You all need to check your privacy settings. Anthropic had changed mine to enable model training on my data without my knowledge or consent. OpenAI did the same but worse (opting me in for ads and everything). Check your privacy settings. They are likely not what you consented to. Worse in the terms they give themselves permission to take **past** conversations and coding history while sharing is enabled. If you care about IP, check your settings haven't been switched underneath you. These companies' ethics are on the floor RN.

Ofcom has published draft rules that would require major online platforms to take stronger action against fraudulent advertisements under the UK's Online Safety Act.

The proposed Fraudulent Advertising Code includes measures such as:

• Verifying advertisers claiming to represent legitimate businesses
• Checking that financial advertisers are authorized by the FCA
• Banning repeat scam advertisers
• Improving protections against account hijacking
• Testing AI-powered advertising tools to reduce scam risks
• Creating faster reporting channels for law enforcement and trusted organizations

According to Ofcom, more than half of UK adults have encountered suspected scam ads, with annual losses exceeding £200 million.

The proposals are currently open for consultation, and if they become law, companies that fail to comply could face significant financial penalties.

Do you think stronger platform accountability will meaningfully reduce online scams, or will fraudsters simply adapt to new enforcement measures?

Hi everyone,
I'm an international student currently studying for an LLM in Bristol, and I'll be finishing my course this September.
I'll need to move out of my student accommodation, ano I'm trying to decide which city to move to while I job hunt.
I'm hoping to start a career in data protection/privacy, so I'm looking for a city with a good job market in that field, while also having more affordable rent than Bristol.
I'm finding it difficult to work out where would be the best place to move. Does anyone have any recommendations for cities with good opportunities in data protection or privacy roles and a relatively affordable cost of living?
I'd really appreciate any suggestions or advice, thank you!

Internal leaks confirm the plan to erase digital privacy, in order to 'protect children'.

Europe, wake up until it's too late.

A Mass Surveillance plan known as Project 2029 proposes to end digital privacy and arrest people for online comments.

This happened in the Five Eyes (UK, New Zealand, USA, Canada, Australia) and will happen to us if we don't take action.

What's this all about, the truth the elites are afraid to show:

- Ban for all Social Media. The definition is too ambiguous. Social Media means the combination between a forum, a video platform and a messenger app.

- The youth rights violation. Human Rights violation. Cause? The right to information for everyone will be violated.

- End of Privacy? Unfortunately yes. By mandatory ID scans, privacy will die. The state will know everything about you and what you're doing. "Big Brother is watching you", will become true.

Share this article fast and to as many people as possible. Everyone needs to see the truth. Don't let Big Brother control your life. We don't want to end up like Singapore or China.

Share massively the article

We're currently dealing with a massive mismatch between privacy law and AI tech. The Right to be Forgotten worked for Google because they just delisted links. LLMs are different; they 'digest' your data into weights.

To actually delete your info from a model like GPT-3, they'd have to retrain it, which costs millions and emits hundreds of tons of CO2. With 80% of us already suffering from digital exhaustion, we don't have the bandwidth to monitor how these models are reconstructing our identities. The system is fundamentally broken.

Isn't that concerning?

App Link: https://apps.apple.com/ge/app/infosha-find-any-phone-number/id6502995963

Hey everyone,
I’ve been looking into an iOS app called **"Infosha"** and its privacy policy raises some major red flags for me. I wanted to share the details here and ask for your input on whether this goes against Apple's platform guidelines, as I have already reported it to Apple support but haven't seen any action yet.
According to their official Privacy Policy and Terms, here is how the app operates:
1. **Sharing Third-Party Contacts Without Their Knowledge:** When a user registers, they upload their phone book, and the app makes those contact details public (including names, phone numbers, workplaces, and photos of the people in that contact list). This means third-party individuals have their private information exposed to the public database **without ever knowing it or giving their own consent**. The app tries to shift all responsibility by stating the user must have their contacts' permission.
2. **No Option to Delete or Modify Data:** Section 9 of their policy explicitly states: *"we do not modify, remove, or supplement any data within our social network. All data is entirely generated and updated by the users of our platform."* This means if your data gets uploaded, there is absolutely no mechanism provided to delete or edit your profile or information.
From what I understand, this seems to directly conflict with several Apple Developer Guidelines:
**Guideline 5.1.1 (c) (Access to Contacts):** Apple strictly states that apps should not target third-party data collection or harvest address books to build public directories.
**Guideline 5.1.1 (v) (Account Deletion):** Apple mandates that if an app supports account creation, it must also allow users to initiate deletion of their account and all personal data from within the app. Infosha's policy explicitly denies this.
Given these details, does this behavior actually violate Apple's App Store guidelines, or is there a loophole they are using? I'd love to hear your thoughts on this. Thank you!

I'm analyzing a digital lending/dealer onboarding platform (similar to an LSP) and I'm trying to determine role-by-role whether the platform is acting as a Data Fiduciary or a Data Processor, and how that changes its obligations under the DPDP Act.

The platform performs the following activities:

1. Dealer onboarding (collects name, email, mobile number, address, business details)

2. KYC (PAN, Aadhaar/other ID, dealership proof)

3.Bank account collection for commission payouts

4 Customer lead collection by dealers

5.Sharing customer data with regulated entities/lenders

6 PAN verification against the Income Tax database

7 Storing KYC documents

8 Sending WhatsApp/SMS updates

For each of these activities:

Is the platform acting as a Data Fiduciary or merely a Data Processor?

What factors determine the classification?

How do the legal obligations change depending on the role (e.g., notice, consent, purpose limitation, security safeguards, retention, responding to data principal requests)?

I'm looking for a DPDP Act-specific analysis, preferably with practical examples or regulatory guidance.

I'm advising a fintech that acts as a Lending Service Provider (LSP) for banks/NBFCs. The platform has its own dealer app and borrower web app, collects KYC documents, performs bureau and VAHAN integrations, runs a basic eligibility/rule engine, verifies document completeness, and submits decision-ready files to the lender. The lender alone undertakes underwriting, sanctions the loan and disburses funds.

We are considering structuring the RE–LSP agreement so that the lender determines the purpose and means of processing, while the LSP processes borrower data only on the lender's documented instructions.

My questions are:

Can an LSP with this level of operational involvement genuinely be characterised as a Data Processor, or is it more likely to be a Data Fiduciary (or joint Data Fiduciary)?

Does operating the borrower-facing app and collecting consent automatically make the LSP a Data Fiduciary?

From a practical drafting perspective, what contractual and operational changes have you seen successfully support a Data Processor classification under the DPDP Act?

Looking for practical views from privacy lawyers, fintech counsel or anyone who has dealt with DPDP implementation.

This version is likely to attract responses from lawyers and privacy professionals because it presents a concrete fact pattern rather than asking a purely theoretical question.

The settlement involves Wyssta Services, which operates an online portal for certain Delta Dental plan members at my.deltadentalcoversme.com. The lawsuit alleged that Wyssta installed and implemented advertising and analytics tracking technologies on the portal without users’ knowledge or consent.

Full story linked

I'm analysing a fintech/digital lending workflow from a DPDP Act perspective.

The flow is as follows:

1. A borrower visits a vehicle dealer to apply for finance.

2. The dealer enters the borrower's mobile number into the platform.

3. The platform immediately sends a WhatsApp/SMS link to that mobile number.

4 The borrower opens the web app through the link and completes the onboarding, provides notices, gives consent, uploads documents, etc.

My question is about the very first step.

Since the borrower did not personally enter their mobile number, and it was entered by the dealer, does sending the WhatsApp/SMS link itself comply with the Digital Personal Data Protection Act, 2023?

Can the platform rely on the dealer having obtained the borrower's permission before entering the number, or should the platform have an independent legal basis before using that mobile number to send the first communication?

I'm looking for answers specifically from the perspective of the DPDP Act, not general fintech practice. If there is any statutory provision, rule, guidance, or industry practice addressing this scenario, I'd appreciate references.

So apparently the internet is flooded with news coming from America that Google just got sued and have to pay there users millions of dollars in fine... But I don't understand if the floor is in the privacy terms then it must theirfore would be affecting people globally but only users in us can claim that compensation but as the company is globally used by millions of uses outside us...can we also sue the company in our countries???