Do you remember those 200 questions you asked ChatGPT — the ones you’d be far too embarrassed to ask your own mom?

You may have thought it was all confidential, but a growing number of cases show these chats are not protected by any legal safeguards and could end up in court.

In May 2025, a US court ordered OpenAI to hand over more than 20 million ChatGPT logs that users had previously deleted in connection with the New York Times copyright case.

And just two months ago, a Washington Post investigation revealed that at least a dozen court cases had cited logs from AI chatbots as evidence, highlighting that users’ most intimate confessions could be used for legal purposes.

In US v. Heppner, Judge Jed Rakoff ruled that a defendant's Claude conversations weren't shielded by attorney-client privilege or work-product protection, reasoning that no attorney-client relationship exists "or could exist, between an AI user and a platform such as Claude."

"Most people treat an AI like a private diary. But legally, it’s a record held by a company, with none of the privilege that protects what you tell a lawyer or a doctor," Eamonn Maguire, Director of Engineering and Machine Learning at Proton — which develops its own privacy-focused AI assistant — tells TechRadar.

Despite this, people continue to ignore the weight that their digital diaries carry in the eyes of the law.

When an AI chatbot knows too much

A recent DuckDuckGo survey found that as many as 75 percent of respondents were unaware that their AI chatbot conversations could be subpoenaed by law enforcement.

"We see it with traditional search too," says DuckDuckGo’s SVP of Insights Zac Pappis. "Google, for example, received tens of thousands of search warrants, subpoenas, and other requests for user data, and in most cases, they provide it."

Whether AI chats are used in front of a judge depends on the case, and privacy regulations around the world remain a complex patchwork of national laws, international frameworks, and legal custom.

In the UK, there are no specific laws regulating how AI firms hand over their data.

"The UK has not yet developed a bespoke regulatory regime governing AI or AI conversations," notes Melissa Hall, Legal Director and AI Specialist at Scottish law firm Morton Fraser MacRoberts.

AI providers are also actively scanning chats and referring people to the police themselves. This month, a Florida woman was charged after Anthropic’s system flagged her Claude conversations for human review, prompting the company to contact the police. "She reportedly used it like a diary, unaware staff could read it," Maguire notes.

Unsurprisingly, these systems can also make incorrect legal assessments. Anthropic, for example, recently disclosed that one of its own AI agents submitted a fabricated witness tip to a police murder-tip portal during testing.

"As agents act more and more on our behalf, it’s easy to imagine one misreading a conversation and filing a report on its own or being deliberately directed to make a false report about someone, at scale," Maguire adds.

Even if you try to obscure details, you aren't necessarily safe. As Phil James, Partner and Head of Data, Privacy and Cybersecurity at law firm Browne Jacobson, warns: "Just because you redact someone’s name doesn’t mean they’re not identifiable."

Treating a chatbot like a diary often also means venting about other people. "People forget that personal information about third parties can also be protected by data-protection laws," James stresses. "You’re sharing third-party information which you didn’t have consent to share."

Deleting won’t help

Hit ‘Delete’ as many times as you like: when a court orders data to be retained, your digital footprint remains there.

Venetia Argyropoulou, General Counsel at ExpressVPN, which recently built its own privacy-first LLM, notes: "Most people assume that when they delete a chat, it’s gone, while in reality, it can be kept for some time afterward. Indeed, privacy policies tend to say data can be held for longer if the law requires it."

Under Article 17 of the UK GDPR, users may request the erasure of their personal data, but there are exceptions. "If an organization is required by law to retain certain information, including for the purpose of preserving evidence relating to legal proceedings, such obligations will generally take precedence over a request for erasure," says Hall.

Some might argue that Big Tech companies should simply make their privacy policies clearer. "People deserve a clear warning before they start typing, not one buried deep in a policy document," says Proton's Maguire.

In the UK, the Information Commissioner's Office guidance rules that privacy information must be easily accessible and written in clear and plain language, so simply having a privacy policy hidden on a website may no longer be enough.

"It is possible that, if the use of chat data becomes a higher-risk area from a regulatory perspective, expectations around the prominence of such disclosures may evolve," Hall explains.

NEW: Leave No Trace — A weekly newsletter on digital privacy and online surveillance.

Leave No Trace investigates the companies and governments putting our digital freedom at risk — and the people fighting back.

📩 Subscribe now to get every edition delivered to your inbox every Friday, launching this September.

Safer ground

While we wait for that to happen, companies developing alternative, 'privacy-first' AI models argue that the architecture itself needs to change.

Proton is clear on how to protect user data: "The only real protection is a provider that never holds your conversations in a readable form: you can't hand over what you can't read," says Maguire.

ExpressVPN agrees. "Companies can challenge these requests, but if a court orders them to preserve or produce data, they have to comply. Users have very little say in it, and in most cases won't know it's happening," Argyropoulou says.

In short, if you wouldn't be comfortable with something you've typed into a chatbot ending up in a legal dispute, it's worth thinking carefully about which AI tool you use, she says.

Argyropoulou recommends considering AI tools in which conversations are end-to-end encrypted right up to the user’s browser and protected within a secure enclave, where transcripts and logs cannot be viewed, so that the company cannot provide them even if it wanted to.

"As people trust AI with more of their lives, privacy has to be built into how these tools work, not just written into a policy," Argyropoulou concludes.

• Microsoft has confirmed that the Windows 11 'Always On VPN' connection issues introduced in September remain unfixed.
• The tech giant admitted the bug was mistakenly flagged as resolved in the October 13 patch.
• IT admins must continue pinning VPN profiles to a single protocol until a permanent fix arrives in the coming weeks.

Microsoft’s October Patch Tuesday was supposed to mark the end of a highly frustrating month for Windows 11 users relying on Always On VPN. However, the company has now walked back its initial claims, admitting that the highly anticipated fix was a total failure.

In a service bulletin sent to IT administrators this week, Microsoft confirmed that the nasty glitch, which leaves enterprise VPN connections hanging indefinitely or entirely unable to connect, remains fully active.

The issue was originally introduced during the September 2026 security updates and continues to wreak havoc across enterprise networks that depend on secure remote access.

With the bug still running rampant, users relying on the best VPN services for seamless remote work will have to make do with Microsoft's suggested temporary workarounds.

A permanent fix is reportedly still several weeks away, leaving network administrators in a precarious position.

An unresolved headache

The problem primarily affects users utilizing Microsoft's native Always On VPN technology with automatic protocol selection configured. Always On VPN is a critical remote access tool designed to build an encrypted link back to corporate networks quietly in the background.

Trouble starts when an initial connection attempt fails. The system tries to fall back to a secondary method, automatically switching between IKEv2 and SSTP protocols.

Right now, this fallback process is entirely broken. Affected clients will simply hang at a "Connecting" status or flat-out fail to get through. In some instances, subsequent retry attempts will throw an error reading, “The specified port is already in use.”

We previously reported that the KB5127648 and KB5127646 cumulative updates released on October 13 had supposedly cured the fault, while simultaneously introducing bizarre new Wi-Fi authentication issues. Now, it appears those updates failed to deliver on the VPN front altogether.

As reported by The Register, the tech giant has been forced to confess its error. Microsoft explained to administrators that the bug had been “mistakenly updated to Resolved status on October 13, 2026.” The company’s official KB5127648 support page has since been scrubbed of any mention of the VPN repair, with the changelog now quietly noting that the fix will be included in a later release.

Temporary mitigation

For now, Microsoft has downgraded the bug's status from "Resolved" back to "Mitigated," apologizing to IT admins for the confusion.

According to early reports, a permanent repair is slated for an upcoming update that Microsoft expects to ship within the next several weeks.Until that release lands, IT administrators simply cannot treat the October Patch Tuesday builds as a cure.

The sole safeguard currently available is to restrict affected Always On VPN profiles to a single protocol. By manually pinning the connection to either SSTP or IKEv2 and disabling the auto-fallback feature, administrators can prevent the bug from triggering in the first place.

The Register notes that, “The issue affects Windows 11 versions from 24H2 through 26H2.” If your organization relies heavily on these recent builds for remote connectivity, your IT department will need to ensure this temporary mitigation remains firmly in place until Microsoft can successfully deploy a working patch.

An exclusive TechRadar investigation into Google’s Chrome Web Store has revealed more than 350 untrustworthy VPN extensions targeting Russian users, with many imitating well-known brands. Combined, these tools have amassed over 218,000 users.

It’s not the first time potentially dangerous VPN extensions have been discovered. Earlier this year, Palo Alto revealed a significant number of dangerous VPN extensions that could leak users’ internet traffic. Alarmingly, we discovered that 89 of those extensions are still active and available.

So, why are there so many shady VPN extensions specifically targeting Russians, and what are the risks of using these low-quality products?

‘A game of whack-a-mole’

In total, we discovered that there are 369 Russian VPN extensions available on Google’s Chrome Web Store that fail basic transparency and professionalism tests.

Almost every single extension we analyzed lists a throwaway, anonymous personal Gmail address rather than a professional developer contact. And it appears these operators are running large clusters of extensions — just 70 developers are responsible for all of the extensions we found, with one email address associated with 24 individual apps.

Nearly three-quarters of these VPNs host their privacy policies on Telegram’s anonymous Telegra.ph platform, which hides the true owner of the service, and almost half (47%) have more reviews than users, which may indicate review manipulation.

Perhaps most egregiously, we found over 120 extensions using a name associated with a legitimate brand.

The most frequently hijacked name was Happ — a custom proxy client widely used in Russia — which was co-opted by more than 15 extensions. Among major international commercial providers, we found seven extensions imitating Windscribe and five impersonating ExpressVPN.

It’s not the first time fake VPN extensions have plagued Google's ecosystem—earlier this year, researchers uncovered hundreds of fake Chrome VPN extensions impersonating NordVPN and Proton that were routing user traffic through unencrypted proxies. However, our research shows a distinct regional network specifically tailoring these tactics to Russian users.

Windscribe and ExpressVPN told TechRadar that they are aware of copycat extensions appearing on the Chrome Web Store and said they frequently ask Google to remove them when they are found.

Cherlynn Cha, Head of Security Operations at ExpressVPN, said that “copycat extensions put people at risk” because they give people a “false sense of security”. The company added that it employs an "enforcement partner” to scour the web for unauthorized use of the company’s name.

However, enforcement can be challenging. Rebecca Rosenberg, Head of Growth at Windscribe, said: “It’s pretty much a game of whack-a-mole now, the copycat is pulled and two more pop up.”

And the data backs that up. One email address we uncovered is linked to 14 apps, with the precise number constantly changing as their extensions are removed and new ones take their place.

Why are unprofessional VPN extensions a threat?

Unlike many other extensions, VPNs have the potential to access a huge amount of sensitive data. In fact, a VPN extension asks “for more access than almost anything else in the store,” Rosenberg said.

A VPN works by encrypting and re-routing your internet connection through one of its servers. While a legitimate VPN improves your digital privacy, it also means you are transferring all your trust from your internet service provider directly to the VPN creator.

In theory, the anonymous developer could see everything your ISP normally monitors. Think: websites visited, time stamps, and your home IP address.

It’s “a lot of trust to hand over," Cha said. Rosenberg added that giving your data “to an anonymous developer with a personal email and a privacy policy that doesn't load is the opposite of privacy”.

Ongoing security concerns

Without detailed dynamic web testing of all the extensions, it’s impossible to know which may be harmful to users and which are purely unprofessional. However, Palo Alto previously found more than 350 apps that were linked to harvesting user data via traffic interception.

In our tests, 89 of these extensions were still available to Russian users, while email addresses associated with the extensions have continued to launch more apps since initial discovery.

One email address — ‘vale99505@gmail[.]com — was first flagged by Palo Alto in July. According to the company’s threat intel notice, the address was associated with extensions that do not provide “typical encrypted protection like reputed VPN extensions”, adding that the “threat actor” running the apps “has access to all communication”.

According to our most recent tests, six extensions linked to this address are still available for download.

At the time of publication, Google had not responded to requests for comment. TechRadar has shared the full list of extensions with the company and will monitor their availability in the coming weeks.

Windscribe said that Google “should absolutely be doing more” to protect its users from encountering untrustworthy VPN extensions on its Chrome Web Store, while ExpressVPN confirmed the company is in favor of “stronger verification for privacy and security tools”.

Stopping the rise of untrustworthy VPN extensions is important for everyone. But it’s no surprise that this specific network is focussed on Russia.

Why target Russians?

Since the full-scale invasion of Ukraine in 2022, authorities in Russia have launched an unprecedented crackdown on digital freedom. Thousands of websites have been blocked in the country, including international media, social media and gaming platforms.

In response, VPNs have become a crucial tool for millions of people, which has subsequently prompted coordinated efforts by the government to regulate and restrict access to these vital privacy and security tools.

Most recently, this has included the plan to use AI to detect and block VPN traffic in the country.

In this context, developers looking to make a quick profit may spin up cheap VPN solutions that are poorly designed, entirely fake, or designed to harvest user data to sell to third-party advertisers.

But there’s a darker potential: malicious actors may be intentionally designing VPN extensions to trick Russians into downloading software that can actively monitor their internet browsing behavior.

While there’s no evidence that these extensions are linked to authorities in the country, amid growing concerns about state surveillance and deteriorating internet freedoms, taking extra care when selecting a VPN in Russia today certainly seems sensible.

How to defend yourself today

There are several steps you can take to make sure you’re downloading a legitimate version of a VPN extension:

• Check the developer’s name and website before downloading anything
• Check that the privacy policy is accessible, informative and related to the app
• If you know which VPN you want to download, go straight to the provider’s website
• Look out for the ‘Established Publisher’ badge on the Chrome Web Store
• Check for any unnecessary permissions like ‘geolocation’

It’s worth remembering that a VPN Chrome extension also only protects your activity in your browser. Anything you do outside of the browser won’t be encrypted so it’s worth using a well-respected VPN where possible.

And, like most things, if a product is free, it’s worth being skeptical. As Cherlynn Cha told us: “Be wary of free VPNs. Running a VPN network costs real money. If a service is free and it’s not clear how it makes money, your data may be what’s paying for it.”

How we found shady Russian VPN extensions

We compiled our data using a variety of sources, primarily an in-house web scraping tool that identified VPN extensions on the Google Chrome Web Store targeting Russian-language users. We collected metadata including user counts, developer contact emails, and privacy policy URLs.

We then filtered the dataset to remove legitimate, verified corporate VPN providers. The remaining extensions were analyzed for untrustworthy signals, such as using personal email addresses, unprofessional privacy policies and copying established VPN brands.

We also cross-referenced our data with threat intelligence research published earlier this year by Palo Alto Networks' Unit 42 to verify how many malicious extensions previously flagged remained active.

All data and user counts are accurate as of October 12, 2026. Extensions are frequently removed and new copycats are constantly appearing. We continue to monitor their accessibility in the coming weeks.

• A draft of Russia's national AI plan proposed using AI to analyze 70% of blocked VPN services and lift blocking effectiveness to 95%
• The Digital Development Ministry says the measure is absent from the current draft, but Roskomnadzor's separately budgeted and arguably crucial ML filtering project remains
• The 95% is an effectiveness target, not accuracy, and sources expect AI to raise false positives, with corporate VPN, cloud and voice traffic most exposed

Russia's Digital Development Ministry considered using artificial intelligence to push the effectiveness of its VPN blocking to 95%, according to a front-page report in Kommersant.

The measure appeared in a draft of the country's national plan for implementing AI through 2030; the ministry now says it is not in the current version.

This isn't the first time such a move has been reported, but some earlier coverage might have been overzealous, to say the least, when it reported that "Russia Eyes AI-Powered VPN Crackdown With 95% Blocking Accuracy." The problem with that headline is that not only was that proposal dropped, but the 95% accuracy figure was never actually in play.

A draft that proposed AI use

None of the above reporting should reassure an estimated 57 million Russians who rely on circumvention tools.

Roskomnadzor (the Federal agency tasked with "Supervision of Communications, Information Technology and Mass Media") has its own machine-learning filtering project budgeted outside the national AI plan, and the money for Russia's blocking infrastructure is set to double next year.

Kommersant, which reviewed the draft, reports that the ministry wanted AI to analyze the characteristics of 70% of all the VPN services Russia blocks. The drafters reckoned that would lift blocking effectiveness to 95%.

Asked about it, the ministry said the current draft of the plan "contains no such information," in Meduza's translation. A source familiar with the discussions told Kommersant that agencies had pitched a range of measures for the plan, some of which may never be implemented, and that the traffic-analysis algorithms already in service are a form of intelligent analysis but do not count as AI.

An AI layer would behave fundamentally differently; rather than matching known signatures, models would weigh packet sizes and timing, session length, and the balance of inbound to outbound traffic, then flag likely VPN servers from indirect clues: how a node behaves, which host it sits on, and what its neighboring IP addresses look like. The payoff is speed, catching new servers before they reach any blocklist.

Kommersant uses the word effectiveness, and the distinction matters: a blocking-effectiveness figure describes how much targeted traffic it stops. It says nothing about how much legitimate traffic gets stopped with it, and that is what the catch is; the solution proposed does not account for any mistakes, just how effective it would be at its job of blocking out VPN traffic.

The 95% target is also less of a leap than some headlines suggest, because Russia already has 92% on paper, at least by its own estimates. A Roskomnadzor subsidy decision for its Main Radio Frequency Center (GRChTs), dated January 2025 and surfaced in May 2026 by journalist Maria Kolomychenko, sets an "average level of effectiveness" of 92% for restricting VPNs via signatures by the end of 2030. Verstka reports that the AI proposal was meant to lift that same indicator to 95%.

The more consequential point is that striking a line from a draft strategy does not strike the capability. Forbes Russia reported in January 2026 that Roskomnadzor planned to spend 2.27 billion rubles (around $29 million) in 2026 on a machine-learning-based traffic-filtering mechanism, a project we flagged when Windscribe saw a roughly 90% drop in its Russian traffic that same month.

The false-positive risk is not hypothetical in Russia, because the government has already learned how hard it is to separate good VPNs from bad ones. When the ministry ordered major platforms in April to block users with VPNs switched on, its guidance promised a whitelist for corporate VPNs.

Telegram founder Pavel Durov claimed the crackdown had "triggered a massive banking failure," and outage-tracking data showed bank disruptions on April 3 2026. A source told RBC at the time that no reliable technical method existed to tell permitted corporate VPN traffic from the rest.

For now the picture on the ground is unchanged: blocking is intensifying with or without an AI mandate. At least 10 VPN providers reported tighter restrictions in the week after September's State Duma elections, and VPN Guild chairman Alexey Kozlyuk described it to Meduza as "a continuation and gradual intensification" of a campaign that began in August.

The Kommersant report also landed a day after RBC revealed a draft ministry order requiring phones on Russia's 5G networks to support the FSB-developed Kuznyechik cipher from March 1, 2032.

Providers keep adapting. "In Russia, VPNs face pressure almost every month; it is a new norm," an Amnezia VPN spokeswoman told TechRadar Pro. But Sarkis Darbinyan of RKS Global and the VPN Guild warned TechRadar that for users, the end result is "an ever-shrinking number of services that actually work."

The 95% target may be gone from one document. The infrastructure, the money, and the intent behind it are not.

Russian authorities have reportedly explored using artificial intelligence to identify and block virtual private networks with a staggering 95% effectiveness.

According to a report by Russian newspaper Kommersant, the proposal surfaced in a draft national plan for implementing AI technologies through 2030. The ambitious scheme envisioned AI models analyzing the characteristics of 70% of VPN services targeted for censorship.

While Russia’s Digital Development Ministry claims this AI measure is absent from the plan's current iteration, the underlying intent remains clear. Moscow is already heavily investing in a permanent censorship infrastructure, with recent reports highlighting plans for Russia to double its internet censorship budget.

For citizens or visitors trying to secure their connection, finding the best VPN is increasingly difficult as the state tightens its grip on circumvention tools. Currently, Russia relies on "intelligent algorithms" rather than true AI to analyze internet traffic. However, the government still intends to increase the capacity of its traffic-filtering infrastructure 2.5-fold to 954 terabits per second by 2030.

Collateral damage and false positives

An AI-powered system would sit atop Russia's existing technical systems for countering threats (TSPU), the dedicated filtering hardware already installed on telecom operators' networks.

Speaking to Kommersant, a source in the Russian networking industry explained the technical mechanics. “AI automates and accelerates the analysis of connection patterns,” the source noted. The technology would evaluate data points like packet size and timing, session duration, traffic ratios, and neighboring IP addresses to indirectly root out VPN infrastructure.

However, deploying artificial intelligence to blindly hunt down hidden traffic comes with a steep cost.

Industry sources cautioned that an AI layer could lead to a surge in false positives, trapping legitimate business and corporate traffic in the dragnet. One source estimated that the algorithmic error rate is already 5% to 6%, and early-stage AI models would likely produce a significant number of incorrect blocks.

As noted by United24 Media, rolling out such a system requires immense resources. A fully operational AI detection net requires large-scale telemetry storage, massive computing clusters for model training, and a complex infrastructure to distribute updated models directly to filtering nodes.

A broader push for "sovereign" tech

The drive to automate VPN detection is just one piece of a broader effort by Moscow to tightly control mobile communications and escalate VPN blocks. Alongside restricting circumvention tools, Russia is attempting to force the tech industry to adopt strictly domestic security standards.

A recent draft order from the Digital Development Ministry mandates that smartphones operating on Russia's future 5G networks must support "Kuznyechik", an encryption algorithm developed with participation from the FSB’s information-security centre and InfoTeKS. Scheduled to take effect on March 1, 2032, this is not part of the standard 3GPP encryption suite.

Because the algorithm must be baked into modem chipsets, it could effectively force global manufacturers like Apple and Samsung to build Russia-specific hardware just to operate in the country.

Ultimately, it appears the Kremlin is prepared to use every technological weapon at its disposal to isolate its digital borders.

• Fake WatchGuard VPN website steals administrator credentials while delivering legitimate software
• Attackers collected VPN server addresses, usernames, and passwords
• The fraudulent website rejected initial submissions to collect credentials a second time

A fraudulent WatchGuard download website stole VPN login details while supplying the authentic installation package, experts have claimed.

Security investigators at Huntress traced the activity to a lookalike domain that collected connection details before downloading the legitimate client.

The investigation began after suspicious activity involving an administrator working for a managed service provider was detected.

Fake download pages harvest user credentials

Investigators found that the user had searched Bing for a WatchGuard VPN download before visiting a deceptive website designed to resemble the vendor's official download pages.

The website, watchguard-vpn[.]net, offered a purported mobile VPN with SSL download and displayed a form requesting the server address, username, and password.

Those details matched information required by the genuine VPN client, making the request appear consistent with an ordinary installation process.

Submitting the form transmitted the information to a separate domain, watchguard-ssl[.]online, where attackers collected the credentials for potential use against the organization's network.

The malicious script rejected the first submission and cleared the fields, prompting the victim to enter the information again and potentially supplying attackers with multiple password attempts.

Huntress revealed that the operators registered the download domain on August 22, 2026, while the credential collection domain appeared on September 14.

WatchGuard had previously reported the lookalike address in January, although researchers then found no functioning mechanism directing visitors through the fraudulent download process.

Genuine software helps conceal the credential theft

After collecting the second submission, the website initiated a download from WatchGuard's official content delivery network rather than providing a counterfeit installation package.

The file was Mobile VPN with SSL client version 12.11.5, carrying a valid digital signature from WatchGuard Technologies and a timestamp dated November 4, 2025.

Huntress verified that the installer remained unchanged after signing, meaning investigators found no evidence that attackers had modified the legitimate executable.

This approach differs from campaigns that distribute tampered installers or malicious libraries, which endpoint protection products may identify through file inspection.

The authentic download also gives victims little reason to suspect their credentials have already been compromised, since installation can proceed normally afterward.

Huntress found no recorded download from the official server during the investigated incident, suggesting the user might not have completed both credential submissions.

The detection arrived 21 seconds after the malicious website loaded, allowing the security operations team to provide remediation guidance before investigators observed further escalation.

Huntress reported that the main deceptive domain was offline by October 13, although that status does not establish whether associated infrastructure remains active elsewhere.

The attack avoids many malware checks because the fake website steals VPN credentials through the browser before downloading the genuine software.

Organizations should reset compromised passwords, enable multifactor authentication, check for suspicious VPN logins, and direct employees to official software download pages.

This week, I tried to opt out of the facial recognition system at my local Sainsbury’s supermarket. The only solution? Shop elsewhere.

Judging by the look on the security guard’s face when I asked if I could avoid having my biometric data processed, it was an unusual request — surprising, given that an innocent customer was mistakenly flagged and ejected from the exact same store just a few months ago.

Sainsbury’s is far from alone in using live facial recognition technology. Facewatch, the company behind the tech, also lists Sports Direct, Budgens, Costcutter, and B&M as customers on its website. Meanwhile, an increasing number of police forces across the UK are adopting the technology, despite persistent legal challenges.

With facial recognition rapidly becoming a staple of the high street across the UK, what risks does it pose to our privacy, and is improved supermarket security really worth it?

Supermarket surveillance: scanned before you shop

One of the most important principles of any modern data privacy law — including the UK GDPR — is the right to be informed when an organization collects and processes your personal data. It’s why you constantly encounter cookie banners on websites and why app privacy policies often run thousands of words long.

At the supermarket entrance, however, the notice isn't asking for permission; it's informing customers that the scan is underway. Because retailers claim tracking crime is a "legitimate interest", they bypass the need for customer consent.

When I visited the East Dulwich Sainsbury’s store, there was a small sign next to the sliding glass doors that I initially missed, and a larger board positioned inside. While the notices reassure shoppers that "your privacy is protected", they offer very little substantive detail.

To access the full information, you have to scan a QR code leading to Facewatch’s privacy policy — something I could only do because I happened to have a charged smartphone with mobile data, facilities not everyone will have when popping out for milk.

To his credit, the security guard offered to find the store manager to answer any additional questions. But, by then, the point felt moot. Glancing up at the cameras hanging directly along the entrance path, I conceded that my face had likely already been scanned, analyzed, and checked against a database.

Walking away to shop elsewhere might be relatively simple in London, but supermarkets are essential national infrastructure. In rural areas or places where alternatives do not exist, telling customers to choose another shop isn't a realistic option.

The cost of a false match

For victim of mistaken identity, Matt Arnold, the consequences of the system weren’t just theoretical. This summer, he was wrongfully accused of being a shoplifter and escorted out of the East Dulwich store.

Speaking to the BBC, Arnold said: “What upset me was thinking this is what the future could be — people just listen to what the machine tells them to do without thinking about the consequences." Following the debacle, the system was paused.

While Sainsbury’s declined to comment on the record and referred data privacy inquiries to Facewatch, the tech company confirmed to TechRadar that the pause is over and live alerts have resumed. But with the cameras quietly back online, broader civil liberties concerns have reignited.

UK-based civil liberties group Big Brother Watch regularly intervenes to help innocent shoppers remove their details from Facewatch’s database after being wrongly flagged, noting that some "aren’t so lucky and are blacklisted from all the stores in their local area".

Even if the technology worked with total accuracy, questions about its proportionality and fairness remain.

Jasleen Chaggar, Senior Legal and Policy Officer at Big Brother Watch, warned that "shoppers are being subjected to airport-style security just to buy a pint of milk," arguing that the system is “indiscriminate by design, meaning every customer is treated with suspicion”.

Who does supermarket surveillance really protect?

There’s no denying that shoplifting harms supermarket profits. Recent industry indicators cited by Facewatch estimate annual losses from shoplifting have reached £2.2 billion.

In an email to TechRadar, a Facewatch spokesperson defended the technology as an essential safeguard, arguing that "while campaign groups are highlighting the rights of consumers, they are overlooking a shop worker’s right to feel safe at work".

"Giving a shop worker advance warning that someone known to have violently offended has entered their store can give them confidence and precious time to consider a safe response, de-escalate a potentially dangerous situation or seek support before an incident occurs."

Addressing concerns about accessibility and notice, the company said that store cameras are positioned at an "appropriate distance between the entry point and image capture area", and noted that entrance posters provide a landline telephone number and postal address for anyone unable to scan the QR code. In practical terms, that means a customer without a smartphone must step outside, make a phone call, or send a letter in the post before doing their weekly food shop.

Digital rights campaigners remain unconvinced that worker protection justifies pervasive biometric tracking. Sarah Lasoye, programme manager at Open Rights Group, told TechRadar the technology represents a "dangerous infringement on our data, privacy, and human rights".

She also questioned whether surveillance tackles the real issue, saying: "These costly facial recognition technologies only work to line the pockets of private tech companies, and do nothing to address the root causes of crimes of poverty such as theft — unmet social and economic need."

The future of facial recognition at the supermarket?

Sainsbury’s first began trialing facial recognition in September 2025 across just two stores. Following an initial run that reportedly led to an almost 50% drop in theft, verbal abuse, and antisocial behavior, the supermarket is in the process of expanding the technology to 200 stores this in 2026.

With market leaders like Sainsbury’s publicly endorsing facial recognition, other high-street chains will watch the rollout closely.

But the rapid spread of automated surveillance is meeting a growing resistance. Big Brother Watch has launched a campaign encouraging shoppers to object, while a petition calling on the Government to halt the use of facial recognition has surpassed 41,000 signatures.

Surprisingly, Facewatch is also calling for intervention. A company spokesperson told TechRadar that Facewatch "actively supports" tighter regulations on the development and use of the technology, noting it has engaged with the Home Office and hopes "the Government will consider a high bar of regulation for its use by private companies."

While civil liberties campaigners and surveillance companies wait for the law to catch up, the responsibility for protecting personal privacy has been left with the individual. And until genuine opt-out mechanisms are established, that responsibility comes with only one choice. As the security guard at Sainsbury’s made clear: shop somewhere else.

VPN providers are increasingly selling “dark web alerts” as premium security features, marketing them as essential protection against identity theft. This raises a key question: do paid alerts find unique threats, or just repackage data that's freely available?

With subscriptions to the best VPNs already costing up to $10-15 monthly, adding identity protection features can push bills toward $20 a month. If you’re essentially paying for data available at no cost, that’s money better spent elsewhere.

This article is the third in a series of content relating to Cybersecurity Awareness Month 2026, which runs throughout October. The previous articles have covered VPN protection when using AI, and the benefits of dedicated antivirus over packaged solutions.

How dark web monitoring works

Let’s clear up a common misconception first: VPN services aren’t sending security analysts to actively patrol the dark web hunting for your name. That would be impossible – the dark web is too vast and constantly shifting.

Instead, what most dark web monitoring services actually do is simpler: they cross-reference your information against massive databases of leaked credentials that have already been publicly disclosed. These databases contain billions of compromised accounts from data breaches spanning over a decade.

The monitoring happens automatically. You register your identifiers – such as your email address, phone number, or social security number – the service scans these databases periodically, and sends you an alert if a match appears.

The free option: Have I Been Pwned

For free breach checks, Have I Been Pwned (HIBP) has become the industry benchmark. Created by security researcher Troy Hunt in 2013, this free service hosts nearly 18 billion compromised email addresses from hundreds of publicized breaches. Checking is free and requires no account.

Where it gets interesting for continuous tracking is Mozilla Monitor, which runs entirely on HIBP’s data.

Since launching in 2018, Mozilla’s free service has helped people in 237 countries identify exposed information. You can sign up for email notifications that ping you whenever your address shows up in a breach – essentially the core functionality paid services advertise.

Several VPN providers have acknowledged using this same foundation. ExpressVPN Keys explicitly integrates with HIBP for both email breach and password detection, while CyberGhost Identity Guard is described in their documentation as being “powered by Have I Been Pwned.”

Yet not all vendors are relying on public data alone. Domininkas Virbickas, Product Director at NordVPN, said they track “more than 40,000 sources around the clock” and that “most of this data never reaches the public breach databases people can check for free.”

When to pay for premium alerts

That doesn’t mean paid services lack value. Having breach alerts built into an app you already use for VPN protection eliminates another password and dashboard to manage.

If you’re already paying for a VPN subscription, adding monitoring for free or minimal extra cost is efficient. You don’t need to remember to check another website or log into a separate service.

While HIBP updates regularly, paid services may offer faster notifications. Minutes matter when someone steals your credentials – they can try accessing accounts immediately.

That head start can mean the difference between resetting your password on your own terms versus dealing with account recovery after unauthorized access.

Finally, there’s the distinction between basic email alerts and full identity theft protection.

Free services like HIBP notify you about email addresses appearing in breaches. Paid identity protection packages often go much further, including SSN monitoring, credit file locks, bank account number tracking, and even identity theft insurance.

Coveron, which partners with NordVPN for identity protection on premium plans, adds credit monitoring, flags suspicious credit inquiries, and includes identity theft insurance.

Similarly, services like Norton’s LifeLock monitor multiple data types – phone numbers, SSNs, financial accounts – and provide guided recovery steps if something goes wrong.

The verdict

Don’t pay extra for a VPN subscription to get basic email breach alerts. If you want to monitor whether your credentials have been exposed, free tools like Have I Been Pwned or Mozilla Monitor do the same job at no cost.

However, if you’re already paying for a VPN and the dark web monitoring is included at no additional charge, there’s no reason not to enable it. If you genuinely need identity theft protection, then premium services justify their cost with features free tools simply don’t offer.

So the question isn’t whether free tools work for basic breach checking – they do. It’s whether you need the expanded coverage, faster alerts, and recovery support that paid services provide.

For most people, starting with free monitoring makes sense. You can always upgrade later if your threat profile warrants it.

A VPN is great at hiding where you are and what your internet provider sees. However, when you’re chatting with ChatGPT or Claude, your privacy depends on something far more complicated than a tunnel through the internet.

Even the best VPNs won’t stop AI companies from reading, storing, and learning from everything you type. In this article, we’ll unpack exactly what data these platforms see, why encryption has limits, and what you can actually do to protect yourself.

This article is the second in a series of content relating to Cybersecurity Awareness Month 2026, which runs throughout October. The first article covered the benefits of dedicated antivirus over packaged solutions.

What chatbots see (and what a VPN actually hides)

Without a VPN, OpenAI (ChatGPT) and Anthropic (Claude) can typically see a lot about your connection. Your IP address reveals your approximate geographic location. Device metadata follows alongside that, including your browser type, operating system, and unique device identifiers.

According to OpenAI’s privacy policy, the company collects your IP address; device information, including unique identifiers; cookie data; and your location, along with your email address and payment information.

Anthropic does the same. Their policy covers location, connection details, and device usage patterns, especially on the mobile app. Different wording, same result: both companies can see roughly where you are and what you’re using to talk to them.

A VPN helps with some of this. It successfully masks your real IP address from the AI platform and encrypts your traffic so your ISP can’t see that you’re using AI services. However, this is where the protection stops. Once your encrypted tunnel ends at the VPN server, the AI company still sees everything that arrives at their doorstep.

The limits of encryption: What a VPN can’t hide

This is the critical part many people miss. A VPN protects your data while it travels across the internet, but that protection ends the moment your prompt arrives on OpenAI or Anthropic’s servers. Your message has to be decrypted for the AI to process it.

Once decrypted, your data sits on the AI company’s systems, governed by their policies rather than yours. A VPN does nothing to hide the content of your prompts, any files or images you upload, your account details and conversation history, or your payment information.

The encryption protects the connection between you and their servers, not what happens afterward. No matter how strong the VPN tunnel is, everything you type is fully readable on the other end.

What AIs remember and how to actually stay private

Here’s where things get tricky. Most consumer chatbots keep your conversations on file indefinitely and may use them to train future models. You have to manually adjust settings and delete chats yourself if you want them gone.

For ChatGPT specifically, OpenAI may use your content to improve services unless you opt out. You can navigate to Settings > Data Controls, then toggle off the option to improve the model for everyone. However, even with this disabled, chats may still be stored for safety and legal reasons.

Claude works similarly. Anthropic requires all consumer users to choose whether their chats can be used for training, and the toggle is on by default. If enabled, data can be retained for up to five years, compared to 30 days if you decline.

You can disable the setting anytime in your account preferences or use Incognito mode to keep conversations out of your saved history. Paid business tiers come with stricter privacy agreements by default.

The verdict and privacy-first alternatives

A VPN is a solid first step for network security in that it hides your location from AI providers and keeps your ISP from monitoring your activity. However, it won’t stop AI companies from reading, remembering, and learning from your prompts.

If privacy matters to you, adjust your settings by turning off data training in both ChatGPT and Claude, use ChatGPT’s temporary chats or Claude’s Incognito mode, and avoid sharing sensitive information.

For genuinely private AI interactions, consider Proton AG’s Lumo. Built by the team behind Proton Mail and Proton VPN, it uses zero-access encryption so only you can decrypt saved conversations, keeps no logs on their servers, and doesn’t train on your data unless you opt in. It runs on European infrastructure under GDPR and Swiss privacy laws.

One step further than this is to run open-source models offline with tools like Ollama or LM Studio, keeping everything local so nothing ever leaves your machine.

Nestled among the unusually snow-free Swiss Alps, Proton’s Geneva HQ shines in front of me on a glorious, sunny October day.

I’m here alongside journalists from the UK, France, and Germany to learn more about how the privacy-first company is creating an alternative to Google — its number one rival.

After a quick tour of the office, we make a pit-stop in the kitchen to grab a coffee before starting a long day of presentations. Some Proton staff are finishing the generous daily breakfast offered by the company, while others are perusing the lunch menu.

Proton’s Founder and CEO, Andy Yen, is the first to speak, kicking off by telling us how everything started back in May 2014 with a simple idea: building an encrypted email service. Proton VPN came next. Now, twelve years later, the company offers 11 different products, including its privacy-first AI chatbot, Lumo.

As Yen speaks, it becomes clear that Proton is no longer just focused on individual tools — it is trying to build a complete alternative to Google, OpenAI, and Silicon Valley’s model of surveillance capitalism. But can a privacy-first company really take on Big Tech across AI, web browsers, and state surveillance without stretching itself too thin?

Right before he leaves for his next meeting, I sit down with Yen to talk AI ethics, age verification, Swiss wiretapping laws, and the future of digital freedom.

The following interview has been edited for length and clarity.

What we noticed was, after opening it up — first to the first thousand users or so, really to the people who worked at CERN — people kind of caught on: "Okay, well, this is interesting." So, apparently it's not just me who wants this; there's a bigger demand for this.

The turning point was probably in May of 2014. On the first day, 10,000 people joined us. Same thing on the second day as well. And then on the third day, the server crashed, which is not a great start. But that was probably the moment when I began to realize this is a broader societal issue.

It's not just a couple of crazy privacy types that want this. There's a bigger segment of our society that really does care, doesn't like the way the internet is going and evolving, and there is real demand for an alternative.

So, Proton was really created to provide that alternative. We actually provide many of the same services that Big Tech does, obviously with a completely different business model and a completely different set of values.

So, it's not going to be for everybody, but I do think for most people that is probably the correct approach.

We will do our part: having everything open source, providing additional security, having the controlling shareholder be a foundation as another layer of security, and relying on our long track record.

We've been around for more than 10 years, and doing the exact same thing for 10 years is uncommon in tech. The last factor that makes us different is that even if you look purely at financial incentives, we're non-profit-owned, so it's not a financially driven business. But even from a pure financial standpoint, it doesn't make sense for us to do anything different from what we're saying because the only reason people pay us is our privacy.

The instant we compromise that value, we lose everything. Financially, our incentives are actually aligned with our users, and that is probably the strongest guarantee — along with encryption and mathematical guarantees — that Proton will stay true to its mission in the long run. It's a combination of all these factors together that you don't find elsewhere in the business space.

NEW: Leave No Trace — A weekly newsletter on digital privacy and online surveillance.

Leave No Trace investigates the companies and governments putting our digital freedom at risk — and the people fighting back.

📩 Subscribe now to get every edition delivered to your inbox every Friday, launching this September.

In the future, other chatbots will suggest things to buy based on ad networks, which might not be the best answer for you. A chatbot that suggests unbiased results is inherently better.

So, I think in the long run, it's not that we have more limitations. We have more freedom to build products without limitations that better serve what customers actually want.

Chances are that your VPN does more than just encrypt your traffic. An increasing number of providers now bundle malware detection, malicious link checkers, and ad blockers into their packages.

This recent trend raises an interesting question: Are a VPN’s built-in security tools enough to replace standalone antivirus products? Or do we still need dedicated antivirus protection layered underneath our VPN?

This article is the first in a series of content relating to Cybersecurity Awareness Month 2026, which runs throughout October.

VPN security tools

Modern VPNs have evolved far beyond simple tunneling tools. The best VPNs like NordVPN and Surfshark now include real-time malware protection that checks URLs against malicious databases and scans files during downloads.

In 2024, NordVPN became the first VPN to earn certification as a reliable anti-phishing tool. Its Threat Protection feature blocks websites, web trackers, and ads while scanning downloads on the spot.

Surfshark takes this further with Surfshark One. It offers real-time protection from viruses and malware, with scheduled scans as part of regular security maintenance.

That said, VPN-based solutions often skip features common in standalone antivirus such as full system scans and behavioral threat analysis.

Here’s where it gets interesting: some VPNs’ antivirus tools are essentially rebadged versions of the same underlying technology. Surfshark’s antivirus is directly powered by Avira’s anti-malware SDK, while CyberGhost Security Suite uses Intego’s frontend – which, for Windows, relies on Avira’s engine and definitions.

This shared infrastructure means they depend on the same detection databases. When Avira pushes an update, VPN partners may take time to integrate it, creating potential gaps in protection compared to native Avira users.

Beyond timing delays, platform support can be inconsistent. Some VPN antivirus features only work on Windows and Android, leaving macOS and iOS users with partial coverage. For threat actors targeting Apple devices specifically, this gap becomes exploitable.

OS-level protection

Having evolved significantly since the days of basic protection, built-in security deserves more credit. Microsoft Defender, once considered a bare-minimum option by many, has improved considerably.

In AV-Comparatives’ July-August 2026 real-world protection test, Defender blocked 95.5% of live threats with just one false positive recorded.

What stands out is its consistency. Across multiple testing rounds, Defender has consistently earned Advanced+ awards and solid protection scores that often rival paid solutions, including Bitdefender and Sophos.

Critically, it recorded fewer false positives than many commercial competitors – meaning fewer instances of legitimate files being incorrectly flagged as threats.

Apple’s approach is equally sophisticated, deploying a trio of defenses rather than traditional signature-based scanning. Gatekeeper verifies authenticity, Notarization scans for known malware before distribution, and XProtect handles background detection with automatic updates. XProtect Remediator, added in recent macOS versions, periodically scans for active infections that slip through.

Between these systems, Apple prevents a substantial share of opportunistic attacks, though zero-day threats remain a vulnerability.

The free options and when to pay

If you prefer not to pay for antivirus software, Avast Free Antivirus remains a solid baseline. In recent testing from AV-Comparatives, it was one of only three products out of 20 tested to achieve a 100% block rate.

Free tiers typically come with trade-offs such as limited cross-platform coverage and reduced toolsets. For casual browsing, these rarely matter, but for managing sensitive files across multiple devices, they start to add up.

However, the value proposition shifts with paid suites. Norton 360 Deluxe and Bitdefender Total Security offer numerous valuable extras beyond antivirus protection that justify their cost for many users.

Features include password managers, cloud backup, parental controls, and identity monitoring. Having all these utilities in one package means less to juggle, and often works out cheaper than buying each tool separately.

The Verdict

Rather than choosing between them, a combination works best. A VPN, free antivirus, and built-in OS-level security creates a solid protection foundation. Relying on any single layer leaves gaps.

A VPN alone won’t catch malware already on your device or protect offline activity. Free antivirus lacks the behavioral analysis and premium support of paid suites. OS-level security can’t stop every zero-day exploit or advanced persistent threat.

That said, for the average user practicing sensible browsing habits, this layered approach provides adequate protection for everyday use. If you manage sensitive data, handle financial transactions regularly, or use older hardware that might delay security updates, investing in a premium suite adds meaningful insurance.

Practically speaking, most users can stay secure without overspending. The key is to stay sharp by keeping software updated and avoiding clicking on unexpected pop-ups or unsolicited links without thinking twice.

• Budget doubled: Russia will spend $235m on internet blocking in 2027.
• There are plans to charge users a fee for international 5G internet traffic.
• A new legislative package aims to penalize domestic VPN hosting providers.

Russia has unveiled aggressive plans to double its spending on internet blocking infrastructure in 2027, signalling a massive escalation in its ongoing war against VPNs.

According to recent budget drafts uncovered by Russian independent media, the government intends to allocate nearly 20 billion rubles (approx. $235m) to its automated internet filtering system in 2027. In total, censorship spending is expected to reach an unprecedented 60 billion rubles over the next three years.

For everyday Russian citizens relying on VPN services to bypass state propaganda and access international news, the digital walls are rapidly closing in. Not only is the state upgrading its capacity to block traffic, but it is also exploring new ways to financially penalize users who attempt to tunnel out of the domestic internet.

This development follows a recent wave of disruptions where Russia escalated VPN blocks following State Duma elections in a major censorship crackdown.

A multi-billion ruble censorship machine

The Russian government’s internet censorship relies on the "Automated System for Ensuring the Security of the Internet" (ASBI).

This system controls specialized hardware known as TSPU (technical means of countering threats), which Internet Service Providers are legally required to install.

These devices filter network traffic, allowing the state to throttle or block unauthorized websites and VPN protocols.

Originally, the state planned to spend 9.87 billion rubles (approx $115m) on ASBI in 2027. However, the new budget proposal revealed by Verstka and corroborated by The Moscow Times shows a massive increase to 19.87 billion rubles. Overall funding for the federal censor, Roskomnadzor, will grow by 60% in 2027.

This cash injection is designed to vastly expand the system's capacity. Roskomnadzor has been tasked with reaching a 92% efficiency rate in blocking VPNs by 2030, increasing ASBI's throughput by 2.5 times to handle 954 Tbit/s of data.

NEW: Leave No Trace — A weekly newsletter on digital privacy and online surveillance.

Leave No Trace investigates the companies and governments putting our digital freedom at risk — and the people fighting back.

📩 Subscribe now to get every edition delivered to your inbox every Friday, launching this September.

Traffic fees and server crackdowns

Alongside hardware upgrades, the Ministry of Digital Development is exploring financial deterrents. Kommersant reports that the government is discussing a new fee for users who consume more than 50GB of international traffic on 5G networks.

While telecom operators currently lack the technical capability to separate 5G and LTE international traffic in real-time, the intent is clear: to penalize users who constantly route their traffic outside the country via VPNs.

Simultaneously, a new legislative package dubbed "Anti-Fraud 3.0" aims to severely punish domestic infrastructure providers.

Under these rules, Russian hosting providers will be banned for a year from offering services to individuals who host VPNs or proxies if those services land on a Roskomnadzor registry.

Hosters will be forced to strictly identify their clients and verify the intended use of their physical and virtual servers.

What this means for VPN users in Russia

The situation for Russian internet users is becoming increasingly hostile.

As the Kremlin's war on the global web turned VPNs into Russia's new national utility, authorities have pivoted from simple IP bans to sophisticated Deep Packet Inspection (DPI) techniques.

Over 250 VPN services have already been blocked, echoing earlier campaigns that saw the largest in history, with Russia blocking over 20 popular VPNs in a major internet crackdown.

According to experts, internet providers now have the statistical data needed to precisely throttle VPN performance.

"Operators have accumulated enough statistics to move from total blocks to targeted suffocation of quality," noted Sergei Shcherbakov, technical director at Stakhanovets, highlighting the shift toward making VPNs unbearably slow rather than just outright banned.

Sarkis Darbinyan, expert at RKS Global and VPN Guild, told TechRadar that VPN operators are not standing still either.

"They are upgrading their protocols, adopting new traffic obfuscation methods, building alternative apps, and using many other guerrilla tactics," he said.

"None of this, however, guarantees that any given public VPN will remain accessible from Russia. For the end user, the result is a deteriorating VPN experience and an ever-shrinking number of services that actually work."

For now, Russian citizens continue to play a high-stakes game of cat-and-mouse, relying on advanced obfuscation protocols to bypass an increasingly well-funded digital iron curtain.

It’s 4 pm on an unusually warm first day of October as a small crowd begins forming outside the Bristol Royal Infirmary, the south-west UK city’s central hospital. Outpatients arriving for appointments begin to take notice as the demonstration against US company Palantir’s involvement with the UK’s health service starts to take shape.

Placards are raised: “No Palantir in our NHS”, “Ditch Palantir”, “Good at harvesting your NHS data”. The passing traffic starts beeping its support.

Bristol is one of the 45 locations across over 30 cities around the UK where people are taking to the streets on October 1, 2026. The biggest action rolls out in front of Palantir’s London offices, with hundreds there to protest. Here, the number is closer to a vocal 50 or so.

Former and current health workers, campaigners from Amnesty International, the Good Law Project and more, and concerned citizens have all joined the International Day against Palantir to ask the British government to stop paying a US firm to manage UK citizen health data.

Headquartered in Miami, Palantir Technologies is an analytics firm specialising in AI-powered tools designed to manage large datasets. Its flagship software platforms, Gotham and Foundry, are widely used by government organizations and businesses globally to uncover data patterns and support decision-making operations.

The promise of its products certainly makes sense. Its list of clients, however, is what today’s demonstrators find less than palatable.

Among its most controversial partners is the US Immigration and Customs Enforcement, better known as ICE, which has been using Palantir tech for over a decade. More recently, the Israeli military has also begun using its powerful software to assist with on-the-ground operations.

It was in 2023 that Palantir managed to secure a £330 million contract within the UK public health sector. The then-Prime Minister, Rishi Sunak, tasked the American company with building a new platform to manage all UK citizen health data across the country in what was called the NHS Federated Data Platform (FDP).

Three years and two Prime Ministers later, the project is under increasing scrutiny, with some suggestions from insiders that many of the hospitals that have been signed up to Palantir are still yet to even log into the system.

With more than one reason for protester complaint on the table, TechRadar went along to the Bristol arm of the International Day of Action to find out what it was that the demonstrators cared about the most — their data, their finances or their politics?

Palantir’s NHS Federated Data Platform (FDP): the privacy concerns

A national programme led by NHS England, the Federated Data Platform (FDP) is designed to help NHS organisations bring together information from hundreds of different databases in a single platform. The goal is undoubtedly attractive: improve efficiency by supporting health worker delivery of patient care, improving operational performance, and assisting staff to make better-informed decisions.

According to the NHS security and privacy page, “the protection of people’s data is at the heart” of FDP’s design, with measures like strong network security, purpose-based access to data, and encryption all in place. It certainly sounds well conceived and considered.

Furthermore, under the terms of the contract with the NHS, Palantir Technologies is named strictly as a "data processor". That means it cannot decide how the information that its software processes is used. In other words, Palantir could face direct liability should it fail to secure this data or violate NHS instructions.

A Palantir spokesperson explained to TechRadar that FDP is a software that helps the NHS better manage the data it already holds. “How that software is used is controlled by the NHS Trusts who use it, with data — legally and contractually — only able to be processed strictly in accordance with their instructions, and all data remaining in the UK,” they added.

Despite these rules of engagement, all of the protesters expressed their lack of trust in Palantir when it came to handling their most sensitive data. They were not convinced that Palantir was not able to access their information at will.

“We simply cannot believe this won’t happen,” one protester told us.

These concerns do not exist in a vacuum. In May, the Financial Times reported on an internal NHS briefing note which explicitly earmarked "unlimited access" to identifiable patient data for certain contractor admin roles.

Most protesters also expressed their fear that Palantir’s NHS system could also be repurposed one day for wider surveillance across different government bodies, such as immigration.

Matt, a health worker and campaigner in Bristol, told TechRadar that there’s both an emotional and technical component to his worries about Palantir.

“All Palantir software is interoperable with each other. So, the data that is collected under the FDP can be dragged and dropped to their policing software if a government chose to do that,” he said.

Matt refers to what came out of a January investigation by The Nerve that found 34 active contracts across at least 10 UK government departments, as well as local councils and police authorities. A scenario that, according to opponents, could make it technically easier for a cross-pollination of healthcare data and law enforcement work to occur.

Again, these fears aren’t entirely unfounded. While Palantir’s UK CEO, Louis Mosley, insists that Palantir has “no interest” in UK patient data, the company’s track record outside the country seems to tell a different story.

404Media revealed that, in the US, citizen health data is fed to a Palantir-developed app called ELITE, which is used by ICE agents to map and target suspected illegal immigrants.

Small wonder, then, why Matt and others outside the Bristol Royal Infirmary are expressing their concerns.

Is Palantir’s technology worth the risk?

Make no mistake, though. This was mostly a protest of politics rather than privacy. Most people at the rally were here to object to Palantir's deal with the NHS based on the company’s involvement in ongoing global conflicts and immigration raids.

Either way, though, as the Head of Tech and Data at Good Law Project (one of the campaigns behind the UK actions), Duncan McCann, told TechRadar, procurement decisions based on ethics and morals are rare, whatever field of concern they lie in. The hard facts of cost and utility most usually win the day.

And it's because of this, McCann explains, that the tide is turning against the US firm.

“When we started working on this campaign a year ago, all the momentum was with Palantir. They were getting new contracts all the time. The assumption was that this contract was just going to get renewed. It wasn't even really a question. Now, when I look around, I see them losing contracts,” said McCann, mentioning the Homes for Ukraine as the most telling example.

And, for McCann, the reason for Palantir’s decline is simpler than the politics. Its technology isn’t just more expensive — Ukraine said the government saved millions by replacing Palantir’s software — but it seems to be actually failing in its goal of making the NHS more efficient.

NEW: Leave No Trace — A weekly newsletter on digital privacy and online surveillance.

Leave No Trace investigates the companies and governments putting our digital freedom at risk — and the people fighting back.

📩 Subscribe now to get every edition delivered to your inbox every Friday, launching this September.

While the UK government claims to have already seen significant improvements in its data management flow, there have been multiple reports alleging that the FDP software is not delivering on that promise.

A report by Democracy for Sale, for example, says that staff have found that Palantir's newly built platform is 10 times slower than the existing system, citing an internal NHS document.

Palantir has strongly rejected these allegations, however. In a statement to Democracy for Sale, the US firm argued that "comparing the two systems is not like-for-like", adding that its platform "introduces guardrails to improve data correctness, enforce purpose-based access and allow more controlled data sharing".

Approached by TechRadar, a Palantir spokesperson said:

“Palantir software is helping to deliver better care, with Trusts using it recording 117,000 additional operations, a 14.3 per cent reduction in discharge delays for long stay patients and a 5.6 per cent improvement in the number of people finding out whether or not they have cancer within 28 days.”

Impressive-sounding stats, but back in June 2026, the Financial Times reported that England’s health service acknowledged that its main claims about the benefits of the FDP aren’t backed up by robust evidence, with MPs now calling for a new audit.

The jury, it seems, is still out on the Palantir systems’ efficacy, leaving the company’s reputation a peg or two lower than where it stood when the 2023 UK government originally signed the deal.

How likely is it for Burnham to scrap the deal?

As the deadline to renew the deal approaches, campaigners feel that now is their best shot at making the government listen to their concerns. Indeed, this may be more likely than some people realise, given the new Prime Minister’s position on digital policy.

During Andy Burnham’s almost decade as Mayor of Greater Manchester, neither municipal nor public health departments awarded any contracts to Palantir. Instead, Manchester’s NHS leaders spent six years building their own analytics infrastructure.

For campaigners against Palantir’s involvement in the NHS, then, scrapping the deal could be a good fit for Burnham’s political agenda.

"It proves that we can do it ourselves and save money by doing that, while creating new jobs,” McCann from the Good Law Project told TechRadar.

What’s certain is that the new Prime Minister is under increasing political pressure to act.

During this week's Labour Party conference, 20,000 party members backed a motion to cancel the contract with the US firm. Although the motion was not chosen for debate, the number of signatories still signals the discontent among the political rows.

A great majority of Labour voters (76%) also believe Palantir’s contract should not be renewed when it expires in February 2027. That echoes the views of the Science, Innovation and Technology Committee that, in June, urged the government to exercise the 2027 break clause and “either develop an in-house replacement or seek an alternative UK provider”.

That said, as Wired reported, there are plenty of politicians and advisers close to Burnham who are also quietly advocating for the company’s work in the UK. The recent announcement that former Labour Deputy Leader, Tom Watson, is joining Palantir as senior vice president perfectly paints the rifts within the governing Party.

For the people filling the streets, however, it isn’t negotiable. Ultimately, as health worker and campaigner Matt points out, the change could, and should, start locally.

"Here, in Bristol," he says, "we're really trying to build up the pressure and give the message that NHS Trusts actually do have the right to refuse to use the software. We really want them to take a strong stance on that."

What are the Palantir protesters asking for

By Wednesday, September 30, the day before the demonstrations, 44,000 people had filed legal objections to their health data being shared with, stored in, or used by the FDP system operated using the US company’s AI technology. Thousands of people have also signed petitions to ask to scrap the £330 million deal in the past months.

Currently, patients cannot opt out of having their sensitive healthcare data stored on the FDP, despite a 2023 YouGov poll finding that nearly half of all UK adults would likely opt out of data sharing if a private company like Palantir began processing their personal information.

“I think when people are aware of it, they're very concerned,” health worker Matt told TechRadar, pointing out the number of people turning up to the rally. “It really shows the strength of the public feeling about this.”

The erosion of trust in the NHS was a recurrent topic when we spoke to those opposing Palantir in Bristol. Many told TechRadar that they would opt out if they could.

And while people admitted that a better system to manage health data may be needed, they didn’t feel that Palantir should be the answer.

“We do need platforms that can speak to each other, but we need ones that we can trust,” another protester told us.

Most people said that they would feel more comfortable if a UK company managed their data instead. They said a domestic firm would be easier to oversee and hold to account.

Economics was also a big concern.

"Why can't these jobs be kept in Britain for British companies to run these systems? Why do we need to have a foreign company coming in and have dangerous motives to actually do this work? It's not necessary," another protester told us.

As we left the rally, the placards still waiving in the distance and the hospital entrance regaining its usual look, it was that word 'trust' that echoed in our mind.

It's almost impossible to separate the issues of data privacy from global politics, when it comes to Palantir. It's tangled up in every line of code.

Demonstrators in Bristol weren't rallying around a single, isolated grievance. They were there to resist a model where healthcare, data, and defense contracts bleed into one another.

At its very core, the entire issue around people’s health data privacy hinges on public trust.

Whether driven by fear of corporate overreach, frustration at the use of government funds, or deeper ethical objections, the battle over Palantir goes beyond digital security – the public is demanding assurances about who holds their most sensitive information.

And, for those taking to the streets today, the US tech giant had failed to earn their trust.

• La Liga has asked the European Commission to add four major VPNs to the EU’s Counterfeit and Piracy Watch List
• The request targets NordVPN, ExpressVPN, Surfshark, Proton VPN
• La Liga claims third-party affiliate marketing promotes the circumvention of court-ordered blocks

La Liga's war against illegal streaming has escalated once again, with the Spanish football league formally asking the European Commission to place four of the world's most popular VPN providers on an official piracy watch list.

As first reported by TorrentFreak, in a 14-page submission to the EU regarding the upcoming 2027 Counterfeit and Piracy Watch List, La Liga took aim at NordVPN, Proton VPN, ExpressVPN, and Surfshark. The league argues that these providers are benefiting from third-party affiliate marketing guides that actively instruct users on how to bypass geo-blocking restrictions to stream live matches.

While La Liga stresses that it does not take issue with VPN technology itself, the sporting giant believes that this type of third-party promotion strips the tools of their status as neutral technical intermediaries. If La Liga succeeds, everyday users relying on the best VPN to protect their online privacy could face an uncertain regulatory landscape in Europe.

TechRadar has reached out to NordVPN, Surfshark, Proton VPN, and ExpressVPN for comment on La Liga's latest allegations and will update this article with their responses.

NEW: Leave No Trace — A weekly newsletter on digital privacy and online surveillance.

Leave No Trace investigates the companies and governments putting our digital freedom at risk — and the people fighting back.

📩 Subscribe now to get every edition delivered to your inbox every Friday, launching this September.

A growing battleground for VPN users

The submission explicitly targets tutorials published by publishers and influencers who earn a commission from VPN sales.

According to La Liga, these online guides explain how to connect to foreign servers to access free or discounted football broadcasts. While not inherently tied to illegal pirate streams, La Liga argues this practice harms the territorial exclusivity of its expensive broadcast licensing deals.

The football league's request also points the finger at affiliate pages that explicitly name known pirate streaming platforms, allegedly showing users how to bypass court-ordered blockades.

"This request is based not on the provision of VPN services as such, but on the commercial exploitation and active promotion of their ability to circumvent court-ordered blocking measures," La Liga’s document reads.

LaLiga’s chaotic history with VPNs in Spain

This latest push to involve the European Commission is just the newest chapter in LaLiga’s aggressive anti-piracy crusade, which has already caused widespread disruption.

Earlier this year, LaLiga's sweeping anti-piracy efforts led to over 500,000 websites being wrongly blocked in Spain, breaking parts of the internet and causing chaos for users relying on legitimate online services. The league has also found itself increasingly in conflict with major tech infrastructure providers like Cloudflare.

In February, a Spanish court issued an ex parte order requiring NordVPN and Proton VPN to block illegal football streams in Spain. The court controversially concluded that the providers actively advertised their ability to bypass geo-restrictions. However, both VPN firms quickly fired back, stating that they had never even been formally notified of the legal action.

The situation took another twist in May when NordVPN won a crucial legal battle over LaLiga piracy fines. The court ultimately refused to issue fines for non-compliance, accepting that the targeted IP addresses of pirate streams changed too frequently to enforce a permanent block.

With a recent EU study proposing 30-minute takedowns of illegal streams across DNS resolvers and VPNs, the pressure on privacy tools is steadily mounting.

As La Liga expands its fight to the broader European stage, the foundational right to internet privacy and secure browsing could become the ultimate casualty.

• The DEFEND IP Act is a new bicameral site-blocking bill targeting ISPs, DNS
• The bill explicitly exempts VPNs from carrying out blocking orders
• It allows copyright holders to seek court orders to block foreign platforms

Last week, privacy advocates raised alarms about a US bill that could force virtual private networks to act as piracy blocklists. Now, a newly introduced competing proposal has taken a decidedly different approach — leaving the best VPN providers completely off the hook.

Senator Thom Tillis and Representative Zoe Lofgren have jointly introduced the DEFEND IP Act (Deterring Extraterritorial Foreign Exploitation of Networks Damaging Intellectual Property). The bicameral bill merges two previous legislative drafts into a single proposal aimed at giving copyright holders the power to compel intermediaries to block foreign pirate sites.

However, Representative Darrell Issa's competing American Copyright Protection Act (ACPA) included VPNs in its scope. According to an analysis by TorrentFreak, the newly introduced DEFEND IP Act explicitly leaves them out.

NEW: Leave No Trace — A weekly newsletter on digital privacy and online surveillance.

Leave No Trace investigates the companies and governments putting our digital freedom at risk — and the people fighting back.

📩 Subscribe now to get every edition delivered to your inbox every Friday, launching this September.

How the DEFEND IP Act spares VPNs

Under the DEFEND IP Act, court-ordered blocking would apply to broadband providers with at least 50,000 subscribers and public DNS resolvers generating over $100 million in annual revenue. This high financial threshold easily captures tech giants like Google and Cloudflare.

Yet, the proposed legislation specifically carves out an exemption for virtual private network (VPN) tools. The bill's text excludes "an entity that exclusively provides virtual private network services or similar service [sic] that encrypt and route user traffic through intermediary servers."

While the word "exclusively" leaves some room for interpretation when it comes to cybersecurity companies that bundle their VPNs with other features like antivirus software, the legislative intent to shield core VPN operations is clear.

If passed, the DEFEND IP Act would establish a two-step legal process. First, a federal court must formally classify a website as a "foreign digital piracy site." To qualify, the platform must be primarily designed for copyright infringement or intentionally marketed as a piracy destination.

Once designated, rightsholders can return to a judge to request a formal blocking order. The court would then determine if the block is "technically feasible and effective." These blocking orders would remain valid for a year, can be renewed, and apply directly to live streaming events, meaning a rogue sports broadcasting site could be blocked before a match even starts.

Digital rights advocates push back

Despite the explicit VPN exemption, digital rights groups remain staunchly opposed to the broader concept of site-blocking. Public Knowledge, an advocacy group that also opposes the competing ACPA bill, has strongly criticized the DEFEND IP Act.

"For the second time in as many weeks, rightsholders have convinced Congress to build out an expansive infrastructure for censorship rather than go after the root of the problem: operators of overseas piracy websites," Public Knowledge wrote in response to the proposal.

The group also warned of the technical consequences of the bill's DNS scope, adding: "Let us repeat: Applying blocking orders to global DNS resolvers causes global blocks."

With the current congressional term ending in January, time is running out for either proposal to become law. Both Representative Issa and Senator Tillis are leaving Congress at the end of the term, meaning neither will be around to reintroduce their respective bills next year.

For now, however, privacy-conscious internet users can breathe a sigh of relief knowing that their VPNs are excluded from this latest legislative push.

• At least 10 VPN services reported severe network restrictions, IP blocking
• This new wave of blocking follows Russia's recent parliamentary elections
• About 57 million Russians are estimated to rely on circumvention tools

Russian authorities have launched a renewed and aggressive assault on virtual private networks following the country's recent State Duma elections. Within the span of a single week, at least ten VPN providers reported significantly tighter network restrictions, leaving users scrambling to maintain access to the open web.

According to reports cited by the independent outlet Meduza, multiple providers have faced severe service disruptions. One service noted its team had to swap out eight servers in just five days, while two others saw all of their international server locations and IP addresses outright blocked by the state communications watchdog, Roskomnadzor.

Despite the abrupt spike in outages, industry experts suggest the clampdown was anticipated. Alexey Kozlyuk, chairman of the VPN Guild, noted that while the restrictions are severe, the organization doesn't consider the election-timed blocks a "fundamentally new wave."

"From what we've seen, the pressure began to mount back in early August. We see what's happening now as a continuation and gradual intensification of that campaign," Kozlyuk said to Meduza.

TechRadar has reached out to Amnezia VPN and digital rights experts at RKS Global for further comment on the current outages.

A spokeswoman for Amnezia VPN also told TechRadar that these new blocks aren't surprising. "In Russia, VPNs face pressure almost every month; it is a new norm," they said.

This latest wave of blocking hasn't affected Amnezia, though. "Following the events in June, we rebuilt our server infrastructure and updated our protocol to be more resilient against censorship," the company told TechRadar.

NEW: Leave No Trace — A weekly newsletter on digital privacy and online surveillance.

Leave No Trace investigates the companies and governments putting our digital freedom at risk — and the people fighting back.

📩 Subscribe now to get every edition delivered to your inbox every Friday, launching this September.

A coordinated assault on internet freedom

The post-election throttling is just the latest phase in a long-running technical war against privacy tools. A report by Human Rights Watch (HRW) details how the state has pivoted from granular, targeted blocks to sweeping infrastructure attacks designed to break the fundamental architecture of circumvention software.

"The Russian government's escalating attacks on censorship circumvention services is part of its broader assault on access to information, privacy, and freedom of expression," said Hugh Williamson, Europe and Central Asia director at Human Rights Watch.

Tactics include the bulk blocking of entire IP subnets, targeted phishing campaigns against provider employees, and distributed denial of service (DDoS) attacks.

In June, a coordinated assault crippled the popular provider Amnezia VPN, taking the company six weeks to fully restore its network. Following that devastating state-sponsored cyberattack, Amnezia VPN restored premium service in Russia and subsequently improved its anti-censorship protocols as Russia escalated its anti-VPN regime.

The state also appears to be increasingly weaponizing domestic tech. Earlier this year, authorities directed major Russian internet companies to quietly log their users' VPN connections. A study by RKS Global confirmed that at least 30 domestic apps gathered these IP addresses, which were then fed back into the state's censorship apparatus to help execute the largest block of over 20 popular VPNs in history.

The stakes for digital privacy are incredibly high. The Kremlin's war on the global web turned VPNs into Russia's new national utility, with an estimated 57 million people, roughly 40% of the country's population, now using them to reach independent news and blocked platforms like Instagram and YouTube.

As Russia's battle against VPNs is entering a new phase, authorities are simultaneously pressuring Apple and Google to remove circumvention tools directly from their respective app stores.

HRW reports that Apple removed 1,213 applications in response to Russian government requests in 2025, while Google faced a 22.8 million ruble fine in February 2026 for failing to scrub VPNs from its Play Store. Several popular clients were removed from Apple's platform in March after Roskomnadzor claimed the apps “included content that is illegal in Russia.”

With the government cutting off mobile payment gateways and aggressively squeezing tech giants, users face a growing technical arms race to detect, block, and evade Russia's VPN crackdown.

• Proton found most Android free games send data to foreign ad-tech
• In the US alone, games sharing data with China were downloaded 15.8 million times in a single month
• Experts advise using a VPN with built-in tracker blocking, or paying for ad-free games to protect your privacy

Right now, there is a good chance you have a free game on your phone. It costs nothing to download, and it seems harmless enough, apart from the occasional intrusive ad. However, a new study reveals that your data is likely paying the hidden price.

Secure email and VPN service provider Proton has warned that the most popular free mobile games are infested with data trackers.

By analyzing the top 100 free-to-play Android games on the Google Play Store — which have collectively been downloaded almost 20 billion times worldwide — Proton found that the vast majority send gamers' personal data abroad. Much of this data goes to ad-tech companies headquartered in China, Russia, Israel, and Five Eyes nations.

According to Proton, this "paints a disturbing picture of an industry that routinely includes trackers sending large amounts of highly personal data to countries hostile to privacy, with minimal transparency and no meaningful accountability."

These aren't niche rogue apps, either. The list includes household names like Block Blast!, Disney Solitaire, and Subway Surfers. While game developers obscure exactly what data is collected, these trackers are capable of harvesting your device type, usage habits, payment information, age, gender, and even your physical location.

The global scale of mobile game tracking

To understand the sheer volume of data being harvested, Proton examined the top 100 games across multiple regions for the month of May 2026. The findings are staggering.

In the US, the top 100 games were downloaded almost 20 million times in a single month. Of those, games actively sharing data with Chinese companies accounted for 15.8 million downloads, while 13.7 million downloads were found to be sharing data with Russian entities.

The UK tells a similarly bleak story. Out of 3.6 million downloads in May, 3 million contained Chinese trackers and 2.7 million contained Russian trackers.

A staggering 99% of total UK downloads included trackers funneling data back to Five Eyes entities, meaning personal information could be widely shared among allied government intelligence agencies. The research found that games in the UK contained up to a whopping 36 different trackers per app.

NEW: Leave No Trace — A weekly newsletter on digital privacy and online surveillance.

Leave No Trace investigates the companies and governments putting our digital freedom at risk — and the people fighting back.

📩 Subscribe now to get every edition delivered to your inbox every Friday, launching this September.

Why location tracking matters

Of all the information hoovered up by ad-tech companies, location tracking remains the most alarming. In the US, games containing location trackers were downloaded 1.7 million times in May. In the UK, that number reached 300,000.

While games like Pokémon GO have a legitimate reason to know your GPS coordinates to function, Proton notes that simple puzzle or coloring games have absolutely no need for it.

"Location information deserves particular attention, because location data is not just data. It's a record of your life," Proton’s report warns. "It tells whoever holds it where you work and where you sleep. It records whether you attended a protest, visited a medical clinic, went to a place of worship, or met with someone you'd rather keep private."

When data is sent to ad-tech companies in countries like Russia or China, potentially adversarial governments can gain access to millions of people's personal information.

Furthermore, even if the data goes to a legitimate advertising firm, it can still be stolen. Proton highlighted a November 2025 data breach at Mixpanel, a product analytics platform used by games like Roblox, which allowed hackers to steal user-identifiable metadata.

How to stay safe

Sending personal data to data-broker networks is the foundational business model of the free-to-play ecosystem. As Proton bluntly states: "If you don't pay for a product, you are the product."

So, how can you protect yourself? If you want to keep playing without handing over your GPS coordinates to Moscow or Beijing, you need to block the tracking at the source. To defend against this invasive data harvesting, experts recommend using the best VPN services equipped with built-in ad and tracker blockers.

Tools like Proton VPN's NetShield filter DNS requests, meaning that when an app attempts to load a known tracker, the request is killed before your data can leave your device.

Alternatively, the simplest solution is to pay for your games upfront, which usually guarantees a tracker-free and ad-free experience.

• A federal judge granted a preliminary injunction against Utah's SB 73
• The move blocks the rules that strictly targeted VPN users
• The judge notes flawless geolocation tracking is technically impossible

Using the best VPN to protect your online privacy is not a loophole, and a federal judge has now formally blocked a controversial state law that treated it as one.

On September 24, U.S. District Judge David Barlow granted a preliminary injunction against Utah’s uniquely aggressive age verification law (SB 73).

The legislation targets VPN use by requiring adult platforms to identify and verify the age of users physically located in Utah, even if they were masking their traffic with a virtual private network (VPN) or similar tool. It also banned sites from providing instructions on how to use a VPN to bypass these checks.

However, the courts have firmly stepped in. In a major victory for digital rights and Aylo, the parent company of Pornhub, which originally filed the lawsuit in May, Judge Barlow blocked the law's most draconian VPN provisions. In his memorandum, the judge stated that the state's mandates are "likely to violate the United States Constitution."

The decision highlights a fundamental gap between legislation and internet infrastructure. As reported by KUER, the judge noted that "perfect geolocation" simply does not exist.

By design, a VPN encrypts your web traffic and routes it through a secure remote server, hiding your true IP address from the websites you visit. Demanding that platforms bypass this encryption to find a user's physical location is not just technically impossible for the websites to guarantee; it also raises severe privacy and free speech concerns.

NEW: Leave No Trace — A weekly newsletter on digital privacy and online surveillance.

Leave No Trace investigates the companies and governments putting our digital freedom at risk — and the people fighting back.

📩 Subscribe now to get every edition delivered to your inbox every Friday, launching this September.

Utah VPN law: What happens next?

Utah’s attempt to regulate VPNs is part of a growing trend of state-level age verification bills, but it was the first to explicitly target the tools used to preserve online anonymity.

Lawmakers in Utah argued they were simply trying to close a technological loophole that teenagers use to access restricted content. But cybersecurity experts and digital rights advocates quickly sounded the alarm. They argued that forcing platforms to effectively break or ban encrypted traffic threatens the safety of journalists, activists, and everyday citizens who rely on VPNs to protect their personal data from hackers, stalkers, and corporate tracking.

Gytis Malinauskas, Head of Legal at Surfshark, previously warned TechRadar about this legislation, noting that it treats a core cybersecurity tool as an illegitimate workaround. "VPNs are a standard security tool millions of Americans use every day to protect their data. Blocking them would only erode the privacy of ordinary users," he explained.

A spokesman for Proton told TechRadar that their company is encouraged to see the court intervene to protect VPN users by blocking the "actual location" provision of SB 73 and recognize VPNs as a critical security tool.

"Although the Utah legislature has a good intention to protect children from adult content, VPNs should not be used as a scapegoat. We hope that other states will take notice and draft their child safety bills in a targeted way that does not sacrifice user privacy and security," they added.

While this injunction temporarily pauses the enforcement of the VPN location rule, the legal battle continues in court. The broader age-verification law remains heavily contested, and Utah’s Attorney General may still appeal the decision.

For now, privacy advocates are celebrating a crucial precedent: state governments cannot arbitrarily force websites to break essential cybersecurity infrastructure. According to ID Tech Wire, the ruling sends a strong message to other states drafting similar bills, you cannot bypass the First Amendment by effectively outlawing digital privacy tools.

• Bitdefender launches privacy tool built specifically for autonomous AI agents
• Each agent task gets a disposable, temporary connection that deactivates when the task is done
• VPN for AI Agents runs on a Model Context Protocol server architecture entirely

Bitdefender has introduced VPN for AI Agents, a standalone privacy tool built specifically for the autonomous software agents now browsing, researching, and transacting on behalf of everyday users.

The company says this public beta is a direct answer to the growing anxiety over machine-driven data exposure.

Unlike a conventional privacy tool that stays connected at all times, this tool activates only when an AI agent needs it, then deactivates once the task is done.

Why agents need their own privacy layer

Cybersecurity researchers have increasingly warned that autonomous agents occupy an ambiguous identity space, often borrowing a person's own credentials or shared workload logins to complete tasks online.

Without a clear separation, every website an agent visits and every transaction it completes remains traceable back to a single household IP address.

Recent Pew Research Center data found 71% of adults in the United States believe wider AI adoption will make their personal data less secure, a fear that extends well beyond American borders.

Bitdefender's new offering, built on a Model Context Protocol server architecture, spins up a disposable digital workspace for each prompt and discards it when the task is done.

Each prompt opens its own encrypted tunnel and exits through the VPN server's IP address, so no cookies, cache, or session state carries over to the next task.

The tool covers network transport and IP masking only, leaving the actual content of a prompt exchanged directly between the user and whichever AI provider is running it.

"AI agents are quickly becoming an extension of the people who use them, showing up in both our workdays and our personal lives," said Ciprian Istrate, senior vice president of operations, Consumer Solutions Group at Bitdefender.

"That means security can no longer stop at protecting the person behind the screen; it has to extend to the agent itself acting on their behalf."

This approach treats each agent like an independent team member requiring its own security boundary rather than inheriting the user's existing protections wholesale.

Bitdefender also describes this as clean-IP browsing, useful for QA checks on pages that display different content depending on the visitor's country.

The tool supports up to four simultaneous exit locations, or eight under the recommended testing configuration.

Access remains limited during the beta period

For now, the tool works only on macOS devices, though Bitdefender has confirmed plans to expand to additional operating systems after beta testing.

The beta specifically requires macOS 13 or later and an Apple silicon processor, meaning Intel Macs are not supported.

Bitdefender recommends macOS 15, 16 GB of memory, and roughly 10 GB of free disk space for smoother testing.

Once installed, it operates automatically across several popular AI platforms, including Claude Desktop, Cursor, Codex, and OpenCode, without requiring manual configuration from the user.

Bitdefender lists several practical use cases, including letting an agent compare prices across regions or complete multi-country research in one session.

The company frames these tasks as a productivity gain too, since they would otherwise need manual, country-by-country effort from a person.

Bitdefender is explicit about the tool's limits as well. It does not protect a device's other apps or browser.

It also does not hide prompts from the AI provider running them, and does not override a site's terms of service, rate limits, or an existing IP ban.

"With Bitdefender VPN for AI Agents, we're giving students, workers, and everyday consumers the confidence to let their AI agents work freely, knowing their identity and activity stay protected," Istrate added.

VPN for AI Agents public beta is currently available for free, but whether the free offering continues after the beta testing remains to be seen.

• AmneziaVPN rolls out version 5.0.3.0 across all apps
• It brings new XRay-core, TProxy, and minor user updates
• It includes upgrades for Self-hosted and Premium users

Anti-censorship Amnezia VPN has released a new app version that improves stability, introduces an updated Xray-core, and brings updates for both self-hosted and Premium users.

The move comes after the VPN provider spent months strengthening its security measures to counter the attacks launched by Russian organisations that specifically targeted the best VPNs operating in the region.

Version 5.0.3.0 is available on all devices (version 5.0.3.1 for Android); users can download it from the Amnezia website, GitHub, and the Android and iOS app stores.

Amnezia VPN 5.0.3.0: what's new?

Rather than a major update with dramatic new features, the new version emphasises general clean-up, maintenance and connection stability.

For example, the XRay protocol, the core component of the proxy that allows users to bypass censorship, has been updated from version 1.3 to 1.4, in line with the adoption of a newer protocol system in the new version.

Additional support for the TProxy container has also been introduced. The Linux support is useful for routing traffic through the VPN at the transparent proxy level, essentially allowing Linux systems to make the traffic appear as if it originates from the user, thereby making it more difficult to block WireGuard connections.

The update also enables self-hosted users to set up a proxy for Telegram by directly going to the “Self-hosted” section to install it.

For Premium users, the VPN has also improved performance when connecting via the VLESS anti-censorship routing protocol.

Additional fixes addressed Android warning log levels, alongside self-hosted default values, links, and other minor issues that have been corrected.

In terms of user changes, the new release includes a Google Play billing library, which was added as a small feature component to handle In-App Purchases (IAP), and a new country was added to the supported dataset, overall boosting the user experience with minor tweaks.

NEW: Leave No Trace — A weekly newsletter on digital privacy and online surveillance.

Leave No Trace investigates the companies and governments putting our digital freedom at risk — and the people fighting back.

📩 Subscribe now to get every edition delivered to your inbox every Friday, launching this September.

Relentlessly updating

Amnezia's efforts to combat censorship had largely focused on previous updates, designed to strengthen its anti-detection capabilities in response to the Russian government's increasingly sophisticated Internet censorship regime.

In June, the open-source VPN said it fixed a bug in its AmneziaWG protocol that had previously left its infrastructure vulnerable to a coordinated cyberattack, allegedly carried out by Russia's media regulator, Roskomnadzor (RKN).

In August, the VPN focused again on security by updating its anti-censorship protocol, AmneziaWG, introducing greater variability in traffic patterns to increase the VPN’s invisibility against new detection methods. During the same month, the provider also strengthened its blocking capabilities with a 'mandatory update' for Premium and Free users.

The move came after a crackdown by the government blocked access to more than 20 widely used privacy services, with the scale of the attack suggesting that Roskomnadzor is continuing to boost new sophisticated ways to filter VPNs.

These governmental repressive measures are making it increasingly difficult for citizens to access the free internet. Additionally, the more repressive these attacks are, the more they seem to influence citizens' perception of VPNs as an everyday tool they need, rather than the opposite.

Indeed, research recently showed that they are developing new forms of collaboration to use VPNs, and view the associated costs as just as essential as those for mobile Internet and routine bills.

If you found someone's diary, what would you do with it? That was the question that sat in my mind as I stared at my laptop screen, slightly shocked, after uploading my ChatGPT export to Proton AI Paper Trail.

The free tool built by privacy software engineers at Proton has one job: to analyse your exported chat history from ChatGPT or Claude and show you exactly how much of yourself you have inadvertently handed over. It runs on Lumo — the company's privacy-focused LLM — which, unlike the data-harvesting mindset of Big Tech giants, claims to delete user data immediately without retaining any of it.

I braced myself for the picture I knew I had volunteered — a hypochondriac fretting over career moves, various financial details, and a person prone to brainstorming relationship issues and researching travel plans. However, the profile I received was far more detailed than I had expected. It nailed some traits of my character to a degree even my relatives probably wouldn't guess.

The Proton AI Paper Trail report has sorted me into categories. A 'Financial Background' section detailed quite sensitive information I never explicitly mentioned. A 'Health Limitations' category tracked my health changes over months, including injuries and facilities I have turned to for help.

To some relief, a 'Family' section was fabricated, reiterating that LLMs can still hallucinate. Nevertheless, the attempt was real, and would only sharpen with more data and time.

Concerningly, the report rated me 'easy' to profile. It even assigned me an 'ad value': a four-figure dollar amount, with a list of sectors that would bid for my attention.

How easy is for AI chatbots to profile you

Only a few years ago, building profiles like these would have required extensive research. Now it takes only an upload.

Unsettlingly, much of the data users inadvertently share stems from the accumulated context they build as they 'play' with chatbots.

As Eamonn Maguire, Director of Engineering at Proton, tells TechRadar: "Even when a user never disclosed certain facts directly, these can often be estimated from patterns in their interaction — approximate age, income bracket, education level, or political leanings."

Even writing style and tone work against you. They can reveal both socioeconomic profiles and psychological states, including stress levels, mood, and moments of vulnerability.

The cost? My data carried a specific (and substantial) price tag with intrinsic value that companies can profit from.

Indeed, once it leaves the platform — whether it is combined with other datasets for advertising, training, or sharing purposes beyond what is necessary for the basic functioning of large language models (LLMs) — personal data risks being permanently compromised. That leaves users with very few means of protecting it at all.

Are some chatbots worse than others?

It's fair to assume the majority of LLMs are data treasure troves. They absorb our details as we freely offer them, and it's too tempting for their owners not to profit.

Incogni’s data privacy ranking 2026 scored 13 AI platforms based on the privacy risks they pose. "It’s less a case of which is the most privacy-friendly platform but rather which is the least privacy-invasive platform," Senior Communications Manager at Incogni, Bogan Popescu, told TechRadar.

Meta AI, Gemini, and Copilot were the worst. Incogni points to sprawling privacy policies covering many products at once, making it hard to pinpoint exactly what applies to the chatbots, together with more extensive data collection or sharing practices overall.

Others, such as Mistral’s Vibe, accumulated fewer risks overall, but they still train on publicly available datasets without disclosing exactly where these come from. "They tell users very little about what information was actually included, whose data may be in there, and how it was obtained,” Popescu told TechRadar.

And while the popular ChatGPT follows Vibe as "the least privacy-invasive platform," these findings don't look so comforting in retrospect. Last week's 404Media investigation revealed that humans are actually reading users' prompts to improve OpenAI’s models.

These firms were contacted but have not responded to our requests for comment on their privacy policies.

NEW: Leave No Trace — A weekly newsletter on digital privacy and online surveillance.

Leave No Trace investigates the companies and governments putting our digital freedom at risk — and the people fighting back.

📩 Subscribe now to get every edition delivered to your inbox every Friday, launching this September.

Do people using AI chatbots even know?

What’s painful is that, rather than LLM providers 'harvesting' data, their users are voluntarily sacrificing their privacy.

As DuckDuckGo’s Senior Vice President, Zac Pappis, told me: "Many companies have given the impression that they should be using AI for everything."

Combine that context with a conversational voice and veneer of expertise, and people assume a level of safety and anonymity that most AI chatbots just don’t offer.

That's exactly what DuckDuckGo's recent report unveils, in fact. A survey conducted on nearly 2,000 American adults found that more than a third of AI users have shared information that they kept from close friends, parents, or medical professionals.

Worse still, over half of those surveyed didn’t know or were unsure whether their chatbot conversations had been used for training. "For most companies, it's to their benefit that people don't realise where their data is going," Pappis stresses.

Why deleting your AI chats isn't enough

Deleting everything might be your first instinct now, but will this solve the problem? Not quite. A clear front-end is just that — a clear facade.

Copies persist in places deletion doesn't reach — backup logs and disaster-recovery systems that can hold data for months, server logs recording interactions, third-party processors like cloud or moderation infrastructure, and most consequentially, derived artifacts.

"The last one matters the most," Maguire from Proton told me. If a conversation has already contributed to trained models, embeddings, or aggregated analysis before deletion, removing the conversation afterwards doesn't undo what the model has already learned about you.

Deletion itself might not even be immediate, as many providers retain data post-deletion for abuse investigation, legal compliance, or simply operational lag.

Opting out of conversation training doesn't solve this problem either. Platform settings might retain conversations, uploaded files, account information, and usage patterns for extended periods regardless.

Platforms often use your data for purposes beyond improving models, including targeted advertising — which ChatGPT has recently introduced. "So there is an important distinction between 'my conversations aren’t being used to train the model' and 'the service isn’t retaining or processing my data'," Maguire explains.

Furthermore, Incogni research found that no platform currently enables users to remove data once already used for model training, making opt-outs prospective rather than retroactive. "Make no mistake: your deepest secrets are being actively used to train the platform to respond to someone else's closely similar query tomorrow," Popescu says.

In fact, opt-outs can create a dangerous illusion of control. Disabling training only shields the text inside the chat window, while background data harvesting continues regardless.

How to use AI chatbots more privately

Most experts share similar advice for LLM users, and it starts with a constraint.

"Think about the cumulative effect of conversations rather than treating every prompt as an isolated interaction, and assume anything you type could potentially be seen by others," Maguire from Proton says.

Popescu at Incogni agrees. "Every month, we see how malicious agents — whether human or AI — could still hijack the conversation. In practice, that means you should assume anything you write could be seen by someone other than you."

Also, while reviewing privacy policies and data controls to understand Big Tech's information collection and use is important, switching to AI services designed with stronger privacy protections might simply be safer.

Proton’s Lumo, for instance, claims to keep no conversation logs after processing, use zero-access encryption for saved chat histories, and not train on conversations.

The open-source xPrivo is another privacy-first chatbot which promises that it doesn't train with user chats, while Internxt is also clear that all chats are stored locally on your device.

These tools, and similar ones, can be excellent allies in safeguarding digital privacy, and we expect their popularity to only grow over time.

If you are sticking with the major players, though, at least favour the browsers over mobile apps, as apps often require more device data and share it with third parties, stresses Popescu.

His ask for the future of regulations is simple, and while it probably won’t happen anytime soon, we hold out hope for it, too — a verifiable 'Right to be forgotten' as standard.

No one wants their diary read. Our new digital journals should be no different.

• Windscribe, NordVPN, ExpressVPN are among the tech leaders demanding urgent changes to Canada's Bill C-22
• The proposed legislation could force digital service providers to weaken encryption and store sensitive user metadata
• Major privacy providers warn they will abandon Canada if the surveillance law passes

Canada's controversial new surveillance legislation is facing a massive revolt from the privacy industry, with top digital security providers threatening a complete exodus if the law passes in its current form.

In a newly published open letter organized by the Chamber of Progress, heavyweights like Windscribe, NordVPN, and ExpressVPN, along with a chorus of civil liberties groups and major tech firms, urge the Canadian government to significantly amend Bill C-22.

Also known as the Lawful Access Act, the proposed legislation aims to give law enforcement and intelligence agencies broader access to digital information during investigations.

However, cybersecurity experts warn that the bill will effectively kill end-to-end encryption. To comply with the proposed rules, companies running the best VPN services, secure email platforms, and messaging apps would be forced to create backdoors into their encrypted systems.

Providers could be required to retain sensitive user metadata, the digital breadcrumbs that track your online habits, for up to six months.

For everyday consumers, this means the very tools designed to keep personal data safe from hackers and snoops could be legally mandated to feature systemic vulnerabilities. Now, the companies that build these tools are drawing a line in the sand.

NEW: Leave No Trace — A weekly newsletter on digital privacy and online surveillance.

Leave No Trace investigates the companies and governments putting our digital freedom at risk — and the people fighting back.

📩 Subscribe now to get every edition delivered to your inbox every Friday, launching this September.

A backdoor for everyone

The core issue with Bill C-22 is its demand for lawful access to encrypted data. The legislation leaves the definition of a "core provider" dangerously unresolved, meaning any service could potentially face secret ministerial orders to alter its security architecture.

As the joint letter explains, weakening encryption to catch bad actors ruins the defense for innocent users.

"A backdoor for law enforcement is a backdoor for everyone," the coalition stated. "Once built, it would permanently expand the attack surface for criminal actors and foreign adversaries."

This massive tech backlash has triggered a global response. Recently, digital rights advocates urged the EU to step in and save encryption from Canada's Bill C-22, warning that the law’s extraterritorial reach could force European companies to quietly betray their users.

Even Google joined the privacy backlash, warning lawmakers that the bill establishes a dangerous surveillance infrastructure.

VPNs threaten to walk

The pushback has been unusually fierce from VPN providers with physical operations in the country. Because premium VPNs do not log user activity, there is simply no metadata to hand over to authorities.

The open letter doesn't mince words and argues that "Bill C-22 puts our companies at risk," as it could force businesses to create new compliance and data-retention systems while weakening consumer protection.

The signees are willing to pack their bags if Canada refuses to budge. The letter confirms that "some firms have already said they will leave Canada if this bill passes as-is."

Windscribe, a major VPN provider based in Ontario, recently reassured its users about the Bill C-22 fallout, boldly stating there will be "no changes to our logging or privacy policies."

Windscribe CEO Yegor Sak has publicly discussed exploring options to move the company's headquarters out of the country rather than compromise their security framework.

Sak told TechRadar: "Bill C-22 makes Canada an untenable place for most tech companies to operate in, foreign and domestic."

While Canada has vowed to amend Bill C-22's encryption and metadata rules, Public Safety Minister Gary Anandasangaree has insisted that the core of the legislation "needs to happen."

If the government refuses to overhaul the bill, Signal, Apple, and top VPNs will continue fighting the surveillance law, leaving everyday Canadians caught in the crossfire, potentially isolated from the world's most secure digital services.

• 66% of UK AI users have discussed highly sensitive topics with a chatbot
• Yet, 64% of respondents are worried that chats will be used to profile them
• Proton's privacy-first chatbot, Lumo, aims to fix this trust gap

Late at night, when you need to vent about a relationship, ask for career advice, or check a worrying health symptom, who do you turn to? For a rapidly growing number of people, it isn't a friend, family member, or doctor; it's a chatbot.

A new piece of research published today by Proton, the Swiss tech firm behind some of the best VPN services on the market, reveals that a staggering 66% of British AI users have discussed at least one sensitive topic with an artificial intelligence assistant.

However, there is a massive contradiction at the heart of this new digital relationship: we are pouring our hearts out to these chatbots, but we do not actually trust them. According to the survey, 42% of UK users have little or no trust in AI companies to protect their private information, and 11% don't trust them at all.

Despite these glaring privacy reservations, 55% of Brits admit that AI has fundamentally changed their everyday decision-making.

The ultimate judgment-free zone

So, why are we sharing our most intimate thoughts with machines we don't trust? The answer is simple: freedom from judgment.

While friends and family remain the preferred choice for most sensitive discussions, AI offers a 24/7 digital confidant that won't react with surprise or embarrassment.

Proton's data shows personal finance is the most commonly discussed sensitive topic (33%), followed closely by work or career problems (32%), mental health struggles (27%), and relationship issues (20%).

"AI is learning far more about us than a search engine ever could," said Eamonn Maguire, Director of AI Engineering at Proton. "We’re not just asking questions. We’re sharing deeply personal context about our health, finances and relationships. And when technology knows that much about us, privacy can't be an afterthought."

The primary worry isn't just about the AI remembering a single chat, or even the risk of human reviewers reading your logs. Users are increasingly terrified of the bigger picture.

In the UK, 64% of respondents are concerned that their vulnerable conversations are being weaponized to build detailed advertising or marketing profiles. Meanwhile, 52% are worried their secrets are being fed back into the machine to train future AI models.

NEW: Leave No Trace — A weekly newsletter on digital privacy and online surveillance.

Leave No Trace investigates the companies and governments putting our digital freedom at risk — and the people fighting back.

📩 Subscribe now to get every edition delivered to your inbox every Friday, launching this September.

How Lumo promises a private alternative

Despite these valid fears, Brits are highly receptive to a more secure way forward. A massive 82% of users said they would be more likely to use an AI chatbot specifically designed around privacy, and 44% would be far more willing to share sensitive information if they were given a cast-iron guarantee that their chats wouldn't be used for AI training.

This is exactly where Proton hopes to fill the gap with Lumo. Built with the same end-to-end encryption ethos as the company's famous email client, Lumo is an open-source, privacy-first ChatGPT alternative.

To help users understand the scale of their digital footprint, Proton recently launched AI Paper Trail, a tool from Lumo that visually demonstrates exactly how much personal information an average AI conversation leaks about a user's inner life.

"People have already decided that AI is useful enough to hear their money worries, doubts and everyday concerns. They are handing AI companies their inner lives and biggest secrets on the assumption that they will protect them when it's actually the opposite. AI's business model depends on learning from them" Maguire added.

• A new US proposed law would force internet providers and VPN services to block "foreign piracy sites" via expedited court orders
• The legislation would apply to ISPs, DNS resolvers, and any VPN provider with at least 100,000 monthly US subscribers
• Digital rights groups warn the fast-track legal process risks massive overreach, citing similar policies in Europe

A newly introduced bill in the US House of Representatives is threatening to fundamentally change how virtual private networks operate within the country. If passed, the legislation would force VPN providers to actively block access to piracy websites, turning vital privacy tunnels into heavily filtered exit ramps.

The American Copyright Protection Act (ACPA), formally numbered H.R. 10364, was introduced by Representative Darrell Issa (R-CA) on September 16, 2026. The bill aims to give copyright holders a fast-track judicial process to obtain blocking orders against platforms accused of copyright infringement.

Crucially, the ACPA explicitly names VPN services alongside traditional broadband providers and DNS resolvers as entities that must enforce these blocklists. For users who rely on the best VPN software to ensure unrestricted, unmonitored internet access, this legislation poses a direct threat to the core promise of the technology.

The blocking obligations would apply to any VPN service with at least 100,000 monthly US subscribers. This threshold catches almost all major consumer VPN brands, effectively forcing the industry's biggest players to implement nationwide web filters or risk severe legal consequences.

Laura Tyrylyte, privacy advocate at NordVPN, told TechRadar that there are thousands of VPN solutions available for users worldwide; however, "these blocking measures primarily target reputable, paid VPN providers, leaving free VPN services largely untouched."

"Free VPNs are often harder to regulate, and since users who seek to avoid paying for content are unlikely to pay for a VPN either, these services will continue to operate without any impact," she added.

NEW: Leave No Trace — A weekly newsletter on digital privacy and online surveillance.

Leave No Trace investigates the companies and governments putting our digital freedom at risk — and the people fighting back.

📩 Subscribe now to get every edition delivered to your inbox every Friday, launching this September.

Fast-track censorship "at the speed of light"

Under the ACPA, a copyright holder can petition a designated federal judge to declare a website a "foreign piracy site." The evidentiary bar for this is surprisingly low, requiring only a "preponderance of the evidence." Once approved, covered providers are given 14 days to object before the blocking order takes effect, though crackdowns on live sports and other time-sensitive material could be executed even faster.

Rep. Issa has made no secret of his desire for aggressive enforcement. Speaking at a June hearing, he framed his goal bluntly: “Can we do it at the speed of sound? Can we do it at the speed of light?”

Digital rights organizations have heavily criticized the proposal. Meredith Rose of Public Knowledge warned that the bill would force any service provider "to disrupt traffic from targeted websites simply accused of copyright infringement."

Meanwhile, Brandon Butler of Re:Create argued the legislation codifies "a one-sided legal process modeled on European site-blocking laws" and "violates American due process, First Amendment rights, and American ingenuity."

To mitigate the risks of false positives, the bill includes an error provision allowing companies wrongly blocked to claim up to $250,000 in damages, though critics argue this offers little financial comfort to innocent small businesses taken offline.

A growing global threat to unfiltered internet

This isn't the first time US lawmakers have targeted VPNs in 2026. The ACPA arrives on the heels of Utah's SB 73, a controversial state law that attempted to regulate VPN use for age verification before facing an enforcement freeze. The ACPA also joins other pending federal proposals, such as the Block BEARD Act and the Foreign Anti-Digital Piracy Act.

However, the real warning signs come from overseas. As Butler noted, the ACPA heavily mirrors aggressive European anti-piracy campaigns, which have already put VPNs in the crosshairs. In countries like Spain and France, court-ordered VPN blocking is already a reality.

These systems have already shown their potential for collateral damage. An analysis by Re:Create found that in Italy, innocent websites remained blocked for an average of 320 days due to overzealous filters. In Spain, over 500,000 websites were wrongly blocked during LaLiga matches, temporarily restricting access to 5.8% of the popular internet.

If the ACPA advances, a VPN's legal jurisdiction will become more vital than ever. US courts cannot automatically enforce orders against providers incorporated in privacy havens like Panama or the British Virgin Islands. Until then, the battle for the open internet continues on Capitol Hill.

• Google hit with €403M for the unlawful processing of user location data
• Proton calculates Alphabet can cover the penalty in just about two days
• Multi-million fines are failing to deter Big Tech repeating GDPR violations

The news that Ireland's Data Protection Commission (DPC) fined Google €403 million (around $462 million) for the unlawful processing of users' location data may sound like a monumental victory for consumer privacy. Yet, industry experts are already warning that the fine is simply too small to force a change in corporate behavior.

According to the privacy firm Proton, Google's parent company, Alphabet, will be able to brush off the historic penalty in less time than it takes to enjoy a long weekend.

"Google will barely notice this fine," noted Jurgita Miseviciute, Head of Public Policy at Proton. "When one of the biggest weapons in the EU's arsenal only costs the offender two days of revenue, it's not a deterrence."

For everyday internet users looking to protect their digital footprint with the best VPN or secure browser, this latest ruling serves as a stark reminder of how profitable your personal data remains.

A multi-million euro 'slap on the wrist'

Following a lengthy inquiry, the DPC announced the enforcement action against Google over controversial location data practices that occurred between 2018 and 2020. It represents one of the largest GDPR penalties the search giant has ever faced.

However, for a company the size of Alphabet, the impact is mathematically minuscule. Based on Alphabet’s own reported 2025 free cash flow of $73.3 billion, which breaks down to roughly $200 million a day, Proton notes that Google's cash flow alone could cover the fine in about two days and seven hours.

To put that into perspective, that is roughly 55 hours, or 199,000 seconds of standard revenue generation.

NEW: Leave No Trace — A weekly newsletter on digital privacy and online surveillance.

Leave No Trace investigates the companies and governments putting our digital freedom at risk — and the people fighting back.

📩 Subscribe now to get every edition delivered to your inbox every Friday, launching this September.

The illusion of deterrence

The €403 million fine is not an isolated incident. In 2025 alone, Google picked up five separate fines totaling nearly $4.24 billion. Thanks to its massive financial reserves, the company's free cash flow could replace that entire sum in roughly three weeks, a trend that echoes broader warnings that Big Tech could need only one month to pay off over $7 billion in collective 2025 fines.

This mirrors an equally dismal pattern from the previous year, when the industry needed less than three weeks to pay off over $8 billion in 2024 penalties.

This recurring pattern has left privacy advocates frustrated by the limitations of the European Union's current regulatory framework.

Miseviciute from Proton emphasized that the lack of financial sting makes these penalties a mere cost of doing business rather than a mechanism for actual reform.

"Time and time again fines makes [sic] headlines without changing Big Tech's behaviour at all," she added. "If regulators are serious about compliance, the penalties have to actually bite."

For consumers, this means the responsibility for data security largely remains in their own hands. Location data is uniquely sensitive, capable of revealing everything from your home address to your daily routines and medical visits.

Until regulators find a way to issue penalties that genuinely threaten a tech giant's bottom line, companies will continue to calculate that the astronomical profits of aggressive data harvesting far outweigh the minor risks of a regulatory fine.

Feature-packed Chinese SUVs like the Jaecoo 7 — dubbed the 'Temu Range Rover' — are rapidly taking over British roads. But while public scrutiny centers on these cut-price imports, focusing solely on Chinese models misses an important reality: almost all connected cars pose a threat to your privacy.

With 95% of cars expected to have an internet connection by 2030, it's not long until this may affect us all.

So, what’s the true cost of driving a connected car? And is your new Chinese-made SUV really any worse for your privacy than a Western model?

Surveillance on wheels: how your car spies on you

While much of the current scrutiny focuses on Chinese companies , they are not the only brands involved. All it takes is a cursory look at the privacy policies of leading manufacturers to understand the sheer scope of data modern cars gather.

According to Land Rover's UK policy, for example, the company logs your "last-parked" location by default alongside every journey detail, including duration, distance, average speed, route travelled, and fuel efficiency.

Meanwhile, Kia’s US policy explicitly states the company may "collect and store voice data to enable voice control and voice inputs."

The issue is hardly new. In 2023, Mozilla researchers shed light on connected car privacy, and their findings were damning.

Every single one of the 25 car brands reviewed — including BMW, Ford, Toyota, Tesla, Kia, Nissan, and Subaru — failed consumer privacy standards. At the time, researchers discovered that some brands were collecting deeply personal details like facial expressions, weight, health status, and location history.

Privacy expert and former Mozilla Research Lead, Jen Caltrider, described these vehicles to TechRadar as "information-collecting monstrosities," noting that low consumer awareness makes their data collection even more "terrifying".

Data is gathered through a web of sensors, microphones, and in-cabin cameras linked to connected smartphones, alongside companion apps, dealership systems, and vehicle telematics.

This, coupled with policies that are anything but consumer-friendly, makes connected cars an even greater threat to privacy.

Take Jaecoo’s privacy policy, for example. The document states that it does not apply to "the processing of personal data when you use our vehicle," without linking to any other policy that does that.

That’s unfortunately a recurring practice across the automotive industry. As Caltrider confirmed to TechRadar, deciphering these layered car policies is notoriously difficult even for privacy researchers.

And even if you manage to get a grip on what kind of information is collected, how it's processed, and who it's shared with before making a purchase, "there's no guarantee that the company won't just change that tomorrow," Caltrider added.

TechRadar has reached out to Jaecoo, Land Rover, and Kia for comment, but has not received a response prior to publication.

NEW: Leave No Trace — A weekly newsletter on digital privacy and online surveillance.

Leave No Trace investigates the companies and governments putting our digital freedom at risk — and the people fighting back.

📩 Subscribe now to get every edition delivered to your inbox every Friday, launching this September.

Car privacy and the real-world risks

China is infamous for state surveillance, but Western drivers have also become accustomed to routine monitoring through smartphones, smartwatches, and ubiquitous CCTV.

But cars feel like private, secure spaces. This disconnect between driver expectations and technical reality prevents people from grasping the real-world risks.

Telematics data may seem abstract, but aggregated over months alongside call histories, contacts, and cabin sensor metrics, raw GPS coordinates build a shockingly detailed picture of your daily life.

That’s what Caltrider calls "inferences." This aggregate data can reveal your emotional stability, political beliefs, health status, and financial risk, which can then be combined with smartphone data to build a digital persona monetized for commercial gain.

While Nissan explicitly states in its US policy that it "does not create or sell any customer inference profiles," Kia’s US terms are explicit: the company draws inferences from collected data "that may reflect your preferences, characteristics, predispositions, behavior, attitudes, or similar behavioral information."

According to Caltrider, this thirst for aggregated data is why automakers write such expansive privacy policies — giving them leeway to collect as much information as possible.

While a policy disclosure doesn't mean a car constantly logs every metric it claims, "the potential for manipulation and abuse is off the charts," Caltrider warns.

Which brings us back to the core question: with China infamous for aggressive state surveillance and invasive data laws, is driving a Chinese car an even bigger risk?

Geopolitical risks: Are Chinese connected cars worse?

One of the biggest concerns surrounding Chinese cars is rooted in potential geopolitical risk: could the Chinese government use these vehicles to spy on the Western world?

Possibly. At least, that’s what several Western military and intelligence agencies have come to believe, taking concrete steps to mitigate those risks.

In the UK, for example, the Ministry of Defence (MoD) reportedly issued security notices instructing personnel not to hold sensitive conversations inside leased Chinese cars, nor pair work phones via Bluetooth or USB to prevent mobile data extraction.

As cybersecurity experts previously confirmed to The Guardian, Chinese cars certainly have the potential to be repurposed as surveillance platforms for a hostile government.

After all, Article 7 of China's National Intelligence Law requires any Chinese company and citizen to "support, assist, and cooperate" with national intelligence work upon request and keep that assistance secret.

Regardless of whether a brand stores drivers' data in a UK data centre, Chinese parent companies still remain subject to that legal obligation.

Yet as Michael Stokes, SVP of Emerging Technologies at Veilant and former CIA officer, told TechRadar: "That does not prove any particular car is spying, and I have seen no public evidence that one is."

Stokes reiterates that the privacy issue with connected cars is far from just a China problem, arguing that Chinese manufacturers simply add "a second layer" of risk.

While it’s important to keep that in mind when choosing between a UK-made Range Rover, a Tesla, or a Jaecoo 7, the ultimate decision comes down to personal choice: how comfortable are you with your data being collected — and potentially shared with the country where the manufacturer is based?

Can we still be private in our own car?

Three years after Mozilla published its shocking findings, lawmakers have begun taking steps to better protect consumers.

Most notably, the US Federal Trade Commission (FTC) issued a five-year ban prohibiting General Motors from selling customer location and driving telemetry to data brokers. Australia's privacy watchdog also launched formal investigations into Toyota and Hyundai regarding potential breaches of data protection laws.

Despite these victories and growing consumer awareness, Caltrider feels the broader trend around vehicle privacy is actually worsening as new models harvest more data without lawmakers stepping in to stop it.

For Caltrider, the issue isn’t negotiable: the burden shouldn’t fall on consumers. "People should be able to buy a car without having to figure out how to stop it tracking them," she explains.

So, can we still have privacy in our own cars? The short answer is no. Whether you are behind the wheel of an iconic British luxury SUV or a budget-friendly Jaecoo 7, you can be certain vast amounts of your data are being harvested.

There are ways to limit this collection. A good place to start is avoiding your car's companion app whenever possible, or revoking as many app permissions as you can. But these workarounds fall short of addressing the real elephant in the room.

While consumer awareness is higher today, and some manufacturers are slowly shifting toward privacy-conscious vehicles, control over data collection is far from standard practice. Until data privacy becomes a non-negotiable manufacturing requirement, you either stick with an older vehicle or accept that the moment you turn the ignition in a connected car, your privacy is left behind in the driveway. On the long road ahead, that shouldn't be acceptable to anyone.

• Surfshark’s System Engineer dismisses recent AI extinction warnings as a recurring marketing tactic
• The real threats are already here, including deepfake fraud and the massive environmental toll of data centers
• Current LLMs might have reached their limit, making the "Skynet" narrative a distraction from serious user privacy risks

Over the past week, the internet has been flooded with renewed warnings about the catastrophic dangers of artificial intelligence. From tech giants calling for pacing the frontier of AI development to researchers expressing fears of AI-driven human extinction, the doomsday narrative is back in full force.

But not everyone is buying into the panic. According to Karolis Kaciulis, Lead System Engineer at Surfshark, one of the market's best VPN and consumer cybersecurity providers, these dystopian warnings are little more than a calculated distraction.

"The latest debate around AI threatening humanity is clearly a marketing move," Kaciulis told TechRadar. "AI companies use the same rogue-AI rhetoric every few months, and it is almost identical each time."

While Silicon Valley executives and pundits continue to debate whether AI could really kill off humanity, Kaciulis argues that hyper-focusing on a sci-fi future blinds us to the very real, immediate problems that generative AI is already creating for everyday consumers.

Real-world risks over sci-fi scenarios

For Kaciulis, the focus of the current AI safety debate is entirely misplaced. "The threat itself is fictional, closer to a Skynet-style sci-fi scenario than the problems generative AI is already causing today, from automated scams to intimidation," he explained.

Rather than plotting to take over the world, generative AI is currently busy giving bad actors an incredibly effective toolkit. Kaciulis notes that while AI models aren't necessarily becoming independently dangerous, they are giving scammers much easier access to sophisticated methods of attack.

The financial toll is already staggering. According to Surfshark's data, deepfake fraud has resulted in $2.19bn in losses globally, including $149m in the UK alone.

There is also a mounting, hidden cost to the AI boom that rarely makes it into apocalypse narratives: the environment.

“One of the most immediate risks from AI is its environmental cost: the wildlife and land lost to data centres, the huge amounts of energy they use and, by extension, the water needed to cool them," Kaciulis said.

Surfshark's own research highlights this burden, estimating that a single ChatGPT query uses around 2Wh of energy on average, enough to run a 40W desk fan for three minutes. Multiplied across hundreds of millions of daily queries, the environmental impact mounts rapidly.

NEW: Leave No Trace — A weekly newsletter on digital privacy and online surveillance.

Leave No Trace investigates the companies and governments putting our digital freedom at risk — and the people fighting back.

📩 Subscribe now to get every edition delivered to your inbox every Friday, launching this September.

Have large language models peaked?

Beyond fraud and energy consumption, Kaciulis suggests that the AI industry might be projecting future dangers to mask a more mundane reality: the technology might be plateauing.

"The bigger danger for AI companies may be that no valuable scaling is possible anymore with the current state of LLMs. This may be as efficient as they ever get," he argued.

According to Kaciulis, it remains entirely unclear whether newer models are actually better at performing requested tasks, or if they are simply getting better at imitating the responses we expect to see.

This illusion of intelligence presents a massive privacy risk for users who mistakenly trust these tools with sensitive information. Because chatbots confidently ask follow-up questions while helping with research or tasks, users often forget they are interacting with a corporate data-gathering machine.

“People do not really understand how chatbots work, or that what they pass to one may be accessible to the company behind it," Kaciulis warned.

For now, it seems the best way to stay safe from AI isn't to prep for the apocalypse, but to protect your wallet and your personal data.

• A coalition of privacy organizations is urging the EU to intervene against Canada's Bill C-22
• The proposed law could compel European tech companies to weaken encryption and retain user metadata
• This follows a massive backlash in Canada from major tech giants and leading VPN providers

In a last-ditch effort to protect end-to-end encryption, digital rights advocates are calling on the European Union to intervene against Canada's controversial Bill C-22.

Also known as the Lawful Access Act, the proposed legislation threatens to force technology companies into building surveillance capabilities that can help law enforcement and intelligence services access digital information during high-stakes investigations.

Access Now, alongside a coalition of European civil society organizations, has published an open letter urging European Commission President Ursula von der Leyen and other top EU officials to step in.

The groups warn that Bill C-22 is not just a domestic issue, as its sweeping data retention mandates and surveillance requirements will inherently compromise the privacy of millions of people globally.

For privacy-conscious users relying on secure messaging apps or the best VPN to keep their digital lives private, the stakes couldn't be higher. If passed, Bill C-22 could grant Canadian authorities the power to secretly compel European-based companies to comply with data demands, completely bypassing traditional oversight and transparency.

Namrata Maheshwari, Global Encryption Policy Lead and Asia Pacific Policy Manager at Access Now, warns that the bill threatens to normalize excessive surveillance powers, while converting "devices that work for people into devices that work against them."

"Steps must be taken to prevent it from becoming law," Maheshwari added.

NEW: Leave No Trace — A weekly newsletter on digital privacy and online surveillance.

Leave No Trace investigates the companies and governments putting our digital freedom at risk — and the people fighting back.

📩 Subscribe now to get every edition delivered to your inbox every Friday, launching this September.

What’s at stake for Europe?

While Canada's Lawful Access Act may sound like a local concern, the legislation has an aggressive extraterritorial reach. The open letter suggests that Bill C-22 would apply to any service provider whose platform is used by people in Canada.

Digital rights experts also warn the new rules would target providers with zero Canadian users, provided they belong to a corporate group carrying out business activity in the country.

The coalition argues that a Canadian minister would have the authority to secretly order a European company to weaken the security of products used across the EU.

Because a deliberate weakness built for one target ultimately compromises the entire system, experts warn that this effectively serves as a backdoor for mass surveillance.

This is why advocates stress that "Europe should not stay silent" and publicly declare that measures weakening encryption are entirely incompatible with the EU’s own fundamental rights, particularly as the EU and Canada are currently negotiating a Digital Trade Agreement.

With the Canadian Senate expected to conclude its study of the bill as early as October 2026, time for the EU to apply pressure is rapidly running out.

The growing privacy backlash

The open letter to the EU is just the latest development in a massive tech backlash against the Canadian government. Bill C-22 has faced fierce opposition from almost every corner of the cybersecurity industry, with top executives arguing that backdoors cannot safely exist.

Leading tech firms have already drawn a hard line in the sand. Google also joined the privacy backlash, warning that the law would fundamentally break end-to-end encryption.

Meanwhile, the top privacy tools on the market, including Signal, Apple, and leading VPNs, are fighting the surveillance law tooth and nail. From Canada-based Windscribe to ExpressVPN, NordVPN, and ProtonVPN, companies reassured users that they would rather leave the country than undermine their no-log infrastructure.

Ultimately, the cybersecurity community remains united: introducing systemic vulnerabilities for law enforcement creates the very same weaknesses that malicious actors and foreign adversaries will exploit.

If Canada moves forward with the legislation in its current state, it risks isolating its citizens from the world's most secure digital services.

The second issue of TechRadar's privacy newsletter, Leave No Trace, is now live.

Last week, TechRadar's VPN and Security team launched Leave No Trace with a clear goal: to warn about the companies and governments that put our online freedoms at risk, and to shed light on the people fighting back.

To do so, Issue #2 retraced the fall of Autistici/Inventati (A/I), an Italian volunteer-run tech collective. For a quarter of a century, A/I has supplied a non-commercial, privacy-first communications infrastructure alternative to Big Tech to thousands of users worldwide — until last Sunday, when a US terror designation brought its mission to an end.

What could look like yet another story of censorship and politics, the fall of the A/I Collective actually reveals a deeper lesson for the future of digital rights and the open web.

LNT #2 also features stories on age verification in Utah, a massive passport database leak, an investigation into the vulnerability of a popular travel app, and more.

Leave No Trace — A weekly newsletter on digital privacy and online surveillance.

Leave No Trace investigates the companies and governments putting our digital freedom at risk — and the people fighting back.

📩 Subscribe now to get every edition delivered to your inbox every Friday.

What you can expect from Leave No Trace newsletter

Leave No Trace is a weekly briefing on the most important digital privacy stories from the last seven days. It is a complete read in its own right, with the whole stories delivered right to your inbox. There's no need to click through, unless you want a deeper dive into the details.

We bring you exclusive, behind-the-scenes analysis of the struggle between privacy advocates and anti-encryption legislation; curated news from our team and from around the web; and hands-on findings from testing of VPNs and other privacy tools designed to keep you safe online.

You can expect analysis on how companies and governments abuse our online privacy, advice on how to stay one step ahead of surveillance, and features on the groups and figures in the movement that's fighting back.

In case you missed it, issue #1 brought the lens to Meta smart glasses and the rise of surveillance chic, asking whether the loss of public privacy is an inevitable trade-off in the name of convenience, or whether there's still time to do something about it.

If you are interested in knowing more, remember to sign up to Leave No Trace today.

• Read issue #2 of Leave No Trace here
• Read issue #1 of Leave No Trace here
• Sign up for the weekly email and never miss the news again.

Twelve days — that’s how long it took a designation, signed in the US, to bring an end to the 25-year-long work of Autistici/Inventati, an Italian technology collective which supplied a non-commercial, privacy-first communications infrastructure alternative to Big Tech.

On August 26, the US Departments of State and the Treasury denounced Autistici/Inventati (A/I) as Specially Designated Global Terrorists, in a statement by the Office of the Spokesperson (OFAC), for operating infrastructure for "far-left militants across the world".

A/I was hit with sanctions and an announcement that anyone engaging with them "may risk exposure to sanctions". A wind-down deadline was set for September 25.

The US terrorism accusations were made under Executive Order 13224, with A/I allegedly "having materially assisted, sponsored, or provided financial, material, or technological support for, or goods and services to or in support of, an act of terrorism".

It’s an accusation that the collective strongly rejects, arguing that it "merely provides digital self-defence tools for activists, individuals, groups and associations", i.e. that it’s not a terrorist. It’s a software supplier.

If you’ve not heard of Autistici/Inventati (A/I) before, you are not alone. In some ways, it’s a wonder that this tiny Italian collective came under the radar of the US Treasury’s Office of Foreign Assets Control (OFAC) at all.

Since its beginnings in 2001, A/I has been volunteer-run. It has provided email, mailing lists, messaging apps, web hosting, and blogging platforms, all designed to be resilient to censorship and surveillance, to thousands of users worldwide.

Within days of the announcement, though, one of A/I's domains became unreachable, its donation gateways were closed, and its bank accounts were frozen. On Sunday (September 6), A/I announced it would shut down for good to protect users from potential repercussions.

There’s no hiding that Autistici/Inventati has been a political project. The group self-describes as an anti-fascist, anti-racist, anti-sexist, anti-militarist organisation and opposed to capitalism and authoritarianism. With few larger beacons of capitalism on the planet than the US Treasury, perhaps it should not have been a surprise that A/I got noticed?

And, crucially, unlike a regular privacy software and service provider, the group had supplied its tools only to individuals and projects that shared its views. Most of A/I users were grassroots movements and activists on that same side of the political spectrum.

Nonetheless, the story has an eerie ring to it. The ease with which a single nation has been able to silence a global movement, without any international legal process, should stand as a warning. And, if punishing the host of a private service for what its users do on its platform becomes normalized, could your favorite encrypted apps be next?

Who is Autistici/Inventati?

A group of Italian technology activists, hackers, and digital rights defenders founded Autistici/Inventati (A/I) during the anti-globalization movement at the start of the millennium. Since 2018, it has been a legally recognised non-profit organization — Associazione AI-ODV — based in San Giuliano Terme, Italy.

For about a quarter-century, A/I offered a non-commercial oasis in a corporate-dominated web. As the collective confirmed to TechRadar, as of September 6, the group had included about 20,000 email accounts, 20,000 blogs, 5,000 mailing lists, and 1,500 websites — a drop in the ocean compared to Proton’s 100 million registered accounts, and the 6 million subscribers to Riseup, another volunteer-run collective.

That said, the actual number of people engaging with the A/I infrastructure, however, is most likely higher, given all the people accessing the websites, newsletter, and emails sent, which are hosted on its services, or reading a post on its flagship NoBlogs platform.

"Given that one of the features of our tools is the protection of communications, we are unable to provide precise data [on users]," an A/I spokesperson told us, echoing the group’s privacy policy, which centers on collecting as little data as possible about its users.

In its terms and conditions, A/I is also clear regarding the responsibility for the content: users are "the sole responsible" for the data they store and the content posted on their platforms. “We do in no way pre-screen, filter, or verify the content uploaded by the users, nor do we have the opportunity to edit or modify it,” the policy also reads.

It’s a level of independence, anonymity, and privacy that had already put the collective under the justice system’s scrutiny in the past. This time, however, the US action was different.

"We are not dealing with a legal or technical dispute, but rather a case that highlights the fragility of a tool everyone takes for granted," an A/I’s spokesperson told us.

Targeting the infrastructure: what’s behind the US terror designation?

The US Treasury has sent a clear message: providing digital tools to political direct-action groups or sanctioned foreign political parties — the order directly mentioned the Kurdistan Workers’ Party (PKK) among those — constitutes "material assistance" or "technological support" for terrorism.

For the US Treasury Secretary, Scott Bessent, the "enablers" of what he deems far-left extremists must be targeted with "the full weight of our economic tools to bear".

While this isn't the first time the US has targeted independent, open-source software — they did so in 2022 against Tornado Cash — the recent action against A/I still marks an escalation: from targeting the content, to aiming squarely at the infrastructure that hosts it. It’s a shift that digital rights experts warn could have heavy repercussions.

Talking to Italian broadcaster Rai News, American non-profit digital rights group Electronic Frontier Foundation’s director of international freedom of expression, Jillian York, explained that the practice of designating an internet platform and service provider as a terrorist group — rather than those who directly perpetrate violence — has "enormous" implications.

"They are targeting the messenger. I don’t think members of the group would necessarily endorse the actions of the people they host. What they endorse is the freedom to host, the ability to remain anonymous, and the ability to maintain privacy," York added.

NEW: Leave No Trace — A weekly newsletter on digital privacy and online surveillance.

Leave No Trace investigates the companies and governments putting our digital freedom at risk — and the people fighting back.

📩 Subscribe now to get every edition delivered to your inbox every Friday, launching this September.

The threat to everyday privacy tools: who is next?

By issuing a terror designation to an independent technology collective, Washington has dragged the legal principle of "material support" into dangerous terrain. But could such an attack really be replicated?

Let's take Proton as an example. This well-known privacy-first firm offers an encrypted alternative to the Gmail suite (email, docs, sheets, cloud storage, calendar, and even videoconference tools), alongside a secure VPN service.

ProtonMail and other Proton apps are a popular choice among everyday users, activists, and journalists worldwide owing to their zero-knowledge architecture and strict no-log policy. The Swiss-based company explicitly uses the impossibility of disclosing any data to authorities as a selling point.

So, if a sanctioned organization or political direct-action group uses a Proton account to communicate, might the host risk being designated an "enabler" of terrorism? Probably not quite, for now at least.

The difference is that A/I isn't a neutral provider. Unlike Proton — or another volunteer-run network, the Tor Project — that doesn’t make any distinctions about who can subscribe to its services, the Italian collective did support only users who demonstrated their shared political views.

Still, experts at the European Digital Rights (EDRi) and 30+ digital rights groups see these events as an "attack on independent internet infrastructure, fundamental rights of multiple collectives, safe and secure communications, democratic anti-authoritarian organising and the democratic integrity of the EU".

Beyond politics, what's clear is that the move could be seen as a thin end of the wedge: if providing privacy-preserving infrastructure to controversial or radical groups is reclassified as terrorism, it leads to a chilling question: how long will it take before something similar happens again, and who might be next?

That's why, according to the CEO of Nym Technologies, the provider behind the privacy-first, decentralized NymVPN, Harry Halpin, only a decentralized infrastructure can truly be resilient to similar attacks.

"A government can easily take centralized domain names and bank accounts down, but the service as a whole should continue to operate if designed properly," Halpin told TechRadar, adding that "I hope that even if Nym Technologies disappeared tomorrow, the infrastructure should run without us."

A move against bigger commercial entities than A/I may not seem as likely, but the current US administration is nothing if not bold. All the same, there is a clear distinction between commercial companies, such as Proton, Tuta, or Signal, and independent projects, like A/I, where the aim isn’t profit:

"We hold different visions of the Internet — radically different ones — and we have been targeted for this reason as well," A/I told TechRadar.

That rationale, though, could include other non-profit projects like the well-known Tor Browser, which, one day, may also find itself in the US government’s crosshairs. Should Tor be successfully taken down in the same way, it would undermine the very nature of a free and open internet.

As A/I told TechRadar: "If a case like ours were to happen again, it would mean that those in power have decided to make the Web as we have known it — from its inception to the present day — disappear; a Web where the vast distinction between the provider of a tool and its user was abundantly clear."

A case for digital sovereignty

The fall of Autistici/Inventati doesn’t just create a possible precedent for digital rights, it also exposes a stark reality: a foreign government can unilaterally disable a European digital service without having to seize physical servers or prove criminal liability in court.

Washington did not have to target physical hardware. The US could, instead, simply count on centralized choke points across the internet's core infrastructure to do its work.

While A/I’s servers remained operational, access to one of its domains — autistici.org — was severed at the DNS level. Short for Domain Name System, DNS allows your web browser to find the IP address of the domain that you type in and connect to the site you want.

A/I believes that the operator responsible for managing these connections, the US-based Public Interest Registry (PIR), placed the domain in a 'serverHold' status as a direct consequence of the US sanctions. It’s worth noting that there is currently no public statement from PIR at the time of publication.

Simultaneously, the risk of secondary sanctions led PayPal to close A/I’s account and compelled Italy’s Banca Etica to suspend A/I’s current account, despite the bank’s commitment to human rights.

Whether or not we share A/I’s political views, the ease with which the 25-year-old tech collective has been dismantled is a dark moment for digital rights. Unless independent infrastructure is actively defended, the vision of the Internet as an open, free, and democratic forum will cease to exist.

At the very least, this tale should serve as a wake-up call to any even slightly controversial service built on US-owned internet foundations. Without digital sovereignty protection elsewhere, might, it seems, is right. What the US Treasury wants kicked off the internet, it may well get.

• The Tor Project's Android VPN marked its first year
• The provider confirms a pivot toward circumvention and reliability
• Adoption has been strongest in heavily censored regions

One year after the Tor Project quietly rolled out Tor VPN Beta, the team behind the anonymity network has shared what it learned, and the message is clear: people are reaching for it to unblock the internet.

The app, which is Android-only for now, was designed to stretch Tor's privacy protections beyond the browser and across an entire device. When it soft-launched last autumn, that primary use case became clear almost immediately, and it has steered how the project prioritizes its work ever since.

Unlike the usual best VPN services, Tor VPN was never built to win speed tests. It routes traffic through the volunteer-run Tor network rather than a company's own servers, trading raw performance for a very different kind of privacy.

NEW: Leave No Trace — A weekly newsletter on digital privacy and online surveillance.

Leave No Trace investigates the companies and governments putting our digital freedom at risk — and the people fighting back.

📩 Subscribe now to get every edition delivered to your inbox every Friday, launching this September.

What makes Tor VPN different

Instead of pushing every app through a single shared tunnel, Tor VPN gives each app its own Tor circuit and exit IP, so activity in one app cannot easily be linked to another.

The Tor Project frames this as a kind of "per-app pseudonymity," an idea lifted directly from the anti-tracking design of Tor Browser.

Under the hood, the app runs on Arti, Tor's next-generation implementation written in Rust, which brings safer memory handling and a more modern codebase than the older C-based tools. A Rust tunnelling layer called Onionmasq handles the low-level plumbing, capturing device traffic and feeding it into the network.

A year of hardening, and what's coming next

Much of the past 12 months went into stability rather than flashy additions. The team credits the Arti foundation with fewer crashes and better handling of shifting network conditions, and successive beta releases have steadily chipped away at bugs.

The project also passed an independent security review. As TechRadar reported, a Cure53 penetration test found no fundamental flaws in how Tor VPN routes traffic or builds its tunnels, leaving only lower-level issues to patch.

On the circumvention side, the team added WebTunnel bridges, which disguise Tor traffic as ordinary encrypted web traffic and make connections harder to detect and block.

Engagement has been strongest in heavily censored regions such as Iran and Turkmenistan, in fact, a notable contrast to Tor Browser's more Global North audience.

The project also made its builds reproducible and brought the app to F-Droid, so users can verify what they are running and update without leaning on Google Play.

Now, the roadmap leans into building on the features users rely on most.

The Tor Project says it will keep sharpening circumvention in restrictive environments, refine the interface to reduce risky mistakes, and port more of Arti's missing performance features, such as congestion control, into the mobile experience.

Exit selection, which tripped up testers who really needed bridges, is also being reworked.

Why use Tor VPN, and how

Tor VPN suits anyone who wants device-wide anonymity that a standard provider cannot match, especially people living with everyday network restrictions. I

If you are mainly after speed and streaming, one of the best mobile VPN apps is probably a better fit, as one hands-on test clocked Tor VPN at just 3 to 4 Mbps.

It's worth stressing that this is still beta software. The Tor Project explicitly warns it is not suitable for high-risk users yet, and some Android device identifiers can still leak.

To try it, head to the Tor Project's download pages, where you can grab it as an APK, from the Google Play Store, or now via F-Droid.

• Nearly half of the top mobile apps collect your browsing history
• Social media apps are the worst offenders
• Avoiding in-app browsers can limit data collection

You probably assume your web browser is the only app keeping tabs on where you go online. According to new research from Surfshark, that assumption is incorrect.

The cybersecurity firm analyzed 40 of the most popular Android and iOS apps and found that 18 of them, or 45%, report collecting users' browsing history in their app store privacy labels. In other words, nearly half of the apps you open every day may be logging the websites you visit.

Even the VPNs, like Surfshark, though, can't fully stop an app from recording what you do inside its own walls, which makes understanding what you are signing up for more important than ever.

What Surfshark found

Surfshark's team looked at 40 leading apps split evenly across four categories: generative AI, social media, e-commerce, and messaging.

For each one, the researchers checked whether its Apple App Store label reported collecting "Browsing History" and whether its Google Play label reported "Web Browsing History."

Social media came out as the biggest collector by far. Nine of the 10 social apps studied collect browsing history on at least one platform. Facebook, Instagram, TikTok, X, YouTube, and Pinterest do so on both Android and iOS, while Reddit, LinkedIn, and Snapchat collect it on Android only. Discord was the only social app that collected it on neither.

E-commerce came next, with half of the shopping apps analyzed collecting the data on at least one platform.

Messaging was less hungry, with only Rakuten Viber, Messenger, and LINE gathering it, echoing earlier findings on how much data messaging apps collect.

In the generative AI category, Google Gemini was the only app of the 10 to report collecting browsing history.

NEW: Leave No Trace — A weekly newsletter on digital privacy and online surveillance.

Leave No Trace investigates the companies and governments putting our digital freedom at risk — and the people fighting back.

📩 Subscribe now to get every edition delivered to your inbox every Friday, launching this September.

Why apps want your browsing history

The logic is straightforward: the more an app knows about where you go online, the more precisely it can target ads and shape the content in your feed.

As Surfshark's lead system engineer Karolis Kaciulis explains, many apps now route external links through their own "embedded browsers," so the moment you tap a link, they can track what you search for and look at.

The important thing to remember here is that most of these social media and shopping apps do not need your browsing history to provide their services. The practice is not related to providing value to users, and simply takes place to benefit the app companies.

Kaciulis argues that consent for this is usually buried in the fine print, and that the apps fighting hardest to keep you inside their own browser tend to be the ones selling ads rather than the ones that need your history to function.

How to stay safe

There is no single switch that turns all of this off, but a few habits can go a long way.

The easiest is to sidestep in-app browsers: when you tap a link, use the "Open in default browser" option or paste the URL into your default browser, which stops the host app from watching where you go next.

Pair this with switching to a privacy-focused browser, and you'll be able to avoid a lot of the worst data-collecting practices without much effort.

• Utah temporarily suspended its new age-verification rules for adult sites while a legal challenge is underway
• Sites are liable for verifying local users, even if they use a VPN to mask their location
• The lawsuit brought by Pornhub's parent, Aylo, cites technical flaws and privacy risks

Utah has become the first state in the US to enact legislation explicitly targeting the use of VPNs to bypass age-verification gates on adult websites. However, the state's authorities have agreed to temporarily halt enforcement while a legal challenge plays out in federal court.

According to a report from Engadget, Utah's Department of Commerce confirmed it will not enforce the measure, which officially went into effect on Thursday, September 3, against adult websites while it waits for a federal judge to rule.

The delay stems from a lawsuit brought by Aylo, the parent company of Pornhub, which has argued that the mandate creates an unworkable technical standard for online platforms.

The temporary pause offers a sigh of relief for digital privacy advocates who feared the legislation could fundamentally compromise how the best VPN services operate.

By targeting the privacy tools themselves rather than just the content, VPN providers have previously told TechRadar that Utah’s strict new law threatens to catch millions of innocent users in its crosshairs.

NEW: Leave No Trace — A weekly newsletter on digital privacy and online surveillance.

Leave No Trace investigates the companies and governments putting our digital freedom at risk — and the people fighting back.

📩 Subscribe now to get every edition delivered to your inbox every Friday, launching this September.

Why enforcement is on hold

Formally known as the Online Age Verification Amendments (SB 73), the measure was originally meant to take effect in May. However, the initial rollout was paused after Aylo challenged the law in federal court, prompting Utah to delay enforcement.

At a hearing on Thursday, the presiding judge stated that "he could not commit to when he would issue a ruling," as reported by Fox 13 News.

Until a decision is reached, the state has agreed to an enforcement truce with Aylo, leaving the law in a state of legal limbo.

Aylo has been one of the most vocal opponents of age-verification mandates across the US, previously pulling Pornhub out of multiple states rather than comply with laws it claims create a "substantial risk" for user privacy.

TechRadar has reached out to Aylo for comment on the ongoing litigation and will update this article if we hear back.

The core issues with Utah’s VPN law

Utah's legislation attempts to close a geographical loophole, but, according to VPN experts, it creates a technical whack-a-mole in the process.

Under the law, an individual is considered to be accessing a website from Utah if they are physically located in the state, regardless of whether they are using a virtual private network (VPN) or proxy server to spoof their location. The legislation also prohibits websites hosting "a substantial portion of material harmful to minors" from sharing instructions on how to use a VPN to bypass age checks.

The fundamental issue is that a VPN’s entire purpose is to encrypt internet traffic and mask a user's true physical location. Websites simply have no reliable way to verify if a user connecting from a server in Germany is actually sitting in Salt Lake City.

Privacy groups warn this creates an impossible standard. As the Electronic Frontier Foundation (EFF) explained, the legal risks could force websites "to mandate age verification for every visitor globally."

"This would subject millions of users to invasive identity checks or blocks to their VPN use, regardless of where they actually live," EFF wrote.

For now, the enforcement freeze means VPN users in Utah are safe from the immediate fallout, but the digital rights community remains on high alert as the court battle continues.

TechRadar's VPN and Security team has launched the first issue of its digital privacy newsletter, called Leave No Trace.

Leave No Trace is a weekly briefing on the most important digital privacy stories from the last seven days. It is a complete read in its own right with the whole stories delivered right to your inbox. There's no need to click through, unless you want a deeper dive into the details.

Leave No Trace offers warnings on the companies and governments that put our online freedom at risk, advice on how to stay one step ahead of surveillance, and features the groups and figures in the movement that's fighting back.

Leave No Trace — A weekly newsletter on digital privacy and online surveillance.

Leave No Trace investigates the companies and governments putting our digital freedom at risk — and the people fighting back.

📩 Subscribe now to get every edition delivered to your inbox every Friday.

We bring you exclusive, behind-the-scenes analysis of the struggle between privacy advocates and anti-encryption legislation; curated news from our team and from around the web; and hands-on findings from testing of VPNs and other privacy tools designed to keep you safe online.

In issue #1, the lens is on Meta smart glasses and the rise of surveillance chic. Is the loss of public privacy an inevitable trade-off in the name of convenience, and is there still time to do something about it?

We feature stories on age verification in Utah, a device to spot hidden cameras, and how the people of Buenos Aires took to the streets to protest about Palantir's co-founder.

Read issue #1 of Leave No Trace here.

Sign up for the weekly email and never miss the news again.

• Amnezia VPN has introduced a two-year plan
• Launch discounts run until September 15, with up to 30% off
• The longer-term plan removes the annual renewal hassle

Amnezia VPN, the open-source service best known for helping users slip past internet censorship, has added a new two-year plan to its Premium lineup.

The provider frames the 730-day option as a way to stay protected for longer while giving its team a steadier footing to keep developing the service.

To mark the launch, Amnezia is running a limited promotion until September 15: 15% off a new purchase and 30% off renewals made through the Personal Dashboard.

If you are shopping around for the best VPN, the appeal here is simple: a lower overall cost and one less renewal to manage.

Wht to get Amnezia VPN's "2 Years" plan

The plan is straightforward: pay once and stay covered for two years.

Amnezia VPN says the format is designed to save subscribers money, shield them from problems with payment services, and remove the need to renew for a long stretch.

The company also positions the longer term as a hedge against its own future price rises. Signing up now locks in today's rate, so any later increase will not affect you mid-term.

Amnezia notes that it reviews pricing from time to time to fund its team and infrastructure, just like any other company does.

NEW: Leave No Trace — A weekly newsletter on digital privacy and online surveillance.

Leave No Trace investigates the companies and governments putting our digital freedom at risk — and the people fighting back.

📩 Subscribe now to get every edition delivered to your inbox every Friday, launching this September.

How to subscribe to Amnezia VPN's "2 Years" plan

Amnezia now has three payment models: 6 months for $30, 1 year for $50, and 2 years for $80.

The pattern is clear — the longer the period you commit to, the more you save. Choosing the "2 Years" plan instead of subscribing to the "6 Months" plan for two years, for example, saves you $40.

With the current offer, the price of the "2 Years" plan goes down even further, to $68 for new customers and $56 for current customers.

New users can buy directly through Amnezia's payment page with the discount applied. Existing subscribers can renew on the website by opening the Personal Dashboard, choosing "Renew subscription," then selecting "2 Years". The same option is available inside the app in a few taps.

What is Amnezia VPN?

Amnezia is an open-source VPN launched in 2020 that began at Demhack, a hackathon run by Russian digital rights group Roskomsvoboda. It started as a tool for deploying self-hosted VPN servers and has since grown into a wider service spanning Free, Premium, Self-hosted, and Business tiers.

Its main appeal is censorship resistance. Premium routes traffic through the provider's custom AmneziaWG protocol by default, with XRay VLESS as a fallback in tougher network conditions.

Subscribers get servers in 20 countries, coverage for seven devices, and security essentials including ChaCha20 encryption, a kill switch, and split tunneling.

The apps have recently gained stronger anti-blocking tools, and WhatsApp has named Amnezia among its go-to tools for bypassing censorship.

The service runs a strict no-logs policy backed by independent 7ASecurity audits in 2022 and 2024, making it a credible pick for privacy-focused users who want to support anti-censorship work.

Since the mass adoption of CCTV, we have accepted — for the most part — giving up a degree of personal privacy in exchange for public safety. But are we prepared to hand that same power to everyday citizens, all in the name of fashion?

In 2025 alone, over 7 million people bought Meta Ray-Ban smart glasses. This rapid adoption has coincided with an alarming rise in covert harassment, prompting public venue bans and calls to ban sales entirely.

Yet these glasses are just the most well-known product in a broader cultural shift experts are calling the "chicification of surveillance."

From smart doorbells to camera-equipped smart cars — as well as rumors of camera-fitted AirPods — the latest tech is quietly turning citizens into passive, continuous monitors of each other.

As the distinction between fashion and surveillance blurs, is this another acceptable trade-off for innovation and convenience, or is it time to rethink our entire approach to public privacy?

Fashion accessory or surveillance tool?

For many tech companies, combining AI with audio and video sensors represents a huge opportunity to make seamless products. The major benefits? Better accessibility, usability, and, sometimes, even security.

Take smart glasses, for example. These intelligent wearables offer clear benefits for users, such as live translations, on-the-go content creation, and hands-free commands. These advantages are particularly important for people with disabilities, offering tools that boost everyday independence.

Yet mainstream adoption relies on more than just usefulness. And to position smart hardware as everyday lifestyle items, tech firms are increasingly turning to the fashion world.

Meta, for example, launched a major campaign featuring Kylie Jenner to promote its Ray-Ban smart glasses. Speaking to Glossy, Meta’s Vice President of Fashion, Eva Chen, explained that the new frames are built "to blend into and be a part of your personal style."

This strategy illustrates what digital rights advocates say is a deliberate reframing of surveillance tools.

Lauren Hendry Parsons, Director of Communications at the Mozilla Foundation, notes that tech companies and influencers are shifting how the public views constant recording.

How? "Turning what would previously have been private moments or a level of recording that would be quite distasteful or shocking into something cool, fashionable or, in some way, desirable," she told TechRadar.

While acknowledging the genuine value these devices offer for accessibility, Hendry Parsons argues that behind there is a hidden motivation: "This is all about collecting more data, encouraging more people to collect more data."

Parsons is not alone in warning against the "chicification of surveillance."

AI ethicist and digital rights educator Catharina Doria also believes that what she calls the "coolification of surveillance" serves tech companies' growing need for personal data in the age of artificial intelligence.

"We stop thinking about the data that we're giving away because it's cool," Doria told TechRadar. "The data is being created, collected, and I would assume it will be used by them to improve their products," she added.

But how exactly do smart gadgets collect our data? And what’s the real impact on our privacy?

The hidden cost of passive recording

While smart glasses have been criticized for their potential to covertly record people, many emerging wearables — from AI pendants to sensor-equipped earbuds — do not record visual footage at all.

Take Nothing’s recently released earbuds, which allow users to take an instant "Audio Snapshot" of their environment. While audio-only, the feature still raises eavesdropping concerns, even with alerts intended to notify others when recording is active.

And even without cameras or microphones, many smart devices still pose a threat to public privacy as they continuously harvest environmental data to train AI models.

For Hendry Parsons, this continuous logging raises some important questions:

"What I worry about with this sort of thing is: are the sensors continuously on or user-triggered? What outputs are being retained, linked to an account, or a location? What metadata is being collected and put together with this data? Is it being used to train models?"

Products like Alexa have previously blurred the boundaries between privacy and convenience behind closed doors. Now, as surveillance chic moves into public spaces, those risks multiply.

While buying a wearable may be your right and choice, that choice is increasingly impacting others around you — processing the voices, movements, and behaviors of bystanders without their knowledge or consent.

As Doria puts it, "When you're walking on the streets, and someone passes you with smart earbuds, smart glasses, and smart whatever, it is still your face, still your voice, still you. Suddenly, you don't have that control anymore because a third party is deciding that for you."

This raises the question: can we still exercise our data protection rights in the age of surveillance chic?

NEW: Leave No Trace — A weekly newsletter on digital privacy and online surveillance.

Leave No Trace investigates the companies and governments putting our digital freedom at risk — and the people fighting back.

📩 Subscribe now to get every edition delivered to your inbox every Friday, launching this September.

Why current privacy laws fail in public spaces

While recording in public is not inherently illegal, data protection frameworks like Europe's GDPR grant citizens specific agency over their personal data through the main principles of transparency, consent, and data minimization.

The expansion of always-on, wearable sensors creates a clear regulatory gap. Existing privacy laws were designed primarily for centralized, internet-based data processing — not for thousands of individuals continuously capturing ambient public data as they walk down the street.

The risks aren't always visible, either. While smart glasses are relatively easy to spot, sensor-equipped earbuds and smart vehicles operate far more discreetly.

How can a bystander realistically exercise their legal rights when they have no way of knowing the device next to them is actively monitoring their voice, image, or location?

While lawmakers struggle to keep pace, digital rights advocates argue that manufacturers must take responsibility before products hit store shelves. Reactive fixes — such as Meta disabling camera functions on modified devices — are a start, but experts argue guardrails belong in the design phase.

For Parsons, that requires building hardware around a private-by-design ethos: "This means very thoughtful ephemeral data processing, strict purpose limits, no secondary use, and really independently verifiable protections," she told TechRadar.

AI ethicist Doria believes that tech companies should undergo rigorous audits before launching a new product in the market. A similar, strict framework to what currently regulates pharmaceutical and food manufacturers.

"We shouldn't be allowing tech companies to create technology for the sake of 'innovation,' push it into the market, and harm people. If they want to create something that is amazing, awesome, and great for everyone, they should make the appeal, we check the appeal, and only then are they able to push it," Doria told TechRadar.

The price of progress?

The debate around "surveillance chic" ultimately hinges on how we define innovation — and whether we are willing to trade our privacy for the latest style.

According to Doria, if 'moving fast and breaking things' compromises human safety, dignity, and life, then societal well-being must be prioritized over profit. "We have to start asking, what actually is this 'innovation,' who is it benefiting, and who is it leaving behind?”

Yet while lawmakers debate regulation and manufacturers introduce haphazard guardrails, the power remains with us.

Big Tech may control production and influencers may drive trends, but consumers hold the ultimate leverage: voting with our wallets to declare that our right to privacy is not for sale.

• US Senator Ron Wyden has asked the NSA to update its guidance on commercial VPNs
• Standard single-hop VPNs remain vulnerable to foreign bulk data traffic analysis, even with strong encryption
• Multi-server tools like Tor, Nym, and Apple iCloud Private Relay are highlighted as more effective alternatives

When it comes to basic digital hygiene, firing up the best VPN is widely considered the gold standard for protecting your data on public Wi-Fi or shielding your IP address from intrusive internet service providers. But when pitted against advanced state-sponsored surveillance, your standard commercial app might be falling drastically short.

US Senator Ron Wyden is now pressing the National Security Agency (NSA) to update its federal cybersecurity guidance, warning that everyday consumer VPNs do not offer sufficient protection against sophisticated foreign spying operations.

Relying on a newly released Congressional Research Service (CRS) memo, Wyden highlighted that foreign intelligence services can trace users through a technique known as "traffic analysis."

By matching the exact timing and volume of encrypted data entering and leaving a single VPN server, adversaries can piece together a user's web browsing activity, without ever breaking the underlying encryption.

"Americans facing advanced foreign threats, including government personnel, defense contractors, journalists, and human rights defenders, deserve clear, honest advice about how best to protect their communications from surveillance by foreign adversaries," Wyden wrote in his letter addressed to NSA Director Gen. Joshua M. Rudd.

NEW: Leave No Trace — A weekly newsletter on digital privacy and online surveillance.

Leave No Trace investigates the companies and governments putting our digital freedom at risk — and the people fighting back.

📩 Subscribe now to get every edition delivered to your inbox every Friday, launching this September.

The limits of standard encryption

Most consumer VPNs rely on a single-hop architecture, routing a user’s internet traffic through just one provider's server before sending it to its final destination. If an adversary is monitoring the internet backbone or compromises that specific server, they can easily connect the incoming and outgoing traffic dots.

The CRS memo makes the reality of bulk data collection painfully clear: "encryption strength alone does not protect users from an advanced, persistent threat conducting bulk data traffic collection."

Instead, the analysis points to multi-hop tools, such as the Tor Browser, NymVPN, and Apple iCloud Private Relay, as safer alternatives.

These technologies split a user's footprint across multiple servers, often in different jurisdictions, making traffic analysis significantly harder for eavesdroppers to execute.

Wyden has formally requested the NSA to clarify whether it recommends these multi-server systems over standard commercial VPNs.

A history of mounting VPN warnings

This is far from the first time lawmakers and cybersecurity experts have raised red flags regarding basic privacy tools. The tech community has issued numerous warnings about the false sense of security provided by subpar or improperly configured applications.

Last week, experts at Proton VPN warned that millions of consumers in the US are inadvertently putting their privacy at risk.

This risk multiplies exponentially for users chasing cost-free solutions. Despite the clear dangers, nearly 1 in 4 readers say they use free VPNs, tapping into a market saturated with apps that are largely not fit for purpose.

Tech giants and federal agencies have also increasingly sounded the alarm. Recently, Google had to issue security alerts warning that some VPN apps could be spyware in disguise, while cybersecurity researchers found that Apple and Google are still hosting hundreds of dangerous VPN links on their official app stores.

Even at the government level, authorities have urged extreme caution, with a US security agency previously urging Android and iPhone users to stop using personal VPNs on official devices.

As lawmakers continue to demand answers regarding whether American VPN users are at risk of warrantless government surveillance, Wyden's push for updated NSA guidelines arrives at a critical moment for digital privacy

• Utah’s SB 73 takes effect today, September 3, but ongoing legal challenges mean strict enforcement could remain paused.
• Anyone physically in Utah is legally treated as a resident, even if they use a VPN to mask their location, and websites face a $2,500 penalty per violation.
• Leading VPN providers confirm they will not change how their services operate in Utah, calling the legislation a "dangerous precedent" that fails to solve age assurance.

Utah has become ground zero for a major digital rights battle. Following months of intense legal wrangling, Utah’s Senate Bill 73 (SB 73) comes into effect today, September 3.

Originally scheduled for a May rollout, the law was temporarily paused following a court injunction. That initial pause has now expired, allowing the law to come into effect and making Utah the first US state to explicitly target VPN use for age verification mandates.

But the cybersecurity industry is warning that the legislation remains a convoluted, unenforceable mess.

As reported by Gizmodo, SB 73, formally known as the Online Age Verification Amendments, requires commercial websites hosting adult material to verify user ages.

The privacy concerns lie in how the state handles location spoofing: anyone physically located in Utah is legally treated as a Utah user, regardless of the IP address they present to a website.

This means if a resident of Salt Lake City connects to a VPN server in Germany, they are still a Utah user in the eyes of the law, and the website remains legally liable for verifying their age. If websites fail to comply, they face severe penalties reaching $2,500 per violation.

NEW: Leave No Trace — A weekly newsletter on digital privacy and online surveillance.

Leave No Trace investigates the companies and governments putting our digital freedom at risk — and the people fighting back.

📩 Subscribe now to get every edition delivered to your inbox every Friday, launching this September.

A "dangerous precedent" for privacy tools

To comply with the law, websites may be forced to use highly intrusive tracking measures or block all suspected VPN traffic. Furthermore, adult websites are now legally barred from publishing instructions on how to use a VPN to circumvent the state's age gates.

Digital rights groups have previously slammed the framework as an "impossible by design" waste of money that simply creates a technical whack-a-mole. This legislative push isn't happening in a vacuum, as authorities globally, including the EU, increasingly view VPNs as circumvention software that needs to be restricted.

However, some of the best VPNs are refusing to alter their services for Utah residents, noting that the legal burden falls entirely on website operators.

Speaking exclusively to TechRadar, Laura Tyrylyte, privacy advocate at NordVPN, clarified that the September 3 rollout is far from final. "The legal challenge to the law is still ongoing, so September 3 should not be treated as a set enforcement date. Depending on how things move, enforcement could remain paused while litigation continues," Tyrylyte explained.

"That said, SB 73 does not affect NordVPN directly as the law's obligations fall on websites that host content deemed harmful to minors, not on VPN providers," she continued. "However, the trend of rushed-out laws that are impossible to comply with is far from reassuring, and we will continue to advocate for approaches to child safety that don't sacrifice the cybersecurity and privacy tools that protect everyone."

AdGuard VPN has taken a similar stance. Denis Vyazovoy, Head of Products at AdGuard, confirmed to TechRadar that the company has no intention of restricting its local users.

“We don’t currently see Utah’s SB 73 as creating direct compliance obligations for VPN providers, so we don’t plan to change how AdGuard VPN works for users in Utah," Vyazovoy said. "More broadly, treating VPNs as a loophole in age-verification policy sets a dangerous precedent: VPNs are general-purpose privacy and security tools, and restricting them risks harming legitimate users without solving the underlying problem of age assurance.”

Gytis Malinauskas, Head of Legal at Surfshark, told TechRadar that Utah's SB 73 sets a concerning precedent. "In practice, it requires sites that host content deemed harmful to minors to block VPNs. This treats a core cybersecurity tool as a loophole. VPNs are a standard security tool millions of Americans use every day to protect their data. Blocking them would only erode the privacy of ordinary users," he said.

For now, everyday encryption remains completely legal in Utah. However, as the burden of proof shifts to website operators, users can expect to face significantly more invasive identity checks, or blanket blocklists, as companies attempt to navigate the new state rules.

• Russians consider VPNs an essential domestic utility, RKS Global says
• Community groups promoting shared use of VPNs are growing
• Users also rely on multiple VPNs to counter regular crackdowns

Russian citizens are increasingly viewing VPNs as a regular line item in their household bills as they create new forms of cooperation to counter censorship, a recent study by Eurasian digital rights organisation RKS Global has found.

Recent laws restricting internet freedoms, along with intensified crackdowns that recently disrupted dozens of circumvention tools, are turning the best VPNs into an essential domestic utility, as citizens treat their costs as essential as mobile internet and routine bills such as electricity and gas.

Against a backdrop of constant outages in Russia's mobile infrastructure — leaving the population in constant fear of unpredictable “digital darkness” — citizens are also banding together in solidarity groups to boost ways to circumvent the country's blocking measures.

NEW: Leave No Trace — A weekly newsletter on digital privacy and online surveillance.

Leave No Trace investigates the companies and governments putting our digital freedom at risk — and the people fighting back.

📩 Subscribe now to get every edition delivered to your inbox every Friday, launching this September.

A community-led approach

The study drew on focus groups made up of ordinary users, civic activists, and Amnezia VPN’s head of user support to analyse the online behaviour of VPN users in Russia and their attitudes towards censorship.

The findings suggest that people are forming a variety of small and large mutual-aid networks when making cybersecurity decisions, starting with which virtual private network (VPN) tool to use.

Furthermore, VPN users are happy to act as nodes to help spread the service, sharing keys with relatives and loved ones to create a shared infrastructure that connects multiple devices to a single VPN account and allows an entire family to access it.

Some have created cooperatives of dozens of people, connecting family members and personal contacts in exchange for a subscription fee that covers server costs.

Manzay Banzaev, founder of Amnezia VPN, tells TechRadar these solutions are indeed widely used by self-hosters who have set up their own VPN servers using its free open-source app.

"While using the application is becoming more difficult due to the specific challenges of operating in a region with a high level of attacks on VPN services, these users continue to make effective use of it, establishing a connection with the outside world not only for themselves but also for their loved ones," he adds.

A crumbling infrastructure

The study also highlighted a challenging scenario where users are forced to use several VPNs simultaneously, as they must be constantly prepared to switch from one service to another when one stops working.

It's becoming increasingly hard for users to understand if a block is caused by the government, an outage, a VPN malfunction, or general connection issues, leading to increasing frustration and a sense of degradation of the digital environment.

Banzaev, whose VPN recently improved its anti-censorship protocol against smarter censorship tactics, says: "The endless search for working tools, switching between them, periods of downtime and waiting for 'when everything will work again' are also becoming routine.”

He also notes the quality of telecoms services is getting worse while prices have increased by up to 40 per cent over the last couple of years. "All of this is having a significant impact on the expenses of Russian families who, regardless of all the restrictions and sanctions, wish to use foreign messaging apps, social media and content platforms, and are forced to pay for solutions that allow them to do so — in particular VPNs," he explains.

Despite this, informants confirmed that blocking is perceived as "universally negative" with users unwilling to give up circumventing it, and only a drastic tightening of the law — such as prison sentences for using a VPN — or the complete lifting of the blocks would attenuate its use.

In short, if the Russian authorities believe increased blocking and crackdowns on circumvention tools are being effective, they may not have realised they might be pushing users towards increasingly decentralised, community-run networks that are far harder to disrupt.

Felicia Anthonio first encountered the impact of internet shutdowns in 2017. While working as an intern tracking press freedom violations, she was prevented from verifying information on the ground or contacting people in the area when disruptions were imposed across Anglophone Cameroon.

Certain stories struck her particularly hard. "Most of the young technologists who were building their careers in this particular region had to leave the country," Anthonio told TechRadar.

Almost a decade later, Anthonio serves as the #KeepItOn global campaign manager at digital rights organization Access Now.

To mark the 10th anniversary of the coalition's work, the team has launched the "Sound of the Silenced" initiative. It features eight firsthand accounts from people across the globe, illustrating how shutdowns isolate communities and endanger lives.

From a teacher in Gaza left without news of her family after a bombing, to an activist in Myanmar forced to travel by motorbike just to find signal and call for help during an airstrike — the campaign highlights the devastating, multifaceted ways internet shutdowns harm communities around the world.

TechRadar spoke with Anthonio to look back at the coalition's decade of work and explore what the years ahead may have in store.

NEW: Leave No Trace — A weekly newsletter on digital privacy and online surveillance.

Leave No Trace investigates the companies and governments putting our digital freedom at risk — and the people fighting back.

📩 Subscribe now to get every edition delivered to your inbox every Friday, launching this September.

Defining an 'internet shutdown' — how the movement started

The #KeepItOn coalition’s first priority was establishing a definition for the worrying trend of governments deliberately disrupting citizens' internet access.

Before the campaign launched, human rights advocates had struggled to categorize these state actions, even as politicians realized their strategic power.

The first recorded shutdown occurred in Guinea in 2007, ordered by the president under the guise of "national security" to suppress protests over economic hardship.

Two years later, Iran adopted the same playbook to crush Green Movement protests following disputed elections in June. Then, in 2011, Egypt pulled the plug to suppress widespread protests against Hosni Mubarak’s regime.

Throughout these events, there were neither coordinated efforts to fight them nor a clear definition of what constituted an internet shutdown.

Activists knew this had to change.

In March 2016, at Access Now’s annual RightsCon conference in Silicon Valley, the organization brought together technologists, activists, and policymakers to draft the first official definition of an internet shutdown.

"An internet shutdown is an intentional disruption of internet or electronic communications, rendering them inaccessible or effectively unusable, for a specific population or within a location, often to exert control over the flow of information," reads the official definition.

The #KeepItOn campaign was officially born.

Global recognition and legal victories

Since its inception, the #KeepItOn coalition has secured key diplomatic victories.

In July 2016, the United Nations Human Rights Council adopted a landmark resolution denouncing internet shutdowns as direct violations of human rights — a commitment reinforced later that year by the African Commission on Human and Peoples' Rights.

These early victories laid the groundwork for a broader shift in how global institutions view digital blackouts. Crucially, the coalition's standardized definition of internet shutdowns and its Shutdown Tracker Optimization Project (STOP) database have been adopted by UN special rapporteurs, academic researchers, and major human rights groups to track violations, Anthonio explains.

Over the years, advocacy has translated into norm-shifting action. In 2025, lawmakers in Bangladesh proposed a formal ban on shutdowns, while the International Criminal Court (ICC) formally recognized the link between deliberate internet disruptions and crimes against humanity.

When diplomatic pressure has proven insufficient, the coalition has turned to strategic litigation to take governments to court — and won.

Notable victories include landmark rulings from the ECOWAS Community Court of Justice, which declared government-imposed internet shutdowns illegal in Togo, Senegal, Guinea, and Nigeria.

Campaigners have also harnessed "preventative diplomacy" to protect civic space by pushing governments to publicly commit to keeping the internet on — a tactic that appeared to pay off during Zambia's recent elections.

Perhaps most importantly, the group has expanded into a global coalition of over 370 local and international organizations spanning 106 countries, making it the "leading network fighting against internet shutdown worldwide," Antonio told TechRadar. .

Why internet shutdowns are becoming more frequent — and how to fight back

Despite these impressive international achievements, internet shutdowns show no sign of slowing down. Quite the opposite: incidents continue to rise year after year.

In fact, 2025 was the worst year on record for internet shutdowns, with Access Now recording at least one active blackout somewhere in the world every single day. In total, the coalition has documented more than 2,100 shutdowns across 100 countries since launching the campaign in 2016.

What explains this gap between growing international condemnation and increasingly aggressive state tactics? According to Anthonio, several factors are at play.

First, international frameworks are largely non-binding — meaning they lack immediate punitive consequences for states that violate digital rights.

Governments have also refined their tactics, shifting from total blackouts to targeted blocks on specific social media platforms and messaging apps — a less costly and often more politically palatable intervention for authorities.

But the coalition isn't backing down. "Real advocacy can be painstakingly slow. But as long as governments continue to violate human rights, we aren't also giving up, and we won't rest," Anthonio said.

At the same time, the global community of technologists building tools to help people navigate shutdowns and communication blackouts is growing.

A cornerstone of this technical resistance is the strategic partnership between campaigners and VPN providers. During critical moments like national elections — when governments frequently restrict access — the coalition collaborates directly with VPN providers to distribute free, secure access.

While virtual private networks (VPNs) are effective at evading platform-specific blocks, they are useless during total internet blackouts. This limitation has driven the creation of Bluetooth-enabled mesh messaging apps, such as Bridgefy, to try and keep local communication channels open offline. However they have certain limitations, too.

Access to censorship-resistant tools is only half the battle. That is why the coalition also conducts digital security workshops, teaching local communities how to secure their physical devices and communicate safely under heavy surveillance.

"In the absence of internet access, anything that enables you to communicate is a lifeline," Anthonio said, encouraging developers to release more open-source tools tailored to communities facing shutdowns.

Another decade of fighting internet shutdowns?

After ten years of #KeepItOn — and nine since she first witnessed the human toll of blackouts — Anthonio is clear about one thing: winning this fight may take another decade or more, but every victory along the way matters. However, achieving those wins requires a growing global coalition.

"Without tracking and accountability, the suppression would be far worse. But this fight requires collective efforts. There's no way civil society alone can do this," Anthonio said.

From tech giants, telecom operators, and governments to engineers and everyday citizens, she believes everyone has a role to play in preventing the normalization of digital blackouts.

That is the core message of the "Sound of the Silenced" initiative — encouraging people to ask themselves: What if this happened to me? How would an internet shutdown disrupt my life?

As Anthonio puts it: "As lives are more digitally interconnected, it should be everyone's hope to defend our rights online just as we defend them offline."

• Proton found 85% of VPNs on US app stores contain hidden trackers
• 64 of these apps actively track physical GPS locations
• Millions of US downloads are tied to apps funneling data to foreign entities

Millions of Americans use virtual private networks to shield their internet activity from prying eyes. But a massive new study reveals that many of the most popular privacy apps are doing the exact opposite.

According to Proton VPN's latest report, a staggering 85% of mobile VPN apps available on US app stores contain trackers designed to collect and share your data.

Instead of securing your connection, these rogue apps harvest incredibly sensitive information. This includes your unique device IDs, device models, network types, and mobile carrier data.

If you are on the hunt for the best VPN, this data serves as a harsh reminder that not all privacy tools are created equal. In June 2026 alone, Google and Apple allowed these suspect VPNs to be downloaded more than 13.2 million times.

The hidden foreign ownership problem

Proton’s research team analyzed more than 7,000 mobile VPN apps worldwide to uncover these privacy violations. Zooming in on the US market, they found that 64 out of the 390 available VPNs appeared to be owned by Chinese companies.

Worse still, the report says that 31 of those services actively conceal their true ownership behind shell companies based in places like Singapore, Hong Kong, and the UK. These Chinese-owned apps are incredibly popular, racking up more than 3 million US downloads in a single month.

Proton also found that VPN apps that funnel tracker data back to companies in Israel accounted for 2.6 million US downloads. Meanwhile, apps containing trackers sending data to China and Russia hit 1.5 million and 1.4 million downloads, respectively.

NEW: Leave No Trace — A weekly newsletter on digital privacy and online surveillance.

Leave No Trace investigates the companies and governments putting our digital freedom at risk — and the people fighting back.

📩 Subscribe now to get every edition delivered to your inbox every Friday, launching this September.

Location tracking and the worst offenders

Proton's researchers discovered that, in what Crawford deems "the ultimate act of betrayal," 64 VPN apps are actively tracking users' physical locations using GPS and other geolocation data.

This essentially builds a real-time map of your physical movements, completely shattering your anonymity. "Anyone with access to this data can see if you are at a protest or meeting with a journalist, lawyer, or source, and ultimately share that information with law enforcement or intelligence services," said Crawford.

Apps flagged for this behavior include popular services such as VPN Proxy Master, VPN-Fast VPN Super, and X-VPN. Together, these 64 location-tracking apps accounted for more than 3 million US downloads in June alone, representing roughly 20% of all VPN downloads in Proton's dataset.

TechRadar contacted the named providers for comments, but we were still waiting for a response at the time of publication.

David Peterson, Proton VPN General Manager, feels strongly that people looking to protect their privacy have the right to make an informed choice.

"People have the right to know if their personal information is being shared by their VPN, and with whom," he told TechRadar.

That's why Proton's deeper investigations into VPNs with a significant number of downloads are only at the beginning.

Peterson confirms to TechRadar that the team is currently tracking 7,500 VPNs. "We have data sets for the UK, France, and Germany, which we are looking to publish in the near future," he added.

How to stay safe in a sea of shady apps

This isn’t the first time we’ve seen major app stores flooded with dangerous software. TechRadar has previously reported on how Apple and Google are hosting hundreds of dangerous VPN links.

We also recently uncovered how thousands of iOS and Android VPNs are hiding behind fake websites and useless privacy policies.

To protect yourself, completely avoid free, ad-supported mobile VPNs from unknown developers. If a service is entirely free, there is a very high chance your data is the product being sold.

Always stick to reputable providers with transparent ownership. Look for VPNs that undergo strict, independent security audits to verify their no-logs claims, ensuring your browsing data remains entirely your own.

As incidents of women being harassed by people wearing smart glasses were making headlines, London-based mum and tech founder Liz Hunter could not help but watch in horror as fashionable Ray-Ban Meta glasses multiplied across city streets.

She went online to sign a petition calling for a ban on the technology. To her disbelief, she couldn’t find a single petition that reflected the scale of the outrage she was seeing online. So she decided to take matters into her own hands.

"I didn't want to just stand on the sidelines wringing my hands, because everyone just complaining to each other on LinkedIn isn't going to do anything. I wanted to build something to make that voice a little bit louder," Hunter told TechRadar.

Hunter decided to team up with teacher and privacy campaigner Guy Holder — who was behind a parliamentary petition calling for a sales ban on Meta’s wearables — and build a grassroots movement.

Last Friday, the Stop Smart Glasses campaign was officially launched with a clear goal: to pressure retailers and lawmakers to act before the technology is normalized.

But how exactly does Stop Smart Glasses plan to achieve this? And can social pressure be the key to breaking a legislative roadblock?

How to stop the rise of smart glasses

The idea behind the Stop Smart Glasses initiative is simple: harness the growing wave of UK venue bans to turn privacy concerns into public action.

Major pub chains like Wetherspoons — alongside courtrooms, theaters, and cinemas — have already responded to public backlash by banning smart glasses on their premises. "So, I thought, let's borrow a bit of that attitude," Hunter told us.

With the help of basic AI tools, Hunter built the campaign platform in just a week, despite having no coding background.

The website includes several tools to help people take practical action. A store finder enables visitors to locate local retailers across the UK and Ireland by entering their postcode, town, or city, and email them asking to stop selling smart glasses.

Similarly, users can contact local sports facilities and other venues, urging them to implement private property bans. The site even makes it easy to swamp the customer support inboxes of major national retailers or contact local MPs.

"Then obviously you can sign [Holder's] petition. We really hope that we see the numbers starting to snowball soon," Hunter said.

While the campaign's primary target is Meta's line of wearables, Hunter says the problem is much bigger. A quick Google search reveals that dozens of companies are already making smart glasses.

For Hunter, one principle isn't negotiable: cameras embedded in everyday items should not become a normal part of daily life. "An urgent public debate is needed and, whilst we wait for this to happen, these devices must be immediately banned," she writes on her website.

Smart glasses and the grand public privacy debate were discussed in our latest podcast episode. Check it out!

To ban or not to ban: why campaigners demand action on smart glasses

A backlash against Meta's wearables has intensified following a sharp rise in reports of women being secretly recorded in public spaces, with footage often posted online without their consent.

As reported by Futurism, TikTok is already flooded with teenage boys in the US using these glasses in schools to harass and bully girls.

For Hunter, the priority is avoiding a repeat of social media's early days, when new technology "raced ahead of regulation" with little concern for the potential downsides.

"We turn the page, and suddenly we're in an episode of Black Mirror," she said. "We don't want another damaged generation to be the evidence of [inaction]."

The problem with banning smart glasses, however, is that they also offer legitimate benefits. They enable real-time translation and hands-free controls — and, most importantly, empower visually impaired individuals to live more independently.

We previously reported that these factors make a complete UK sales ban unlikely.

While supporting the use of smart glasses for the disabled, Hunter strongly objects to trading general consumer convenience for public anonymity. "It's not worth the risk. You cannot ignore how quickly they have become a means to abuse and harass people," she said.

Ultimately, Hunter believes tech giants like Meta are using accessibility benefits as a PR shield to force public acceptance. "They nudge the door open with them, and then flood through to the mass market, which was their goal all along," she added.

When asked for comment, a Meta spokesperson stated that limiting access to this technology — which the company deems "critical" for the blind and low-vision community — "would be a major step backwards."

The spokesperson acknowledged that "some places shouldn't be filmed at all," but argued that "rules should be applied consistently." They also noted that the glasses feature an LED light indicating when a photo or video is being recorded—"something smartphones and other cameras don't have."

However, recent research suggests these lights fall short, with a study concluding that neither bystanders nor wearers "viewed LED indicators as adequate privacy protection." The research noted that many believe they are too small, easily overlooked in daylight, and simple to obstruct.

Users have also found ways to deactivate or cover the light, prompting Meta to release a patch that disables the camera if physical tampering with the capture LED is detected

NEW: Leave No Trace — A weekly newsletter on digital privacy and online surveillance.

Leave No Trace investigates the companies and governments putting our digital freedom at risk — and the people fighting back.

📩 Subscribe now to get every edition delivered to your inbox every Friday, launching this September.

The people vs. Big Tech: putting public pressure to the test

Stop Smart Glasses is now giving concerned citizens the tools they need to make their voices heard. But will that be enough?

In reality, online momentum rarely translates into actual legislative change. We saw this last year when a petition to repeal the UK Online Safety Act failed despite garnering over 450,000 signatures in just a few days

That said, public pressure does sometimes pay off — such as the 2014 Change.org petition that led to the abolition of the tax on sanitary products in 2021.

While viral petitions do not guarantee statutory changes, they can still trigger parliamentary debate. Real-world change takes time — time that, in the case of smart glasses, society may not have.

Despite the challenges, for Hunter, it's a no-brainer — lawmakers need to step in and regulate this market before any more societal harm is done. She believes this urgency can be driven by more public venues and retailers siding with citizens' concerns.

"I'm a real believer that people power can shift the needle," said Hunter, adding that the campaign wants to appeal directly to the new UK Prime Minister. "We want him to be brave enough to ban smart glasses."

Public pressure against smart glasses has shown signs of success elsewhere in Europe. In Norway, for example, the Ministry of Digitalisation announced tighter regulations on controversial features, while the Norwegian Consumer Council urged retailers to halt sales until regulations are settled.

Will the Stop Smart Glasses campaign foster a similar legislative push? That remains to be seen. But ultimately, the true strength of the campaign may lie in its refusal to remain a localized battle.

While currently focused on the UK and Ireland, the platform was fundamentally "built to go global," Hunter explains. The entire website's code is open-source to make it "easy to replicate" — a strategy that has already attracted interest from a US supporter looking to launch their own version.

What started as a local fight for privacy rights could soon turn into a global movement. Will you join?

• Surfshark's Cybersecurity Advocacy Fund offers up to €100K a year
• It's open to university groups, students, and faculties worldwide
• The first submission window opens in September 2026

Surfshark, one of the best VPN services, is now putting money behind the people it believes can help close the gap between online threats and public understanding. The company has launched a Cybersecurity Advocacy Fund worth up to €100,000 a year, aimed at students, researchers, and university groups.

The fund is designed to bridge academic research and real-world impact, pairing financial support with direct collaboration from Surfshark's in-house experts. Rather than funding its own products, it looks for ideas emerging from classrooms, labs, and creative spaces.

Scams have become one of the most common threats people face, and the fund's first cycle — which opens in September — arrives with anti-scam work named as a priority.

Why Surfshark is funding ideas outside its own walls

Cybersecurity threats are evolving faster than most people can keep up with, from phishing and data leaks to increasingly sophisticated scams.

The scale is hard to overstate: independent research from the Global Anti-Scam Alliance and Feedzai estimates that around $442 billion is lost to scams worldwide each year, while Norton's data points to nearly 174 scam attempts every second.

Surfshark argues that closing that awareness gap takes more than corporate solutions. The company describes the fund as "an investment in expertise that sits outside our own walls," according to Gabriele Sinkeviciute, its Head of Product.

The idea grew out of "Bot or Not?", a Malmö University student project that found nearly half of participants could not reliably tell bot-written comments from human ones.

NEW: Leave No Trace — A weekly newsletter on digital privacy and online surveillance.

Leave No Trace investigates the companies and governments putting our digital freedom at risk — and the people fighting back.

📩 Subscribe now to get every edition delivered to your inbox every Friday, launching this September.

How to apply to Surfshark Cybersecurity Advocacy Fund

To be eligible, applicants must be actively enrolled university students, employed faculty such as professors or researchers, or representatives of an officially recognized university group. Submissions are open worldwide, but pitches must be written in English.

The fund backs three types of work: creative advocacy, such as art installations or interactive campaigns that make digital threats tangible; academic research, including papers and studies on cybersecurity risks; and technological ideas, from prototypes to early-stage tools that Surfshark's experts can help refine.

Selected projects share in the annual pot of up to €100,000, which is distributed across multiple initiatives rather than handed to a single winner. Beyond money, teams gain technical guidance, industry insight, and support throughout development.

The fund runs in two cycles a year. September submissions are reviewed during an October selection period, and February submissions during a March one. Each window stays open for the full month, with the first cycle opening in September 2026.

Every pitch is reviewed by several Surfshark experts against four criteria: relevance to cybersecurity awareness, clarity of the proposal, originality of the approach, and potential impact.

Applicants should read the full terms and conditions before submitting, then pitch their project by email to advocacyfund@surfshark.com.

The fund follows other Surfshark advocacy efforts, including partnerships with Amnesty International and Internews.

• Amenzia WG 3.0 updates the VPN’s WireGuard protocol to evade detection
• Amnezia VPN aims to keep the internet accessible in censored regions
• The upgrade should make the protocol undetectable to Russian censors

Amnezia has updated its anti-censorship protocol, AmneziaWG, as it continues its relentless fight to circumvent the Russian government’s increasingly sophisticated internet censorship systems.

AmenziaWG 3.0 introduces greater variability in traffic patterns, making the VPN even harder to detect.

It comes in response to recent large-scale coordinated attacks launched by Russian authorities, which revealed new methods implemented by the state for detecting and blocking VPN infrastructure, Amnezia VPN said.

Although the new wave of government censorship has hindered access to dozens of circumvention tools, this has not deterred Amnezia from tirelessly improving its service. Instead, its resilience lets it stay one step ahead of Russian attacks, demonstrating its commitment to providing one of the best VPNs for effectively countering censorship.

The new AmneziaWG protocol is included in the VPN’s Premium and Free packages as v3.0, as well as for Self-hosted users as v3.1.

Always prepared for the worst

Originally developed as a fork of the WireGuard protocol, AmneziaWG continues to build on this solid foundation, but with an update to its technical architecture to mask the overall traffic profile throughout the entire connection.

While previous versions of AmneziaWG focused on obscuring specific, individual protocol signatures that could indicate a VPN connection, this update aims to alter the overall connection profile to evade signature-based detection methods, focusing instead on the operation of the protocol’s TSPU, the primary traffic filtering tool.

According to Amnezia’s team, the Russian government recently targeted Amnezia's servers by using combined parameters — including packet size and sequence, inter-packet arrival times, handshake patterns, and traffic volume — to identify VPN traffic.

Its protocol was detected because the collective behavior of a large number of users employing the same protocol created identifiable patterns. The numbers are truly staggering: as Mazay Banzaev, founder of Amnezia, noted, Microsoft's data indicates that the protocol has been installed more than 15 million times on Windows, significantly increasing the likelihood of detection.

The update eliminates predictable patterns during the handshake phase by varying packet sizes, sequences, and intervals, so that, in essence, each connection is different from all others without altering the data transmitted — regardless of the number of users using the protocol simultaneously.

NEW: Leave No Trace — A weekly newsletter on digital privacy and online surveillance.

Leave No Trace investigates the companies and governments putting our digital freedom at risk — and the people fighting back.

📩 Subscribe now to get every edition delivered to your inbox every Friday, launching this September.

Censorship continues to grow

While Russians are rapidly turning to VPN services, the Kremlin’s censorship tactics continue to intensify, with attacks becoming increasingly frequent.

On August 4, a new crackdown by the government blocked access to more than 20 widely used services, with the scale of the attack suggesting that the Russian communications regulator, Roskomnadzor, is resorting to more sophisticated methods to disconnect the country’s vital digital arteries.

Words such as "the largest in history" have been used to describe these repressive measures, underscoring the severity of the current state of censorship in Russia. The exact scale of the latest disruption, however, remains difficult to quantify according to anti-censorship organisations.

These repressive measures are making it increasingly difficult for citizens to connect to the free Internet, proving that Russians need a VPN even to access Google and Apple services.

Although Amnezia VPN — which recently upgraded its apps to counter Russia's new strategy for blocking VPNs — stated on this occasion that its service was "working reliably" in Russia, the provider had previously restored its premium service in the country following a devastating state-sponsored cyberattack that lasted a month and a half and had caused the system to shut down completely.

Last month, the anti-censorship provider also strengthened its blocking capabilities with a 'mandatory update' for Premium and Free users.

• Surfshark found that Meta's apps declared the most data types on average
• The seven hungriest apps in the study were all Meta-owned
• The figures come from developers' own App Store privacy labels

A new study from Surfshark has put a hard number on something privacy watchers have long suspected: among the biggest names in tech, Meta's apps are the hungriest for your personal data.

Of the 12 Meta apps included in the study, an average of 25 out of the possible 35 data types were collected.

That is more than three times as much as Microsoft and Apple gather on average, according to the research. The company's apps sit far ahead of the pack, and the gap is stark enough that Surfshark's team argues it reflects a purposeful choice rather than a technical necessity.

No amount of privacy tooling, not even the best VPN, can claw back information you consent to hand over when signing into a service. This makes knowing which apps take the most a useful first step in guarding your privacy.

Meta leads the pack, but Google is everywhere

Surfshark's researchers examined 171 apps in the Apple App Store, split across Google (44), Apple (41), Microsoft (40), Amazon (34), and Meta (12), and counted how many of the 35 data categories each developer self-reports collecting.

Meta came out on top by a distance. Its apps collect 25 data types on average, ahead of Google (17), Amazon (12), Microsoft (8), and Apple (7).

The gap widens at the extremes: the seven most data-hungry apps all belong to Meta, led by Meta AI on 33 data types, followed by Meta Horizon, Meta Business Suite, Meta Ads Manager, Messenger, Forum, and Facebook on 32 each.

This echoes an earlier finding that Meta's Messenger collects 32 of a possible 35 data types, nearly double the messaging-app average.

Google's story is about scale rather than intensity. It accounted for 29 of the 40 apps declaring the broadest data collection, though it was also overrepresented in the sample with 44 apps.

Even where individual Google apps collect less than Meta's, their sheer spread paints a wide picture of your activity.

At the other end, Microsoft and Apple were consistently the tamest, with Safari the only Apple app in the study to log browsing history.

What it means for your privacy

The concern is not any single app, but what happens when the data is stitched together.

Surfshark research lead Dr Luis Costa said the Big Tech business model is often built on an "insatiable appetite" for user information, weaving search history, purchases, and location into a detailed map of your life. Crucially, Meta ties this data directly to your identity, fuelling hyper-targeted ads.

Costa argues that collecting triple the data for the same tasks proves that this level of tracking is deliberate, not required. Meta's tracking has drawn scrutiny before, from WhatsApp's metadata trail to Facebook's Link History feature.

If you would rather not feed the machine, disabling precise location and your device advertising ID is a sensible place to start.

How to stay safe

As Costa puts it, "awareness is the only effective defense when a familiar voice or face can no longer be trusted implicitly".

For personal calls and messages, he suggests setting up a family "safe word" you can use with loved ones to confirm identity when a request feels urgent or out of character.

On video calls, a "glitch test" can help too. Ask the other person to wave a hand in front of their face, as deepfakes often blur or distort when facial features are obscured.

TechRadar has more advice on catching convincing AI images and deepfakes if you want to sharpen your eye.

• Researchers found banking malware requests VPN permissions to block Google Play and Play Protect on infected Android phones
• ToxicPanda 2.0 bypasses security to install hidden payloads, targeting 349 banking and crypto apps across 16 countries
• The malware can even seize shell-level control of a device

Security researchers have flagged a new twist in Android banking malware: a trojan that turns your phone's own VPN feature against you.

A report from mobile security firm Zimperium details how ToxicPanda 2.0 abuses VPN permissions to shut down Google's built-in protections before it strikes.

The tactic is effective because it hides in plain sight. Plenty of legitimate apps ask for VPN access, and even the best VPN apps rely on the same underlying permission to route your traffic. ToxicPanda copies that request, but uses the access to cut your phone off from Google Play instead.

Once Google Play Protect can no longer reach the device, the malware has a clear runway to install its payload and begin harvesting your data.

How ToxicPanda uses VPN permissions to blind Google Play

ToxicPanda operates as a "dropper," an app that smuggles in a second, hidden program. According to Zimperium researchers, the malware first shows a fake installation screen and prompts the victim to grant VPN permissions. That request looks routine, so many users tap "allow" without a second thought.

Granting it lets ToxicPanda create a local network interface that sits between the phone and the internet, giving the malware control over all traffic passing through the device. It immediately uses that control to block communication with Google Play and Google Play Services.

Cutting off this connection lets the malware interfere with app verifications, updates, and Play Protect, the security layer that would normally flag or remove a harmful app. With Google effectively blindfolded, ToxicPanda decrypts a payload hidden in its own files, installs it, and then asks for Accessibility Service permissions to dig deeper.

This release is a major escalation from the previous ToxicPanda iteration.

As Zimperium says, ToxicPanda 2.0 now supports 167 remote commands. It can also overlay fake login screens on 349 banking, e-wallet, and crypto apps across 16 countries, up from just 16 apps previously. A separate module harvests PINs from more than 140 financial apps using invisible overlays that capture your taps.

The trojan can also spoof your Android lock screen to steal your PIN, pattern, or password, and it abuses Android's Wireless Debugging (ADB) feature to gain shell-level access and grant itself permissions without prompts.

ToxicPanda first appeared in 2024, targeting European banks. Other similar malware such as Rokarolla, has also hit hundreds of banking and crypto apps in recent months.

How to stay safe

The strongest defense is to keep the malware off your phone in the first place.

Only install apps from the official Google Play Store, and avoid sideloading APK files from links, ads, or third-party sites. Be aware that dangerous VPN links have even slipped into official app stores, so treat any surprise VPN prompt with suspicion.

A legitimate VPN remains a valuable privacy tool, but this campaign is a reminder that the permission itself is powerful, so grant it only to apps you genuinely trust.

• Windscribe's AI-generated ad featuring Adolf Hitler has sparked massive backlash online
• Some users have threatened to cancel their VPN subscriptions over the marketing stunt
• The controversy has also shone a spotlight on the company's use of AI for support, code, and testing

UPDATE: Windscribe's CEO shares some comments with TechRadar after publication. We are making some small edits to the copy to reflect this.

A highly controversial marketing stunt has landed Windscribe in the center of a massive online storm, with furious users taking to social media to declare they are canceling their subscriptions.

The provider, frequently evaluated in discussions for the best VPN services, is facing intense scrutiny after posting a bizarre, AI-generated advertisement featuring Adolf Hitler to its official X account.

In a bid for edgy humor that has spectacularly misfired, the video was immediately slammed by privacy advocates and customers, who were left stunned by the decision to use the infamous dictator to promote a digital privacy tool. The backlash swiftly migrated to Reddit, where threads condemning the video garnered thousands of upvotes within hours.

Replying to TechRadar's request for comment, Windscribe's CEO, Yegor Sak, said the intent of the video was "to mock authoritarianism and censorship in an absurd way" instead.

"Users choose us because we are independent, blunt, privacy-focused, and willing to say things most companies will not. That approach will not land perfectly every time, but the alternative is becoming another corporate VPN with safe posts, vague values, and nothing real to say. That is not us," said Sak.

The outrage didn't stop at the marketing misstep, though. It also reignited debates over the security implications of Windscribe's public admission that it uses artificial intelligence to handle customer support, write code, and conduct testing.

Commenting on this, Sak confirms that AI is simply a tool and real people are still accountable for production work.

"We have also continued growing the team while adopting AI," Sak added. "If AI was a replacement strategy, headcount would be moving the other way. For us, the point is to stop wasting humans on repetitive work so they can do the things AI cannot."

"A line crossed too far"

The outrage on platforms like Reddit's r/Windscribe and r/Piracy has been palpable, with users expressing total disbelief. One user summed up the collective shock, stating, "I just canceled my subscription."

Another user criticized the brand's attempt at adopting an overly casual, shock-jock persona, writing: "One could argue this is normal since Windscribe has always been edgy with their emails and April Fools' gags, but straight up using Hitler is a line crossed too far."

Other users were even more direct, questioning the recent trend of bizarre behavior from VPN providers. "What's with these VPN companies doing this nonsense lately," one commenter noted.

For many, the misstep isn't just a simple mistake but proof that shock-value advertising can easily alienate a core audience relying on these tools for safety.

The AI security elephant in the room

The Hitler video isn't the only issue causing subscribers to hit the cancel button. Screenshots circulating alongside the controversial ad show Windscribe openly discussing its extensive use of artificial intelligence in day-to-day operations.

The company publicly confirmed that its support, coding, and testing are handled by AI.

While integrating artificial intelligence tools is becoming standard practice across the software industry, virtual private network (VPN) users are notoriously protective of their data.

A service designed to encrypt sensitive information and hide digital footprints requires bulletproof cybersecurity practices. The idea that a company's core infrastructure or testing protocols might rely too much on AI has led to understandable anxiety. Bragging about AI while simultaneously botching a PR stunt doesn't inspire confidence.

For now, Windscribe's attempts to go viral have succeeded, but entirely for the wrong reasons. Until the company addresses the community's concerns, its reputation as a reliable guardian of online privacy remains under a heavy cloud.

• NordVPN found a malware campaign impersonating 65 brands
• It tricks victims into clicking on messages requesting urgent action
• If you use an Android phone, it’s worth checking your apps

Summer is still in full swing with many people out enjoying their holidays. Unfortunately, cybercriminals never stop trying to steal money by tricking people into believing they are on trustworthy websites or using legitimate apps — especially when our attention is more likely to wander.

That’s what NordVPN, the pinnacle of the best VPNs, recently investigated, issuing an alert urging caution over a widespread and sophisticated malware campaign targeting Android users through highly convincing phishing schemes.

The malware is posing as over 65 well-known brands, including Ryanair, Emirates, and Qatar Airways, as well as tax authorities, registry offices, and social security systems that lure you into downloading their apps.

The dangerous trojan tracks your messages and logins, spies on you through your camera, records your voice, and bypasses two-factor authentication before ultimately draining your bank account.

The campaign has targeted users in Southeast Asia, Latin America, and Africa.

What the research found

NordVPN spent the last 12 months investigating the malware campaign — including its infrastructure and impersonation targets — analysing malware clusters and mapping more than 100 domains linked to the campaign.

It discovered that the campaign tricks users into installing an app that grants full access to their Android phones or computers by impersonating highly trustworthy companies — brands people are accustomed to providing their personal data without questioning it.

Victims are lured by a variety of requests via SMS, WhatsApp, or social media that look totally innocuous, like a job opening at an airline, a cheap flight, or a tax refund.

Once installed, the Trojan runs quietly in the background and stays active even if the phone is restarted, accessing your messages and call logs, capturing the screen, recording audio, and accessing the camera.

Attackers can even log into the victim's banking app and approve transactions themselves by using SMS interception to steal your money, as most banks implement two-factor authentication through one-time codes sent by text.

Marijus Briedis, chief technology officer at NordVPN, says: "One install, and the phone is no longer yours. The attacker sees your screen, reads your SMS codes, and empties your accounts from the inside."

Trusted brands are often the most spoofed brands in phishing scams, alongside other malware 'tricks' to gain trust, such as multi-platform PR campaigns promoting malware as legitimate software, or even Chrome extensions impersonating VPNs.

However, unlike many opportunistic phishing attempts, these attacks have been particularly hard to spot, featuring extremely accurate replicas of legitimate websites, meticulously copied and professionally translated.

How to stay safe

Briedis advises Android users to be very careful not to install apps from links received via text message. "Real airlines, banks and government bodies distribute apps through Google Play, not SMS or WhatsApp," he stresses.

As with other AI impersonating scams, users should treat any urgent request as a warning sign: whenever there is mention of a refund or an account being blocked, check the source carefully before clicking on anything or taking any action.

Checking that a website is legitimate and does not operate from domains ending in .cc, .lol, .xyz, .mom, or .pw will be a clear safety indicator.

Furthermore, do not rely on 'the padlock icon': an HTTPS connection merely indicates that the connection is encrypted, not that the site is genuine.

If you suspect that a suspicious app is already on your phone, disconnect your phone from the internet, uninstall the app, change your password from another device, and contact your bank: this will ensure you’re back in the clear.

And remember that if even the current UK Prime Minister can be a scam target, perhaps you should remain vigilant too.

Pubs, restaurants, theatres, private clubs, and courtrooms — these are the venues where Meta’s nicknamed "pervert glasses" have already been banned across the UK. But could a wider blockade be soon to follow?

First landing on the British market in October 2023, the Ray-Ban Meta smart glasses have been facing a growing backlash across the country. The force behind it isn't tech skepticism, but a privacy crisis driven by non-consensual public recording, voyeurism, and third-party data processing.

With activist groups hacking London billboards, venue bans and calls for a complete Meta glasses sales embargo, the public is now viewing these AI spectacles as 'surveillance tech' tools rather than fun futuristic accessories. There may, eventually, be an appetite for a nationwide prohibition of these kinds of smart glasses both in public spaces as well as private ones.

But could a statutory ban on Meta AI glasses even be a legally feasible option for UK lawmakers? And is it really what’s needed to clamp down on misuse and protect the public’s privacy?

Meta AI glasses: what's the privacy problem?

The smart glasses market isn’t exclusive to Meta, nor any intelligent eyewear with a built-in camera. Zuckerberg’s wearables are, however, the best known and the most controversial — and for several reasons.

While other smart glasses are visually bulky and obvious, a pair of Ray-Ban Metas look like regular specs. That’s despite their frames coming packed with dual cameras, open-ear speakers, a microphone, and touch controls.

Meta glasses are designed for hands-free control. Users simply say "Hey Meta" to activate the built-in AI — and allow them to directly stream audio, record photos, videos, and broadcast live to social media.

This last set of skills is the one that’s of particular concern. Women have increasingly reported being secretly filmed, with the footage often ending up online without their consent.

Meta points out that the glasses come with an LED light that activates every time someone is recording or taking a photo. But the LED's small size has cast doubts as to whether it’s enough for people to realise they're being taped. Plus, some users have already found ways to deactivate it — something that prompted the company to release an emergency patch last July.

There's also the problem of how Meta may process this sensitive data. We should not forget, in fact, that Meta is the most data-hungry company there is — a record recently confirmed by the latest study from VPN service provider Surfshark.

Worse still, Meta explicitly states on its website that "all photos processed with AI are stored and used to improve Meta products, and will be used to train Meta’s AI with help from trained reviewers."

So, without even consenting, you might have been posted online for millions to view while Meta potentially profits from your image, your voice and your behaviour and, to some degree, duplicates parts of your identity.

But the final straw came this summer, when Kylie Jenner became the new face of Meta glasses. A move seen by privacy advocates as a cynical way to rehabilitate the image of the product, the campaign deliberately featured women using the wearables to make them socially acceptable.

Meta's marketing move didn't exactly pay off, though. In the UK, groups like Everyone Hates Elon have started a guerrilla-style campaign across London to raise awareness among citizens. The group even launched a legal complaint to help Brits object to being filmed with AI glasses under UK data protection legislation.

But what exactly are our rights when it comes to public ambient recording?

Smart glasses and the grand public privacy debate were discussed in our latest podcast episode. Check it out!

The UK regulatory gap: What the law on smart glasses actually says

Alongside Courts in England and Wales, private venues have reacted to the Meta glasses privacy backlash by banning their use within their premises. Rather than waiting for slow-moving national legislation, they decided to create their own set of rules, but these rules end at their front doors.

In public places, such as streets, squares, or city parks, the current laws are more complicated. Ambient recording falls into a large grey area. The laws can regulate more serious public offences like harassment, stalking and voyeurism but, short of that, the lines between what’s legal and what isn’t are blurry at best.

As Nick Phillips, a UK lawyer specializing in data protection and technology law, explains, public recording is not inherently unlawful. "The problem comes about in terms of what you do with that recording," he told TechRadar.

NEW: Leave No Trace — A weekly newsletter on digital privacy and online surveillance.

Leave No Trace investigates the companies and governments putting our digital freedom at risk — and the people fighting back.

📩 Subscribe now to get every edition delivered to your inbox every Friday, launching this September.

When you record strangers in public, you are de facto collecting personal data. And while data protection laws do not apply to purely domestic or social filming — creating what Phillips calls a "loophole" for casual users of smart glasses — this exemption falls away the moment recorded individuals are identifiable by their face, voice, gait, location, or background conversation.

This means any casual user filming strangers in public places can easily trigger the UK General Data Protection Regulation (GDPR), requiring them to satisfy core privacy principles such as fairness — the recorded footage must be fair to the people being recorded — and transparency — the person recording needs to be transparent about it.

If a wearer uses the glasses for commercial or business purposes (such as an influencer or a company), they are classified as 'data controllers' and have additional obligations under GDPR. This includes that they cannot use footage of strangers in public for commercial advertisements without permission, or film in places with an expectation of privacy.

And things get further complicated when it comes to exercising individual data rights. This is what data protection and human rights barrister Frederick Powell refers to as an "enforcement gap". It’s the gap between the rights recognized by law and a victim's ability to actually assert them.

Bystanders captured by smart glasses face a massive transparency issue because the device is incredibly discreet and they often don't realise they are being recorded. Plus, once a video is online, it is incredibly difficult to have it removed, or stop the footage from being downloaded and redistributed.

And with incidents of Meta glasses misuse becoming more of a hot topic in the public eye, lawmakers are now faced with the challenge of readjusting the balance between public safety and consumer rights, with a new technology now tipping the scales. So, could a statutory, nationwide ban on Meta AI glasses be the government's next step?

Theoretically, Parliament could pass a law to enact a full ban. "But that's very unlikely," Phillips told me. An outright ban would be perceived as overly restrictive. More importantly, according to Phillips, a ban would be at odds with how the UK government typically approaches tech regulation.

It’s also worth remembering that Meta and other smart glasses have plenty of positive uses — especially for visually impaired people.

What's more, the real issue isn't with the Meta AI glasses themselves, but rather with the covert nature of their use. "And that, to my mind, isn’t really something you can easily legislate for," Phillips said.

Could policymakers instead, then, extend the Online Safety Act's 'duty of care' obligations to introduce design obligations for manufacturers? Possibly, but it’s still difficult, according to Phillips.

Are Meta glasses really worse than your smartphone?

Real-time translation, assistance for low-vision users, hands-free commands, and content creation — when you view smart glasses through a different lens, it's clear that Meta AI's latest gadget is a legitimate piece of tech that can bring plenty of benefits to those wearing them.

So, why should we even want or expect governments to take legislative measures against them? After all, smartphones can also be used to secretly record strangers. Well, the matter appears to be more complex than that.

During a recent interview, a Boston University professor in privacy and technology law, Woodrow Hartzog, didn’t mince his words when he dismantled this narrative.

According to Hartzog, smart glasses are problematic because they challenge "our whole social fabric." Unlike when we see a phone pointing at us, we don't assume we’re being recorded when looking at someone wearing a pair of glasses.

Covert cameras have, of course, existed for years already, so surely Meta can’t be to blame for the issue? But Hartzog argues that these glasses in fact make privacy transgressions not only a lot easier to execute, but also even encourage it.

"If you make a really harmful — but to a certain group of people desirable — practice easier to do, they're going to do a lot more of it," Hartzog told reporters.

The risks escalate with facial recognition. A June investigation by Wired revealed that Meta silently added a facial recognition system ("NameTag") into its platform, capable of converting captured faces into unique biometric "faceprints" to match against phone data.

Although Meta was quick to delete the code following a backlash, the concept remains active. The company has since filed a patent for a camera system designed to automatically identify people in the frame. Digital rights experts warn that if such technology is deployed, it could end public anonymity entirely.

Worse still, even if Meta abandons these features, malicious users can build them independently. In 2024, two Harvard students, AnhPhu Nguyen and Caine Ardayfio, demonstrated this real-world danger using Ray-Ban Meta glasses and publicly available tech. Simply by walking past people while wearing the glasses, they instantly accessed private details, including names, addresses, and family information.

It seems then that Meta AI glasses have not just replicated the existing privacy risks of smartphones — they’ve multiplied them.

Could social stigma be enough to end Meta glasses misuse?

We are rapidly approaching a crossroads where ambient recording slips past our legal field of view and into our daily lives. The public privacy laws in place worked fine in the days of SLRs and compact cameras and managed ok once camera phones became ubiquitous, but they’re struggling to be fit for purpose as recording devices become even further camouflaged.

If governments can’t or won’t legislate, then will it come down to social pressure to keep smart glasses in check?

It happened in the past with Google Glass. That venture lasted just nine months before the Big Tech giant was forced to halt consumer sales following heavy concern from the public.

But it isn't 2015 anymore, and those clunky AR specs of the last decade have become so svelte that they’ve now been subsumed by fashion brands like Ray-Ban and Oakley. They’re on the brink of looking normal and could very soon disappear from sight altogether.

Today’s consumer tech industry has 20-20 vision on the subject. They see a world of omnipresent lenses built upon the promise of making our hardware interactions effortless. Google knows it too and has decided to bet on built-in cameras in intelligent glasses once again, with two models entering the market soon.

And while not all built-in cameras may carry the same risk — Apple’s rumored earbuds with built-in cameras don’t allow users to record video or take pictures, for example — data collection is set to increase, and with it more potential privacy problems.

At this point, we need to ask ourselves: are we ready to live in a digital panopticon where everything we look at can be used to profile us, train AI systems, or erode our public anonymity?

For most, the answer is probably no, but we wouldn't have chosen our obsession with smartphones either if we could have stopped what was coming. Money talks, and what Big Tech wants, Big Tech gets. After all, we're still sitting here, scrolling, aren’t we?

And while many bemoan government intervention on subjects like social media or adult content bans, legislation might be the only thing that can truly save us.

• ExpressVPN and the IWF warn against the danger of 'sharenting'
• 56% of kids feel parents overlook their privacy concerns, research reveals
• Ahead of back-to-school, parents are urged to rethink their online habits

As millions of students head back to the classroom, social media feeds are inevitably flooding with proud first-day-of-school photos. But cybersecurity experts are urging parents to rethink their posting habits, warning that innocent images are increasingly being scraped and manipulated by malicious actors.

While families are often quick to warn kids about talking to strangers and using strong passwords, adults routinely post their children's names, faces, school uniforms, and birthdays with little of the same scrutiny — a phenomenon known as sharenting.

Now, ExpressVPN — the provider behind one of the best VPNs on the market — has partnered with the Internet Watch Foundation (IWF) to sound the alarm on the modern risks of public photo sharing.

The hidden dangers of 'sharenting'

The core concern revolves around the rapid rise of AI "nudification" tools. These easily accessible programs make it trivially simple for criminals to manipulate an ordinary photo.

In July, the National Crime Agency and the IWF explicitly warned that AI is being used to harvest everyday photos — including images lifted directly from public school websites — to generate child sexual abuse material.

IWF CEO Kerry Smith stressed the gravity of the situation, deeming it "deeply sad" that parents need to refrain from sharing important family moments because of the risk that those images could be exploited by criminals.

Yet, "Tackling this requires a collective response — from families, government, technology platforms and society as a whole — to better protect children online.”

ExpressVPN already collaborates with the IWF to combat this material, blocking access across its network to web domains confirmed by the IWF to host it.

However, experts argue the first line of defense happens much earlier: before a photo is ever uploaded. A school crest on a jumper, a street sign in the background, or a pet's name can all be used to identify a child, locate them, or bypass their digital security questions within hours of a post going live.

NEW: Leave No Trace — A weekly newsletter on digital privacy and online surveillance.

Leave No Trace investigates the companies and governments putting our digital freedom at risk — and the people fighting back.

📩 Subscribe now to get every edition delivered to your inbox every Friday, launching this September.

Setting a new family standard for digital privacy

New YouGov research commissioned by the VPN Trust Initiative reveals a stark disconnect in household privacy.

While 77% of parents worry about their child's online privacy, the worry isn't one-sided: 56% of children say they are concerned about their own privacy. Yet, the decision of what actually gets posted is largely dominated by the adults, frequently without the child's say-so.

This practice is telling, considering that, as Dr. Pete Membrey, Chief Research Officer at ExpressVPN, points out, children learn privacy from the choices the parents make.

"A parent who asks before posting, explains who will see a photo, and accepts the answer is teaching consent far better than any lecture about being careful online," said Membrey, warning that "Back to school is when the photos go up fastest, so it's the moment to set that standard."

Membrey suggests families start the school year with a collaborative conversation, answering six key questions:

• What are we each comfortable sharing about one another?
• Which family details should stay out of public posts?
• Who can currently see our profiles and locations?
• Which new apps, accounts or online groups have appeared this year?
• What will happen when someone receives unwanted contact or shares something they regret?
• Which privacy decisions is the child ready to manage independently now?

"Sharing our children's milestones comes from a good place, and no parent should feel bad about it," Membrey added. "The small shift that helps is treating our own posts with the same care we'd want our children to use one day."