U.S. Customs and Border Protection (CBP) seized a psychiatric nurse practitioner's phone filled with confidential patient information at Washington Dulles International Airport last week, according to a new lawsuit. Muhammad Numaan Imam alleges that CBP agents told him that they could take his electronics the "easy way or the hard way" and refused to let him talk to his lawyer because "we are the authorities at the border."
The lawsuit by the American-Arab Anti-Discrimination Committee (ADC) may be the first time CBP is taken to court over seizing people's medical records. ADC is also helping Palestinian-American lawyer Jay Shehadeh and Jewish-American journalist Max Blumenthal sue over their devices being seized.
"We're seeing a pattern where officers use their border-search authority not to advance any legitimate border-related purpose, but to punish individuals for refusing to provide access to their personal electronic devices and for having expressed views the government didn't approve of," ADC president and legal director Jenin Younes wrote in a statement emailed to journalists.
While Shehadeh and Blumenthal claim that CBP is retaliating for their political views, Imam argues that he faced threats and retaliation with the simple act of asserting privacy rights. Both Imam and Shehadeh were considered "trusted travelers" under the Global Entry program, which allows American citizens who undergo a background check to pass through an automated fast track at airports and borders.
Asked by Reason, a CBP spokesperson did not address any specifics of the case, giving only a generic statement about how "CBP's ability to lawfully inspect electronic devices crossing the border is integral to keeping America safe in an increasingly digital world."
The border exemption to the Fourth Amendment gives U.S. authorities the power to look for "contraband" crossing into the country without a warrant. There is a mess of contradictory court rulings on whether that power includes searching travelers' electronic data, but in practice, CBP can simply seize the physical devices that the data live on.
And the agency often lies outright to travelers whose data that it wants to search, as documents recently released in the case of Atlanta protester Samuel Tunick show. CBP agents gave Tunick a false reason for detaining him and falsely promised that he would be allowed to leave with his phone if he cooperated, even though they were under orders to seize his devices no matter what. Tunick is now on trial for allegedly tricking the CBP agents into deleting his data to avoid a search.
"It's happening to a lot of people, and it's being used in this coercive, inappropriate way," Younes tells Reason.
The problems for Imam, who lives in Virginia, actually began at another border. He was heading to Istanbul on Saturday for a family vacation with his Pakistani wife, Khadijah Mansoor, and their 1-year-old child. Turkish authorities demanded to see Mansoor's U.S. green card, which she had forgotten at home, and wouldn't let her enter on her Pakistani passport alone. The family had to board the next flight back to Washington. On their arrival, CBP naturally wanted to know why they had been turned away and why Mansoor didn't have her green card.
But things took a weirder turn after agents told Imam he had been "flagged" for undisclosed reasons, pulled him into a separate room, and began questioning him about his social media use and group chats, according to the lawsuit. (Imam tells Reason that they asked about group chats in general, not any specific group chat.) When agents asked for the password to Imam's phone, he told them that he uses the phone to communicate with and manage cases for patients at the rehab facility where he works. The Health Insurance Portability and Accountability Act (HIPAA) strictly prevents doctors and other medical staff from sharing patient data without consent, so Imam asked to speak to a lawyer.
"Your lawyer cannot do anything. We are the authorities at the border," Imam recalls one agent saying. A supervisor then told the couple that CBP could take all of their electronics the "easy way or the hard way," and that the devices could take months to get back, Imam and Mansoor claim.
CBP's own internal policy says that devices should "ordinarily" be held for less than five days. The same policy includes vague guidelines for dealing with medical information: "Possibly sensitive information, such as medical records and work-related information carried by journalists, shall be handled in accordance with any applicable federal law and CBP policy." Imam says that the CBP agents claimed to have software for filtering out HIPAA-protected data.
After four hours in detention, CBP took the family's phones and laptops and let them go. The next day, Imam got an email stating, "We regret to inform you that your membership in Global Entry has been revoked for the following reason(s): You do not meet the Trusted Traveler standard." In addition to both Imam and Mansoor losing valuable work data, the lawsuit argues, Imam is now unable to prescribe certain psychiatric medications to his patients, because of federal regulations that require phone verification.
The lawsuit demands the return of the devices and data under Rule 41(g) of federal criminal procedures, which requires the government to hand back property that is no longer necessary for a criminal investigation. ADC has also filed these motions in Shehadeh and Blumenthal's cases. (CBP gave back Blumenthal and Shehadeh's phones almost immediately afterward, but ADC is continuing to press for records of what they did to those phones in custody.) Younes filed a brief on Blumenthal's behalf in support of an upcoming Supreme Court case over whether CBP can continue these electronic searches.
"The devices are neither contraband nor subject to forfeiture, and, to Plaintiffs' knowledge, there is no pending criminal investigation, criminal prosecution, or warrant authorizing their continued seizure or search," Imam's lawsuit states. "The Fourth Amendment does not permit the border-search exception to become a means of coercing compliance through the threatened or actual confiscation of travelers' personal property."
Your home address, phone number and relatives' names may be sitting on people-search websites you've never visited. Anyone who finds those listings could learn more about you than you're comfortable sharing. A data broker opt-out can help reduce that exposure, especially during retirement, when protecting your finances, family and home becomes a priority.
And a tragic case in Minnesota shows why publicly available personal information deserves a closer look. Here's what happened in Minnesota and the steps you can take to make your personal information harder to find online.
Join our upcoming CyberGuy LIVE class: 5 Ways to Travel Smarter and Save Money
In this free live online class, Kurt "CyberGuy" Knutsson will share five practical ways to protect your trip and your wallet this holiday travel season. You'll learn how to secure your phone and personal information, find better travel deals, avoid common scams, save money on bookings and use technology to make your travels easier and less stressful. No technical experience is needed.
Join us Saturday, October 31, at 11 AM ET / 8 AM PT. Register for free now at CyberGuyLive.com.
In June 2025, Minnesota lawmaker Melissa Hortman and her husband, Mark, were murdered in a targeted attack. State Sen. John Hoffman and his wife, Yvette, were seriously injured in a separate shooting. Investigators discovered notebooks containing the names of public officials and a handwritten list of 11 people-search websites in the suspect's vehicle. The list included TruePeopleSearch, Spokeo, Pipl, PeopleFinders, BeenVerified, Whitepages, TruthFinder, Intelius, Ownerly, USSearch and PeopleLooker. The notes described which services were free and what information someone could find through them.
However, the discovery alone did not establish whether the websites supplied the victims' addresses. On June 11, Vance Boelter pleaded guilty to federal charges involving the murders, shootings and stalking of the victims. He was sentenced on July 23 to two consecutive life terms plus 40 years in federal prison. Separate state charges remain pending. The case raised an unsettling question: How easily could someone find your home address and information about your family?
What data brokers know about you
Data brokers collect information from public records, online activity, commercial databases and other sources. They then combine those details into profiles that businesses and individuals may be able to purchase or access. Some companies specialize in marketing information. Others operate people-search websites that make personal details available through free searches or paid reports.
Depending on the company and the available records, those profiles may include:
Your current and previous home addresses
Phone numbers and email addresses
Age, birth date and marital status
Names of relatives and possible associates
Property ownership and estimated home values
Employment and education history
Purchasing interests and other consumer information
Financial, health-related or political inferences
Not every broker collects or sells all this information. Credit reporting agencies also operate under different legal requirements than many people-search services. Still, these records can reveal details you never intended to share with strangers. For a closer look at how criminals assemble this information, read our CyberGuy report on how scammers build a profile on you using data brokers.
Want to see how much of your personal information may already be exposed? Get a free scan to find out if your personal information is already out on the web: Cyberguy.com
Why exposed personal information is risky for retirees
Scammers can use publicly available details to make their stories more convincing. As a result, a suspicious call or message may sound surprisingly personal.
Here are some of the potential risks.
Financial scams: Someone who knows your age, address and family relationships may use those details to impersonate a financial institution, government agency or relative. That familiarity can make a fraudulent request sound credible.
Home and personal safety: People-search listings may expose where you live, where you previously lived and who lives nearby. This can be particularly concerning for people dealing with stalking, harassment or threats.
Medicare and healthcare fraud: A scammer who knows your name, age or location could use those details to make a fake Medicare call or insurance offer seem legitimate. Never provide your Medicare number to an unexpected caller.
Family impersonation scams: Criminals may use relatives' names and personal details to create convincing emergency stories. They might claim someone you love needs money immediately.
Spam calls and unwanted messages: Data brokers and marketing lists can contribute to unwanted contact. However, removing your information will not eliminate every robocall, spam text or phishing email.
Even if you've never experienced one of these problems, reducing the amount of personal information available online can make it harder for someone to research you.
You can request removal from many people-search websites for free. However, each company may have different requirements, and removing a listing doesn't always prevent it from returning.
Here's how to get started.
Search for yourself online. Look up your full name, city, current address and phone number. Check major people-search websites for matching listings. Avoid paying for reports unless you have a specific reason.
Save the website addresses. Keep a record of the pages exposing your information so you can return to them later.
Find each site's removal instructions. Look for links labeled "Opt Out," "Remove My Information" or "Do Not Sell or Share My Personal Information." You can also check the site's privacy policy.
Submit your removal request. Follow the company's instructions. Some sites require you to verify your identity or confirm that the record belongs to you. Share only the information necessary to complete the request.
Complete any verification steps. Check your email for confirmation links or follow-up instructions. A request may remain incomplete until you finish the process.
Consider search-result removal. If sensitive information appears in Google search results, you may qualify to request its removal. Keep in mind that removing a search result does not erase the information from the original website.
Check again periodically. Brokers may refresh their records, and previously removed details can reappear. Revisit the sites and submit new requests when necessary.
A new privacy shortcut for California residents
If you live in California, you now have another option. The state's free Delete Request and Opt-out Platform (DROP) at privacy.ca.gov/drop/ launched in January 2026. It allows eligible residents to submit one deletion request to more than 600 registered data brokers. Beginning August 1, 2026, covered data brokers were required to start processing those requests. The system also requires recurring checks for matching information, although legal exceptions apply and removal is not immediate. Other states have their own privacy laws and removal rights, so your options may depend on where you live.
How a data removal service can help protect your personal information
If manually contacting dozens of websites sounds exhausting, a data removal service can handle much of the work for you. These services help identify data brokers and people-search websites that may have your information. They can also submit removal requests on your behalf and follow up when necessary.
Depending on the provider and subscription plan, available features may include:
Automated removal requests: Services contact covered data brokers and people-search websites to request deletion of your personal information.
Recurring removals: Some providers periodically repeat requests and check whether previously removed information has reappeared.
Progress reports: You can track removal requests and review updates about which companies have responded.
Multiple personal details: Certain services let you submit current and previous addresses, email addresses and phone numbers to help identify matching records.
Custom removals: Some providers allow you to submit additional website links for review and possible removal assistance.
To get started, choose a reputable data removal service, create an account and provide the information needed to identify your records. You'll typically need to authorize the service to submit removal requests on your behalf. Some providers also offer family plans that cover multiple household members.
Before subscribing, compare the websites each service covers, its removal process, ongoing monitoring features and subscription costs.
Check out my top picks for data removal services and get a free scan to find out if your personal information is already out on the web by visiting CyberGuy.com.
What a data removal service cannot do
Even with automated removal, some personal information may remain publicly accessible. Property ownership records, government databases and certain court records can continue displaying details about you. Data removal services generally cannot force government agencies to delete legally available public records.
Additionally, not every website must honor a removal request. Some services offer custom removals, but legal restrictions and technical limitations can prevent certain information from being deleted.
Removing data broker listings also cannot undo previous data breaches or guarantee that scammers will stop contacting you.
Still, reducing the number of websites exposing your information can make it harder for strangers to find personal details. For retirees, that added privacy can help reduce exposure to targeted scams and unwanted contact.
Kurt's key takeaways
What concerns me most is how much someone can learn about you without ever meeting you. Your address, family connections and personal history can give scammers information they can use to gain your trust. And once that information starts circulating, controlling where it goes becomes difficult. That's why I recommend taking a proactive approach. Start by finding out what's publicly available, remove what you can and keep checking. If the process becomes overwhelming, a reputable data removal service can help with the ongoing work. You may never erase every trace of yourself from the internet, but you can make your personal information harder to find.
Have you ever searched your name on a people-search website and been surprised by how much information was available? Let us know by writing to us at CyberGuy.com.
Sign up for my FREE CyberGuy Newsletter
Get my best tech tips, urgent security alerts and exclusive deals delivered straight to your inbox.
For simple, real-world ways to spot scams early and stay protected, visit CyberGuy.com – trusted by millions who watch CyberGuy on TV daily.
Plus, you'll get instant access to my Ultimate Scam Survival Guide free when you join.
Ever find something you want to buy online, leave it sitting in a browser tab and then completely forget where you saw it? Maybe you spotted a great pair of headphones while searching Google. Later, you found a birthday gift at another retailer. Before long, you've got a dozen tabs open and no idea which store had the better deal.
Google thinks it has a solution. On Oct. 15, the company began the U.S. rollout of Universal Cart, a new artificial intelligence-powered shopping tool that brings products from different retailers into one place. It also tracks prices, watches for restocks and helps you find savings before checkout.
With holiday shopping approaching, the timing could be especially useful. But there's another question worth asking. Will having everything in one cart help us spend less, or simply make it easier to buy more?
Join our upcoming CyberGuy LIVE class: 5 Ways to Travel Smarter and Save Money
In this free live online class, Kurt "CyberGuy" Knutsson will share five practical ways to protect your trip and your wallet this holiday travel season. You'll learn how to secure your phone and personal information, find better travel deals, avoid common scams, save money on bookings and use technology to make your travels easier and less stressful. No technical experience is needed.
Join us Saturday, October 31, at 11 AM ET / 8 AM PT. Register for free now at CyberGuyLive.com.
Google Universal Cart is a shopping hub that works across Google Search and the Gemini app. Instead of keeping separate lists of products you might buy, you can save items from different retailers in one place. For example, you might find a coffee maker while searching Google and add it to your Universal Cart. Later, while talking with Gemini about gift ideas, you could save a pair of sneakers from another store. When you return, both products will be waiting for you. Google first previewed the tool in May 2026. Now, Universal Cart is rolling out to U.S. shoppers. It uses Google's Shopping Graph, which contains more than 60 billion continually refreshed product listings. That information helps the system monitor prices and availability across supported products.
4 ways Google's new AI shopping cart can help you save
The biggest attraction here is convenience. But Google has added several features that could also help you avoid paying more than necessary.
1. Keep products from different stores in one cart
Shopping online often means bouncing between websites. You find something at Target, check another item at Walmart and then head to Sephora for a gift. Remembering where you saw everything can become a chore. Universal Cart lets you save supported products you discover through Google Search and Gemini. More importantly, your saved items stay together when you return to shopping. That could come in handy when you're shopping for several people or making a big purchase that requires some research. You can keep your options organized without committing to buying anything right away.
2. Get alerts when prices drop or products return
Here's the feature I find particularly interesting. Universal Cart can monitor saved products and notify you when a price drops. It can also alert you when something that sold out becomes available again. Suppose you're considering a new television but aren't ready to spend the money. Rather than checking the same retailer every morning, you can save it and let Google's shopping system watch for changes. The alerts could be especially helpful heading into Black Friday and the holiday shopping season. Still, remember that a price reduction doesn't automatically guarantee the lowest price available.
This is where Google's AI starts doing some extra work. Universal Cart can surface relevant promotional codes and consider benefits associated with your payment cards. Let's say you have multiple credit cards but can't remember which one offers better rewards at a particular retailer. Universal Cart uses information from Google Wallet to understand supported credit card benefits and help you choose between payment methods. It can also show relevant promotional codes directly in your cart, potentially helping you find savings you might otherwise miss. However, I would still check the details before choosing a card. Rewards programs come with conditions, and the highest points offer may not always translate into the greatest savings.
4. Check out without starting over
Once you're ready to buy, Universal Cart offers a more streamlined checkout experience with participating retailers. In some cases, you can complete the purchase using Google Pay directly from the cart. Alternatively, Google can transfer your selected items to the retailer's website so you can finish your order there. Google says its simplified checkout experiences include retailers such as Nike, Sephora, Target, Ulta Beauty, Walmart and Wayfair, along with many Shopify merchants. However, the available checkout options depend on the retailer. Either way, the retailer remains the seller of record and handles order confirmations and customer support. That means you'll continue dealing with the merchant for delivery questions or returns.
Google began rolling out Universal Cart to U.S. users on Oct. 15. The feature works across Google Search and the Gemini app, although availability may vary as the rollout continues. To explore it, open Google Search or Gemini and look for products you're interested in buying. When Universal Cart becomes available in your shopping experience, you can save supported products from different retailers. Google says those items will remain in your cart when you return, allowing you to pick up where you left off. You can also use the cart to monitor price changes, discover promotional offers and review available checkout options. However, Google hasn't provided a single set of instructions that applies to every device. The appearance and placement of these features may vary.
Does Google's Universal Cart work with every retailer?
Not necessarily. Google says Universal Cart can organize products across retailers, but that doesn't mean every online store supports every feature. The products you can save depend on supported shopping experiences. Meanwhile, checkout options vary depending on the merchant. Some purchases can happen through Google Pay in the cart, while others require you to finish on the retailer's website. Google originally introduced Universal Cart in May with plans to bring it to Search, Gemini, YouTube and Gmail. However, its October 15 launch announcement specifically confirms availability across Search and Gemini in the U.S. Google has not announced a confirmed launch date for Universal Cart integration with Gmail or YouTube.
What's powering Google's new shopping experience?
Behind the scenes, Google uses something called the Universal Commerce Protocol, or UCP. It's a shared technical standard designed to help AI-powered shopping tools communicate with retailers and payment systems. For shoppers, the technical details are less important than what they make possible. UCP helps Google connect product discovery with checkout, reducing the need to jump between different shopping experiences. Google has also been expanding AI shopping beyond the cart. Its Let Google Call feature, for example, can use AI to contact nearby stores and check product availability. Amazon has been developing AI-powered shopping tools, while OpenAI offers AI agents that can assist with shopping-related tasks. The competition to become your digital shopping assistant is heating up.
What about your shopping privacy?
Having Google organize your shopping could be convenient, especially if you already use Search and Gemini. Still, it's worth considering how much shopping information you're comfortable keeping within your Google account. Universal Cart uses Google Wallet to help identify supported payment benefits and relevant offers. However, Google's launch announcement doesn't provide detailed information about how long Universal Cart shopping data is retained or exactly how it may be used for advertising. Before relying on the feature, review your Google account's privacy settings and Google's published privacy policies. For now, I would avoid assuming that adding something to Universal Cart keeps that shopping interest private. And if you're buying a surprise gift for someone who shares access to your Google account, think twice before saving it there. Of course, the usual online shopping precautions still apply. Before completing a purchase, check the final price and verify that you're buying from a legitimate seller. A familiar checkout experience shouldn't replace those basic habits. For more help spotting suspicious sellers, see our guide on how to tell whether an online store is real or a scam.
Kurt's key takeaways
I like the idea of having one place to keep track of everything I'm considering buying, especially when the holidays roll around. The price alerts could be genuinely helpful. And if Google's AI can find a discount code I would have otherwise missed, I'm all for it. But I'm also watching where this is heading. Google is making shopping increasingly convenient, and that convenience can be a double-edged sword. When a company knows what you're interested in buying and makes checkout easier, there's less time to reconsider a purchase. My advice? Use Universal Cart to do your homework and save money. Just don't let the technology do the deciding for you.
Would you trust Google's AI to help you shop and choose how to pay, or are we giving tech companies too much influence over what we buy? Let us know by writing to us at CyberGuy.com.
Sign up for my FREE CyberGuy Newsletter
Get my best tech tips, urgent security alerts and exclusive deals delivered straight to your inbox.
For simple, real-world ways to spot scams early and stay protected, visit CyberGuy.com â trusted by millions who watch CyberGuy on TV daily.
Plus, you'll get instant access to my Ultimate Scam Survival Guide free when you join.
Americans traveling to China are being warned about the possibility of detention, electronic surveillance and restrictions that could keep them from returning home, with a travel expert sharing critical information for people to know before they go.
The U.S. State Department issued an updated Level 2 "Exercise Increased Caution" advisory for mainland China this week, citing concerns about wrongful detention and restrictions on leaving the country.
Travelers are told to be aware that routine professional, academic and personal activities, which carry no risk in Western countries, could be treated as criminal offenses under China's broad security laws.
The advisory also raises concerns about private communications, warning Americans that emails, texts and social media activity could be monitored by Chinese authorities.
"Assume that China's security services can read your emails, texts and social media posts if you send them to or from China," the Oct. 19 advisory states.
The State Department said some people have been detained or deported over private messages considered critical of Chinese authorities, even when those messages were sent outside China.
The State Department elaborated on possible detention without justification.
"The U.S. Department of State has determined that Americans are at serious risk of wrongful detention by the Government of China," the advisory states.
Those detained could spend years behind bars with limited contact with family members or U.S. officials, according to the department.
Travelers could also face restrictions that prevent them from leaving the country, even if they have not been detained.
Chinese authorities have used the "exit bans" during investigations and business or civil disputes. Exit bans have also affected relatives of people under investigation, including children, according to the advisory.
Some travelers may not know they're prohibited from leaving until they try to fly home.
"U.S. citizens might only become aware of an exit ban when they attempt to depart China," the State Department said.
Some bans have lasted for years. Officials warn there may be no clear way to challenge them in court.
Americans who plan to visit China are advised to travel with a U.S. passport and valid Chinese visa, enroll in the Smart Traveler Enrollment Program and arrange regular check-ins with family members or an employer.
Fox News Digital reached out to the U.S. State Department for further comment.
"Be aware of your surroundings. Think before you take a picture," advised Bobby Laurie, a longtime travel expert and former flight attendant.
"This is one of those situations where maybe you were spotted taking pictures of law enforcement on the street, or you were somewhere you shouldn't have been. Maybe you were inadvertently near a protest on the streets," he added.
"Then as your trip comes to an end, you head to the airport. You scan your boarding pass, ready to get through immigration to fly home. And then you realize you're actually not allowed to fly home. There has been an exit ban placed on you."
A judge in New Mexico ordered Meta Platforms META.O on Wednesday to pay the state $25 billion after a jury found the company had misled consumers about the privacy of their data, hitting the company with one of the largest financial penalties in US history.
The ruling came in a case stemming from allegations that Cambridge Analytica, a British political consulting firm involved in Donald Trump’s 2016 presidential campaign, obtained data from millions of Facebook users without their consent. New Mexico had sued Meta, accusing it of lying to Facebook users in New Mexico about who had access to their data.
“Facebook’s wrongdoing — over the course of years and systematically broadcast to the public — goes to the heart of Facebook’s core business practices,” Judge Francis Mathew wrote in his order, which came more than three weeks after the verdict.
Mathew found that a penalty of more than $219 billion was warranted based on state law, but he reduced the figure to $25 billion.
Meta vows to appeal $25 billion penalty
In a statement, C.J. Mahoney, Meta’s chief legal officer, said the company is confident it will win on appeal.
“This ruling, and the Attorney General’s approach to this enforcement, makes it all but impossible to do business in the state of New Mexico,” Mahoney said. “At its core, this lawsuit seeks to impose a tax on speech to enforce new rules for what people can say online.”
New Mexico Attorney General Raúl Torrez said in a statement after the ruling the penalty was one of the largest financial penalties against a corporation in US history.
Meta previously faced a $5 billion penalty from the US Federal Trade Commission in 2019 over the Cambridge Analytica scandal.
Six other states settled their lawsuits against Meta related to Cambridge Analytica for $459.2 million as part of a $17.1 billion multistate settlement the company reached in August to resolve states’ claims that the company’s platforms had harmed teen mental health.
Cambridge Analytica scandal at heart of lawsuit
New Mexico’s attorney general sued Meta in 2021 following revelations that Cambridge Analytica had harvested personal data from as many as 87 million Facebook users through a third-party app.
The state accused Meta of lying to Facebook users in New Mexico about who had access to their data and its handling of hate speech and misinformation posted on the platform. It alleged the company knew third parties had broad access to users’ data and tolerated hate speech or other harmful content when it benefited the company’s bottom line.
Cambridge Analytica, now defunct, used the data for voter profiling and targeting.
“It has been a long time coming holding Big Tech accountable,” Torrez told a press conference in Albuquerque after Wednesday’s ruling. “I think today’s judgment is a clear break with that past and a very clear warning to those in this space and beyond that we intend to protect our people and protect our consumers.”
Mathew’s decision comes as Meta faces thousands of lawsuits and pressure from lawmakers over the impact of Instagram and Facebook on teen mental health, with another trial slated to begin next week.
Earlier this year, New Mexico won $942 million in a pair oftrials against Meta over claims it facilitated sexual exploitation of young people on Instagram and Facebook and misled consumers about the platforms’ safety.
Analyst Gil Luria, head of technology research at D.A. Davidson & Co, called the latest New Mexico ruling costly but unlikely to impact the company’s value.
“Meta is worth nearly two trillion dollars, and will likely continue to appeal these cases and drag them out,” Luria said.
Legal experts anticipate lengthy appeals
Jurors in September had found that the company and its leadership made 26 misleading statements on data privacy, hate speech and other subjects. Multiplying those statements by their potential audience, they said the company had committed more than 43 million violations of New Mexico’s consumer protection laws.
At a hearing on October 1, Randi McGinn, a lawyer for New Mexico, had asked Mathew to award the state between $35 billion and $40 billion.
“This court should speak to Meta in the only language it understands, which is money, and the value of its stock price,” McGinn said.
In court filings, Meta urged Mathew to cap the penalties at $3.45 billion. The evidence showed that Meta does not sell user data and New Mexico did not prove that any consumer had actually been misled, the company said in court filings.
The verdict should be seen as a warning for tech companies that New Mexico will hold them accountable, state Attorney General Raúl Torrez said at a news conference.
The penalty, one of the largest levied against a tech giant, stemmed from a lawsuit by New Mexico claiming the social media company had misled users about their data privacy.
One of the unfortunate quirks of the American system is that you can't lie to the government, but the government can lie to you. Samuel Tunick found himself on the receiving end of this setup last year at Atlanta International Airport. When agents from the Department of Homeland Security (DHS) asked for his phone password, he allegedly gave them a self-destruct code that wiped his data. Tunick now faces five years in prison for destroying evidence.
It turns out that the feds were lying to Tunick the entire time. A new court filing, first reported by 404 Media, shows that the DHS had sent out an order to seize Tunick's phone over his involvement in environmentalist protests in Atlanta. When he landed at the airport, however, agents told Tunick that they were looking for "kiddie porn" and he would be allowed to leave with his phone if he cooperated. They also repeatedly denied him access to his lawyer when he asked.
"There can be no real debate that if law enforcement had acted similarly elsewhere in Atlanta, their actions would be unconstitutional. But the government says it was entitled to act this way because Mr. Tunick was returning from an international vacation" in the Dominican Republic, his lawyers wrote in the filing, which includes internal DHS communications and excerpts from his interrogation video.
U.S. law recognizes a "border exception" to Fourth Amendment privacy rights, allowing federal agents to search incoming travelers for contraband. U.S. Customs and Border Protection (CBP) claims that this exemption also allows them to hold travelers for questioning and search their electronic data. Tunick's case reveals just how widely the agency stretches this loophole.
A few hours before Tunick landed, Homeland Security Investigations (HSI) agent Travis Mcghie emailed the CBP station in Atlanta with his photo and information, stating that he is under investigation for "suspected terrorist activities." (Tunick is involved in Save the Atlanta Forest, also known as Stop Cop City, a protest movement against a local police training center.) The email asked CBP to "conduct a 100% baggage exam, retain all electronics and collect passcodes," stating that the HSI will be at the airport to conduct an interrogation.
Pulled into the secondary screening room, Tunick "almost immediately" told CBP officers that "I don't really want to speak without a lawyer any more," according to the filing, which cites the interrogation tape. He would ask for a lawyer multiple times.
The agents asked Tunick if he had "kiddie porn" on his phone and stated that "because you're refusing to talk, we have the authority to go through your phone to see what we're looking for." One of them, Latoya Castro, told Tunick that "either you can give us your password so that we can go through it no problem, or you can refuse to do that, unfortunately, we will have to seize your phone."
Both of those statements were a lie, of course. The HSI's email had asked CBP to take Tunick's phone, whether or not he cooperated.
The lie about child porn may not only have been meant to intimidate Tunick. While there arecontradictory lower court rulings about the border search exemption, some courts have ruled that the CBP can only search electronics for "digital contraband," or files that are themselves illegal. A search for child sex abuse material would be on stronger legal ground than a search for mere evidence of other crimes.
Tunick was using GrapheneOS, a secure phone system that allows users to set both a real password and a "duress password" that wipes out all data when entered. The interrogation tape shows his phone appearing to reset after he gave the officers a passcode. HSI agent Nathan Burnham and FBI agent Andrea Coble then entered the room.
"You are not under arrest. Once these gentlemen are done with you, pursuant to your entry into the country, you're free to leave," Burnham said, referring to the CBP officers.
Tunick's lawyers argue that the judge should throw out the phone password Tunick provided and everything that resulted from entering it as an "involuntary" response made under "unlawful interrogation," because the CBP agents did not read Tunick his Fifth Amendment rights and ignored his multiple requests to consult with his lawyer before answering their questions.
The CBP claims that secondary screening at the border doesn't count as a criminal investigation, so detainees don't have the same rights as criminal suspects. "Since the international arrivals inspection is an administrative function, CBP policy and federal regs do not permit the presence of lawyers during secondary examinations," a spokesmantoldReason earlier this year.
But Tunick's lawyers insist that his experience was "far outside" a normal border crossing: He was accused of a serious crime to his face, faced an investigation for a different serious crime he didn't know about, and clearly could not leave the situation until he gave information to government agents.
"I hope people understand that the charges against me are meant to intimidate people against protecting their data and their privacy, and the government hopes to set a precedent that no one has the right to privacy," Tunick told 404 Media.
Defend the Atlanta Forest, the movement that Tunick is involved with, has been amajor nuisance for authorities in Georgia. Protesters attacked and burned construction equipment throughout 2022, and police shot a protester in 2023 under unclear circumstances, claiming that they were fired at during a raid.
The Trump administration has brought down the federal government against the movement. In June 2026, the Department of Justice broughtfederal charges against two alleged arsonists, citingNational Security Presidential Memo 7, which directs the feds to go after left-wing domestic terrorism.
But beyond the email line about "suspected terrorist activities," there is no indication of what specific crimes the feds suspected Tunick of, or why they suspected him. And the whole setup of the interrogation was designed to hide those answers. In fact, instead of charging Tunick under typical obstruction or evidence-destruction laws, federal prosecutors chose ararely-used statute that doesn't require them to disclose what the underlying investigation was about.
"Many times the government wants to highlight what it was trying to investigate because that ups the stakes on what the defendant was doing," former prosecutor Daniel RichmantoldThe New York Times. "This is a case where I think they're trying to avoid exactly that by focusing only on the destruction, and not what the investigation was about."
Your phone buzzes. Another political text. This time, it's an urgent fundraising appeal claiming a campaign desperately needs your help before midnight. You delete it, block the number and get on with your day. Then tomorrow, another one arrives from a completely different number. Sound familiar? I've been there, and frankly, I'm fed up with it.
On The CyberGuy Report podcast, I sat down with George Weiner, founder of PACspam.org and head of the digital agency Whole Whale. George got so frustrated with the relentless political texts that he created a free tool to help people figure out who's sending them. Our conversation revealed why blocking numbers often gets you nowhere, how political fundraising has become a lucrative business and what you can do to fight back.
Join our upcoming CyberGuy LIVE class: 5 Ways to Travel Smarter and Save Money
In this free live online class, Kurt "CyberGuy" Knutsson will share five practical ways to protect your trip and your wallet this holiday travel season. You’ll learn how to secure your phone and personal information, find better travel deals, avoid common scams, save money on bookings and use technology to make your travels easier and less stressful. No technical experience is needed.
Join us Saturday, October 31, at 11 AM ET / 8 AM PT. Register free now at CyberGuyLive.com.
Why blocking political text messages doesn't work
You would think blocking a phone number would send a pretty clear message. Apparently, political texting operations don't always take the hint. I asked George why texts from the same political groups kept showing up after I blocked their numbers. "Well, you block one number and you've only blocked one number," Weiner explained.
He introduced me to a technique called snowshoeing, which allows an organization to spread its messages across multiple phone numbers. A single campaign or political action committee (PAC) may use many different numbers to reach the same people. So, even after you block one sender, another number can deliver the next fundraising appeal.
For George, this frustration became personal. As a father of three, he worries about missing an important call from his children's school. "That could be the school, right? That could be an emergency," he explained. Instead, his phone often interrupts him with another fundraising appeal. He tried replying STOP, reporting messages and registering for the National Do Not Call Registry. Yet the interruptions continued. "I have done it all and I still get these messages," Weiner said. That raises a question I've been asking for years. How did these organizations get our phone numbers in the first place?
How political campaigns get your phone number
You might assume a campaign needs your permission before adding your number to its texting list. Unfortunately, political outreach operates under rules that leave plenty of room for unsolicited messages. Weiner explained how phone numbers can circulate through political donor and voter databases. Campaigns may also combine registration information with commercially available data to identify potential supporters. Furthermore, organizations can purchase or exchange contact lists, allowing your information to reach groups you've never heard of.
Voter registration records vary by state, and phone numbers aren't necessarily public in those records. However, organizations can match voter information with other databases to build detailed contact profiles. Political donations can create additional exposure. As we've previously reported, federal political contribution records can reveal personal information, including your name and address when disclosure requirements apply. Once your number enters this fundraising network, tracking every organization that holds it becomes extremely difficult.
The money behind nonstop political fundraising texts
Here's something from my conversation with George that really caught my attention. There's a substantial amount of money flowing through the political texting business, and the people sending these messages have financial reasons to keep doing it. Weiner pointed to approximately $65 million spent on political texting services during the 2024 election cycle, based on his analysis of Federal Election Commission records. He also believes 2026 spending could exceed that amount, although a final election-cycle total isn't yet available.
George also highlighted how much money individual political messaging vendors receive. According to PACspam's analysis of FEC records covering December 2008 through May 2026, reported payments totaled $17 million for Switchboard, $14.4 million for Mothership Strategies and $10.6 million for Message Digital. These figures span multiple election cycles and reflect reported payments to political messaging vendors, which may include services beyond texting.
Why political fundraising texts keep coming
"There is money to be made," Weiner told me. He explained that fundraising operations can keep paying to send messages as long as the donations they generate justify the expense. Even a small percentage of people responding with money can make another round of texts financially worthwhile. Some appeals claim a donation deadline is approaching or suggest a candidate faces an immediate financial emergency. Others use provocative headlines designed to make you react before thinking.
Weiner also raised concerns about how much money some PACs actually direct toward candidates. He pointed to investigations suggesting that certain organizations spend heavily on fundraising while relatively little reaches the candidate being promoted. PACs operate under different rules, however, and not all are established to make direct candidate contributions. That's why it's important to investigate where your donation will go. And this problem crosses political lines. Weiner stressed that organizations associated with different political parties use these tactics. The repeated pleas for money, he believes, can end up alienating the very voters campaigns want to reach. That brings us to an interesting way to investigate who's behind the messages.
How PACspam helps identify who's sending political texts
George created PACspam.org to give people more information about the organizations filling their phones with unsolicited political messages. "Our phones don't have to live like this," Weiner said while explaining why he built the tool. The free service analyzes political fundraising texts and attempts to identify the committee behind them. It can examine fundraising links and use public campaign finance information to help trace the organization responsible. PACspam also helps document complaints and tracks repeat offenders using information connected to FEC-registered committees. Its public leaderboard focuses on texting behavior rather than political affiliation. Meanwhile, its FEC Texting-Spend Explorer lets visitors investigate campaign spending on texting services. In some cases, PACspam can also help identify the texting technology provider that delivered the message. That last part is particularly interesting because those technology companies may serve multiple political organizations.
Rather than contacting only the committee asking for money, Weiner suggests contacting the texting platform when it can be identified. "They do answer," Weiner told me when I asked whether these companies respond to complaints. He described receiving a response from the legal department of a texting provider. That company explained how he could request placement on its own do-not-contact list. The approach could be more useful than blocking one phone number because it targets a provider that may handle messages for multiple political organizations. Still, one company's removal list won't necessarily apply to competing platforms. Of course, results can vary. An organization may use another platform, and some messages don't contain enough information to identify the sender. Still, contacting a texting provider offers another avenue to pursue.
Getting started requires only a political text you've received. Here's what to do.
Visit PACspam.org.
Copy the unwanted political message from your phone. You can also upload a screenshot if you prefer.
Review the message or screenshot for personal details you don't want to share.
Paste the message into the site's lookup tool, or upload your screenshot.
Select Look up sender to analyze the message.
Review any identified committee, fundraising link or texting provider.
Use the generated complaint information to contact the relevant organization through available official channels. You can also review the site's reporting options.
PACspam can prepare complaint information and help document unwanted political messages, but it doesn't automatically send those complaints on your behalf. It also cannot guarantee that your number will disappear from political texting lists. I also asked George an important privacy question. What happens to the information people submit? "We're not collecting your number. I just want that message," he said. According to Weiner, you don't need an account to use PACspam. Whole Whale also says uploaded screenshots are processed and discarded, while personal messages aren't displayed publicly. Those are the service's stated privacy practices, so I still recommend removing identifying details before submitting anything.
Are unsolicited political text messages legal?
Here's where things get frustrating. The Federal Communications Commission treats political texts differently depending on how they're sent. Political messages sent through an automatic telephone dialing system generally require prior express consent before reaching your cellphone. However, messages sent manually through peer-to-peer texting systems can fall outside those restrictions. That helps explain why so many campaign texts can reach people who never specifically requested them.
The National Do Not Call Registry generally doesn't cover political outreach either. So, registering your number may reduce some telemarketing calls without stopping political fundraising appeals. The FCC also says political campaigns should honor opt-out requests when recipients reply STOP. For robotexts covered by federal consent rules, revocation requests must generally be honored within 10 business days. However, an opt-out from one sender won't necessarily remove your number from other political organizations' databases.
5 ways to block political text messages and protect yourself
You may not be able to eliminate every political text, but several steps can reduce the interruptions and help protect your information.
1. Reply STOP when you recognize the sender
If you receive a message from a legitimate political campaign or organization, replying STOP can unsubscribe you from that sender's messages. However, be selective. If the text looks suspicious or contains an unfamiliar fundraising link, avoid responding. Scammers sometimes impersonate political organizations, and engaging with suspicious messages may confirm that your number is active.
2. Turn on spam filtering on your phone
Your smartphone already has tools that can help move unwanted messages out of your main inbox. Here's where to find them.
On iPhone running iOS 27:
Open the Messages app.
Tap the Filters button.
Select Manage Filtering.
Turn on Screen Unknown Senders.
Make sure Filter Spam is enabled.
Unknown senders can move into a separate folder, reducing interruptions. If needed, tap Allow Notifications to choose which categories of unknown messages can still alert you. Availability varies by region.
On Google Pixel or Samsung Galaxy using Google Messages:
Open Google Messages.
Tap your profile picture or icon.
Select Messages settings.
Tap Protection & safety.
Select Spam protection.
Turn on Enable spam protection, if available.
Google Messages can flag suspicious texts and move some of them into the Spam & blocked folder. Menu options may vary by device and app version. Remember to review your filtered messages occasionally so important texts don't get overlooked.
Blocking individual numbers can reduce messages from persistent senders, even though other numbers may still get through.
On an iPhone, open the unwanted conversation, tap the sender's icon, select Info and choose Block Contact. On an iPhone, reporting a message as spam doesn't automatically block the sender. You need to block the contact separately if you want messages from that number stopped.
On Google Messages, touch and hold the unwanted conversation, then tap Block. You can also select Report spam before confirming.
4. Report unwanted texts to your carrier and the FCC
You can forward unwanted political texts to 7726, which spells SPAM on a telephone keypad. This alerts your wireless carrier and can help its spam detection efforts. For suspected violations of federal calling or texting rules, you can also submit a complaint through the FCC Consumer Complaint Center. If the text appears to be a scam, report it to the Federal Trade Commission at reportfraud.ftc.gov/. Keep a screenshot of the suspicious message if you may need it for your report.
5. Donate directly and limit your personal data exposure
One of George's strongest recommendations involves political donations. If you want to support a candidate, find that candidate's official website yourself rather than following a link in an unsolicited text. During our interview, George warned that donating through unfamiliar political fundraising texts can encourage additional solicitations. He described how a successful donation might lead organizations to think, "we got one, let's send twice as many messages." His recommendation was straightforward: Give through the candidate's official website instead of an unsolicited fundraising link. That helps you verify who is receiving your money. However, even donating directly can lead to additional campaign messages, so review the site's privacy disclosures and contact preferences.
Additionally, consider limiting how widely your phone number appears online. Data brokers can collect and resell personal information, and removing your details from covered sites may reduce future exposure. Check out my top picks for data removal services and get a free scan to find out if your personal information is already out on the web by visiting CyberGuy.com.
Keep in mind that commercial data removal services cannot erase legally required public campaign finance records. They also can't guarantee removal from every political organization's contact database.
Kurt's key takeaways
What struck me most about my conversation with George is how much money is being made from messages that so many of us desperately want to stop. We block numbers and ask to be removed, yet the texts keep coming. And the organizations making money from this system have little incentive to change it. I appreciate that George decided to do something about it. His PACspam tool offers a way to investigate who's behind these messages and push back through official complaint channels. I'd love to see political organizations become more accountable for how they use our personal information. After all, supporting a candidate shouldn't mean giving every fundraising operation unlimited access to your phone. Want to hear exactly how George is fighting back? Listen to my full interview with George Weiner on The CyberGuy Report podcast. We dig deeper into the political texting business, the companies behind it and what you can do when blocking numbers fails. And if you're ready to reduce even more unwanted messages, head to CyberGuyLive.com for my free Sick of Spam? class replay. You'll get practical advice for reducing robocalls, unwanted texts and junk email, along with a free spam-stopping checklist.
Should political campaigns have to get your permission before sending fundraising texts, and should the companies profiting from those messages face consequences when you repeatedly ask them to stop? Let us know by writing to us at CyberGuy.com.
Sign up for my FREE CyberGuy Newsletter
Get my best tech tips, urgent security alerts and exclusive deals delivered straight to your inbox.
For simple, real-world ways to spot scams early and stay protected, visit CyberGuy.com –trusted by millions who watch CyberGuy on TV daily.
Plus, you'll get instant access to my Ultimate Scam Survival Guide free when you join.
Ever notice that websites keep asking you to verify your identity when you're using a VPN? Whether you're checking your bank account, signing into email or shopping online, those repeated security checks can get frustrating. Your VPN may be part of the reason.
A VPN changes the IP address websites see, which can sometimes trigger additional verification requests. Fortunately, a dedicated IP address may help reduce those interruptions while keeping your VPN protection enabled. Here's what you need to know.
Join our upcoming CyberGuy LIVE class: 5 Ways to Travel Smarter and Save Money
In this free live online class, Kurt "CyberGuy" Knutsson will share five practical ways to protect your trip and your wallet this holiday travel season. You’ll learn how to secure your phone and personal information, find better travel deals, avoid common scams, save money on bookings and use technology to make your travels easier and less stressful. No technical experience is needed.
Join us Saturday, October 31, at 11 AM ET / 8 AM PT. Register free now at CyberGuyLive.com.
First, let's set the record straight: A VPN generally does not interfere with how your passkeys or two-factor authentication codes work. Time-based authenticator codes are generated on your device and can work without an internet connection. Passkeys use cryptographic keys to verify your identity during a sign-in, while push notification approvals require a network connection. A VPN can usually work alongside all of these methods. What it does change is the public IP address websites see. When you connect through a VPN server, websites and apps see that server's IP address instead of your usual public IP address.
That's the whole point. But it's also why banks, email providers, and financial apps sometimes get nervous. These services use your IP address as one of many signals to decide whether a login looks legitimate. If you always log into your bank from roughly the same location and the same address, and suddenly your account is being accessed from a different city or a different country, the system flags it. Not because your VPN broke anything, but because from the app’s point of view, someone new just walked in the door.
Why changing IP addresses can trigger extra security checks
One common trigger is a VPN connection that uses shared IP addresses. Your public IP address may change when you reconnect or switch servers, although some VPN connections can keep the same address across multiple sessions. For a bank or workplace login portal that recognizes your usual login patterns, an unfamiliar IP address or location can raise a red flag.
The second trigger is shared IP addresses themselves. When hundreds of users connect through the same VPN server, they all appear to be coming from the same address. Websites and security systems recognize these addresses as VPN traffic and treat logins from them with extra suspicion. That means more CAPTCHAs, more verification steps, more temporary lockouts. Neither of these is a flaw in your VPN. It's doing exactly what it's supposed to do. But if you're regularly logging into sensitive accounts, those extra security checks can get frustrating fast.
How a dedicated IP can reduce login interruptions
One potential solution is a dedicated IP address. Instead of sharing an IP address with other VPN customers, you receive a fixed address reserved for your use. Each time you connect to that dedicated VPN location, websites see the same public IP address. This consistency may help reduce unnecessary CAPTCHAs and security checks, especially on services that consider your usual login location.
However, a dedicated IP doesn't guarantee that a bank or website will recognize your connection as trusted. Security systems also evaluate your device, account activity and other risk signals.
Some VPN providers offer dedicated IP addresses as part of their subscription plans or as a paid add-on. These services let you maintain a consistent IP address while keeping your internet traffic encrypted through the VPN. However, privacy protections vary by provider, so check how your dedicated IP is assigned and whether it can be linked to your account.
There is also an important trade-off. Because only you use your dedicated IP, websites may find it easier to associate repeated visits with the same address. Shared VPN addresses can provide greater privacy against IP-based tracking by mixing your traffic with other users.
For people who frequently encounter login interruptions, a dedicated IP may provide a more consistent browsing experience without giving up VPN encryption.
For the best VPN software, see my expert review of the best VPNs for browsing the web privately on your Windows, Mac, Android and iOS devices at CyberGuy.com.
If you're still running into extra verification requests, here are five things worth trying.
1) Switch to a different VPN server
Some VPN server IP addresses trigger more security checks than others. Try connecting to a server closer to your actual location. This may help reduce verification requests, although websites can still recognize VPN traffic.
2) Use split tunneling for trusted apps
Some VPN services offer split tunneling, which lets you choose which apps use the VPN connection. For example, you might allow your banking app to connect directly to the internet while keeping other apps protected by the VPN. Just remember that apps bypassing the VPN will expose your regular public IP address. Feature availability varies by provider and device. Only bypass the VPN for sensitive apps when you're using a network you trust.
3) Check your authenticator app's clock
If your six-digit authentication codes aren't working, your device's clock could be the problem. Time-based codes depend on accurate time settings. Make sure your phone's date and time are set to automatic. If codes still fail, confirm you're selecting the correct account in your authenticator app.
4) Let trusted websites remember your device
Some websites offer a "Don't ask again on this device" option after you verify your identity. Selecting it can reduce repeated security checks on your personal computer or phone. Make sure your browser allows cookies for those websites, since private browsing or automatically clearing cookies can cause them to forget your device. Never use this option on a shared or public computer.
5) Don't approve unexpected login requests
A VPN can trigger extra security checks, but that doesn't mean every authentication request is legitimate. If your phone asks you to approve a login you didn't initiate, deny it. Someone could be trying to access your account. Check your recent account activity for unfamiliar sign-in attempts. If you spot anything suspicious, change your password and review your account's security settings.
I like the extra privacy a VPN provides, but I can understand how repeated security checks could get frustrating. A VPN generally works alongside passkeys and two-factor authentication without interfering with their underlying security. However, changing IP addresses and shared VPN connections can prompt websites to request additional verification. A dedicated IP may reduce those interruptions by giving websites a more consistent connection to recognize. It won't eliminate every security check, but it can make frequent logins more convenient. The most important thing is to keep your authentication protections enabled, even when an extra verification step feels inconvenient.
Have you ever been locked out of an account while using a VPN, or found a solution that smoothed things out? Let us know by writing to us at CyberGuy.com.
Sign up for my FREE CyberGuy Newsletter
Get my best tech tips, urgent security alerts and exclusive deals delivered straight to your inbox.
For simple, real-world ways to spot scams early and stay protected, visit CyberGuy.com – trusted by millions who watch CyberGuy on TV daily.
Plus, you'll get instant access to my Ultimate Scam Survival Guide free when you join.
John Ternus' Apple is waging war on advertising identifiers.
Benjamin Fanjoy/Getty Images
Apple roiled the ad industry with an unexpected new crackdown on web trackers.
The tech giant has now issued a rationale for why it's stamping out "identity resolution."
The ad industry has concerns Apple's latest privacy move may hamper targeting and measurement.
Apple's latest privacy crackdown left the online ad industry scrambling for answers. Now, the tech giant has finally offered some.
Late on Monday, Apple published a blog post laying out its rationale for new restrictions that block technology used to identify and track consumers across websites. The changes are implemented through WebKit, the browser engine that powers Safari and other browsers on iPhones and iPads.
Apple said the change was designed to target "identity resolution," a method adtech companies use to connect separate data points about users — such as email addresses, phone numbers, IP addresses, browsing history, or information about the device they're using — to identify and track them across devices.
The method grew in popularity as many web browsers, including Apple's Safari, began phasing out third-party tracking cookies, the small files dropped on a user's device that were traditionally used for web tracking. The ad industry deploys tracking to precisely target specific audiences and measure whether their campaigns are working.
In its blog post, Apple said that while users might readily offer their email address to log in to a website or sign up for a newsletter, most wouldn't expect it to also be shared with other companies for invisible tracking purposes.
"It's not enough to block cross-site cookies to prevent cross-site tracking today because the tracking industry has not stopped trying to track users on the web," Apple said. "They have ushered into what they call the post cookie era and in our latest releases we have put strong protection in place."
The blog post explains that Apple is implementing "domain-level" blocking, a broad intervention designed to ensure that identity providers can't circumvent the restriction by changing how they send data.
Apple took the adtech industry by surprise earlier this month when it came to light that it had begun blocking the domains operated by several companies that offer alternative identifiers, without warning. The blocked domains included those operated by The Trade Desk, LiveRamp, ID5, Permutive, and Audigent.
The stakes are high for adtech companies that have invested heavily in building identity graphs and alternative tracking identifiers to mitigate the impact of the loss of third-party cookies. Apple's latest move threatens to undermine those efforts and put a dent in their businesses if targeting its users across the web becomes more difficult.
The initial rollout had also blocked The Trade Desk's ability to serve ads at all on Apple-operated browsers. Apple rolled out a fix a few days later that restored The Trade Desk's ad-serving domain from being blocked alongside its advertising identifier, Unified ID 2.0.
The ad industry braces for fallout
The ad industry is now bracing for impact as more users begin updating their devices to iOS 27. Ad pros previously told CMO Insider that the change will make it harder for advertisers to identify and reach people across the open web.
Industry insiders said that by effectively shrinking the pool of users they can target, advertisers are expecting less reach, higher prices to reach the audiences they can still identify, and more difficulty in controlling how often people see an ad and measuring whether their campaigns worked.
Identity resolution has become widespread across the open web. An academic paper published in September that analyzed 600,000 websites over 41 months found that 83.76% of those sites were using alternative identifiers by May 2025.
If advertising becomes less effective on the open web, marketers could funnel more of their budgets into so-called "walled garden" platforms like Meta and Google, which aren't as heavily reliant on alternative identifiers because they have reams of their own logged-in user data. Apple, too, has a growing advertising business within its App Store and apps, including News and Maps.
Apple isn't backing down
There are still unanswered questions about Apple's exact definition of an identity resolution provider, and the company has already demonstrated it can add domains to its block list without warning.
There's also an indication Apple is only getting started. First reported by AdExchanger, Apple has created a broader list that can dynamically block potentially hundreds of adtech, martech, and data companies. Affected companies may not realize they've been added to the list until they begin experiencing disruptions.
In Monday's blog post, Apple linked to its long-standing tracking-prevention policy, which acknowledges that its blocking rules may have unintended impacts. Those include disrupting the funding of websites that use targeted or personalized advertising, advertising measurement, and fraud prevention.
The policy states that while Apple will try to limit unintended impact, "when faced with a tradeoff, we will typically prioritize user benefits over preserving current website practices."
Ever since Apple launched its Intelligent Tracking Prevention feature in 2017, the tech giant has been locked in a cat-and-mouse game with the adtech industry, which has persistently developed workarounds to its privacy updates. Adtech companies have argued that these techniques were necessary to help publishers effectively monetize their websites with ads while still maintaining user privacy.
Apple, which has long held that "privacy is a fundamental human right," makes it clear in its policy that it won't allow workarounds to proceed on its watch.
"We treat circumvention of shipping anti-tracking measures with the same seriousness as exploitation of security vulnerabilities," the Apple policy states. "If a party attempts to circumvent our tracking prevention methods, we may add additional restrictions without prior notice."
Millions of customers’ genetic and personal information exposed in 2023, including more than 855,000 Californians
California’s attorney general, Rob Bonta, on Monday announced the state will receive a $6m settlement payment in 23andMe’s bankruptcy, resolving California’s legal claims related to a 2023 data breach that exposed 6.9 million customers’ genetic and other personal information.
California had unsuccessfully tried to block the $305m sale of 23andMe assets to TTAM Research Institute, a non-profit controlled by the 23andMe co-founder Anne Wojcicki. The state had argued that the bankruptcy sale violated California’s Genetic Information Privacy Act, and it had said consumers did not give express consent to the sale.
Around 80 pages on WhatsApp’s website exposed instructions that were designed for its chatbot, including “WHAT NOT TO SAY.” Meta says a bug caused the issue.
Monitoring tools common in a range of workplaces, including factories, office jobs, delivery work and in retail – often without employees being informed
Employers are increasingly using technology, from CCTV to keystroke monitoring, to track workers’ moves and it is being accelerated by the use of AI, the Human Technology Institute has warned.
Examples provided to Guardian Australia by the institute include a fast-food restaurant using surveillance cameras to stop workers using their phones, and AI tracking leading to a cashier warned over making a mistake once every 533 scans.
Lena Schilling of Austrian Greens says images are ‘digital violence against women’ and a threat to democracy
An Austrian MEP has spoken out about her experience of being “stripped naked” online without her consent and has urged the EU to take action, as a report found that one in six female MEPs had been targeted by sexualised AI-generated content.
Lena Schilling of the Green party said she had learned last month about nude deepfakes of herself circulating online. When she opened the links, she found herself staring at images from one of her first ever press conferences – but the images had been digitally altered to remove her clothing.
Lena Schilling of Austrian Greens says images are ‘digital violence against women’ and a threat to democracy
An Austrian MEP has spoken out about her experience of being “stripped naked” online without her consent and has urged the EU to take action, as a report found that one in six female MEPs had been targeted by sexualised AI-generated content.
Lena Schilling of the Green party said she had learned last month about nude deepfakes of herself circulating online. When she opened the links, she found herself staring at images from one of her first ever press conferences – but the images had been digitally altered to remove her clothing.
Due chiavette Usb criptate, in una busta antieffrazione, in un armadio chiuso a chiave. Dentro c’è la posta di tre ex dipendenti di Michael Page, colosso della selezione del personale, usciti nel 2021 e passati a un concorrente. L’azienda ha tenuto in vita le loro caselle fino al 25 settembre 2023, per due di loro oltre due anni e mezzo. Dice di averle setacciate per parole chiave, ma il Garante non se la beve e annota che non ne ha dato prova. Ha girato ai vecchi capi le mail che continuavano ad arrivare, poi ha mandato dentro un consulente informatico forense. Niente risposta automatica, e il motivo l’azienda l’ha messo nero su bianco: altrimenti gli ex “si sarebbero accorti dell’inattività delle proprie caselle di posta elettronica e sarebbero riusciti ad occultare i propri comportamenti”. Per il Garante della privacy non si fa. Con il provvedimento n. 583 del 6 agosto 2026, pubblicato a inizio ottobre, ha inflitto a Michael Page International Italia una sanzione di 225 mila euro.
Il cuore della decisione sta in poche parole: la società ha conservato la posta e ci è entrata “a ritroso”, “a prescindere dal formarsi di qualunque sospetto”. I controlli difensivi ammessi dalla Cassazione valgono solo per i dati raccolti dopo che il sospetto è nato. Bocciate anche la conservazione delle mail per dieci anni e la regola che imponeva ai dipendenti di consegnare, su richiesta, la password al superiore. La posta, scrive l’Autorità, è corrispondenza “assistita da garanzie di segretezza tutelate anche costituzionalmente”. Chi può aprirla al posto del lavoratore “non può essere il superiore gerarchico né, più in generale, il datore di lavoro”. Michael Page aveva chiesto che il provvedimento non fosse pubblicato, perché i concorrenti avrebbero potuto usarlo per screditarla. Richiesta respinta. Davanti all’Autorità la società si era difesa parlando di indagini difensive contro la concorrenza sleale dell’ex personale; contro la multa può ricorrere al tribunale. Non è un caso isolato, è una linea.
I tre ex di Michael Page hanno presentato reclamo il 15 settembre 2022 e la decisione è arrivata quasi quattro anni dopo. L’articolo 143 del Codice privacy chiede di decidere entro nove mesi, dodici se servono approfondimenti. Per la LTL il reclamo era del 30 ottobre 2023: oltre due anni. Il Fatto ne aveva raccontato lo stallo a metà novembre 2025, e la sanzione è arrivata un mese dopo. La Cassazione, con la sentenza 22791 di quest’anno, ha stabilito che il ritardo non fa decadere il potere di sanzionare. Chi aspetta giustizia per la posta violata, però, aspetta lo stesso.
Gli uffici, del resto, lavorano sotto un Collegio ridotto a tre da gennaio, quando si è dimesso Guido Scorza per effetto delle inchieste di Report e del Fatto. Pasquale Stanzione, Ginevra Cerrina Feroni e Agostino Ghiglia sono rimasti al loro posto nonostante l’inchiesta della Procura di Roma che dovrebbe essere prossima a chiusura. Ed è qui che la frase sulle ricerche “a ritroso” fa un certo effetto. Il 4 novembre 2025, due giorni dopo una puntata di Report sull’Autorità, l’allora segretario generale Angelo Fanizza chiese al direttore dei sistemi informativi di estrarre “urgentemente” mail, accessi Vpn e cartelle condivise dei dipendenti del Garante, per trovare chi passava notizie al Fatto e a Report. Il direttore dei sistemi IT contestò la richiesta. Quando la vicenda divenne pubblica Fanizza si dimise, e il Collegio si dichiarò estraneo. Michael Page almeno frugava nella posta di tre persone. Al Garante si voleva frugare in quella di tutti.
Back in 1983, the Supreme Court declared that "a person traveling in an automobile on public thoroughfares has no reasonable expectation of privacy in his movements from one place to another." That increasingly doubtful proposition underpins a nationwide network of more than 144,000 AI-assisted cameras that track the travels of innocent motorists across the country billions of times each week.
So far, state and federal courts have almost uniformly rejected constitutional challenges to automated license plate readers (ALPRs) installed by companies such as Flock Safety. But in a decision that could signal a shift in the legal treatment of Flock cameras, a federal judge in Oklahoma recently recognized that they enable "a type of indiscriminate mass surveillance."
ALPRs are much more sophisticated than the technology that the Supreme Court considered in 1983, when it approved the warrantless use of a radio transmitter that helped police tail a suspected methamphetamine manufacturer's car. Three decades later, by contrast, the Court said police should have obtained a search warrant before attaching a GPS tracker to another drug suspect's car.
The majority opinion in the latter case emphasized the physical intrusion necessary to install the tracker. But five justices embraced an alternative rationale, saying GPS tracking impinges on reasonable expectations of privacy by revealing potentially sensitive information about the target's historical whereabouts.
That theory came to the fore in a 2018 case involving mobile-phone location data collected by cell sites, which the majority said implicated the Fourth Amendment because "individuals have a reasonable expectation of privacy in the whole of their physical movements." The Supreme Court reiterated that principle this year, extending it to data collected by Google's Location History feature.
"An individual has a reasonable expectation of privacy in records about his cell phone's location," Justice Elena Kagan said in the majority opinion, "and police intrude on that constitutionally protected interest when they demand the information." By similar logic, U.S. District Judge Sara E. Hill concluded this month in the Oklahoma case, people have a reasonable expectation of privacy in ALPR records, and police therefore generally need a warrant to search them.
Those databases include "information about all vehicles that pass by any network-connected camera at all times," which police can peruse "on demand," Hill noted. "Freedom from persistent, dragnet-style surveillance while in public is not a foreign concept in our society, and it is a reasonable expectation that society already accepts," as reflected in the Supreme Court's cellphone decisions.
Like cars, cellphones "move in public places where people can see you in plain view," Hill wrote. "But it becomes constitutionally problematic when law enforcement can indiscriminately and passively catalog your whereabouts over an extended period of time and then use that information for any purpose whenever convenient."
At this point, Hill's decision is an outlier. "It appears that nearly every court examining the issue to date has determined that ALPR technology use is not a search under the Fourth Amendment because people have no reasonable expectation of privacy in their movements on public streets," she noted.
Last month, for instance, a federal judge in California held that ALPR database searches are "clearly distinguishable from and less extensive than the 'near perfect surveillance' achievable" with cell-site or Location History data. And the day after Hill's ruling, a state judge in California rejected a challenge to San Jose's Flock camera network, saying "there is no reasonable expectation of privacy in license plate data collected from cameras directed solely at public streets."
A federal lawsuit involving the same city's ALPR system, which the Institute for Justice filed last April, is still pending. So are challenges to Flock cameras in cities such as Wichita, Kansas, and Norfolk, Virginia.
Even when they reject such lawsuits, courts commonly acknowledge that the legal picture could change as the number and capabilities of ALPRs multiply. If so, it seems likely that Hill will eventually be joined by other judges who recognize the perils of "indiscriminate mass surveillance."
Login
