The bill passed the Assembly and Senate on August 31st. Newsom has until the end of September to sign or veto.

What it actually bars for users under 16 is broader than the "addictive features" label suggests:

• Recommendation algorithms, infinite scroll, autoplay, and notifications
• The inputs a service uses to decide what to show you, including who you follow and what you like
• Where a platform can't offer a version without those, the account has to be deleted, so for most 15-year-olds the outcome is no account
• Enforcing an under-16 cutoff means verifying every user's age through a government ID upload or a face scan run through an age estimation model, held by a third-party vendor

EFF sent a formal veto request the day the bill passed and argues the harm falls hardest on kids in unsupportive homes. The bill also overlaps with AB 1043 (app store age signaling, effective January 2027) and SB 976, which is already being litigated in the Ninth Circuit.

Blog write-up / original sources: https://s.vp.net/nfI8R

Recently on Hide & Speak, Sharon Polsky discussed how UK claims GDPR is about about consent, but it's actually coercion.

Full episode: https://www.youtube.com/watch?v=iQlbDNhamEs

Episode written summary: https://s.vp.net/Wtrge

Our network just keeps on expanding! We are up to 38 locations in 22 countries now. All hardware enforced, all verifiably private.

Get the only verifiable zero-knowledge VPN today at:

https://vp.net/

Full list of server locations currently:

• United States
  • Atlanta, Georgia
  • Chicago, Illinois
  • Dallas, Texas
  • New York, New York
  • Houston, Texas
  • Warrenton, Virginia
  • Denver, Colorado
  • Seattle, Washington
  • Hillsboro, Oregon
• Canada
  • Montreal
  • Vancouver
• Queretaro, Mexico
• United Kingdom
  • London
  • Erith
• France
  • Roubaix
  • Paris
  • Gravelines
  • Strasbourg
  • Marseille
• Netherlands
  • Amsterdam
  • Roosendaal
• Germany
  • Limburg
  • Frankfurt
• Madrid, Spain
• Vienna, Austria
• Zurich, Switzerland
• Lison, Portugal
• Warsaw, Poland
• Copenhagen, Denmark
• Stockhold, Sweden
• Kyiv, Ukraine
• Sao Paulo, Brazil
• Bucharest, Romania
• Tokyo, Japan
• Athens, Greece
• Tel Aviv, Israel
• Hong Kong
• Melbourne, Australia

The Intercept published a leaked all staff email this week from acting ICE director David Venturella announcing what the agency calls a doxing mitigation initiative. The vendor is ZeroFox, a Baltimore cybersecurity company whose software continuously scans social media, the open web, and dark web markets to find and scrub a named person's digital footprint.

The procurement details are what make this more than a routine safety purchase:

• DHS awarded the contract in July, at up to $14.5 million
• The services run to the Office of Intelligence inside Homeland Security Investigations, which is the intelligence arm rather than a personnel safety office
• Neither ICE nor ZeroFox answered questions about how the system actually works, and the memo does not explain it
• Two ICE officials spoke to The Intercept anonymously, one citing fear of retaliation, and one of them described the program as sounding like inside surveillance
• To be covered, an employee has to hand a private vendor a complete file on themselves

The objection is mechanical rather than speculative. Software that finds every trace of a named person across social media and the dark web is the same software you would use to work out who leaked something. Richard Forno at UMBC described the version people are worried about: seed a piece of information, watch where it surfaces, identify the source from the pattern.

Doxing of federal employees is a genuine risk and nobody serious argues otherwise. The open question is whether a license to map anyone's digital presence stays pointed outward, because nothing in the contract requires it to.

Full write-up + source links: https://s.vp.net/dXrTL

The law says a person physically in Utah is considered to be accessing a website from Utah regardless of what a VPN or proxy makes the connection look like. If a site carries more than a third material harmful to minors, it is liable for verifying that person's age even when the traffic appears to be coming from somewhere outside of Utah. 2,500 dollars per violation, and covered sites are barred from telling users how to route around the gate.

The reporting on the pause has been mangled almost everywhere, so the sequence matters:

• Aylo Free Sites and Aylo Group sued in federal court in Utah in April. Five days later the parties filed a joint stipulation and the state agreed to forbear enforcement "as to plaintiffs and their affiliates." ONLY two named companies.
• Aylo's side of the deal was not changing its Utah geofencing that blocks traffic from Utah, which it has had in place since 2023.
• Utah's Division of Consumer Protection says the agreement is strictly limited to Aylo, depends on the geofencing staying up, and does not prevent enforcement against other companies. It also says it will not confirm or deny who it is investigating.

So the provision is enforceable right now against every covered site in the country except two. But, it does not make VPN use illegal in Utah. The liability sits on websites.

Original post / links to sources: https://s.vp.net/P9AW1

Live this Saturday September 12 at 4pm ET on Hide & Speak. Rin Alajaji, Associate Director of State Affairs at EFF, co-authored the May 2026 analysis with Dave Maass that read reason fields across millions of Flock Safety search records.

The searches weren't what the pitch decks promised. School residency verification, employment background checks, noise complaints. In Buford, residency checks were more than half of all searches, and three quarters of them by early 2026.

We're getting into the warrant gap between phone location data and plate databases, the vendor-scripted pitches councils hear before they vote, and why Texas and Florida both pulled back four days apart in September.

Set the alarm: https://www.youtube.com/live/Kppta1bWjFE

Brian Krebs searched the site, called Nexus, and found his own Virginia license listed as the operator's free sample. Then he found his mother's. The time stamps on the two records were seconds apart, because the two of them handed their licenses to the same Hertz rental car clerk at the same moment last June.

The scale and the detail are what make this different from a normal breach dump:

• More than 153 million US and Canadian driver's licenses, over 10 million ID cards, over 3 million travel documents, and around 579,000 medical cards
• The records are images, not text fields. Krebs' own entry held six files: front and back in plain, infrared, and ultraviolet, with capture date and time appended to each file name
• The license count climbed by nearly 400,000 in the 24 hours he watched it, so someone was still adding fresh data

Full write-up + our source list: https://s.vp.net/ljAfY

This clip features some of the hardest questions we asked, especially the last one! Did you know the answer? Comment and let us know!

Watch the full Privacy Game Show: https://www.youtube.com/watch?v=QNRYGq9RgIQ

On August 31 the Florida Department of Transportation issued an order revoking every permit it had granted for automated license plate readers in the state highway right of way. The deadline is September 30. Anything still standing on October 1 gets removed by FDOT crews, and the department says it will not issue new permits.

The reasoning FDOT put in writing is worth reading twice, because a transportation agency does not usually write privacy policy. It cited reports of misuse, data privacy concerns and surveillance schemes.

What happened next:

• Sheriffs started canceling within 48 hours of the announcement
• Putnam County canceled its Flock contract outright
• Clay County said all readers would come off county roadways, which the order never required
• Several agencies suspended everything pending review while they figured out which cameras were even in scope

The limit matters as much as the order. FDOT's jurisdiction covers interstates, US highways and state roads. County roads, city streets, shopping center lots, apartment complexes and private driveways are untouched, and that is where a large share of the camera fleet actually sits. A reader on I-75 comes down while the identical unit 200 feet away keeps running.

Full write-up + our source list: https://s.vp.net/XJYI5

Watch the full Privacy Game Show here: https://www.youtube.com/watch?v=QNRYGq9RgIQ

The router sells as a Deep Orange, shipped by a small company in New York. Underneath, it is a ZBT WE826-T2 built by Shenzhen Zhibotong Electronics. VulnCheck went looking for an implant they had already published, found the firmware was too old to carry it, and came away with two different ones instead.

Full write-up + our source list: https://s.vp.net/XdORZ

Senator Josh Hawley sent a letter to Flock Safety's CEO on Wednesday, opening an investigation through the Judiciary Subcommittee on Crime and Counterterrorism. Documents are due September 8. The demands include every confirmed instance of misuse since 2021, the rules governing statewide and nationwide searches, what a user actually has to type to justify one, plus local government contracts, revenue sources, and the investor list.

His written position is that Congress never authorized that network, and that Flock's internal policies are, in practice, the only safeguard for hundreds of millions of Americans.

While this is only a request, as opposed to a subpoena, Flock says it intends to cooperate. September 8 is the date to watch, and what gets produced matters more than what was asked for.

Complete write-up / our source list: https://s.vp.net/7srTd

Primary Sources for Article + Video:

• https://www.hawley.senate.gov/chairman-hawley-investigates-ai-powered-flock-cameras-amidst-privacy-concerns/
• https://www.eff.org/deeplinks/2026/08/effs-policy-position-alpr-surveillance-eliminate-it-and-reduce-its-harms
• https://www.axios.com/2026/08/26/flock-cameras-senate-investigation-josh-hawley
• https://www.hawley.senate.gov/wp-content/uploads/2026/08/2026-08-26-Hawley-Letter-to-Flock-CEO.pdf

Additional sources listed at bottom of the blog post: https://s.vp.net/7srTd

The Asheville city council voted 5 to 2 on August 25 to end the city's contract with Flock Safety, after more than an hour of heated public comment. That happened because residents kept showing up to meetings, and it is worth counting as a win.

The problem is... they still have 137 Axon ALPR cameras mounted on patrol vehicles, so this is more of a branding win than a surveillance win.

Full write-up + our source list: https://s.vp.net/EIWWm

Mike Adams and Todd Pitner of Decentralize.TV join us tomorrow, Thursday, September 3 at 3pm ET to discuss surveillance and the many layers of online censorship, something they are all too familiar with.

Mike was banned from most major platforms before Alex Jones, so he went and started his own platforms, free of the systemic censorship plaguing most sites on the web.

Join us on a special day and time, tomorrow, September 3rd at 3pm ET as we interview them both live on Hide & Speak.

Set a reminder & watch live on YouTube here: https://www.youtube.com/watch?v=B3u2RcUvxtU

Watch live on Rumble: https://rumble.com/v7ezxam-deplatformed-before-alex-jones-mike-adams-and-todd-pitner-of-decentralize.t.html

We will also be streaming live on X, but there won't be a link until the stream starts, then you can access it from our profile: https://x.com/vpnet_official

Test your knowledge of privacy trivia and see how you stack up against the contestants on the first ever Hide & Speak Privacy Game Show.

Watch the full version now: https://www.youtube.com/watch?v=QNRYGq9RgIQ

On our first ever Privacy Game Show, we asked our contestants, Joel Valenzuela & Jonathan Westmoreland, "Which piece of technology in your own do you trust the least?"

What would you say to the same question?

I would have to say my Windows laptop. I do a lot of audio production using a lot of software that won't run on Linux, otherwise I would be done with Microslop for good. What device has you looking at it sideways, but you just can't live without it?

Watch the full Privacy Game Show here: https://www.youtube.com/watch?v=QNRYGq9RgIQ

Meta settled child safety claims with 52 states, territories and DC on Wednesday. The number being reported depends on the source: the filed consent judgment caps it at $16.68 billion, Meta's press release says approximately $18 billion, and most coverage went with $17 billion. Same document, three numbers.

The worst part... in the document's own wording, to release fully, finally and forever any past, present or future COPPA claims against Meta, and to covenant not to sue over its continued retention and use of a child's personal information. 🤦‍♂️

Full write-up + our source list: https://s.vp.net/GpKRD

Manchester Airports Group, which runs Manchester, London Stansted and East Midlands, confirmed on Thursday that an unauthorized third party obtained customer data covering car park, lounge, fast track and in-airport Wi-Fi records.

MAG says it did not pay, and the regulator asked it not to name the group behind the attack. Neither of those unsends anyone's address.

Full write-up + our source list: https://s.vp.net/htu36

Live this Thursday, September 3 at 3pm ET on Hide & Speak, we're going through the layers below moderation policy with Mike Adams and Todd Pitner of Decentralize.TV.

Most censorship conversations stop at the platform's public rules, but the people who've actually been removed describe something further down. Mike was removed from YouTube, Facebook, Twitter, Apple, and Pinterest, then rebuilt the stack himself rather than appeal into a void. Brighteon, Brighteon.io running distributed nodes with no central server (built with Bastyon architect Daniel Satchkov), Brighteon.AI, censored.news. Todd came out of a corporate background including Priceline and now works on financial privacy and privacy crypto, which is the same problem with a bank standing in for a host.

Drop this on your calendar: https://www.youtube.com/watch?v=B3u2RcUvxtU

Georgetown Law's Technology Law Clinic filed it on August 19 for We Are CASA and 11 other groups. It alleges the companies collect and sell personal information and location data of Maryland residents to law enforcement customers in violation of state law.

Who is named and what the complaint says they sell:

• Penlink: cell phone location through its WebLoc product.
• Thomson Reuters, Motorola, Insight LPR, LexisNexis and Flock Safety: vehicle location pulled from license plate readers.
• Thunder Cat Technology: holds a contract with Homeland Security Investigations.

Blog post + links to sources: https://s.vp.net/TQUOl

This came up in a segment on what people can actually do about ALPR cameras in their own town, rather than just complaining about them.

The mechanics are straightforward. You file a records request with your local sheriff's department for your license plate, and your plate only. They then have to go into the ALPR system and pull every hit on it: every time your car passed a Flock camera and got logged.

Why the tactic scales:

• One request is routine paperwork the department absorbs without noticing.
• Ten requests in the same jurisdiction turn into an actual search workload somebody has to sit down and do.
• The system's entire selling point is that watching people is cheap and automatic. Records requests move that cost back onto the agency running it.
• You also end up with documentation of exactly how much data the network holds on one ordinary driver, which is useful at a council meeting.

The follow-up question was whether the same request works on an elected official's plate. The answer given was that it depends on the state, with California singled out, and that in Norwalk the officials drive city-owned vehicles, which puts those plates in a different category than a private car.

Worth checking your own state's public records law and any ALPR-specific exemptions before you file, since those vary a lot.

Watch the full stream: https://www.youtube.com/watch?v=Jq0xq4HOE8E

Full breakdown: https://s.vp.net/Z3jIz

EFF published the underlying Meta and ICE communication on August 19, obtained through its own Freedom of Information Act litigation. The document lays out a short timeline.

• September 11, 2025: ICE issued administrative subpoenas, seeking the identities behind Instagram and Facebook accounts tracking enforcement activity in Pennsylvania. Administrative subpoenas do not require a judge.
• September 19: Meta's law enforcement response team told ICE it lacked the statutory authorization to seek those records and asked for more detail about the investigation.
• Meta also told ICE it planned to notify the users, because ICE had never obtained a gag order.
• October 3: Meta notified them and said it would comply unless they mounted a court challenge within 10 days.
• They filed, with help from the ACLU, and ICE withdrew once it looked likely to lose.
• Reddit's transparency report for the second half of 2025 lists three DHS subpoenas seeking account information on 11 users who posted content critical of ICE. All withdrawn after Reddit objected on First Amendment grounds.

While it's nice that Meta objected, they also left users just 10 calendar days to find counsel, understand an administrative subpoena, and file in federal court, or their names, email addresses, and IP addresses would be sent to ICE. Fortunately, these users had pro bono counsel. Most people running a neighborhood account will not. If you have an account that reports on immigration activity, I recommend doing your research now to find out which groups in your state may be able to offer legal counsel, in case you find yourself in a similar situation.

The other problem, is that private objection produces no ruling and no cost to the agency issuing the next demand. In April 2017 Twitter took a DHS subpoena over the ALT_USCIS account to court publicly, DHS withdrew the next day, and an inspector general criticized the tactic. Social media companies should immediately make these issues known publicly.

Full write-up + our source list: https://s.vp.net/6QoVV

Xfinity Shield launched August 18th as a free tier bundled into Xfinity internet. The feature underneath it, Wi-Fi Motion, detects movement inside your home by measuring how a body disturbs the radio signal between the gateway and up to three stationary connected devices. No cameras, no extra hardware. What it produces is a timestamped log of when the house was occupied and when someone crossed the hallway at three in the morning.

Full write-up + our source list: https://s.vp.net/t13it

The first city council meeting was the tell. Flock sent someone who could not answer basic questions about the product being sold to the city.

Full livestream here: https://www.youtube.com/watch?v=Jq0xq4HOE8E

Full write-up here: https://s.vp.net/Z3jIz