to be. On Facebook, your friends list, past posts, and tagged photos can each be restricted separately. On Instagram, switching to a private account hides your posts from non-followers but keeps your profile name searchable. LinkedIn lets you control whether your profile appears in public search results — it’s under Settings > Visibility > Profile visibility off LinkedIn. The harder problem is old accounts. Most people have profiles on five to fifteen platforms they no longer check: Tumblr, MySpace archives, old Reddit accounts, Flickr, forums from a decade ago. These persist and rank in search results precisely because the accounts are inactive and no one is managing them. Go through them methodically: Log in and delete the account entirely if the platform allows it (most do, buried in Settings > Account > Delete)</li> Where deletion isn’t offered, delete all content, change the name to something generic, remove the profile photo, and make the account as private as possible</li> For platforms where you’ve lost the login, use the password recovery flow first; if the email no longer exists, contact support with proof of identity</li> </ul> Account deletion on most major platforms takes 30 to 90 days to fully propagate through the platform’s systems and disappear from search engines. Don’t expect it to be instant. Tagged photos are a separate problem. Photos others have posted of you, at events or in group shots, persist even if you delete your own account. Your options here are narrow. Request deletion from the person who posted it. Or ask the platform to remove it under its policies. In GDPR jurisdictions, you can also file a deletion request with the platform directly. Layer 3: Data brokers</h2> This is the layer that matters most for practical privacy, and the one most people underestimate. There are roughly 4,000 data broker companies in the US alone. They collect your personal data from public records, retail purchase histories, loyalty programs, warranty cards, motor vehicle records, and dozens of other sources. Then they sell access to that profile to insurers, employers, advertisers, landlords, and anyone else willing to pay. The information in these profiles is detailed. It’s not just your name and address. It’s your estimated income, household composition, health-condition categories, political affiliation, buying habits, vehicle, and sometimes your daily movement patterns inferred from your phone. US data brokers</h3> The major people-facing sites each have opt-out forms: Spokeo</a>, BeenVerified</a>, Whitepages</a>, MyLife</a>, Intelius</a>, TruthFinder, Radaris</a>, and FastPeopleSearch</a>. The opt-out process is voluntary under federal law for most of them. California’s CCPA makes it somewhat enforceable if you’re a California resident. Each site has a slightly different process: submit your name and location, confirm via email, then wait 5 to 30 days. For the full walkthrough of each major people-search site’s opt-out URL and process, see our people-search sites removal guide</a>. For the upstream wholesale data aggregators — Acxiom, Oracle Data Cloud, Epsilon, LexisNexis — the opt-out process is different and less user-friendly. Our complete US data broker removal guide</a> covers both tiers. California’s DELETE Act (SB 362) covers all registered data brokers, roughly 500 in California’s registry. It requires them to honor deletion requests submitted through a single state portal called DROP. The portal opened to consumers on January 1, 2026, and registered brokers must start processing requests from August 1, 2026. If you’re a California resident, one filing reaches all those registered brokers at once. It doesn’t cover unregistered brokers or companies outside the registry. For the full mechanics, see how to file a DELETE Act request</a>. Timeline: Each broker typically processes opt-out requests within 30 to 45 days. Your information will reappear. Data brokers re-acquire records from new source data: updated voter rolls, new property transactions, fresh social media scrapes. Most privacy researchers recommend reviewing and re-submitting every 6 to 12 months. EU data brokers</h3> In the EU, you have a legal right — not a voluntary courtesy — to demand deletion under GDPR Article 17. Data brokers must comply within 30 days or provide a written legal basis for refusing. The right applies regardless of where the broker is headquartered, if they’re processing data about EU residents. The process is direct. Find the company’s Data Protection Officer contact, required by GDPR Article 37 for large-scale processors and published in their privacy policy. Send a formal Article 17 erasure request citing your name and the data you want deleted, and note the date. If they don’t comply within 30 days, that’s a reportable violation. The major EU brokers include Acxiom EU, Experian, Epsilon France, Bisnode, Creditreform, and country-specific directory sites like 118.nl and Das Telefonbuch. See our EU data broker removal guide</a> for specific DPO contact addresses and templates. India data brokers</h3> India’s Digital Personal Data Protection Act (DPDPA), passed in 2023, establishes a right to erasure. India notified the DPDP Rules and stood up the Data Protection Board in late 2025. But 2026 is a phased “soft enforcement” period, with the heaviest penalties for core obligations arriving by mid-2027. In practical terms, your erasure rights exist and the Board is live, but the formal mechanism to compel a non-compliant broker is still ramping up. What you can do now: send erasure requests to Indian data broker companies directly using the DPDPA’s erasure right as your basis. Many companies have designated grievance officers — distinct from the EU’s DPO model — whose contact details they’re required to publish. The practical process for Indian data brokers is covered in our DPDPA rights guide</a>. Removing yourself from Indian internet directories and aggregation services is its own challenge. The removing yourself from the Indian internet</a> guide goes deeper on country-specific sites. Layer 4: Public records</h2> This is where the honest part of this guide matters most. A large category of information about you is held in government databases — and government records are, by design, public. Your ability to remove this data is limited. Court records — civil suits, criminal cases, traffic violations, evictions — are public records in virtually every jurisdiction. They’re indexed. They appear in people-search profiles. They feed background check services. In the US, expungement seals or destroys the court’s record of certain criminal cases, but the laws vary enormously by state. Expungement also doesn’t automatically remove data that a private data broker collected beforehand. You’d need to submit a separate request to each broker, citing the expungement. Voter registration records are public in most US states. Some states (California, New York, Massachusetts) restrict access to party-affiliated groups or researchers. Others (Florida, Ohio, Michigan) make the full database available online. You cannot typically opt out of voter registration data while remaining a registered voter — the public nature of the record is a feature of election transparency. What you can sometimes do is apply for a confidential voter registration under your state’s address confidentiality program (ACP), if you qualify. Eligibility is typically limited to domestic abuse survivors, law enforcement, or public officials. Property records are public by design. Property ownership and sale prices are recorded in county assessor databases that are freely accessible. You cannot remove them. What you can do is reduce their utility. Many people-search sites will eventually remove or suppress your listing if you submit opt-out requests, even though they pull from public data. Business filings and licenses — if you’ve registered a business, obtained a professional license, or sat on a board, that’s in a state or federal database and is public. Layer 5: AI training datasets</h2> This is a newer layer, and the options are more limited than most coverage suggests. Say your photo, writing, or personal data appeared on a website that was included in an AI training dataset. That data may have been incorporated into a model’s weights. The model doesn’t store your data like a database — it encodes patterns from it. There’s no straightforward way to “delete” information from a trained model. What you can sometimes do is request removal from the dataset itself before training, or request that a company not use your data in future training. Stable Diffusion / Stability AI operates a removal request tool at haveibeentrained.com</code>, built on the LAION dataset. There you can search for your images and flag them for exclusion from future training runs. This removes your data from the next version of the dataset, not from models already trained on it. LAION (Large-scale Artificial Intelligence Open Network) also accepts removal requests through their contact form. LAION-5B was the primary dataset behind many open-source image models; if your images were scraped from the public web before 2022, they’re likely in it. For text-based AI models from OpenAI, Google, Meta, and Anthropic, your options are limited. You can opt out of your future interactions being used for training, covered in our AI training opt-out guide</a>. There’s no mechanism to retroactively remove your public writing from what these models were trained on. Layer 6: Marketing and email databases</h2> Marketing data is the least dangerous layer but the most pervasive nuisance. Your email and phone are almost certainly in hundreds of commercial databases used for direct marketing. CAN-SPAM (US): Any commercial email must include an unsubscribe link. Using it obligates the sender to remove you within 10 business days. The catch is that each sender is separate — unsubscribing from one doesn’t affect others. GDPR (EU) Article 21: You have the right to object to processing for direct marketing purposes. Unlike Article 17 erasure, the company can’t override an Article 21 objection with “legitimate interests” — once you object to direct marketing, they must stop. This includes profiling for marketing. Send a written objection, keep a record. The Wayback Machine (archive.org) archives web pages, including pages that may have contained your personal information years ago. The Wayback Machine honors robots.txt exclusions — if a site’s current robots.txt blocks archival, the Wayback Machine will typically remove archived versions of that site on request. For personal pages, you can submit a removal request at help.archive.org/help/change-my-privacy-settings-in-the-wayback-machine/</code>. This takes time and is not guaranteed for all archived content. What cannot be deleted</h2> Be clear on these. A guide that glosses over the limits wastes your time and creates false confidence. Published news articles about you will not be removed because you don’t like them. Google can de-index them, making them harder to find. But the article stays live on the publisher’s site, and any other search engine can still surface it. Journalists and publishers have their own First Amendment protections. Your options are narrow. You can request corrections if the article contains factual errors. In extreme cases involving old content, you can file a “right to be forgotten” de-listing request with Google under EU law. That right applies only in EU searches and is decided case by case. Breach databases once they’re in the wild are not retrievable. Say your email and password appeared in the Dropbox breach of 2012 or the LinkedIn breach of 2021. That data is now in circulation on dark web forums and in credential-stuffing lists. It cannot be recalled. HaveIBeenPwned deliberately retains breach notification data. It keeps not your password, but the fact that your account was in a breach. The service does this because it functions as a security tool for defenders. Your email cannot be removed from breach notifications, and this is a policy choice HIBP maintains intentionally. Data already sold to third parties creates a downstream problem GDPR only partially solves. When you send an Article 17 erasure request to a data controller, they’re legally required to inform downstream processors who’ve received your data. In practice, verification is nearly impossible. The controller deletes their copy; whether the buyer of their list also deletes it is difficult to audit. Your data may persist in derivative datasets for years. Inferred data is in a category of its own. Your actual income figure — if you disclosed it somewhere — is a record that can be deleted. Your estimated income, inferred from your zip code, vehicle registration, and purchasing patterns, is a derived computation. It’s not “your data” in the same way. You didn’t disclose it; it was calculated. Whether erasure requests cover inferred data is currently contested in several jurisdictions. Professional licensing and credentialing databases are run by state agencies and professional bodies. Your medical license, law license, securities registration, or contractor license is public record by design. It cannot be removed. The practical roadmap</h2> Given all of the above, here’s how to prioritize. The most common mistake is spending an hour getting your Facebook privacy settings right while doing nothing about Spokeo. People-search sites are the highest-exposure, highest-impact target — they’re what scammers, stalkers, and low-effort investigators actually use. Start there. Deletion services vs. manual removal is a real tradeoff. Services like DeleteMe, Privacy Bee, and Optery automate much of the broker opt-out process — submitting requests, monitoring for re-listing, and running periodic sweeps. They typically cost $100 to $200 a year. The value proposition is time, not completeness: no service covers all 4,000+ brokers. If you’re dealing with a safety-critical situation, get started on the highest-exposure sites yourself today while setting up a service for ongoing maintenance. Priority checklist</h2> Start here and work down. Each item is worth doing even if you stop before finishing the list. Highest priority — do these first Search your name in incognito mode to establish a baseline</li> Submit opt-outs to the top 10 people-search sites (Spokeo, BeenVerified, Whitepages, MyLife, Intelius, TruthFinder, Radaris, FastPeopleSearch, Peekyou, Instant Checkmate)</li> Submit opt-outs to upstream data aggregators (Acxiom, Oracle Data Cloud, Epsilon, LexisNexis)</li> If you’re a California resident, file through the DELETE Act (DROP) portal on the CPPA’s official site</li> If you’re an EU resident, send GDPR Article 17 erasure requests to EU brokers</li> </ul> High priority — do these within a week Audit your active social media privacy settings (Facebook, Instagram, LinkedIn, Twitter/X)</li> Find and delete or deactivate old social media accounts you no longer use</li> Request removal of your home address and phone from Google Search using their removal tool</li> Opt out of AI training data collection at OpenAI, Google, Meta (see our AI training opt-out guide</a>)</li> </ul> Medium priority — complete within a month Check Wayback Machine for archived personal pages; submit removal request if needed</li> Review employer and professional directory listings; contact HR or the listing owner for removal</li> Unsubscribe from marketing emails using CAN-SPAM process; for EU, send Article 21 objection to marketing lists</li> Check HaveIBeenPwned to understand your breach exposure; change passwords on affected accounts</li> </ul> Ongoing maintenance — set a reminder Re-check people-search sites every 6 months; re-submit opt-outs for any reappearances</li> Google yourself quarterly to catch new listings</li> Check for new data breaches involving your email on HaveIBeenPwned</li> </ul> The process isn’t fast and it isn’t permanent. Data re-aggregates. Brokers buy new source lists. Old accounts get re-scraped. What you’re building is not a clean slate — it’s a practice. The goal is to be a harder target than you are today, consistently, over time. That matters. Because most people never start. Cyber Fraud: 2026 Field Guide to Financial Crime Unknown — Mon, 30 Mar 2026 00:00:00 +0000 The short answer. Cyber fraud is not one crime. It is a dozen distinct industries, each with its own playbook, target profile, and recovery path. This guide covers every major category. Business Email Compromise, phishing, investment fraud and pig butchering, tech support scams, romance scams, synthetic identity fraud, account takeover, recovery scams, marketplace fraud, and deepfake-assisted fraud. For each, you get how it works, who it targets, and the single defense with the best payoff. The recovery section at the end covers how to report in the US, UK, and India. The FBI’s Internet Crime Complaint Center logged a record $16.6 billion in losses in 2024, across 859,532 complaints. That is a 33% jump from 2023. India’s I4C (Indian Cyber Crime Coordination Centre) reported ₹11,269 crore (about $1.35 billion) in fraud for FY2024. The agency itself estimates actual losses are several times higher, given the severe underreporting that marks cybercrime across South Asia. The UK’s Action Fraud received over 380,000 reports in 2023, with losses exceeding £2.3 billion. These figures represent only crimes that were reported. Only victims who knew they’d been defrauded. Only losses that could be quantified at the time of filing. The real numbers are larger. A victim of Business Email Compromise needs different immediate actions than a victim of pig butchering. A person who received a tech support call faces a different threat than someone whose bank account was taken over by a credential-stuffing attack. Knowing which type you’re dealing with is the first step to responding correctly, and to defending against it before it happens. Business Email Compromise</h2> Business Email Compromise targets organizations rather than individuals, but the damage lands on the people inside them. The attack convinces an employee to authorize a fraudulent wire transfer or redirect payroll. It uses an email that appears to come from a trusted source: the CEO, the CFO, a vendor, or an attorney handling a transaction. The sender address is either spoofed (made to look like the real address without controlling it) or a genuine compromise of the executive’s real account through phishing or credential theft. The most direct path to a BEC attack is LinkedIn. An attacker searches the target company and identifies the finance team. They find the CFO’s name and the accounts payable manager’s name, then infer the email format from a press release or team page. From there they build a wire transfer request that follows the real hierarchy. The request usually invokes urgency or confidentiality: a deal closing today, a legal matter that requires discretion. The social engineering is the attack. No malware is required. Toyota’s Belgian subsidiary, Toyota Boshoku Corporation, lost about €37 million in a single BEC transfer in 2019. An attacker impersonated a business partner and convinced financial officers to change the bank account on a pending payment. The FBI reported $2.77 billion in BEC losses across US victims in 2024. This category consistently ranks among the highest-dollar-loss cybercrime types in the IC3 report, year after year. The defense with the best payoff is a call-back policy. Any wire transfer request above a set threshold requires verbal confirmation with the requester over a phone number already on file. Pick a number that fits your organization, such as $5,000 or $10,000. Confirm it regardless of how convincing the email appears. This single control defeats most BEC attempts, because it cannot be bypassed through email alone. Phishing, Vishing, and Smishing</h2> Phishing is the baseline of online fraud. It is a fraudulent message that impersonates a trusted entity to harvest credentials, install malware, or direct you to a fraudulent payment. Today’s version has evolved a long way from the badly spelled Nigerian prince email. Adversary-in-the-middle (AiTM) phishing is the technique that renders standard multi-factor authentication ineffective. Tools like Evilginx sit as a transparent proxy between the victim and the real service. The victim enters their credentials and their one-time password. The proxy relays both to the real site in real time and logs the resulting session cookie. The attacker then uses that cookie to authenticate without the victim’s knowledge. The MFA code was entered successfully. It just went to the wrong party. This technique drove the 2022 “0ktapus” campaign, which breached Twilio and targeted over 130 organizations. That breach compromised Signal SMS verification data for about 1,900 users. Cloudflare, also targeted, blocked the attack entirely with hardware security keys. FIDO2 verified the real domain, while the phishing proxy could not. Voice phishing (vishing) exploits phone trust. Attackers impersonate bank fraud departments, IRS agents, or UIDAI officers. They walk victims through “securing” their account by reading back an OTP, transferring to a “secure” account, or installing remote access software. SMS phishing (smishing) has become the dominant consumer fraud vector in recent years. Think fake package-delivery texts from USPS, FedEx, India Post, or Royal Mail, carrying malicious links that harvest banking credentials or install Android malware. The only defense that reliably defeats AiTM phishing is a FIDO2 hardware security key, such as a YubiKey or Google Titan. These keys cryptographically verify the domain you’re authenticating to. If the site is a proxy rather than the real login page, the key refuses to sign. SMS-based 2FA and authenticator-app codes do not provide this protection. Treat them as a usability improvement over passwords, not a security guarantee. For financial accounts, Google accounts, and any service holding sensitive data, hardware keys are the right choice. Investment Fraud and Pig Butchering</h2> The FBI IC3 logged $6.57 billion in investment fraud losses in 2024, the single largest category by dollar loss. The dominant method driving that figure is pig butchering (sha zhu pan in Mandarin, “slaughter the pig”). It is a long-form relationship fraud that has industrialized in compound operations across Southeast Asia, primarily in Myanmar, Cambodia, and Laos. The structure is systematic. Contact begins through LinkedIn, Instagram, dating apps, or WhatsApp. The opening message often claims to be a wrong number or a business-networking mistake. Over weeks to months, the scammer builds a relationship, discusses investments, and eventually introduces a platform. The platform’s screen shows real-time prices. The victim deposits money and sees fabricated profits pile up. Small withdrawals are allowed early to build confidence. At the point of maximum investment, the victim tries to withdraw. The scammer has encouraged this with stories of their own large positions. The victim then discovers that taxes or fees of 20–30% must be paid before any withdrawal is released. Those taxes and fees are additional fraud. The platform is entirely fake, controlled by the scammer operation, and the money is gone. The US Department of Justice has prosecuted several pig butchering networks. A 2023 indictment alleged losses to US victims exceeding $80 million from a single operation. The victims include technically sophisticated people: engineers, doctors, finance professionals. The fraud targets emotional trust, not technical naivety. The defense: verify any investment platform against FINRA’s BrokerCheck (brokercheck.finra.org) and the SEC’s EDGAR database before transferring a dollar. Any platform not registered with a national securities regulator is operating illegally in a regulated jurisdiction. No legitimate platform imposes taxes or fees as a precondition of withdrawal. Real taxes on investment gains are reported to regulators and paid to governments, not to the platform itself. Tech Support Scams</h2> A browser window fills with a red warning. It claims your computer is infected, your files are at risk, and your IP address has been reported to Microsoft or the TRAI. A phone number is displayed. The instruction is to call immediately. Legitimate operating systems, antivirus software, and security services never display a phone number in an error or warning message. Windows Defender does not show a phone number. macOS security alerts do not show a phone number. TRAI does not send browser warnings. The popup is built with JavaScript or HTML. It can appear on any website, including through malicious advertising on legitimate sites. Callers in tech support scams walk the victim through granting remote desktop access. AnyDesk and TeamViewer are the most common tools, because they’re legitimate software that antivirus doesn’t flag. Once remote access is established, the attacker harvests browser-saved credentials, banking sessions, and stored documents. They sometimes install persistent tools that allow return access after the call ends. They may also stage a fake screen showing “your funds being transferred” to demand immediate payment for “cleaning” the malware. For the full breakdown, see the guide to tech support scams</a>. Microsoft receives millions of tech support scam complaints a year and has partnered with law enforcement on takedowns. In 2021, the FTC brought actions against multiple operations and secured over $30 million in judgments. The model persists anyway. It is cheap to run, hard to trace, and effective against any victim who doesn’t know the basic tell: no real software alert ever includes a call-back phone number. If you encounter one of these popups, close the browser. If it doesn’t close normally, force-quit it from Task Manager or Activity Monitor. Do not call the number. If you already called and granted remote access, disconnect from the internet immediately. Change your passwords from a separate device, and contact your bank to watch for unauthorized access. Romance Scams</h2> Romance fraud is mechanically distinct from pig butchering, though the two increasingly overlap. The classic romance scam does not involve a fake investment platform. The endpoint is a direct request for money, through wire transfer, gift cards, cryptocurrency, or money-transfer services. It follows a relationship of two to six months of online contact. The most common personas are military officers on overseas deployment, offshore oil-platform engineers, international surgeons with relief organizations, and UN or NATO officials on peacekeeping missions. Each persona explains why meetings are impossible. Each also explains why the person has access to compelling assets, such as equipment, salaries, or medical supplies, that could be “stranded” and require a financial intervention. The FBI IC3 recorded $734 million in romance fraud losses in 2022. Victims range across every demographic. The most consistent factor is recent social isolation from divorce, bereavement, or relocation, which creates genuine loneliness an attacker can exploit. The scam is not predicated on stupidity. It is predicated on loneliness and the human tendency to trust people we have emotional investment in. The primary detection technique is reverse image search. Scammers use stolen profile photos, often taken from the Instagram accounts of real models, soldiers, or professionals. Running a profile photo through Google Images or TinEye usually reveals the real source within seconds. A photo that returns results under a different name, country, or context is a definitive warning. One more rule of thumb. Anyone who claims romantic interest but never appears in unscripted live video, and never meets in person despite months of contact, and eventually asks for money is running a script. The size of the first request does not matter. Synthetic Identity Fraud</h2> Synthetic identity fraud does not immediately damage your existing credit, because it doesn’t use your identity. It uses only your national ID number, attached to a fabricated name and address. The dedicated post on synthetic identity fraud</a> covers the 12–24 month construction process, the bust-out mechanics, and why children’s identities are the primary target. The short version: the attack runs invisibly. The fraudulent credit file sits under a name you’ve never heard, and most credit-monitoring services scan by name rather than by SSN. The financial system loses an estimated $20 billion a year to synthetic identity fraud in the US alone. Detection requires SSN-level monitoring, not name-level monitoring. The primary defense is a credit freeze at all three bureaus. It prevents any new credit file from being opened using your SSN. For children, that means freezing their credit before they’re old enough to need it. The window between birth and first credit application is the entire period of exposure, which can run 18 years. Account Takeover</h2> Account Takeover (ATO) covers every method of authenticating as you on a service you legitimately use. The attack vectors divide roughly three ways. Credential-based uses stolen passwords from breaches or stealer-log markets. Session-based uses stolen browser cookies that bypass login entirely. Social engineering tricks you, or customer support, into giving access. The fastest-growing vector in recent years is the browser infostealer. This malware spreads through malicious advertising, cracked software, fake game mods, and YouTube-linked installer packages. It exfiltrates every saved password and active session cookie from the victim’s browser. Traditional credential stuffing requires finding a working password and beating login controls. Session cookie theft skips that: it authenticates straight to an already-logged-in session. The victim’s bank account can be reached without a password ever being entered. FinCEN flagged $25.9 billion in suspicious activity reports tied to account takeover in 2023. For a deeper walkthrough, see the guide to bank account takeover fraud</a>. Each vector has its own defense. Against credential-based ATO, a password manager that generates unique, long passwords for every site removes the reuse that credential stuffing depends on. Against session theft, use anti-malware that targets infostealers, avoid downloads from unofficial sources, and use hardware security keys that lock sessions to registered devices. Against social engineering, freeze your mobile account at your carrier to block unauthorized SIM swaps. On top of your account password, register a verbal passcode or PIN with the carrier. Recovery Scams</h2> Recovery scams target people who have already lost money to fraud, the most vulnerable population in the fraud ecosystem. The pitch arrives by phone, email, or social media ad. A “fraud recovery specialist,” a law firm that specializes in cryptocurrency recovery, or a government-affiliated “victim assistance” service claims it can recover the lost funds for an upfront fee. The fee ranges from a few hundred dollars to tens of thousands. The fee is the fraud. There is no recovery service. There is no recovered money. The attacker has either bought a list of prior fraud victims from a criminal marketplace, or is the operation that defrauded the victim in the first place. Either way, it is running a second round against the same person. The FTC has brought enforcement actions against multiple recovery scam operations. The FBI IC3’s annual report warns that online “cryptocurrency recovery services” are predominantly fraudulent. The tell: any legitimate attorney or forensic firm working on fraud recovery operates on contingency or charges verifiable court-filing fees. They do not demand large upfront fees before doing any work. For more, see the guide to recovery scams</a>. If you lost money to fraud, the legitimate path is to file with the FBI IC3 (ic3.gov), file with the FTC (reportfraud.ftc.gov), and contact your bank immediately. If the fraud involved crypto, consult a forensic blockchain analytics firm like Chainalysis or CipherTrace. Verify their credentials independently before paying anything. Marketplace and Rental Fraud</h2> On consumer marketplace platforms, fraud runs in both directions. This includes Facebook Marketplace, Craigslist, Gumtree, OLX, and rental listing sites. Buyers hit fake listings that collect a deposit or full payment and deliver nothing. Sellers hit fake payment confirmations. Fake rental listings are especially costly. A scammer posts photos of a real property, copied from a real listing or Google Street View. They set a below-market rent to create urgency. Then they ask for a security deposit and first month by wire or Venmo, before a “viewing” that never happens. The FBI IC3 logged over 11,000 rental fraud complaints in 2023, with $350 million in losses. The check: never pay a security deposit without a signed lease on letterhead, confirmed by a call to a phone number you sourced yourself, not the one in the listing. For sellers, the dominant pattern is fake payment screenshots. These are fabricated Venmo, Zelle, or bank-transfer confirmation images, convincing enough to make you hand over goods before you check your account. Zelle has become a significant fraud vector on Facebook Marketplace. Zelle transactions are not reversible once completed, and Facebook provides no buyer protection for Marketplace deals. The rule: verify funds in your own account before releasing any goods, and never trust a screenshot of a payment confirmation. Deepfake-Assisted Fraud</h2> In February 2024, a finance employee at a multinational company in Hong Kong was convinced to transfer HK$200 million, about $25 million USD. The employee did so after joining a video conference in which every other participant was a deepfake. They had initial doubts about the request. Then they saw what looked like the familiar faces of company executives on the call. Hong Kong police confirmed the case and the loss amount. That case showed deepfake fraud had moved from theoretical to operational at scale. It is no longer limited to low-quality face-swapped images. Real-time video deepfakes, built from publicly available footage of the target, can impersonate faces well enough to defeat a casual look. Voice cloning from as little as three seconds of audio has been commercially available since 2023. It now shows up in vishing calls impersonating family members and executives. For more, see the guides to deepfake video verification</a> and AI voice-cloning scams</a>. The defense is out-of-band verification. For any large or unusual financial transaction, confirm the request by calling back on a phone number already on file before you execute it. Do this no matter how convincing the person on the call appears. It is the same call-back policy that defeats BEC. The addition for deepfakes: agree on a shared code word or passphrase with family and close colleagues that is not in any public record. Use it to authenticate real-time requests when the stakes are high. How to report fraud and what recovery actually looks like</h2> United States. File with the FBI IC3 at ic3.gov. This opens federal investigations, and it’s required before federal law enforcement can act. File a parallel report with the FTC at reportfraud.ftc.gov. These reports feed enforcement actions and consumer-protection rulemaking. For bank-related issues, file with the CFPB at consumerfinance.gov/complaint. Report to your state attorney general if the fraud is regionally specific. United Kingdom. Report to Action Fraud at actionfraud.police.uk. Bank-related Authorised Push Payment (APP) fraud is where you were deceived into authorizing a transfer yourself. UK banks are subject to mandatory reimbursement rules under the Payment Systems Regulator framework. The rules took effect in October 2024 and cover losses up to £85,000. If your bank denies your APP fraud claim, escalate to the Financial Ombudsman Service. India. File at cybercrime.gov.in (the National Cyber Crime Reporting Portal) or call the 1930 helpline. Calls within the first hour of a fraud give the best chance of freezing the transaction before funds move offshore. File an FIR with your local police cyber crime cell. For bank-related fraud, the RBI’s Banking Ombudsman Scheme covers unauthorized transactions, and the mandatory reporting timeline is within three days of discovery. Recovery prospects vary sharply by payment method. Card transactions carry the strongest recovery mechanism through chargeback. Card-network rules allow reversal for fraudulent transactions, and disputes filed within 60 to 120 days usually succeed. Bank wire transfers are harder. Regulation E in the US covers unauthorized electronic transfers. But “authorized” transactions, where you were deceived into sending money yourself, are being contested in court, and banks vary in their willingness to reimburse. The UK’s mandatory APP reimbursement rules (effective October 2024) are a significant consumer-protection advance. Zelle, Venmo, and Cash App transactions are the most difficult. These platforms treat transactions you initiated as authorized regardless of fraud, and reversal rates stay low despite regulatory pressure. Cryptocurrency is almost never recovered without specialist forensic tracing firms. Even with tracing, recovery requires a jurisdiction with legal authority over the exchange and a receivable asset. That is rarely achievable quickly enough to matter. If you’ve been defrauded through any of these channels, report immediately, whether or not you believe recovery is possible. Reports feed intelligence that leads to enforcement actions. They create official records that some bank reimbursement processes require. In aggregate, they can also identify patterns that stop the same fraud operation from targeting someone else. KnytX Scam Shield screens incoming calls, links, and contacts against known fraud patterns →</a> It isn’t live yet; join the waitlist</a> to get in early. Indian Data Breach Index: Every Major Leak Explained Unknown — Sun, 29 Mar 2026 00:00:00 +0000 A Telegram bot handed out Aadhaar numbers, phone numbers, and vaccination details for hundreds of millions of Indians in 2023. You typed a name. It returned a person’s entire CoWIN record. No password. No verification. Just open access to some of the most sensitive government-held data in the country. That incident was not an outlier. It was the pattern. India has experienced some of the largest-scale data exposures globally. These breaches affected hundreds of millions of individuals, and most never triggered a meaningful response. This post documents every major breach and what was specifically exposed. It also covers how criminals used the data, and what you should do if your information was part of any of them. Bookmark this page. Return to it. The list will grow. The short answer: India has suffered some of the world’s largest data breaches. They range from the 2018 Aadhaar portal leak (1.1 billion records) to the 2024 Star Health breach (31 million). Criminals use this data for SIM swap fraud, KYC fraud, targeted phishing, and loan fraud. To check your exposure, search Have I Been Pwned and review your Aadhaar authentication history at resident.uidai.gov.in. If exposed, change reused passwords, enable app-based two-factor authentication, lock your Aadhaar biometric, and monitor your credit report. In this article: Why India’s data is so exposed</a></li> The major breaches: what was exposed</a></li> What criminals do with breached Indian data</a></li> How to check if your data was in a breach</a></li> What to do if your data was exposed</a></li> Why breaches keep happening in India</a></li> Frequently asked questions</a></li> </ul> Why is India’s data so exposed?</h2> India digitized at extraordinary speed. The JAM trinity is Jan Dhan bank accounts, Aadhaar biometric IDs, and Mobile connectivity. It linked over a billion people to digital financial services in under a decade. That was genuinely remarkable. The security infrastructure meant to protect all that data did not grow at the same pace. By 2024, India had more than 900 million internet users. Aadhaar was linked to bank accounts, mobile numbers, insurance policies, tax records, and vaccination databases. Every linkage created a new attack surface. Enforcement lagged badly. Before the Digital Personal Data Protection Act 2023 (DPDPA), India had no dedicated data protection law. Companies could lose your data, deny it, and face no real consequence. Some did exactly that. India generates more data than it can currently protect. That gap — between digitization speed and security maturity — is why this list exists. The major breaches — what was exposed</h2> These are the incidents that defined Indian data breach history. Dates, record counts, and exposed data types are sourced from security researchers, investigative journalism, and breach databases. Aadhaar (2018)</h3> Records exposed: 1.1 billion In January 2018, The Tribune reported that a journalist had purchased access to an Aadhaar data portal for ₹500. The portal was sold through anonymous WhatsApp groups. It let anyone search any Aadhaar number and retrieve the linked name, address, phone number, email address, and photo. The breach traced to an API vulnerability in the UIDAI (Unique Identification Authority of India) system. A separate exploit allowed the creation of unauthorized Aadhaar printouts through the same access. Effectively, the entire Aadhaar database was queryable by anyone willing to pay ₹500. UIDAI initially denied the breach. They later confirmed that an unauthorized access channel had existed. The full scope — who used it, for how long, what data was extracted — was never publicly disclosed. What criminals did with it: Aadhaar data became the backbone of KYC fraud. With a name, date of birth, Aadhaar number, and address, fraudsters could impersonate individuals to open bank accounts, apply for loans, and port mobile numbers. JustDial (2019)</h3> Records exposed: 100 million+ Security researcher Rajshekhar Rajaharia disclosed in April 2019 that JustDial’s API was returning unauthenticated user records. Any request to their API — the same one that powered their app — returned detailed personal profiles without requiring login credentials. The data included names, phone numbers, email addresses, gender, date of birth, profile photos, occupation, and in some cases payment method information. JustDial patched the vulnerability after disclosure, but the window of exposure had been open for years. One hundred million people’s contact details, sitting in an API with no authentication gate. That is not a software bug. That is a systems failure. BigBasket (2020)</h3> Records exposed: 20 million In October 2020, cybersecurity firm Cyble found a database containing 20 million BigBasket user records for sale on the dark web. The data included names, email addresses, phone numbers, hashed passwords, dates of birth, IP addresses, and home delivery addresses. BigBasket confirmed the breach in November 2020. The hashed passwords were bcrypt-encrypted, which provides some protection — but names, phone numbers, and addresses were in plaintext. Delivery addresses are particularly sensitive because they confirm physical location. MobiKwik (2021)</h3> Records exposed: 100 million users, 8.2 TB of data In March 2021, researchers discovered a 8.2 terabyte database on a dark web marketplace containing MobiKwik user data. The exposure included phone numbers, email addresses, hashed passwords, IP addresses, and GPS locations. Most seriously, it included KYC documents: scanned Aadhaar cards, PAN cards, and passport photos. MobiKwik denied the breach publicly and suggested the data came from user devices rather than their systems. The data appeared on the dark web regardless of the denial. Researchers were able to verify personal records by matching them against their own accounts. KYC document exposure is a different category of harm. Aadhaar scans and PAN cards handed to criminals give them everything needed to commit identity theft at scale. (MobiKwik denied the breach; the data was reported by independent security researchers but never confirmed by the company.) AIIMS Delhi (2022)</h3> Records exposed: estimated 40 million patient records In November 2022, the All India Institute of Medical Sciences in Delhi suffered a ransomware attack that took down hospital servers for roughly two weeks. Emergency patient care had to be managed manually. The attackers reportedly demanded ₹200 crore in cryptocurrency. AIIMS Delhi is not just any hospital. It treats senior government officials, ministers, and prominent public figures. The attackers understood that patient data from this institution had leverage beyond ordinary medical records. The Indian Computer Emergency Response Team (CERT-In) investigated but full details of what data was exfiltrated were not disclosed publicly. Medical records are among the most sensitive personal data — they can be used for blackmail, insurance fraud, and targeting high-value individuals. CoWIN (2023)</h3> Records exposed: unconfirmed, widely reported In June 2023, a Telegram bot began returning detailed CoWIN vaccination records in response to phone number queries. The records included Aadhaar numbers, dates of birth, vaccination status, and beneficiary details. The Indian government stated that the CoWIN data had not been breached directly. The bot was pulling from a previously compromised health worker database that had API access to CoWIN. That distinction mattered for the government’s statement. It did not matter for the people whose vaccination records and Aadhaar numbers were publicly accessible through a Telegram search. This is the breach that most clearly illustrated how data linkage creates cascading exposure. One compromised database became a key that opened another. Star Health Insurance (2024)</h3> Records exposed: alleged 31 million In October 2024, a threat actor operating under the name “xenZen” claimed to have obtained 31 million customer records from Star Health and Allied Insurance. The data reportedly included policyholder names, phone numbers, addresses, policy details, claims data, and medical records including diagnoses and treatment histories. The attacker claimed the data was obtained through a senior Star Health executive who sold access. Star Health filed a legal case and initially disputed the claims. Data samples were made available through Telegram bots before the bots were taken down via legal injunctions. Medical and insurance claims data is among the worst categories of exposure. It reveals health conditions, financial situations, and physical addresses simultaneously. What do criminals do with breached Indian data?</h2> Understanding the harm matters. Breach data does not just sit on a dark web server — it gets used, repeatedly, by multiple actors. SIM swap fraud is one of the most common outcomes. A fraudster calls your mobile operator with your Aadhaar number, name, and date of birth (all available from multiple breaches). They claim to have lost their SIM. The operator ports your number to a new SIM. The fraudster now receives your OTPs and can access your bank accounts, UPI wallets, and email. Phishing with breach data is more targeted than generic phishing. Instead of “Dear Customer,” you get a call or message that opens with your real details. It might say they’re calling about your Star Health policy number XXXXX. You assume the caller is legitimate because they know your policy number. They are not. They bought the data. KYC fraud exploits the MobiKwik and Aadhaar breach data specifically. With a scanned Aadhaar and PAN, fraudsters open bank accounts, apply for personal loans, and purchase SIM cards in your name. You find out when a debt collector calls about a loan you never took. Loan fraud has surged. Digital lending apps require minimal verification. Breach data provides everything needed to apply. Victims discover fraudulent loans when their credit scores drop or when lenders contact them for repayment. How to check if your data was in a breach</h2> Start with HaveIBeenPwned.com — enter your email address and it will show you every known breach where that email appeared. It covers BigBasket, JustDial, and dozens of other Indian companies whose data ended up in international breach databases. HaveIBeenPwned does not cover all Indian breaches. The CoWIN and Aadhaar incidents are not indexed there because the breach data was not submitted to their system. For those, you need to check your Aadhaar authentication history. Open mAadhaar or visit resident.uidai.gov.in and check your authentication history. This log shows every time your Aadhaar was used for authentication. Unknown entries are a red flag. For phone-number-based breaches (JustDial, CoWIN), watch for unsolicited calls that reference specific personal details. That could be a date of birth, an address, or a policy number. That specificity tells you the caller has breach data, not just a random dialing list. Breach data also feeds people-search sites</a> that resell your details. What to do if your data was exposed</h2> Act in this order. Change passwords immediately for any service named in a breach you were part of. Use a unique password for each service — a password manager makes this manageable. If you reused passwords across services, change all of them. Enable two-factor authentication (2FA) on your bank accounts, email, and UPI apps. Use an authenticator app rather than SMS-based OTP where possible — SIM swap fraud defeats SMS 2FA. Google Authenticator and Authy both work well. Monitor your credit report if your KYC documents or financial data was exposed. CIBIL, Experian, and CRIF all offer free credit reports. Look for accounts or enquiries you did not initiate. Register a complaint with CERT-In (cert-in.org.in) if you have evidence of identity fraud resulting from a breach. File an FIR with your local cyber crime cell. These steps create a paper trail that helps dispute fraudulent accounts. Lock your Aadhaar biometric if you are not actively using it. The UIDAI allows you to temporarily lock biometric authentication through mAadhaar. This prevents someone from using your fingerprint for authentication even if they have your Aadhaar number. Watch your bank statements and UPI transaction history weekly. Unauthorized transactions should be reported to your bank within 24 hours to maximize the chance of reversal under RBI guidelines. Why do breaches keep happening in India?</h2> The honest answer is that India’s legal framework created almost no incentive for companies to invest in security or disclose breaches. CERT-In’s 2022 directive mandated that companies report breaches within six hours. The directive exists. Enforcement is a different matter. MobiKwik denied their breach. Star Health disputed the scale of theirs. AIIMS Delhi’s full disclosure never materialized. The pattern is denial, deflection, and minimal disclosure — because the consequences of full transparency have historically been limited. The DPDPA 2023 changed the legal landscape. It requires data fiduciaries to notify affected individuals and the Data Protection Board of breaches. Penalties reach ₹250 crore. The DPDP Rules were notified in November 2025 and the Board was legally established. But as of mid-2026 the Board is still not fully operational, obligations phase in through 2026–2027, and no enforcement cases have yet been pursued. Security investment at Indian companies has not kept pace with the scale of data they handle. The BigBasket breach involved hashed passwords — at least they hashed them. The JustDial breach involved an unauthenticated API returning full user records — that is a basic security failure that should never reach production. The gap between digital ambition and security practice is where breaches happen. India is closing that gap, but slowly. Frequently asked questions</h2> What are the biggest data breaches in India? The 2018 Aadhaar portal leak (1.1 billion records), JustDial (2019, 100M+), MobiKwik (2021, 100M with KYC scans), AIIMS Delhi (2022), CoWIN (2023), and Star Health (2024, 31M with medical records) are the largest documented ones. How do I check if my data was leaked in India? Search your email at Have I Been Pwned, and review your Aadhaar authentication history at resident.uidai.gov.in or in the mAadhaar app. Watch for calls that quote your real personal details. What do criminals do with breached Indian data? SIM swap fraud, KYC fraud (opening accounts with your Aadhaar and PAN), targeted phishing that quotes real policy numbers, and instant-loan fraud. You often find out when a lender chases a loan you never took. Can I get compensation for a data breach in India? Not through the DPDPA yet, as the Data Protection Board isn’t fully operational as of mid-2026. Today you can use IT Act Section 43A or the consumer forum. See our India data breach compensation guide</a>. What you can do right now</h2> Want to see what data brokers expose about you? See what a scan finds →</a> shows an example report: the kinds of sites that list your name, phone, and address. Once KnytX Shield launches it will find and remove these automatically. Join the waitlist</a> to get in early. A Practical Counter-OSINT Guide to Your Footprint Unknown — Sat, 28 Mar 2026 00:00:00 +0000 In 2022, after Elon Musk’s acquisition of Twitter, former safety executive Yoel Roth was doxxed within days of leaving the company. His home address was compiled from public county property records. His employer was on LinkedIn. A photo of his home was sourced from Google Street View. The package was assembled and posted on Twitter and far-right forums, accompanied by specific threats. He had to temporarily leave his home. The information came from no hack, no breach, no technical intrusion. It was entirely public, gathered through tools any person with a laptop and a few hours could use. That case had a named victim and media coverage. The same process runs thousands of times a day against ordinary people: spear phishing targets, romance scam victims, SIM swap targets, and stalking victims. Most of them never hear the term OSINT. The short answer. Counter-OSINT means raising the cost of aggregating a complete profile on you from public data. Work through four layers. Government records: use voter suppression programs, hold property in a trust or LLC. Data-broker sites: opt out of Spokeo</a>, Whitepages</a>, BeenVerified</a>, and Intelius</a>. Social and professional profiles: lock down LinkedIn, prune old posts. Breach data: change reused passwords, add a hardware security key. The goal is not invisibility. It’s staying below the effort threshold most attackers will invest. Jump to a section: What OSINT means when applied to you</a></li> Why ordinary people face this</a></li> The four layers of public personal data</a></li> Counter-OSINT actions by layer</a></li> The metadata persistence problem</a></li> The employer threat surface</a></li> A quarterly maintenance schedule</a></li> </ul> What OSINT means when applied to you</h2> Open Source Intelligence, in its law-enforcement and intelligence-community origin, refers to information collected from publicly accessible sources rather than clandestine means. Applied to an individual, it means the profile anyone can build about you with nothing but a web browser and some patience. The sources include property records, court filings, voter registration, business registrations, and LinkedIn profiles. On top of that sit Whitepages</a>, Spokeo</a>, BeenVerified</a>, Intelius</a>, and roughly forty data broker sites. They aggregate all of it and make it searchable by name, phone number, and address. Attackers, stalkers, scammers, and spear phishers all begin with OSINT before they attempt any technical exploit. Your employer name, job title, and manager’s name are on LinkedIn. Your city and phone number are on Whitepages. Your home address is on the county assessor’s site. The combination — employer, title, manager, phone, home address — is enough to do real damage. An attacker can craft a convincing phishing email, socially engineer your bank, or compile a harassment dossier. No password has to be stolen. No system has to be hacked. The data was already there. Why ordinary people — not just executives — face this</h2> A common assumption is that OSINT-based targeting happens to celebrities, executives, journalists, and activists. This is wrong in practice. Spear phishing is targeted phishing designed to look like it came from someone you know. It requires exactly the information a LinkedIn profile provides: your employer, your title, your manager’s name, and your work email format. Say attackers know you work at Acme Corp in accounts payable and your manager is Sarah Chen. They can send you an email that appears to come from Sarah, requesting a wire transfer. Business Email Compromise fraud, which costs companies $2.9 billion per year according to the FBI, starts with this kind of public profile research on employees. Social engineering your bank requires several things. It needs your city, your approximate income bracket, and the name of a merchant you’ve transacted with. It also needs your account-linked email address and your full name. Data brokers provide the first three without any effort. The merchant name and email are typically extracted from breach data that sells for pennies per record on dark web markets. In a SIM swap attack, an attacker convinces your mobile carrier to transfer your phone number to a new SIM. These attacks typically require your name, billing address, and sometimes a recent account transaction. The billing address, again, is public property data or broker data. The carrier name is often inferable from your number’s area code and geographic location. Pig butchering operations are long-form investment fraud that has cost victims hundreds of millions of dollars. They use people-search sites to validate targets before making contact and to build personalised rapport scripts. Say a scammer learns from your LinkedIn that you recently moved to a new city, work in finance, and have a technology background. They can open a conversation that fits your actual life precisely enough to feel real. The common thread is that these attacks use public data to reduce friction and increase success rates. They target you not because you’re prominent but because you have a financial account, a phone number, and information visible online. The four layers of public personal data</h2> Understanding where your data lives is the prerequisite for doing anything about it. There are four distinct layers, each with different sources and different removal mechanisms. Layer 1: Government records. County property records typically include the owner’s name and mailing address and are searchable by owner name on most county assessor websites. Voter registration rolls in most US states include name, address, party affiliation, and voting history, and are published or sold to commercial buyers. Court filings — civil suits, divorces, evictions, small claims judgments — are public record in most jurisdictions. Business registrations, if you’ve ever filed an LLC or DBA, list a registered agent name and address that is publicly indexed. UCC filings appear when a business has secured loans. These records exist because government transparency is a legitimate public interest. The problem is that they have been absorbed by commercial data brokers who repackage them for anyone willing to pay a search fee. Layer 2: Data broker aggregation. Companies including Spokeo</a>, BeenVerified</a>, Intelius</a>, MyLife</a>, TruthFinder, FastPeopleSearch</a>, ZabaSearch, PeekYou, and PeopleFinder operate the same way. They purchase Layer 1 records, scrape social media profiles, buy purchase-history data from loyalty programs and consumer apps, and assemble searchable profiles. A Spokeo search for your name can return your current and former addresses, your relatives, your phone numbers, your approximate age, and associated email addresses. You never knowingly shared any of it with Spokeo. These services make their data searchable by name, phone number, and address. They charge for full reports. They sell access in bulk to background-check companies, marketers, and anyone else who pays. California’s registry alone lists roughly 500 registered data brokers. Layer 3: Social and professional networks. LinkedIn’s public employment data is one of the most valuable OSINT resources in existence. Your employer, your role, your years of tenure, your listed skills, and your location are all publicly indexed and searchable. So are your connections, from which a manager or colleague can often be inferred. Instagram location tags in old posts. Facebook group memberships that reveal your neighborhood, political views, religious affiliation, and social network. Twitter’s history of your location and travel. The calendar invites people share publicly for events. These are not data you gave to brokers. They are things you published yourself, often years ago. Often you gave no thought to who would eventually aggregate them. Layer 4: Breach and leak data. This is the version of your profile that lives in breach databases and stealer-log marketplaces. HaveIBeenPwned tracks over 14 billion breached accounts. Stealer logs go further, enriched with session cookies, browser-saved passwords, and form auto-fill data. Attackers cross-reference this layer against the first three. A breach record with your email address, old password, and the platform you used is the missing link. It connects your LinkedIn employment data to your data-broker home address to your financial account login. Layer 4 is what turns an OSINT profile into a live credential. Counter-OSINT actions by layer</h2> The goal is not invisibility. Most people cannot achieve invisibility — home ownership is on record, voter registration is often mandatory, LinkedIn is professionally necessary. The goal is to raise the cost of aggregating a complete profile. Raise it high enough, and you drop below the threshold of effort most attackers will invest. Government records offer more removal tools than most people know exist. In most US states, voter registration suppression programs let certain residents keep their address out of the commercial resale of voter-roll data. Eligible categories include domestic violence victims, judges, law enforcement officers, and, in some states, anyone who requests it. The address remains on the rolls (so you can still vote) but is not included in the data sold to brokers. Check your state Secretary of State or county elections office for the specific process. California’s Safe at Home program provides a substitute mailing address for qualifying residents. Those include domestic violence survivors, reproductive health workers, and election workers. The public record address is then not their home. Several other states have analogous programs. Home ownership poses the clearest challenge: your name and property address are in public record by default. The standard counter-measure is to hold property in a trust or LLC. When a property is recorded under an entity name rather than your personal name, the public record shows the entity — not you. Property records in most US counties are searchable by owner name, so this removes your personal name from that search result. It involves legal costs to establish the entity and transfer title, but for people with genuine threat exposure, it is the most effective option. A real estate attorney can advise on the specific mechanics in your jurisdiction. Court records present a narrower mitigation path. Under Federal Rule of Civil Procedure 5.2 (and Federal Rule of Appellate Procedure 25(a)(5) for appellate filings), parties can request redaction of certain personal identifiers from publicly accessible PACER documents. Those identifiers include Social Security numbers, dates of birth, financial account numbers, and home addresses. State courts vary significantly in their privacy protections; some allow post-filing redaction requests, others do not. If you have a court filing you’re concerned about, the clerk’s office can advise on available options. Data brokers are the layer where the most direct action is possible for ordinary people, and also the most frustrating. Every major people-search site has an opt-out process. Spokeo</a> requires submitting your listing URL and an email for confirmation. Whitepages</a> requires a removal form. BeenVerified</a> and Intelius</a> have their own processes, several of which make you submit personal information to remove personal information. That tradeoff is worth noting. FastPeopleSearch</a>, MyLife</a>, TruthFinder, PeopleFinder, and ZabaSearch all maintain separate opt-out pages. Full opt-out from the major sites takes 4 to 6 hours the first time. The fundamental problem with manual opt-outs is that they do not hold. Brokers refresh their databases quarterly from the same government records and commercial sources. Opt-out status expires on some platforms. New brokers keep entering the market; California’s registry listed roughly 500 registered data brokers as of mid-2026. This is why manual opt-outs are not a one-time fix. They are an ongoing maintenance task. California’s DELETE Act deletion portal (DROP) opened to consumers on January 1, 2026, letting you send one deletion request to every registered broker at once. Registered brokers must start processing those requests from August 1, 2026, which we cover in how to file a DELETE Act request</a>. Automated services handle both initial submissions and periodic re-submissions. That is what converts opt-outs from a treadmill into a managed state. DeleteMe ($129/year) and Privacy Bee do this today; KnytX Shield</a> is built to do the same once it launches. LinkedIn and professional profiles require specific configuration rather than removal, since most people need professional visibility. LinkedIn allows you to restrict who can see your connections list — which prevents OSINT researchers from mapping your professional network. You can configure who sees you when you view their profile (removing your name from their “who viewed this” list). Removing graduation years removes an age-inference vector. Consider whether your exact current employer needs to be on your public profile. A more general description may serve the same professional purpose with less spear phishing exposure. Remove any location tags or check-ins. Disable “Open to work” when not actively recruiting — it significantly increases profile scraping because it raises engagement signals. Conference speaker bios, company “Our Team” pages, and press releases are a related category. Finance employees, HR personnel, and executives are direct spear phishing targets. Their names, email addresses (or email format inference), and roles are often discoverable from a company’s own public materials. The email format firstname.lastname@company.com</code> disclosed on a team page is enough to fabricate an internal spoofed email. This is an organizational hygiene problem as much as an individual one. But you can still take individual steps. Request removal from team pages you don’t need to be on. Avoid listing your exact role in conference programs when you’re attending rather than speaking. Use role-generic email addresses on public-facing materials. Old social media is the layer most people underestimate. They think of it as things they chose to publish, not as an attack surface. A 2015 Instagram post with location metadata reveals your home neighborhood at that time. A Facebook group membership from 2018 reveals your political views. A forum post from 2012 under a username that also appears on your LinkedIn reveals your real name. These are all available to anyone patient enough to look. Instagram and Twitter/X allow downloading your full archive before deletion — do this first, then delete. For bulk deletion of old tweets, tools like Semiphemeral and Redact.dev filter by date, keyword, and engagement threshold. That lets you delete the long tail of inconsequential posts while keeping relevant ones. Facebook’s Activity Log under Settings allows bulk deletion by year. Tagged photos in other people’s posts require direct requests to those people or platform reports. Wayback Machine archives are permanent. Once a page is archived, the archive persists even after the original is deleted. So there’s no point in deleting things specifically to remove Wayback Machine records. The metadata persistence problem</h2> After you opt out, request removal, and delete posts, references to the deleted information continue to exist elsewhere. A LinkedIn recommendation written in 2014 that mentions your employer and city may outlive any deletion of your own posts. A forum post that quoted your old tweet may survive the tweet’s deletion. A cached Google result may persist for weeks after you’ve removed the source page. The metadata persistence problem is why the goal is not erasure — it is cost-raising. Every piece of information you remove forces an attacker to work harder. They have to find it, rely on older cached data that may be stale, or cross-reference from more obscure sources. The complete elimination of your digital footprint is not achievable for most people who use the internet for work and personal life. Reducing the richness and freshness of the profile that can be assembled from public sources is. The practical implication is that counter-OSINT is maintenance, not a one-time project. Allocate two hours per quarter. Search your full name in quotes on Google. Search your phone number. Search your home address. What’s currently indexing tells you where your current exposure is. Re-submit data broker opt-outs for any sites that have relisted you. Audit third-party app permissions on your Google, Apple, and Facebook accounts. Check account recovery settings on financial accounts. Phone numbers used for SMS 2FA appear in data brokers. If your recovery phone is the same number listed on Whitepages, an attacker who calls your carrier already has the address to match it. The employer threat surface</h2> One category of OSINT exposure is organizational rather than personal, but the consequences land on individuals. Corporate “Our Team” pages list employee names, roles, email addresses, and sometimes direct phone numbers. LinkedIn employee directories expose your entire department’s org structure to anyone who knows the company name. Conference speaker bios, press releases, and client-facing materials build a detailed picture. Together they show who handles financial transfers, who approves vendors, and who holds privileged access. Business Email Compromise attackers start with this public layer. They identify the CFO or VP of Finance and find the email format from a press release or team page. They confirm the manager chain from LinkedIn. Then they send a convincing wire-transfer request to someone junior enough to comply. The FBI reported $2.9 billion in verified BEC losses in 2023. Every attack started with information the organization published about itself. Individually, the available actions are limited but worthwhile. Request removal from team pages where your presence serves no business purpose. Use a functional email address on public materials rather than your personal work address. Avoid publishing specific financial-authority or system-access roles publicly. Organizationally, regular OSINT audits of the company’s own visible employee data should be part of the security program. What a quarterly maintenance schedule looks like</h2> Set a recurring two-hour calendar block, every three months. Run Google searches for your name in quotes, your phone number in quotes, and your home address in quotes. Record what’s currently indexed. Run the same searches on Bing — Google and Bing index different things. Check your top-level listings on Spokeo, Whitepages, and FastPeopleSearch — if any have relisted you after a prior opt-out, resubmit the removal. Check HaveIBeenPwned for any new breaches against your email addresses. If a new breach has added your email, change the password for that service and any service where you reused it. Enable a hardware security key on financial accounts if you haven’t already. It is the single most effective phishing defense. A FIDO2 key validates the actual domain, which defeats adversary-in-the-middle phishing proxies that can capture SMS and app-based OTP codes. Review third-party app connections on Google and Apple accounts — remove anything you no longer use. Review which apps have access to your contacts, location, and photos on your phone. Each granted permission is a data source feeding a broker network downstream. The goal of the quarterly session is not perfection. It is freshness. Keep the publicly available profile stale enough that any attacker working from current data-broker results finds material that doesn’t hold up against cross-checking. Stale enough that the effort of building a complete picture exceeds whatever you’re worth to them. KnytX Shield is built to run broker removal across your digital footprint, so you’re not spending weekends on opt-out forms →</a> It isn’t live yet; join the waitlist</a> to get in early. Account Takeover Fraud: How Criminals Empty Banks Unknown — Fri, 27 Mar 2026 00:00:00 +0000 In 2022, a DOJ operation in Miami broke up a network that had accessed over 2,000 bank accounts using stolen credentials. The network withdrew $4.5 million over 90 days via Zelle, ACH transfers, and ATM cashouts through mule accounts. The attackers never cloned a card. They never physically touched anything. They simply logged in. FinCEN reported $25.9 billion in suspicious activity reports tied to identity theft and account takeover in 2023. That figure represents only the cases financial institutions chose to file, not total losses. Account takeover fraud does not look like the card fraud most banks have built their fraud teams to detect. It does not trigger alerts for a chip card used in an unusual location. The attacker presents as you. That means valid credentials, sometimes a passed MFA check, correct browser fingerprint, and in some cases a session token the bank issued to you directly. By the time the bank’s fraud systems see an anomaly, the transfer is already queued. The short answer: Account takeover (ATO) is when a criminal logs into your existing bank account with credentials the bank accepts as valid. They do not need your card, PIN, or physical documents. They get in through stolen passwords, phishing that steals your session cookie, infostealer malware, SIM swaps, or by social-engineering the bank’s phone line. Recovery is hard because the bank’s logs show the transfer coming from an “authorised” session. The best defences are a unique password per financial account, an authenticator app instead of SMS, and login alerts you actually read. Jump to: What account takeover actually is</a></li> Five paths to your bank account</a></li> How session cookie theft works</a></li> The mule account pipeline</a></li> Why Zelle recovery is hard</a></li> UK consumer protections</a></li> How to tell ATO has happened</a></li> Immediate response steps</a></li> Prevention that actually works</a></li> </ul> What Account Takeover Actually Is</h2> Account takeover — ATO in fraud industry terminology — is distinct from every other form of bank fraud consumers typically hear about. Card fraud requires access to card numbers and CVVs, either through physical theft, skimming, or data breaches of payment processors. Check fraud requires physical documents. New-account fraud uses your identity to open accounts you did not apply for. ATO is none of these. In ATO, the attacker is authenticating to your existing account on your actual bank’s actual login page using credentials the bank accepts as valid. They are inside the account. They can see your balance, your transaction history, your registered payees, and your account settings. They can initiate transfers, change the registered phone number or email address, add new payees, set up automatic payments, or download account statements. The bank, at the moment of login, cannot distinguish them from you. This is what makes ATO categorically harder to detect and to recover from than card fraud. The bank issued the session. The transaction looks authorised. The legal frameworks around “authorised” transfers are far less protective than those around card fraud. In most cases, the recovery burden falls on the account holder to prove they did not initiate the transaction. Five Paths to Your Bank Account</h2> There is no single method attackers use for ATO. The approach depends on what data they have available and what the target bank’s security configuration looks like. It also depends on how much effort the value of the account justifies. Credential stuffing is the highest-volume method. Your email and password from the LinkedIn breach of 2012, the Dropbox breach of 2012, or any other large breach of that era are still in circulation. They travel in combolist format. If you used the same password for your bank account, or a simple variation of it, automated credential stuffing tools will find the match. Software like Sentry MBA, OpenBullet, and their successors takes millions of email:password combinations and tests them against bank login pages at scale. It handles CAPTCHAs through API-based solvers and rotates IP addresses through residential proxy networks to avoid rate-limit detection. The success rate per credential is low. At millions of attempts per day across hundreds of financial sites, the volume makes the economics work. Troy Hunt’s HaveIBeenPwned database currently indexes over 14 billion accounts from known breach compilations. A meaningful fraction of those accounts reused passwords across financial sites. Our credential stuffing guide</a> covers this attack in depth. Adversary-in-the-middle phishing is technically more sophisticated but increasingly accessible via off-the-shelf tools. A phishing email sends a target to what appears to be their bank’s login page. The page is not a static HTML clone. It is a real-time proxy that forwards every request the victim makes to the legitimate bank site, and forwards every response back to the victim. The victim enters their credentials and passes their MFA check, including authenticator app codes or SMS codes. At that point the attacker’s proxy captures the session cookie the bank’s server issues after successful authentication. That session cookie is now in the attacker’s hands. The attacker does not need the password. They do not need the MFA code again. They have what the bank’s server recognises as proof that the legitimate user authenticated. Tools like Evilginx2 and Modlishka automate this entirely. The attacker needs to register a lookalike domain and send a convincing email. The technical barrier is a few hours of setup. Infostealer malware bypasses the login entirely for accounts already logged in. Redline, Raccoon, and Vidar stealers spread through pirated software, fake Chrome extensions, malicious YouTube download links, and compromised websites. Once running on an infected Windows device, they exfiltrate everything the browser has stored. That means saved passwords, active session cookies, autofill data, saved payment cards, and crypto wallet seed phrases. An active session cookie proves to a bank’s server that the user has already authenticated. When that cookie is exported and imported into an attacker’s browser, the attacker lands inside the bank account at its current session state, with no login prompt. Banks that use “remember this device” features with 30-day session lifetimes are most exposed to this vector. Banks with 30-minute session timeouts or device fingerprint verification on every new browser instance reduce the window. Our stealer logs explainer</a> shows what one of these dumps contains. SIM swap transfers the victim’s mobile phone number to a SIM card the attacker controls. The attacker typically calls the mobile carrier’s customer service line with enough personal information to pass knowledge-based verification. Once the swap completes, all SMS messages to that number arrive on the attacker’s device. That includes 2FA codes, one-time passwords, and “verify this transaction” texts. This vector specifically targets SMS-based 2FA, which most retail banks in the US and India still use as their primary second factor. SIM swap is harder than it was in 2018, when carriers had almost no specific controls. The FCC’s November 2023 rules required carriers to add verification steps for SIM changes, and major carriers have added PIN-based verification. But the fraud continues, because social engineering can still defeat PIN verification when a caller is sufficiently prepared. Our SIM swap guide</a> explains how to lock your number down. Social engineering the bank directly requires no technical access to the victim’s devices or accounts. The attacker calls the bank’s customer service line and works through the bank’s knowledge-based authentication. That means full name, date of birth, last four of Social Security Number, mother’s maiden name, and perhaps the last transaction amount or the account’s opening balance. Every one of these fields is available from a combination of breach databases and data broker records. A fullz package, a complete identity bundle sold on Telegram markets, contains all of them. The attacker passes verification, requests a password reset or a new linked phone number, and takes over the account without ever knowing the original login credentials. This vector is particularly effective against older customers whose full biographical data has accumulated across decades of data broker records. It also works against customers at banks that still lean on static knowledge-based questions rather than device-bound authentication. Getting your details out of those broker records shrinks the pool of answers an attacker can buy. How Session Cookie Theft Works</h2> The session cookie deserves more detailed explanation, because it is widely misunderstood. It is the mechanism that makes both adversary-in-the-middle phishing and infostealer attacks so effective. When you log into your bank and pass your 2FA check, the bank’s server issues a session token. It is a long, random string stored in your browser as a cookie. On every later request your browser makes to the bank’s site, it sends this cookie. The server checks the cookie against its session database. If it matches a valid, unexpired session, the server treats the request as authenticated. The cookie is the proof of authentication, not your password. Your password is only used at login. After that, the cookie is doing all the work. This is why stealing a session cookie gives an attacker authenticated access without needing your password at all. When an infostealer exfiltrates your browser’s cookie store, it is taking the active proof-of-authentication that your browser is currently using. When an adversary-in-the-middle proxy captures the session cookie issued after you complete MFA, it captures the same thing. The session cookie’s validity depends on the bank’s configuration. Some banks issue short-lived tokens that expire in 15–30 minutes of inactivity. Others issue “remember this device” cookies lasting 30 days. Some use additional device fingerprinting, comparing the browser’s characteristics on each request. This detects when a cookie is being used from an unfamiliar device and forces re-authentication. Banks that layer cookie-based sessions with device fingerprinting validation are materially more resistant to this vector. The Mule Account Pipeline</h2> When attackers access bank accounts, they rarely transfer money directly to their own accounts. A direct transfer to an identifiable attacker-controlled account would trigger bank fraud detection and provide law enforcement with a clear paper trail. Instead, money flows through mule accounts: third-party accounts that receive and forward funds. Mule accounts are operated by one of two kinds of person. Some are witting participants, recruited through money-mule job scams pitched as “payment processing” or “financial agent” work from home. Others are unwitting victims who were themselves scammed. A romance scam victim who was convinced to receive and forward money, believing it legitimate, becomes an unwitting mule. A “remote work” hire who receives funds and is told to buy gift cards or wire money abroad is a witting or semi-witting mule. Zelle transfers are the preferred first movement step in US domestic ATO because they settle immediately and are treated as authorised transfers by the sending bank. An attacker who logs into your bank account and Zelles $2,000 to a mule account completes that transfer in under a minute. The mule then withdraws cash or purchases cryptocurrency. By the time you notice and call your bank, the funds have moved at least once and possibly twice. The mule may not be traceable to the actual attacker. Why Zelle Recovery Is Hard</h2> Regulation E of the Electronic Fund Transfer Act covers unauthorised electronic fund transfers. If someone takes your Zelle credentials and transfers money without your knowledge or consent, that is an unauthorised transfer under Regulation E. Banks are required to investigate and refund it. The problem is how “authorised” gets defined. When an attacker logs into your account through ATO and initiates a Zelle transfer, the bank’s transaction log shows the transfer originating from an authenticated session. The bank argues the transfer was authorised by you, in your authenticated session, even if the authentication was obtained fraudulently. Senate Banking Committee hearings in September 2022 and May 2023 highlighted this pattern. JPMorgan Chase, Wells Fargo, and Bank of America reported receiving hundreds of thousands of ATO-related Zelle complaints. Their reimbursement rates for these cases were extremely low. Pressure from the Senate Banking Committee and the Consumer Financial Protection Bureau (CFPB) led the major US banks to voluntarily expand their Zelle reimbursement policies in 2023. The expansion applied specifically to impersonation fraud, where the account holder was manipulated into initiating the Zelle transfer themselves. But pure ATO cases, where the attacker initiated the transfer from an authenticated session, remain contested. In a January 2025 compliance aid, the CFPB set out its position on these transfers. A peer-to-peer transfer made by a fraudster using stolen credentials is an unauthorised transfer under Regulation E, which banks must investigate. That guidance is interpretation, not a new rule. As of mid-2026, there is no active CFPB rulemaking targeting Zelle account takeover. The Bureau’s late-2024 enforcement lawsuit against the three banks over Zelle handling is the live front. How individual disputes resolve still varies bank to bank. The practical consequence is that recovering Zelle losses from ATO is a dispute process that can take weeks and frequently results in denial. This is a structural difference from credit card fraud, where the Fair Credit Billing Act gives consumers much stronger dispute rights. UK Consumer Protections</h2> The UK provides substantially stronger consumer protection here. The mechanism is the Payment Systems Regulator’s mandatory reimbursement rule for Authorised Push Payment (APP) fraud, which came into force in October 2024. APP fraud covers situations where the account holder initiates a payment. That includes cases where an attacker accessed the account and initiated a payment the bank processed, and it covers most ATO-driven bank transfers. Under the rule, UK banks must reimburse victims of APP fraud up to £85,000 per claim for most cases. The cost is split equally between the sending and receiving banks. Victims must report promptly and cannot have acted with gross negligence. Even so, the bar for reimbursement is significantly lower than under comparable US frameworks. As of mid-2026 the £85,000 cap remains in force, though the PSR has opened a review. A formal consultation on the cap and other terms is scheduled for December 2026. The rule explicitly covers cases where the account holder was manipulated or deceived and does not require the victim to prove they exercised unreasonable caution. UK banks lobbied heavily against the rule during its consultation phase, arguing the cost burden was excessive. The PSR implemented it over those objections. If you bank in the UK and believe you have been a victim of ATO-related fraud, start with the APP fraud mandatory reimbursement framework. It is the relevant starting point for your complaint. Your bank is required to handle the complaint and, if not satisfied with the outcome, you can escalate to the Financial Ombudsman Service. Recognising That ATO Has Happened</h2> ATO attacks vary in speed. Some attackers move money within minutes of gaining access; others spend time inside the account surveilling, adding payees, and preparing a larger transfer. The window before you notice ranges from minutes to weeks. Several signals indicate ATO in progress or recently completed. Unexpected login alerts or “new device recognised” emails are the earliest indicator. Most banks now send these, but they are only useful if you receive them before the attacker changes the notification email address. A changed recovery email or phone number on your account is a strong signal. Attackers change these to prevent you from resetting your own access. Other signs include new payees you did not create and outgoing Zelle or ACH transfers you did not initiate. Watch too for password reset requests on email accounts you did not make. Attackers who want persistent access often try to lock you out of your email. An unexpected logout from your bank’s app can also mean someone changed your credentials. The subtler signals matter too. A series of small test transactions, $1 or less, often precede larger withdrawals. Attackers test whether an account is being watched before moving larger amounts. Watch also for statements showing purchases at retailers you have never used, and balance notifications that do not match what you expected. Immediate Response Steps</h2> Speed matters. The faster you respond, the more likely you can interrupt money movement before it completes further transfers in the mule pipeline. Call the bank’s fraud line using the phone number on the back of your physical card, or from the bank’s official website that you type in manually. Never use a number from a suspicious email or text message. Explain that you believe your account has been accessed without your authorisation, and ask for an immediate freeze on outgoing transfers. Request that they lock the account against new payee additions or changes to registered contact details while the investigation is open. File a police report. Many banks require a police report or crime reference number to process fraud claims. In the US, file with your local police department. In the UK, file at actionfraud.police.uk or call Action Fraud at 0300 123 2040. In India, file at cybercrime.gov.in or call the 1930 cybercrime helpline. The report creates an official record and the reference number is necessary for insurance claims, bank dispute escalation, and credit bureau fraud alerts. File with the Federal Trade Commission at identitytheft.gov if you are in the US. The FTC generates a personalised recovery plan and documents the incident in its national fraud database. This record supports dispute letters to banks and credit bureaus. Contact the major credit bureaus to place a fraud alert. In the US, Equifax (equifax.com), Experian (experian.com), and TransUnion (transunion.com) each accept fraud alerts. You only need to file with one, and it notifies the others. A standard fraud alert lasts one year and requires creditors to take extra verification steps before opening new accounts. An extended alert lasts seven years. In India, use CIBIL (cibil.com), Equifax India, Experian India, and CRIF High Mark. A fraud alert does not stop someone already inside your existing accounts from transacting, but it prevents new credit being opened. Our credit freeze vs fraud alert guide</a> explains which one to use when. Change the password for your bank account and your primary email account from a device you trust. Ideally, use one that has not been on the same network as any device you suspect was compromised. Change them to long, random strings generated by a password manager. Prevention That Actually Works</h2> The most effective single change is a unique, randomly generated password for every financial account, stored in a password manager. Bitwarden is free, open-source, and audited annually. 1Password and Dashlane are paid options with extra features. A unique password per account means a credential breach of one service cannot cascade to your bank account. This addresses the entire credential stuffing vector. Our password manager guide</a> walks through setting one up. Use an authenticator app instead of SMS for 2FA wherever your bank allows it. Google Authenticator, Authy, and Microsoft Authenticator generate time-based one-time codes locally on your device. They are not delivered over SMS, so SIM swapping does not intercept them. They also resist SS7 network attacks that can intercept SMS on some carrier networks. Hardware security keys are stronger still, and Yubico’s YubiKey is the most widely used. A key requires physical possession and cannot be phished through an adversary-in-the-middle proxy, because it uses challenge-response cryptography bound to the legitimate domain. Our two-factor authentication guide</a> compares each option, and passkeys</a> go further still. Set up login alerts and transaction alerts on every financial account. Most banks send email or SMS notification for logins from new devices, password changes, and transactions above a threshold you set. Review these settings in your bank’s security page and ensure the notification email address is one you actively monitor. An alert you receive within minutes of an attacker accessing your account gives you time to call the fraud line before a transfer settles. Freeze your credit proactively at all three US bureaus. A credit freeze is free and prevents any creditor from accessing your credit file to approve new accounts. It does not affect your existing accounts or your ability to use existing credit. It prevents the new-account fraud that often accompanies ATO, where attackers who gain access to your financial identity also open new lines of credit. Unfreezing to apply for credit yourself takes minutes online. Leaving your credit unfrozen when you are not actively applying for credit is unnecessary exposure. Audit the active sessions on your bank’s security page. Most major retail banks now show this under “Security” or “Account Settings” — a list of devices or sessions currently authenticated to your account. Review this periodically, and immediately after receiving any suspicious email or notification. Revoke sessions associated with devices you do not recognise or have not used recently. Finally, regularly review your linked accounts and payees. An attacker with a medium-term strategy sometimes adds a payee or linked external account weeks before initiating a transfer. Letting the relationship age reduces fraud scoring risk. A quarterly review of every registered payee, linked account, and authorised application takes ten minutes and catches changes you did not make. KnytX Vigil</a> is built to watch breach databases and stealer logs for your credentials, so you get early warning before ATO attackers reach your bank. Vigil isn’t live yet; join the waitlist</a> to turn it on at launch. Email Aliases and Phone Masks: A Privacy Guide Unknown — Wed, 25 Mar 2026 00:00:00 +0000 The pile you can’t take back — and the pile you’re still building</h2> Your Gmail address is probably listed on 80 different sites. Your phone number is on 150. This didn’t happen because of one bad decision. You signed up for things over years. Companies sold that data to brokers, and brokers sold it to other brokers. Then somewhere in 2019 a database got breached, and your details ended up in a dump that circulates on Telegram to this day. That data is out there. You can work on cleaning it up — removing your information from broker sites</a> is a separate fight worth having. This post is about a different problem: the pile you’re still building right now. Every signup you complete today adds to it. That’s what email aliases and phone masks are designed to stop. Why compartmentalization matters</h2> Most people use one email address for everything. That feels fine until a company you barely remember — some food delivery app from 2021, a discount coupon site — gets breached. Now every service you’ve ever signed up for knows your email is valid and active. Spam floods in. Credential stuffing attacks start. The breach at one service becomes a problem for all of them. Email aliases break this chain. You create a different alias for each service — myntra-8x2j@simplelogin.com</code> for Myntra, zomato-k9p1@simplelogin.com</code> for Zomato. When Zomato gets breached (or sells your data), only that alias is exposed. You delete the alias. Damage stops there. Your actual inbox and identity stay clean. This is compartmentalization. It’s not paranoia — it’s how you manage risk when you can’t control what companies do with your data. Email aliases: the options for Indian users</h2> Four tools are worth your time. Here’s what they actually cost and where they fall short. SimpleLogin is the strongest recommendation. It’s now owned by Proton (the Swiss privacy company), which adds credibility. The free tier gives you 10 aliases — enough to get started. Paid plans (around ₹2,500/year (approximately $30/year)) give you unlimited aliases, custom domains, and more. It works with any email provider, including Gmail. You create an alias, forward it to your real inbox, and reply from it without revealing your real address. Setup takes about five minutes. DuckDuckGo Email Protection is free with no account required — you just need the DuckDuckGo app or browser extension. It gives you a @duck.com</code> forwarding address that strips tracking pixels before delivering email to your real inbox. The limitation: you can’t create per-service aliases, just one address. It’s a good starting point if you want something that works immediately. Apple Hide My Email generates random aliases that forward to your iCloud address. It’s well-integrated if you use an iPhone. The catch: it requires an iCloud+ subscription, which costs ₹75/month in India. If you’re already paying for iCloud storage, this is essentially free. If you’re not, SimpleLogin is the better choice. Firefox Relay gives you five aliases on the free tier as part of Mozilla’s ecosystem. It works, but the free limit is tight. It’s worth knowing about; it’s not the first recommendation for most users. Virtual phone numbers for Indian users</h2> Phone is harder than email. Genuinely anonymous virtual numbers are not a practical option in India — SIM registration requirements mean every number is linked to an Aadhaar or passport at the point of purchase. Anyone claiming to sell you a truly anonymous Indian number is either mistaken or operating in a grey area you don’t want to touch. So what actually works? A secondary Jio SIM is the most practical approach by far. A Jio prepaid SIM costs around ₹149 and gives you a real +91 number. Use it exclusively for signups, OTPs, and services you don’t trust with your primary number. Your primary number stays reserved for banking, Aadhaar-linked services, and people you actually know. Most Indian apps require a +91 number for OTP verification — this satisfies that requirement cleanly. TextNow or Google Voice give you US numbers. They don’t work for Indian OTPs that require +91. Don’t bother for Indian services. Airtel’s virtual number features exist in limited form for business accounts. Not practical for individual consumers at this stage. A WhatsApp Business account on a secondary number is worth considering if you want to keep your primary WhatsApp clean. You can run both accounts on the same phone using WhatsApp’s dual-account support (available natively on most Android phones, and via WhatsApp’s own multi-account feature). The secondary number receives business or commercial messages; your primary stays personal. The honest answer: for most Indian users, a secondary Jio SIM does the job. A practical setup that takes 30 minutes</h2> Here’s what an actual privacy setup looks like — not theoretical, just the steps. Start with SimpleLogin. Create a free account at simplelogin.io, connect it to your existing Gmail or email provider. Make one alias and use it for your next signup. That’s the whole workflow — one alias per service, going forward. For phone, pick up a Jio prepaid SIM from any Jio store or mobile shop (bring your Aadhaar). Activate it. This becomes your “signup number.” Use it wherever an app or site asks for a phone number and you’re not sure you trust them. Going forward: use your primary email and phone number only for things that genuinely need them — your bank, your Aadhaar-linked services, government portals, EPFO, UPI. Everything else gets an alias and the secondary SIM. That’s it. Thirty minutes of setup, and you stop building the pile. The limit of these tools</h2> Email aliases and phone masks are forward-looking. They protect the data you haven’t handed over yet. They do nothing about the 80 sites already listing your Gmail, or the breach dump from 2019 that has your Airtel number. For that — the data already out there — you need removal requests. India’s DPDPA gives you the right to request deletion of your personal data from companies that collect it. Read the practical guide to removing your data from Indian sites</a> for how that process actually works. For formal rights under the DPDPA — including how to file complaints with the Data Protection Board — the DPDPA rights guide</a> covers the steps. These two tracks work together. Aliases and masks stop the bleeding going forward. Removal requests clean up what’s already there. Neither one is a replacement for the other. What you can do right now</h2> Want to see what data brokers expose about you? See what a scan finds →</a> shows an example report: the kinds of sites that list your name, phone, and address. Once KnytX Shield launches it will find and remove these automatically. Join the waitlist</a> to get in early. Browser Fingerprinting: Tracking You Without Cookies Unknown — Tue, 24 Mar 2026 00:00:00 +0000 You open a browser tab — incognito, because you’re on a shared laptop at a hotel. You navigate to a news site. It’s your first visit from this machine. You’ve never logged into anything. You’ve never clicked an ad on this device. And then the sidebar loads. Running shoes. Specifically, the pair you were comparing on your home computer three days ago. This is not a coincidence. It is not a targeting algorithm that happened to guess right. A tracking system matched the browser on this hotel laptop to a profile it already built from your home machine. No cookies, no login, nothing you did to connect them. It did this in the time it took the page to load. That method is called browser fingerprinting. And most people who think they’ve protected their privacy by going incognito have never heard of it. The short answer: Browser fingerprinting builds a near-unique ID from your device’s technical details: screen size, installed fonts, timezone, and how your GPU renders a hidden image. It needs no cookie and no login, so incognito mode and most VPNs don’t stop it. You can’t delete a fingerprint, because it lives on the tracker’s servers. What works is a browser that spoofs or randomizes those signals: Brave by default, Firefox with resistFingerprinting</code>, or Tor for maximum protection. Jump to: What a fingerprint is</a> · Canvas fingerprinting</a> · The commercial infrastructure</a> · Why consent banners miss it</a> · How browsers fight back</a> · What works and what doesn’t</a> · Test your own fingerprint</a> · What to do</a> What a fingerprint actually is</h2> Every browser that visits a website sends information about itself. Some of this is necessary. The browser needs to tell the server what kind of content it can display, what language to serve, and what screen dimensions to render for. But the combination of all this technical data, taken together, turns out to be nearly unique. Your screen resolution. Your color depth. Your timezone. Your system language and any additional languages your browser is set to accept. The list of fonts installed on your operating system — not the fonts your browser uses, but fonts your system has, which JavaScript can probe for. Your browser plugins and their versions. The number of CPU cores your device reports. How your browser handles audio — the AudioContext API produces slightly different numerical output depending on your hardware and drivers, and that deviation is measurable. Your device’s battery level and charging state, where exposed. Whether your device has a touchscreen. How your graphics card renders a hidden test image. That last one is important enough to explain on its own. Canvas fingerprinting: your GPU draws your identity</h2> Canvas fingerprinting was first described in academic literature around 2012. It spread quickly through ad tech infrastructure, because it works reliably and requires almost nothing to implement. Here is what happens. When you visit a page, a JavaScript snippet instructs your browser to draw an invisible image. It’s often a string of text using a specific font, with specific colors, on a specific background. This image is drawn using the HTML5 Canvas API. Your browser renders it using your GPU, your graphics drivers, and your operating system’s text rendering stack. Here’s the critical part: that rendering is not identical across devices. The anti-aliasing, subpixel rendering, font hinting, and floating-point math in the GPU all introduce tiny variations. A MacBook Air renders the test image slightly differently than a Windows laptop with an NVIDIA card. And that renders it slightly differently than a Chromebook. These differences are invisible to the human eye. But they’re measurable, and they’re consistent. The same hardware and driver setup will produce the same rendering every time. The script takes that rendered image, converts it to a string of data using a process called hashing, and sends that hash to the tracking server. Your canvas hash is your signature. The next time you visit — or the next time any site using the same fingerprinting infrastructure loads — your canvas renders the same way. It produces the same hash, and you’re recognized. You can’t clear your canvas fingerprint. It isn’t stored anywhere on your device. It lives on the server, linked to the profile they’ve built for you. How many attributes combine into a unique identity</h2> The research on this is specific and worth citing. A 2010 study by Peter Eckersley at the Electronic Frontier Foundation tested 470,161 browsers. It found that 83.6% of them had a unique fingerprint, based on browser and plugin version, timezone, screen resolution, system fonts, and a few other attributes. For browsers with Flash or Java installed, the majority at the time, that figure rose to 94.2%. A 2022 study in Proceedings on Privacy Enhancing Technologies analyzed modern browser fingerprinting with updated attributes. It found that combining canvas fingerprinting, WebGL, audio fingerprinting, and standard attributes created a fingerprint unique to roughly 1 in 286,000 browsers. That’s a far smaller population than most cities. Across the scale of the internet, it’s more than enough to pick you out. A 2019 paper from INRIA in France tracked users over time. It found that fingerprints remain stable across browser sessions for most users. And even when attributes change, after a browser update say, the tracking companies have developed algorithms to link the old fingerprint to the new one with high confidence. The commercial infrastructure behind this</h2> Browser fingerprinting isn’t something shady actors built in basements. It is industrial-scale commercial technology deployed by major ad tech companies and sold as a product. FingerprintJS, which rebranded to Fingerprint.com in 2022, is the most prominent commercial provider. They operate a browser fingerprinting library used by thousands of websites. Their claimed accuracy is 99.5% — they say their system can correctly identify a returning user 99.5% of the time. They market this explicitly to banks and financial institutions as fraud prevention, and to e-commerce and ad tech as visitor identification. Their library is open source for basic use; the commercial product adds server-side processing and their cross-site identification network. Lotame operates a data management platform that uses fingerprinting to build cross-device identity graphs — linking a person’s phone browser, laptop browser, and tablet without any shared login. Their “Panorama ID” is built partly from fingerprinting signals. Nielsen uses fingerprinting in its digital audience measurement systems. Sizmek, before its acquisition by Amazon, was one of the earlier large-scale ad server users of canvas fingerprinting for retargeting. The ad tech supply chain is layered enough that fingerprinting infrastructure can be present on a page without the site operator having made any deliberate choice to include it. An ad network includes it. A third-party widget includes it. A hosted font service includes it. The site owner agreed to display ads or embed a social sharing button and got fingerprinting as an undisclosed dependency. The cookie consent dialog does not cover this</h2> You’ve clicked “Reject All” on a cookie consent banner. You felt like you did something. You didn’t do nothing: rejecting cookies does block some tracking. But fingerprinting is a separate mechanism. Its legal treatment under GDPR and the EU’s ePrivacy Directive has been inconsistent enough that many operators treat it as outside the scope of cookie consent entirely. The GDPR defines personal data as any information relating to an identified or identifiable person. A browser fingerprint that uniquely identifies a device and, by extension, a person is personal data under that definition. The Court of Justice of the European Union confirmed in 2019 that dynamic IP addresses can constitute personal data — fingerprints carry the same logic. But the cookie consent framework, technically established under the ePrivacy Directive, specifically addresses cookies and similar technologies that involve storage on the user’s device. Fingerprinting involves no storage on your device — the data lives entirely on the tracker’s servers. Regulators in some countries, including France’s CNIL, have stated that fingerprinting requires consent. Others haven’t taken a firm position. The result is a legal gray zone that companies have operated inside for years. The practical outcome is this. You go through the ritual of the consent banner. You reject tracking. The banner disappears. And then the fingerprinting infrastructure that was already running in the page’s background keeps running. Your explicit choice about tracking is, in effect, honored for one method and ignored for another. Cross-device tracking without a login</h2> Here is where fingerprinting gets more troubling than just recognizing you on a single return visit. Ad tech companies are trying to answer a specific question: is the person using this phone the same person who uses that laptop? Without a shared login, they have to infer this relationship. They do it through what the industry calls probabilistic matching. The method works like this: your phone and your laptop originate requests from the same IP address at the same times (because they’re both on your home Wi-Fi). Both visit similar sites. Both exhibit similar browsing behavior — you read tech news in the morning, check certain publications in the evening, show interest in the same product categories. The fingerprints from both devices go into a model that calculates the probability that they belong to the same person. When that probability crosses a threshold, the two devices are linked in an identity graph. Your ad targeting profile is now shared across both devices. This is why you can look at a product on your phone and see an ad for it on your laptop later that day. You never logged into anything on either device. The alternative is deterministic matching — linking devices through a shared login, like seeing you’re signed into the same Google account on both. Fingerprinting enables the probabilistic version. Both approaches end up in the same place: a single profile spanning multiple devices, built without your knowledge or any explicit consent. How browsers are fighting back</h2> Browser vendors have been aware of this problem for years and have taken different approaches. Firefox added a setting called privacy.resistFingerprinting</code> that has been available in about:config</code> since around 2018. When enabled, it standardizes a range of fingerprinting surfaces. Firefox reports a fake, generic screen resolution, returns a fixed user-agent string, and spoofs timezone as UTC. It also limits font enumeration and randomizes canvas output. It makes your Firefox look like many other Firefox installations rather than your specific system. The trade-off is that some sites break when they receive inconsistent data — a screen that reports one resolution while displaying at another can confuse layout code. Brave Browser takes a different approach: randomization rather than standardization. Rather than making everyone’s canvas hash the same, Brave adds a small, consistent random noise to canvas output that changes every session and every site. Your canvas hash on site A is different from your canvas hash on site B, which breaks cross-site fingerprint matching. The noise is small enough that it doesn’t visibly affect what you see, but large enough to make fingerprint matching unreliable. Brave does the same for WebGL, audio fingerprinting, and font enumeration. Safari uses Intelligent Tracking Prevention (ITP), which focuses more on cookie and storage-based tracking than fingerprinting, though Apple has added some fingerprinting mitigations. Safari limits the JavaScript APIs that expose fingerprinting surfaces and restricts access to certain APIs entirely. Chrome and its Privacy Sandbox initiative is a different story. Chrome’s approach has largely focused on replacing third-party cookies with alternative ad targeting systems — Topics API, Protected Audience — rather than addressing fingerprinting as a fundamental threat. Critics have argued that Google, as both a browser vendor and the largest ad tech company in the world, has a structural conflict of interest here. Chrome has added some fingerprinting mitigations but has not taken the aggressive approach that Brave or Firefox with resistFingerprinting have. Tor Browser goes furthest. It standardizes everything: a fixed screen size, identical fonts across all users, the same user-agent string, and caps on all APIs that could expose hardware-level variation. Every Tor Browser installation looks essentially identical. This is the maximum anti-fingerprinting stance, and it comes with real costs. Some sites don’t work, the user experience is noticeably constrained, and performance is slower because all traffic routes through the Tor network. What actually works — and what doesn’t</h2> This is where the advice gets more specific than “use a VPN” or “browse incognito.” Incognito mode does not help with fingerprinting. Incognito stops your browser from saving cookies and history locally after the session ends. It does not change your screen resolution, your GPU, your installed fonts, or any of the signals that fingerprinting uses. Your fingerprint in an incognito window is the same as your fingerprint in a normal window. The tracking companies see no difference. Most VPNs do not help with fingerprinting. A VPN hides your IP address from the sites you visit — they see the VPN server’s IP instead of yours. This limits IP-based tracking and prevents your ISP from seeing your traffic. But fingerprinting doesn’t rely on your IP address. Your canvas hash, WebGL renderer, and screen configuration are the same regardless of which VPN server your traffic routes through. Adding a VPN does nothing to your fingerprint. Cookie blockers alone do not help. Extensions that block third-party cookies are effective at one thing: blocking third-party cookies. Fingerprinting is not a cookie. It doesn’t fall under cookie blocking. Brave Browser genuinely helps. Its randomization approach — per-session, per-site noise added to canvas, audio, and WebGL fingerprinting surfaces — makes fingerprint matching unreliable across sites and sessions. This is among the most effective anti-fingerprinting approaches available in a browser that doesn’t significantly break the normal web experience. Firefox with privacy.resistFingerprinting = true</code> genuinely helps. Set it in about:config</code>. The main cost is that a small number of sites will display incorrectly because they receive a spoofed screen resolution. Most sites work fine. Tor Browser completely works, at the cost of usability and speed. For high-stakes situations where fingerprinting resistance matters more than convenience, it’s the right tool. Test your own fingerprint</h2> Before deciding how much any of this matters to you, go look at what your browser is leaking right now. coveryourtracks.eff.org is run by the Electronic Frontier Foundation. Visit it with your current browser. It tests your fingerprint and tells you three things. Whether your browser is unique among the browsers that have tested against it. Whether your browser blocks tracking ads and invisible trackers. And a breakdown of the specific attributes it could collect. The results are specific: you’ll see your exact user-agent string, your screen resolution and color depth, your system timezone, and your list of plugins. You can run it on your regular browser and then on a Brave or Firefox session to compare directly. AmIUnique.org, a research project from INRIA, runs a similar test and maintains an ongoing dataset of browser fingerprints. It will show you how unique your browser configuration is compared to fingerprints in its database, and break down which attributes are rarest. browserleaks.com goes deeper into individual APIs — separate tests for WebGL, canvas, audio fingerprinting, WebRTC, fonts, and more. More technical but more comprehensive. Run the EFF test first. It’s designed for general audiences and gives you a clear verdict. If your browser shows up as unique among even a few thousand tested browsers, you are being fingerprinted reliably and precisely. The persistence problem</h2> Unlike cookies, there is no “clear fingerprint” button. A cookie is a file stored on your device. Delete it, and the tracking data is gone from your machine. Your fingerprint doesn’t live on your device at all. It lives on servers operated by Fingerprint.com, or inside Lotame’s identity graph, or in whatever third-party data management platform the site operator has contracted with. So you can switch browsers, clear every cookie and cache, reset your browser to factory settings, or reinstall your operating system. Your fingerprint still reappears the moment you visit a site that’s seen it before. That’s because the fingerprint is a function of your hardware: your GPU, your screen, your CPU. Those don’t change when you clear your browser history. The only way to change your hardware fingerprint is to change your hardware, or to use a browser that actively spoofs or randomizes those hardware signals. This is why the browser choice matters. You can’t clean up a fingerprint that’s already been linked to a profile, but you can stop generating a consistent, reliable fingerprint going forward. What to actually do</h2> This is a sliding scale based on how much fingerprinting bothers you specifically. If you want meaningful protection without changing your workflow much: switch to Brave Browser for daily use. No configuration required — fingerprinting protection is on by default. Install it, import your bookmarks, and use it the way you were using Chrome. You lose nothing noticeable and gain substantial fingerprint resistance. If you’re already using Firefox: open a tab to about:config</code>, search for privacy.resistFingerprinting</code>, and toggle it to true</code>. Also set privacy.trackingprotection.fingerprinting.enabled</code> to true</code>. While you’re in Firefox’s privacy settings, switch Enhanced Tracking Protection to Strict mode. Add uBlock Origin from the Firefox extensions store. This combination blocks tracking scripts from loading in the first place, which addresses the subset of fingerprinting that gets loaded via third-party scripts. If you want to see what’s leaking before deciding what to do: visit coveryourtracks.eff.org in your current browser. Do this first. The results make the abstract concrete. Seeing your specific timezone, screen configuration, and font list laid out as a single traceable profile tends to land differently than reading about it. If you care about cross-device tracking specifically, be aware of one thing. Using the same browser across devices, or staying logged into Google or Meta accounts across devices, gives companies deterministic links that are stronger than any fingerprint. Fingerprinting fills the gap when you’re not logged in. Logins close the loop. Limit the accounts you stay signed into on browsers you use for general browsing. For situations requiring maximum privacy — specific research, sensitive communications, anything where tracking represents a genuine risk rather than a commercial inconvenience — use Tor Browser. It’s available at the Tor Project’s website. The browsing experience is slower and some sites will present CAPTCHAs or break partially, but your fingerprint will be effectively indistinguishable from every other Tor Browser user. One thing that won’t help: privacy-branded browser extensions that you’ve never heard of. The extensions market includes tools that are themselves data harvesters, or that do approximately what they claim while also transmitting your browsing history somewhere. Stick to uBlock Origin, the EFF’s Privacy Badger, or the built-in protections of Brave and Firefox. Avoid any extension that asks for broad permissions and comes from an unknown publisher. The hotel laptop scenario at the start of this article is real. Fingerprinting infrastructure is widespread enough and accurate enough that cross-device recognition without any shared login is routine. There is a gap between believing you’ve protected your privacy and actually having done so. In many cases, it’s the gap between “cleared my cookies” and “using a browser that actively spoofs its hardware signals.” Clearing cookies is table stakes. It was table stakes ten years ago. Fingerprinting moved past it a long time ago, and the companies operating at scale have been exploiting that gap ever since. To also cut the third-party scripts that carry fingerprinting into a page, see our guide to tracker blocking</a>. What you can do right now</h2> Want to see what data brokers expose about you? See what a scan finds →</a> shows an example report: the kinds of sites that list your name, phone, and address. Once KnytX Shield launches it will find and remove these automatically. Join the waitlist</a> to get in early. Inside the Telegram Groups Selling Your Data Unknown — Mon, 23 Mar 2026 00:00:00 +0000 In January 2024, a Telegram channel posted what researchers named MOAB — the Mother of All Breaches. It held 26 billion records aggregated from LinkedIn, Twitter, Tencent, Weibo, and hundreds of other sources. The channel had 40,000 subscribers within 72 hours. The data was free. No Tor browser. No cryptocurrency required. Just a Telegram account. That event was not an anomaly. It was the public-facing surface of a market that has operated on Telegram for years. By most threat intelligence estimates, it has grown every year since 2020. The shift from dark web forums to Telegram reflects a fundamental change in how stolen data circulates: from technically inaccessible to reachable by anyone with a smartphone. The short answer: Telegram has become a primary marketplace for stolen personal data because it removes the friction of the dark web. No Tor browser, no crypto wallet, and channels are searchable. Markets sell free combolists, “fullz” identity packages, fresh stealer logs, OTP bots, and lookup bots. Fresh data costs the most, since sessions and passwords are more likely to still work. To protect yourself, monitor your identifiers, act fast on any alert, use unique passwords, and enable app-based two-factor authentication. In this article: Why Telegram replaced dark web forums</a></li> The taxonomy of breach groups</a></li> The Indian market</a></li> How data gets into these channels</a></li> The economics in detail</a></li> Who buys this data</a></li> The freshness window</a></li> Law enforcement response</a></li> What monitoring means in practice</a></li> What to do when you get an alert</a></li> Frequently asked questions</a></li> </ul> Why did Telegram replace dark web forums?</h2> Traditional dark web marketplaces required Tor, cryptocurrency wallets, forum accounts, and a working knowledge of how to navigate .onion addresses. That friction excluded most of the people who might buy or sell breach data, and it gave law enforcement a consistent profile to target. Telegram removed nearly all of it. Telegram accounts require only a phone number, which can be a temporary number from any SIM. Messages in channels and groups can be set to self-destruct. The platform does not scan file contents. Bots — automated accounts that respond to commands — run natively within Telegram, so sellers can automate queries without writing custom infrastructure. File sharing supports files up to 1GB compressed, large enough to distribute breach dumps of several million records in a single post. Critically, Telegram’s public channel search makes groups discoverable. A user searching for terms like “fullz USA” or “stealer logs fresh” finds active selling channels without needing an invitation or referral. This discoverability drives the scale. Forums on dark web marketplaces relied on reputation-gated access to maintain some operational security. Telegram markets are deliberately visible — the more subscribers a channel accumulates, the more potential buyers see each listing. Telegram’s response to law enforcement requests has historically been limited. The company’s stated policy requires a court order from a jurisdiction Telegram recognises, and its moderation of illegal content has been inconsistent. Channels taken down frequently reappear under new names within days, with the same operators announcing the migration in affiliated channels. The arrest of Telegram’s CEO Pavel Durov in France in August 2024 prompted some changes to the company’s cooperation policies. But threat intelligence firms including Flare Systems and Cybersixgill have documented continued active markets throughout 2025. The Taxonomy of Breach Groups</h2> Not all Telegram breach channels operate the same way. Threat intelligence researchers have identified four primary market types, each serving different buyers and pricing differently. Free combolists channels distribute bulk credential dumps — millions of email:password or username:password pairs in text files — at no cost. The purpose is channel growth. A high-subscriber channel with a history of real data is more credible to future buyers of paid content. Combolist data is typically old: aggregated from multiple prior breaches, deduplicated, and sorted by domain. A combolist of Gmail accounts from 2023 aggregations might contain 15 million lines. The data’s value to the channel operator is advertising. Its value to a buyer is credential stuffing: running the combinations against banking, e-commerce, and streaming accounts to find where the user reused their password. Paid “fullz” sellers offer complete identity packages. A package holds a full name, date of birth, Social Security Number, current address, bank account and routing numbers, and sometimes a scan of a driver’s licence or passport. These are used for new-account fraud, tax refund theft, and credit application fraud. US fullz priced at $10–30 per identity in documented market sampling by Flashpoint and Cybersixgill through 2024. Premium fullz — verified to have no existing fraud flags, with a clean credit file — command higher prices. The sellers often offer replacement guarantees: if the identity bounces during fraud, they replace it. Stealer log markets sell the fresh output of infostealer malware. Redline, Raccoon, and Vidar are the three most prevalent families. Each runs silently on an infected device and exfiltrates browser-stored passwords, active session cookies, autofill form data, crypto wallet seed phrases, saved credit card numbers, and desktop files. A single log from one infected device can contain hundreds of saved passwords, session cookies for banking and e-commerce sites, and enough autofill data to populate a credit application. Logs are priced by the value of the sessions they contain: a log with an active online banking session and a crypto wallet seed phrase sells for $80–200. A log with only retail account sessions and no financial access sells for $5–20. Markets like Russian Market and 2Easy, which operate as Telegram-adjacent storefronts, have been documented selling millions of logs over their operational history. OTP bot services are automated systems that call a target’s phone number in real time, impersonating their bank, and social-engineer them into reading out the one-time password they just received. The attacker purchases OTP-bot access, sets up an automated call to the victim using a spoofed bank phone number, and simultaneously initiates a login on the bank’s site. When the site sends an SMS code, the OTP bot’s automated voice asks the victim to verify their identity by reading the code aloud. It sounds like a bank fraud team. The bot captures the code, and the attacker then enters it. The entire process takes under 60 seconds. OTP bot services are sold on monthly subscription or per-use pricing. Lookup bots accept a phone number, email address, or full name and return associated data from aggregated breach and data broker records. A phone number query might return the registered name, carrier, current address, and which breaches contain that number. These bots are used by scammers to pre-screen targets and personalise social engineering calls. They’re priced per query, with bulk discounts. The Indian Market</h2> India’s exposure in these channels is disproportionate to the amount of coverage the English-language security press gives it. CERT-In’s 2023 annual report placed India in the top five most-breached countries globally. Indian threat intelligence firms Cyble and CloudSEK have both published documented market research on Telegram groups trading specifically in Indian citizen data. The data types that appear most frequently in Indian-focused channels are different from the US market. PAN card numbers combined with full names and dates of birth are common — this combination is sufficient to apply for financial products. Aadhaar-linked phone records — mobile numbers verified to a specific Aadhaar number — are valuable for SIM swap attacks. Health insurance subscriber records appear in channels following breaches of insurance administrators. KYC document bundles — the identity documentation Indian financial services companies require — are sold as packages. HDFC Bank, ICICI Bank, and SBI customer data has been advertised in these channels in formats that include account numbers, registered mobile numbers, and email addresses. Threat intelligence companies differ on how much of this data reflects genuine breaches. The rest may be aggregation of leaked call centre data, or earlier breaches restated with new packaging to command fresh prices. The 2021 MobiKwik breach is the most extensively documented Indian case in this category. An attacker published 8.2TB of KYC data from 3.5 million MobiKwik users on a dark web forum, then promoted the dump via Telegram channels. The data included names, dates of birth, addresses, PAN cards, Aadhaar numbers, and bank account details. MobiKwik disputed that the breach had occurred; the data’s presence and content were independently verified by multiple researchers. The breach was never formally acknowledged by the company under India’s then-applicable IT Act 2000 frameworks, which had no mandatory breach notification requirement. The Digital Personal Data Protection Act 2023 introduced notification requirements. Its rules were notified in November 2025, but as of mid-2026 the Data Protection Board is not yet fully operational and enforcement is still phasing in. Indian aadhaar-linked identity packages were documented trading at ₹500–2,000 per record in CloudSEK’s 2023 Telegram market research. At scale, a set of 10,000 verified records with full KYC data costs less than organising a physical mail campaign. How does data get into these channels?</h2> Breach data enters Telegram markets through several distinct pipelines, each with different freshness and accuracy characteristics. Initial access brokers are the entry point for corporate breaches. These are attackers who gain a foothold inside a company network, often by purchasing or phishing valid employee credentials. They then sell that access rather than exploiting it themselves. Buyers may be ransomware operators, espionage groups, or data thieves. When a company is breached and customer data exfiltrated, that data frequently appears in Telegram markets within weeks. Infostealer malware is the most reliable source of fresh data. Redline, Raccoon, and Vidar stealers are distributed through pirated software downloads, malicious Chrome extensions, fake software update prompts, and YouTube video descriptions linking to supposed cracked applications. Once executed on a device, the stealer runs, exfiltrates its target data to a command-and-control server, and exits — often in under 30 seconds. The operator of the stealer then sells the logs through Telegram. Because this pipeline runs continuously, stealer log markets always have fresh inventory. Public breach data is republished and enriched. An operator takes a 2022 breach of a retail company and combines it with a 2023 breach of an insurance company. They match records by email address, producing an enriched dataset with more fields than either original breach. This enrichment creates packages that appear more valuable than the individual components, and commands higher prices. Insider access is a smaller but documented channel. Employees with access to customer databases have sold queries or bulk exports through Telegram. The Indian call centre industry has been specifically identified by CloudSEK research as a source of CRM data sold in Telegram markets. The Economics in Detail</h2> The pricing structure of Telegram breach markets reflects a specific business model: use free data to grow channels, then monetise premium inventory. Free combolist dumps drive subscriptions. A channel with 200,000 subscribers and a history of posting verified breach data is worth more than one without that history, because it has a larger audience for paid listings. This is why free data continues to circulate even though its components could be sold — the subscriber count is the asset. Premium subscriptions exist for channels offering “fresh” data — typically defined as under 30 days old. The freshness premium reflects practical value. A session cookie less than two weeks old may still be valid. An email:password combination used last month is more likely to be unchanged than one from three years ago. Aged data trades at discount — 80% below fresh pricing for the same category of record. Custom queries bill per record: a lookup bot that returns current home address from a phone number charges per successful match. Bulk queries receive volume discounts, making it economically viable to query thousands of records for a targeted fraud campaign. A fresh US bank session cookie is a browser authentication token that lets an attacker log into the bank account without entering credentials. It sells for $20–80 depending on the bank and the visible account balance. When a stealer log contains a bank session cookie alongside the credentials for that account, the package price increases. The buyer now has two different attack paths to the money. Who Buys This Data</h2> The buyers are not a monolith. Different data types attract different operator categories, and understanding who uses which data explains why certain information is consistently more valuable than other types. Credential stuffing operators run automated software — Sentry MBA, OpenBullet, SilverBullet — that takes a combolist and systematically tests each credential against a target site. The target is any site where a successful login yields value: bank accounts, cryptocurrency exchanges, loyalty programmes, streaming services. The success rate per credential is low, typically 0.1–2%, but at millions of credentials per run and thousands of runs per day, the volume compensates. These operators buy combolist data at scale and cheap. Romance scammers use data to build targeted lists. Say a scammer builds a list of 50-plus single individuals with above-average income in a specific city, matching data broker records with social media profiles and breach data. That list lets them prioritise high-yield targets instead of cold-contacting random numbers. Location and income data from data brokers and breach records drives this targeting. SIM swap contractors are sometimes hired by criminal groups who lack the social engineering skills to execute the carrier call themselves. The contractor purchases target information — full name, carrier, account PIN from breached carrier data — and executes the swap for a flat fee. OTP bot subscriptions serve the same market for cases where a SIM swap is too risky or time-consuming. Tax fraud syndicates use fullz — complete identity packages — to file fraudulent tax returns and claim refunds before the legitimate taxpayer files. The IRS received over 294,000 reports of identity theft tax fraud in tax year 2023. The window to exploit this is narrow: after the legitimate return is filed, the fraud fails. So fullz buyers in this category move quickly on fresh inventory. Business email compromise operators need accounts-payable contact information: the name, email address, and role of the person authorised to transfer funds at a target company. Breach data combined with LinkedIn data provides this. A successful BEC attack that redirects a single wire transfer yields orders of magnitude more than credential stuffing returns. The Freshness Window</h2> Freshness is the dominant pricing variable in stealer log and session cookie markets. It reflects a genuine operational constraint: action needs to happen before the victim or their bank detects the compromise. A bank session cookie issued when a user logs in without selecting “remember me” might expire in 30 minutes. A cookie from a “stay logged in” session might be valid for 30 days. When that cookie appears in a stealer log, the attacker has a window between when the cookie was stolen and when it expires or is revoked to use it. Fresh logs — from malware infections in the last two weeks — command the highest prices because the probability that sessions remain valid is highest. The same logic applies to credentials: a password changed six months ago is less likely to be current than one from a device infected three weeks ago. Markets reflect this accurately in pricing. A log less than 7 days old commands 3–5 times the price of an identical log 45 days old. This window is what makes alert speed matter. Say a monitoring system detects your email in a stealer log today and alerts you the same day. You can change the relevant password and revoke active sessions before an attacker has completed the purchase and acted on the data. If the alert arrives three weeks after the log was posted, you are likely already inside the attacker’s action window. Law Enforcement Response</h2> Operation Cookie Monster took down Genesis Market in April 2023. It was coordinated by the DOJ, Europol, and law enforcement agencies from 17 countries. Genesis was a dark web and clearnet marketplace that sold stealer logs and browser fingerprints. The operation resulted in 119 arrests globally and seizure of the Genesis Market infrastructure. At its peak, Genesis Market offered access to over 1.5 million compromised devices. The FBI, Europol, and India’s Indian Cybercrime Coordination Centre (I4C) have all issued public guidance on stealer log threats and Telegram-based data markets. Law enforcement pressure produces visible results against specific infrastructure: site takedowns, arrests, and occasionally the disruption of specific malware distribution networks. The structural problem is speed of regeneration. Within days of the Cookie Monster operation, Telegram channels carrying Genesis Market data had migrated to alternative storefronts. New markets appear regularly. The operators behind identified markets frequently surface operating new channels or moved to alternative platforms. Threat intelligence firms that track these markets report a consistent pattern. Takedowns reduce supply temporarily, and sometimes permanently for specific high-profile operators. But they do not reduce the total volume of data in circulation. The economics of running a Telegram channel are too low-cost, and the operator risk too manageable with basic operational security, for enforcement alone to be the solution. What Monitoring Means in Practice</h2> Threat intelligence platforms such as Cybersixgill, Flare Systems, and Constella Intelligence continuously ingest Telegram channels, dark web forums, paste sites, and stealer log markets. They index the content and alert subscribing users when monitored identifiers appear: email addresses, phone numbers, full names, or combinations. KnytX Vigil is built to do the same for individuals once it launches. The difference between these platforms and a service like HaveIBeenPwned is continuous coverage and breadth. HaveIBeenPwned covers disclosed public breaches and some stealer log data; enterprise-grade platforms also ingest private Telegram channels, fresh stealer logs not yet publicly indexed, and lookup bot databases. An alert from one of these systems tells you which data appeared, in which channel, and when. So you know whether it is a five-year-old breach republished or fresh stealer log data from this month. That distinction changes the urgency and scope of the response. An old breach republication of just an email address requires a password check. A fresh stealer log means there may be an active malware infection on one of your devices that has not yet been identified. What to Do When You Get an Alert</h2> Change the credential implicated in the alert immediately. Do not rotate all passwords speculatively — start with what appeared in the alert and then work outward to any site where you reused the same password. Check active sessions on financial accounts. Most retail banks now show a “devices and sessions” or “connected devices” page in security settings. If you see sessions you do not recognise or devices you have not used, terminate them. This is particularly important if the alert includes a session cookie rather than just a credential. Place a fraud alert with the major credit bureaus. In the US: Equifax, Experian, and TransUnion each accept fraud alerts free; a fraud alert requires creditors to take extra steps to verify identity before opening new accounts. An extended fraud alert lasts seven years. In India, the credit bureaus are CIBIL, Equifax, Experian, and CRIF High Mark; CIBIL fraud alerts are initiated through the bureau’s dispute process. These do not prevent someone from using existing credentials to log into accounts, but they prevent new credit being opened in your name. Monitor for account recovery attempts. A flood of password reset emails or SMS codes you did not request means someone is attempting to access accounts using your identifiers. Secure the most sensitive accounts first — email, bank, and any account from which a password reset can cascade to other services. Review the devices you use. If the alert flagged stealer log data specifically (session cookies, autofill data, saved passwords), run a malware scan on any Windows devices you use. Stealer malware does not always trigger antivirus. Look for recently installed browser extensions you do not remember installing, and check browser settings for unexpected proxy or DNS configuration changes. Frequently asked questions</h2> Why is stolen data sold on Telegram instead of the dark web? Telegram removes the friction. There’s no Tor browser or crypto wallet needed to join, channels are searchable, and bots automate sales. That lowers the barrier for both buyers and sellers. What kinds of data are sold in these Telegram markets? Several types. Free combolists (bulk email:password pairs), “fullz” identity packages, fresh stealer logs (passwords and session cookies), OTP bots, and lookup bots that return a person’s details from a phone number or email. Why does “fresh” data cost more? Because it’s more likely to still work. A recent session cookie may still be valid, and a recently stolen password is less likely to have been changed. Fresh logs can cost several times more than data 45 days old. How do I know if my data is being sold? Search Have I Been Pwned for public breaches, and watch for scam calls that quote your real details. Dedicated monitoring services also index private Telegram channels and fresh stealer logs. Check where your details resurface on people-search sites</a> too. What should I do if I get a breach alert? Change the affected password everywhere you reused it and terminate unfamiliar account sessions. Then place a fraud alert with the credit bureaus, and scan your devices for stealer malware if session data was involved. KnytX Vigil is built to watch Telegram channels and dark web forums for your personal data, so you’ll find out before attackers act on it. It isn’t live yet — see how it will work →</a> Security Vulnerabilities Become Privacy Disasters Unknown — Sun, 22 Mar 2026 00:00:00 +0000 In May 2023, the BBC’s HR department discovered that personal records belonging to current and former employees had been stolen. The records included names, dates of birth, national insurance numbers, home addresses, and salary information. Employees had done nothing wrong. Their passwords were fine. Their accounts hadn’t been phished. The breach had nothing to do with anything they controlled. The BBC used a third-party payroll and HR data management service. That service used a file transfer tool called MOVEit. MOVEit had a vulnerability: a SQL injection flaw catalogued as CVE-2023-34362. A ransomware group called Clop had been quietly exploiting it before anyone knew the flaw existed. By the time MOVEit’s developer published a patch on May 31st, Clop had already exfiltrated data from hundreds of organizations. The BBC was one of over 2,700 organizations eventually confirmed as affected. Shell, British Airways, the US Department of Energy, TIAA, and dozens of US state governments were on the same list. Total records exposed: an estimated 93 million. Most of those 93 million people had never heard of MOVEit. This is the story behind most major data breaches. Not a hacker guessing your password. Not a company careless with your login credentials. A software vulnerability — code behaving unintentionally — exploited silently, your data gone, and you finding out months later. What a vulnerability actually is</h2> Software is written by humans, which means it contains mistakes. Some of those mistakes are just bugs — the app crashes, a button doesn’t work, a calculation is wrong. But some mistakes create a gap between what the software is supposed to do and what an attacker can make it do. That gap is a vulnerability. The categories of vulnerability that appear most often in major breaches follow recognizable patterns. SQL injection happens when software passes user input directly into a database query without checking it first. Say you type a username into a login form and the software constructs a query like SELECT * FROM users WHERE username = '[what you typed]'</code>. An attacker can type something that breaks out of the intended query and runs their own commands against the database. The MOVEit flaw was exactly this. An attacker sends a crafted request to the web application. Instead of just fetching the file they asked for, the database executes their instructions — including copying data out. Remote code execution (RCE) vulnerabilities let an attacker run arbitrary commands on a machine they have no legitimate access to. They send a specially crafted input, such as a message, a request, or a file, and the target system executes it. Log4Shell, which we’ll cover shortly, was this category. An attacker could send a log message containing a specific string. That caused any Java application using Log4j to fetch and execute code from a server they controlled. Authentication bypass vulnerabilities let someone skip the login check entirely. The software is supposed to verify who you are before granting access. But a flaw in how it handles a particular request lets an attacker skip that step. They get in as if they’d authenticated, without any credentials at all. Buffer overflow and memory corruption vulnerabilities are lower-level. Software allocates a fixed block of memory for some data. If an attacker sends more data than that block can hold, the excess spills into adjacent memory. That memory might contain executable code, security controls, or pointers the program uses to decide what to run next. With enough precision, an attacker can overwrite those locations with their own code. The common thread runs through every category: the software behaves in ways its authors never intended. An attacker who understands that behavior can weaponize it. CVEs and the gap between disclosure and patch</h2> When a vulnerability is discovered and formally documented, it gets assigned a CVE number — Common Vulnerabilities and Exposures. The CVE system is a public catalog maintained by MITRE Corporation, sponsored by the US Department of Homeland Security. Each entry includes a description of the flaw and a severity score. CVE-2023-34362 is the MOVEit SQL injection. CVE-2021-44228 is Log4Shell. The number tells security teams and researchers what, specifically, they’re dealing with. The catalog is public. That’s mostly a good thing — it allows defenders to identify and patch known problems. But it also means the catalog is readable by attackers. Research from Palo Alto Networks’ Unit 42 found that the average time from CVE publication to exploitation in the wild is 12 days. The average time organizations take to patch a known vulnerability is 102 days. That 90-day window between “the flaw is published” and “organizations have patched it” is when most exploitation happens. Attackers scan for vulnerable systems as soon as a CVE is published. Organizations are still scheduling maintenance windows. Zero-days are different. A zero-day vulnerability is one that the software vendor doesn’t know about yet — or has only just discovered. There is no patch because there has been zero days of opportunity to write one. The MOVEit breach was a zero-day attack: Clop exploited CVE-2023-34362 before MOVEit’s developer Progress Software had any knowledge of the flaw. The moment Progress published the patch, the vulnerability technically became a “known vulnerability,” but Clop had been exploiting it for weeks beforehand. Zero-days require more skill and resources to discover and exploit. They’re valuable precisely because defenders have no warning. Nation-state intelligence agencies spend significant resources acquiring zero-days for espionage. Criminal groups occasionally find them too, or buy them. But zero-days are the minority of breaches. The majority of successful attacks exploit vulnerabilities that have been public for months — against organizations that simply hadn’t patched yet. Log4Shell: when a library inside a library breaks everything</h2> On December 9, 2021, a security researcher published proof-of-concept exploit code for a vulnerability in Log4j, a Java logging library. Within hours, active exploitation was observed in the wild. Within days, hundreds of millions of systems were known to be vulnerable. Log4j is not software that end users install. It’s a library — a reusable piece of code that developers include in their own applications to handle logging. Logging is mundane: when something happens in a program, you write a record of it. Log4j handled that job for an enormous fraction of Java applications. Java runs inside banking systems, healthcare records platforms, Minecraft servers, enterprise software from Cisco, IBM, and VMware, and an incalculable number of internal business applications. CISA estimated that Log4Shell (CVE-2021-44228) affected approximately 3 billion devices. The vulnerability worked like this: Log4j, in a misguided attempt to be helpful, would interpret special strings inside log messages and act on them. An attacker only had to get their string into a log. That might be as simple as putting it in a username field, a search query, a user-agent header, or a chat message. Log4j would then fetch code from a server the attacker specified and execute it. Completely automatically. No user interaction beyond generating the log entry. The library was maintained by three volunteer developers working in their spare time. No commercial entity owned it. No security team reviewed it full-time. It was free, well-written for its purpose, and used everywhere. The volunteers responded as fast as anyone could have, pushing a patch within days. The problem was that the library was embedded inside so many other applications. Patching required each application vendor to update their software, then each organization to update their installations. Some organizations didn’t finish that process for months. Some haven’t finished it yet. The supply chain problem: your data isn’t just at your bank</h2> The BBC employees affected by the MOVEit breach hadn’t given MOVEit anything directly. Their data was at their employer, which used a payroll service, which used MOVEit. The vulnerability was three relationships away from the individuals whose data was taken. IBM’s Cost of a Data Breach report consistently finds that roughly 60% of major breaches involve a third party. That means a vendor, supplier, contractor, or service provider. Your data doesn’t just sit with the company you gave it to. It flows downstream: to payment processors, cloud infrastructure providers, analytics companies, HR platforms, legal firms, marketing agencies. Each of those downstream entities has its own technology stack, its own patch cadence, and its own vulnerabilities. You cannot audit your bank’s technology vendors. You cannot check whether your health insurer uses a third-party claims processor running an unpatched server. You cannot know which file transfer tool your mobile carrier’s billing contractor uses. This isn’t a failure of due diligence on your part. There is no mechanism for an individual to investigate this chain. The implication is uncomfortable. You can make every good personal security decision: strong passwords, two-factor authentication, minimal data sharing. Even then, your information can still be exfiltrated through a system you’ve never interacted with, via a software flaw you couldn’t have known existed. What attackers do after they’re inside</h2> Getting into a system through a vulnerability is the entry point. What happens next determines how much data gets taken and whether anyone finds out. After initial access, an attacker typically engages in lateral movement. They explore the network, escalate their privileges, and move from the entry point to the systems holding the most valuable data. A SQL injection in a web application might give access to the web server. From there, an attacker looks for internal network access, finds database servers, cloud storage buckets, backup systems, and authentication directories. The initial vulnerability is the door. Lateral movement is walking through the building. Dwell time is the gap between when an attacker first gets in and when anyone detects them. Mandiant’s M-Trends report places the global median dwell time at around 16 days, but that median conceals a long tail. Some breaches go undetected for 200 or 300 days. During that time, the attacker can read, copy, and exfiltrate data at will. They can plant persistent backdoors so that even if discovered and removed, they can re-enter. They can watch communications, gather credentials for other systems, and understand exactly what data exists and where it lives. Exfiltration is quiet. Attackers don’t announce when they’ve copied data. They transfer it gradually, often disguising the traffic as normal activity, sending it to infrastructure they control. By the time a company detects a breach, weeks or months of data has already left the network. The notification you receive — “we detected unauthorized access to our systems” — often describes an event that concluded before anyone knew it began. What you can actually do</h2> You cannot prevent a vendor you’ve never heard of from running unpatched software. You can significantly limit what someone can do with your data once they have it. Use different passwords for different services. This is the most important thing on this list. When credentials leak in a breach, attackers test them against every valuable site they can target. This technique is called credential stuffing</a>. Say your password from a breached fitness app is the same one you use for your email, your bank, and your airline account. That one breach effectively becomes all of them. A password manager</a> removes the friction of maintaining distinct credentials everywhere. Enable two-factor authentication on every account that supports it. Breached passwords are common. Breached passwords plus the code from your authenticator app are much rarer. An attacker with your username and password still hits a wall if they don’t have your second factor. Use an authenticator app rather than SMS</a> where possible, because SIM-swap attacks</a> can intercept text messages. Freeze your credit. A credit freeze prevents new credit accounts from being opened in your name, even if someone has your full personal information. It’s free in most jurisdictions and takes minutes to do with each credit bureau. You can lift it temporarily when you genuinely need to apply for credit. Given how much personal data is already in circulation from historical breaches, a freeze limits what someone can actually do with it. Our credit freeze vs fraud alert guide</a> covers the details. Monitor for breach notifications. Services like Have I Been Pwned let you check whether your email address appears in known breach databases. KnytX Vigil</a> is built to alert you when credentials tied to your email show up in newly discovered breach datasets. Vigil isn’t live yet; join the waitlist</a> to turn it on at launch. A notification doesn’t undo the breach. But it tells you which passwords to change and which accounts to review before an attacker exploits them. Minimize what you share. Data that was never collected cannot be breached. Services often ask for information they don’t need: your date of birth for a loyalty account, your phone number to read an article. Declining reduces your exposure. The less a company holds, the less can leave in a breach. Know your rights under breach notification law. Under GDPR, organizations have 72 hours to report a breach to their supervisory authority once they become aware of it. US states have their own notification timelines — most require notification within 30 to 90 days of discovery. India’s DPDPA requires notification to the Data Protection Board and affected individuals within a timeframe to be specified by regulation. These laws exist because companies historically didn’t tell affected individuals at all. If you’re affected by a breach and the company notifies you late, that’s a violation you can report. Watch for CVE advisories affecting services you use. Security researchers and vendors publish CVE notices when vulnerabilities are discovered. Tools and feeds exist that let you track CVEs affecting specific products. If you know your company’s payroll software just received a critical vulnerability disclosure, you can ask whether it’s been patched. You can also decide what data you want stored there while it isn’t. The practical checklist</h2> These steps don’t require technical expertise. They take an afternoon. Freeze your credit at each major bureau in your country (in the UK: Experian, Equifax, TransUnion; in the US: the same three plus ChexSystems; in India: CIBIL, Experian, Equifax, CRIF High Mark)</li> Set up a password manager and change the passwords on your email, bank, and any financial account to unique, randomly generated strings</li> Enable an authenticator app for your email and financial accounts — not SMS</li> Enter your email address at Have I Been Pwned and review what’s already been breached</li> Review what data you’ve shared with services you use infrequently; request deletion from ones you no longer use, under GDPR, DPDPA, CCPA, or the applicable law in your jurisdiction</li> Check your email’s forwarding and recovery settings — these are what attackers modify immediately after taking over an account</li> Enable breach monitoring alerts so you’re notified when new leaks appear with your credentials</li> Decline unnecessary data collection when signing up for new services — date of birth, secondary phone number, and physical address are frequently asked for and frequently unnecessary</li> </ul> None of these steps prevent a vendor three relationships from you from running unpatched software. What they do is limit what an attacker can accomplish with whatever comes out. The BBC’s employees couldn’t have prevented the MOVEit breach. But some of those 93 million people had credit freezes in place, unique passwords per service, and two-factor authentication on their accounts. They were substantially harder to harm, even after their data left the building. The DPDPA's Enforcement Problem, and What Now Unknown — Sat, 21 Mar 2026 00:00:00 +0000 Ask the privacy officer at most Indian tech companies about DPDPA compliance. You will get a version of the same answer: “We are getting ready.” Translation for many: not much yet. The law now has rules and an enforcement body. But penalty-backed enforcement is still ramping up, and companies are pacing their spending accordingly. The short answer: India’s DPDPA became law in 2023. Its rules were finalised and notified on 13 November 2025, and the Data Protection Board of India has now been formally established. But the Board’s core penalty powers and most compliance duties phase in through 2027, so 2026 is largely a “soft enforcement” year. Your rights still exist today, and you can exercise many of them by writing directly to a company’s grievance officer. India’s Digital Personal Data Protection Act became law in August 2023. It passed Parliament, received Presidential assent, and generated a wave of compliance seminars and explainer articles. For nearly two years, what it did not generate was meaningful enforcement. That is now changing, but slowly. Is the DPDPA being enforced yet?</h2> The DPDPA created a body called the Data Protection Board of India (DPBI). The DPBI receives complaints, investigates violations, and imposes penalties. Without it operating, the law has little bite in practice. Here is where things stand in mid-2026. The DPDP Rules were notified on 13 November 2025. Those rules cover how the Board is established, how complaints are filed, and how investigations run. The government has formally established the four-member Board, headquartered in the National Capital Region. But establishment is not the same as full enforcement. The Board’s core powers to investigate and penalise, along with most substantive duties for companies, phase in over an 18-month transition. The consent-manager rules take effect around November 2026. The main compliance obligations follow in 2027. So 2026 is widely treated as a “soft enforcement” year, focused on guidance rather than fines. Companies know this. Their legal teams track it. Many are making a deliberate calculation: heavy compliance spending is a 2027 problem. What the DPBI does</h2> Once its powers are fully in force, the DPBI is the central enforcement mechanism for Indian data protection law. Its mandate covers adjudicating complaints from individuals whose rights were violated. It investigates companies on its own initiative when violations are suspected. And it imposes financial penalties. The maximum penalty under the DPDPA is ₹250 crore per incident, roughly $30 million. For a company holding millions of users’ data, that is a serious number. One procedural detail matters for individuals: under the rules, you first raise a grievance with the company. Only if it goes unresolved (the rules point to a 90-day window) can you escalate the complaint to the Board. The board is modeled partly on GDPR’s Data Protection Authorities (DPAs) — the national regulators in EU member states that enforce Europe’s data protection rules. Ireland’s DPA, for example, is the lead regulator for Meta, Google, and Apple (all EU-headquartered). It has levied billions in fines. That’s the model. India isn’t there yet. Where enforcement stands now</h2> Here is the honest picture as of mid-2026. The DPDP Rules are notified and the Board is established. But the DPBI has not yet issued major fines under the DPDPA. Its core penalty powers and most company duties are still phasing in through 2027. So the near-term reality is guidance and preparation, not headline penalties. One piece of enforcement infrastructure has been active for years: CERT-In’s 6-hour breach notification requirement. Companies must report significant data breaches to India’s cybersecurity agency within 6 hours of discovery. This predates the DPDPA and operates separately from it. It is real, and some companies have been pulled up for non-compliance. But CERT-In’s mandate is national cybersecurity, not individual privacy rights. If your data gets sold by a telecom company or scraped by a data broker, CERT-In is not the body you would complain to. What this means for companies</h2> The enforcement gap creates a perverse incentive. Companies that updated their privacy policies after August 2023 deserve credit for the paperwork. Most stopped there. Actual data practices — how long data is retained, who it’s shared with, whether erasure requests are processed — remain largely unchanged. Grievance officers are listed on websites because the law requires it. Whether those officers actually respond to requests is another question. Some larger Indian tech companies and multinationals with GDPR exposure have done genuine compliance work. GDPR penalties are real and enforceable now, which creates pressure that cascades into global privacy practice. But a domestic startup collecting your data for a fintech app? The calculus is different. Why spend on compliance infrastructure for a regulator that hasn’t penalized anyone? This isn’t cynicism — it’s rational behavior under the current incentive structure. What you can still do</h2> The DPDPA gives you rights regardless of whether the DPBI is enforcing them. And some of those rights can be exercised directly. Right to access and right to erasure can be triggered by writing to a company’s grievance officer. Every Data Fiduciary must appoint one under Section 13 of the act. This obligation applies to all Data Fiduciaries, not just Significant Data Fiduciaries. You do not need the DPBI to exercise these rights. You write the letter, and they are legally obligated to respond. Practically, many companies will not respond promptly. Some will not respond at all. But the legal obligation exists, and documented non-response strengthens any future complaint once the DPBI’s powers are fully in force. You are building a paper trail. For a step-by-step guide on actually exercising these rights — what to write, who to contact, what to do when they ignore you — read our DPDPA rights practical guide</a>. The GDPR comparison: this changes</h2> GDPR became law in May 2018. For the first two years, enforcement was slow. Fines were small. Companies hedged. Privacy professionals inside large companies struggled to get budget. Then, in May 2023, Ireland’s Data Protection Commission fined Meta €1.2 billion for transferring EU user data to the US without adequate safeguards. Suddenly, every board of directors in Europe had a data protection agenda item. Privacy teams got headcount. Compliance budgets appeared. India is following a similar trajectory. The DPBI is now established and its powers are phasing in. The first large enforcement action, probably against a major platform or a telecom operator, will reshape how Indian companies think about data privacy overnight. The companies building genuine DPDPA compliance now will be ready. The companies treating it as optional will scramble. That’s not speculation; it’s what happened in Europe, and the incentive structures are the same. The question isn’t whether DPDPA enforcement arrives. It’s when — and whether your data will be better protected by then, or still sitting in dozens of databases you’ve never authorized. What you can do right now</h2> Want to see what data brokers expose about you? See what a scan finds →</a> shows an example report: the kinds of sites that list your name, phone, and address. Once KnytX Shield launches it will find and remove these automatically. Join the waitlist</a> to get in early. Your Old Yahoo Account Is Still Out There Unknown — Fri, 20 Mar 2026 00:00:00 +0000 In July 2016, Verizon announced it would acquire Yahoo for $4.8 billion. Two months later, in September 2016, Yahoo disclosed a breach of 500 million accounts. In December 2016, Yahoo disclosed a second breach, this one of 1 billion accounts from 2013. In October 2017, Yahoo revised that figure upward to 3 billion, which was every account Yahoo had ever created. Verizon renegotiated the acquisition price down by $350 million. The breached accounts included people who had opened a Yahoo Mail account in 2002 to get a free email address, used it for six months, then stopped thinking about it. Those accounts still existed. They still had names, birth dates, security questions, and alternate recovery addresses attached. The people who created them had no idea they were still in Yahoo’s database, and no idea they were now in someone else’s. The breach was not an edge case. It was the logical outcome of a structural fact about email accounts. They do not expire on their own. They accumulate sensitive data passively over years. And they stay accessible via credentials most people have not changed in a decade. The short answer: A dormant email account is a live security risk because it still holds password reset links, bank alerts, and recovery addresses for accounts you use today. If an attacker gets in, they can reset passwords on your current bank and health accounts. Fix it in three moves. First, find your old accounts by searching your inbox for “welcome” and “account created.” Second, check each address on HaveIBeenPwned. Third, delete the account or reactivate it with a new 16-character password and two-factor authentication. Then update every recovery email that still points to an old address. What Your Old Email Account Actually Contains</h2> A dormant email account is not an empty container. It is a warehouse of activity logs that built up during every year the account was nominally active. It holds categories of data more sensitive than most people recognize until they go look. Purchase receipts: every order confirmation from Amazon, Target, Etsy, or any online retailer that sent a receipt to that address. These receipts include the delivery address — your home address — and the item description. A decade of purchase receipts is a detailed behavioral profile. Flight and travel confirmations: hotel bookings, rental car confirmations, airline itineraries. These show where you traveled and when. They can name the people who traveled with you if a booking was shared, and your passport or driver’s license number if the booking required it. Medical appointment reminders: calendar confirmations from physicians, dentists, mental health providers, and specialist clinics. These do not say what the appointment was for in most cases, but they do name the provider and the date. Bank and financial account notifications: monthly statement alerts, low balance warnings, wire transfer confirmations. These reveal which institutions held your accounts and often include partial account numbers. If your bank sent statements to that address for five years, the archive of those notifications describes your financial history. “Account created” confirmation emails for services you no longer remember: forums, subscription services, online stores, apps, social platforms. These emails contain the username you registered with and frequently the password in plaintext, sent as confirmation at the time of account creation. In 2010 and 2011, many services did this. And then there is the category that creates the most immediate security risk: password reset emails. Every time you clicked “forgot password” on any service and had a reset link sent to that old Yahoo address, the reset token arrived in that inbox. If an attacker gains access to the dormant account, they can initiate new password resets on every service associated with it, including services you use actively today. Why Old Email Addresses Are the Primary Key in Data Broker Databases</h2> Data brokers compile records by matching fragments from different data sources against a common identifier. The identifier they rely on most is the email address, because it appears across more datasets than any other consistent piece of personal information. Your name appears in many forms. Your address changes. Your phone number changes. Your email address, particularly an old one you created under your real name, appears consistently across breach datasets, public records, marketing lists, and purchase history files. An old Hotmail address from 2005 that appears in seven different breach datasets is, for a data broker, a rich anchor point. It links records from a social network breach, a retail loyalty program, a forum membership, and a financial service. Each of those records adds attributes: job history, political donations, purchase categories, forum posts, location history. The dormant address you stopped thinking about in 2008 is the key that joins all of it together. The practical consequence is that your digital privacy posture today depends partly on the security of accounts you may not have thought about for years. If that address is compromised, every attribute attached to it becomes accessible as a linked record. The same old address is also what lets people-search brokers like Spokeo</a> and Whitepages</a> join your scattered records into one profile. The Two Active Threat Patterns</h2> Two specific attacks target dormant email accounts, and both are running continuously. Credential stuffing. When the 2016 Yahoo breach data was sold on criminal forums and eventually dumped publicly, it included email addresses and their associated hashed passwords. Password cracking tools process these hashes against known patterns and common wordlists. For any account where the user’s password followed a predictable pattern — a word plus a number, a pet name, a birth year — the hash cracks quickly. Automated tools then try that email and password combination against hundreds of other services: banks, social media platforms, investment accounts, health portals, government benefit systems. This is credential stuffing. It does not require any particular sophistication. It requires only a breach dataset and automation. Say you used “yahoo123” as your Yahoo password in 2008, and a variation of that pattern on your bank’s website. You are in the at-risk population for every service where that pattern holds. The fact that you have not logged into Yahoo in fifteen years does not stop a credential stuffing</a> tool from trying those credentials on your current accounts. The account recovery attack. This is the scenario that catches people most off guard. In 2013, you opened an account with your regional bank. The bank asked for a recovery email address. You entered your old Yahoo address because that was the address you used for financial correspondence at the time. In 2018, you changed banks. You have not thought about that account in years. But the old bank still has your account in its system, and your recovery email is still the Yahoo address. An attacker who gains access to your old Yahoo inbox can initiate a “forgot password” request on the old bank account. The reset link goes to Yahoo. They click it. They now control your bank account. The same sequence applies to any service that still holds a recovery address pointing to a dormant inbox. The Breach Datasets You Are Probably In</h2> Troy Hunt’s HaveIBeenPwned service, at haveibeenpwned.com, aggregates breach datasets and allows anyone to search for an email address. The most widely circulated datasets, all of which are available on the service, include the 2012 LinkedIn breach (117 million records, publicly dumped in 2016 and containing plaintext and SHA-1 hashed passwords), the 2012 Dropbox breach (68 million records, released publicly in 2016), and the 2016 MySpace breach (360 million records, including email addresses, usernames, and weakly hashed passwords). In January 2024, a dataset researcher published what became known as the Mother of All Breaches, or MOAB. It was a single aggregated file containing roughly 26 billion records compiled from hundreds of individual breaches. This was not a new breach; it was a compilation of existing breach data. But its scale demonstrated how easily dormant account data persists and circulates years after the original incident. If you enter an old email address into HaveIBeenPwned and it returns breach results, the data from those breaches is available to anyone with the motivation to look for it. The fact that you stopped using the address does not remove it from those datasets. Finding Your Dormant Accounts</h2> Most people significantly underestimate how many accounts they have created. For an adult online since the early 2000s, the practical upper bound is often 200 to 400 registered accounts. Most are dormant, and many are forgotten entirely. The most reliable discovery method starts in your current inbox. Search for the word “welcome” with no other filters. You will find every “Welcome to [Service]” email that was ever sent to your current address. Do the same search for “account created,” “thanks for registering,” and “verify your email.” The results give you a list of every service that ever sent to this address. Repeat the same searches in any old email accounts you still have access to. Then check your browser’s saved password list — Chrome, Firefox, and Safari all store this under settings — and your password manager if you use one. Every entry represents a registered account somewhere. HaveIBeenPwned accepts single email address queries for free. Enter each address you have ever used and note which breaches it appears in. This gives you two things: a list of addresses that are definitely compromised and in circulation, and a list of services that were breached where your account existed. What To Do With Dormant Accounts</h2> The options are deletion or secure reactivation. Both are better than leaving a dormant account in place with an old password. Deletion is preferable if you do not need the account. Yahoo Mail allows account deletion via the Yahoo Privacy Dashboard. The deletion takes 40 days to complete. Yahoo also warns that the username may be released for re-registration after a waiting period. That is a known issue: someone who registers your old username later would receive any emails still forwarded to that address. If services still have the address on file and send notifications to it, that creates a new problem after deletion. Before deleting, update any service still using the address as a contact or recovery address. Google’s inactive account policy now deletes accounts that have not been signed into for two years, following a policy announced in May 2023 and enforced starting December 2023. Microsoft’s Outlook and Hotmail accounts are deleted after two years of inactivity as well, though the policies have changed several times. Accounts opened before these policies took effect may still exist even if you have not logged in since 2010 — the policies are not retroactive in a guaranteed way. If you need to keep the account, reactivate it properly. Sign in and change the password to something unique and at least 16 characters. A password manager</a> makes this painless. Enable two-factor authentication</a>, then review the recovery settings so no old phone number or secondary email is still listed. The Linked-Account Time Bomb</h2> A compromised email account is not only a risk to that account. It is a risk to every service that uses that address as a login, a recovery method, or a notification destination. Google accounts have a “Security” section that lists all apps and services that have been granted access via Google Sign-In. Facebook has an “Apps and Websites” section in Privacy Settings that shows every service that was connected via Facebook Login. Apple’s Apple ID settings list every service where “Sign in with Apple” was used. Review each of these panels in every account. Any service listed in these panels can be accessed by someone who controls the connected email account. Say you signed into a health portal using Google in 2019, and that Google account’s recovery address points to a dormant Yahoo inbox. The chain then runs directly from the Yahoo breach to your health data. The audit is methodical but finite. Pull up Google, Facebook, and Apple’s connected apps lists. For each connected service, check what permissions were granted. Revoke connections that are no longer relevant. For services that are still active and important, switch the login method to something that does not depend on a vulnerable upstream account. The Account Recovery Audit</h2> Every financial account, healthcare portal, insurance provider, and government benefits account you hold has a recovery email on file somewhere. Most people set those recovery addresses during the account setup process and never revisit them. Log in to each of these accounts, go to the security or account settings section, and check what email address is listed for recovery notifications and password resets. Look for any address you no longer fully control: an old Yahoo, Hotmail, or AOL address, or an email from an ISP you left years ago. Update it to a current address immediately. The services where this matters most: banks and credit unions, brokerage and investment accounts, the Social Security Administration’s my Social Security portal, state DMV accounts, health insurance provider portals, Medicare and Medicaid accounts, utility accounts, mortgage servicing accounts. These are the accounts where unauthorized access creates the most direct financial or legal harm. The Practical Step-by-Step</h2> Search your current inbox for “welcome,” “account created,” “thanks for registering,” and “verify your email.” List every service that appears. Do the same in old inboxes you can still access. Check every old email address on HaveIBeenPwned. Note which addresses appear in breaches and which breaches are listed. For each dormant account you find: decide whether to delete or reactivate. If deleting, first update every service that still uses that address as a contact or recovery email. If reactivating, change the password, enable 2FA, and clear out old recovery settings. Open Google Account Security, Facebook Apps and Websites, and Apple ID Passwords and Security. Review every connected app. Revoke connections that are no longer needed. Log in to every financial, health, and government account you hold. Check the recovery email address. Update any that point to old addresses. The total time for someone with a moderate online history is two to four hours. The risk it eliminates is a decade of exposure that most people do not know they have. KnytX Shield is built to watch all your email addresses for broker exposure — including the ones you forgot about →</a> It isn’t live yet; join the waitlist</a> to get in early. Pig Butchering: The Scam That Grooms for Months Unknown — Thu, 19 Mar 2026 00:00:00 +0000 In 2022, a software engineer in San Francisco lost $1.5 million to a months-long WhatsApp relationship. He believed he had met the woman by coincidence. She messaged him first, a wrong number, she said, looking for a restaurant recommendation. They talked daily for weeks. She was warm and intellectually curious. She mentioned that her uncle worked in finance and had introduced her to a cryptocurrency trading platform with remarkable returns. She was not pushy about it. She mentioned it the way someone mentions a good restaurant. He tried it. He made money. Then he deposited more. Then he lost everything, and the woman, the platform, and everyone he had been speaking to disappeared. ProPublica and the New York Times both documented this case and dozens like it across 2022 and 2023. The money was gone. There was no recourse. The FBI received more than 40,000 investment fraud complaints in 2023, when IC3 logged $4.57 billion in losses. The short answer. Pig butchering is a long-con investment scam. A stranger builds a warm relationship with you for weeks or months, usually over WhatsApp or a dating app, then introduces a fake crypto trading platform. Small early withdrawals work, which builds trust, so you deposit more. When the balance is large, withdrawals suddenly fail and “tax” or “fee” payments are demanded. The platform is fake and the money is gone. The red flags: a stranger made accidental-looking first contact, the investment came only after personal bonding, and the platform isn’t listed on FINRA BrokerCheck or the SEC’s EDGAR. Verify any platform before you send a dollar. This scam type has a name: pig butchering. The name comes from a Chinese phrase, 杀猪盘 (shā zhū pán), which translates roughly to “pig slaughter plate.” The metaphor is agricultural and deliberate. You fatten the pig before you slaughter it. Rushing the process produces a smaller yield. The scam is optimized for patience. What Pig Butchering Is</h2> Pig butchering is a form of investment fraud that combines extended social engineering with a fake trading platform. Unlike a phone scam that resolves in a single call, pig butchering operates over weeks or months. The relationship-building phase is not incidental to the scam — it is the mechanism. By the time the victim deposits money into a fraudulent investment platform, they trust the person who introduced it. That trust has been built deliberately, over dozens of conversations, personal disclosures, shared experiences, and emotional intimacy. The operation originated in Southeast Asia and expanded globally over the following decade. Investigative reporting by the International Justice Mission, the Associated Press, and Al Jazeera documented the conditions inside the scam compounds in Myanmar, Cambodia, and the Philippines where this work is performed. Many of the individuals running scripts on the other end of these WhatsApp conversations are themselves victims. They are trafficked workers, recruited with fake job advertisements for legal employment, then forced to run fraud scripts under threat of violence. The BBC estimated in 2023 that hundreds of thousands of people were being held in these compounds across the region. Understanding the origin matters for one practical reason: the person you are speaking to is operating from a script. They are not a rogue individual. They are part of a production system with defined roles, shift schedules, and performance metrics. The warmth, the coincidental first contact, the gradual escalation — all of it is documented procedure. The Five-Stage Playbook</h2> The scam follows a sequence that fraud researchers have mapped with enough precision that it reads like a flowchart. Stage 1: The chance contact. The first message is designed to look like a mistake. A wrong number. An accidental connection request on LinkedIn. A match on a dating app where the person seems unusually thoughtful and almost too compatible. The accidental framing is important because it explains why a stranger is reaching out and removes any suspicion of targeting. The conversation that follows is light and without any financial dimension. Weeks may pass before money is mentioned at all. Stage 2: Trust-building. Daily contact, genuine-seeming personal disclosures, photos, voice messages, sometimes video calls using real footage or deepfake technology. The person playing the role of the new friend or romantic interest is trained to mirror the target’s interests and emotional needs. If the target expresses loneliness, the contact provides companionship. If they express financial stress, the contact demonstrates financial success. Every conversation is moving toward a specific destination, but nothing about it feels transactional. This stage can run for two to three months. Stage 3: Platform introduction. The investment platform is introduced casually and with apparent reluctance. The contact does not pitch it. They mention it offhandedly, then downplay it when the target shows interest. They explain that their uncle set up the account for them, that it is not really something they discuss, that they feel awkward recommending financial products to friends. This friction is manufactured. It functions as social proof: something that must be extracted is more valuable than something freely offered. The target eventually asks to be shown how the platform works. Stage 4: The profit run-up. The target deposits a small amount — a few hundred dollars. The platform shows immediate gains. The interface looks real: live charts, order books, trade confirmations, a customer service chat. The target deposits more. Gains continue. At this stage, the fraudulent platform is showing the target a number that represents money they do not have. There is no actual investment activity. The UI is displaying whatever figure the operators choose to display. The target may withdraw small amounts early on, and those withdrawals go through — this is intentional. It proves the platform is real. The target tells friends. Some of them join. Deposits grow. Stage 5: The slaughter. When deposits reach a target threshold — typically in the tens or hundreds of thousands of dollars — withdrawal attempts begin to fail. The customer service team explains that a tax payment is required before funds can be released. Or a compliance fee. Or an account verification charge. The contact, still present, encourages the target to pay it. The tax is paid. A new fee appears. Each payment extracts more money. Eventually the platform goes dark, the contact disappears, and the money is gone. How the Fake Platforms Work</h2> The investment platforms used in these scams are custom-built software. They have real domain names, SSL certificates, professional design, and live-looking market data pulled from legitimate sources to make charts and price feeds look authentic. They display fake account balances, fake trade histories, and fake profit summaries. The customer support team is part of the operation. Some platforms have impersonated real, regulated financial institutions. The Financial Industry Regulatory Authority (FINRA) maintains a BrokerCheck tool at finra.org/brokercheck that lists registered US broker-dealers and investment advisers. The Securities and Exchange Commission’s EDGAR database at sec.gov/cgi-bin/browse-edgar lists registered investment entities. When a platform claims to be SEC-registered, the registration number can be verified directly. Pig butchering platforms either use fabricated registration numbers, stolen registration numbers from real dormant entities, or jurisdiction-shop to countries with minimal oversight. The profit run-up mechanism works because the victim never actually withdraws their full balance. They see a number. They may withdraw a small portion, which goes through. But the large balance exists only as a number on a screen. The operators control what that number says. Why Intelligent Adults Fall For It</h2> The fraud exploits specific psychological mechanisms that have nothing to do with intelligence. A software engineer, a physician, a retired executive — these are among the documented victims because the scam is not designed to fool people who are credulous. It is designed to fool people who are forming genuine social bonds. The first mechanism is manufactured social proof. The contact is not a stranger; by the time the platform is introduced, they are someone the victim has spoken to every day for weeks. The victim has met their “family” in photographs. They know details about the contact’s life that feel intimate. The recommendation comes from within an established relationship. The second mechanism is gradual escalation. The first deposit is small enough to feel like an experiment. Each subsequent deposit is anchored to the previous one and to the visible balance in the account. When someone has $47,000 showing in an account, depositing another $3,000 to bring it to $50,000 feels proportionate to what they have already committed. The third mechanism is sunk cost. Once a victim has lost $200,000 and been told that paying $30,000 in “tax” will release the funds, the $30,000 looks like 15% of recovery rather than more loss. The operators understand this and time the fees to arrive when the victim’s sunk cost is high enough that the fee looks rational by comparison. The fourth mechanism is the exploitation of loneliness and connection. Many victims describe the relationship that preceded the fraud as genuinely important to them. The loss is not only financial. There is a compound grief: the money is gone, and so is someone who felt real. Contact Vectors</h2> The wrong-number contact on WhatsApp is the classic delivery method, but the operation runs across every platform where strangers talk. LinkedIn contacts claiming to be in finance or tech who want to connect over shared professional interests. Instagram DMs from accounts with hundreds of posts and a plausible personal history. Dating app matches, particularly on Hinge, Tinder, and Bumble, where the match is attractive and unusually communicative. Telegram groups around investing topics where a participant begins a private conversation. The scripted openers are recognizable once you know them. The accidental message. The “I got your number from a mutual friend.” The “I noticed your profile and thought you seemed interesting.” The platform introduction always follows a trust-building period, and always arrives as something the contact is reluctant to recommend. Scale and the Southeast Asia Connection</h2> The FBI Internet Crime Complaint Center’s 2023 Internet Crime Report documented $4.57 billion in investment fraud losses in 2023, up from $3.31 billion in 2022. Investment fraud was the single largest category of reported cybercrime losses. The report notes that cryptocurrency was the dominant payment method and that losses for victims aged 30 to 49 increased by the largest margin year-over-year. These numbers represent only reported losses. Victims frequently do not report because of shame, because they believe it will not help, or because they do not realize what has happened to them until months later. The connection to human trafficking is documented and ongoing. The compound workers identified by the International Justice Mission and investigative journalists are people who responded to legitimate-looking job postings for hotel, casino, or tech support jobs in Southeast Asia. They were transported across borders, had their travel documents confiscated, and were forced to operate fraud scripts under threat of beatings, starvation, or sale to other compounds. The UN Office of the High Commissioner for Human Rights (OHCHR) estimated in an August 2023 report that over 220,000 people were being held in Myanmar and Cambodia alone. The financial system powering the scam depends on this labor. Red Flags That Distinguish This Scam</h2> Several specific indicators differentiate pig butchering from a legitimate investment opportunity. A stranger initiated the contact, and it felt accidental. The investment platform was introduced only after weeks of personal conversation. The platform is not listed with any domestic regulator — verification takes two minutes on FINRA BrokerCheck or the SEC’s EDGAR. The contact is enthusiastic about the investment but oddly reluctant to recommend it directly. Early withdrawals of small amounts succeed, which functions as proof-of-concept for larger deposits. When a larger withdrawal is attempted, fees are required before release. Customer support for the platform exists only within the app and cannot be independently verified. Any single one of these is a reason to stop. The presence of multiple is decisive. What To Do If Money Is Already Gone</h2> The honest answer is that recovery is rare and that the likelihood decreases with time and with how funds were moved. Act immediately. File a complaint with the FBI’s Internet Crime Complaint Center at ic3.gov. The IC3 forwards complaints to federal, state, and local law enforcement and can initiate coordination with international partners. File a complaint with the FTC at reportfraud.ftc.gov. Contact your bank’s wire fraud department on the same day you realize the fraud occurred. Banks can sometimes start a wire recall within 24 to 72 hours of a fraudulent transfer, though success rates are low. If funds went to cryptocurrency wallets, firms including Chainalysis and Elliptic specialize in tracing blockchain transactions and have worked with law enforcement on seizure actions. The DOJ announced seizures of over $112 million in pig butchering proceeds in April 2023, coordinated with law enforcement in multiple countries. These seizures are real but represent a small fraction of total losses. Be wary of “recovery services” that promise to retrieve cryptocurrency for an upfront fee. These are almost always secondary scams that target people who have already lost money, as covered in the guide to recovery scams</a>. Zelle, wire transfers, and cryptocurrency are the preferred payment methods in these scams for a reason. They are difficult or impossible to reverse, unlike credit card payments, which carry dispute rights under the Fair Credit Billing Act. If a victim used a credit card to buy cryptocurrency and then transferred that cryptocurrency, the card-level dispute may still be viable. Raise it with the card issuer immediately. The psychological impact of these scams is substantial. The Cybercrime Support Network at fightcybercrime.org maintains referrals to counselors and support groups that specialize in fraud victims. KnytX Scam Shield isn’t live yet. Once it launches, it’s built to flag fraudulent investment contacts before they ever reach your wallet. See how Scam Shield is designed to work →</a> Your DPDPA Rights: How to Actually Use Them Unknown — Wed, 18 Mar 2026 00:00:00 +0000 Your phone rings at 7:43 AM. Unknown number. A loan app you downloaded two years ago — and deleted — is offering you a pre-approved credit line. You never gave them permission to call. You’re not sure how they still have your number. And you have absolutely no idea how to make it stop. That’s the situation millions of Indian consumers are in right now. The Digital Personal Data Protection Act 2023 (DPDPA) gives you real, enforceable rights over this data. The problem isn’t the law. The problem is that companies are counting on you to find the process too confusing, too slow, or too unclear to bother with. This guide removes that excuse. Not what the law says (you can read that elsewhere), but exactly what you do, step by step, to exercise your rights today. The short answer: The DPDPA gives you four statutory rights, and erasure (Section 12) is the one most people should use first. To exercise it, find the company’s grievance officer, send a written erasure request naming the specific data, and keep a dated copy. The template below is ready to send. If they ignore you, escalate to the grievance officer again, then to the Data Protection Board of India, whose powers are phasing in through 2027. What DPDPA actually gives you</h2> The DPDPA creates four statutory rights for data principals — that’s you, any individual (regardless of citizenship) whose personal data is processed in India. The four statutory rights under the DPDPA 2023: Right to Access (§11): Ask any company what personal data they hold on you and how they’re using it.</li> Right to Correction & Erasure (§12): Demand they fix inaccurate or outdated data. You can also require them to delete your data when you withdraw consent or when they no longer need it.</li> Right to Grievance Redressal (§13): Every Data Fiduciary (any company processing your data) must have a grievance officer you can contact.</li> Right to Nomination (§14): Designate someone to exercise your rights on your behalf in the event of death or incapacity.</li> </ul> These rights exist. They apply to every company operating in India that processes Indian residents’ data. What they don’t have yet is teeth — and we’ll get to that honestly in a later section. The right most people should use first: erasure</h2> The DPDPA data deletion request — formally, the right to erasure — is the most powerful right for most people. It’s the one that actually removes your data from a company’s systems, not just flags it. Here’s what erasure covers: any personal data the company collected with your consent, once you withdraw that consent. Data collected for a specific purpose that is now complete. Data collected when you were a customer, after you’ve stopped being one. Here is what it does not cover. Data a company must retain under law (tax records, KYC under RBI rules, court orders). Data processed for legitimate interests that override yours. And data involved in ongoing legal disputes. A bank cannot delete your loan history just because you ask. Jio cannot delete your billing records while telecom regulations require it to hold them. So before you send a request, identify who actually holds your data. This step is non-obvious. Your name and phone number from a loan app inquiry four years ago is probably sitting in the databases of three credit bureaus, two lead-generation companies, and the original lender. You need to know who has it before you can ask for deletion. The fastest way to find that out is a scan. See what a scan finds →</a> walks through an example report of the data broker and company databases that can list your information. KnytX Shield isn’t live yet; join the waitlist</a> to run your own at launch. How to send a DPDPA erasure request</h2> Once you know who holds your data, the process has four steps. Step 1: Find the company’s Grievance Officer. Every Data Fiduciary regulated under DPDPA is legally required to appoint a Grievance Officer and publish their contact details. Look in the company’s privacy policy — it should be there. If it’s not, that itself is a violation you can report. For large companies like Flipkart or Airtel, the Grievance Officer details are usually in the footer of their website under “Privacy Policy” or “Contact Us.” Step 2: Write a formal erasure request. This needs to be in writing — email works. Keep a copy. Step 3: Be specific about what you want deleted. Vague requests get vague responses. Name the data: your mobile number, your Aadhaar-linked profile, your purchase history, your location data. The more specific you are, the harder it is for the company to claim they didn’t understand what you were asking. Step 4: Send it and note the date. You’re creating a paper trail. If they ignore you, this becomes your evidence. Here’s a template you can use immediately: Subject: Request for Erasure of Personal Data — DPDPA 2023, Section 12 To: [GRIEVANCE OFFICER NAME] [COMPANY NAME] [COMPANY EMAIL] Date: [DATE] Dear [GRIEVANCE OFFICER NAME], I am writing to formally request the erasure of my personal data held by [COMPANY NAME], in accordance with my rights under the Digital Personal Data Protection Act 2023 (DPDPA), specifically Section 12 (Right to Correction and Erasure). My details: - Full Name: [YOUR FULL NAME] - Registered Mobile Number: [YOUR MOBILE NUMBER] - Registered Email Address: [YOUR EMAIL ADDRESS] - Account/Customer ID (if known): [ACCOUNT ID] I hereby withdraw any consent I previously provided for the processing of my personal data. I request that [COMPANY NAME] permanently delete all personal data it holds relating to me, including but not limited to: name, mobile number, email address, physical address, Aadhaar-linked data (if any), browsing or usage history, and any derived or inferred profile data. Please confirm in writing: 1. That this request has been received and logged. 2. The timeline within which erasure will be completed. 3. Any data that will be retained and the legal basis for retention. If any portion of this request cannot be fulfilled, please provide the specific legal basis for retention as required under the DPDPA. I expect acknowledgment of this request within a reasonable time, and full response no later than the timeline stipulated by applicable rules. Regards, [YOUR FULL NAME] [YOUR MOBILE NUMBER] [YOUR EMAIL ADDRESS] [DATE] </code></pre> Send this to the Grievance Officer directly. CC your own email address so you have a timestamped copy. What is a company required to do with your request?</h2> Under the DPDPA, companies must acknowledge your request and either fulfill it or provide a written refusal with legal grounds. The honest reality on timelines: the core Act itself does not specify a number. It says “without undue delay,” which is deliberately vague. The DPDP Rules 2025, notified on 13 November 2025, set out the operational detail. But most of the substantive compliance obligations they carry phase in through 2027, so the binding response deadlines are still ramping up rather than uniformly in force today. A valid refusal must cite a specific legal basis: a law requiring retention (like SEBI regulations for financial records), an ongoing contractual obligation, or a public interest ground. “We need it for analytics” is not a valid refusal. “We need it for our marketing” is not a valid refusal. What acknowledgment should look like: a written confirmation with a reference number, the name of the officer handling it, and a stated timeline. If you get an automated “we received your email” with no follow-up within two weeks, treat that as non-compliance and move to escalation. What can you do when a company ignores you?</h2> Most companies will respond when they receive a formal DPDPA erasure request. Not out of civic spirit. It is because Grievance Officers know a complaint to the Data Protection Board of India (DPBI) creates documentation they would rather avoid. The process: Step 1: Re-contact the Grievance Officer with a follow-up email referencing your original request, citing the date and reference number. Step 2: Escalate to the DPBI. The Data Protection Board of India is the adjudicatory body under DPDPA. As of mid-2026, the Board has been formally established, and the DPDP Rules were notified in November 2025. But its full adjudication powers and the main complaint-handling machinery phase in through 2027. This is the honest picture: escalating to the DPBI is possible in principle, but the response timelines are still settling. Step 3: Civil remedies. Section 32 of the DPDPA preserves your right to seek remedies through civil courts independently. This is a longer, more expensive path — but it’s real. What this means in practice: the threat of a DPBI complaint carries more immediate weight than the complaint itself right now. Document everything. Send a final written notice to the company stating you will file with the DPBI. For large companies with legal teams, that letter alone often produces results. DPDPA vs GDPR: the key differences</h2> If you’ve read about GDPR — Europe’s data protection law — and wondered how DPDPA compares, here’s what actually matters for you as an Indian consumer. Enforcement: GDPR has active enforcement with real penalties. The Irish Data Protection Commission fined Meta €1.2 billion in 2023. DPDPA enforcement is not yet active at that scale. The DPBI is established, and its rules are notified, but its full powers phase in through 2027. This gap will close, but it is real today. Scope: GDPR covers all EU residents’ data, regardless of where the company processing it is located. DPDPA covers data principals located in India — Indian residents whose data is processed. It also applies to companies outside India that offer goods or services to Indian residents (the extraterritorial clause). So foreign apps processing your data are covered. Consent withdrawal: Both laws give you the right to withdraw consent. Under GDPR, withdrawal must be as easy as giving consent — if you ticked a box, you must be able to untick it. DPDPA requires consent withdrawal to be “as easy to withdraw as it was to give,” similar language. In practice, companies build friction into the withdrawal process (buried settings, multi-step forms). That friction is itself a compliance failure. Data portability: GDPR has an explicit right to data portability — receive your data in a machine-readable format and move it to another provider. DPDPA does not include an explicit portability right in the current text. This is a meaningful gap. The key takeaway: if a company also processes EU residents’ data, they’re already GDPR-compliant and your DPDPA request will likely land in a workflow they already have. That often means faster responses. The companies most worth targeting</h2> Not all data deletion requests are equally productive. Here’s where your data is most likely to be held, and which companies are most likely to actually respond. Telecom operators — Jio, Airtel, Vi — hold your Aadhaar-linked KYC data, call records, location history, and sometimes financial data. They’re heavily regulated, have established Grievance Officer processes, and respond to formal requests. They’ll retain some data under TRAI and DoT obligations (call detail records for 1 year minimum), but they can delete marketing profiles and third-party sharing consents. Banks and NBFCs hold your PAN, Aadhaar, income data, transaction history, and credit behavior. They must retain core financial records under RBI guidelines, but they can delete marketing opt-ins, third-party data sharing permissions, and profile data from discontinued products. E-commerce platforms — Flipkart and Amazon India — hold your address book, purchase history, browsing behavior, wishlist data, and payment method details. Neither is required to retain most of this under law. These are among the most productive targets for erasure requests because the legal retention basis is thin. Health apps hold some of the most sensitive data you’ve ever shared — symptoms, diagnoses, menstrual cycles, medication history. Health data is personal data under the DPDPA, with heightened obligations applying to Significant Data Fiduciaries designated by the central government — not tiered by data category. Apps like PharmEasy, Practo, and 1mg have this data. They are high-priority targets. Loyalty programs — airline frequent flyer programs, retail reward cards, hotel points programs — hold behavioral data going back years. If you’ve left a program, you almost certainly have no ongoing relationship that justifies retention. These are often the easiest wins. Data brokers and lead-generation companies are the hardest to target directly under DPDPA. These are companies you have never directly interacted with, but who still hold your data. The problem is that identifying them requires knowing they exist. This is where a data scan tool becomes useful before you start filing requests. Do you know how many companies currently hold a profile on you? Most people guess three to five. The actual number is typically closer to forty to sixty, including companies in sectors they’ve never interacted with directly. What you can do right now</h2> Want to see what data brokers expose about you? See what a scan finds →</a> shows an example report: the kinds of sites that list your name, phone, and address. Once KnytX Shield launches it will find and remove these automatically. Join the waitlist</a> to get in early. Online Anonymity: A Practical Guide by Threat Level Unknown — Tue, 17 Mar 2026 00:00:00 +0000 In 2014, a New York Times reporter named Glenn Greenwald was trying to contact Edward Snowden. Snowden had encrypted files to share and a specific, urgent request: Greenwald needed to set up PGP email encryption before any files would change hands. Greenwald had been too busy to do it. He was, by the standards of a technology reporter at a major newspaper, reasonably sophisticated about security. He almost missed the biggest national security story in a decade because he didn’t know how to set up basic encrypted email. That’s the gap this guide addresses. Not the theoretical gap between ordinary people and nation-state surveillance. It’s the practical gap between what most people believe protects them and what actually does, and where that gap matters. The short answer: There is no single “anonymous” setting. Anonymity is always relative to a specific adversary, so start by naming who you’re hiding from. For most people, the threats are data brokers, advertisers, and stalkers, not the NSA. Tier 1 (a password manager, hardware 2FA, uBlock Origin, broker opt-outs) and Tier 2 (a vetted VPN, email aliases, private DNS) cover almost everyone. Tier 3 (Tor, Tails, Whonix, Monero) is for high-risk work and adds real friction, so only reach for it when your threat model demands it. Jump to: Choose your threat model</a> · Tier 1: baseline privacy</a> · Tier 2: reduced footprint</a> · Tier 3: strong anonymity</a> · The limits of all of this</a> Before choosing a tool, choose your threat model</h2> The single biggest mistake in privacy advice is treating anonymity as a binary: you have it or you don’t. In practice, anonymity is always relative to a specific adversary. The question isn’t “am I anonymous?” It’s “who am I hiding from, and what do they have the capability and motivation to do?” This changes everything. Most people need protection from three things: data brokers selling their purchase history to insurers, advertisers building behavioral profiles, and stalkers or abusive ex-partners. A people-search site can hand any of them a home address. They don’t need to evade NSA signals intelligence. These are fundamentally different problems with different solutions. Conflating them produces security theater: expensive, time-consuming measures that don’t address the actual threat while neglecting simple fixes that would. A few questions to ask yourself: Who is most likely to harm you using your digital information? A corporation monetizing your data is different from a harassing ex-partner, which is different from a government. Their tools, their motivations, and their legal constraints are different. What do you most need to protect? Your location from a stalker. Your identity from a doxxing campaign. Your communications from an employer. Your financial history from an insurance company. Each has a different protection strategy. What are you willing to give up for privacy? Tor Browser is slow. Tails OS requires rebooting your computer every session. Air-gapping a device means it’s useless for half of what you might need. Trade-offs are real. With that framing established, here’s what each tier actually gets you. Tier 1: Baseline privacy — what everyone should already be doing</h2> These measures don’t require any significant inconvenience. Not having them is indefensible for anyone who cares about their own data. Password manager with unique passwords per site</h3> Most successful account takeovers don’t happen through sophisticated hacking. They happen through credential stuffing</a>: automated attacks that take email and password combinations leaked from one site and try them everywhere else. When LinkedIn leaked 6.5 million password hashes in 2012 (later revealed to be 117 million), anyone who reused that password was exposed everywhere at once. That covered their bank, their email, and their health portal. A password manager solves this completely. Use a different, randomly generated password for every site. When a breach happens, it’s contained to that site. Bitwarden is open source, audited, and free. 1Password is the well-regarded commercial option. Either one puts this problem behind you. Hardware security key for two-factor authentication</h3> You’ve been told to enable two-factor authentication. You probably did, with SMS, which sends a code to your phone. Here’s the problem: SMS 2FA is vulnerable to SIM swap attacks</a>. An attacker calls your mobile carrier, claims to be you, claims they got a new phone, and asks for your number to be transferred to their SIM. Carriers have poor verification. This attack is common enough that the FBI issued a warning about it. It has been used to drain cryptocurrency wallets, take over email accounts, and bypass account recovery on social media. A hardware security key operates on FIDO2/WebAuthn. YubiKey is the dominant brand, and Google’s Titan Key is the main alternative. The key performs a cryptographic operation locally that proves you physically possess the device. There’s no code to intercept. There’s no carrier to social-engineer. Phishing attacks that capture your password don’t help the attacker, because the key also verifies the site’s domain. You can’t be tricked into authenticating on a fake login page. Use hardware keys on your email, any financial accounts that support them, and your password manager. SMS 2FA is better than nothing. FIDO2 is in a different category. Encrypted email</h3> ProtonMail and Tuta (formerly Tutanota) both offer end-to-end encrypted email. When you email another ProtonMail user, the content is encrypted between your devices and never readable by Proton’s servers. But understand what this does and doesn’t protect. End-to-end encryption protects the content of messages. It does not protect metadata: who you emailed, when, how often, and from which IP address. Proton’s servers don’t read your emails, but they do know that your account exchanged messages with another account on a given date. This metadata is often more valuable than content. The NSA’s bulk collection programs focused heavily on metadata for a reason. Behavioral patterns from who-contacts-whom graphs are revealing even without reading a single message. For journalists, activists, or anyone whose contact network is itself sensitive, metadata is a serious concern. For most people, encrypted email primarily protects against the scenario where a company employee reads your emails or a breach exposes the contents of stored messages. That’s still worth having. Browser: Firefox or Brave with uBlock Origin</h3> Someone switches from Chrome to Firefox “for privacy.” The most important change isn’t the browser. It’s installing uBlock Origin in that browser. uBlock blocks the tracking pixels, analytics beacons, and ad network scripts that follow you from site to site. Installed in Firefox or Brave, it cuts off most behavioral tracking at the source. The choice between Firefox and Brave affects browser fingerprinting</a>. But at this baseline level, any browser with uBlock Origin installed is dramatically better than Chrome, which effectively serves as Google’s data collection endpoint. Don’t use Internet Explorer, Edge, or Opera for privacy-sensitive browsing. Edge phones home to Microsoft by default in ways that aren’t easily disabled. Opera sold a majority stake to a Chinese consortium in 2016 and its privacy practices have been questionable since. Remove yourself from data broker sites</h3> Data brokers are companies you’ve never heard of that maintain detailed profiles on you. A profile can hold your name, current and past addresses, family members, and phone numbers. It can also hold property records, estimated income, political donations, and purchase history. They sell this data to marketers, background checkers, and insurance companies. They also sell it to people looking for someone’s home address. Sites like Spokeo</a> and Whitepages</a> are the consumer-facing tip of this. Getting yourself out is unglamorous, repetitive work. There’s no single form to fill. Each broker has its own opt-out process, many of which are designed to be tedious. And they don’t stay removed. Brokers repopulate their databases from public records and resellers, so you have to repeat requests regularly. Google’s results about you tool and services like DeleteMe automate the tracking and re-submission. It costs money but saves time. Tier 2: Reduced footprint — for the privacy-conscious</h2> These measures suit a specific group. A researcher. A small business owner who doesn’t want competitors tracking their activity. Someone escaping a difficult personal situation. Or anyone who has started thinking seriously about what their digital life looks like to people who don’t mean them well. VPN — what it does and doesn’t do</h3> A VPN hides your traffic from your ISP. At the sites you visit, it replaces your IP address with the VPN server’s IP. That’s genuinely useful in two situations. First, if you don’t want your ISP logging your browsing (in the US, ISPs can sell this data). Second, if you want to make IP-based tracking across sites harder. What a VPN</a> does not do: it doesn’t stop fingerprinting, it doesn’t protect you from sites you’re logged into, and it doesn’t defeat tracker pixels. It also doesn’t make you anonymous. It shifts who you’re trusting from your ISP to the VPN provider. If the VPN provider keeps logs and receives a legal request, they hand them over. This makes the “no logs” audit question critical. Mullvad doesn’t require an email address to sign up — you get an account number, pay with cash if you want, and they have nothing to link to you. They’ve been audited and have proven they can’t produce logs because they don’t have them. IVPN is similar. These matter. A VPN company with unverified “no logs” claims is just another company with your browsing history. Avoid free VPNs entirely. The product is your traffic. Compartmentalization</h3> Your “identity” online isn’t a single thing. It’s whatever cross-references advertisers, data brokers, and bad actors can make between different pieces of your online presence. Keeping those pieces apart prevents the cross-references. At minimum: use separate browsers for separate activities. Shopping in Chrome (where you might be signed into Google) means Google gets your shopping data. Doing political research in the same browser means that data gets added to the same profile. Use Brave for general browsing and a separate Firefox profile for accounts that require a real identity. If the activity matters enough — business operations, activist work, anything you’re serious about separating — use a separate device. The point isn’t to create an alias. It’s to stop the single data profile from growing into a comprehensive map of your life. Email aliases</h3> Every time you give a website your email address, you’ve created a permanent link between you and them. When their database leaks — and it will — your real email address is now attached to your name, your account, and whatever else was in that breach. Spam follows. Phishing follows. If you used a variation of your email that reveals your name format, every future breach builds on that. SimpleLogin and addy.io let you create per-site aliases</a>: a unique address for each signup that forwards to your real inbox. Amazon.com gets one alias. A forum you post in gets another. If any alias starts receiving spam or breach notifications, you know exactly where it came from. You disable that alias without compromising your real address. This is a low-friction change with significant impact. Breaches still happen. This limits their blast radius. Privacy-respecting phone number</h3> Many services require a phone number for account verification. Your phone number is one of the most persistent identifiers attached to your real identity — it’s on your ID, linked to your mobile account, associated with your bank. Giving it to every app and service creates a trail back to you. Google Voice provides a free US number for this purpose, though Google has its own tracking concerns. MySudo gives you multiple phone numbers with separate identities. Hushed and Burner offer virtual numbers for temporary use. For high-sensitivity purposes, consider a prepaid SIM purchased with cash. DNS privacy</h3> When you type a web address, your device first asks a DNS server to translate that name into an IP address. By default, that request goes to your ISP’s DNS server. Your ISP logs every domain you query — this is separate from HTTPS content encryption and doesn’t require breaking your connection. It’s simply a record of every site you visit, in order. Cloudflare’s 1.1.1.1 with DNS-over-HTTPS encrypts your DNS queries and sends them to Cloudflare instead of your ISP. NextDNS goes further — it blocks known tracking and malware domains at the DNS level, works on all devices on your network, and logs nothing by default. Either eliminates ISP-level DNS surveillance. DNS leaks are also a known VPN problem: some VPN configurations still send DNS queries outside the tunnel to your default resolver, defeating the ISP privacy benefit. Confirm your VPN handles DNS inside the tunnel. Leaving Google’s ecosystem</h3> Google’s core business is the precise targeting of advertising. That requires knowing what you’re interested in, what you’ve searched for, where you’ve been, and what you’re likely to do next. Gmail, Google Search, Google Maps, Chrome, and Android are data collection infrastructure that happens to provide useful services. Kagi is a paid search engine ($5/month) with no ad model, no tracking, and high-quality results. SearXNG is a self-hosted or public-instance meta-search engine that doesn’t track queries at all. DuckDuckGo is the easiest switch and better than Google from a tracking standpoint, though its Bing results have quality limits. Request removal from Google’s search index through their removal tools. Revoke location history, app permissions, and ad personalization in your Google account if you’re keeping it. Use Google Maps while signed out if you need it. Tier 3: Strong anonymity — for high-risk individuals</h2> Journalists working with sensitive sources. Activists in authoritarian countries. Abuse survivors who have reason to believe someone with resources is looking for them. Whistleblowers. Anyone whose physical safety could be harmed by digital exposure. These measures belong here. They are genuinely inconvenient. Reaching for this tier without the threat model to justify it just makes your life harder for little benefit. Tor Browser</h3> The Tor network routes your traffic through three encrypted relays operated by volunteers worldwide. Your ISP can see you’re connected to Tor, but not what you’re accessing. The website you visit sees the IP address of the exit relay, not yours. Each relay operator sees only the traffic passing through their node. The entry relay knows your IP but not your destination. The exit relay knows your destination but not your IP. No single relay knows both. What Tor protects against: ISP surveillance of your traffic, site-level IP tracking, and most commercial tracking infrastructure. For journalists accessing sources who use SecureDrop (The New York Times, The Washington Post, The Intercept, and others all run SecureDrop instances accessible only through Tor), it’s the standard tool. What Tor doesn’t protect: your behavior inside a session. If you log into your real Google account through Tor, you’ve identified yourself. If you fill in a form with your real name, your IP anonymity doesn’t matter. JavaScript fingerprinting can still run inside the browser. Exit nodes — the final relay that connects to regular websites — can see and modify unencrypted HTTP traffic. Most modern HTTPS traffic is protected by the site’s own encryption, but anything over HTTP is exposed at the exit node. The canonical warning: the Tor Browser Bundle hardens against fingerprinting by standardizing every browser configuration. Don’t install plugins, don’t resize the window, don’t log into any account connected to your real identity. These behaviors create distinguishing characteristics that can be correlated across sessions. Timing attacks on Tor are a real threat at the nation-state level. If an adversary controls enough of the network’s entry and exit nodes, they can correlate traffic timing to identify users. Law enforcement has successfully de-anonymized Tor users through this method combined with other techniques. Tor doesn’t protect you from the NSA. It does protect you from almost everyone else. Tails OS</h3> Tails is a live operating system that runs from a USB drive. You boot a computer from the USB — bypassing the installed operating system — and Tails loads into RAM. When you power off, everything that happened in that session is gone. No persistent files, no browser history, no connection between this session and any prior session, nothing stored on the host machine. Tails routes all internet traffic through Tor by default. It includes tools for encrypted file handling, secure deletion, and metadata removal. It’s designed for use on computers you don’t own or trust. When you need it: handling a sensitive document on a library computer. Communicating with a source in a situation where your device might be examined. Working from a location where you need zero local trace of your activity. What it’s not: a daily driver. Booting from USB every time you want to read your email is not sustainable. Use it for specific sessions that require a clean slate. Whonix</h3> Whonix takes a different approach. It runs as two virtual machines: a “Gateway” that handles Tor routing, and a “Workstation” that you use normally. All network traffic from the Workstation must pass through the Gateway, which routes it through Tor. If an application in the Workstation is compromised and tries to send traffic directly — bypassing Tor — the Gateway blocks it. Unlike Tails, Whonix is persistent. You can save files, maintain a workflow, use it as part of a regular routine. This makes it suitable for journalists who need to maintain communication with a source over weeks or months without each session being completely ephemeral. The trade-off is setup complexity and resource use — running two virtual machines simultaneously requires a reasonably capable host machine. Air-gapped devices</h3> Some operations are genuinely sensitive: managing encryption keys, or working with documents that should never touch the internet. For those, an air-gapped device is a computer that has never been connected to a network and never will be. Data goes in and out on physical media: USB drives, SD cards. Those transfer points are where the risk concentrates. The Stuxnet worm that damaged Iranian nuclear centrifuges was delivered by a USB drive into an air-gapped network. An air-gapped machine is not for general use. It’s for specific tasks: generating and storing GPG keys, working with highly sensitive documents, anything where the cost of network exposure is too high to risk. Financial anonymity: cash and Monero</h3> Every credit card transaction you make is logged, retained, and sold. Your purchase history is more revealing than your search history — it shows where you physically were, what you bought, and patterns that combine into a behavioral profile. Cash eliminates this for physical transactions. For anything that requires online payment, cryptocurrency is the common answer, with important caveats. Bitcoin is not anonymous. The Bitcoin blockchain is a public ledger. Every transaction is visible to anyone who looks. Blockchain analysis is a service companies like Chainalysis sell commercially. With enough of it, Bitcoin transactions can often be traced back to real identities. That is particularly true where they touch regulated exchanges that required identity verification. Monero (XMR) is the main privacy-preserving cryptocurrency in practical use. It uses ring signatures, stealth addresses, and confidential transactions to hide sender, recipient, and amount on-chain. No public ledger. No transaction graph. For online purchases that cannot be traced back to an identity, Monero is the tool. Buying Monero privately takes effort. The simplest path is buying Bitcoin through a KYC exchange and converting it through a decentralized exchange. Accept that the conversion point itself is a record. Physical OPSEC: what your devices leak without your knowledge</h3> Your photos contain EXIF data. GPS coordinates are embedded in images taken on smartphones by default. A photo of a document can include the GPS location of the room where it was photographed. A photo posted publicly with location data embedded is sufficient to determine your home address if enough photos were taken there. Disable location tagging in your camera app settings. Before sharing any image, strip EXIF data. On Linux, exiftool -all= filename.jpg</code>. On mobile, the Scrambled Exif app for Android or the built-in sharing options on iOS can remove metadata before transmission. More subtle: printers embed invisible steganographic dots in printed pages that encode the printer’s serial number and the date and time of printing. Documents that should be untraceable to a specific device shouldn’t be printed — or if they must be, printed in a public location on a machine unconnected to you. Communications: Signal and its limits</h3> Signal provides end-to-end encrypted messaging with perfect forward secrecy. The encryption keys are rotated with each message. So compromising one key doesn’t expose past conversations. Signal’s server stores only your phone number and registration date. It is the gold standard for encrypted communication in 2026 and is used by security professionals, journalists, and government officials in sensitive roles. Signal requires a phone number for registration, which is a real trade-off. That number is a link to your real identity. For high-risk use, register with a non-attributable number (see Tier 2 on virtual numbers). WhatsApp uses the Signal protocol for message encryption. Its marketing emphasizes this. The difference: Meta owns WhatsApp. Metadata covers who you message, when, how often, your contacts, and your location when you opened the app. Meta retains all of it. That extends its reach to their advertising ecosystem and to legal requests. The encryption of message content doesn’t change the exposure of the social graph. For metadata-sensitive communication, Signal with a private number is not equivalent to WhatsApp. They are different products with different threat profiles. The limits of all of this</h2> Behavioral de-anonymization</h3> Your writing style is a fingerprint. Academic researchers have demonstrated stylometric analysis that can identify authors from short text samples with significant accuracy. The same techniques have been used to narrow down Satoshi Nakamoto candidates from Bitcoin forum posts. They have attributed articles to specific journalists. They have de-anonymized academic paper authors who submitted anonymously. Your typing patterns, time-of-day posting habits, and characteristic phrase choices are consistent across pseudonyms. An adversary with enough samples from your pseudonymous account and your real identity can draw connections that no technical protection prevents. This is not a hypothetical. Several Tor hidden service operators were identified not through any cryptographic break, but through writing style analysis and behavioral patterns. Posting times matched a suspect’s time zone. Phrasing appeared both on the hidden service and in indexed posts. If you maintain a pseudonymous identity with serious stakes, it requires consistent behavioral discipline: post at different hours, write differently, avoid phrases you use elsewhere. Timing correlation attacks</h3> Law enforcement agencies and intelligence services have demonstrated they can de-anonymize Tor users by controlling enough of the entry and exit nodes to correlate traffic timing. Say an adversary sees encrypted traffic entering the Tor network from your location at the same moment that unusual traffic arrives at a target site. Statistical analysis of that timing is enough to link them, even without ever breaking the encryption. This attack requires significant resources. It is not available to a stalker, a data broker, or most corporate adversaries. It is available to nation-states and some well-resourced law enforcement agencies. If you’re a journalist with sources whose safety depends on identity protection, Tor provides meaningful protection against most adversaries. It doesn’t protect against an adversary who can monitor large portions of internet infrastructure. Legal compulsion</h3> What governments can demand: In the US, the government can compel disclosure of account metadata under a variety of legal authorities, often without your knowledge. National Security Letters require no court oversight and come with a gag order preventing the recipient from disclosing they received one. GDPR provides meaningful protections in Europe, but law enforcement exemptions are broad. In authoritarian countries, the legal framework is irrelevant — companies operating in those jurisdictions comply with local authorities or face the consequences. “Warrant canary” programs — where companies note the absence of government demands rather than their presence — have had mixed effectiveness. Some companies have upheld them seriously. Others have abandoned them quietly. The practical implication: even if a service provider’s technical architecture protects your content, a company operating under a legal obligation will provide what they have. Design your privacy so that what they have isn’t enough to identify you. Calibrate to your actual adversary</h3> A final, honest note: the single most important principle in this guide is the adversary model at the beginning. Nation-state surveillance — the NSA, GCHQ, China’s MSS — is not a practical threat to most people reading this. Corporations harvesting behavioral data to sell to insurance companies, political campaigns, and anyone willing to pay is a practical threat to essentially everyone. The privacy measures that matter most for most people are Tier 1 and Tier 2. That means unique passwords, hardware 2FA, and an alias email service. It also means uBlock Origin, a vetted VPN, and opting out of data brokers. These are low-friction, high-impact. They protect against the actual threats people face: credential stuffing, identity theft, stalking enabled by data broker exposure, targeted phishing. Tor and Tails and air-gapped machines matter for people with specific, high-stakes threat profiles. Using them without that threat model is security theater. It makes your life harder without matching protection against the risks you actually face. Know who you’re protecting yourself from. Then build accordingly. What you can do right now</h2> Want to see what data brokers expose about you? See what a scan finds →</a> shows an example report: the kinds of sites that list your name, phone, and address. Once KnytX Shield launches it will find and remove these automatically. Join the waitlist</a> to get in early. Passkeys Explained: Replace Your Passwords This Year Unknown — Mon, 16 Mar 2026 00:00:00 +0000 She clicked the link in what looked like a Google security alert. The page was convincing — Google’s font, Google’s colors, the familiar “Sign in to your Google Account” header. She typed her password. Then the site asked for her two-factor authentication code. She typed that too. The page spun, then redirected her to the real Google homepage as if nothing had happened. Forty seconds later, her Google account was gone. The attackers had her password and her 2FA code. They logged in immediately, changed the recovery email and phone number, and locked her out before she could react. Everything tied to that account — her Gmail, Google Drive, Google Photos, the YouTube channel she’d spent three years building — was gone in under a minute. Here’s what makes this particular kind of attack so effective: it works perfectly even against people who know about phishing. The page looks real. The sense of urgency is real. The 2FA code she entered was valid and real. She did everything she thought she was supposed to do. The problem wasn’t her behavior. The problem was the technology. Passwords and one-time codes are both secrets that can be intercepted. If an attacker can get you to type them, anywhere, those secrets belong to the attacker. Passkeys break that chain entirely. They don’t make the secret harder to steal. They eliminate the shared secret altogether. The short answer: A passkey replaces your password with a cryptographic key pair. Your device keeps the private key and never lets it leave; the website stores only the matching public key. Logging in means your device signs a challenge, so no secret is ever typed or transmitted. That makes passkeys unphishable and useless to a breached server. You set them up through Google, Apple, or Microsoft in about two minutes, and you keep your password manager for the sites that don’t support passkeys yet. Jump to: What a passkey actually is</a></li> Why passkeys can’t be phished</a></li> Why they can’t be leaked in a breach</a></li> Synced vs. device-bound passkeys</a></li> How widely are passkeys adopted?</a></li> How to set up a passkey (Google, Apple, Android, GitHub)</a></li> The remaining weaknesses</a></li> What to do this week</a></li> </ul> What a passkey actually is</h2> A passkey is a cryptographic key pair. Two mathematically related keys are generated: a private key and a public key. Your device — your phone, your laptop, your tablet — holds the private key and never lets it leave. The website holds the public key. When you log in, the website sends your device a challenge: a random piece of data. Your device uses the private key to sign that challenge, producing a signature. The website verifies the signature using the public key. If the signature checks out, you’re in. No password was typed. No secret was transmitted over the network. The private key itself never moved. This is called asymmetric cryptography, and it’s the same mathematical foundation used to secure HTTPS connections, cryptocurrency wallets, and secure shell (SSH) access to servers. It isn’t new technology. What’s new is that it’s been standardized and packaged in a way that works for ordinary login flows — on your phone, in your browser, across every major operating system. The standard behind passkeys is called WebAuthn, part of the broader FIDO2 specification developed by the FIDO Alliance and ratified by the World Wide Web Consortium (W3C). The FIDO Alliance members include Google, Apple, Microsoft, Amazon, PayPal, Samsung, and hundreds of other companies. That coalition is why passkeys work across different ecosystems. The same passkey you create on an iPhone can authenticate you in Chrome on a Windows machine, via a QR code scan. Why passkeys can’t be phished</h2> This is the critical property, and it’s worth being precise about. When you log in with a password, you type a string of characters. Those characters are the secret. It doesn’t matter where you type them — a real site, a fake site, a form in a PDF, a “customer support” chat window. Whatever receives that string now has your credential. Passkeys don’t work this way. The private key never leaves your device, full stop. It is stored in a secure enclave — a hardware-isolated portion of your device’s chip that is separate from the main operating system. On an iPhone, that’s the Secure Enclave. On Android devices with a Titan chip, it’s the Titan security chip. On Windows Hello, it’s the Trusted Platform Module (TPM). The private key cannot be extracted, cannot be copied out, and cannot be sent anywhere. More importantly: the private key is bound to a specific domain. When you create a passkey for google.com, the cryptographic binding includes the exact origin — the domain and protocol — of the site you registered with. When you try to use that passkey, your browser and device verify that the site requesting authentication matches the domain the passkey was created for. This is what makes phishing impossible. The fake Google login page — the one that looked perfect, with the right fonts and the right logo — is hosted at a different domain. Maybe it’s g00gle-security-alert.com, or accounts.google.com.phishing-domain.net. The domain doesn’t match the one your passkey was issued for. Your device simply won’t produce a valid signature for it. There is nothing for the attacker to intercept, because nothing was transmitted. The attacker can’t trick you into giving up your passkey the way they tricked that YouTube creator into giving up her password and 2FA code. The key never comes out of the device. The device won’t respond to the wrong domain. The attack has no surface to target. Why they can’t be leaked in a breach</h2> With passwords, a server breach is a catastrophe. The server stores something that represents your password — often a hash, sometimes (still) plaintext — and that stored value is what gets stolen. If an attacker steals hashed passwords, they can crack weaker ones offline, then use the recovered passwords elsewhere. If they steal plaintext passwords, the work is already done for them. This is credential stuffing, and it has been running as an industrial-scale attack for years. The RockYou2024 combolist, compiled from thousands of historical breaches and published in 2024, contained nearly 10 billion credential pairs. That’s what attackers test against your Gmail, your bank, your Amazon account — automatically, at thousands of attempts per second, while they sleep. If you’ve reused a password anywhere, you’re in that pipeline. With passkeys, the server stores only the public key. That’s it. Public keys are designed to be public. They’re mathematically useless without the corresponding private key, which only your device holds. If the server is breached and the attacker walks away with your public key, they have nothing. They cannot log in as you. They cannot derive your private key from the public key — that’s the core guarantee of asymmetric cryptography, and breaking it would require computing power that doesn’t exist on Earth. A breach of a passkey-enabled service is fundamentally different from a breach of a password-enabled service. The attacker gets a list of public keys and usernames. That list cannot be used to log in anywhere. It cannot be used to attack other services. The credential stuffing attack that locked people out of millions of accounts across thousands of platforms becomes irrelevant the moment you switch. Synced passkeys vs. device-bound passkeys</h2> When you create a passkey on an iPhone, Apple syncs it across your other Apple devices via iCloud Keychain — encrypted end-to-end, with Apple holding no key. Create it on an Android phone, and Google Password Manager syncs it across your Android devices and Chrome. Create it on Windows with a Microsoft account, and it’s available across your Windows machines. These are synced passkeys. They’re designed for usability: you get a new iPhone, your passkeys are already there when you sign in to iCloud. You lose your phone, your passkeys survive on your other devices. Device-bound passkeys are different. They live only on one physical device — typically a hardware security key like a YubiKey — and cannot be exported or synced. They’re used in high-security environments where the additional binding to a physical object is worth the loss of convenience. If you lose the key, you lose the passkey. Most people don’t need device-bound passkeys. For most threat models, synced passkeys through Apple, Google, or Microsoft are the right choice. The security difference between the two comes down to what you’re protecting against. Synced passkeys rely on your iCloud or Google account being secure — if someone takes over your Apple account, they can potentially access your synced passkeys. That’s a real consideration. But for the vast majority of people, the threat of phishing and credential stuffing is far more immediate than the threat of a sophisticated iCloud takeover. Synced passkeys eliminate the first category of threat entirely. How widely are passkeys actually adopted?</h2> More widely than most people realize, and the growth has accelerated sharply. Google announced passkey support in May 2023 and reported over 1 billion passkey authentications across its services by late 2024. Apple shipped passkey support in iOS 16 and macOS Ventura, both released in September 2022. It was announced at WWDC 2022 alongside the cross-platform WebAuthn commitment made jointly with Google and Microsoft. Microsoft integrated passkeys into Windows Hello beginning in 2023 and added passkey support to Microsoft accounts in 2024. On World Passkey Day in May 2026, the FIDO Alliance estimated around 5 billion passkeys were in use worldwide. Its survey found roughly three-quarters of people had enabled a passkey on at least one account. On the service side, the list of major platforms supporting passkey login now includes PayPal, Amazon, GitHub, Best Buy, Walmart, Instacart, Adobe, Coinbase, eBay, Kayak, LinkedIn, Nvidia, PlayStation Network, Shopify, Target, and Yahoo. The FIDO Alliance maintains a current directory at passkeys.directory. As of mid-2026, community trackers count roughly 300 services with passkey login, including about half of the top 100 websites, and the list keeps growing. GitHub’s adoption is particularly significant. In 2023, GitHub required two-factor authentication for all code contributors. In 2024, they expanded passkey support and began encouraging users to upgrade from 2FA to passkeys. For developers — a group that is both high-value and frequently targeted — GitHub passkeys eliminate a major attack vector. How to set up a passkey on Google</h2> Setting up your first passkey takes about two minutes. Go to myaccount.google.com</a> and sign in.</li> Click Security in the left sidebar.</li> Scroll to How you sign in to Google and click Passkeys and security keys.</li> Click Create a passkey.</li> Follow the prompt on your device — on a phone, this will ask for Face ID, fingerprint, or your device PIN. On a Mac, it uses Touch ID or your Apple account password.</li> The passkey is created and synced. Done.</li> </ol> Next time you sign in to Google, you’ll be offered the option to use your passkey instead of your password. The sign-in takes one biometric confirmation, no password typed, no 2FA code to receive. How to set up a passkey for your Apple ID</h2> On your iPhone, open Settings and tap your name at the top.</li> Tap Sign-In & Security.</li> If your Apple ID is managed through Apple, you may see an option to use Apple’s own passkey system — on newer devices running iOS 17 or later, Apple ID itself is increasingly passkey-backed by default. Check here to confirm the status.</li> For iCloud Keychain specifically: passkeys you create on other supported sites (Google, GitHub, PayPal, etc.) are stored here automatically when you choose “Save to iCloud Keychain” during the passkey creation flow.</li> You can review all saved passkeys in Settings → Passwords — they appear alongside your saved passwords, labeled with a key icon.</li> </ol> When you get a new iPhone and sign in to iCloud, every passkey synced to iCloud Keychain restores automatically. You don’t need to re-register with each service. What happens on Android with Google Password Manager</h2> The flow on Android mirrors the Apple experience. When you create a passkey on a supported site using Chrome on Android, your device prompts you to save it to Google Password Manager. It syncs to any device where you’re signed in with the same Google account and using Chrome or Android’s built-in credential system. You can review your passkeys at passwords.google.com</a> — they’re listed separately from your saved passwords, with the passkey icon making them easy to identify. For cross-device logins — say, signing in on your laptop using a passkey stored on your phone — the browser shows a QR code. You scan it with your phone’s camera. Your phone authenticates with biometrics, confirms the request, and your laptop session is approved. The private key still never leaves your phone. The QR code and Bluetooth proximity are used only to establish that the phone and laptop are physically close together, preventing remote attacks. How to add a passkey on GitHub</h2> Sign in to GitHub and go to Settings (click your profile photo, then Settings).</li> In the left sidebar, click Password and authentication.</li> Scroll to Passkeys and click Add a passkey.</li> Follow the device prompt — Touch ID, Face ID, Windows Hello, or your device PIN.</li> Give the passkey a name (optional but useful if you have multiple devices).</li> Click Save.</li> </ol> GitHub also allows passkeys as a 2FA method, so if you’re not ready to replace your password entirely, you can add a passkey as a second factor. The security improvement is still significant even in that configuration. The remaining weaknesses</h2> Passkeys are not a perfect, complete solution. Being clear about their limitations is important. Account recovery is the hard problem. You might lose access to every device that holds your passkeys: the phone destroyed, the laptop stolen, the backup device lost. In that case, getting back into accounts requires fallback recovery mechanisms. Google, Apple, and Microsoft all have account recovery processes, but those processes typically rely on backup codes, trusted contacts, or support verification. They are the weakest link in a passkey setup. Store your backup codes somewhere safe: a printed copy in a secure location, or a password manager that you access from a device separate from your primary passkeys. This is the one place where old-school physical security still matters. Your device account security still matters. Synced passkeys live in your iCloud or Google account. Someone could take over your Apple ID through a phishing attack on Apple itself, or a SIM swap</a> against your recovery phone number. If they do, they gain access to your synced passkeys. This is a real threat vector, though it requires significantly more effort than credential stuffing or phishing for a single-service password. Securing the root account (your Apple ID or Google account) is a prerequisite for trusting passkey sync. Not every site supports them yet. Your bank, your insurance company, your utility provider — many of these still live in password-world. Password managers remain essential for the accounts that haven’t made the switch. The good news is that FIDO Alliance membership continues to grow, and enterprise adoption is accelerating as companies recognize the liability reduction of eliminating phishable credentials. Passkeys don’t protect you from a compromised device. Say an attacker has malware on your device with operating-system-level access. They can potentially intercept authentication requests at the point of use. They do this not by extracting the private key, but by approving requests made through the legitimate credential. Full device compromise is a separate threat model that passkeys don’t address. What to do this week</h2> Security decisions work best when they’re prioritized. Not everything is equally important. Here is the order that makes sense. First: your primary email account. Email is the master key. Whoever controls your email can reset every other account linked to it. If you do nothing else, add a passkey to your Google, Apple, or Microsoft email account this week. The setup takes two minutes. The risk reduction is immediate and substantial. Second: your bank and financial accounts. Check whether your bank supports passkeys. Most of the major US banks, including Bank of America, Wells Fargo, and Chase, have added passkey support or are rolling it out. PayPal has supported passkeys since 2023, and so has Coinbase. Add passkeys to every financial account that offers them. Passkeys are also the strongest defence against the account takeover fraud</a> that empties bank accounts. Third: your social media accounts. These are high-value targets both for personal embarrassment and for impersonation scams targeting your contacts. Apple ID, Google Account, LinkedIn, and others support passkeys or FIDO-based authentication. Enable them. Fourth: everything else. Work through your password manager’s list of saved accounts. Most password managers now flag which sites support passkeys — 1Password, Bitwarden, and Dashlane all surface this information directly in the app. Set up passkeys wherever you see the option. Keep your password manager. Passkeys don’t replace password managers yet; they complement them. For accounts that still require passwords, a password manager</a> with unique, random passwords remains your best defense. Where a site offers no passkey, strong two-factor authentication</a> is the next best thing. Think of passkeys as the upgrade path: every account you move to a passkey is one fewer password to worry about. Set up account recovery. Before you rely on passkeys, generate and store backup codes for your primary accounts. Google, Apple, and Microsoft all offer backup codes specifically for account recovery. Print them or store them somewhere you can access independently of your primary device. Don’t skip this step. The shift from passwords to passkeys is the most meaningful security improvement available to ordinary people right now. It doesn’t require technical expertise to set up. It doesn’t require you to remember anything. And it eliminates entire categories of attack that have been draining accounts for twenty years — phishing, credential stuffing, and brute force, all in one architectural change. The YouTube creator who lost her channel to a fake login page? A passkey would have made that attack technically impossible. Not harder, impossible. Her device would have refused to authenticate to the wrong domain, silently, with no action required on her part. That’s not a marginal improvement. That’s a different kind of security entirely. Even with passkeys, credentials you set up years ago may already be circulating from old breaches. KnytX Vigil</a> is built to watch breach databases for your exposed logins and flag them so you know which accounts to upgrade first. Vigil isn’t live yet; join the waitlist</a> to turn it on at launch. Dark Web Monitoring: What It Finds, What It Misses Unknown — Sun, 15 Mar 2026 00:00:00 +0000 In 2021, 100 million MobiKwik users had their KYC records — including Aadhaar numbers, PAN cards, and passport photos — listed on a dark web marketplace. MobiKwik denied the breach for weeks. The data was already selling. That gap between “breach happens” and “company admits it” is exactly what dark web monitoring is designed to close. But before you decide whether it’s worth using, you should understand what it actually does and where it stops. The short answer: Dark web monitoring scans breach dumps, paste sites, and dark-web forums for your identifiers (email, phone, PAN, Aadhaar) and alerts you when a match appears. It finds credential pairs, PII dumps, financial bundles, and full KYC packages. It misses private broker sales, closed Telegram groups, breaches not yet public, and offline leaks. It detects exposure; it doesn’t prevent breaches or remove data. Pair it with broker removal to reduce how findable that data is. What is the dark web?</h2> The dark web is not a single place. It’s a layer of the internet that requires special software — primarily the Tor browser — to access. Tor routes your connection through multiple encrypted relays, making both your identity and the server’s location hard to trace. Most of the dark web is mundane: privacy forums, whistleblower platforms, journalists protecting sources in authoritarian countries. The part that matters for data exposure is the dark web marketplace — sites that function like Amazon, except the products are stolen data, fake documents, and compromised accounts. These marketplaces have ratings, seller reviews, and customer support. They’re businesses. What Indian data sells for</h2> On these marketplaces, your data has a price. And it’s cheaper than you’d expect. Bulk records — name, phone, email — sell for around ₹500 per 10,000 entries. That’s ₹0.05 per person. Financial packages with PAN and bank account details fetch ₹5,000 to ₹15,000 for a full KYC bundle including Aadhaar, photo, and address proof. These prices come from breach research firms that monitor marketplace listings. The MobiKwik data — 100 million records with full KYC — was being offered for around 1.5 Bitcoin (roughly ₹60–82 lakh at March 2021 prices). Individual records were also being sold separately. That’s the scale of what one breach produces. What makes Indian data particularly attractive? Aadhaar links your biometric identity to your financial history. A single leaked KYC package contains more usable information than most countries’ breach data — it’s the identity verification infrastructure turned against you. What does dark web monitoring actually do?</h2> Dark web monitoring services continuously scan known breach repositories, paste sites (like Pastebin), and dark web forums for data dumps containing your personal identifiers. You give the service your email addresses, phone numbers, PAN, and Aadhaar (a partial hash, in responsible implementations). The service checks these against a database of known breaches and alerts you when a match appears. Services like HaveIBeenPwned cover major global dumps and are free for email checks. Dedicated monitoring scans more sources on an ongoing basis. That includes India-specific breach data and Telegram channels, where breach data circulates before it reaches public repositories. KnytX Shield is built to include this on Pro and above once it launches. The alert tells you: this dataset was breached, it appeared here, and your identifier was in it. What it finds</h2> When your data appears in a monitored dump, a good monitoring service will surface: Credential pairs — your email address combined with a password (often plaintext or weakly hashed). These are used in credential stuffing attacks — automated login attempts across banking, UPI, and shopping sites. PII dumps — name, phone number, Aadhaar or PAN combinations. These are sold to spam operations, used in SIM swap fraud, and occasionally used for loan fraud where your identity is used to apply for credit. Financial data bundles — bank account numbers, credit card details, IFSC codes. Usually from fintech or banking breaches. Full KYC packages — everything above, plus photo ID, address proof, and selfie. The complete package for identity fraud. MobiKwik’s breach fell into this category. When monitoring catches any of these, you have a window to act: change passwords, freeze Aadhaar-linked services, alert your bank. What it misses</h2> This is the part most monitoring services won’t tell you directly. Private broker sales — not all breach data goes to public marketplaces. High-value datasets (C-suite executives, government employees, HNI banking data) are sometimes sold directly between buyers and sellers through private Telegram channels or encrypted messaging. These never appear in scanned repositories. Zero-day breaches — a company’s data can be exfiltrated today and not appear publicly for months. Monitoring only catches data that has already surfaced somewhere scannable. The breach you don’t know about yet is outside its reach. Closed Telegram groups — a significant volume of Indian breach data circulates in private Telegram channels before it reaches any public dump. Monitoring coverage here is partial at best. Physical world leaks — your data copied from a gym’s paper registration, photographed from a hotel check-in form, or sold by a mobile SIM retailer. None of this enters a digital breach dump. Monitoring is a detection tool. It tells you what’s already out there. It doesn’t prevent the breach, and it doesn’t remove the data once found. Why do monitoring and removal work together?</h2> Detection without action is just anxiety. When monitoring surfaces your data in a dump, the practical problem is what happens next. That data feeds clearnet data broker sites: the people-search sites</a> that aggregate and resell breach data into searchable profiles. Anyone can look you up. That’s where the actual harm materializes: spam calls, identity fraud, targeted phishing. Removal addresses that second step. Getting your data off data broker sites doesn’t undo the breach. But it removes the easily searchable, freely accessible version of your profile. The two-step approach: monitoring catches what’s been exposed, and removal reduces how findable that data is. If you want to understand how data broker sites build those profiles from breach data, read our post on removing your data from the Indian internet</a>. Frequently asked questions</h2> What does dark web monitoring find? It surfaces your identifiers in breach dumps: credential pairs, PII dumps (name, phone, PAN, Aadhaar), financial bundles, and full KYC packages. When it catches a match, you get a window to change passwords and alert your bank. What does dark web monitoring miss? Private broker sales, closed Telegram groups, breaches not yet public, and offline leaks (paper forms, SIM-retailer copies). It only catches data that has already surfaced somewhere scannable. Is dark web monitoring worth it? It’s useful as early warning, but it’s detection only. It won’t prevent a breach or remove your data. Pair it with data-broker removal so exposed data is harder to find and use. Can I check the dark web for free? Yes, partly. Have I Been Pwned checks your email against major public dumps for free. Dedicated services scan more sources, including India-specific breaches and Telegram channels, on an ongoing basis. What you can do right now</h2> Want to see what data brokers expose about you? See what a scan finds →</a> shows an example report: the kinds of sites that list your name, phone, and address. Once KnytX Shield launches it will find and remove these automatically. Join the waitlist</a> to get in early. Why TRAI's DND Registry Doesn't Stop Spam Calls Unknown — Fri, 13 Mar 2026 00:00:00 +0000 Your phone rings at 11:43 AM. Unknown number. You answer because it might be your kid’s school. It’s a man reading from a script about a home loan you didn’t ask about. You registered on India’s Do Not Disturb registry three years ago. You’ve gotten eight calls like this today. You’re not doing anything wrong. The system is broken by design — and the people running it know it. You’re on DND. The calls keep coming.</h2> The National Do Not Disturb registry exists. You can register on it. TRAI maintains it. And if you’ve been on it for more than a year, you have noticed that it does almost nothing. This isn’t a bug in implementation. It’s the predictable result of how the system is structured — who it covers, who it exempts, and who it has no power over at all. What DND is actually supposed to do</h2> TRAI’s NDNC (National Do Not Call) registry, now branded as the DND registry, was set up to stop registered telemarketers from calling you for unsolicited commercial communication. The theory is simple: you register your number, telemarketers check the registry, they skip your number. Registered telemarketers in India must obtain commercial communication headers from TRAI — the alphanumeric sender IDs you see on promotional SMS messages like “VM-HDFCBK” or “JD-JIOOFF.” These are the entities DND is designed to regulate. For that narrow category of caller, DND technically works. A legitimate bank with a registered header should not be cold-calling DND-registered numbers for unsolicited offers. The problem is that this narrow category covers almost none of the spam calls you actually receive. The exemptions that swallow the rule</h2> The TRAI framework carves out a vast category of calls as transactional or service communication — and exempts them from DND entirely. Banks can call you about loan offers if they have an existing relationship with you. Insurance companies can call you about policy renewals. Mutual funds can call you about investment opportunities. Government services can call you about anything. Any company that can claim a prior relationship with you can call your DND-registered number. And “prior relationship” is defined loosely enough that buying a SIM card from Jio qualifies. These exemptions cover the majority of spam calls Indians actually receive. The person calling about a home loan from “HDFC” — real or fake — falls under the transactional exemption. The insurance upsell from a call center in Gurugram is “service communication.” The credit card offer from a number you don’t recognize is “relationship-based marketing.” DND was never going to stop these calls. The exemptions exist because the banking and insurance lobbies pushed for them, and TRAI accommodated. Spoofed numbers: TRAI’s blind spot</h2> Here is the harder problem. A growing fraction of spam and scam calls don’t come from registered Indian telemarketers at all. Scammers use VoIP (Voice over Internet Protocol) services to make calls from servers in Bangladesh, the UAE, Singapore, and the United States — then spoof an Indian mobile number as the caller ID. The number that shows up on your screen may be a legitimate Indian mobile number belonging to someone who has no idea their number is being impersonated. TRAI regulates Indian telecom operators. It has no jurisdiction over a SIP trunk operating from a data center in Dubai. The DND registry has no mechanism for these calls. The AI spam detection systems being rolled out at the carrier level help identify suspicious call patterns, but they’re playing catch-up against an adversary that changes infrastructure constantly. When you get a call from what looks like a +91 mobile number but turns out to be a scam — the Customs officer scam, the FedEx parcel scam, the fake CBI notice — that call almost certainly came from outside India’s regulatory reach. How scammers get your number anyway</h2> Even if DND perfectly blocked every regulated telemarketer (it doesn’t), and even if TRAI somehow gained authority over overseas VoIP operators (it hasn’t), the scammers would still have your number. They buy it. Bulk phone number lists are sold openly on Telegram channels and dark web marketplaces for a few hundred rupees per lakh records. These lists are assembled from breached databases. Telecom companies, fintech apps, e-commerce platforms, and government portals have all suffered data breaches in the past five years. Once your number is in a breach, it enters a resale ecosystem that DND has no access to. Your number is also on data broker websites</a> that aggregate publicly registered information, app permissions, and breached data. Anyone willing to pay, or willing to scrape, can get a list of Indian phone numbers with names and addresses attached. DND tells legitimate telemarketers to skip your number. It tells exactly nobody to delete your number from their database. What TRAI is doing (and why it’s not enough)</h2> TRAI is not ignoring the problem. In 2023 and 2024, it pushed Indian telcos to implement AI-based spam call detection at the network level. Airtel launched its AI-powered spam detection system in 2024. Jio has similar filtering built into its network. These systems work by analyzing call patterns — an entity making 10,000 calls in an hour from the same number is automatically flagged. They’ve reduced some categories of spam. They don’t stop spoofed VoIP calls that look like individual mobile numbers. They don’t stop manual call center dialing. They don’t stop calls from exempted categories. TRAI also runs the Sanchar Saathi portal where you can report spam calls. Filing a report creates a record. Whether that record results in any action depends on whether the caller is an identified, regulated Indian entity — which, as covered above, many are not. Reporting is worth doing. It is not a solution. What actually works</h2> The only thing that reliably reduces spam calls is reducing the number of places your phone number exists. Your primary phone number — the one linked to your Aadhaar, your UPI account, your bank, your employer — is already in too many places to fully clean up. But you can stop it from spreading further. Use a secondary number (a cheap prepaid SIM or a virtual number service) for app registrations, food delivery, e-commerce, and any form that asks for your phone number but doesn’t need to be linked to your real identity. Your primary number stays clean. The secondary number gets the spam. Where your number is already out there, you can get it removed. Data broker websites — the ones that list your name, phone number, and address — accept removal requests. Under the DPDPA, Indian companies must honor those requests. The problem is there are hundreds of these sites, each with its own process. KnytX Shield</a> is built to automate this: once it launches it will identify where your number is listed and submit removal requests on your behalf. For a full guide to tools that help you limit how much of your real contact information you share, see email aliases and phone masks</a>. For how to get your data off Indian broker sites specifically, see removing your data from the Indian internet</a>. The DND registry was designed for a world where spam came from domestic telemarketers with registered headers. That world ended years ago. The solution isn’t a better registry. It’s limiting the attack surface — the number of databases your phone number lives in. What you can do right now</h2> Want to see what data brokers expose about you? See what a scan finds →</a> shows an example report: the kinds of sites that list your name, phone, and address. Once KnytX Shield launches it will find and remove these automatically. Join the waitlist</a> to get in early. Why You Don't Own Your Own Data Unknown — Thu, 12 Mar 2026 00:00:00 +0000 In 2015, RadioShack filed for bankruptcy. The electronics retailer had 117 million customer records — names, addresses, phone numbers, email addresses, purchase histories — accumulated over decades. Those records were a balance sheet asset. When the company’s assets went to auction, the customer data was listed alongside the store fixtures and trademark. The FTC had to intervene to block the sale. Regulators argued the sale would violate RadioShack’s own privacy policy, which had promised customers their data wouldn’t be sold to third parties. The bankruptcy court ultimately placed restrictions on what buyer General Wireless could do with the data. Here’s what’s worth sitting with: the FTC’s intervention worked, in that case, because of a contract violation — RadioShack’s own policy. Not because customers owned their data. Not because personal information is property that can’t be transferred without consent. A retailer could list 117 million people’s personal information in a bankruptcy auction, alongside the furniture. The legal principle that allowed it was simple: customers never owned that data to begin with. This is the reality most privacy discussions skip over. “Your data” is a phrase we use constantly, in news articles, in marketing copy, in legislation. It implies a proprietary relationship. That relationship, in most legal systems, does not exist the way the phrase implies. The short answer: In the US, EU, and UK, personal data is not legally classified as property. You cannot claim title to it the way you claim title to a house. What you have instead is three kinds of rights. Contractual rights (from terms of service). Statutory rights (from laws like GDPR, CCPA, and India’s DPDPA). And tort remedies (when misuse causes real harm). These rights are real and worth exercising. But they operate inside a system where the licenses you already granted, and the data already copied and sold, largely stay in place. Is your personal data legally your property?</h2> Property law in common law systems (US, UK) is built around physical things and, more recently, intellectual creations. The same is true in most civil law systems, including EU member states. You can own a car. You can own a patent. You can hold a lease. Property ownership gives you the right to exclude others, the right to transfer, and a bundle of legal protections that follow from those. Data doesn’t fit this framework. When you tell a bank your annual income, you haven’t transferred your income figure to the bank — you’ve communicated information. The bank now has a fact. You still have the same fact. The information has been duplicated, not transferred. Property law developed around things that can only be in one place at a time. Information can be in thousands of places simultaneously. There is no US federal statute that classifies personal data as property and gives individuals title to it. There have been academic proposals and a handful of state-level proposals, but none have passed. The EU’s General Data Protection Regulation — the most comprehensive data protection regime in the world — deliberately chose a different model. The GDPR does not grant data subjects ownership of their personal data. It imposes obligations on the organisations that process it and grants individuals a set of specific rights. Obligations and rights, not ownership. The UK Information Commissioner’s Office describes the GDPR framework this way: “Data protection law regulates what organisations can do with personal data; it does not give individuals a right of ownership over their own data.” This is the foundation everything else rests on. What you actually have: contractual rights, statutory rights, and tort remedies</h2> Saying you don’t own your data isn’t the same as saying you have no rights over it. You have three categories of rights, each with different scope and different enforcement mechanisms. Contractual rights are what the terms of service give you. When you sign up for a service, you enter a contract. That contract typically gives the company extensive rights over your data (more on this below). But it may also include promises: how the data will be used, whether it will be sold, and how long it will be retained. RadioShack’s privacy policy was a contractual commitment. The FTC intervention worked because the proposed bankruptcy sale would have breached that contract. The limitation: contracts only bind the parties to them. A company’s privacy policy binds that company. It doesn’t bind every downstream recipient of your data once the company sells, licenses, or shares it. Statutory rights are what legislation gives you. These are the substantive rights most people mean by “data rights.” The right to see what data a company holds about you. The right to request deletion. The right to object to certain uses. GDPR (EU and UK), CCPA (California), and India’s DPDPA are the most significant examples. These rights exist regardless of what any individual terms of service says. A company cannot contract out of them. The limitation: statutory rights are rights to make requests, not ownership claims. You can ask for deletion. The company may have legal grounds to refuse. You can ask for a copy of your data. The company must provide it — but providing a copy doesn’t erase the original. Tort remedies are the legal actions available when your data is misused in ways that cause identifiable harm. Several torts allow you to sue when personal information is published or used in ways that damage you. These include breach of confidence and privacy torts in US common law. They also include misuse of private information, a tort developed in UK courts after Campbell v MGN [2004]. These remedies are retrospective. They respond to harm that has already occurred. The limitation: tort remedies require demonstrable harm. Speculative future harm, embarrassment, or discomfort at the mere fact of data processing generally doesn’t clear the threshold for a tort claim. What “perpetual, irrevocable, royalty-free, sublicensable” actually means</h2> The terms of service you agreed to almost certainly grant the company a license to use your data. That includes your social media account, your email provider, and your loyalty card. The standard formulation, used by platforms from Instagram to LinkedIn, runs something like this: “You grant us a non-exclusive, transferable, sublicensable, royalty-free, worldwide license to use any content you post…” </blockquote> Parse each word. Non-exclusive: you can still use your own data; you’re not transferring it exclusively. This sounds friendly. It’s irrelevant to your interests — the company isn’t asking for exclusivity because they don’t need it. Transferable: the company can assign the license to someone else. If they’re acquired, merge with another company, or — relevant here — go bankrupt, the license travels with the business. Sublicensable: the company can grant the same rights to third parties. They don’t need your permission to share your data with advertisers, analytics firms, or data brokers. This is why a platform’s privacy policy can say “we may share your data with trusted partners” and mean it. The sublicense provision gives them the contractual right to do exactly that. Royalty-free: they don’t pay you. You are not compensated for the commercial value your data generates. Worldwide: no geographic restriction on where the data goes. The RadioShack situation illustrates the transferable clause in practice. When the company went into bankruptcy, the license customers had granted — through their contractual relationship with RadioShack — was an asset. It could be transferred. The FTC intervened on policy grounds, not because there was a clean legal bar to the transfer. This same dynamic plays out in every platform acquisition and bankruptcy. When MySpace was sold — multiple times, ultimately to Time Inc. in 2016 for $35 million — user data was part of what transferred. When businesses that collected data under one name are acquired by larger entities, the data portfolio follows. The privacy policy you read in 2015 was written by a company that no longer exists in the same form. The GDPR framework: a regulated relationship, not ownership</h2> The EU General Data Protection Regulation came into force in May 2018. It’s the most comprehensive personal data regulation enacted in a major jurisdiction, and it has produced billions of euros in fines. But it’s worth being precise about what it actually does. GDPR doesn’t give you ownership of your personal data. It structures a legal relationship between you (the “data subject”) and organisations that process your data (“data controllers” and “data processors”). Controllers have obligations. You have rights you can exercise against them. The regulation defines what lawful processing looks like. The bases are consent, contract, legitimate interest, legal obligation, vital interests, or public task. It restricts processing to those. This framework is genuinely powerful. It means a company can’t simply collect everything and do whatever it wants. It means you have enforceable rights. It has produced major enforcement actions. In 2023, Ireland’s Data Protection Commission fined Meta €1.2 billion. The reason: transferring EU user data to the US without adequate safeguards. Google was fined €150 million in France in 2022 across two entities. These aren’t symbolic numbers. But the framework is explicitly one of regulated relationships, not property rights. The GDPR uses the language of “lawful basis,” “proportionality,” and “data subject rights.” It never uses “ownership,” “title,” or “property.” This distinction matters. It shapes what you can actually do with your rights. The right to erasure is real, but the exceptions are substantial</h2> Article 17 of the GDPR is the so-called right to be forgotten. You can request that a data controller erase your personal data. They must comply unless one of the Article 17(3) exceptions applies. The exceptions: Legal obligation: The controller is required by law to retain the data. Tax authorities require financial records to be retained for specified periods. Employment law requires payroll records. Healthcare regulations require patient data. These legal retention mandates override your erasure request. </li> Legitimate interest overriding yours: If the controller is processing your data under the legitimate interest lawful basis and their interest overrides yours, they can refuse. In practice, this exception is most relevant for things like fraud prevention and network security. </li> Legal claims: If the data is necessary for the establishment, exercise, or defence of legal claims — either yours or theirs — deletion can be refused. A company defending litigation involving your account is not required to delete the evidence. </li> Public interest / scientific research: Health data, statistical research, and archiving in the public interest can override erasure requests. </li> Freedom of expression: A newspaper is not required to delete a factually accurate article about you from its archive because you request it under Article 17. </li> </ul> For most commercial contexts, these exceptions are less likely to apply. Think of your account data at a retailer, your browsing profile at an advertiser, or your contact information at a data broker. Erasure requests to commercial companies, sent with a clear statement of withdrawal of consent, succeed reasonably often. But “succeed” means the controller confirms deletion from their active processing systems. It doesn’t mean your data disappears. When you delete data, is it really gone everywhere?</h2> When a company tells you it has deleted your personal data, the statement is accurate within limits that matter. Backups. Enterprise databases operate with backup cycles. When data is deleted from a production system, it persists in backup copies until those backups are overwritten or explicitly purged. Standard backup retention schedules range from 30 days to several years. A company that deletes your data “promptly” may still have it in backup infrastructure for months. GDPR Article 17 requires erasure “without undue delay.” But there is no specified period for backup purging. Regulators have generally accepted that backup deletion follows normal IT cycles. Derived data. This is the more structurally significant problem. Companies don’t just store the raw data you gave them. They generate inferences from it. Your income bracket comes from your spending, your health indicators from your searches. Your political views come from your engagement, your creditworthiness from behavioral signals. When you delete your data, these inferences are not necessarily covered by the deletion request. They may be accurate, may be wrong, and are yours in any meaningful human sense. But the derived profile is the controller’s own analysis, not your personal data in the same direct sense. Under GDPR, inferences are personal data if they relate to you and can identify you. But in practice, the line between your data and the analysis derived from it gets blurry. Companies have argued, sometimes successfully, that derived datasets fall outside the scope of specific deletion requests. Third-party sharing. GDPR Article 17(2) requires a controller who has made your data public to inform others who are processing it that you’ve requested erasure. But “public” has a specific meaning here — it refers to data the controller has published, not data they’ve shared in commercial transactions. Data sold to a data broker is not “public” in this sense. The controller who sold it should have deleted it on their end. Whether the broker they sold it to deletes it depends on whether that broker responds to your separate request. The practical result: an erasure request to Platform A removes your data from Platform A’s active systems. It does not retrieve data already sold to advertisers, data brokers, or analytics firms before the request was made. Those transfers happened under the license you granted in the terms of service. Data portability: technically a right, practically limited</h2> GDPR Article 20 gives you the right to receive your personal data in a structured, commonly used, machine-readable format. The intent was to reduce lock-in and let people move between services. For instance, take your data from one cloud storage provider to another, or move your contact list between email services. The right applies when processing is based on your consent or on a contract, and when processing is carried out by automated means. For most consumer data held by commercial platforms, this covers a lot. In practice, data portability as implemented ranges from adequate to useless. Google Takeout is genuinely functional — you can export your Gmail, Calendar, Photos, and Contacts in usable formats. Facebook/Meta’s data download is comprehensive but produces enormous archives in formats not easily processed by anything other than the original platform. LinkedIn’s download is incomplete. Most smaller services and data brokers implement portability badly or not at all. The Article 20 right does not include having the data transferred directly to a competitor in real time. That requires interoperability, which GDPR does not mandate. (The EU’s Data Act, which focuses more on non-personal data, moves in this direction for specific sectors.) What you have is a right to a download. Whether you can do anything useful with it depends on the format. The “data as labor” argument has gone nowhere legislatively</h2> A strand of academic and activist thinking argues that your data has economic value, so you should be compensated for producing it. It generates revenue for platforms, trains AI models, and drives advertising pricing. Senator Mark Warner introduced a bill in 2019, the Designing Accounting Safeguards to Help Broaden Oversight and Regulations on Data Act (the DASHBOARD Act). It included provisions for platforms to disclose the value of user data. It didn’t pass. The theoretical case for “data as labor” is made most fully by Imogen Heap and Jaron Lanier. Economists like Glen Weyl and Eric Posner make it too, the latter two in their book Radical Markets. The argument is that data is something you contribute, which generates economic value, and for which you should be paid. Treating it as labor would create better incentives all around. Platforms would have to actually value user data rather than treating it as a free input. The legislative reality is that this framework hasn’t been enacted anywhere at scale. No major jurisdiction has passed a law requiring platforms to pay users for their data. The EU’s focus is on obligation and rights, not compensation. The US federal framework doesn’t exist in the first place. The data as labor movement remains a policy discussion, not a legal right. The practical implication is simple: you currently produce economic value through your data, and you are compensated zero for it. The terms of service make this explicit — “royalty-free” is right there in the license grant. The breach exposure problem</h2> One consequence of companies accumulating large amounts of your data is structural: the more a company holds, the more you’re exposed when they’re compromised. The average time between a data breach and its discovery was 204 days globally in IBM’s 2023 Cost of a Data Breach Report. In the healthcare sector, which retains extensive personal data for legally mandated periods, breach exposure times have been longer. The data a company holds because you exercised your data rights and kept your account open is also the data exposed if their security fails. You can shrink that exposure. Submit deletion requests for accounts you no longer use. Opt out of data sharing where allowed. And remove yourself from data broker databases, such as Spokeo</a> or Whitepages</a>, which resell your details to anyone who pays. This is not just a privacy argument. It is a security argument. A profile that does not exist cannot be stolen. What you can actually do today</h2> The following is a jurisdiction-by-jurisdiction summary of the rights you hold and how to exercise them. United States</h3> Federal level: No comprehensive federal privacy law exists for most private-sector data. The main federal frameworks are sector-specific: HIPAA covers health data, FERPA covers education records, COPPA covers children’s data online, the FCRA covers consumer reporting data (credit, background checks). For most general consumer data, there is no federal right to access or deletion. California (CCPA / CPRA): If you’re a California resident, the California Consumer Privacy Act and its 2023 amendments (CPRA) give you: Right to know what personal data businesses collect and how they use it</li> Right to delete personal data (with exceptions)</li> Right to opt out of the sale or sharing of personal data</li> Right to correct inaccurate data</li> Right to limit the use of sensitive personal information</li> Right to non-discrimination for exercising these rights</li> </ul> To exercise: Most covered businesses have a “Do Not Sell or Share My Personal Information” link in their site footer, required by CCPA. For deletion, contact their privacy team directly. For data broker removal specifically, the California DELETE Act (effective 2026) requires the California Privacy Protection Agency to create a one-stop portal for data broker opt-outs. Other states: Virginia (VCDPA), Colorado (CPA), Connecticut (CTDPA), Texas (TDPSA), and several others have passed state-level privacy laws since 2021. Rights vary by state but generally include access, deletion, and opt-out of targeted advertising. Regulator: The California Privacy Protection Agency (CPPA) handles CCPA/CPRA complaints. For HIPAA violations, the Office for Civil Rights at HHS. For FCRA violations, the Consumer Financial Protection Bureau (CFPB) and the FTC. European Union (GDPR)</h3> Rights available: Access (Article 15): What data, what purpose, who it’s shared with. Response within 30 days.</li> Rectification (Article 16): Correct inaccurate data. No charge.</li> Erasure (Article 17): Request deletion. Subject to exceptions detailed above.</li> Restriction of processing (Article 18): Pause processing while disputing accuracy.</li> Data portability (Article 20): Receive your data in machine-readable format.</li> Right to object (Article 21): Object to processing based on legitimate interest; absolute right to object to direct marketing.</li> Rights related to automated decision-making (Article 22): Object to decisions made purely by automated means, including profiling.</li> </ul> How to exercise: Identify the company’s Data Protection Officer (required for large processors — contact details must be in the privacy policy). Send a written request by email stating the specific article you’re invoking. They must respond within 30 days. For non-response or improper refusal, file a complaint with your national Data Protection Authority. Key regulators: CNIL (France): cnil.fr</li> BfDI (Germany): bfdi.bund.de</li> DPC (Ireland): dataprotection.ie — handles complaints against Meta, Google, Apple, Microsoft, TikTok, and most US tech companies headquartered in Dublin</li> ICO (UK): ico.org.uk (post-Brexit UK GDPR)</li> Garante (Italy): garanteprivacy.it</li> </ul> Cost: Free for the first request. Companies can charge a reasonable fee for subsequent manifestly unfounded or excessive requests. United Kingdom (UK GDPR)</h3> After Brexit, the UK retained the GDPR framework as UK GDPR, enforced by the Information Commissioner’s Office. As of mid-2026, the core rights remain substantively similar to EU GDPR. The UK changed the framework through the Data (Use and Access) Act 2025 (Royal Assent June 2025, most data-protection provisions in force by mid-2026). It adds flexibility on legitimate interests, reshapes the rules on solely automated decisions, and eases some administrative requirements. The core individual rights remain in place. How to exercise: Same as EU GDPR. The ICO has a complaints portal at ico.org.uk. The ICO can fine companies up to £17.5 million or 4% of global annual turnover. Notable enforcement: The ICO fined British Airways £20 million in 2020 for a 2018 breach affecting 400,000 customers. The fine was reduced from an initial notice of £183 million. Enforcement is active. India (DPDPA)</h3> The Digital Personal Data Protection Act 2023 came into force in stages. Its rules were notified in November 2025. The rights framework includes: Right to access information about data processing</li> Right to correction and erasure of personal data</li> Right to grievance redressal</li> Right to nominate a person to exercise rights in case of death or incapacity</li> </ul> How to exercise: Submit a request to the company’s Data Protection Officer or designated grievance officer (required for significant data fiduciaries). Companies must acknowledge and respond within the timelines set by the rules. Important limits: The DPDPA contains broader exemptions for government data processing than GDPR. Its enforcement is still ramping up. The Data Protection Board of India, the designated enforcement body, has been formally established, but its full penalty powers and most compliance duties phase in through 2027. For now, the primary route is the grievance officer process, with escalation to the Board as its powers come into force. Key difference from GDPR: The DPDPA does not include an equivalent to GDPR’s right to object to processing or a right to data portability in the same terms. The erasure right exists but is narrower than GDPR Article 17. The underlying asymmetry — companies holding broad contractual licenses and statutory limitations on your ability to constrain them — is structural. The rights described above are real and worth exercising. An erasure request removes your data from an active marketing database. A SAR reveals what a data broker actually holds on you. An Article 21 objection stops direct marketing. These have immediate, practical effects. But they operate within a system that leaves a lot in place. The data that already exists. The inferences already drawn. The licenses already granted in terms of service you agreed to. The phrase “your data” describes something you can influence. It doesn’t describe something you own. Want to see what data brokers expose about you? See what a scan finds →</a> shows an example report: the kinds of sites that list your name, phone, and address. Once KnytX Shield launches it will find and remove these automatically. Join the waitlist</a> to get in early. How to Remove Your Data from the Indian Internet Unknown — Wed, 11 Mar 2026 00:00:00 +0000 Type your own name into Google. Then add your city. If you’ve lived at the same address for more than two years, the results will unsettle you. JustDial lists your phone number. Truecaller shows your area. Sulekha has the listing you never created. AskLaila still shows the home number you disconnected in 2021. Your data is everywhere — and most of it got there without you ever clicking “agree.” This guide walks you through exactly which sites list Indian personal data, how to remove yourself from each, and what to expect when they relist you six weeks later. Why your data ends up on 200+ sites</h2> Data brokers don’t hack you. They aggregate what’s already technically public: voter rolls, property registrations from the local municipal office, telecom directories, Aadhaar-linked business filings, and app permissions you approved without reading. One piece of data — your mobile number from a UPI registration, say — becomes the seed record. From there, brokers cross-reference it with delivery addresses from e-commerce databases, employment records from LinkedIn scrapers, and family member data from WhatsApp profile lookups. Within months, a profile emerges that’s more complete than anything you’d willingly share. That profile then gets licensed to dozens of downstream sites. Each one resells or republishes it to others. By the time your name appears on Pipl or Whitepages, it has passed through six to eight intermediaries — each one a legitimate barrier you’ll have to contact separately to request removal. The sites that list Indians’ personal data</h2> People-search directories are the most visible problem. JustDial is the largest in India, with tens of millions of listings. It shows full name, phone number, address, and business category for anyone it has a record on, whether or not that person ever listed themselves. AskLaila operates similarly, pulling data from telecom records, user contributions, and scraped yellow-pages databases going back to 2007. TrueContact aggregates mobile numbers with associated names and locations, often sourced from spam-reporting apps and bulk SMS sender registries. Have you searched your name on JustDial lately? If not, open a new tab and do it now, before reading further. The result is usually more detailed than people expect. Caller ID and contact aggregators present a separate challenge. Truecaller has over 388 million registered users worldwide and builds its contact database from phone books that users voluntarily upload — meaning your number appears in Truecaller’s database because someone else’s phone had your number saved. You had no say in it. GetContact works the same way, using crowdsourced contact names to build searchable profiles. You never signed up, but you’re in there, probably under whatever label your last delivery person saved you as. Business directories reach further than most people assume. Sulekha, Indiabizinfo, and similar sites list not just registered businesses but individual service providers, freelancers, and anyone who ever registered a GST number or filed a Udyam certificate. If you’ve ever operated as a sole proprietor, your personal mobile number is almost certainly on Indiabizinfo — attached to your business name, PAN category, and home district. The registration you filed to get a small business loan in 2019 is still live on four different directories. Global data brokers carry Indian data too. Spokeo</a>, Whitepages</a>, and Pipl all maintain profiles on Indians, sourced from international business registries, LinkedIn data, and purchased datasets from Indian brokers. These sites are often overlooked, because they sit on .com domains and feel less relevant to an Indian user. But they rank high in Google results for English searches. Background-check companies and international employers query them actively. The full opt-out steps for those US sites are in how to remove yourself from US data brokers</a>. How to remove yourself — step by step</h2> There is no single portal, no universal opt-out, and no “delete all” button. Each site has its own removal process, and most are designed to make you give up before you finish. Work through these in order. JustDial Go to justdial.com and search for your listing by name and city.</li> Click on your listing, then select “Claim this listing.”</li> Once claimed, navigate to “Edit Listing” and use the suppress or close option to mark it as closed or inactive.</li> If you don’t have a business listing, use their contact form at justdial.com/contact-us and submit a removal request citing your name, mobile number, and the URL of the listing.</li> JustDial typically processes these within 7–14 business days, though some users report delays up to 30 days.</li> </ol> Truecaller Go to truecaller.com/unlisting — this is the only official opt-out URL.</li> Enter your phone number with the +91 country code.</li> Select your reason for unlisting and submit.</li> Truecaller removes the number from search within 24 hours, but it takes up to 48 hours to propagate across all app versions.</li> Note: if someone re-adds your number to their phonebook and uploads contacts again, Truecaller will relist you. There is no permanent opt-out.</li> </ol> GetContact Open the GetContact app on your phone.</li> Go to Profile > Privacy > Unlist My Number.</li> Confirm with your registered phone number.</li> GetContact unlists within 24 hours on the app. Web search results take longer — up to 7 days.</li> If you’re not a registered user, email support@getcontact.com with your number and a screenshot of the listing.</li> </ol> AskLaila AskLaila does not have a self-serve removal tool.</li> Go to asklaila.com and use the contact form under “Report a Problem.”</li> Submit your full name, the URL of your listing, and a government-issued ID (Aadhaar or PAN card) as identity proof.</li> State explicitly that you are requesting removal under the Digital Personal Data Protection Act 2023, Section 12.</li> Response times vary — typically 10–21 days. Follow up if you don’t hear back within two weeks.</li> </ol> Indiabizinfo Go to indiabizinfo.com and locate your listing.</li> There is no online removal form. Email contact@indiabizinfo.com directly.</li> Include: your full name, the exact URL of the listing, your business registration number or PAN (for verification), and a written request for deletion under DPDPA Section 13.</li> Most requests receive a response within 14 days. Actual deletion can take up to 30 days.</li> </ol> For global brokers like Spokeo</a> and Whitepages</a>, removal instructions live on each site under “Privacy” or “Do Not Sell My Info.” Whitepages calls the phone number on your listing to verify the request. Spokeo sends a confirmation link to your email after you submit the opt-out. Submit requests to both, then verify three weeks later by searching your name directly. Why the process is designed to frustrate you</h2> Let’s be honest about what’s happening here. These removal processes are not designed to protect your privacy. They are designed to protect the business model. AskLaila asking for a government-issued ID before removing your address is a perfect example. They collected your data without your consent and without asking for proof of identity — not once. But to remove it, you must hand over your Aadhaar number. Think about what that means. The only way to stop a site from publishing your personal data is to give them more personal data. That’s not a privacy policy. That’s an extortion loop dressed up as compliance. JustDial’s “claim” flow is another dark pattern. The path to suppress your listing runs through a business verification process designed to let restaurants and shops control their profiles — not for individuals who never created a listing in the first place. It works, eventually, but requires navigating a UI built for business owners, accepting email OTPs sent to numbers you no longer control, and waiting through queues designed around bulk business requests, not individual ones. Deliberate friction compounds this. Removal forms are buried three or four clicks deep, labeled with vague terms like “Report an issue” rather than “Remove my data.” Contact addresses for data officers are not published on the main site. You have to file an RTI or hunt through legal disclaimers. Removal requests cite legal sections most people have never heard of, require formats nobody uses in daily communication, and then get routed to support teams that treat them like spam tickets. Each barrier eliminates a percentage of people who started the process. That is precisely the intent. And the 72-hour re-listing window — the period after removal during which the original source database can push a refreshed record — is not a technical limitation. It is a deliberate policy choice. Sites can honor removals indefinitely if they choose to. Most don’t, because every listing is a data asset generating ad revenue and API query fees. Your legal right to demand removal</h2> India’s Digital Personal Data Protection Act 2023 gives you a formal right to erasure. Section 12 establishes a clear right. Every data principal (that’s you) can ask a data fiduciary (any company processing your data) to correct or erase personal data that is no longer necessary for the purpose it was collected. You can invoke this formally. Write a letter or email to the site’s Grievance Officer. All Data Fiduciaries must appoint a Grievance Officer (§13); only entities designated as Significant Data Fiduciaries by the central government must appoint a DPO (§10). Your request should include four things: your full name, the specific data you want erased, the URL where it appears, and a citation of Section 13 of the Digital Personal Data Protection Act 2023. Give them a 30-day deadline to respond, and specify a calendar date. If they fail to respond or refuse without lawful justification, you can file a complaint with the Data Protection Board of India. The Board was stood up in late 2025 and can impose significant financial penalties on non-compliant data fiduciaries. Enforcement is phasing in through a soft-enforcement window in 2026, with the heaviest penalties for core obligations arriving by mid-2027. This route takes more time than a direct request, but it carries genuine legal weight and gives you a documented trail if you need to escalate. For a full breakdown of every right DPDPA grants you and how to exercise each one, read our DPDPA rights practical guide</a>. The re-listing problem</h2> Here is what no one wants to tell you: removal is not a one-time fix. Within 30 to 90 days of a successful removal, most sites will relist you. The underlying data sources — telecom records, voter rolls, property registries, business filings — don’t change when you request removal from a downstream site. They keep feeding data into the broker ecosystem on automated refresh cycles. The broker’s pipeline picks up a new record that matches your profile and creates a fresh entry. You’re back, sometimes with updated information that wasn’t in the original listing. This is not a bug. It is a structural feature of how these businesses operate. They license data from primary sources on rolling monthly or quarterly contracts. Those contracts update their databases continuously, often automatically. A removal from JustDial does nothing to the municipal property record that JustDial’s scraper checks every 30 days. The scraper doesn’t know or care that you submitted a removal request last month. Truecaller’s unlisting holds until someone installs Truecaller fresh and uploads their contacts, which includes your number. That happens millions of times a day across India. GetContact relists you the moment a new user’s phonebook is synced and your number is in it. Indiabizinfo refreshes from MCA and GST records; if your registration is still active, your data comes back. This is also why the removal instructions above, followed diligently, will get you clean for a few weeks — and then require you to start over. Treat removal as a recurring maintenance task, not a problem you solve once and forget. Set a monthly calendar reminder. Check the same 15–20 sites each time. Resubmit wherever you’ve been relisted. The realistic goal is not permanent erasure. It is continuous suppression. Every month you resubmit is a month less of your address being accessible to someone who shouldn’t have it. What you can do right now</h2> Want to see what data brokers expose about you? See what a scan finds →</a> shows an example report: the kinds of sites that list your name, phone, and address. Once KnytX Shield launches it will find and remove these automatically. Join the waitlist</a> to get in early. Dark Patterns: UX Traps Built to Steal Your Consent Unknown — Tue, 10 Mar 2026 00:00:00 +0000 In December 2022, the Federal Trade Commission charged Epic Games, maker of Fortnite, one of the most-played video games on the planet. The charge: using “dark patterns” to manipulate millions of players, including children, into making unintended purchases. The FTC’s complaint was specific. Fortnite’s interface was designed so that pressing a button while loading into a match, or while a controller vibration occurred, would trigger an instant purchase. The “V-Buck” currency the game used obscured the real cost of items. Cancellation paths were buried. Children had spent family money they didn’t mean to spend, and parents had no straightforward way to get it back. Epic settled for $245 million — at the time, the largest amount ever paid in an FTC action over dark patterns. That case mattered because it named the practice out loud, at scale, with a financial consequence attached. Epic did not accidentally design a confusing interface. The confusion was the design. The patterns that extracted $245 million in unintended charges were deliberate choices, made by teams of designers and product managers who knew exactly what they were doing. This is what dark patterns are: interface decisions made with the intent to manipulate rather than inform. Understanding them is not a technical exercise. It requires recognising a set of recurring tricks and knowing what to do when you see them. The short answer: Dark patterns are interface designs built to manipulate you rather than inform you. Common ones include confirmshaming (guilt-tripping decline buttons), roach motels (easy to join, hard to cancel), manipulative cookie banners, trick questions, and fake close buttons. They are now regulated: GDPR, the EU’s Digital Services Act, the FTC Act, and California’s CPRA all address them. Your defence is to recognise the pattern and act anyway: if declining is harder than accepting, decline anyway. Tools like uBlock Origin and Consent-o-Matic automate cookie rejection. Where does the term “dark pattern” come from?</h2> UX researcher Harry Brignull coined the term “dark pattern” in 2010. He had been cataloguing interface designs that appeared engineered to work against users. Not through bugs or honest mistakes, but through deliberate choices that served the company at the user’s expense. He started a site, darkpatterns.org, documenting specific examples with screenshots and named categories. What he was describing was not new, but naming it gave critics and eventually regulators a shared vocabulary. That vocabulary entered law in the European Union. GDPR Article 7, read alongside Recital 32, requires that consent be freely given, specific, informed, and unambiguous — and that withdrawing consent must be as easy as giving it. Any interface designed to make refusal harder than acceptance fails that test by definition. The EU’s Digital Services Act (DSA) took effect for large platforms in August 2023, and it goes further. Article 25 of the DSA explicitly prohibits platforms from using dark patterns to manipulate users’ choices, or interface design to subvert users’ intentions. In the United States, the FTC has pursued dark patterns cases under Section 5 of the FTC Act, which bans unfair or deceptive acts in commerce. The Epic action was one. California’s CPRA, which amended the CCPA from 2023, specifically prohibits using dark patterns to obtain consent. It defines them as “user interfaces designed or manipulated with the substantial effect of subverting or impairing user autonomy, decision-making, or choice.” The legal definition tracks Brignull’s original framing closely. The term that started as a UX researcher’s classification project is now embedded in federal enforcement actions and state privacy law. Confirmshaming</h2> The name comes from “shaming the user for confirming refusal.” It appears most often in email opt-in prompts, subscription popups, and GDPR-era consent banners. A popup asks if you’d like to receive marketing emails. The opt-in button reads “Yes, save me money.” The opt-out button reads “No thanks, I don’t want to save money.” The asymmetry is deliberate. It is designed to make the user feel foolish, vain, or self-defeating for declining. Other common formulations include “No thanks, I prefer to pay full price,” “No, I don’t care about my health,” and “No, I’d rather stay uninformed.” The factual claim embedded in the refusal button is almost always false or manipulative. There is no savings guarantee on the other side of that email list. But the framing exploits social discomfort at the moment of a decision. Confirmshaming does not force you to consent. It pressures you through language that implies your refusal is irrational. You can recognise it instantly: if the decline button is phrased as a statement you’re making about yourself rather than a simple refusal, you’re looking at confirmshaming. Click it anyway. Roach motels</h2> The roach motel is defined by asymmetry between sign-up and exit. Getting in is designed to be fast and frictionless. Getting out is designed to require effort, time, and persistence. Amazon Prime’s cancellation flow was the canonical example for years. In the European Union, Prime cancellation required navigating five or six screens. Each one offered to pause the subscription, reduce the price, transfer it to a family member, or otherwise avoid the cancellation you had explicitly requested. Each screen was a soft checkpoint, formatted to look like the process was complete, while actually presenting another offer to stay. In the US, Amazon Prime’s cancellation flow was the subject of an FTC lawsuit filed in June 2023. It alleged that the company enrolled people without clear consent, then made cancellation so difficult that members gave up. After regulatory pressure across the EU and the FTC action, Amazon simplified the flow. But the practice ran for years and cost subscribers money they didn’t intend to spend. Gym memberships, streaming services, news subscriptions, and software trials all rely on roach motels. The sign-up process takes 90 seconds. The cancellation requires a phone call during business hours to a retention team trained to talk you out of leaving. Some services bury cancellation behind in-app flows that are inaccessible on desktop, or web flows that are inaccessible on mobile. Checking whether a service has a straightforward cancellation path before you subscribe is a reasonable precaution. Cookie banner manipulation</h2> The cookie consent banner is where dark patterns meet data collection at the largest possible scale. Billions of people encounter these banners every day. The design of most of them is not neutral. The typical manipulative implementation: a large, colored “Accept All” button presented at eye level. A small, grey “Manage Preferences” link in fine text below it. Click “Manage Preferences” and you find yourself inside a panel with dozens of categories and potentially hundreds of individual toggles for third-party vendors, all pre-enabled. The “Save” button is at the bottom of a scrollable list. There is no “Reject All” button on the main banner. This design is illegal in the EU. France’s CNIL ruled in January 2022 that Google and Facebook were violating GDPR by making consent to cookies significantly easier than refusing them. Google was fined €150 million. Meta received €60 million. The specific violation was the absence of a “Reject All” option at the first layer of the banner. GDPR requires that consent to tracking and refusal of tracking be presented with equal prominence and equal ease. Meta’s data practices faced further scrutiny in January 2023. The Irish Data Protection Commission fined Meta €390 million over how it obtained consent for targeted advertising on Facebook and Instagram. Meta had been relying on “contract necessity” as a legal basis for processing personal data for ads. In effect, it argued that serving you personalised ads was necessary to provide the service you signed up for. The DPC, backed by the European Data Protection Board, rejected that argument. It is not necessary for Meta to show you targeted ads. It is profitable for Meta. The legal basis for personalised advertising in the EU is now explicitly consent, not contract — meaning Meta needs your affirmative, freely given agreement. The fine reflected years of design choices made to avoid asking for that agreement cleanly. Trick questions and double negatives</h2> The double-negative checkbox is simple and old. A pre-ticked box reads: “Uncheck here if you do not wish to not receive marketing emails from our partners.” Now parse that. Figuring out whether leaving it ticked means opted in or opted out takes more focus than anyone applying for a loyalty card in a supermarket queue has available. Pre-ticked checkboxes are explicitly banned under GDPR — they have been since the regulation came into force in 2018. They remain common outside the EU and in jurisdictions with weaker rules. The intent is to produce consent through inattention. The user has to actively opt out. When the opt-out also requires understanding a double negative under time pressure, a significant proportion of users will not successfully opt out. Trick questions appear in slightly subtler forms in app setup flows. Take “Help us improve by sharing usage data,” with a toggle that defaults to on, presented mid-flow during account setup. It is not technically a dark pattern, but it operates like one. The placement — between steps the user is trying to complete — exploits the user’s desire to keep moving. Most people tap “Continue” without reading. That is the intended outcome. Misdirection and fake close buttons</h2> The X button on a popup is supposed to close it. In a misdirection dark pattern, the X closes the popup in some cases and triggers the popup’s primary action in others. A modal asking you to enable notifications may have an X in the corner that, on closer inspection, activates the notification request rather than dismissing it. The visual language of “X means close” is being used against its own meaning. Disguised ads are a variant. Search results on major engines are labelled as ads, but the label is small, low-contrast, and positioned to blend with organic results. Studies by consumer organisations have found that a significant proportion of users cannot reliably distinguish sponsored results from organic ones, even when labels are present. The interface is designed to reduce the salience of the “Ad” label. On comparison shopping sites and app stores, sponsored listings are often indistinguishable from ranked results unless you already know to look for the label. Social proof nudges for consent</h2> “87% of users share their location with us to get better results.” This framing uses social proof: the Cialdini principle that people look to others’ behavior to decide what is correct. The effect is to make sharing feel normal and withholding feel deviant. The statistic may be true, meaningless, or fabricated. Its function in the interface is persuasion, not information. It is placed on the location permission request screen to lower the psychological cost of consenting. Related to this: progress bar consent flows. An onboarding flow presents a progress bar showing you are “80% done setting up your account.” But the remaining 20% includes a permissions screen asking for access to your contacts, microphone, and location. The progress bar creates a completion pressure — you’re almost done; you don’t want to leave the setup unfinished. The permissions screen is designed to feel like a required step rather than an optional choice. Forced account creation and privacy policy walls</h2> Some services require you to create an account before using features that don’t require an account. The account creation flow asks for name, email, date of birth, and sometimes phone number. Each field is a data collection opportunity. The email becomes a contact point for marketing. The date of birth confirms you’re over a threshold age and enriches a demographic profile. The phone number enables cross-platform identity matching. None of this is necessary to provide the service. The account requirement is the dark pattern. The privacy policy wall works differently. You’ve been using a service — sometimes one you’ve paid for. The company updates its terms and presents you with a modal: “We’ve updated our privacy policy. By continuing to use [service], you agree to the new terms.” The new terms expand the company’s rights to process and share your data. Your only option to refuse is to stop using the service. This is sometimes called “consent or leave.” Under GDPR, it fails the “freely given” requirement — consent obtained under threat of losing a paid service is coerced. Under US law, it’s generally enforceable. Reading the diff between the old and new terms when these notices appear is worth the time. The data collection connection</h2> Dark patterns are not merely annoying interface choices. They are mechanisms for collecting more data than users would consent to if the interface were honest. Every percentage point increase in cookie acceptance rates translates into a richer behavioral tracking profile on each user. Every additional field filled in during a forced account creation represents another data point in a commercial profile. Every user who fails to navigate an opt-out flow represents a longer retention of their data. More data collected through manipulative means means more data exposed when that company suffers a breach. The Irish DPC’s Meta fine involved data used to build advertising profiles. That same data — behavioral histories, demographic information, cross-site tracking records — is exactly what appears in breach datasets. The size of a company’s data collection footprint directly determines the scale of harm when their systems are compromised. Reducing what they collect about you, by resisting dark patterns wherever possible, reduces your exposure. What regulators are actually doing</h2> Enforcement is accelerating. The FTC’s Epic Games action in December 2022 was followed in June 2023 by the FTC’s complaint against Amazon over Prime enrollment and cancellation practices. The FTC has also published guidance explicitly naming dark patterns as unfair or deceptive practices under Section 5 of the FTC Act. That signals more enforcement actions are coming. In the EU, DSA Article 25 is the strongest instrument. It applies to “very large online platforms,” those with more than 45 million monthly active users in the EU. It prohibits using interface design to deceive users or distort their decision-making. The European Commission has investigative authority under the DSA and has already opened proceedings against several major platforms under its provisions. California’s CPRA, effective January 2023, prohibits using dark patterns to obtain consent for the sale or sharing of personal data. It writes this prohibition directly into the definition of valid consent. The California Privacy Protection Agency (CPPA) is still in its early enforcement phases, but the statutory prohibition is in place. The UK’s ICO published specific guidance on dark patterns in 2022, identifying them as inconsistent with GDPR-derived UK law, and has named them in enforcement contexts. None of this enforcement moves quickly enough to protect you in real time. The practical defense is recognising the patterns yourself. How to spot dark patterns and what to do</h2> When you encounter a popup, consent banner, or permissions request, apply two tests before acting. First: is the refusal path as easy to find and use as the acceptance path? If the “Accept” button is large, colored, and prominent, and the “Decline” option requires three clicks through nested menus, you are looking at a manipulative design. Decline anyway — it just takes longer. Second: is the language on the refusal option a description of your choice, or a statement about your character? If declining feels like agreeing that you are foolish or self-defeating, that is confirmshaming. It does not mean accepting is the right decision. For cookie banners specifically: install Consent-o-Matic, a browser extension built by researchers at Aarhus University that recognises common consent management platforms and automatically selects the most privacy-protective option. It is available for Firefox, Chrome, and Edge, and it handles the navigation of multi-level preference panels automatically. Firefox with uBlock Origin blocks many tracker requests before they load regardless of what you click on a consent banner. Brave Browser applies equivalent blocking by default without requiring extensions. For account creation dark patterns: use a temporary or aliased email address for accounts you don’t fully trust. Services like SimpleLogin or Apple’s “Hide My Email” generate unique forwarding addresses. You can sign up, evaluate the service, and revoke the forwarding address if it is used for spam. In the EU, you can file a complaint with your national data protection authority when you encounter a clear violation. Examples include a cookie banner with no “Reject All” button, a pre-ticked marketing consent checkbox, or a service requiring cookie acceptance as a condition of access. In France: cnil.fr/plainte. In Germany: the state-level DPA for your region (a list is maintained at bfdi.bund.de). In Ireland: dataprotection.ie. In the UK: ico.org.uk/make-a-complaint. Complaints from users are how most GDPR enforcement cases begin. For US residents: the FTC accepts reports at reportfraud.ftc.gov. California residents can file complaints with the CPPA at cppa.ca.gov. These reports build the factual record regulators use when deciding where to direct enforcement attention. What you can do right now</h2> Practical steps that require no technical expertise: Take five minutes and audit the apps on your phone for location permissions. Go to Settings > Privacy (iOS) or Settings > Location (Android) and revoke location access for any app that doesn’t need it to function. Navigation apps need location. A weather app you opened twice doesn’t. On the same screen, check which apps have microphone and camera access. Revoke anything that does not have an obvious reason to listen or watch. When you next see a cookie banner, do not click “Accept All.” Click “Manage Preferences” or the equivalent, turn everything off, and save. Use Consent-o-Matic to automate this going forward. Before subscribing to any paid service, look up the cancellation process. If it requires a phone call or is not clearly described, treat that as a warning about how the company operates. When an app’s setup flow asks for permissions mid-sequence, stop. Tap the “Don’t allow” or “Skip” option if one exists. If it does not exist and the permission is not required to use the app, decline and report the behavior to the relevant app store. The more data you successfully withhold through these steps, the smaller your exposure when — not if — one of the companies holding your data suffers a breach. Companies that collect less data lose less when they are compromised. Reducing their take through informed resistance to dark patterns is a direct privacy protection measure. The patterns described here are not hypothetical. They are live, in production, on sites and apps you use today. They were put there by people who knew what they were doing. Recognising them is the first step to not being manipulated by them. See what a scan finds →</a> walks through an example report of the kinds of data brokers expose. KnytX Shield isn’t live yet; join the waitlist</a> to run your own scan at launch. The Apps That Quietly Sold Your Data Unknown — Mon, 09 Mar 2026 00:00:00 +0000 An astrology app asks for access to your contacts. You want your horoscope. You tap Allow. That tap just handed over the names, phone numbers, and email addresses of everyone in your phonebook. Your family, your colleagues, your doctor. It all went to a company you’ve never heard of. The astrology app didn’t need your contacts to read your birth chart. It needed them because contacts are valuable, and someone will pay for them. How do free apps sell your data? They embed advertising and analytics SDKs, small code packages from third-party firms that do the collecting. The SDK gathers your location, contacts, and device identifiers, then packages and sells them to data brokers. The worst offenders are loan apps, astrology apps, photo editors, and utility apps. This is the business model behind almost every free app on your phone. The real business model of free apps</h2> Building an app costs money. Developers pay for servers, engineers, and marketing. If the app is free and has no subscription, the money has to come from somewhere. It comes from data. Free apps embed advertising and analytics SDKs — small code packages from third-party companies that do the actual data collection. The developer plugs in an SDK, agrees to the terms, and gets a revenue share. The SDK company does the rest: collecting behavioral data, location history, device identifiers, and contact lists, then packaging and selling this to data brokers and advertisers. Several of the largest players in this ecosystem are Indian or operate prominently in India. InMobi, founded in Bangalore, is one of the world’s biggest mobile advertising networks. MoEngage and CleverTap are Mumbai-based customer engagement platforms used by thousands of Indian apps. ironSource (now part of Unity) powers monetization for Indian mobile game developers. When you install a free app, you’re often installing four or five of these SDKs at the same time. Each one is collecting data. None of them are the company whose name is on the app. Which app categories are worst</h2> Not all apps are equally invasive. Some categories have business models that make data collection especially aggressive. Loan apps are the worst offenders. Dozens of instant loan apps ask for Aadhaar number, PAN, contact list access, SMS read permissions, and location. All of it is justified as KYC (Know Your Customer) requirements. Some of this is legitimate. Most of it is not. A loan app does not need to read every SMS on your phone to verify your identity. It needs your bank statements. The excess data (your contacts, location history, and call logs) gets retained and sold long after your loan is repaid. Astrology apps have become notorious for permissions that make no logical sense. An app that shows you your daily horoscope has no conceivable use for your contact list. Yet many request it. Why? Contacts are a high-value data category because they map real social graphs. Photo editing and filter apps request storage access to do their job — that part is legitimate. The problem is that broad storage access on Android lets an app read far more than the photo you’re trying to edit. Documents, screenshots, downloaded files, other images. Apps that exceed what they need for their core function are worth treating with suspicion. Utility apps — flashlight apps, phone cleaner apps, battery optimizer apps — are the classic trap. They perform a trivial function that Android does natively anyway, and they use that tiny footprint to request permissions that make no sense. A flashlight app asking for your location is not optimizing your torch. It’s collecting a data point to sell. What the permissions actually mean</h2> Android permission dialogs are written to sound harmless. Here’s what they actually do. Contacts — access to your entire phonebook, not just your own number. Every name, every phone number, every email address your contacts have ever given you. This maps your social graph and exposes people who never agreed to anything. Location (precise) — your GPS coordinates, accurate to a few metres. This can be sold to location data brokers who build movement profiles: where you live, where you work, which hospital you visited, which political rallies you attended. Storage / Media — read access to files on your device, including photos, downloaded documents, and screenshots. This is broader than it sounds. Phone (read phone state) — access to your IMEI number (the unique hardware identifier for your device), your carrier, and your call state. Your IMEI doesn’t change when you change SIM cards. It’s a permanent tracking identifier that follows your physical device. Every one of these permissions has a legitimate use in the right context. The question is whether the app you’re granting it to actually needs it. How to audit your own apps</h2> Google added a Data safety section to every app’s Play Store listing in 2022. Open the Play Store, find any app, scroll down, and you’ll see what data the developer says is collected — broken down by data type and whether it’s shared with third parties. It’s self-reported, which means it’s only as honest as the developer. But it’s still useful. If a flashlight app’s Data safety section shows it collects “Location — precise” and shares it with third parties for “Advertising or marketing,” that’s the developer admitting it in writing. For a more honest view, go to Android Settings > Privacy > Permission manager. This shows you every app on your phone sorted by permission, not the other way around. Open “Location” and you’ll see every app that has ever been granted location access. Open “Contacts” and you’ll see who can read your phonebook. Revoke anything that surprises you. The app will still work for its core function in most cases. The Indian regulatory gap</h2> The DPDPA requires companies to get meaningful consent before collecting personal data. In principle, every app that collects your location or contacts needs valid consent under Indian law. In practice, the rules around what counts as valid consent for app permissions are still being written. MeitY has flagged specific apps — particularly Chinese-origin apps — and removed some from Indian app stores. But enforcement against the broader SDK ecosystem, which operates across thousands of apps simultaneously, is minimal. The law is real. The enforcement is not yet. That means the work of protecting your data has to start with you, not with regulators. What actually helps</h2> Deny unnecessary permissions when you install an app. Read the permission dialog — it takes ten seconds. Ask yourself whether this app could possibly need this access to do what it claims to do. For location specifically, Android gives you three choices: Allow all the time, Allow only while using the app, and Don’t allow. “Allow only while using” is almost always the right choice. It means the app can see your location when you have it open, but not when it’s running in the background. Delete apps you don’t use. An app you installed two years ago and opened once still has the permissions you granted it, still runs background processes, and still collects data. Before installing a new app, open its Play Store listing and read the Data safety section. If a utility app claims to collect device identifiers and share them with advertisers, install something else. For a broader set of tools, including secondary phone numbers and email aliases that limit what apps collect in the first place, see email aliases and phone masks</a>. The location and identifier data these apps leak often ends up on people-search and aggregator sites like Spokeo</a> and Acxiom</a>, which you can then request removal from. Frequently asked questions</h2> Which free apps sell the most data? Loan apps, astrology apps, photo editors, and utility apps (flashlights, cleaners, battery savers) are the most aggressive. Each requests permissions well beyond what its core function needs. How do I check what an app collects? Open the app’s Play Store listing and read the Data safety section, then go to Android Settings > Privacy > Permission manager to see every app sorted by permission. Revoke anything that surprises you. Does deleting an app stop it selling my data? It stops new collection, but data already sold has already left. Deleting unused apps still matters: an app you installed once keeps its granted permissions and can keep collecting until you remove it. What you can do right now</h2> Want to see what data brokers expose about you? See what a scan finds →</a> shows an example report: the kinds of sites that list your name, phone, and address. Once KnytX Shield launches it will find and remove these automatically. Join the waitlist</a> to get in early. What Truecaller Knows About Non-Users Unknown — Sun, 08 Mar 2026 00:00:00 +0000 Go to truecaller.com and search your own phone number. If you’ve never installed the app, you’ll probably still see your name. Sometimes your employer. Sometimes your neighborhood. Data that you never gave Truecaller, from an account you don’t have. That’s not a bug. It’s the product. How does Truecaller know your name if you never signed up? Every Truecaller user grants the app access to their entire phonebook, which uploads to Truecaller’s servers. If anyone who has your number saved is a user, your name and number are in the database, under whatever label they gave you. You can unlist your number at truecaller.com/unlisting, but that only hides it from search. It doesn’t delete it, and a new upload can re-index you. For the full Indian-site removal playbook, see removing your data from the Indian internet</a>. You’re in their database. You didn’t sign up.</h2> Truecaller has over 388 million registered users worldwide, with India as its largest market. But the database contains far more than 388 million records — because every user contributes data about everyone in their contacts, whether those people ever consented to it or not. Search for yourself. Your name might appear exactly as a family member saves it (“Priya - Sister”), or as an old office colleague labeled you (“Rahul Finance Team”), or stripped down to just your name and number. The label depends entirely on how other people chose to categorize you. You never authorized any of their contact-syncing. This is the part Truecaller’s privacy policy mentions but their marketing never leads with. How contact sync works</h2> When you install Truecaller and grant it contact permissions — which the app essentially requires to function — your entire phonebook uploads to Truecaller’s servers. Not a sample. Not just the contacts you choose. Every single entry in your address book goes to Stockholm (where Truecaller’s servers are based). Each of those contacts is a real person who didn’t install Truecaller. They didn’t agree to any terms of service. They weren’t asked. Their name and phone number were submitted to a private Swedish company’s database by someone else who happened to have their number. Multiply this by 388 million users. Each user averages hundreds of contacts. The overlap between address books creates a dataset that covers effectively every active Indian phone number, with names attached. There are enough Truecaller users in any given social circle that your number appears in multiple uploaded phonebooks. This is how Truecaller’s database got so large so fast. The product didn’t grow by signing people up. It grew by harvesting the contacts of people who did sign up. What they actually hold on you</h2> The minimum entry in Truecaller’s database is your phone number and the name someone saved you as. But often there’s more. If multiple contacts saved you under different labels, Truecaller’s system aggregates the most common or most recent version of your name. If any contact saved you with your employer in the label — “Ankit - TCS”, “Deepa Infosys HR” — that information is part of your record. Truecaller also tracks call frequency patterns. They know how often your number calls or receives calls from their users, which feeds their spam-scoring system. This is aggregate behavioral data derived from your phone activity, collected from other users’ devices without your knowledge. Business contacts are particularly exposed. Say you work in sales, customer service, or any role where you call people frequently. Enough users may have reported you as spam that Truecaller flags your personal number as a potential nuisance caller. That’s the same number you use for your family, your bank, and your doctor. Their business model</h2> Truecaller is free. You are not their customer — you’re the inventory. Their primary revenue comes from Truecaller for Business, where companies pay to display a verified name when they call customers. Banks, e-commerce platforms, and fintech companies pay Truecaller to ensure their calls appear as “HDFC Bank — Loan Team” rather than an anonymous number. This verification network is only valuable because Truecaller controls caller-ID data for most of India’s smartphone users. They also run advertising within the app and sell analytics products to enterprises — aggregated call pattern data, spam trend reports, and market intelligence based on who’s calling whom across India. The product that’s “free for users” is a data infrastructure play built on harvested contact graphs. The consent model that built this business — uploading other people’s contacts without asking those people — is the engine of their commercial value. The opt-out: what it does</h2> You can unlist your number at truecaller.com/unlisting. You should do this. But understand what it actually accomplishes. Unlisting removes your number from public search results on Truecaller’s platform. If someone searches your number on their website or app, it won’t appear. Your name won’t show up when your number calls a Truecaller user. What it does not do: it does not delete your data from Truecaller’s servers. Your number remains in their database — it’s just suppressed from display. It also does not prevent your number from being re-indexed. The moment any new Truecaller user uploads a contact with your number, you can be pulled back into the searchable database. Truecaller acknowledges this in their own documentation (buried, but there). So opt out — yes, do it today — but treat it as damage reduction, not a clean solution. What DPDPA says about this</h2> The Digital Personal Data Protection Act 2023 requires meaningful consent before collecting personal data. “Third-party data” — data about a person collected from someone else — requires the data fiduciary to have a legitimate reason and, in most cases, the subject’s consent. Truecaller’s contact-sync model almost certainly does not meet this bar. The person whose data is uploaded never consents. The person uploading contacts can’t meaningfully consent on their behalf. The data is processed, stored, and monetized without the subject ever being notified. This isn’t a gray area. It’s a structural violation of what DPDPA is designed to prevent. But the law’s enforcement is still ramping up. India notified the DPDP Rules and stood up the Data Protection Board in late 2025. 2026 is a phased “soft enforcement” period, with substantive penalties for core obligations arriving by mid-2027. No major action against a large consumer app has landed yet. Truecaller operates in India knowing that meaningful enforcement risk is, for now, still on the horizon rather than active. For a detailed look at why enforcement is lagging despite clear statutory language, see our post on the DPDPA enforcement problem</a>. What you can do right now</h2> Want to see what data brokers expose about you? See what a scan finds →</a> shows an example report: the kinds of sites that list your name, phone, and address. Once KnytX Shield launches it will find and remove these automatically. Join the waitlist</a> to get in early. What Is a Stealer Log & Why It's Worse Than a Breach Unknown — Sat, 07 Mar 2026 00:00:00 +0000 In September 2024, a former Disney employee in Florida downloaded what he thought was an AI image generation tool from GitHub. The file was bundled with infostealer malware. Within minutes, the program had exfiltrated everything it could reach. Every saved password from his Chrome profile, every browser cookie, his 1Password vault, and a Slack session token still authenticated to Disney’s corporate workspace. The attacker used that single session to download more than 44 million internal Disney messages, surface unreleased project details, and dump the entire archive to a public leak site. Disney’s own systems were not breached. One employee’s laptop was. The U.S. Department of Justice indictment, filed in October 2024, named the malware family and confirmed the path: a free download, a stealer log, an active session, full corporate exposure. This is the part most people miss. The headline says “Disney leak.” The reality is a stealer log. Stealer logs explained</h2> A stealer log is the structured output of an infostealer. That’s purpose-built malware that runs once on a victim’s machine, harvests everything credential-shaped it can find, packages it into a folder, and ships it to a command-and-control server. The malware does not need persistence. It does not need to escalate privileges. It executes, exfiltrates, and exits. The folder it produces has a predictable shape. Browser passwords from Chrome, Edge, Firefox, and Opera, decrypted from the local credential store. Browser cookies, including the session cookies that authenticate you to Gmail, Outlook, Slack, AWS, GitHub, and your bank. Autofill data — names, addresses, card numbers. Cryptocurrency wallet files from MetaMask, Exodus, Atomic, and dozens of others. Screenshots of the desktop at the moment of execution. A system fingerprint: hostname, IP, installed software, hardware ID. Sometimes a Telegram or Discord session token. Sometimes a Steam or Epic Games login. That folder, zipped and named after the victim’s machine, is a stealer log. One person’s entire digital life, exported. The malware families running the show</h2> A handful of infostealer families dominate this market. They are bought, sold, and updated like any commercial software product. Redline Stealer has been the most prevalent since 2020. It is sold as malware-as-a-service for around $150 per month or $800 for a lifetime licence. Redline harvests credentials from over 30 browsers, FTP and email clients, VPN configs, and crypto wallets. In 2023, ESET and KrebsOnSecurity documented Redline logs containing credentials from inside Fortune 500 networks, military contractors, and government agencies. Operation Magnus, a coordinated international takedown announced in October 2024, disrupted Redline and Meta Stealer infrastructure — but successor families filled the gap within weeks. Lumma Stealer (sometimes branded LummaC2) emerged in 2022 and now ships more logs per day than Redline did at its peak. Lumma costs $250–$1,000 per month depending on the tier. It is sold openly on Russian-language forums and operated through a Telegram bot interface. Microsoft and the FBI executed a coordinated takedown of Lumma’s infrastructure in May 2025, seizing roughly 2,300 domains (Microsoft DCU takedown, May 2025). Within a month, operators had rebuilt on new infrastructure. Vidar has been around since 2018 and survives by being modular. Buyers configure exactly what they want extracted. Vidar logs often appear in initial-access broker listings — packaged with a description of the network the victim was logged into, ready to be sold to a ransomware crew. Raccoon Stealer went dark briefly in 2022 after its alleged operator was arrested in the Netherlands, then returned as Raccoon v2. Meta Stealer, RisePro, StealC, Atomic Stealer (the macOS specialist), and a long tail of less-known families round out the ecosystem. None of them is hard to find. None of them is expensive. How victims get infected</h2> The delivery vectors are mundane and effective. Cracked software downloads. A Google search for “Photoshop crack” or “Adobe Premiere activator” returns dozens of YouTube videos with download links in the description. The link goes to a password-protected ZIP hosted on MediaFire or MEGA. The password is required specifically because it prevents automated antivirus scanning of the archive. The ZIP contains the stealer. Fake software updates. SocGholish and similar campaigns inject “your browser is out of date” prompts into compromised WordPress sites. The download is the stealer. GitHub repositories impersonating real tools. AI image generators, game cheats, trading bots, NFT minters. The repository looks plausible. The README is convincing. The compiled binary is infostealer malware. Several Lumma campaigns in 2024 used this pattern. Malicious browser extensions uploaded to the Chrome Web Store before Google removes them. The extension requests broad permissions, scrapes everything it can reach, and disappears. Phishing attachments and ISO files delivered through compromised email accounts. The ISO contains an executable disguised as a PDF. Windows mounts the ISO automatically; the user double-clicks the “document” and the stealer runs. No exploit chain is needed. No zero-day. The user clicks once. Where logs end up</h2> Once a stealer has shipped its log to the operator, the log enters a distribution market that runs in parallel to the dark web breach economy. Russian Market is the largest dedicated marketplace for stealer logs and has been operational since 2019. Logs are listed individually with previews: domain count, country, antivirus status, last login dates for high-value accounts. A log with active sessions to a corporate Microsoft 365 tenant, a banking site, and a major SaaS platform might list for $200–$2,000. A log with only consumer accounts sells for $5–$15. Genesis Market ran a similar model. It sold not just logs but a custom browser plugin that loaded the victim’s cookies, fingerprint, and timezone, letting buyers impersonate the victim’s exact browser environment. The FBI seized Genesis in April 2023 in Operation Cookie Monster, arresting users in 17 countries. New marketplaces, such as 2easy.shop and RussianMarket clones, filled the niche within months. Telegram channels are the volume distribution layer. Channels with names like “CloudyLogs,” “RedLine Cloud,” “Daily Logs Free” post fresh logs in compressed archives daily. Some are free (used to advertise paid tiers); others are subscription-based at $50–$300 per month for access to several hundred thousand fresh logs. The Telegram model is faster than marketplace listings — logs are typically posted within hours of exfiltration. Initial access brokers sit one layer up the food chain. They buy stealer logs in bulk, filter for corporate credentials and active VPN sessions, and resell qualified access to ransomware affiliates. A Conti or LockBit affiliate looking for an entry point into a manufacturing company can buy curated access for $5,000–$50,000. The original stealer log that started that chain might have cost $20. Why password reset alone is not enough</h2> This is the part most “what to do after a breach” articles get wrong. When a credential pair leaks from a breach — your email and a hashed password from some forum that got dumped — changing the password closes the door. The attacker can no longer log in. A stealer log is different. The log contains not just your password but your session cookies: the small files in your browser that prove you have already logged in. When you click “remember me” on a site, the server issues a cookie that bypasses authentication for as long as the cookie is valid. Most major sites issue session cookies that last weeks to months. Some — Google’s, for instance — can stay valid for over a year if regularly used. A session cookie bypasses your password. It also bypasses multi-factor authentication. The MFA check happens at login. If the attacker imports the stolen cookie into their browser, the site treats them as already-logged-in. No password prompt, no MFA prompt, no email alert. This is how the Disney leak worked. This is how the 2022 Uber breach worked, with attackers using an active session obtained through a contractor’s compromised machine. The EA Sports breach in 2021 worked the same way. A Slack session cookie purchased for $10 on Genesis Market gave attackers persistent access to EA’s internal Slack. They used it to social-engineer their way into source code repositories. We covered this dynamic in detail in our post on session hijacking</a>. A password reset does not invalidate existing session cookies on most platforms. You have to explicitly revoke all sessions. Google calls it “Sign out of all devices,” Microsoft calls it “Sign me out everywhere,” and many platforms bury this option two or three menus deep. Some sites do not offer it at all. Until you revoke sessions, the attacker stays in. The compounding damage</h2> The damage from a stealer log is not the password leak. It is the combination. A log with your Gmail session gives the attacker your inbox, your password reset emails, and your contacts. With your inbox they can initiate password resets on every other site you use, intercept the reset email, and pivot. A log with your crypto wallet seed phrase — extracted from MetaMask’s local storage — gives the attacker every wallet derived from that seed, in every chain, forever. There is no reset. The funds move within minutes of the log being purchased. A log with your saved corporate credentials and an active VPN session gives the attacker your employer’s internal network at the access level you have. If you are a developer with GitHub credentials saved, the attacker has your source code. If you are a finance team member with Workday saved, the attacker has payroll. If you are an admin with cloud credentials saved, the attacker has the cloud. A log with your password manager’s vault file is worse still. The vault file syncs to your local machine for most managers, and it hands the attacker every credential you have ever stored, encrypted with your master password. If your master password is in the same log, because you typed it into a Chrome prompt that was scraped by the stealer, the vault is open. This is why infostealer infections are catastrophic in a way that single-site breaches are not. How to tell if you are in a stealer log</h2> The honest answer: most people will not know until something visibly goes wrong. Stealer logs do not produce the kind of public dump that breach-notification services pick up. They circulate in private channels and on marketplace listings indexed by hash and machine ID, not by email address. A handful of services index stealer logs and let you check exposure. HaveIBeenPwned added stealer log coverage in 2023, so searching your email there now flags whether it appears in any indexed log. Hudson Rock and SpyCloud run commercial stealer-log databases used by enterprise SOC teams. KnytX Vigil</a> is built to add stealer-log detection alongside standard breach monitoring on its Pro tier ($14.99/mo). Once it’s live, if your email or password shows up in an indexed log, Vigil is designed to alert you. Each alert would carry the machine fingerprint, the malware family if known, and a remediation checklist. Vigil isn’t live yet; join the waitlist</a> to turn it on at launch. See what a scan finds →</a> walks through an example report of the kind of exposure that turns up. If your own data surfaces, the urgent action is not just changing passwords. It is finding the infected machine, taking it offline, reformatting, and then revoking sessions everywhere. KnytX Shield isn’t live yet; join the waitlist</a> to run your own scan at launch. What to actually do</h2> If a stealer log is suspected, the response order matters. Identify the infected machine. Stealer logs almost always include a screenshot of the desktop and a system fingerprint. If you can see the log (services like Hudson Rock will show you the screenshot for your own exposure), the desktop tells you which device was compromised. If you cannot see the log, the infected machine is usually the one where you have the most browser-saved credentials. Take it offline and reformat. Antivirus removal of an active infostealer is not reliable. The malware may have dropped secondary payloads, scheduled tasks, or persistence mechanisms you cannot enumerate. The only durable response is a clean operating system reinstall from known-good media. From a different, clean device, change passwords on every account in priority order. Email first, then financial accounts, then cloud and SaaS, then everything else. Use a password manager</a> and generate new unique passwords. Revoke sessions everywhere. This is the step that matters most. On Google: Account → Security → “Your devices” → “Sign out.” On Microsoft: Security → “Sign me out.” On every other platform, find the equivalent option. Do this even for accounts where you have changed the password. Rotate any seed phrases or recovery keys. If a crypto wallet was on the infected machine, move funds to a new wallet generated on a clean device. The old seed is compromised forever. Enable hardware-key MFA where possible. A YubiKey or equivalent prevents future session theft from being immediately reusable because re-authentication requires the physical key. Notify your employer if the infected machine had work credentials. This is uncomfortable. It is also the step that limits the damage to you personally rather than turning into the next Disney-scale incident. Why this is getting worse</h2> Three trends are pushing infostealer volume higher every year. The malware-as-a-service model has lowered the operator skill floor to near zero. A buyer who cannot write code can rent Lumma, buy a phishing kit, and run a campaign. The barrier is now marketing, not engineering. Browser-stored credentials and persistent sessions have become the default user experience. Saving passwords in the browser is convenient. It is also a single, exfiltratable file. And the cleanup gap remains wide. Most users do not know stealer logs exist. Companies whose employees get infected often learn about it only when stolen sessions are used months later. The detection-to-response gap is where the damage accumulates. Detection is the leading edge of containment. KnytX Vigil</a> is built to run stealer-log monitoring on its Pro tier ($14.99/mo</a>), bundled with breach monitoring, dark web alerts, and a remediation playbook for each detection. The point of monitoring is not anxiety. It is the early signal that lets you act before your session cookie becomes someone else’s payday. Vigil isn’t live yet; join the waitlist</a> to be ready at launch. Related posts</h2> Session Hijacking: How Attackers Stay Logged In After You Change Your Password</a></li> Credential Stuffing: How One Leaked Password Opens Every Account You Have</a></li> Dark Web Monitoring: What It Finds, What It Misses</a></li> </ul> How Scam Callers Know Your Name Before You Answer Unknown — Fri, 06 Mar 2026 00:00:00 +0000 Your phone rings. You pick up. “Is this Priya Sharma?” Yes. “This is HDFC Bank calling about an urgent issue with your account.” The caller knows your full name, your bank, and sometimes even references a recent transaction. You almost believe them — and that’s the point. The call is a scam. But the information they have is real. So how did they get it? The call that almost got you</h2> You didn’t give your phone number to these people. You’ve never heard of them. But they know your name, your city, and exactly which bank to mention to sound credible. This isn’t a lucky guess. It’s a system. Your personal data passed through at least three or four hands — a data breach, a broker, a Telegram channel, a scam operation — before reaching this caller. Each step adds more detail. By the time someone calls you, they often have a profile: name, number, bank, location, sometimes your UPI handle. The call feels personal. It’s not. It’s automated social engineering running on a database that includes millions of Indians just like you. Where they got your name</h2> Your phone number and name are already listed on sites you’ve probably never heard of. JustDial scraped and published contact details for hundreds of millions of Indian numbers as part of their business listings database. Even if you never listed yourself, anyone who listed a business and included a “contact person” — or anyone a business listed as a customer — is potentially in there. Truecaller’s contact sync model</a> is a bigger source than most people realize. When any of your contacts installs Truecaller and grants contact permissions, your name and number upload to Truecaller’s servers automatically. You never consented. You weren’t even asked. Truecaller now holds data on hundreds of millions of Indian users who never touched the app. On top of these platforms, breached databases from Jio, Airtel, and Vi (Vodafone Idea) have circulated since at least 2021, though all three operators disputed that the data originated from breaches of their own systems. These breaches included not just names and numbers but sometimes Aadhaar-linked KYC details — which is far more useful for social engineering than a name alone. The Telegram angle</h2> The pipeline from breach to caller runs through Telegram. Indian breach data sells openly on Telegram channels — often for as little as ₹500 for 10,000 records. These aren’t sophisticated dark web markets. They’re public or semi-public groups with usernames like “India Database Resellers” where sellers post sample previews and take payment via UPI. (The irony of using UPI to buy stolen UPI data is not lost on anyone.) A buyer with ₹5,000 can walk away with 100,000 Indian phone numbers, names, and email addresses. Some bundles include bank names, account types, or credit scores pulled from older financial data leaks. The data quality varies — but enough of it is accurate to make the scam economically worthwhile even if only 1 in 500 calls lands. This is why spam call volumes in India are so high. The input cost is essentially nothing. Why they know your bank</h2> This is what makes the calls feel credible — and it comes from a specific source. In 2021, MobiKwik suffered a breach that exposed approximately 100 million KYC records. That’s 100 million Indian users whose names, phone numbers, email addresses, dates of birth, Aadhaar numbers, PAN numbers, and bank account details were extracted from a single fintech platform and put up for sale. Financial KYC data is sold separately from basic contact data, and at a higher price. A scammer who buys a combined dataset (basic contact info plus financial data) now knows exactly what to say to establish trust on the call. “We’re calling from HDFC about your savings account” hits differently when they have your name, your registered phone number, and your rough financial profile. The MobiKwik breach is one example. Similar exposures came from BharatPe, Domino’s India (approximately 180 million order records including customer names, phone numbers, and delivery addresses, 2021; some reports claimed card data was included, though researchers who analyzed the dataset found no evidence of card numbers — Domino’s India relies on cash-on-delivery and digital wallets), and a string of insurance and lending platforms. Your financial data is in circulation. The question is who has it. Why spam filters don’t stop them</h2> You’ve probably noticed that the “Spam Likely” label from your phone or Truecaller doesn’t prevent these calls. There’s a structural reason. Scam callers routing into India use VoIP services registered outside the country — often through providers in the US, Singapore, or Gulf countries where Indian telecom regulation doesn’t apply. The number appearing on your screen is spoofed; it looks like a local mobile number or a bank’s official line but routes through an international VoIP trunk that TRAI has no jurisdiction over. TRAI’s Do Not Disturb registry and its Distributed Ledger Technology framework for commercial communications apply to Indian telecom operators. They don’t reach VoIP spoofing infrastructure hosted abroad. The scammers know this. It’s why the call volume hasn’t dropped despite years of regulation. What actually reduces your exposure</h2> Spam filters are reactive — they label a number after it’s been reported. What actually works is reducing the surface area of your data in the first place. The most effective step is removing your data from data broker sites</a>. Sites like JustDial, TruePeopleSearch, and dozens of similar platforms allow removal requests, but the process is deliberately slow and scattered. Submitting these manually is possible but tedious. KnytX Shield isn’t live yet; once it launches, it’s built to automate this and watch for re-listing. For a step-by-step guide, see our post on removing your data from the Indian internet</a>. Beyond removal: stop handing out your real phone number to apps that don’t need it. Food delivery, shopping, and loyalty apps routinely share user contact data with advertising partners — some of whom sell it onward. Use your email address where possible, and use an alias (not your primary email) for signups you’re unsure about. The scam caller who knows your name got that name from somewhere. The fewer places your name and number appear together, the fewer databases they can buy you from. What you can do right now</h2> Want to see what data brokers expose about you? See what a scan finds →</a> shows an example report: the kinds of sites that list your name, phone, and address. Once KnytX Shield launches it will find and remove these automatically. Join the waitlist</a> to get in early. How the DELETE Act Works for California Residents Unknown — Thu, 05 Mar 2026 00:00:00 +0000 Maria in Sacramento started counting in March. By the end of the week she had logged 38 unsolicited calls. Auto-warranty renewals. Solar panel installers. Medicare supplement plans. A debt consolidation pitch in Spanish. Two health insurance “verifications” that wanted her date of birth. Her number was on the Do Not Call registry. Had been for years. She had not given her number to any of these callers. They had it because data brokers had collected, packaged, and resold it across the consumer-marketing economy. Each spam call represented a record sale. A friend mentioned a new California law. A single form, one website, and supposedly every broker in the state would have to delete her data. Maria looked it up. The law was real. The mechanism was SB 362 — the California DELETE Act — and the centralised deletion portal had gone live earlier that year. What she did not know yet was how the law actually works, which brokers it covers, which brokers it misses, and what to do about the gap. How do you file a DELETE Act request in California? Use the state’s DROP portal (Delete Request and Opt-out Platform) at the CPPA’s official site. Create a verified account with a California address, list the identifiers you want suppressed (name, emails, phones, addresses), and submit once. The CPPA forwards your request to every registered broker. Registered brokers must start processing requests from August 1, 2026. The portal is free, and it covers only the roughly 500 CPPA-registered brokers, so a separate CCPA request is still needed for the rest. DELETE Act California: how to file, what it does</h2> The DELETE Act is California Senate Bill 362, signed by Governor Newsom in October 2023. The full name is the California Delete Act, and the statutory citation is Cal. Civ. Code § 1798.99.86. It does one thing other US privacy laws do not: it gives California residents a single mechanism to request deletion from every data broker registered in the state, simultaneously, through one submission. Before SB 362, exercising your CCPA deletion rights required contacting every broker individually. Hundreds of forms. Each broker has its own deletion process, its own verification steps, its own delays. Researchers at Consumer Reports documented in 2021 that successfully deleting data from a representative set of 240 brokers took an average of one hour per broker and a 50% failure rate even after follow-up. The math made full deletion impractical for a single person. SB 362 was the legislature’s response to that math problem. Senator Josh Becker, the bill’s primary author, framed it as making the “patchwork unworkable” by collapsing it to a single portal. The deletion request goes to the California Privacy Protection Agency (CPPA). The CPPA passes it to every registered broker. Every registered broker must comply. What the law requires of brokers</h2> Three obligations matter. Registration. Any business that meets California’s statutory definition of a data broker must register annually with the CPPA. That definition means a company that knowingly collects and sells the personal information of consumers it has no direct relationship with. The registration is public. The list lives at cppa.ca.gov and is searchable. As of mid-2026, around 500 brokers are registered. Each registration includes the broker’s name, point of contact, types of data collected, and the categories of consumers covered (including whether they collect data on minors, precise geolocation, or reproductive health data). The deletion timeline. From August 1, 2026, brokers must retrieve the current request list from DROP at least every 45 days. Once a broker retrieves your request, it has 45 days to report what it did with it, and the full determination is due within 90 days. The law requires deletion of all personal information about the requesting consumer from the broker’s databases. It also requires ongoing suppression, meaning the broker cannot recollect the same data later without re-consent. Recurring re-deletion. This is the part most summaries skip. Brokers must keep checking the request list every 45 days and re-delete any consumer record that has reappeared. This handles the case where a broker buys a new dataset that includes records about consumers who already requested deletion. The reappearance triggers automatic re-deletion. No new request from the consumer is required. If a broker fails to comply, the CPPA can impose civil penalties of up to $200 per deletion request per day, plus injunctive relief. The fine structure is calibrated to make non-compliance more expensive than compliance. How the deletion portal works</h2> The CPPA-operated deletion mechanism is called DROP: the Delete Request and Opt-out Platform. It launched in stages. The first phase, public registration of brokers, has been live since January 2024. The second phase, the consumer deletion portal, went live on January 1, 2026. You can submit a request today. One date matters here. Consumers can file now, but registered brokers are not legally required to start retrieving and processing DROP requests until August 1, 2026. For what that deadline does and doesn’t mean, see our DROP Act deadline guide</a>. To file: Visit the CPPA’s official site (the URL is on cppa.ca.gov — be careful to use the .ca.gov domain, not lookalike commercial sites).</li> Create a verified account using a California address. The CPPA verifies residency before accepting deletion requests. Out-of-state residents cannot use the portal.</li> Provide the identifiers you want suppressed: name, email addresses, phone numbers, and physical addresses. The more identifiers you provide, the more matches across broker databases. Aliases and previous addresses matter — brokers index historical data.</li> Submit. The CPPA forwards the request to every registered broker.</li> Track. Brokers must report deletion completion through the platform. You can see compliance status per broker in your account.</li> </ol> The portal itself is free to use. No CCPA-style proof-of-residency notarisation. No paper forms. The verification step uses standard online identity proofing — government ID or address verification documents. A request takes about 15 minutes to file. If you file before August 1, 2026, it simply waits in the queue until brokers are obligated to start retrieving requests. Compliance reporting then closes the loop over the following 90 days. The 400-broker gap</h2> Now the part the press releases gloss over. Researchers at Privacy Rights Clearinghouse and Consumer Reports have catalogued data brokers operating in the United States. Their cross-referenced lists, combined with Vermont’s older broker registry and the LexisNexis-style B2B-only databases, push the realistic total of US-operating brokers above 900. California’s registered list sits at around 500. The math means around 400 brokers that demonstrably traffic in personal data about California residents are not currently registered with the CPPA — and therefore are not bound by DROP-mediated deletion requests. Some of these are small operations that may have slipped under the registration threshold. Others are companies that contest whether they meet the statutory definition of “data broker” and are arguing the point in regulatory correspondence. A non-trivial number are simply non-compliant. The CPPA has begun publishing enforcement actions. The first wave in 2024 targeted brokers that had failed to register; fines have ranged from $7,500 to $46,000 per company. The agency has been transparent that registration enforcement is an ongoing process. The gap is closing, slowly. For now, a DROP deletion request handles roughly half of the brokers that hold your data. The other half require separate, manual deletion under CCPA’s individual deletion right. That half includes people-search sites that argue they are “publishers” rather than brokers, lead-generation companies that argue they are “marketers,” and marketing-data aggregators with ambiguous corporate structures. The DELETE Act does not preempt CCPA. You retain the full CCPA right to demand deletion from any business that holds your data, registered or not. The DELETE Act adds a centralised mechanism for the registered subset; it does not replace the individual right for the unregistered subset. Who is required to register</h2> The statutory definition matters because it determines the law’s reach. A “data broker” under SB 362 is a business that knowingly collects and sells personal information about consumers with whom the business does not have a direct relationship. Three pieces matter: The collection must be knowing — accidental aggregation through, say, a hosting provider does not count. The data must be sold — which under California law includes exchange for any form of valuable consideration, not just cash. Data-for-services trades count. Data shared in exchange for analytics or marketing partnerships count. The consumer must not have a direct relationship with the business. This is the carve-out that excludes consumer-facing companies. Your bank holds your data, but you have a direct relationship with it; it is not a broker under SB 362 even though it may sell de-identified or aggregated data. Your grocery store’s loyalty programme is not a broker. Facebook is not a broker for users with Facebook accounts. The companies caught by this definition sit in the middle of the supply chain. They include aggregators, append providers, list rental companies, people-search sites, lead generators, ad-tech identity graphs, and the analytics firms that resell location, financial, or health-adjacent data. You can check the CPPA registry to see who has registered and search for specific company names. Some recognisable broker brands are listed, including Acxiom</a>, Epsilon, Experian’s marketing services arm, Spokeo</a>, BeenVerified</a>, and Whitepages</a>. Verifying compliance after you file</h2> Once brokers begin processing (from August 1, 2026) and the reporting window passes, the portal reports per-broker status. The realistic outcomes: Deleted. The broker has confirmed deletion and confirmed they have added you to their suppression list. The record should not reappear. No record found. The broker did not have data matching your identifiers. This is common; most brokers do not have records on every Californian. Partially complied. The broker deleted some matches but flagged others as exempt under the law’s research, security, or legal-compliance carve-outs. SB 362 includes the same exemptions CCPA does — data needed for fraud detection, legal compliance, security research, or certain regulated industries can be retained. You can challenge a partial compliance finding through the CPPA. Non-responsive. The broker did not respond within the required window. The CPPA will flag the broker for enforcement review. This is rare among registered brokers; the financial penalty makes non-response uneconomic. After the cycle completes, the recurring re-deletion obligation kicks in. You do not need to re-file. Brokers are required to keep checking your record against their inflows every 45 days, indefinitely, until you withdraw the deletion request. What changes if your residency changes</h2> This is the gap most consumers do not anticipate. SB 362 protects California residents specifically. If you move out of state, the DELETE Act protections lapse for new data collected after your move. The existing deletion record persists, because brokers cannot re-add data they already deleted. But new data collected about you in your new state is governed by that state’s laws, or, in most US states, by no specific data-broker law at all. If you split time between California and another state, the residency definition under the Revenue and Taxation Code applies. The CPPA uses a six-month physical-presence test. Snowbirds who spend more than six months elsewhere may not qualify. If you move into California, your DELETE Act rights activate. You can file a deletion request from your first day of residency, though the CPPA’s verification step requires an established California address — typically a utility bill or lease agreement. Texas, Oregon, and several other states have proposed similar broker-deletion laws. As of mid-2026, California remains the only US state with an operational centralised deletion portal. New York and Washington have bills in committee. How the options compare</h2> </th> CPPA (manual)</th> DeleteMe</th> KnytX</th></tr></thead> Cost</td> Free</td> ~$129 / year</td> Free tier + paid tiers</td></tr> Registered broker coverage</td> All ~500 registered brokers</td> Major brokers only</td> All registered + unregistered</td></tr> Unregistered broker coverage</td> Manual CCPA requests only</td> Limited</td> Shield tier covers ~400 extra</td></tr> Filing time</td> ~15 minutes + research</td> Automated setup</td> Guided, same-day</td></tr> Compliance tracking</td> CPPA portal per broker</td> Dashboard</td> Dashboard + alerts</td></tr> Recurring re-deletion</td> You must monitor</td> Included</td> Included</td></tr> People-search sites</td> Manual removal</td> Some</td> Shield tier</td></tr> International brokers</td> Not covered</td> Not covered</td> EU + India tiers</td></tr> Support</td> Self-service</td> Email</td> In-app chat + email</td></tr> </tbody></table> The manual route through the CPPA is free and effective for the ~500 registered brokers. DeleteMe automates a subset of US brokers. KnytX extends to the unregistered gap, international brokers, and people-search sites. The CTA the law makes possible</h2> KnytX free tier prepares a DELETE Act deletion request for you and walks you through submitting it. You provide your identifiers once; we handle the CPPA verification flow, prepare the request, and track the per-broker compliance reporting that comes back once brokers begin processing. The free tier handles SB 362-covered brokers. The Shield tier extends to the 400 unregistered brokers, the people-search sites, and the EU and India equivalents — using each jurisdiction’s own deletion mechanism for each broker. You can do this manually. The portal is free, and the process is documented at cppa.ca.gov. Most people don’t, because of the gap-handling. The brokers that aren’t on the SB 362 list, the people-search sites that need separate CCPA requests, and the international brokers are the part that takes hours and recurs. For the legal background on SB 362, exemptions, and enforcement structure, see the DELETE Act legal page</a>. The product details on guided filing and tracking are on the DELETE Act product page</a>. What you can do right now</h2> Walk through an example exposure report</a> to see which broker sites can list your name, phone, and address. From there you can decide whether to file a DELETE Act request directly through CPPA, let KnytX prepare the filing and walk you through it, or do nothing and accept the level of exposure you have. KnytX Shield isn’t live yet; join the waitlist</a> to run your own scan at launch. The spam calls Maria was getting did not stop the day she filed. Once brokers begin processing requests, call volume typically tapers over the following weeks as your record propagates through broker suppression lists. In an illustrative case like hers, the volume might be down substantially within a few months. The remaining calls come from the unregistered brokers, the gap. Those require a different approach. Related posts</h2> What CCPA Actually Gives You — and What It Doesn’t</a></li> How to Remove Yourself from US Data Brokers</a></li> How Scam Callers Know Your Name Before You Answer</a></li> </ul>

KnytX

How KnytX Acts as Your Authorised Agent

2. What you authorise when you sign up</h2> The KnytX subscription agreement and the in-product confirmation flow grant KnytX a limited, revocable agency to:</p>

3. The “signed permission” requirement</h2> CCPA Reg §7063 requires the agent to “obtain signed permission” from the consumer. We satisfy this by:</p>

6. The audit trail</h2> For each request we file, we keep:</p>

7. Revocation</h2> You can revoke our agency at any time:</p> Cancel your KnytX subscription, in which case the agency ends on cancellation.</li>

Biometric Data Policy

Impersonation Takedowns — How Evidence Is Handled

Mobile App Permissions — What We Use & Why

Privacy Policy

8. Children’s privacy</h2> In short:</strong> our consumer products aren’t for children, and we don’t knowingly collect their data. KnytX for Families is run by a parent or guardian, with consent recorded at signup.</p>

Terms of Service

Incorporated policies</h2> These Terms of Service incorporate the following KnytX policies by reference. When you create a KnytX account or use the relevant service, you agree to them as part of these terms:</p>

Service agreements</h2> Professional services and product licensing are governed by separate written agreements with specific deliverables, timelines, and pricing.</p>

Trademarks

Permitted use</h2> You may reference KnytX in journalism, reviews, academic papers, technical discussions, and social media — provided you make clear you are not affiliated with or endorsed by KnytX.</p>

Restricted use</h2> You may not incorporate KnytX trademarks into your product name, company name, domain name, or marketing materials without written permission. Contact legal@knytx.com for licensing inquiries.</p>

Third-party trademarks</h2> All other trademarks mentioned on knytx.com are the property of their respective owners and are used for identification purposes only.</p>

Security Disclosure Policy

Reporting a vulnerability</h2> If you discover a security vulnerability in any KnytX-controlled software or infrastructure, please report it privately before disclosing it publicly.</p>

Our commitments to researchers</h2> We will not pursue legal action against researchers who act in good faith under this policy.</li> We will acknowledge your contribution in our release notes (or privately, if you prefer).</li> We will notify you when the vulnerability is fixed.</li>

California DELETE Act — methodology

How We Check Breaches Without Seeing Your Passwords

Why this matters</h2>

We cannot, by design, build a database of your passwords</h3> Suppose a hypothetical adversarial KnytX engineer wanted to build a database of which users use which passwords. What does our log show?</p>

Where this fits in the broader trust story</h2> K-anonymity is one of three architectural commitments we make:</p>

Removal Legal Basis by Region

Open Source — Our Mobile Apps Are Auditable

Scoring Models & Automated Signals

Sub-Processors & Data-Sharing Partners

Infrastructure and analytics</h2>

Payments and billing</h2>

AI Security Questionnaire Tools: What They Do & Miss

Service agreements</h2>
Professional services and product licensing are governed by separate written agreements with specific deliverables, timelines, and pricing.</p>

Permitted use</h2>
You may reference KnytX in journalism, reviews, academic papers, technical discussions, and social media — provided you make clear you are not affiliated with or endorsed by KnytX.</p>

Restricted use</h2>
You may not incorporate KnytX trademarks into your product name, company name, domain name, or marketing materials without written permission. Contact legal@knytx.com for licensing inquiries.</p>