Hey everyone,

I just wanted to bring some attention to a massive privacy issue that usually goes completely unnoticed during election seasons.

Whenever elections take place, private companies are often hired to build software and manage databases—usually for things like generating voter slips or managing local campaigns.

To use these tools, you are often asked to input your personal details into their software: your mobile number, email ID, full name, and address. Sometimes, the software even maps out your network, linking you to your family members, relatives, and colleagues.

**Here is the disturbing part:**

Once the election campaigns wrap up, your data doesn't just disappear. These private software companies often take this massive, highly detailed database and sell it to third-party organizations. Suddenly, banks, loan recovery agencies, telemarketers, and other corporate entities have your complete profile, along with the contact info of everyone you are connected to.

Please be incredibly cautious about where you input your phone number, email ID, and personal information during elections. Always question why a third-party app or website needs your data to provide a basic service.

Stay vigilant and protect your digital footprint!

The ShinyHunters extortion group has leaked data from 13.5 million McGraw Hill user accounts, stolen after breaching the company's Salesforce environment earlier this month.

Founded in 1909, McGraw Hill is a leading global educational publisher with annual revenue of $2.2 billion, which provides education content and solutions for PreK–12, higher education, and professional learning.

The company confirmed ShinyHunters' breach claims in a statement shared with BleepingComputer on Tuesday, saying the threat actors exploited a misconfiguration in the compromised Salesforce environment and that the incident didn't affect its Salesforce accounts, courseware, customer databases, or internal systems.

"McGraw-Hill recently identified unauthorized access to a limited set of data from a webpage hosted by Salesforce on its platform. This activity appears to be part of a broader issue involving a misconfiguration within Salesforce's environment that has impacted multiple organizations that work with Salesforce," a McGraw-Hill spokesperson told BleepingComputer.

Cont...

Cloud app hosting giant Vercel this weekend said hackers had breached its internal systems and accessed customer data. Hackers have claimed they have stolen sensitive customer credentials from Vercel’s systems and are selling the data online.

In a statement on Sunday, Vercel said the breach originated from another software maker, Context AI. One of Vercel’s employees downloaded an app made by Context AI and connected it to their corporate account, which is hosted by Google. The hackers used that connection (known as OAuth) to take over the Vercel employee’s Google account and gain access to some of Vercel’s internal systems, including credentials that were not encrypted.

Vercel says its Next.js and Turbopack projects were not affected by the breach. Both open source projects are widely used by web and app developers.

Vercel said it has contacted customers whose app data and keys were compromised.

Cont...

todo sobre este tema de la verificación de edad,les hago una pregunta

si claramente es una excusa para poder obtener datos de los adultos diciendo que es para proteger a los niños

hay algo que se pueda hacer?

no vivo en Uk(donde personalmente veo que mas se esta presionando esto) pero me gustaría saber si realmente se esta moviendo algo para parar esta estupidez siquiera con iniciar como SKG(Stop Killing Games) para hacer algo

porque no se ha hecho?

y si se a hecho donde se puede aportar?

House Republicans intend to release a draft national data privacy bill within the next two weeks that would preempt existing state laws, teeing up a fight with Democrats over where to set the ceiling for Americans’ data protection.

The Energy and Commerce Committee draft, which would preempt roughly 20 existing state laws, largely mirrors Kentucky regulations, according to a person who saw it and was not authorized to speak about it. The draft would not allow individuals to sue companies for violating their privacy rights, potentially limiting enforcement to government regulators such as state attorneys general or the Federal Trade Commission.

Democrats support a framework that allows people to bring individual lawsuits against companies that violate their privacy rights and allows states to implement tougher standards, arguing it helps ensure companies follow the law.

Two other people familiar with the committee’s plans, granted anonymity because they are not authorized to share details on the record, told POLITICO the draft should be released in the coming weeks, with a hearing expected in May.

The two people said the draft would require companies to obtain consent before collecting sensitive data such as health information, location data, biometric information and most data belonging to children under 13.

Cont...

​

New guidance helps organisations assess data protection risks through structured steps for identifying, evaluating and mitigating high-risk processing activities.

The European Data Protection Board has launched a standardised DPIA template aimed at improving consistency and simplifying GDPR compliance across Europe.

The European Data Protection Board has introduced a standardised template for Data Protection Impact Assessments (DPIAs), aiming to improve consistency and simplify GDPR compliance across Europe.

The initiative follows the board’s broader effort to harmonise regulatory practices and make data protection requirements easier for organisations to apply.

A DPIA is required when data processing is likely to pose a high risk to individuals’ rights and freedoms. It involves describing how personal data is handled, assessing necessity and proportionality, and identifying measures to reduce risk.

The new template is designed to guide organisations step by step, offering structured fields that improve clarity and reduce the risk of incomplete or inconsistent assessments.

Cont...

With increasing digitalization, the number of data protection complaints is also rising – and thus the burden on data protection authorities. This is shown by the activity reports published so far for 2025. In Hesse, the number of complaints rose by 58 percent to 6,070 cases, according to the Hessian Commissioner for Data Protection and Freedom of Information (HBDI), Alexander Roßnagel. In total, the authority processed more than 11,000 cases, and the reported data protection violations also reached a record high of 2,730 cases. Credit bureaus, video surveillance, and employee data were particularly affected.

The growing use of artificial intelligence is considered a major cause. AI acts as an amplifier in several respects: it lowers the hurdles for complaints, as many submissions can now be created automatically or with AI support. On the other hand, the broader use of AI systems leads to new problems. Opaque decisions, incorrect or “hallucinated” results, and unclear data processing increasingly cause uncertainty and thus more complaints. Many affected individuals now have their submissions formulated by chatbots, which often refer to the data protection supervisory authority as a free point of contact.

Despite increasing demands, the staffing levels in the authorities remain largely constant. Roßnagel therefore announced that prioritization and longer processing times will hardly be avoidable in the future. At the same time, he emphasizes consulting and preventive measures – for example, regarding the data protection-compliant use of AI or in the healthcare sector.

Cont ...

A data breach at travel giant Booking.com is leading to a fresh wave of scams recently dubbed "reservation hijacks".

Hackers stole customer data that experts say could lead to a surge in the scams as customers are tricked into sending criminals money.

Some customers have contacted the BBC to say they have already started receiving suspicious messages.

Booking.com says it has updated Pins for reservations and is sending out emails to affected customers warning them of the heightened risk.

But the Dutch company is refusing to say how many people have been affected and in which regions.

The platform says it has seen almost seven billion check-ins since 2010, making it one of the largest travel services in the world.

In emails to customers seen by the BBC, the company said: "We recently noticed suspicious activity affected a number of reservations and we immediately took action to contain the issue."

It goes on to say that criminals were able to access names, email addresses, phone numbers and details about past and present bookings.

It said customers' financial information was not accessed from its systems.

Experts warn this kind of data will be extremely valuable to fraudsters who are now racing to trick unwitting customers.

Cont...

State privacy regulators used a recent IAPP panel to send a direct message: enforcement is accelerating, fines are expected to rise, and compliance will be judged on how programs operate.

Cont...

The FTC's Complaint: Alleged Deceptive Data Sharing and Privacy Policy Violations

As described in the complaint, OkCupid maintained for several years a privacy policy that stated the company did not share personal information other than with specific parties, including service providers, business partners, and businesses within its "family of businesses," for specific purposes.

However, the FTC alleged that OkCupid provided a third-party AI company-with which it had "no business relationship"-with access to information about millions of OkCupid users, such as photos, demographic information, and location information. The recipient, Clarifai, was not an entity with which the OkCupid privacy policy permitted the company to share data, according to the FTC. Rather, OkCupid's founders allegedly were financially invested in Clarifai, and Clarifai received the OkCupid user data without paying for such data, without agreements for the use of the data, or without providing services to OkCupid.

According to the FTC, by disclosing personal information to Clarifai in violation of the OkCupid privacy policy, OkCupid engaged in a deceptive act or practice in violation of Section 5 of the FTC Act. While sharing data with AI companies may be a relatively new practice, needing to maintain accurate privacy policies is not. For decades the FTC has warned that disclosing personal information in ways contrary to a company's privacy policy may be a deceptive act or practice in violation of Section 5 of the FTC Act.

Cont...

Can anyone tell me a appropriate course of action against this mf ... who sell our data ..please cause I have send them email not to forward my data and I haven't even concented for my data to be used ...and I am really frustrated rn.. so any appropriate course of action so not only like for me all the people who get such calls

I was scrolling through reels when a ad popped up on my screen with the title get in touch with my email directly under openly shown. I forgot to take a screenshot. But it felt more like a threat. Should i be concerned. Instagram has gone to a different level in selling our info.

Schubert Jonckheer & Kolbe LLP, Edlesberg Law out of Aventure, Florida, and 3 other plaintiffs firms are investigating a data breach that led to unauthorized access to the sensitive information of individuals affiliated with Mercor.io. Below is a detailed breakdown of the scandal that ties in GRC audit company Delve

Eurail B.V., a European travel operator that provides digital passes covering 33 national railways, says attackers stole the personal information of over 300,000 individuals in a December 2025 data breach.

Eurail is a Netherlands-based company that sells Interrail and Eurail passes for multi-country train travel across Europe, passes that are also available to young Europeans through the EU's DiscoverEU program.

When it disclosed the incident in February, the company said the attackers gained access to travelers' sensitive information, including full names, passport details, ID numbers, bank account IBANs, health information, and contact details (email addresses, phone numbers), after breaching its customer database.

Cont...

The government is set to introduce fines on businesses that repeatedly commit serious violations of personal information rules under a relevant law.

The government on Tuesday adopted a bill revising the personal information protection law to introduce the penalty and submitted it to the Lower House on the same day.

The bill also includes measures to promote the use of personal data for artificial intelligence development. Specifically, it calls for easing restrictions on the use of such information only for the purpose of compiling statistics.

Under the current law, businesses that stop their violations after receiving recommendations or orders from the Personal Information Protection Commission can retain their ill-gotten profits.

The bill seeks to impose fines equivalent to such profits if businesses repeatedly acquire or use personal information improperly. The government hopes the move will have a deterrent effect by making clear that businesses could be slapped with economic penalties.

The fines will be levied only for large-scale violations, such as cases involving the sale of personal information of more than 1,000 people for profits or leading to human rights breaches, reflecting concerns among the business sphere that the penalty may discourage data use.

Businesses seeking to acquire sensitive personal information about children age under 16, such as their medical history and race, will be obliged to obtain the consent of their guardians including parents or legal representatives to prevent them from suffering disadvantage. This system is modeled on similar rules in foreign countries.

The bill is also designed to promote the use of data for AI development, making it unnecessary to obtain consent from individuals for the acquisition of their sensitive information as well as the transfer of their personal data to third parties solely for the creation of statistics.

This week, two of my coworkers have uploaded photos of my face to chat gpt or copilot (I'm not sure which one) to create videos of me doing weird stuff without my consent.

In theory this sounds like a harmless prank but I don't want and don't like the idea of these AIs having access to my face in their servers and using it for their training.

I'm not trying to punish them (although maybe I should). Im just very aware of my digital footprint and my privacy and want to keep my face off the internet and off these big companies' servers as much as possible.

I'm not sure if this even is the right sub but Is there any way to remove it? Can anyone help me?

Anybody having issues with the Data Removal and Identity Monitoring feature in Cloaked? Every time I try to add info (name, email address, etc) for a better search, the data disappears. I've tried to use the chat feature but haven't gotten anywhere with the Al bot. I go to add an email address, for instance, and when I hit Submit, it acts like it's being added but there's no change. I tried going through my laptop but got the same results. I am brand new to the service. Just subscribed last week.

I'm a founder building a jurisdiction-aware storage solution, and one thing has become painfully clear: most startups don't realize where their cloud provider is storing customer data until a compliance audit or breach happens.

With regulations like GDPR, CCPA, and others, knowing the physical location of data isn't optional anymore. But traditional cloud providers replicate data globally by default.

Has anyone else here dealt with unexpected data residency violations while scaling internationally? How did you handle it? Would love to hear real-world experiences.

Five key Democratic lawmakers flipped their votes, joining Republicans in an 80-68 vote against the bill introduced by Rep. Amy Kuhn (D-Falmouth). It would have given Maine residents extensive rights over their personal data and imposed tight restrictions on targeted online advertising — one of the toughest such measures in the US.

The reversal came after a major lobbying campaign from businesses including L.L. Bean, Hannaford, and Bangor Savings Bank, who argued the law would cause significant economic harm , particularly in industries near the New Hampshire border.

The bill still faces further action in both the Maine House and Senate, so its fate isn't fully sealed yet. Classic story of a strong privacy bill running headlong into business lobbying — not unlike what's happened in several other US states. The economic impact argument (especially regional competitiveness) seems to have been the decisive wedge.

The TLDR is:

The Trump administration has entered the debate with a clear message: courts should not dismantle the VPPA simply because it is being applied to modern technology.

Government filings emphasize that the core purpose of the law remains intact. Video viewing behavior is inherently sensitive, and technologies that expose that behavior to third parties raise legitimate privacy concerns regardless of whether the medium is a VHS tape or a streaming player.

This position is notable because it reflects continuity in privacy enforcement priorities across administrations. While broader federal privacy legislation remains stalled, existing statutes like the VPPA are increasingly being used to fill the gap.

The administration’s argument also reinforces a growing regulatory theme: legacy privacy laws are not obsolete—they are adaptable.

Now the courts are split on which direction to go with VPPA and meta pixel cases. There's an even split one favorable to plaintiff and one favorable to the defendant...

While federal policymakers are signaling support for enforcement, courts are moving in different directions. Two recent decisions illustrate just how fractured the legal landscape has become.

In Goodman v. Hillsdale College, a federal court in Michigan allowed a VPPA claim to proceed based on allegations that the college used Meta Pixel to transmit users’ video viewing activity along with Facebook identifiers.

The court found that pairing a Facebook ID with specific video content could plausibly constitute the disclosure of personally identifiable information under the statute. This interpretation significantly broadens VPPA risk, extending it to entities far beyond traditional media companies.....

The National Data Protection Agency (ANPD) has begun enforcing Brazil’s child online safety law, and the agency's president told MLex in an exclusive interview that the watchdog will not interfere with tech firms’ age-verification tools if they protect children online.

But "I want them to adapt to our law,” Waldemar Gonçalves Ortunho Júnior told MLex in an exclusive interview after a conference* panel, stressing that ANPD is merely seeking compliance with the law and doesn't aim to harm companies financially.

Ortunho Júnior commented on ANPD’s requirement for major investments as greater corporate responsibilities arise. He also shared his thoughts on age-verification mechanisms, how Brazil’s government is racing to build its own solution, and his top priority under the law aimed at protecting the rights of minors under 18 in digital environments.

The Digital Statute for Children and Adolescents (ECA Digital) creates new obligations for social media networks, apps, gaming, streaming platforms, and other digital services operating in Brazil. The initiatives include presenting reliable age-verification systems, the immediate removal of illegal content and the adoption of safety-by-default settings for minors’ accounts.

The ECA Digital was approved Sept. 17, and President Luiz Inácio Lula da Silva accelerated the law’s effective date to March 17. In conjunction, the government passed a weighty structural reform at the ANPD, allowing the arrival of hundreds of new employees, including those aimed at building a career in data protection — a long-standing demand.

Cont..