News

Tracking & Personal Data

Tracking code on websites and apps, the profiles data brokers build, and the personal data apps and AI services read.

Automatic phone number verification on Android and the linking of Google accounts

Android phones verify phone numbers automatically by default and add them to every Google Account signed in on the phone, including work and secondary accounts. Verification can be turned off in settings, but according to Android Authority, numbers already added have to be removed from each account one by one. As of 18 October, we had not seen a public response from Google.

Based on 13 sources, including Android Help, Android 說明, Android Authority

Compositor, an open-source image editor, and maintaining and auditing AI-generated code

A designer released Compositor, a free, open-source image editor for the Mac that needs no account, and says AI wrote all of its code. The criticism we found centers on the phrase "I built" and on who reviews and maintains AI-written code. As of 12 October it runs only on Apple silicon Macs with macOS 26 or later.

Based on 19 sources, including Compositor, GitHub, X

Apple's planned changes to granting Full Disk Access on the Mac

Apple said on 2 October that it will require very explicit user action before a Mac app can be granted Full Disk Access, citing some developers' use of the permission and the growing risk from AI agents. Apple gave no version or date, and as of 12 October its release notes do not mention the control.

Based on 18 sources, including Apple, TechCrunch, Decrypt

Brave's Email Aliases

Brave's desktop browser offers email aliases from version 1.94, letting you sign up with a forwarding address instead of your real one. Everyone gets five free, with a Brave account required. As of 12 October there is no mobile version, and Brave does not say whether you can reply from an alias.

Based on 14 sources, including Brave, GitHub, Apple

Memory and permission design in Meta Muse and OpenAI Dots

Meta's Muse and OpenAI's Dots, both launched in September, run continuously in the cloud, read data from connected apps and turn it into memory. As of 2 October, Muse was not in the App Store in Taiwan, Hong Kong, Japan or South Korea, and Dots required ChatGPT's Pro or Business Premium plan. ChatGPT memory settings and Mac permissions can be checked today.

Based on 24 sources, including Meta, OpenAI, Freedom of the Press Foundation

Tracking pixels that sent doctors' appointments to social platforms

Doctoralia's sites in Brazil, Colombia, Mexico and elsewhere in Latin America sent specialties, doctors' names and appointment times to Google, TikTok and LinkedIn. Its parent company does not operate in mainland China, Hong Kong, Macau or Taiwan.

Based on 12 sources, including The Markup, Docplanner, GitHub

Mobile location data and the files data brokers keep on you

The Markup and Consumer Reports obtained data broker files on US residents showing more than a thousand inferences and over a hundred buyers. The Freedom of the Press Foundation lists two phone settings that cut the location data a phone leaks, in any country.

Based on 20 sources, including Freedom of the Press Foundation, The Markup, Laws & Regulations Database of Taiwan

Data access settings for Siri AI in iOS 27

The new Siri in iOS 27 can read Notes, Messages and Mail by default, and requests may be processed on Apple's servers. EFF has listed the settings that narrow what it can read. For now Siri AI works only with Siri set to English.

Based on 4 sources from EFF, Apple

The cross-site identifier behind ChatGPT's ad pixel

A traffic analysis found that ChatGPT's ad system sets a cookie linked to the user's account, which advertisers' sites then send back to OpenAI through its pixel along with browsing data. So far it has only been seen in Chrome on Android.

Based on 5 sources, including Buchodi's Threat Intel, OpenAI, Google Chrome 說明