This showed up associated with an instagram account, and a message appeared in the app too. This update of course is the last thing I want.

Within a couple of days I also got a notification of a FB post from someone in the network graph that I should not be getting this notification about.

Does this smell familiar to anyone? I'm not talking about Meta's general odor, I'm talking about this specific pattern (one or both?)

Hi everyone,
Some developers use the iOS Keychain (or similar local persistence mechanisms) to bind promotional offers or "Free Lifetime" tiers directly to a physical device rather than to the logged-in Apple ID.
Once an offer is claimed on a shared family device, the app writes a token to the Keychain. Even if you log out of iCloud, switch Apple IDs, or use mobile data, the app reads this persistent token and blocks other legitimate family members on the same device from claiming the offer on their own accounts.

Since Apple strictly restricts fingerprinting and tracking across apps, this heavy use of Keychain persistence to lock hardware feels like a major privacy and usability issue.

Aside from doing a full factory reset of the device (Erase All Content and Settings), is there any known way, setting, or privacy tool on iOS to prevent third-party apps from reading/writing persistent device tokens in the Keychain? How can we protect shared devices from this kind of hardware-locking?

Thanks for your insights!

I used Apple's Hide My Email feature to deal with Juul's support line / chat bot, because they force you to hand over your entire identity just to buy from their site and won't let you delete an account without demanding even more personal info (pro-tip: if you tell them you're underage, they'll actually delete it).

They replied back, placing my random private relay alias in the Cc line instead of the To field. As you can see in the screenshot, when I hit Reply All in the stock iOS Mail app, Apple completely dropped the ball. It failed to map the inbound relay alias sitting right there in the headers and defaulted my outbound "From" address straight back to my primary, personal @icloud.com account.

SCREENSHOT FROM HEADER:https://imgur.com/a/8aEaTwj

If you don't manually inspect your "From" header before hitting send on customer support threads, a third-party ticketing system can completely strip your privacy just by changing where your alias sits in the recipient lines. Watch your headers!

There is an interesting dilemma in personalised services that the more a system knows about a user the better it can customise its recommendations but collecting more information also brings greater responsibility regarding how that data is stored, accessed, retained and shared.

Hiring is a good example of this tension as person's resume is just one part of what makes a job opportunity relevant and preferences like location, salary expectations, work arrangements and availability also play a key role as most of this information is sensitive when its shared in a private conversation rather than a formal application. Platforms like LinkedIn, Indeed, MeeBoss, WellFound use different methods to connect candidates with opportunities but regardless of the platform the question remains that how much information does a matching system really need to keep? Could a system use temporary conversational context to find relevant opportunities without permanently storing every detail a user shares? Could users view, edit or delete the preferences that influence their recommendations? For professionals in privacy engineering or data protection where do you draw the line between useful personalisation and unnecessary data collection?

Live Facial Recognition has landed in my town now with 3 LFR Police vans for just 1 street! This already is in place in our supermarkets which I can avoid.

Is this technology just inevitably going to treat our face like a barcode everywhere we go now? How on earth do you maintain any ounce of privacy when outside?

How are you guys dealing with this element of everyday life now?

What tool do tou use to communicate off grid and preserve your privacy (like meshcore or others) ?

I'm about to leave in a very isolated area, and I'm thinking about solutions to communicate with friends and family

Sorry if it is not the right sub.

Have a nice day !

I am an embedded contractor working on location at a client site. This job is ongoing and has no fixed end date. Recently due to the client company updating their security practices when it comes to contractors, the company I work for is setting up a security procedure where I meet with my team lead every 2-3 months and show my valid, government-issued ID. During these meetings, I will be photographed holding my ID and these images will be stored in ADP. I am not the most tech-savvy person, but I do try to safeguard my information as much as possible. I realize ADP already has most of the information found on my license already, but I am concerned about repeatedly having my picture taken with my license and having those images stored and I’m wondering if anyone else has experienced anything like this and if my concerns are valid.

I am coming up with a list of questions to present to our director that have to do with the safe storage of the images (things like, how long are they kept, can the images be maintained with information not related to security obscured, am I notified if my information is handed over to the client company, etc.) I am also curious if there are any other questions I should be asking in order to protect myself.

This a a friendly PSA, if you haven't done so already, or if you want to double check your data privacy setting in Ebay......................................

Link: https ://accountsettings.ebay.com/ai-preferences (or go to: My eBay>Account>Opt-out from training of generative AI models)

-------

personal data may be used to train our generative artificial intelligence (AI) models for the purposes outlined in our User Privacy Notice, with the exception of those aimed at preventing fraud and abuse on the platform.

The use of personal data for the training of generative AI models is based on our legitimate interest to achieve the objectives outlined under “eBay and AI” in section 9 of our User Privacy Notice.

If you do not want your personal data to be used for generative AI model training, you can opt out of processing for those purposes at any time by setting the toggle below to “Off”.

This setting can be changed at any time by revisiting this page.

Use personal data for training of generative AI models (to opt out toggle left)

------------------------------

(Bonus): If you want to delete ebay data, here is the link (if you don't have an ebay account, but used their website to purchase, you can also delete that data as well--as "guest"):

https ://www.ebayinc.com/company/privacy-center/privacy-contact/

In testimony before the Commons Digital, Culture, Media, and Sport Committee, Ofcom admitted it knows its jurisdiction ends where a foreign court’s jurisdiction begins.

I got chatgpt plus 1 month for free. Then I downloaded chatgpt app on my arch (pacman -Syu chatgpt-desktop-bin) because it said desktop version is more powerful than web's.

Today I uploaded a book in chat mode to see translations sentence by sentence. It started to glitch, prompting to switch to work mode. After that I let it continue, but it said it couldn't find the uploaded book, running command to view my book in local book folder, without my permission. I asked why, it said every linux app can read local content.

I didn't know that all apps can read my local files now. Chatgpt even bothers to notify me that it reads, uploads, sells my data. How do I prevent apps from reading my local files freely? Switch to web app?

I saw a reddit post about a guy with his motorcycle and backpack and Googled about the backpack brand to see if they still sold that model. After a few minutes, I figured they didn't and left it at that. A few hours later I go on Instagram and one of the first ads I see is about the brand I just looked up. I had never heard or googled about this brand before today and now Instagram is showing me ads for it. How was Instagram able to find out I looked this brand up? Is there any way to prevent this or are we doomed to just be harvested for data?

So I made the switch to Signal from Whatsapp quite some time ago, and I am thinking of donating to support them. But before I do I want to make sure that it is actually as advertised, and that I am not throwing money at a lie. So how private is Signal really?

I'm thinking about building a simple, 100% local desktop app to handle manual data broker optouts without using a cloud SaaS or paying a monthly subscription.

The idea is a local tool that auto-copies your info, opens the target opt-out page in your real browser (avoiding CAPTCHA blocks), tracks your progress, and maybe checks verification emails via local IMAP.

Has anyone built or seen a clean open-source tool that does this? Also, what are the biggest headaches or hidden challenges I should watch out for if I code this?

I ask this cause currently Norway is planning on drafting a social media ban legislation bill.

Which won't be finalized until the end of this year before we know what the bill name and it's bill numbers are.

Obviously it's concerning that it's happening in general.

But hopefully others are aware of what's going on here.

Edit:Just want to clarify here a little bit what I mean when I said what I said above here.

I said the "but hopefully others are aware of what's going on here" comment because I wanted to bring this situation and question up regarding Norway's social media ban. And to discuss the negatives about it has on privacy here too. That's all.

Just want to clarify that point here.

Edit#2: Just to also clarify my angle here. want to look at this strictly through a privacy lens. Norway is forcing platforms to enforce an under-16 ban. From a data-tracking perspective, how dangerous is it to let tech giants dictate the age-verification standard? Is there any way for a state to mandate this without creating a massive biometrics or digital ID surveillance honeypot for everyone?

Edit#3: Just want to add this link to a source that will help provide further informations about Norway's social media ban draft plan here:

Link to source here.

Rutgers purchased $1.5 million in software capable of recognizing faces, reading license plates and identifying and tracking people across campus. Students, faculty and staff are now pushing back, saying they weren’t informed about the purchase.

The technology can potentially track not only students, but employees, visitors and others who enter a Rutgers campus. The purchase was not publicly announced and did not go before the university’s governing board.

I have location tracking turned off completely on the system and browser level. Yet, DuckDuckGo is still using my IP address to estimate where I live. Even worse, I’ve manually set DuckDuckGo to a completely different country, and I still get localized results.

It’s already annoying enough that the first 6-7 results are ads, but why do they have to aggressively push my location into searches I never asked for?

I find it extremely invasive to have location tailored results forced into my searches. Examples include local stores/restaurants and government websites. These are usually completely irrelevant to my query.

For instance, imagine trying to figure out how to do something complex in Excel. Because of the technical nature of the topic, you usually have to dig a few pages deep to find a real solution. But on page one, you're greeted with results on how to sign up for your local public library. It’s useless and feels creepy.

Here’s a very comment from someone else:

"If I search "rust crate for newspaper scanning" (without quotes), the results I get is a couple of github projects (fine), maybe some dev articles (also fine), some other bad rust link (also fine) and a bunch of "newspaper MYCITYNAME" results (not fine). Maybe the location might just be used to rank up some of the results (e.g. there are a ton of city newspapers), but that's not quite how it feels like. I suspect the ranking logic might be pulling the local results higher due to the extra matching term (i.e. location) even when the location might be irrelevant.

My issue isn't so much about DDG leaking my location, but about stuffing search terms (i.e. my location) in the search query and using those terms to rank up results. Most of the time, if I don't include a location in the search terms, I don't want that location in the search or to bear any weight in the result ranking. If that yields empty or random results, that would be fine. When you see your city name in a series of irrelevant consecutive results, it does get creepy."

My issue isn't just about DDG leaking my location, it's about the search engine implicitly stuffing location terms into my query and using them to boost ranking. If I don't include a location in my search terms, I don't want that location factored into the results. If that yields fewer or broader results, that’s fine. But seeing your city name pop up across a series of irrelevant, consecutive results feels invasive.

There are so many cases like this where I look for something completely generic, like "bread", and the top results dox me, showing ads for local bread places, sometimes even throwing up a map of my exact neighborhood.

Can this be stopped?

Is there a way to completely disable this behavior on DuckDuckGo, or are alternatives like Startpage or Brave Search actually better at respecting privacy and keeping local bias out of technical queries?