That Privacy Guy! Blog

Apple locks five operating systems against any independent audit while claiming its review keeps users safe.

Mobile apps have ignored privacy law for two decades.

23 US states built their privacy laws on opt-out consent.

The IAPP suspended my certifications for paying my membership dues on the day they were due — despite its own promised grace period.

A tour of my (almost) fully self-hosted AI stack: local LLMs on Apple Silicon, orchestrated by Gitea, human-gated and cloud-free — privacy-first, sovereign AI.

A picture is worth a thousand words.

An extract from It's Personal.

Yesterday 331 MEPs voted to bring Chat Control back under an urgency procedure the President should never have allowed.

A child abuse survivor urges MEPs to reject Chat Control — mass scanning won't protect children, and it breaks the encryption survivors need to safely report abuse.

Pegasus infected the phone of an MEP who sat on the committee investigating it - a real assault on democracy.

The US Supreme Court has just ruled the FTC isn't independent of the President - and our entire data deal with America was built on the promise that it was.

Google's AI named Putin and Xi as dangers to the world but went soft on the US president invading Iran - and a German court has just ruled that whatever its AI says, Google said it.

The UN demands AI accountability while running Google ad-tech, analytics and tracking on its own website - with no consent and a measurable, avoidable carbon cost.

A national police force has, for the first time to my knowledge, opened a criminal investigation into the deployment of adtech surveillance to a person's device without consent.

Datatilsynet just fined Elkjop NOK 20 million (€1.8m) for the forced consent in its loyalty club — five years after I told their DPO it was unlawful.

Amazon's Ring Familiar Faces biometrically scans every person who approaches a Ring doorbell, performs the match in Amazon's cloud rather than on the device that could have done it locally, and stores faceprints of non-consenting strangers for up to thirty

CIPA wiretapping claims and the new EU Environmental Crimes Directive have one thing in common: they are won and lost on forensic evidence of what a website actually does at runtime.

On 27 April 2026 I lodged a formal complaint with Malta's Information and Data Protection Commissioner against Anthropic.

Google has quietly removed the privacy assurance from Chrome's on-device AI Settings UI.

Every CMP I have looked at in fifteen years sets a cookie before the user has consented to anything.