ChatGPT contractors are reading users’ prompts, incl. sensitive personal information. OpenAI also disclosed that its research agents posted 53 user images online, from training data it calls anonymized.

Yet EU governments are considering special treatment for AI under privacy law. Civil society groups are opposing weaker GDPR rules. The changes are still proposals, so there is time to push back.

Privacy for me, surveillance for thee

Flock’s CEO asks us to give up privacy for safety, but blurs his home on street view for privacy. As reporters film their installations, they cry harassment while profiting off tracking everyone else. The rest of us get unwarranted police searches for “lols” and are being used in sales demos under fake accounts. DeFlock helps map number-plate cameras and campaign against them in their communities.

Meanwhile, someone flooded a Flock camera with fake number plates. Surveillance can have a bad day too.

More ID checks. More data to lose.

The proposed EU KIDS Act would restrict children’s access to social media, but its intrusive age checks affect users of all ages. Not only is it a complete loss of privacy and weak protection against the actual harm, the repeated KYC checks create massive honeypots of sensitive data. IDScan confirmed a breach linked to a reported 153 million driving licences. Revolut handed over passports, selfies, and transaction records to fraudsters using a real government account.

Mandatory identity checks (KYC) should go, but SEC Commissioner Hester Peirce proposes an alternative that collects less data. Zero-knowledge proofs can confirm facts such as age without revealing your name, date of birth or other personal details.

How can we use private information together without exposing it?
The Interfold is a network for confidential coordination, enabling competing companies or complete strangers to compute together on sensitive data: private inputs, verifiable outcomes, no trusted hardware.

Learn more about confidential coordination →

News

• Meta sued over private AI glasses recordings - The case targets footage sent to human reviewers and used for AI training.

• Claude used to build surveillance systems - Claude build systems to monitor dissidents while at the same time using it to track its own critics.

• GrapheneOS plans support for Motorola Signature 27 - The project is expanding beyond Google’s Pixel phones, giving users more choice of hardware.

• Dutch intelligence bill expands spying and cuts oversight - Spies could hack systems without prior approval, keep unrelated data, and use AI to analyse data on people who are not suspects.

• Apple Watch adds daily conversation summaries - Conversation transcripts are sent to Apple’s servers and stored as daily summaries on your phone.

• LG TVs record audio with screens off - These TVs store voice recordings and scan nearby devices in standby. Disconnect them from the internet.

• Sony sells games it says you do not own - Its terms let it revoke access. Players are challenging purchase labels that suggest ownership.

Wins

• Chat Control held back again - Public pressure helped Parliament hold back private-chat scanning again. Talks continue in October, with another round expected in November, so keep the pressure on.

• Credit agency CRIF loses over marketing data - Austria’s Supreme Court ruled that address data cannot be reused for credit scores. The decision strengthens noyb’s class action.

• Google fined €403 million over location data - Consumer complaints helped trigger the inquiry. Ireland’s regulator gave Google six months to change how it processes location data.

• Dutch government tests an open Linux workplace - An open Linux desktop reduces dependence on outside suppliers. Public money is public code.

• Nitter continues after legal advice - Development resumed after legal advice on X’s takedown demand. XCancel is back online.

• US court protects links and embeds - A news publisher tried to make an aggregator liable for linking to its articles. The court rejected that claim.

• DOJ drops wiretapping appeal against Tim Burke - Seven dismissed wiretapping counts stay dismissed. Other charges against the reporter remain.

Tools

• Paperweight V1 is here - Our open-source app scans your full email history locally. Find old accounts, clean up, and send deletion requests.

• FluffyChat tests encrypted calls - Calls work with Element and Cinny, so people can talk across Matrix apps.

• Wisp offers AI with local data storage - Chats stay on your device, while AI models run in protected server hardware.

• Signal tests signups without a phone number - Android beta registration costs $2.99 through Google Play. Existing accounts still need their phone numbers.

• Tor VPN beta protects Android app traffic - Separate Tor routes for each app reduce links between activities. Bridges help you reach services where Tor is blocked.

Resources

• The Politics of Privacy and digital autonomy - From our friends at Web3Privacy Now, a beautiful collection on how human agency, democracy, and freedom can flourish in the algorithmic age.

• Do we need more phone or less? - Bigger screens and AI recaps demand more of our attention. This piece makes the case for devices that leave us alone.

• Why cloud AI changes private messaging - Protected server hardware cannot remove every risk. Using cloud AI adds another system that must protect your private messages.

• Identity checks without handing over your data - This 2025 report explains how to prove facts about yourself without exposing your full identity.

Events

• 02 Oct 2026 - DARK Prague 2026 (Prague, Czech Republic)

• 13 Oct 2026 - Brussels Privacy Symposium 2026 (Brussels, Belgium)

• 13 Oct 2026 - Privacy Camp (Brussels, Belgium and online)

• 20 Oct 2026 - The Matrix Conference (Malmö, Sweden)

• 28 Oct 2026 - Mozilla Festival (Barcelona, Spain)

• 02 Nov 2026 - Web3Privacy Congress (c26mum) (Mumbai, India)

• 07 Dec 2026 - Workshop on Privacy-Preserving Technologies (Hong Kong)

• 27 Dec 2026 - Chaos Communication Congress 40C3 (Hamburg, Germany)

Keep Android Open

From September 2026 Google will block sideloaded Android apps unless developers pay, and hand over government ID. The shift is already happening as Google cut MTE support, GrapheneOS recommends against buying Pixel 11, and apps start blocking logins.

LineageOS has pledged not to play along and will not adopt the verification service. Motorola will ship 2027 models with GrapheneOS. Take your part to keep Android open.

Surveillance without oversight

Everything is turning into a surveillance drone. Flock’s CEO publicly announced we should all “compromise” on privacy and pitched Uber, Lyft and delivery drivers to collect license plate data for their network. Meta patents the next step in their smart glasses to automatically record and identify faces. CBP workers are using these surveillance databases to settle their personal vendettas.

The EFF’s response is to eliminate automated license plate reader surveillance entirely.

Age verification by coercion

The EU is mandating age checks via hardware-bound attestation, trusting only “approved devices”. This locks out open systems, like Linux and Android builds. When platforms refuse, regulators sue, as we see in Brazil vs Discord and Pennsylvania vs. Snapchat.

Meta knowingly designed products to addict children and got a $17B slap on the wrist that further pushes age/ID checks, facial recognition, and device-level age signals as the EFF warns, collecting more identity data from users of all ages.

France pushed a <15 social media ban too, but the French court struck it down as a disproportionate hit on freedom of expression and privacy.

News

• Kill the Cookie Banner! - The EU wants browsers to signal your privacy prefs once and skip banners. Trackers are lobbying hard against it.

• Firefox 154 adds Startpage in five countries - Native no-tracking search in Germany, Netherlands, France, Austria, and Switzerland, no extension needed.

• Europe drafts VPN security standard - ETSI is approving EN 304 620 under the Cyber Resilience Act, giving users a clearer benchmark for trustworthy VPNs.

• Anthropic watermarks Claude text - Machine-readable tags embedded in Claude output to meet EU AI Act detectability rules, even after you copy.

• Paint embeds hidden IDs in AI images - ‘Local’ Paint generation still sends your prompt to Microsoft, which returns a unique ID baked into the pixels.

• X shuts down Nitter for good - Cease-and-desist kills the privacy frontend and public instances, after similar takedowns of XCancel and other proxies.

Wins

• Tor raises $200k in participatory funding - 580 donors backed Onion Browser, OONI, SecureDrop, and other internet freedom tools via quadratic matching.

• French court blocks under-15 social media ban - Constitutional limits still apply: the blanket under-15 ban was ruled disproportionate to speech and privacy rights.

• Omacom Foundation launches with $8M - Eight founders pledged $1M each to fund Omarchy’s trademarks, infrastructure, and open Linux desktop projects.

• EFF coalition demands halt to live face recognition - Liberty and Big Brother Watch joined EFF to warn Nottinghamshire Police the rollout treats every passerby as a suspect.

Tools

• Tor Snowflake Volunteer for Android - Donate bandwidth as a censorship-bypass proxy, with Wi-Fi-only and battery controls.

• Ente Locker for encrypted documents - E2E storage for credentials and files, with private sharing and emergency pass-on, free up to 100 items.

• Privt Voice: local encrypted dictation for Mac - Transcribes on-device via Apple Neural Engine, encrypts with XChaCha20, and never sends audio to a server.

• Brave adds email aliases - Create forwarding addresses from any sign-up form so sites never see your real email. Five free aliases to start.

• Signal adds automatic key verification - Key transparency and continuous auditing make silent key swaps and interception far harder to pull off.

Resources

• Brave Accounts keep passwords on-device - Your password never leaves your device or gets sent to Brave’s servers, a rare step up from browser sync norms.

• Proton maps what AI assistants know - A plain-language primer on what major assistants retain, plus how Lumo tries to do better.

Events

• 01 Sep 2026 - Web3Privacy Now (Amsterdam) (Amsterdam, Netherlands)

• 18 Sep 2026 - Web3Privacy now (Tokyo) (Tokyo, Japan)

• 29 Sep 2026 - Bitkom Privacy Conference (#pco26) (Berlin, Germany)

• 13 Oct 2026 - Brussels Privacy Symposium 2026 (Brussels, Belgium)

• 13 Oct 2026 - Privacy Camp (Brussels, Belgium)

• 13 Oct 2026 - #PrivacyCamp26: Call for sessions (Brussels, Belgium)

• 28 Oct 2026 - Mozilla Festival (Barcelona, Spain)

• 02 Nov 2026 - Web3Privacy Congress (c26mum) (Mumbai, India)

• 27 Dec 2026 - Chaos Communication Congress (40C3) (Hamburg, Germany)

If you’ve been here long enough, you’ve seen this newsletter change shape more than once, from useWeb3 to Privacy on Ethereum and now In the Open. A new privacy initiative for open technology, and digital autonomy.

Technology is changing rapidly around us. Its a fundamental part of our identity, work, relationships and how we communicate, but new systems for identity verification, biometric monitoring, message scanning and other surveillance infrastructure are creeping into our daily life, and reshaping our digital rights.

With this newsletter, I’ll help you follow those developments, understand what they mean and what you can do about it. Each month, I’ll share the most important developments, wins, tools, resources, and events. Beyond the newsletter, the goal is to build open-source tools, models, research, and find ways to take back control.

Get in touch if you’d like to get involved!

- Wesley

Updates

EU Chat Control 1.0 revival

The European Parliament forced an extension of Chat Control 1.0 that allows big tech to continue scanning private messages until 2028. Most MEPs voted against it, but due to an undemocratic and sneaky tactic it was pushed one day before summer recess. See which representatives enabled it.

The real fight over Chat Control 2.0 resumes in September.

Age verification and social media bans

Age-verification laws keep spreading under the guise of child safety. So far they have strengthened the most powerful tech companies more than they have protected children. France has now approved an under-15 social media ban, while security researchers continue to break the verification systems meant to enforce this.

Proton’s tracker shows how quickly these laws are spreading globally.

Your car required to watch you

Every new car in the EU must now include a driver-facing camera to detect distractions. Its another step in collecting biometric data, for training purposes in an everyday private space with little clarity or regulation on what is allowed with that data. Ironic is that these mandates arrive when the next generation of cars does not need a driver at all.

Flock watches more than plates

The street is no longer anonymous either. Cops already use Flock to track people, not just cars, and Tommy G maps how deep that dragnet already runs: national sharing, stalking abuses, cameras you never voted for. Pressure still works on the edges. Flock ended its audio “Distress Detection” rollout after city mics risked sending armed police to ordinary street noise. A small win, as their wider network keeps growing.

Keep Android Open

From September 2026 Google will block sideloaded Android apps unless developers register, pay, and hand over government ID. Keep Android Open.

News

• American charged for using a duress PIN - American traveler charged for the alleged destruction of data using Graphene OS during border search

• Meta and Google introduce selfie verification - Both pushed face-video checks sold as security or recovery. Do not hand over your face for a badge or a password reset.

• AI coding tools overreaching on your repos - xAI admitted Grok Build kept developer repositories, and Anthropic Claude was caught reading files outside its allowed scope.

• Mobile VPNs leak more than they claim - Engineers at the University of Michigan audited 281 Android VPNs and found many leak traffic or identifiers and fail basic hardening.

• Apple patches Hide My Email, a year late - A flaw let anyone reverse-lookup a real address from a Hide My Email alias. Apple fixed it quietly after more than a year.

• arXiv LaTeX sources leak secrets - A study of nearly three million preprints finds LaTeX sources often expose passwords, GPS coordinates, and private author comments.

Wins

• UK drops workplace digital ID - The UK scraps its mandatory workplace digital ID scheme after cross-party pushback.

• Meta smart glasses backlash - After public pressure Meta stripped facial-recognition code from its glasses app, and New York banned the glasses in every courthouse.

• US Supreme Court limits geofence warrants - Warrants for phone location history around a crime scene now count as searches, so police need stronger constitutional grounds.

• EU Court: VPNs are lawful tools - The EU Court of Justice affirmed VPNs as lawful technical tools, not infringement gadgets, in an Anne Frank copyright case.

• UK leaves VPNs alone - The UK kept VPNs outside Online Safety Act controls, and the VPN industry called it the right call.

• Apple loses Digital Markets Act challenge - The EU General Court upheld Apple interoperability duties and rejected its bid for exemptions.

• Proton VPN transparency report - In 2026 through June, Proton denied all 47 data requests targeting VPN users, with nothing to hand over under its no-logs design.

Tools

• Paperweight v0.5 - Local-first PII analysis for addresses, phones, IBANs, national IDs, cards, and more.

• Multi-account containers in Firefox and Brave - Both browsers now ship containers so work, personal, and other sessions stay isolated from cross-site trackers.

• pvcli - A curl-like CLI for debugging Oblivious HTTP and other privacy proxy protocols, open-sourced by Cloudflare under Apache-2.0.

• DuckDuckGo YouTube ad blocking - DuckDuckGo browsers now block most YouTube video ads by default, on top of tracker and cookie-pop-up protections.

• Site Behavior Lab - Runs 98 real sites in a controlled browser and shows every request, cookie, and tracker, including what Brave Shields would block.

• EFF wearable privacy review - Most watches, rings, and bands lack transparency reports and share health data widely. Apple is still the rare end-to-end encryption case.

Resources

• Exit Chat Control - A multilingual field guide to encrypted messaging, email, VPN, DNS, 2FA, and self-hosting.

• Peer-to-Peer (Coin Center) - New Coin Center newsletter on tech authoritarianism and the tools to resist it. This is the first post.

• When is software protected speech? - Law of Code with Peter Van Valkenburgh on code as speech, from the crypto wars to AI export controls.

• Privacy is not about hiding - Jaya Klara Brekke (Nym) on privacy as the freedom to think, err, and connect, not just conceal data.

• Your apps are scanning your photos - Techlore on how photo and message scanning works, why Chat Control-style mandates make it worse, and how to lock down defaults.

• Your Period Data Should Be Private - A practical guide to protecting menstrual health data.

Events

• 06 Aug 2026 - DEF CON (Las Vegas, USA)

• 10 Aug 2026 - Privacy Camp 2026 call for sessions (Brussels, Belgium)

• 14 Aug 2026 - HOPE (New York, USA)

• 31 Aug 2026 - Cypherpunk Week (Amsterdam, Netherlands)

• 01 Sep 2026 - Web3Privacy now (Amsterdam) (Amsterdam, Netherlands)

• 18 Sep 2026 - Web3Privacy now (Tokyo) (Tokyo, Japan)

• 29 Sep 2026 - Bitkom Privacy Conference (Berlin, Germany)

• 13 Oct 2026 - Brussels Privacy Symposium 2026 (Brussels, Belgium)

• 13 Oct 2026 - Privacy Camp (Brussels, Belgium)

• 02 Nov 2026 - Web3Privacy Congress (Mumbai) (Mumbai, India)

• 27 Dec 2026 - 40C3 (Hamburg, Germany)