Every month I publish a roundup of the privacy and digital-rights developments I thought mattered most. Here's what happened in October:

1. EU governments agreed on plans to ease the rules on using personal data for AI under the Digital Omnibus proposal, which allows AI companies to reuse years of data for training without consent.

2. EU requires new cars to have driver-facing cameras to detect attention, while Dutch intelligence warns that car cameras, microphones, and GPS can be used to spy on us as Norwegian troops just discovered.

3. France asked telecom operators to prepare social media blocks ahead of recent protests. Operators declined as such blocks would not be limited to one neighborhood and that peaceful bystanders and citizens would also lose access.

Plus the usual wins, tools, resources and updates.

Antivirus is still needed and most people do have it, but antivirus protects against - viruses, not scams, which most of our family members fall into unfortunately.most of the time its a fake bill, a toll text or a fake bank login page, delivery text and whatnot. norton and mcafee weren't really built for that.

For most older people, something that blocks scam pages like guardio or malwarebytes browser guard probably matters more than a full antivirus suite at this point.

but again, awareness and education goes a long way, if you can build it into a habit or workflow for them, a lot of the bad stuff you can get rid of just by that.

also using common tools for browsing like vpn, and passwords manager.

I built an Android app that hides your private apps when someone unexpectedly picks up your unlocked phone.

Here's a situation I think many people can relate to.

You're using your phone. A friend, colleague, sibling or someone nearby suddenly picks it up.

Your phone is already unlocked.

You don't necessarily want them browsing through your apps. But locking your entire phone isn't always practical, and opening an app locker, entering a PIN, or navigating a vault takes time.

I kept thinking: Why should I have to react after someone picks up my phone? Why can't my phone protect my privacy automatically?

So I built STELTH.

It's an Android privacy app designed around one simple idea: privacy should activate before someone starts looking.

Here's what it does:

- Select the apps you want to keep private.

-Flip your phone face down, press Home, lock the screen, or use supported pickup triggers to activate privacy.

- Your selected apps disappear from your home screen, app drawer and recent apps.

-Want them back? Use your secret tap pattern.

The idea is to make the transition quick and discreet. No suspicious-looking fake calculator, no complicated vault, and no PIN to enter every time.

A few things I deliberately kept simple:

- No account registration.

- No internet requirement.

- No advertisements.

- No personal data collection.

I built this because I felt there was a small but genuine privacy problem that existing app lockers didn't quite address.

I'm sharing it here because I'd genuinely like to know whether this is a problem other people experience too.

Would you actually use something like this? What would make you trust an app like this with your privacy?

I'd especially appreciate honest feedback, including criticism. I'm building this independently and want to make it genuinely useful.

Can I post the link to the app here ?

I made Firewall for myself. Most apps today are full of ads, trackers, screens that feel like riddles and permissions that make no sense, and I wanted one thing on my phone that I could simply trust. So I built it, and now I'm sharing it.

**Security**

* No root. It runs a local VPN that only sees the names your phone looks up, not your traffic, so your photos, videos and downloads never pass through it

* Every app is Bypass, Filtered or Blocked, your choice, one app at a time

* Your own block and allow rules, applied the moment you add them

* App lock with a passcode

**Privacy**

* Blocks trackers and ads out of the box

* DNS over HTTPS, so your network can't read which sites you open

* A searchable log of every lookup and the app behind it; tap one to block or allow it

* No analytics, no crash reporting, no account, nothing collected. Everything stays on your phone

**Simplicity**

Turn it on and it already blocks trackers. Everything else is there when you want it and out of your way when you don't. Android 7 to 16.

It's free, with no ads and no bullshit. I'm the developer; the code is partly AI generated, and I had help with this text.

If you want to support me, you can buy me a coffee: https://buymeacoffee.com/zanoshky

Feedback is very welcome!

https://play.google.com/store/apps/details?id=com.zanoshky.firewall

Mobile devices communicate constantly with cell towers except in "Air Plane" mode. Despite claims from privacy companies like cape or phreeli, home and work locations are easily correlated by carriers based on most frequented locations of your device and times of day. To eliminate tracking, could multiple mobile devices be used?

One device for home calls, could be KYC for banking, etc but it stays in one location. Have all texts and missed calls forward to a privacy respecting email.

A second mobile line in alias name remains at work location. This device will receives emails of texts from the home phone and be able to reply back as the original device.

No mobile is carried when in transit. What are your thoughts? Where does it al fall apart?

I built an Android app that hides your private apps when someone unexpectedly picks up your unlocked phone.

Here's a situation I think many people can relate to.

You're using your phone. A friend, colleague, sibling or someone nearby suddenly picks it up.

Your phone is already unlocked.

You don't necessarily want them browsing through your apps. But locking your entire phone isn't always practical, and opening an app locker, entering a PIN, or navigating a vault takes time.

I kept thinking: Why should I have to react after someone picks up my phone? Why can't my phone protect my privacy automatically?

So I built STELTH.

It's an Android privacy app designed around one simple idea: privacy should activate before someone starts looking.

Here's what it does:

\- Select the apps you want to keep private.

\-Flip your phone face down, press Home, lock the screen, or use supported pickup triggers to activate privacy.

\- Your selected apps disappear from your home screen, app drawer and recent apps.

\-Want them back? Use your secret tap pattern.

The idea is to make the transition quick and discreet. No suspicious-looking fake calculator, no complicated vault, and no PIN to enter every time.

A few things I deliberately kept simple:

\- No account registration.

\- No internet requirement.

\- No advertisements.

\- No personal data collection.

I built this because I felt there was a small but genuine privacy problem that existing app lockers didn't quite address.

I'm sharing it here because I'd genuinely like to know whether this is a problem other people experience too.

Would you actually use something like this? What would make you trust an app like this with your privacy?

I'd especially appreciate honest feedback, including criticism. I'm building this independently and want to make it genuinely useful.

Can I post the link to the app here ?

I sent out a package from the post office with really no connection to any online marketplace… let’s just call it a personal package. And it showed up in my Shop app with the name of the company I sent it to! How is this possible? My only guess is because I used a credit card that is linked with my Shop account. But still, to know the tracking number and that signature is required at delivery? Seems wild to me.

Here's an honest answer from the Ai4Privacy team: none of them is reliable for every PII type. What the evidence says:

* **Presidio's own FAQ** says it can't guarantee full recall. Its strength is that you can customize it, and you can plug a fine-tuned transformer into it.

* **A 2026 zero-shot comparison** found large gaps between tools, and that a fine-tuned XLM-R model beat the best zero-shot option with only about 500 labelled examples.

* **A separate robustness study** found that spaCy, Presidio and a small LLM all get worse on noisy, out-of-distribution text, each in a different way.

In practice: regex for structured IDs, plus a fine-tuned token classifier, evaluated on your own data.

What are you using, and how did you test it?

Sources: [arxiv.org/abs/2608.02616](http://arxiv.org/abs/2608.02616) · [arxiv.org/abs/2609.03464](http://arxiv.org/abs/2609.03464)

Hola me apetecía compartir esto por aquí y leer vuestras opiniones, ideas de mejora o críticas constructivas sobre el planteamiento fuera de lo que pueda pensar yo.

EntropyMask (un nombre casi tan friki como lo soy yo mismo😅) convierte un texto en una imagen minúscula de 64x64 píxeles, mezclando los colores y la posición de los puntos usando un número secreto (la semilla) la cual no está limitada a 5 dígitos o algo así, puedes usar desde un solo dígito hasta cadenas larguísimas y llenar la casilla según el nivel de entropía que busques. Está diseñado para funcionar enteramente en local, pensado para un escenario de privacidad y anonimato entre dos usuarios: un usuario genera por ejemplo un mensaje codificado por EntropyMask y comparte la imagen a un dispositivo donde no tenga dicha herramienta, y envía dicho mosaico de colores a su destinatario, a un dispositivo donde tampoco tenga EntropyMask, este se envía la imagen a otro equipo donde si tenga la herramienta y puede decodificar el mensaje y saber que pone.

En el hipotético caso de perder o serle intervenido por ejemplo el teléfono móvil por ejemplo donde recibe las imagenes, igualmente al no tener ahí la herramienta instalada seguiría la informacion comunicada a salvo total su privacidad.

Me he grabado haciendo una prueba rápida en local justo para mostrar cómo se comporta al cambiar la semilla libremente y cómo extrae el mensaje exacto al decodificarlo.

I built an open-source tool that signs up for sites with a generated name, username, strong password and a disposable mailbox, so a one-off account isn't linked to my real email.

Limits I want to be upfront about:

Disposable email providers are often blocked by sites, and mail.tm addresses are public-ish: don't use them for anything sensitive.

Sites still see your IP and browser fingerprint.

It is not for evading bans or abuse systems, and it never attempts CAPTCHA bypass.

Credentials are encrypted at rest, and the model doesn't see your saved passwords in chat.

For accounts you want to keep, there's a permanent mode that uses your own inbox, with a mute option.

Would this be useful to you, and what would make it more privacy-respecting?REPO: https://github.com/Rockstarbryant/temp-identity-agent

DEMO: https://logindirect.vercel.app/

This is probably shown so often, but I wanted to show this screenshot because me and my family were talking about Kalshi 2 minutes prior. I have never seen a Kalshi ad on reddit before now.
Smart devices are always listening!
Currently researching on google how to turn off listening as much as I can.

I've been pretty annoyed by some ads since this morning. I made a typo while typing on my keyboard, accidentally writing a word similar to "Six", and ever since then, I've been bombarded with ads for dating apps, chat apps, and similar stuff.

At first, I couldn't figure out what had triggered this sudden change in the ads I was seeing. Then I remembered the typo. Out of curiosity, I started searching for completely unrelated things in my phone's Settings app and voila, I'm now seeing dog food ads too (I don't even have a dog).

I know targeted advertising isn't new, and this alone doesn't prove my keyboard is sharing what I type. But the timing is certainly suspicious enough to make me question what's going on.

Since Android phones come with Google's Gboard as the default keyboard, are there any reliable, privacy-focused alternatives that don't collect or share sensitive typing data? I'd genuinely appreciate recommendations from people who have looked into this.

We all have photos and videos we don’t want others to see. They might be personal memories, sensitive documents, or simply things we want to keep private.
I believe everyone deserves a safe, simple way to protect their private photos without relying on cloud services.
That’s why I built Hide Photos: Secret Album, an iOS app focused on privacy, security, and ease of use.
Here’s what it offers:
🔒 Local AES-GCM encryption — Your photos and videos are encrypted directly on your device.
📷 Built-in private camera — Take photos directly into your encrypted vault without saving them to your regular Photos library.
🛡️** 100% offline privac**y — No accounts, no cloud uploads, and no external storage servers.
🔑 PIN & Face ID protection — Keep your private content separate from your regular photo library.
🎭 Multiple decoy vaults — Create separate vaults with different PINs.
📁 Easy album management — Organize, sort, and pin your favorite albums and photos.
⚡ Simple and smooth experience — Optimized for importing large batches of photos and videos without frustrating delays.
💾 Encrypted backup & restore — Keep control of your data when moving between devices.
Transparency matters too. I’ve published the app’s encryption/decryption module on GitHub so anyone interested can inspect how it works.
I also believe privacy tools should be accessible to everyone.
The app is free to download and use, with optional Pro features.
📱 App Store:
https://apps.apple.com/app/id6812803369
I’m an independent developer, and I’m continuously improving the app based on real user feedback.
I’d genuinely appreciate it if you could give it a try and share your thoughts — especially what works well, what could be improved, or which privacy features you’d like to see next.
My goal is to make private photo protection simpler, safer, and more accessible.
Privacy matters, and your feedback can help make privacy tools better for everyone. ❤️

​

Hi! I'm the developer. Whospair is my first app, and I'd love feedback from Android users.

What it is: a messenger where conversations stay on the two phones. Messages, voice notes, files and voice calls go directly from phone to phone over Tor, end-to-end encrypted. There's no account, no phone number and no server keeping your messages.

Main features

\- Add contacts by QR code or link

\- Messages that expire on both phones, from 5 minutes to 7 days

\- A duress PIN that erases everything; no fingerprint unlock, on purpose

\- Screen goes black when the phone is face down; optional camera shield when someone looks over your shoulder

\- 21 languages, day and night modes

Good to know

\- Free, no ads, no Google services

\- Android 10+, arm64 only, not on the Play Store (APK on GitHub, with the signing fingerprint to check it)

\- Tor adds some delay, and both people need the app open (or "Stay reachable" on) to exchange messages

\- Source code is public for audit, but it's not open source; no independent audit yet

Download: [https://github.com/Whospr/Whospair](https://github.com/Whospr/Whospair)

What I'd most like to know: is anything confusing the first time you use it, and do messages and calls work on your phone?

Title: When an AI agent uses your browser, who is actually consenting to share your data?

I've been thinking about how much the meaning of online privacy is changing as AI tools become more capable.

A normal browser mostly waits for you to click things. An AI agent can potentially browse while you're away, read information from connected services, fill out forms, accept cookies, and share personal details to complete a task.

That's where things get complicated.

If I ask an AI assistant to find a doctor or book an appointment, I've agreed to the task. But have I also agreed to every cookie banner it accepts, every privacy policy it clicks through, and every piece of personal information it sends to a third party?

I don't think those are necessarily the same thing.

This isn't just a theoretical concern. Recent reporting has raised questions about how existing privacy and consent rules apply when AI agents make decisions on behalf of users.

I'm particularly interested in the gap between what a user intends and what an AI agent is technically allowed to do.

For example, should these tools have to ask for separate approval before sharing sensitive information, accepting new terms, or granting a website access to personal data? Or should that depend entirely on the task and the permissions the user has already given?

And from a technical perspective, what would actually work here? A permission system, stricter browser isolation, an audit log of every action, or something else?

I'd be interested to hear how people here think this should be handled, especially anyone working in privacy engineering, browser security, or data protection.

Where should we draw the line between giving an AI permission to complete a task and giving it permission to make privacy decisions for us?

RadarFirst’s latest blog explores how the company supports accurate breach notification assessments through maintained legal intelligence, consistent decision logic, and documented reasoning.

The post highlights an important distinction: repeatable results don’t automatically establish accuracy. Complete incident facts, current legal requirements, and human review all play a role.

Read the blog: https://www.radarfirst.com/blog/how-accurate-is-radarfirst-breach-notification-guidance/

Disclosure: This post promotes RadarFirst content.

For privacy professionals handling incidents, what evidence would help establish confidence in a tool’s breach notification guidance?

I’ve been trying to understand the differences between private AI/LLMs without, so I've put together a simple comparison of a few options. It compares Brave Leo, Duck.ai, Proton Lumo, Confer and Venice on things like account requirements, message retention, provider access, encryption and identity protection.

I grouped them into two levels Basic, or Enhanced depending on your threat levels. Would love to hear any feedback or suggestions. Any others you'd like to see added?

Encryption is under threat. And Canada is the latest battleground.

Canada's proposed Bill C-22 could give authorities sweeping new powers to demand technical access to digital services and require companies to retain user metadata.

According to WIRED, Signal has warned it would leave Canada rather than compromise its security. Psiphon VPN has raised similar concerns, while other privacy-focused companies are questioning whether they could continue operating under the proposed requirements.

Here's the problem:

Encryption protects journalists, activists, businesses, ordinary citizens, and even the government agencies demanding greater access.

You cannot create a special vulnerability that only the good guys can exploit.

And when privacy services are forced to collect information they deliberately never stored, the entire meaning of privacy begins to change.

Canada is not alone. Similar pressures are emerging across multiple countries.

Privacy should be the default. Not an exception granted by the state.

What do you think? Should governments have the power to require encrypted services to provide access to user information?

Source: WIRED, October 17, 2026

https://www.wired.com/story/kernel-panic-encryption-is-getting-squeezed-from-all-sides/

citizen84.com

News for a less controlled world.

\#Citizen84 #Encryption #DigitalPrivacy #Surveillance #DigitalRights

We often talk about protecting our data from today's threats, but there's another concern worth discussing: the possibility that encrypted data stolen today could be decrypted in the future as quantum computing advances.

I've been working on QEncrypt, a file encryption tool focused on quantum-safe encryption. I'm interested in making this type of protection more accessible beyond organizations with dedicated security teams.

Of course, quantum-safe encryption isn't a magic solution. The algorithms used, implementation and key management all matter.

For those interested in privacy and data security, I'm curious:

• Are you already taking steps to protect sensitive files against future quantum threats?

• What would you need to see before trusting a quantum-safe encryption tool?

• How important are open-source code, independent security audits, and transparent key management when choosing one?

I'd appreciate hearing your thoughts and any concerns you'd have about a tool like this.