Search This Blog

Powered by Blogger.

Blog Archive

Labels

Footer About

Footer About

Labels

Showing posts with label Digital Privacy. Show all posts

Received an Apple Threat Notification? How to Verify and Respond Safely

 

An Apple threat notification is not a routine security warning. Apple issues these high-confidence alerts when its threat intelligence indicates that someone may have been individually targeted by sophisticated mercenary spyware.

Receiving an alert does not necessarily mean that the spyware successfully infected the device. It also does not identify the spyware operator or explain why the person was targeted. However, Apple says recipients should take the warning seriously and obtain expert assistance.

Verify That the Notification Is Genuine

Attackers may impersonate Apple and use spyware concerns to steal passwords or verification codes. Recipients should therefore confirm the notification before following any instructions.

Apple threat notifications may appear:

  • On an iPhone’s Lock Screen.

  • Inside the iPhone’s Settings application.

  • In an email sent to an address associated with the Apple Account.

  • As a banner at the top of the Apple Account website.

Instead of following a link inside an email or message, manually enter account.apple.com into a browser and sign in. A genuine notification will be displayed prominently at the top of the account page.

Apple says its threat notifications will never ask recipients to click a link, open a file, install an application or configuration profile, or disclose their Apple Account password or verification code.

Any communication making these requests should be treated as a possible phishing attempt.

What the Alert Actually Means

Apple describes its threat notifications as high-confidence warnings that a user may have been individually targeted by mercenary spyware.

These attacks are significantly more sophisticated than ordinary cybercrime. They frequently involve commercial surveillance tools developed for highly targeted operations against a small number of individuals.

Journalists, activists, politicians, diplomats and human-rights defenders have historically been among those targeted. Nevertheless, the notification alone does not prove that a device was successfully compromised.

A forensic investigation may be required to determine whether an attempted infection succeeded and what information may have been exposed.

Preserve Potential Evidence

Recipients should not immediately erase or factory-reset the affected device. Resetting it may remove forensic evidence that investigators could use to identify an attempted or successful compromise.

Access Now recommends preserving the device and creating a backup when an immediate forensic examination is unavailable. Because information stored in system logs can be overwritten over time, expert assistance should be requested as quickly as possible.

Apple directs notified users to Access Now’s Digital Security Helpline, which provides emergency assistance to eligible civil-society groups, including independent journalists, activists and human-rights defenders.

People outside the organization’s support mandate should contact a trusted cybersecurity professional with experience in mobile-device forensics.

Update and Harden Apple Devices

The appropriate order of forensic preservation and security changes may depend on the individual case. When possible, recipients should coordinate these actions with a qualified investigator.

Apple and Access Now recommend the following protective measures:

  • Update the iPhone and other Apple devices to the latest available software.

  • Enable Lockdown Mode on supported devices.

  • Use a strong, unique Apple Account password.

  • Confirm that two-factor authentication is enabled.

  • Review the devices connected to the Apple Account and remove anything unfamiliar.

  • Enable Stolen Device Protection.

  • Install applications only from the App Store.

  • Avoid links and attachments from unknown senders.

Apple recommends updating devices before enabling Lockdown Mode to obtain the complete set of available protections.

On an iPhone, Lockdown Mode can be activated under Settings > Privacy & Security > Lockdown Mode. It restricts certain applications, websites, invitations, attachments and device connections to reduce the attack surface available to highly targeted spyware.

Lockdown Mode must be enabled separately on an iPhone, iPad and Mac. Enabling it on an iPhone automatically activates it on a paired Apple Watch.

Do Not Rely on a Basic Spyware Scanner

A consumer security application reporting that a device is clean does not prove that no compromise occurred. Mobile security applications have limited access to protected areas of the operating system, while sophisticated spyware is specifically designed to avoid detection.

The absence of unusual battery consumption, unexpected applications or suspicious messages also cannot establish that a device is safe. Some advanced spyware attacks require little or no interaction from the target and may leave few visible symptoms.

Remain Alert for Follow-Up Phishing

A person who receives a legitimate threat notification may subsequently encounter fraudulent messages from criminals claiming to offer Apple support or spyware-removal services.

Recipients should never provide passwords, device passcodes or two-factor authentication codes to an unsolicited caller. CySecurity.news has separately reported how fake Apple Support agents target device owners using phishing messages and AI-generated voice calls.

Apple has sent threat notifications to users in more than 150 countries since 2021. Although most people will never receive one, anyone who does should verify it directly, preserve potential evidence, obtain expert assistance and take immediate steps to strengthen the security of every connected device.


Meta’s Muse Code: Affordable AI Coding with a Privacy Catch

 

Meta, the corporate umbrella behind Facebook, Instagram, and WhatsApp, has officially launched Muse Code, a new artificial intelligence system designed to assist developers in writing software. Announced by CEO Mark Zuckerberg via an X post, Muse Code functions as a “terminal coding agent” capable of handling complete software engineering tasks—from planning changes and writing code to validating results. This move reinforces Meta’s continued investment in AI, even as its public image remains tied to its 2021 metaverse pivot. 

What sets Muse Code apart is its ability to maintain context across a developer’s session. According to Zuckerberg, the tool runs specialized background agents that stay active throughout, learning a coder’s habits and preferred patterns. This means if a developer has previously generated a specific code fragment using Muse, the system remembers it for future reuse. Additionally, Muse dynamically allocates tasks: for complex requests, it “fans out” work to separate sub-agents operating in parallel within isolated worktrees, ensuring the original codebase remains untouched during experimentation. 

Despite its technical sophistication and cost advantage, Muse Code comes with a notable caveat: privacy. As with many AI-driven platforms, the tool’s ability to learn from user behavior and retain session data raises questions about how developer information is stored, used, and potentially shared. While Meta has not disclosed full details on data handling policies for Muse Code, the trade-off between affordability and privacy remains a critical consideration for enterprises and individual developers alike. 

Muse Code arrives amid Meta’s aggressive push into AI infrastructure and tooling. Zuckerberg has previously stated ambitions for AI to write most of Meta’s code within 12 to 18 months, and the company has reported a 30% rise in engineer productivity since early 2025, largely attributed to AI coding assistants. This launch also coincides with similar moves by competitors—Google recently unveiled Gemini 3.7 Flash, a low-cost AI model for coding workflows—highlighting a growing industry race to democratize AI-assisted development.

For developers, Muse Code represents both opportunity and caution. Its ability to reduce repetitive tasks, preserve work mid-crash, and scale complex projects could significantly boost productivity. However, the privacy implications underscore the need for transparent data policies and robust security measures. As AI coding tools become more prevalent, the balance between efficiency, cost, and data sovereignty will likely shape the next chapter of software development.

Ultra-Wealthy Turn to Premium Services to Erase Their Digital Footprints

 

For the ultra-wealthy, protecting personal information is increasingly becoming a premium service. High-net-worth individuals and corporations are paying specialized privacy firms to track down and remove personally identifiable information (PII) from search engines, data-broker databases and even the dark web.

Unlike automated privacy tools, these high-end services combine data removal with continuous monitoring and manual audits designed to reduce both online exposure and physical security threats.

Consumer-focused services such as DeleteMe, Incogni and Google’s free PII removal tool can help limit exposure, but their reach remains restricted. Data brokers often use measures to prevent automated deletion requests. “insert something like a captcha to ensure that a bot can’t come in and wipe out their database,” Tom Aldrich, chief operating officer of digital exposure reduction firm 360 Privacy, told Observer.

Aldrich said his company, which works with 32 Fortune 100 companies, recently took on a wealthy client who had previously used an automated service. The firm discovered 62 profiles belonging to the individual across hundreds of data aggregation platforms. “We found 62 different profiles on them across hundreds of data aggregator sources,” said Aldrich, who added that 93 percent of those profiles included non-public information and could be removed.

Digital exposure is becoming a physical security concern

Security experts increasingly warn that information available online can create risks in the physical world. Threats against senior executives have risen steadily over the past two decades, with attacks in 2025 more than doubling compared with the previous year.

“Physical and digital can no longer be separate,” Brian Hill, field chief information security officer at personal cybersecurity firm BlackCloak, which serves corporate executives and high-net-worth individuals, told Observer.

The connection became particularly evident in the case of Vance Boelter, the Minnesota gunman sentenced in July to two consecutive life sentences plus 40 years for killing Democratic lawmakers in 2025. Boelter reportedly used data aggregator websites to identify his victims.

Growing concerns around executive safety have also pushed security spending higher. The median security expenditure for executives at S&P 500 companies increased 37.8 percent between 2024 and 2025. During the same period, S&P 500 CEOs earned an average annual compensation of $18.9 million.

Meta was among the biggest spenders, allocating more than $25 million toward physical and digital security for CEO Mark Zuckerberg.

For family offices, celebrities and high-net-worth clients, BlackCloak's services can cost between $10,000 and roughly $200,000 annually. Enterprise contracts covering executives, board members and founders can reach as much as $600,000 per year.

A growing market for digital privacy

The expanding digital footprint of consumers has created an entire economy around personal-data protection. Data brokers collect and sell personal information to third parties, contributing to a North American data-broker market estimated at $40 billion.

Removing such information is often difficult and labor-intensive, increasing demand for specialized providers that can continuously identify and eliminate exposed data.

Only California, Oregon, Texas and Vermont currently require data brokers to identify themselves through state registries. More than 4,000 data brokers are estimated to operate across the U.S., with many outside the reach of comprehensive regulation. California alone has 545 registered data brokers.

Premium privacy firms typically remove information from publicly accessible websites while also monitoring the dark web and strengthening security across users' accounts and devices. Connected household technology, including security cameras, may also be included in these security assessments.

Still, complete digital anonymity is difficult to achieve. “Reducing your digital footprint to zero is virtually impossible,” said Hill. “Our goal is anywhere from 70–90 percent removal of data.”

Certain public records, including newspaper archives and campaign donation records, can also remain difficult or impossible to erase.

Affordable services remain an option

While high-end privacy protection is increasingly being adopted by wealthy individuals and corporations, more affordable services can still help ordinary consumers reduce their exposure.

Aura, for example, offers automated data removal alongside other digital safety services for families at $32 per month. “As data breaches continue, data brokers expand, and A.I. makes it easier to exploit personal information, more people are looking for ways to reduce their digital footprint and regain control of their privacy,” Tom Clayton, president and chief operating officer of Aura, told Observer.

Despite the growing number of services available, adoption remains relatively low. Only 6 percent of American adults use data-removal services, while more than half do not know such services exist.

Smaller businesses are increasingly vulnerable as well. “The attackers are…going after the small companies, the local family businesses. They’re now becoming the targets because they’re the easy ones,” Hill said.

Executives and their families continue to face particular risks. According to a 2025 report from BlackCloak and the Ponemon Institute, 51 percent of security leaders said cyberattacks had targeted the personal accounts of executives or their family members.

As personal and professional digital lives become increasingly intertwined, conventional corporate security teams may not fully protect executives' personal information. That gap is helping drive demand for specialized privacy and cybersecurity providers.

Artificial intelligence and emerging technologies could make the problem even more challenging. “With a lot of this technology,” said Hill about A.I. and quantum computing, “you’re going to see a lot more data collection, and it’s going to be easier to go after the people that don’t set up an LLC or trust because they just don’t think they need to.”

Firefox 153 Bakes Multi-Account Containers Into the Browser for Smarter Privacy

 

Firefox has long been praised for its privacy-first approach, but managing multiple digital identities used to require workarounds. With the July 2026 release of Firefox 153, Mozilla has natively integrated one of its most powerful privacy extensions—Multi-Account Containers—directly into the browser. This move eliminates the need for separate profiles, constant sign-ins, or third-party extensions, offering a seamless way to isolate browsing sessions within a single window. 

The core innovation lies in how Firefox Containers handle cookies and site data. Each container operates with its own isolated storage, meaning logging into one Google account in a “Work” container won’t interfere with a personal Gmail session in another. This separation prevents websites from sharing login states or tracking users across different contexts. For professionals juggling multiple accounts—be it for work, banking, or shopping—this feature drastically reduces friction while enhancing privacy. 

Setting up native Containers is straightforward. Users can right-click any tab or long-press the new tab button to access options like Personal, Work, Banking, and Shopping. Each container is color-coded and icon-tagged for easy identification, even when dozens of tabs are open. Links opened within a container stay within that container, preserving session isolation automatically. This intuitive design ensures that once configured, Containers operate quietly in the background without disrupting normal browsing habits.

Despite its advantages, the native implementation is still in preview and lacks some features found in the original extension. Notably, automatic site assignment—where specific domains always open in a designated container—is absent. Cross-device sync and integration with VPN or proxy services are also missing. However, for most users, the built-in version offers sufficient functionality without the overhead of installing and maintaining an add-on. Mozilla’s decision to embed this tool natively lowers the barrier to entry, making advanced privacy accessible to a broader audience. 

Firefox’s native Containers represent a significant step forward in user-centric privacy design. By isolating digital identities at the browser level, Mozilla empowers users to compartmentalize their online lives without sacrificing convenience. While not a complete anonymity solution—Containers don’t hide IP addresses or prevent fingerprinting—they complement existing protections like Enhanced Tracking Protection and Private Browsing. For anyone seeking better control over their digital footprint, Firefox 153’s built-in Containers offer a practical, powerful, and privacy-respecting browsing experience.

GrapheneOS Duress Feature Puts Digital Privacy and Evidence Laws to the Test

 

A federal case concerning a local Atlanta activist is fueling controversy over privacy issues relating to cell phone searches and whether simply wiping data from a device qualifies as destroying evidence. The case involves GrapheneOS, an open-source privacy-focused customized Android OS that utilizes the so-called duress PIN/password to permanently delete data from a phone if the correct code is entered by investigators. 

GrapheneOS developers describe their creation’s features on the project’s website, noting that it includes a “duress PIN/password” that causes the phone to immediately wipe all user data and any eSIMs from the device when the “wrong” passcode is entered at the time of credential prompt. According to court records, and reports by the press, in January 2025, Samuel Tunick, an Atlanta-based activist, was taken into custody by the US Customs and Border Protection (CBP) agents at the airport in Atlanta upon his return from the Dominican Republic. 

It seems Tunick was questioned by the customs officials several times and eventually gave them a password to his phone. His phone was wiped immediately after he entered the code. Samuel now faces charges brought by federal prosecutors who alleged that he “conspired to destroy property of the United States.” The defense is arguing that the search was not lawful; the activist was not informed of his constitutional rights and was not allowed to contact a lawyer. 

Additionally, Samuel’s attorney points out that Tunick was accused of possessing child sexual abuse material, and the only reason why he was searched was because of his activism surrounding the Stop Cop City movement. It is worth noting that privacy and security specialists have raised concerns regarding the matter and regard it as an important precedent. The GrapheneOS Foundation, an entity that maintains the software, has stated that it believed that its customized Android OS features “security capabilities that are appropriate and legitimate.” 

Some experts suggest that even if Tunick did wipe his phone, there is no way investigators could prove that he did not do so because of his decision to employ GrapheneOS. The case creates grounds for debate about the potential for cell phone software to create challenges for law enforcement. In particular, the case’s outcome will set a legal precedent about whether a device owner’s intentional interference with a search (by wiping data) constitutes evidence tampering. 

GrapheneOS itself is a valid privacy-centric OS, but the case concerning the Atlanta activist will shape the jurisprudence surrounding the wiping of cell phone data by users and the extent to which such action may be regarded as obstructing law enforcement.

EU Extends Controversial Chat-Scanning Regime Until 2028

 

The European Union has temporarily extended its controversial chat-scanning regime until April 2028, allowing messaging platforms to voluntarily detect child sexual abuse material (CSAM) while exempting end-to-end encrypted apps like WhatsApp and Signal. This decision, approved by 25 EU member states, continues a contentious debate over balancing child protection with fundamental privacy rights in digital communications. 

Modus operandi of extension under EU law 

The temporary framework operates as a derogation from the EU's ePrivacy Directive, permitting tech companies including Meta, Google, and Microsoft to scan unencrypted messages and emails for known CSAM without requiring judicial authorization. Originally introduced in 2021 as Regulation 2021/1232, the measure was designed as a stopgap until permanent legislation could be finalized, but ongoing negotiations have delayed comprehensive reform. The European Parliament initially rejected the extension in March 2026 before reviving it in July through a procedural vote where opponents failed to secure the absolute majority needed to block the Council's position. 


Under the extended rules, scanning remains voluntary for platforms and applies only to unencrypted communications, explicitly excluding end-to-end encrypted messaging services.  MEPs successfully amended the text to narrow the scope, limiting detection to previously known CSAM or content reported by trusted flaggers rather than enabling proactive, algorithmic scanning of all messages. Privacy advocates argue this carve-out protects encrypted apps but warn the voluntary regime still creates a dangerous precedent for mass surveillance of private digital conversations. 

Digital rights organizations including EDRi have condemned the extension as "Chat Control," arguing it permits companies to deny citizens' right to confidential digital conversations by reading every message, email, and image shared on their platforms. Several MEPs, particularly from the Greens/EFA and radical left groups, voted against the measure, contending that child protection should not come at the expense of violating the right to secret communications under EU fundamental rights law. Critics also warn the temporary regime could be annulled by the European Court of Justice, potentially undermining both privacy protections and child safety efforts. 

What comes next for EU digital privacy policy 

The temporary extension runs alongside ongoing trilogue negotiations for a permanent "Chat Control 2.0" regulation, which would introduce mandatory risk assessments, detection orders, and potentially binding scanning obligations for platforms. Discussions are set to resume in September 2026, with the European Commission pushing for stronger enforcement mechanisms while Parliament and civil society groups demand stricter judicial oversight and narrower scope. The outcome will determine whether the EU adopts a comprehensive child safety framework or continues relying on voluntary, time-limited derogations from privacy law.

GoDaddy Challenges Indian Court Order Over Domain Privacy and Internet Governance Rules

 

A legal battle in India over online fraud could have major implications for privacy and regulation of the internet around the globe, as domain name registrar Go Daddy takes exception to a Delhi High Court ruling that would impose severe restrictions on domain registration, privacy, and trademark protection. 

The ruling comes in response to an uptick in cyber fraud in India. Government figures from last year show that authorities received 2.4 million fraud complaints, resulting in $2.4 billion in losses. In recent years, Amazon, McDonald’s, Microsoft, and other companies have taken legal action against fake websites that misled consumers into giving away personal information or making purchases. Last December, the Delhi High Court ordered removal of more than 1,100 fraudulent websites. 

With that, the court issued additional directives concerning the management of domain names and registrars. These mandates include forbidding registrars from offering privacy protection services by default, disclosing private domain owner information to third parties upon request if that party can demonstrate a “legitimate interest,” and prohibiting domain name registrations that use trademarks of others. Go Daddy argues in a petition to a larger bench of the Delhi High Court that those measures go significantly beyond what’s needed to combat fraud. 

The company believes such restrictions, if applied consistently, would disrupt internet governance worldwide. Go Daddy also objects to the requirement that domain ownership information be disclosed to anybody demonstrating a “legitimate interest.” The company argues in its petition that the language could prove too broad and that domain registrars shouldn’t be tasked with reviewing requests for domain owner information and deciding whether they meet a “legitimate interest” standard. The firm says the language could create “significant legal and operational challenges.” 

The company raises additional concerns about the order’s potential impact on international domain name sales, arguing that because the global internet isn’t bound by one jurisdiction, requiring local registrars to follow the kind of rules set out in the December ruling would, in essence, require them to follow Indian law for all international transactions. 

Go Daddy further argues that the privacy restrictions could run contrary to India’s data protection laws as well as the European Union’s General Data Protection Regulation (GDPR). By mandating that privacy protections be revoked by default for domain owners, India’s data laws and the GDPR would instead be weakened. 

Many internet governance experts believe the ruling places India at risk of negatively impacting citizens, particularly journalists, activists, bloggers, and small businesses, and that it fails to consider tactics bad actors will use to exploit weaknesses in the domain system. Other domain name registrars have raised similar objections to the December ruling, including Namecheap and Hosting Concepts. 

These companies expect that the ruling will spark similar actions in other jurisdictions. Delhi High Court is set to hear the challenges on July 16, with implications for the future of internet governance and fraud prevention measures yet to be determined.

2026 Digital Frontiers: AI Deregulation to Surveillance Surge

 

Digital technology is rapidly redrawing the boundaries of politics, business and daily life, and 2026 looks set to intensify that disruption—from AI-driven services and hyper-surveillance to new forms of protest organised on social platforms. Experts warn that governments and companies will find it increasingly difficult to balance innovation with safeguards for privacy and vulnerable communities as investment in AI accelerates and its social side-effects become harder to ignore.

One key battleground is regulation. Policymakers are tugged between pressures to “future-proof” oversight and demands from large technology firms to loosen restrictions that could slow development. In Europe, the European Commission is expected to ease parts of its year-old privacy and AI framework, including allowing firms to use personal data to train AI models under “legitimate interest” without seeking consent.

In the United States, President Donald Trump is considering an executive order that could pre-empt state AI laws—an approach aimed at reducing legal friction for Big Tech. The deregulatory push comes alongside rising scrutiny of AI harms, including lawsuits involving OpenAI and claims linked to mental health outcomes.

At the same time, countries are experimenting with tougher rules for children online. Australia has introduced fines of up to A$49.5 million for platforms that fail to take reasonable steps to block under-16 users, a move applied across major social networks and video services, and later extended to AI chatbots. France is also pushing for a European ban on social media for children under 15, while Britain’s Online Safety Act has introduced stringent age requirements for major platforms and pornography sites—though critics argue age checks can expand data collection and may isolate vulnerable young people from support communities.

Another frontier is civic unrest and the digital tools surrounding it. Social media helped catalyse youth-led protests in 2025, including movements that toppled governments in Nepal and Madagascar, and analysts expect Gen Z uprisings to continue in response to corruption, inequality and joblessness. Governments, meanwhile, are increasingly turning to internet shutdowns to suppress mobilisation, with recent examples cited in Tanzania, Afghanistan and Myanmar.

Beyond politics, border control is going digital. Britain plans to use AI to speed asylum decisions and deploy facial age estimation technology, alongside proposals for digital IDs for workers, while Trump has expanded surveillance tools tied to immigration enforcement. Finally, the climate cost of “AI everything” is rising: data centres powering generative AI consume vast energy and water, with Google reporting 6.1 billion gallons of water used by its data centres in 2023 and projections that US data centres could reach up to 9% of national electricity use by 2030.

Apple’s Digital ID Tool Sparks Privacy Debate Despite Promised Security

 

Apple’s newly introduced Digital ID feature has quickly ignited a divide among users and cybersecurity professionals, with reactions ranging from excitement to deep skepticism. Announced earlier this week, the feature gives U.S. iPhone owners a way to present their passport directly from Apple Wallet at Transportation Security Administration checkpoints across more than 250 airports nationwide. Designed to replace the need for physical identity documents at select travel touchpoints, the rollout marks a major step in Apple’s broader effort to make digital credentials mainstream. But the move has sparked conversations about how willing society should be to entrust critical identity information to smartphones. 

On one side are supporters who welcome the convenience of leaving physical IDs at home, believing Apple’s security infrastructure offers a safer and more streamlined travel experience. On the other side are privacy advocates who fear that such technology could pave the way for increased surveillance and data misuse, especially if government agencies gain new avenues to track citizens. These concerns mirror wider debates already unfolding in regions like the United Kingdom and the European Union, where national and bloc-wide digital identity programs have faced opposition from civil liberties organizations. 

Apple states that its Digital ID system relies on advanced encryption and on-device storage to protect sensitive information from unauthorized access. Unlike cloud-based sharing models, Apple notes that passport data will remain confined to the user’s iPhone, and only the minimal information necessary for verification will be transmitted during identification checks. Authentication through Face ID or Touch ID is required to access the ID, aiming to ensure that no one else can view or alter the data. Apple has emphasized that it does not gain access to passport details and claims its design prioritizes privacy at every stage. 

Despite these assurances, cybersecurity experts and digital rights advocates are unconvinced. Jason Bassler, co-founder of The Free Thought Project, argued publicly that increasing reliance on smartphone-based identity tools could normalize a culture of compromised privacy dressed up as convenience. He warned that once the public becomes comfortable with digital credentials, resistance to broader forms of monitoring may fade. Other specialists, such as Swiss security researcher Jean-Paul Donner, note that iPhone security is not impenetrable, and both hackers and law enforcement have previously circumvented device protections. 

Major organizations like the ACLU, EFF, and CDT have also called for strict safeguards, insisting that identity systems must be designed to prevent authorities from tracking when or where identification is used. They argue that without explicit structural barriers to surveillance, the technology could be exploited in ways that undermine civil liberties. 

Whether Apple can fully guarantee the safety and independence of digital identity data remains an open question. As adoption expands and security is tested in practice, the debate over convenience versus privacy is unlikely to go away anytime soon. TechRadar is continuing to consult industry experts and will provide updates as more insights emerge.

Elon Musk Unveils ‘X Chat,’ a New Encrypted Messaging App Aiming to Redefine Digital Privacy

 

Elon Musk, the entrepreneur behind Tesla, SpaceX, and X, has revealed a new messaging platform called X Chat—and he claims it could dramatically reshape the future of secure online communication.

Expected to roll out within the next few months, X Chat will rely on peer-to-peer encryption “similar to Bitcoin’s,” a move Musk says will keep conversations private while eliminating the need for ad-driven data tracking.

The announcement was made during Musk’s appearance on The Joe Rogan Experience, where he shared that his team had “rebuilt the entire messaging stack” from scratch.
“It’s using a sort of peer-to-peer-based encryption system,” Musk said. “So, it’s kind of similar to Bitcoin. I think, it’s very good encryption.”

Musk has repeatedly spoken out against mainstream messaging apps and their data practices. With X Chat, he intends to introduce a platform that avoids the “hooks for advertising” found in most competitors—hooks he believes create dangerous vulnerabilities.

“(When a messaging app) knows enough about what you’re texting to know what ads to show you, that’s a massive security vulnerability,” he said.
“If it knows enough information to show you ads, that’s a lot of information,” he added, warning that attackers could exploit the same data pathways to access private messages.

He emphasized that his approach to digital safety views security on a spectrum rather than a binary system. The goal, according to Musk, is to make X Chat “the least insecure” option available.

When launched, X Chat is expected to rival established encrypted platforms like WhatsApp and Telegram. However, Musk insists that X Chat will differentiate itself by maintaining stricter privacy boundaries.

While Meta states that WhatsApp’s communications use end-to-end encryption powered by the Signal Protocol, analysts note that WhatsApp still gathers metadata—details about user interactions—which is not encrypted. Additionally, chat backups remain unencrypted unless users enable that setting manually.

Musk argues that eliminating advertising components from X Chat’s architecture removes many of these weak points entirely.

A beta version of X Chat is already accessible to Premium subscribers on X. Early features include text messaging, file transfers, photos, GIFs, and other media, all associated with X usernames rather than phone numbers. Audio and video calls are expected once the app reaches full launch. Users will be able to run X Chat inside the main X interface or download it separately, allowing messaging, file sharing, and calls across devices.

Some industry observers believe X Chat could influence the digital payments space as well. Its encryption model aligns closely with the principles of decentralization and data ownership found in blockchain ecosystems. Analysts suggest the app may complement bitcoin-based payroll platforms, where secure communication is essential for financial discussions.

Still, the announcement has raised skepticism. Privacy researchers and cryptography experts are questioning how transparent Musk will be about the underlying encryption system. Although Musk refers to it as “Bitcoin-style,” technical documentation and details about independent audits have not been released.

Experts speculate Musk is referring to public-key cryptography—the same foundational technology used in Bitcoin and Nostr.

Critics argue that any messaging platform seeking credibility in the privacy community must be open-source for verification. Some also note that trust issues may arise due to past concerns surrounding Musk-owned platforms and their handling of user data and content moderation.

WhatsApp’s “We See You” Post Sparks Privacy Panic Among Users

 

WhatsApp found itself in an unexpected storm this week after a lighthearted social media post went terribly wrong. The Meta-owned messaging platform, known for emphasizing privacy and end-to-end encryption, sparked alarm when it posted a playful message on X that read, “people who end messages with ‘lol’ we see you, we honor you.” What was meant as a fun cultural nod quickly became a PR misstep, as users were unsettled by the phrase “we see you,” which seemed to contradict WhatsApp’s most fundamental promise—that it can’t see users’ messages at all. 

Within minutes, the post went viral, amassing over five million views and an avalanche of concerned replies. “What about end-to-end encryption?” several users asked, worried that WhatsApp was implying it had access to private conversations. The company quickly attempted to clarify the misunderstanding, replying, “We meant ‘we see you’ figuratively lol (see what we did there?). Your personal messages are protected by end-to-end encryption and no one, not even WhatsApp, can see them.” 

Despite the clarification, the irony wasn’t lost on users—or critics. A platform that has spent years assuring its three billion users that their messages are private had just posted a statement that could easily be read as the opposite. The timing and phrasing of the post made it a perfect recipe for confusion, especially given the long-running public skepticism around Meta’s privacy practices. WhatsApp continued to explain that the message was simply a humorous way to connect with users who frequently end their chats with “lol.” 

The company reiterated that nothing about its encryption or privacy commitments had changed, emphasizing that personal messages remain visible only to senders and recipients. “We see you,” they clarified, was intended as a metaphor for understanding user habits—not an admission of surveillance. The situation became even more ironic considering it unfolded on X, Elon Musk’s platform, where he has previously clashed with WhatsApp over privacy concerns. 

Musk has repeatedly criticized Meta’s handling of user data, and many expect him to seize on this incident as yet another opportunity to highlight his stance on digital privacy. Ultimately, the backlash served as a reminder of how easily tone can be misinterpreted when privacy is the core of your brand. A simple social media joke, meant to be endearing, became a viral lesson in communication strategy. 

For WhatsApp, the encryption remains intact, the messages still unreadable—but the marketing team has learned an important rule: never joke about “seeing” your users when your entire platform is built on not seeing them at all.

Deepfakes Are More Polluting Than People Think

 


Artificial intelligence, while blurring the lines between imagination and reality, is causing a new digital controversy to unfold at a time when ethics and creativity have become less important and the digital realm has become a much more fluid one. 

With the advent of advanced artificial intelligence platforms such as OpenAI's Sora, deepfake videos have been able to flood social media feeds with astoundingly lifelike representations of celebrities and historic figures, resurrected in scenes that at times appear sensational but at other times are deeply offensive, thanks to advanced artificial intelligence platforms.

In fact, the phenomenon has caused widespread concern amongst families of revered personalities such as Dr Martin Luther King Jr. Several people are publicly urging technology companies to put more safeguards in place to prevent the unauthorised use of their loved ones' likenesses.

However, as the debate over the ethical boundaries of synthetic media intensifies, there is one hidden aspect of the issue that is quietly surfacing, namely, the hidden environmental impact that synthetic media has on the environment. 

The creation of these hyperrealistic videos requires a great deal of computational power, as explained by Dr Kevin Grecksch, a professor at the University of Oxford. They also require a substantial amount of energy and water to maintain the necessary cooling systems within the data centres. Despite appearing as a fleeting piece of digital art, it has a significant environmental cost hidden beneath it, adding an unexpected layer of concerns surrounding the digital revolution that is a growing concern. 

As social media platforms have grown, there has been an increasing prevalence of deepfake videos, whose uncanny realism has captured audiences while blurring the line between truth and fabrication, while also captivating them. 

As AI-powered tools such as OpenAI's Sora have become more widely available, these videos have become viral as a result of being able to conjure up lifelike portraits of individuals – some of whom have long passed away – into fabricated scenes that range from bizarre to deeply inappropriate in nature. 

Several families who have been portrayed in this disturbing trend, including that of Dr Martin Luther King Jr., have raised alarm over the trend and have called on technology companies to prevent unauthorised digital resurrections of their loved ones. However, there is much more to the controversy surrounding deepfakes than just issues of dignity and consent at play. 

Despite the convincingly rendered nature of these videos, Dr Kevin Grecksch, a lecturer at Oxford University, has stressed that these videos have a significant ecological impact that is often overlooked. Generating such content is dependent upon the installation of powerful data centres that consume vast amounts of electricity and water to cool, resources that contribute substantially to the growing environmental footprint of this technology on a large scale. 

It has emerged that deep fakes, a form of synthetic media that is rapidly advancing, are one of the most striking examples of how artificial intelligence is reshaping digital communication. By combining complex deep learning algorithms with a massive dataset, these technologies can convincingly replace or manipulate faces, voices, and even gestures with ease. 

The likeness of one person is seamlessly merged with the likeness of another, creating a seamless transition from one image to the next. Additionally, shallow fakes, which are less technologically complex but equally important, are also closely related, but they rely on simple editing techniques to distort reality to an alarming degree, blurring the line between authenticity and fabrication. The proliferation of deepfakes has accelerated rapidly at an unprecedented pace over the past few years. 

A new report suggests that the number of such videos that circulate online has doubled every six months. It is estimated that there will be 500,000 deepfake videos and audio clips being shared globally by 2023, and if current trends hold true, this number is expected to reach almost 8 million by 2025. Using advanced artificial intelligence tools and the availability of publicly available data, experts attribute this explosive growth to the fact that these tools are widely accessible and there is a tremendous amount of public data, which creates an ideal environment for manipulated media to flourish. 

As a result of the rise of deepfake technology, legal and policy circles have been riddled with intense debate, underscoring the urgency of redefining the boundaries of accountability in an era in which synthetic media is so prevalent. With hyper-realistic digital forgeries created by advanced deep learning algorithms, which are very realistic, it poses a complex challenge that goes well beyond the technological edge. 

Legal scholars have warned that deep fakes pose a significant threat to privacy, intellectual property, and dignity, while also undermining public trust in the information they provide. A growing body of evidence suggests that these fabrications may carry severe social, ethical, and legal consequences not only from their ability to mislead but also from their ability to influence electoral outcomes and facilitate non-consensual pornography, all of which carry severe social, ethical, and legal consequences. 

In an effort to contain the threat, the European Union is enforcing legislation such as its Artificial Intelligence Act and Digital Services Act, which aim to assign responsibility for large online platforms and establish standards for the governance of Artificial Intelligence. Even so, experts contend that such initiatives remain insufficient due to the absence of comprehensive definitions, enforcement mechanisms, and protocols for assisting victims. 

Moreover, the situation is compounded by a fragmented international approach: although many states in the United States have enacted laws addressing fake media, there are still inconsistencies across jurisdictions, and countries like Canada continue to face challenges in regulating deepfake pornography and other forms of synthetic nonconsensual media. 

Social media has become an increasingly important platform for spreading manipulated media, which in turn increases these risks. Scholars have advocated sweeping reforms, which range from stricter privacy laws to recalibrating free speech to preemptive restrictions on deepfake generation, to mitigate future damage that is likely to occur. This includes identity theft, fraud, and other harms that existing legal systems are incapable of dealing with. 

It is important to note that ethical concerns are also emerging outside of the policy arena, in unexpected circumstances, such as the use of deep fakes in grief therapy and entertainment, where the line between emotional comfort and manipulation becomes dangerously blurred during times of emotional distress. 

The researchers, who are calling for better detection and prevention frameworks, are reaching a common conclusion: ideepfakes must be regulated in a manner that strikes a delicate balance between innovation and protection, ensuring that technological advances do not take away truth, justice, or human dignity as a result. This era of synthetic media has provoked a heated debate within legal and policy circles concerning the rise of deepfake technology, emphasising the importance of redefining the boundaries of accountability in a world where deep fakes have become a common phenomenon.

The hyper-realistic digital forgeries produced by advanced deep learning algorithms pose a challenge that goes well beyond the novelty of technology. There is considerable concern that deepfakes may threaten the integrity of information, as well as undermine public trust in it, while also undermining the core principles of privacy, intellectual property, and personal dignity. 

As a result of the fabrications' ability to distort reality, it has already been reported that they are capable of spreading misinformation, influencing elections, and facilitating nonconsensual pornography, all of which can have serious social, ethical, and legal repercussions. In an effort to contain the threat, the European Union is enforcing legislation such as its Artificial Intelligence Act and Digital Services Act, which aim to assign responsibility for large online platforms and establish standards for the governance of Artificial Intelligence.

Even so, experts contend that such initiatives remain insufficient due to the absence of comprehensive definitions, enforcement mechanisms, and protocols for assisting victims. Inconsistencies persist across jurisdictions, which further complicates the situation. While some U.S. states have enacted laws to address false media, there are still inconsistencies across jurisdictions, and countries such as Canada are still struggling with how to regulate non-consensual synthetic materials, including deepfake pornography and other forms of pseudo-synthetic material. 

Social media has become an increasingly important platform for spreading manipulated media, which in turn increases these risks. Scholars have advocated sweeping reforms, which range from stricter privacy laws to recalibrating free speech to preemptive restrictions on deepfake generation, to mitigate future damage that is likely to occur. This includes identity theft, fraud, and other harms that existing legal systems are incapable of dealing with. 

Additionally, ethical concerns are emerging beyond the realm of policy as well, in unexpected contexts such as those regarding deepfakes' use in grief therapy and entertainment, where the line between emotional comfort and manipulative behaviours becomes a dangerous blur to the point of becoming dangerously indistinguishable. 

Research suggests that more robust detection and prevention frameworks are needed to detect and prevent deepfakes. One conclusion becomes increasingly evident as a result of these findings: the regulation of deepfakes requires a delicate balance between innovation and protection, so that progress in technology does not trample upon truth, justice, and human dignity in its wake. 

A growing number of video generation tools powered by artificial intelligence have become so popular that they have transformed online content creation, but have also raised serious concerns about the environmental consequences of these tools. Data centres are the vast digital backbones that make such technologies possible, and they use large quantities of electricity and fresh water to cool servers on a large scale. 

The development of applications like OpenAI’s Sora has made it easy for users to create and share hyperrealistic videos quickly, but social media platforms have also seen an increase in deepfake content, which has helped such apps rise to the top of the global download charts. Within just five days, Sora had over one million downloads within just five days, cementing its position as the dominant app in the US Apple App Store. 

In the midst of this surge of creative enthusiasm, however, there is a growing environmental dilemma that has been identified by DDrKevin Grecksch of the University of Oxford in his recently published warning against ignoring the water and energy demands of AI infrastructure. He urged users and policymakers alike to be aware that digital innovation has a significant ecological footprint, and that it takes a lot of water to carry out, and that it needs to be carefully considered when using water. 

It has been argued that the "cat is out of the sack" with the adoption of artificial intelligence, but that more integrated planning is imperative when it comes to determining where and how data-centric systems should be built and cooled. 

A warning he made was that even though the government envisions South Oxfordshire as a potential hub for the development of artificial intelligence, insufficient attention has been paid to the environmental logistics, particularly where the necessary water supply will come from. Since enthusiasm for the development of generative technologies continues to surge, experts insist that the conversation regarding the future of AI needs to go beyond innovation and efficiency, encompassing sustainability, resource management, and long-term environmental responsibility. 

There is no denying that the future of artificial intelligence demands more than admiration for its brilliance as it stands at a crossroads between innovation and accountability, but responsibility as to how it is applied. Even though deepfake technology is a testament to human ingenuity, it should be governed by ethics, regulation, and sustainability, as well as other factors.

There is a need to collaborate between policymakers, technology firms, and environmental authorities in order to develop frameworks which protect both digital integrity as well as natural resources. For a safer and more transparent digital era, we must encourage the use of renewdatacentresin datacentress, enforce stricter consent-based media laws, and invest in deepfake detection systems in order to ensure that deepfake detection systems are utilised. 

AI offers the promise of creating a world without human intervention, yet its promise lies in our capacity to control its outcomes - ensuring that in a world increasingly characterised by artificial intelligence, progress remains a force for truth, equity, and ecological balance.

EU’s Child Sexual Abuse Regulation Risks Undermining Encryption and Global Digital Privacy

 

The European Union’s proposed Child Sexual Abuse Regulation (CSAR)—often referred to as Chat Control—is being criticized for creating an illusion of safety while threatening the very foundation of digital privacy. Experts warn that by weakening end-to-end encryption, the proposal risks exposing users worldwide to surveillance, exploitation, and cyberattacks. 

Encryption, which scrambles data to prevent unauthorized access, is fundamental to digital trust. It secures personal communications, financial data, and medical records, forming a critical safeguard for individuals and institutions alike. Yet, several democratic governments, including those within the EU, have begun questioning its use, framing strong encryption as an obstacle to law enforcement. This false dichotomy—between privacy and public safety—has led to proposals that inadvertently endanger both. 

At the center of the EU’s approach is client-side scanning, a technology that scans messages on users’ devices before encryption. Critics compare it to having someone read over your shoulder as you type a private letter. While intended to detect child sexual abuse material (CSAM), the system effectively eliminates confidentiality. Moreover, it can be easily circumvented—offenders can hide files by zipping, renaming, or converting them to other formats, undermining the entire purpose of the regulation. 

Beyond its inefficiency, client-side scanning opens the door to mass surveillance. Once such systems exist, experts fear they could be repurposed to monitor political dissent, activism, or journalism. By introducing backdoors—intentional weaknesses that allow access to encrypted data—governments risk repeating mistakes like those seen in the Salt Typhoon case, where a Chinese state-sponsored group exploited backdoors originally built for U.S. agencies. 

The consequences of weakened encryption are vast. Journalists would struggle to protect sources, lawyers could no longer guarantee client confidentiality, and businesses risk exposure of trade secrets. Even governments rely on encryption to protect national security. For individuals—especially victims of domestic abuse or marginalized groups—encrypted communication can literally be a matter of life and death. 

Ironically, encryption also protects children. Research from the UK’s Information Commissioner’s Office found that encrypted environments make it harder for predators to access private data for grooming. Weakening encryption, therefore, could expose children to greater harm rather than prevent it. 

Public opposition to similar policies has already shifted outcomes elsewhere. In Australia, controversial encryption laws passed in 2018 have yet to be enforced due to political backlash. In the UK, public resistance to the Online Safety Act led major tech companies to threaten withdrawal rather than compromise encryption.  

Within the EU, member states remain divided. Poland, Finland, the Netherlands, and the Czech Republic have opposed the CSAR for privacy and security reasons, while France, Denmark, and Hungary support it as a necessary tool against abuse. Whatever the outcome, the effects will extend globally—forcing tech companies to either weaken encryption standards or risk losing access to the European market. 

As the world marks Global Encryption Day, the debate surrounding CSAR highlights a broader truth: safeguarding the internet means preserving both safety and privacy. Rather than imposing blanket surveillance, policymakers should focus on targeted investigations, rapid CSAM takedown measures, and support for victims.  
Encryption remains the cornerstone of a secure, trustworthy, and free internet. If the EU truly aims to protect children and its citizens, it must ensure that this foundation remains unbroken—because once privacy is compromised, safety soon follows.

Chatbots and Children in the Digital Age


The rapid evolution of the digital landscape, especially in the area of social networking, is likely to have an effect on the trend of children and teens seeking companionship through artificial intelligence. This raises some urgent questions about the safety of these interactions. 

In a new report released on Wednesday by Common Sense Media, the nonprofit organisation has warned that companion-style artificial intelligence applications pose an unacceptable risk to young users, especially as they relate to mental health, privacy, and emotional well-being. 

Following the suicide of a 14-year-old boy whose final interactions with a chatbot on the platform Character.AI last year, concerns about these bots gained a significant amount of attention. It was in that case that conversational AI apps became the focus of attention, which sparked further scrutiny of how they affect young people's lives and prompted calls for greater transparency, accountability, and safeguards to keep vulnerable users safe from the darker sides of digital companionship. 

Artificial intelligence chatbots and companion apps have become increasingly commonplace in children's online experiences, offering entertainment, interactive exchanges, and even learning tools. Although these technologies are appealing, experts say that they can also come with a range of risks that should not be overlooked, as well as their appeal. 

In spite of platforms' routine collection and storage of user data, often without adequate protection for children, privacy remains a central issue. Despite the use of filters, chatbots may produce unpredictable responses, resulting in harmful or inappropriate content being displayed to young users.  A second concern that researchers have is the emotional dependence some children may develop on these AI companions, a bond that, according to researchers, may interfere with their real-world relationships and social development. 

Similarly, there is the risk of misinformation because AI systems do not always provide accurate answers, leaving children vulnerable to receiving misleading advice. It is difficult for children to navigate digital companionship in light of these factors, including persuasive design features, in-app purchases and strategies aimed at maximising their screen time, which combine to create a complex and sometimes troubling environment. 

Several advocacy groups have intensified their criticism of such platforms, highlighting that prolonged interactions with AI chatbots may lead to psychological consequences. Common Sense Media's recent risk assessment, carried out in conjunction with Stanford University School of Medicine researchers, was conducted with input from these researchers. It concluded that conversational agents are increasingly being integrated into video games and popular social media platforms, such as Instagram and Snapchat, in an effort to mimic human interaction in ways that require greater oversight. 

The flexibility that makes these bots so engaging is also the risk of emotional entanglement that they pose, from casual friends to romantic partners and even a digital replacement for a deceased loved one, yet the very nature of the bots that makes them so engaging also makes them so risky. It was particularly evident that the dangers of such chatbots were highlighted when Megan Garcia filed a lawsuit against Character.

AI to claim that her 14-year-old son, Sewell Setzer, committed suicide after developing a close relationship with a chatbot. It has been reported by the Miami Herald that, although the company has denied responsibility, asserted that safety is of utmost importance, and asked a Florida judge to dismiss the lawsuit based on free speech, the case has heightened broader concerns. 

In response to his comments, Garcia has emphasised the importance of adopting protocols to manage conversations around self-harm, as well as reporting annual safety reports to the Office of Suicide Prevention in California. Separately, Common Sense Media urged companies to conduct risk assessments of systems marketed to children, and to ban the use of emotionally manipulative bots, initiatives strongly supported by the organisation. 

There is a major problem with the anthropomorphic nature of AI companions that is at the heart of these disagreements. AI companions are designed to imitate human speech, personality, and conversational style. A person with such realistic features can create an illusion of trust and genuine understanding for a child or teenager, since they have a vivid imagination and less developed critical thinking skills. 

It has already led to troubling results when the line between humans and machines is blurred. As an example, a nine-year-old boy who had his screen time restricted turned to a chatbot for guidance, only for it to be informed that it could understand why a child might harm their parents in response to “abuse” in his situation. 

Another case is of a 14-year-old who developed romantic feelings for a character he created in a role-playing app and ended up taking his own life as a result of this connection. It has been highlighted that these systems can create a sense of empathy and companionship, but they are unable to think, feel, or create the stable, nurturing relationships that are essential for healthy childhood development. 

Rather than fostering “parasocial” relationships, children may become attached emotionally to entities that are incapable of genuine care, leaving them vulnerable to manipulation, misinformation, and exposure to sexual content and violent images. 

There is no doubt in my mind that these systems can have a profoundly destabilising effect on those already struggling with trauma, developmental difficulties, or mental health struggles, thus emphasising the urgent need for regulation, parental vigilance, and enhanced industry accountability. It is emphasised by experts that while AI chatbots pose real risks to children, parents can take practical steps to safeguard their children at the current time to reduce these risks. 

Keeping children safe online is one of the most important measures, so AI companions need to be treated exactly like strangers online, and children shouldn't be left alone to interact with them without guidance. Establishing clear boundaries and, when possible, co-using the technology can assist in creating safer environment. 

Open dialogue is equally important, too. A lot of experts recommend that, instead of policing, parents should encourage children to engage in conversation with chatbots by asking about the exchanges they are having with them and then using this exchange to encourage curiosity while also keeping an eye out for potential troubling responses. 

In addition to using technology as part of the solution, parents can also use parental control and monitoring tools in order to keep track of their children's activities and to find out how much time they spend with their artificial intelligence companions. Fact-checking is also an integral part of safe use. Like an obsolete encyclopedia, chatbots can be useful for providing insight, but they are sometimes inaccurate as well. 

Children need to be taught the importance of questioning answers and verifying other sources as soon as possible, according to experts. It is also important, however, to create screen-free spaces that reinforce real human connections and counterbalance the pull of digital companionship. For instance, family dinners, car rides, and other daily routines without screens should be carved out as soon as possible. 

It is important to ensure these safeguards are implemented, given the growing mental health problems among children and teenagers. The theory of artificial intelligence being able to support emotional well-being is gaining popularity lately, but specialists caution that current systems do not have the capacity to deal with crises like self-harm or suicidal thoughts as they happen. 

Currently, mental health professionals believe more collaboration with technology companies is crucial, but for the time being, the oldest and most reliable form of prevention is the one that is most effective and most reliable: human care and presence. In addition to talking with their children, parents need to pay attention to their digital interactions with their children, and they need to intervene if their children's dependence on artificial intelligence companions starts overtaking healthy relationships. 

In one expert's opinion, a child who appears unwilling to put down their phone or is absorbed in chatbot conversations may require a timely intervention. AI companies are also being questioned by regulators about how they handle massive amounts of data that their users generate. Questions have been raised about privacy, commercialisation, and accountability as a result. 

There are also issues under review with regard to monetisation of user engagements, sharing the personal data collected from chatbot conversations, and monitoring for potential harm associated with their products. In their investigation of the companies that are collecting data from children under 13 years of age, the Federal Trade Commission has emphasised how they are ensuring they are complying with the Children's Online Privacy Protection Act. 

In addition to the risks in the home, there are also concerns over whether AI is being used properly in the classroom, where the growing pressure to incorporate artificial intelligence into education has raised concerns over compliance with federal education privacy laws. FERPA was passed in 1974 and protects the rights of children and parents in the educational system. 

Fourteen years later, Amelia Vance, the president of the Public Interest Privacy Centre, warned schools that they may sometimes inadvertently violate the federal law if they are not vigilant regarding data sharing practices and if they rely on commercial chatbots like ChatGPT. Families who have not explicitly opted out of the use of chat queries to train AI systems raise questions about how this is handled, since many AI companies reserve the right to do so unless they specifically opt out. 

Although policymakers and education leaders have emphasised the importance of AI literacy among young people, Vance highlighted that schools are not permitted to instruct students to use consumer-facing services whose data is processed outside of institutional control until parental consent has been obtained. The Act protects the privacy of students by safeguarding the information provided in FERPA, which is neither intended to compromise student privacy nor to breach it. 

There are legitimate concerns about safety, privacy, and emotional well-being, but experts also acknowledge that artificial intelligence chatbots are not inherently harmful and can be useful for children when handled responsibly. Using these tools, children can be inspired to write stories, gain language and communication skills, and even practice social interactions in a controlled environment using low-stakes practice. 

The potential of chatbots to support personalised learning has been highlighted by educators as they offer students instant explanations, adaptive feedback, and playful engagement, all of which will keep them motivated in the classroom. However, these benefits must be accompanied by a structured approach, thoughtful parental involvement, and robust safeguards that minimise the risk of harmful content or emotional dependency. 

A balanced opinion emerging from child development researchers and experts has stated that AI companions, much like televisions and video games in years gone by, should not be regarded as replacing human interaction, but rather as supplements to it. By providing a safe environment, ethical guidelines and integrating them into healthy routines, children may be able to explore and learn in new ways when guided by adults. 

Nevertheless, without oversight, the very same qualities that make these tools appealing—constant availability, personalisation, and human-like interaction—are also the ones that magnify potential risks. Considering these realities, children must be protected from harm from innovation through measured regulation, transparent industry practices, and proactive digital literacy education. This dual reality underscores the importance of ensuring children receive the benefits of innovation while remaining protected from its harm. 

Children and adolescents are increasingly experiencing the benefits of artificial intelligence as it becomes a part of their daily lives, but they must maximise the benefits while minimising the risks. AI chatbots can indeed be used responsibly in order to inspire creativity, enhance learning, and facilitate the possibility of low-risk social experimentation, while complementing traditional education and fostering the development of skills as they go. 

This suggests that there is no doubt that these tools can be dangerous for young users as a result of exposing them to privacy breaches, misinformation, manipulation of emotions, and psychological vulnerabilities, as has been demonstrated by the cases highlighted in recent reports on this topic. It is recommended that for children's digital experiences to be safeguarded, a multilayered approach is necessary. 

In addition to parent involvement, educators should incorporate artificial intelligence thoughtfully into structured learning environments, and policymakers should enforce transparent industry standards to safeguard children's digital experiences. Various strategies can be implemented to help reinforce healthy digital habits in children, including encouraging critical thinking skills, fact-checking, and screen-free family time, while ongoing dialogue about online interactions can help children negotiate the blurred boundaries between humans and machines. 

Family and institutional policies can make sure that Artificial Intelligence becomes a constructive tool for growth rather than a source of harm by fostering awareness, setting clear boundaries, and cultivating supportive real-life relationships that support the exploration, learning, and innovation of children in a digital age that is free from harm.

How Age Verification Measures Are Endangering Digital Privacy in the UK



A pivotal moment in the regulation of the digital sphere has been marked by the introduction of the United Kingdom's Online Safety Act in July 2025. With the introduction of this act, strict age verification measures have been implemented to ensure that users are over the age of 25 when accessing certain types of online content, specifically adult websites. 

Under the law, all UK internet users have to verify their age before using any of these platforms to protect minors from harmful material. As a consequence of the rollout, there has been an increase in circumvention efforts, with many resorting to the use of virtual private networks (VPNs) in an attempt to circumvent these controls. 

As a result, a national debate has arisen about how to balance child protection with privacy, as well as the limits of government authority in online spaces, with regard to child protection. A company that falls within the Online Safety Act entails that they must implement stringent safeguards designed to protect children from harmful online material as a result of its provisions. 

In addition to this, all pornography websites are legally required to have robust age verification systems in place. In a report from Ofcom, the UK's regulator for telecoms and responsible for enforcing the Child Poverty Act, it was found that almost 8% of children aged between eight and fourteen had accessed or downloaded a pornographic website or application in the previous month. 

Furthermore, under this legislation, major search engines and social media platforms are required to take proactive measures to keep minors away from pornographic material, as well as content that promotes suicide, self-harm, or eating disorders, which must not be available on children's feeds at all. Hundreds of companies across a wide range of industries have now been required to comply with these rules on such a large scale. 

The United Kingdom’s Online Safety Act came into force on Friday. Immediately following the legislation, a dramatic increase was observed in the use of virtual private networks (VPNs) and other circumvention methods across the country. Since many users have sought alternative means of accessing pornographic, self-harm, suicide, and eating disorder content because of the legislation, which mandates "highly effective" age verification measures for platforms hosting these types of content, the legislation has led some users to seek alternatives to the platforms. 

The verification process can require an individual to upload their official identification as well as a selfie in order to be analysed, which raises privacy concerns and leads to people searching for workarounds that work. There is no doubt that the surge in VPN usage was widely predicted, mirroring patterns seen in other nations with similar laws. However, reports indicate that users are experimenting with increasingly creative methods of bypassing the restrictions imposed on them. 

There is a strange tactic that is being used in the online community to trick certain age-gated platforms with a selfie of Sam Porter Bridges, the protagonist of Death Stranding, in the photo mode of the video game. In today's increasingly creative circumventions, the ongoing cat-and-mouse relationship between regulatory enforcement and digital anonymity underscores how inventive circumventions can be. 

Virtual private networks (VPNs) have become increasingly common in recent years, as they have enabled users to bypass the United Kingdom's age verification requirements by routing their internet traffic through servers that are located outside the country, which has contributed to the surge in circumvention. As a result of this technique, it appears that a user is browsing from a jurisdiction that is not regulated by the Online Safety Act since it masks their IP address. 

It is very simple to use, simply by selecting a trustworthy VPN provider, installing the application, and connecting to a server in a country such as the United States or the Netherlands. Once the platform has been active for some time, age-restricted platforms usually cease to display verification prompts, as the system does not consider the user to be located within the UK any longer.

Following the switch of servers, reports from online forums such as Reddit indicate seamless access to previously blocked content. A recent study indicated VPN downloads had soared by up to 1,800 per cent in the UK since the Act came into force. Some analysts are arguing that under-18s are likely to represent a significant portion of the spike, a trend that has caused lawmakers to express concern. 

There have been many instances where platforms, such as Pornhub, have attempted to counter circumvention by blocking entire geographical regions, but VPN technology is still available as a means of gaining access for those who are determined to do so. Despite the fact that the Online Safety Act covers a wide range of digital platforms besides adult websites that host user-generated content or facilitate online interaction, it extends far beyond adult websites. 

The same stringent age checks have now been implemented by social media platforms like X, Bluesky, and Reddit, as well as dating apps, instant messaging services, video sharing platforms, and cloud-based file sharing services, as well as social network platforms like X, Bluesky, and Reddit. Because the methods to prove age have advanced far beyond simply entering the date of birth, public privacy concerns are intensified.

In the UK’s communications regulator, Ofcom, a number of mechanisms have been approved for verifying the identity of people, including estimating their facial age by uploading images or videos, matching photo IDs, and confirming their identity through bank or credit card records. Some platforms perform these checks themselves, while many rely on third-party providers-entities that will process and store sensitive personal information like passports, biometric information, and financial information. 

The Information Commissioner's Office, along with Ofcom, has issued guidance stating that any data collected should only be used for verification purposes, retained for a limited period of time, and never used to advertise or market to individuals. Despite these safeguards being advisory rather than mandatory, they remain in place. 

With the vast amount of highly personal data involved in the system and its reliance on external services, there is concern that the system could pose significant risks to user privacy and data security. As well as the privacy concerns, the Online Safety Act imposes a significant burden on digital platforms to comply with it, as they are required to implement “highly effective age assurance” systems by the deadline of July 2025, or face substantial penalties as a result. 

A disproportionate amount of these obligations is placed on smaller companies and startups, and international platforms must decide between investing heavily in UK-specific compliance measures or withdrawing all services altogether, thereby reducing availability for British users and fragmenting global markets. As a result of the high level of regulatory pressure, in some cases, platforms have blocked legitimate adult users as a precaution against sanctions, which has led to over-enforcement. 

Opposition to this Act has been loud and strong: an online petition calling for its repeal has gathered more than 400,000 signatures, but the government still maintains that there are no plans in place to reverse it. Increasingly, critics assert that political rhetoric is framed in a way that implies tacit support for extremist material, which exacerbates polarisation and stifles nuanced discussion. 

While global observers are paying close attention to the UK's internet governance model, which could influence future internet governance in other parts of the world, global observers are closely watching it. The privacy advocates argue that the Act's verification infrastructure could lead to expanded surveillance powers as a result of its comparison to the European Union's more restrictive policies toward facial recognition. 

There are a number of tools, such as VPNs, that can help individuals protect their privacy if they are used by reputable providers who have strong encryption policies, as well as no-log policies, which are in place to ensure that no data is collected or stored. While such measures are legal, experts caution that they may breach the terms of service of platforms, forcing users to weigh privacy protections versus the possibility of account restrictions when implementing such measures. 

The use of "challenge ages" as part of some verification systems is intended to reduce the likelihood that underage users will slip through undetected, since they will be more likely to be detected if an age verification system is not accurate enough. According to Yoti's trials, setting the threshold at 20 resulted in fewer than 1% of users aged 13 to 17 being incorrectly granted access after being set at 20. 

Another popular method of accessing a secure account involves asking for formal identification such as a passport or driving licence, and processing the information purely for verification purposes without retaining the information. Even though all pornographic websites must conduct such checks, industry observers believe that some smaller operators may attempt to avoid them out of fear of a decline in user engagement due to the compliance requirement. 

In order to take action, many are expected to closely observe how Ofcom responds to breaches. There are extensive enforcement powers that the regulator has at its disposal, which include the power to issue fines up to £18 million or 10 per cent of a company's global turnover, whichever is higher. Considering that Meta is a large corporation, this could add up to about $16 billion in damages. Further, formal warnings, court-ordered site blocks, as well as criminal liability for senior executives, may also be an option. 

For those company leaders who ignore enforcement notices and repeatedly fail to comply with the duty of care to protect children, there could be a sentence of up to two years in jail. In the United Kingdom, mandatory age verification has begun to become increasingly commonplace, but the long-term trajectory of the policy remains uncertain as we move into the era. 

Even though it has been widely accepted in principle that the program is intended to protect minors from harmful digital content, its execution raises unresolved questions about proportionality, security, and unintended changes to the nation's internet infrastructure. Several technology companies are already exploring alternative compliance methods that minimise data exposure, such as the use of anonymous credentials and on-device verifications, but widespread adoption of these methods depends on the combination of the ability to bear the cost and regulatory endorsement. 

It is predicted that future amendments to the Online Safety Act- or court challenges to its provisions-will redefine the boundary between personal privacy and state-mandated supervision, according to legal experts. Increasingly, the UK's approach is being regarded as an example of a potential blueprint for similar initiatives, particularly in jurisdictions where digital regulation is taking off. 

Civil liberties advocates see a larger issue at play than just age checks: the infrastructure that is being constructed could become a basis for more intrusive monitoring in the future. It will ultimately be decided whether or not the Act will have an enduring impact based on not only its effectiveness in protecting children, but also its ability to safeguard the rights of millions of law-abiding internet users in the future.