Enterprises are shaking up their approach to data privacy and governance, new research shows, largely due to added risk factors created by AI adoption.

According to Cisco's 2026 Data and Privacy Benchmark Study, nearly all companies are expanding privacy programs and governance frameworks to protect their data.

AI is the main reason for 90%, with 93% saying they planned further investment to keep up with the complexity of AI systems and the expectations of customers and regulators.

The survey found that 38% spent at least $5 million on their privacy programs in the past year – marking a dramatic increase from just 14% who spent over that threshold in 2024.

Notably, these programs appear to be working well. An overwhelming 96% of organizations reported that robust privacy frameworks were helping unlock AI agility and innovation, and 95% said privacy was essential for building customer trust in AI-powered services.

One interesting change spotted by the researchers is that trust is no longer just a question of meeting regulatory requirements.

Data governance is now seen as a strategic business enabler, with 99% of organizations reporting at least one tangible benefit from their privacy initiatives, such as enhanced agility, innovation, and greater customer loyalty.

Almost half said that clear communication about how data is collected and used is the most effective way to build customer confidence.

As a result, governance is evolving – although many organizations are still working to define and establish the structures they need to manage AI responsibly.

While three-quarters report having a dedicated AI governance body in place, only 12% describe it as mature. Meanwhile, 65% of organizations struggle to access relevant, high-quality data efficiently.

"AI is forcing a fundamental shift in the data landscape, calling for holistic governance of all data – both personal and non-personal,” said Jen Yokoyama, senior vice president, legal innovation and strategy, at Cisco.

“Organizations must deeply understand and structure their data to ensure every automated decision is explainable. It’s not just for compliance, but a necessary scaling engine for AI innovation.”

Data requirements are causing headaches

While 72% of respondents were generally positive about data privacy laws, there is a growing push to streamline and update data requirements, Cisco found.

Just over eight-in-ten organizations surveyed face heightened demand for data localization and global data complexity - and 85% said this adds cost, complexity, and risk to cross-border service delivery. #

Similarly, 77% report these requirements limit their ability to offer seamless 24/7 service across markets.

On top of this, the assumption that locally stored data is inherently more secure is gradually eroding, from 90% in 2025 to 86% in 2026.

“To capture the potential of AI, organizations (83%) are advocating for a shift toward harmonized international standards,” said Harvey Jang, Cisco vice president and chief privacy officer.

“They recognize that global consistency is an economic necessity to ensure data can flow securely while maintaining the high standards of protection required for trust.”

Cisco said enterprises should invest in robust data infrastructure, prioritizing transparency, and embedding security and privacy throughout AI initiatives.

Elsewhere, they should make sure they're making informed decisions about data localization, establish strong AI governance, and kit out their teams with comprehensive training and safeguards.

FOLLOW US ON SOCIAL MEDIA

In January 2025, research from ISACA warned that organizations were deprioritizing privacy budgets and cutting funds for teams. One year on and the situation has deteriorated further, the association claims.

A confluence of challenges, including funding cuts, staff shortages, and growing regulatory compliance pressures are pushing teams to their limits.

Nearly half (44%) of European-based survey respondents told ISACA their teams are already underfunded while 54% expect budgets to be cut further across 2026.

Around four-in-ten (39%) legal privacy workers and over half (51%) of technical privacy workers also reported staff shortages across their teams.

These funding cuts could have severe consequences further down the line, the association warned, especially as organizations continue ramping up adoption of AI tools.

Nearly half (49%) of respondents revealed that managing risks associated with emerging technologies is now a major obstacle to their long-term strategies. The pace of technological change is also having a marked impact on morale and workloads, with more than one-third (68%) highlighting this as a key challenge.

Adding insult to injury, 64% identified compliance-related challenges off the back of new technologies as a key stress driver, with teams forced to pivot rapidly to accommodate for regulations.

Chris Dimitriadis, global chief strategy officer at ISACA, said the study shows privacy teams are now being asked to “manage more risk with fewer resources” – and the impact is beginning to show across Europe.

“As organizations adopt new technologies at speed, the volume and complexity of privacy obligations grow in parallel – yet many teams are still operating without the staffing, funding or training they need to keep pace,” he commented.

Privacy teams are bracing for impact

Privacy teams are frightfully aware of the potential risks associated with understaffing and budget cuts – it’s a trend they’ve contended with for several years now, the study noted.

Notably, many teams are bracing for impact as the effects of these trends come to fruition. More than one-quarter (26%) of respondents told ISACA their organization is “likely to experience a material privacy breach” within the next year.

“Together, this highlights a growing contradiction for European organizations: privacy risk and regulatory expectations continue to rise, while investment in people and resources is being scaled back,” ISACA said in a statement.

Boards still aren’t tuned in

Despite repeated calls for heightened support, privacy professionals still feel board-level attention is “inconsistent”. Just over one quarter (26%) of respondents said their board is “failing to adequately prioritize privacy” regardless of intensified risks.

“When boards underestimate privacy, they underestimate a fundamental pillar of digital trust,” Dimitriadis said. “A single privacy breach can erode years of brand equity, damage customer relationships and trigger significant regulatory consequences.

“Prioritizing privacy is not simply a compliance requirement; it is a business imperative.”

There are positives with regard to privacy awareness, however. The potential monetary penalties associated with regulatory compliance failures mean executives are beginning to pay attention.

More than three quarters (79%) of respondents in Europe said they now use a framework or regulation such as GDPR to “guide their privacy program”.

64% now have a formal incident response plan embedded within their broader privacy strategies, a figure which ISACA said could be improved upon.

However, nearly half (44%) of respondents said the board views their privacy programs as merely “compliance-driven” and not from a holistic perspective.

ISACA warned this is a “narrow focus” which fails to fully address privacy-related risks, thereby leaving organizations exposed.

“These gaps underline a critical truth: privacy cannot be strengthened solely through controls or checklists,” Dimitriadis commented. “It demands sustained investment in people, governance and culture – and that begins at the top.”

FOLLOW US ON SOCIAL MEDIA

MEPs are calling on the European Commission to establish more robust rules on the use of algorithms in recruitment and staff management amidst concerns over privacy and discrimination.

According to recent EU research, 42% of EU workers are currently subject to algorithmic management in the workplace, a figure expected to rise to 55.5% within the next five years.

There's already legislation on artificial intelligence and data protection at EU level, including the EU AI Act and GDPR, while rules focusing more specifically on the use of AI at work are laid out in the Platform Work Directive.

However, the EU lawmakers believe that more specific legislation is required. It has now proposed a series of recommendations aimed at ensuring that the use of automated monitoring and decision-making systems in the workplace is transparent, fair, and safe.

The main thrust of the proposals is that there must be human oversight of all decisions taken or supported by algorithmic management systems.

Workers should have the right to request explanations of any decisions taken or supported by such systems - and, if a worker believes his or her rights to have been infringed, they should have the right to ask for a review.

If successful, the system in question could be modified or discontinued.

Decisions on the offer or termination of employment, the renewal or non-renewal of a contract, changes in pay, or disciplinary action should always be taken by a human and be subject to human review.

"This topic affects both employers and 200 million workers in the EU. A human-centered approach is key, and the rights, safety, and dignity of employers and employees must be strictly respected," said MEP Andrzej Buła.

"This sends a strong signal: Europe can combine competitiveness with social responsibility. It can support innovative enterprises without sacrificing high standards and employee protection."

Cracking down on ‘algorithmic management’

A key focus of the crackdown centers on the fact that workers should be informed about how algorithmic management systems impact working conditions, when they're used to take automated decisions, what type of data they collect or process, and how human oversight is ensured.

MEPs believe workers should be consulted when these systems are used to make decisions affecting pay, evaluation, task allocation or working time.

Similarly, the use of these systems should respect wellbeing and not put workers' safety or physical or mental health at risk.

To protect workers’ privacy and data, the proposed rules would ban the processing of data relating to the emotional, psychological or neurological states of employees, as well as their private communications or geolocation outside working hours.

Elsewhere, the guidelines aim to limit the use of employee data while off-duty, as well as the use of data relating to freedom of association and collective bargaining.

There were 451 votes in favour of the recommendations and 45 against, with 153 abstentions. The European Commission now has three months to respond, by either informing Parliament on the steps it plans to take, or by giving reasons for a refusal.

FOLLOW US ON SOCIAL MEDIA

A new location tracking feature in Microsoft Teams will make it easier to keep tabs on your colleague's activities – and for your boss to know exactly where you are.

Microsoft revealed in September that it was developing a system in Teams to automatically update work locations using Wi-Fi, as well as noting when a laptop is plugged into a configured desk peripheral such as a monitor.

The system is designed to help tackle some of the challenges of hybrid working, when co-workers might be in the office or working from home at different times.

Once this update rolls out, Teams will automatically display location information, rather than leaving colleagues guessing as to whether their coworker's status has been updated and forcing employees to constantly check in with each other.

"When users connect to their organization's Wi-Fi, Teams will soon be able to automatically update their work location to reflect the building they're working from," Microsoft said in a support document.

That means when you're in the office, Teams will know and share that information, making it easier for fellow workers to track you down for some vital in-person collaboration business leaders have been pushing for over the last three years.

However, it'll also be clear when you're not in the office – though the company hasn't revealed details beyond that – and make it harder to dodge interruptions when you are in the office.

How Microsoft Teams location tracking works

The full system is expected to start rolling out in February next year, an apparent delay to earlier plans to begin pushing the feature out this month.

"Automatic detection of work location by plugging into peripherals at a desk is available now," Microsoft noted in a support document. "Automatic detection of work location using a wireless network connection is currently in preview and will be widely available in the near future."

The system will either display that the user is "in the office" or list a specific building, depending on how it's configured and what users have consented to.

Microsoft has clearly recognized that this feature will raise concerns of workplace surveillance. Indeed, the auto-updating location system has to be actively turned on.

"This feature will be off by default," the company said in an explainer document. "Tenant admins will decide whether to enable it and require end-users to opt-in."

Of course, if your manager requires you to turn it on, most employees will feel pressured to comply, but Microsoft stressed "it is not possible for admins to consent on users' behalf."

With an eye on privacy and work-life balance, Microsoft added that the system only operates during working hours.

"The detected work location lasts until the end of a user's working hours. If users connect after their set work hours, their work locations are not set."

Workplace monitoring

The shift to hybrid working has sparked a rise in workplace monitoring as managers seek to maintain some sense of oversight of employees and their work efforts, as well as to track when they're in the office.

Research suggests about a third of companies are using "bossware" of some sort to monitor staff working in the office or remotely. The issue has become a flashpoint for workers in recent years, and research shows that it’s reaching boiling point.

A survey in late 2024 found these practices are harming workforce morale, with three-quarters of respondents claiming they stopped trusting their employer after monitoring tools were introduced.

Last year, research revealed that wireless networking equipment was being used to track employees throughout office buildings by making use of Bluetooth enabled badges, cameras, and even video conferencing systems.

Intriguingly, the feature is set to arrive as Microsoft is apparently planning to tighten up its own hybrid working policies, requiring staff to come into the office more.

As ITPro reported in August, per reports from Business Insider, the tech giant will introduce stricter rules for office attendance in the new year.

The move comes amidst a sharpened focus on workforce productivity at the company, although the crackdown won’t represent a complete return to office (RTO) mandate.

MORE FROM ITPRO

• Salesforce says ‘Microsoft’s anticompetitive tying of Teams' harmed business
• Hackers have been posing as IT support on Microsoft Teams
• Microsoft Teams just added a convenient new feature you can find in Slack

The UK government is reportedly planning to back down on plans to force Apple to share user data.

Tulsi Gabbard, US director of national intelligence, confirmed the move in a post on X, revealing that Downing Street will withdraw plans which would see Apple required to provide a “back door” to access user data.

“Over the past few months, I’ve been working closely with our partners in the UK, alongside @POTUS and @VP, to ensure Americans’ private data remains private and our Constitutional rights and civil liberties are protected,” Gabbard wrote.

“As a result, the UK has agreed to drop its mandate for Apple to provide a “back door” that would have enabled access to the protected encrypted data of American citizens and encroached on our civil liberties.”

The decision to back down follows a months-long war of words between Apple and the UK government over the tech giant’s Advanced Data Protection (ADP) tool, a feature that uses end-to-end encryption and allows users to protect personal data.

The feature even prevents Apple from accessing personal information.

In December last year, the government filed a format notice demanding that Apple grant authorities the right to access encrypted data. This was applicable to users globally, and not specifically in the UK.

The order sparked widespread criticism at the time from privacy experts and industry stakeholders. Legal experts warned that the move could harm industry perception of the UK, noting that the country would “no longer be seen as a safe destination for personal data”.

In response, Apple refused to comply and announced plans to remove access to ADP for UK users. The tech giant began legal proceedings to challenge the demand.

“As we have said many times before, we have never built a backdoor or master key to any of our products or services and we never will,” the company said in a statement at the time.

Apple u-turn “hugely significant” for UK government

The UK government is yet to confirm the decision to back down, however, the rumored decision has been welcomed by security experts.

Charlotte Wilson, head of enterprise at Check Point Software, said the decision to withdraw the demand is “hugely significant”.

“Once you create a master key to encrypted data, it is not just governments that can use it,” she said. “Criminal groups and hostile states will try to exploit it too.”

Wilson added that breaking encryption “not only weakens privacy, but also weakens security for everyone.”

The Apple order was issued under the Investigatory Powers Act, which means orders issued to other companies are essentially shrouded in secrecy.

Wilson said there are still concerns that these powers “remain on the statute books”, meaning that future governments may attempt a similar move in the future.

“Even if this particular demand has been withdrawn, the Investigatory Powers Act still allows future governments to try again,” she said.

“That leaves citizens, campaigners, and businesses in a state of uncertainty about whether the tools that protect their data could be undermined at any point.”

MORE FROM ITPRO

• NCSC expert urges businesses to follow geopolitics as defensive strategy
• The encryption stand-off is getting weirder
• What is end-to-end encryption and why is everyone fighting over it?

Cloudflare has accused Perplexity of failing to honour requests from websites to opt out of content scraping by AI companies.

Last month, the web infrastructure company announced a system to block AI companies from accessing websites without permission or compensation. The move came as part of a push back against AI companies hoovering up the entire internet to use as training data — a tactic that has sparked lawsuits.

Cloudflare's system lets online publishers and other website owners block AI crawlers from seeing their content, with future plans to only allow those who have paid to scrape.

Several weeks into the blocking system, Cloudflare has reported that AI company Perplexity is using evasive techniques to access that content regardless. In a blog post this week, the firm said Perplexity changes how it presents itself to a website when it spots a block.

"Although Perplexity initially crawls from their declared user agent, when they are presented with a network block, they appear to obscure their crawling identity in an attempt to circumvent the website’s preferences," the post noted.

ITPro contacted Perplexity for a statement, but had received no response at time of publication. A spokesperson for the firm told TechCrunch that the Cloudflare research was a "sales pitch" for the blocking product and said that the bot discussed "isn't even ours."

In a separate statement to The Verge, the company said Cloudflare's report was a "publicity stunt" and that there were "a lot of misunderstandings in the blog post".

It's not the first time Perplexity has been accused of letting its bots crawl where they're not wanted. Reports from Wired spotted such behavior last year while Forbes, the New York Times, and the BBC accused the company of scraping and reproducing their content without permission.

Perplexity has denied the accusations.

What Cloudflare claims

Cloudflare said it saw "continued evidence" that Perplexity's user agent is changing their user agent and the source where it's coming from to hide this activity, and even ignoring or failing to view the "robot.txt" files — these are a list of instructions for bots telling them what to access and not, used for search crawlers and now AI agents.

After hearing complaints from customers who had tried to block AI crawlers, Cloudflare set up a series of experiments using brand-new test websites that were not publicly accessible, with a robots.txt file directing "respectful bots from accessing any part of a website."

Cloudflare then asked Perplexity AI questions about the domains, and found it was able to access detailed information from the restricted test sites.

"This response was unexpected, as we had taken all necessary precautions to prevent this data from being retrievable by their crawlers," the post noted.

Cloudflare said Perplexity is not only using a declared user agent, but also a generic browser that impersonates Chrome on macOS when the declared agent is blocked.

For comparison, Cloudflare ran similar tests with OpenAI's ChatGPT, finding it fetched the robots.txt file and stopped crawling when told not to access a page; when there were no instructions in the robots.txt file but there was a block page, ChatGPT again stopped crawling.

"Both of these demonstrate the appropriate response to website owner preferences," Cloudflare said.

Danger to the internet?

Cloudflare said that this behavior risks the network of trust that holds up the internet.

"There are clear preferences that crawlers should be transparent, serve a clear purpose, perform a specific activity, and, most importantly, follow website directives and preferences," the post said.

The company added that it would now block the AI company from websites using its service.

"Based on Perplexity’s observed behavior, which is incompatible with those preferences, we have de-listed them as a verified bot and added heuristics to our managed rules that block this stealth crawling," the post added.

Calling on AI companies to behave better, Cloudflare said "well-intentioned crawlers acting in good faith" should be transparent and identify the agent honestly, and not attempt to dodge detection by sites attempting to block such access.

For sites that do allow access, AI crawlers should behave fairly and not flood sites with too much traffic or scrape sensitive data, and serve a "clear purpose" — such as checking a price or powering a voice assistant.

Cloudflare also suggested AI companies use separate web crawlers for each activity, letting website owners more easily allow some crawler activity but not others. "Don’t force site owners to make an all-or-nothing decision," the post said.

MORE FROM ITPRO

• A threat to Google’s dominance? The AI browser wars have begun – here are the top contenders vying for the crown
• Sick and tired of spreadsheets? Perplexity’s new tools can help with that
• Perplexity AI, a startup that just raised $73.6 million from Nvidia and Databricks, wants to take on Google's search engine

DNA testing company 23andMe has filed for bankruptcy protection, raising questions about the future of the company and the personal data it holds.

The company says it's looking for a sale and hopes to continue as a going concern during the process.

The announcement follows the resignation of CEO and co-founder Anne Wojcicki after pushing for a buyout that was rejected by the board. She said she now hopes to bid for the company independently.

"After a thorough evaluation of strategic alternatives, we have determined that a court-supervised sale process is the best path forward to maximize the value of the business," said Mark Jensen, chair and member of the Special Committee of the Board of Directors.

"We expect the court-supervised process will advance our efforts to address the operational and financial challenges we face, including further cost reductions and the resolution of legal and leasehold liabilities."

But there's uncertainty about the data that the company holds - the company currently has around 15 million customers, who have mailed in saliva kits to have their genetic makeup analyzed. Many are concerned that the data could be sold off to data brokers or for targeted advertising.

"The data itself is one of the core assets, and technically that would be of interest to a buyer. However, the terms of use in which that data was provided remain, so it would be up to the bankruptcy court and associated trustees to ensure that those rights are maintained and controlled," commented Jack Berkowitz, chief data officer at Securiti.

"Ideally, the court appointed trustee has a view and understanding of the sensitivity of the data, the corporate and legal constraints, and the regulatory implications. We have seen such sensitivity around high profile bankruptcies before, such as when FTX went into receivership."

23andMe facing intense data protection scrutiny

The company's handling of personal data is already under investigation by the UK Information Commissioner's Office (ICO) and the Office of the Privacy Commissioner of Canada, following a data breach that was reported in October 2023.

Earlier this month, the ICO issued a notice of intent to fine the company £4.59 million ($5.94m) along with a preliminary enforcement notice.

"We are aware that 23andMe has filed for Chapter 11 bankruptcy in the US to facilitate a sale process. We are monitoring the situation closely and are in contact with the company," said ICO deputy commissioner - regulatory supervision Stephen Bonner.

"As a matter of UK law, the protections and restrictions of the UK GDPR continue to apply and 23andMe remains under an obligation to protect the personal information of its customers."

In many parts of the world, users have the right to request the removal of their personal data, and California attorney general Rob Bonta is urging them to do just that.

"California has robust privacy laws that allow consumers to take control and request that a company delete their genetic data," he said.

"Given 23andMe’s reported financial distress, I remind Californians to consider invoking their rights and directing 23andMe to delete their data and destroy any samples of genetic material held by the company."

MORE FROM ITPRO

• INSERT STORY LINK
• INSERT STORY LINK
• INSERT STORY LINK

Defender VPN, Microsoft's free virtual private network, is set for the scrapheap – so you might want to think about alternative services.

As of 28 February, Microsoft will no longer support the free VPN service that had been included in its Defender security app since 2023.

When the move was announced at the beginning of the month, Microsoft said new installations and reinstallations would not feature the tool.

Microsoft suggested the removal of the "privacy protection feature" was because the tool wasn't very well used.

"We routinely evaluate the usage and effectiveness of our features," Microsoft said in a support post. "As such, we are removing the privacy protection feature and will invest in new areas that will better align to customer needs."

The move follows Google killing off its One VPN last year, also citing low demand.

Microsoft said it wasn't planning on ending any other Microsoft Defender features, with device protection, identity theft and, in the US, credit monitoring set to continue.

Did Microsoft do enough to promote Defender VPN?

Some commenters online have suggested that the limited take-up was because no-one knew about the VPN — or because the service was seriously limited.

It wasn't available outside the UK or US, had a strict 50GB monthly data cap, excluded certain apps, and users couldn't choose the server location, meaning it didn't help with accessing geo-restricted content or dodging censors.

Instead it was pushed as a way to protect privacy when online, such as against man-in-the-middle attacks when using public Wi-Fi.

Anyone who was using the limited VPN will need to find an alternative VPN, likely via a paid-for service, but any will come with a wider range of features that Defender's version lacked.

Microsoft will continue to offer a VPN in one instance, however, mainly for phishing protection on iPhones.

"Defender for iOS users, please note, web protection (anti-phishing) on iOS uses a VPN to help keep you safer from harmful links," the support document said.

"You will continue to see a VPN used for the purposes of web protection and this local (loop-back) VPN is different from the privacy protection feature."

Anyone with the VPN on Windows, iOS, and MacOS won't have to take any action, but Android users will need to remove the tool from their VPN settings if they want it to stop being listed as an option.

"Not removing the Defender VPN profile on your Android device will not cause any impact to your device but it’s recommended to remove it as it won’t be used by Defender to provide protection," the support post noted.

What is the Defender app?

Microsoft included the privacy protection VPN for free in the Defender app that comes with Microsoft 365 Personal or Family subscriptions.

The Defender app is available across Windows, Android, iOS, and MacOS, and also features a web portal for managing phone and PC protection.

The app includes antivirus, alerts about malicious websites or suspicious activity, and more, though what's available differs by platform and region.

This is separate from Windows Security, a set of security tools built directly into Windows, that is formerly known as Windows Defender Security Centre.

MORE FROM ITPRO

• Everything you need to know about VPNs
• Does your business need a VPN?
• Everything you need to know about Microsoft Defender

Only half of UK businesses are fully complying with all data privacy regulations and industry guidelines - an improvement, but not much of one.

Research from Zoho Digital found that the figure has risen from 2023's 42%, but that many businesses still need to improve their data practices.

On the plus side, transparency of data practices emerged as a growing strength, with 50% of respondents saying that their data privacy policies are clear, simple, and transparent, up from just 33% in 2023.

"According to Zoho’s Digital Health survey, businesses must improve transparency around data usage as a clear step toward ethical behaviour," said Sachin Agrawal, Zoho managing director.

“This will play an important role in improving customer experience, strengthening customer relationships."

The survey revealed that 47% of businesses now view data privacy as a critical part of their success, and that 46% conduct regular data privacy training for employees.

However, it also identified serious gaps where businesses are falling behind. Only three-in-ten businesses reported going beyond requirements to provide additional protection for customer and employee data.

This, Zoho noted, suggests that while businesses are meeting their compliance requirements, few are taking proactive steps to enhance data protection.

"In an increasingly data-driven world, organisations must prioritize data privacy throughout their operations. It is encouraging to see the growing recognition of data privacy’s role in driving business policies, but there is still a lot of progress to be made," said Agrawal.

"To unlock the full transformative potential of technologies like AI, businesses must have clear and well-defined data strategies which both protect customer and employee data but enable flexibility of use in the right way."

The report comes hot on the heels of research from ISACA, which found only a third of data privacy professionals are confident in their organization’s ability to safeguard sensitive data, and just a quarter follow Privacy by Design best practices.

Their teams underfunded, they said, and more than half told ISACA they expect budgets to decline this year.

ISACA warned that many organizations risk falling foul of GDPR and new legal frameworks such as the Digital Services Act and EU AI Act.

Recently, Charlie Bromley-Griffiths, senior legal counsel at legal document management software form Conga, told ITPro that UK businesses had made substantial strides in aligning with privacy legislation.

"Companies have implemented stronger data governance policies, enhanced security protocols and prioritized the rights of data subjects," she said. "However, challenges still remain, particularly for small and medium-sized enterprises struggling with the complexity and cost of full compliance."

In a US lawsuit filed on behalf of LinkedIn Premium users, the professional networking app has been accused of using members' private messages to train AI models.

Filed in a California federal court, the lawsuit, on behalf of LinkedIn user Alessandro De La Torre, accuses the company of breaching its contractual promises by disclosing Premium customers' private messages to third parties to train generative AI models.

"Given its role as a professional social media network, these communications include incredibly sensitive and potentially life-altering information about employment, intellectual property, compensation, and other personal matters," the filing reads.

"Microsoft is the parent company of LinkedIn, and Defendant claims it disclosed its users’ data to third-party 'affiliates' within its corporate structure, and in a separate instance, more cryptically to 'another provider'. LinkedIn did not have its Premium customers’ permission to do so."

In a statement given to ITPro, a spokesperson for LinkedIn said: “These are false claims with no merit.”

The story behind the LinkedIn lawsuit

The case hinges on the introduction of a change to LinkedIn's privacy practices last year, whereby users were opted in by default to allow third parties to use their personal data to train AI.

To start with, according to the lawsuit, this was done on the quiet, with the change only appearing in the company's privacy policy in September following a backlash from users and privacy campaigners.

The company exempted customers in Canada, the EU, EEA, the UK, Switzerland, Hong Kong, and Mainland China from the data sharing - but not those in the US.

"Like other features on LinkedIn, when you engage with generative AI powered features we process your interactions with the feature, which may include personal data (e.g., your inputs and resulting outputs, your usage information, your language preference, and any feedback you provide)," the company said in its FAQs.

The change wasn't universally welcomed, however, with the UK’s Information Commissioner’s Office (ICO) noting that the opt-out approach wasn’t sufficient to protect user privacy.

Digital rights campaigners Open Rights Group also complained the opt-out model “proves once again to be wholly inadequate” to protect user rights.

The lawsuit is asking for compensation of $1,000 per Premium user for alleged violations of the US federal Stored Communications Act, along with an unspecified additional sum for breach of contract and the breach of California's Unfair Competition Law (UCL).

It also calls for the company to delete all AI models trained using improperly collected data.

Data privacy professionals think their organizations are underfunding their work, and there's no light on the horizon as budgets are set to be squeezed further in 2025.

In a recent survey, more than half told ISACA they expect budgets to decline this year, up from 41% last year. Meanwhile, only a third said they were confident in their organization’s ability to safeguard sensitive data, with just a quarter always practicing Privacy by Design.

As a result, ISACA warned many organizations risk falling short of compliance with GDPR and new legal frameworks such as the Digital Services Act and EU AI Act.

“As the threat landscape continues to evolve in complexity, privacy is becoming a sector which is increasingly difficult to operate in, but also more critical," said Chris Dimitriadis, global chief strategy officer at ISACA.

"Two-thirds of the European professionals working in privacy roles who we spoke to said their job is more stressful now compared to five years ago. This is only being exacerbated by continued underfunding. While companies may be making a short-term financial gain, they are putting themselves at long-term risk."

Half of technical data privacy teams in Europe remain understaffed, the survey found, much the same as last year, while a third struggle to retain qualified privacy professionals.

Those that do always practice Privacy by Design do rather better, with 43% saying their technical data privacy teams are appropriately staffed. Six-in-ten said they were highly confident in their technical privacy teams as a result.

"Practicing Privacy by Design and embedding privacy across an entire enterprise is key to long-term data protection," Dimitriadis said.

"Such a comprehensive approach fosters trust with stakeholders and safeguards against ever-evolving threats – but this isn’t possible without skilled privacy teams who feel prepared and able to drive privacy practices from a technology, business and compliance point of view."

The data privacy skills gap is growing

Skills gaps were also highlighted as a key issue for data privacy professionals, ISACA found. The biggest reported skills gaps were experience with different types of technologies and/or applications, cited by 63% of respondents.

A lack of technical expertise and IT operations knowledge and skills were also flagged as major concerns. As a result of this shortfall, nearly half of organizations said they offer training to allow staff from non-privacy backgrounds to move into roles in this domain.

However, it’s experience that’s key to plugging this skills gap, the study noted.

Nearly all respondents said they consider compliance and legal experience an important factor in determining if a privacy candidate is qualified. Nine-in-ten also consider industry credentials as important, while only 54% said the same about a university degree.

"There are several ways to plug the skills gap," said Dimitriadis.

"Providing training and continuous support for privacy staff on emerging technologies, privacy-enhancing technologies, and cybersecurity and data protection architectures on top of legal compliance knowledge is essential for managing their stress and maintaining organizational resilience."

An ever-increasing and concerning array of wireless networking equipment is now being used to track employees around the office, according to new research.

A study from Cracked Labs found that technology vendors are using wireless networking infrastructure to pinpoint the location of devices such as smartphones, laptops and so on, in order to track their location.

That is paired with Bluetooth beacons linked to access badges, security cameras, video conferencing systems, and even environmental sensors to understand employee behaviour, alongside more obvious tools such as motion sensors under desks.

The report specifically highlighted the monitoring activities of networking giants Cisco and Juniper Networks, as well as Swiss firm Locatee and European company Spacewell.

Cisco, for example, offers a product that makes use of Wi-Fi access points and other existing IT infrastructure to understand how people move throughout a building.

The report pointed to Cisco marketing material on the product, which claims it can enable companies to ”gain insights into how people and things move throughout their physical spaces” and “understand the behavior and location of people (visitors, employees) and things (assets, sensors)”.

“Companies can get a 'real time view of the behavior of employees, guests, customers and visitors' and 'profile' them based on their indoor movements in order to 'get a detailed picture of their behavior',” the report added.

Cisco hadn't replied to a request for comment at the time of publication.

Big Brother is watching

In one Cisco example, tracking 138 people via 11 Wi-Fi access points generated several million location records, the report said. That allows the company to track where each device is in the building — as well as the employees who carry them.

Beyond Wi-Fi, researchers said Cisco's systems also tap into security cameras, WebEx video conferencing, and make use of linked apps.

According to the report, the purpose depends on the nature of the company. Retailers or restaurants, for example, can use the tools for behavioral profiling to offer personalized recommendations, or merely to understand where and when to clean.

In offices, companies can better understand desk usage — helpful during the shift to hybrid working — but also track IT assets to ensure they don't leave the building.

While those use cases may feel innocuous, the systems are also promoted as being able to measure "behaviour metrics" to aid internal campaigns to change employee behaviour and to understand "employee behaviour that affects performance."

In one example using technology from Juniper Networks, it was possible to see how long employees spent in break areas and kitchens.

Function creep

Even if the aim is useful, researchers warned such systems come with risks.

"Tracking and analyzing employees’ desk presence, indoor location and movements represents intrusive behavioral monitoring and profiling," the study said.

"Even if employers analyze the data only at the aggregate level, they process extensive personal data on employee behavior.

"Once deployed in the name of 'good', whether for worker safety, energy efficiency or just improved convenience, these technologies normalize far-reaching digital surveillance, which may quickly creep into other purposes."

The report is part of wider work into surveillance in the workplace, run by a team of researchers at Cracked Labs alongside partners at AlgorithmWatch, academics at the University of Oxford, and EU and Austrian trade unions.

The report marks the latest batch of research into the rise of workplace monitoring, which has been growing in frequency across a range of industries.

A study in November revealed one-in-five workers is now being monitored by an activity tracker of some kind, and it’s having a significant negative impact on employee morale.

Tracked employees are 73% more likely to distrust their employer, and twice as likely to be job-hunting as those who aren’t tracked in their workplace, the study noted.

The issue reached such an extent that the UK’s Information Commissioner’s Office (ICO) issued fresh guidance on the practices last year. The data watchdog urged businesses to “consider workers’ rights” when introducing workplace monitoring tools.

This advisory was issued alongside a survey conducted by the ICO which found seven-in-ten respondents found workplace monitoring practices to be “intrusive”.

One-in-five workers is now being monitored by an activity tracker, new research shows, and it's not doing much for employee morale.

Tracked employees are 73% more likely to distrust their employer and twice as likely to be job-hunting as those who aren’t tracked, according to analysis from Software Finder.

Meanwhile, three-quarters of workers whose location isn't tracked say they'd be unwilling to share that information with the boss.

"As these tools become more widespread — from activity monitors to location trackers — concerns about their impact are growing," the firm said..

"With privacy and mental health at the forefront, many workers are questioning if the trade-off is worth it."

Tech staff are the most likely to be monitored, with one-in-three being tracked during their daily activities, followed by finance, where it's 30%. Similarly, 21% of retail employees are being actively monitored throughout their working week, along with 20% of people working in healthcare, and 17% in the education sector.

The study noted that activity tracking “does not seem to make employees more productive” and in fact has an adverse impact on team morale.

“Tracked and untracked employees report equal productivity levels,” the firm said.

“Tracked employees report higher stress levels, worse mental health, and less job satisfaction than untracked employees."

Despite this, half of managers currently using tracking tools plan to expand their surveillance over the next year, and 13% of those that aren't tracking staff plan to start.

A third of workers are now sharing their computer's location with their employer, and one-in-seven share their phone's location.

Notably, the study found the bigger the company, the more likely it is to be using surveillance tools. Only 8% of workers at micro companies being tracked compared to 18% of those at small companies, 23% of those at medium companies and a quarter of staff at large firms.

Remote and hybrid workers are more likely to be tracked, with a quarter under surveillance, compared with 18% of those working in the office.

Just over three-in-ten managers say they check up on their employees every day, with 35% doing it a few times a week and 23% once a week. Four in five believe it makes their staff more productive.

Staff are pushing back on workplace monitoring

Many workers are rebelling against this growing trend, the study found. One-in-six revealed they’re using a mouse jiggler - a device that mimics movement - to disguise periods of inactivity. Another 12% say they want to start.

However, using a mouse jiggler carries its risks and these controversial devices can be detected. Earlier this year, for example, Wells Fargo fired more than a dozen employees over their use.

The financial services firm said the actions of the employees amounted to gross misconduct and therefore warranted dismissal.

Experts told ITPro at the time that although the firm may have been justified in its response, the incident highlighted the now-pervasive culture of surveillance across a range of industries.

While worker surveillance is perfectly legal, the UK’s Information Commissioner’s Office (ICO) has previously warned employers that it has to be carried out in a fair and responsible manner.

Guidance issued by the data protection watchdog called on employers to make it clear to staff exactly what they're doing, and have either the worker's consent or a legal obligation for the monitoring.

Similarly, the guidance warned enterprises they must also carry out data protection impact assessments to ensure safe and responsible use.

The UK's Information Commissioner’s Office (ICO) has issued guidance on the use of AI recruitment tools following a wide-ranging review.

With AI increasingly being used to source potential candidates, summarize CVs, and score applicants, the ICO said it's become concerned that their use can cause problems for job applicants in terms of their privacy and information rights.

Some AI tools were not processing personal information fairly, for example, by allowing recruiters to filter out candidates with certain protected characteristics.

Others were even inferring characteristics such as gender and ethnicity from a candidate’s name, rather than asking for the information.

Meanwhile, some AI recruitment tools collected far more personal information than necessary and retained it indefinitely to build large databases of potential candidates without their knowledge.

The ICO has now made nearly 300 recommendations, such as ensuring personal information is processed fairly and kept to a minimum, and clearly explaining to candidates how their information will be used by the AI tool.

"AI can bring real benefits to the hiring process, but it also introduces new risks that may cause harm to jobseekers if it is not used lawfully and fairly. Our intervention has led to positive changes by the providers of these AI tools to ensure they are respecting people’s information rights," said Ian Hulme, ICO director of assurance.

"Our report signals our expectations for the use of AI in recruitment, and we're calling on other developers and providers to also action our recommendations as a priority. That’s so they can innovate responsibly while building trust in their tools from both recruiters and jobseekers."

Some of the most important measures, said the ICO, include completing a Data Protection Impact Assessment (DPIA), to understand, address and mitigate any potential privacy risks or harms.

Organizations must also identify an appropriate lawful basis for collecting data, such as consent or legitimate interests. Special category data, such as racial, ethnic origin or health data involves extra conditions.

Recruiters must identify who is the controller and processor of personal information and set explicit and comprehensive written instructions for providers to follow, and check that the provider has mitigated bias.

Candidates should be told how an AI tool will process their personal information, and recruiters must ensure that the tool collects only the minimum amount of personal information required to achieve its purpose, and that it won't be used in any other ways.

The developers concerned have all accepted or partially accepted all the ICO's recommendations.

“We are actively working to implement the specific actions agreed with the ICO in our audit plan," said one. "For example, we are making sure to provide the relevant information regarding the use of AI in our privacy policies and evaluating the steps taken to minimize bias when training and testing our AI tools."

Peloton could face court in California over accusations that it allowed a third party to process user chat data, including for training AI, after twice attempting to have the lawsuit dismissed. 

The case highlights the legal uncertainty surrounding how companies can gather the huge swathes of data necessary to train AI systems.

In June 2023, legal firm Consumer Advocates filed a class-action lawsuit alleging that chat data between Peloton users and company representatives was processed without permission by AI-powered marketing firm Drift.

Both companies, Peloton and Drift, are accused in the filing as violating the anti-wiretapping California Invasion of Privacy Act (CIPA); though Drift is named, it is not targeted in the lawsuit.

According to one of the filings, Peloton's website has a chat function, allowing current and would-be customers to ask questions to the connected tech workout company.

Those people were not told that chat content was automatically captured by Drift to be stored and analysed. The transcripts were also used to train Drift's AI systems, as it also offers AI-powered chatbots. Beyond the chat text, the Drift system also captured the website visitor's IP address, device type, and other data.

Though Peloton's attempt to have the case thrown out was unsuccessful, the class-action was narrowed from its initial wording to focus on how it allowed Drift to violate the act. Peloton is, of course, allowed to see the content of the chats as one party to the communication, but the complaint is that they were shared without consent.

As the filing notes, the complaint arises from Peloton's "secret integration of third parties’ software to secretly wiretap and eavesdrop on the private conversations of users of the chat features on the website," adding that the intent was to allow Drift to " harvest data for financial gain."

Peloton incident highlights lingering AI trust issues

Acquired by Salesloft in February this year, Drift uses conversational AI for customer service and consumer marketing, using AI to help clients "deliver curated, personalized experiences to every unique buyer in real-time", according to a product announcement from last year. 

A report by the company in 2022 predicted trust and perception would be serious challenges for AI in the coming years, while also suggesting companies shouldn't continue to over-rely on declining marketing tools like third-party cookies.

"Companies that don't prioritize a strong first-party data collection strategy are setting themselves back for the near term," Kimen Warner, VP of Product Management at Drift, was quoted as saying at the time.

Warner later added that conversational AI can help build trust with data collection by "empowering customers to willingly 'opt in' and consent to sharing more information about themselves."

Whether the court agrees that Peloton customers were "empowered" to make a choice about how their data was processed remains to be seen, but Drift is not part of the legal complaint. 

The second motion to dismiss has been denied, but questions remain over whether Peloton will file further motions or when the case may proceed.

Peloton has had a rough ride after pandemic lockdowns sent sales soaring. Its share price has fallen from $160 at the end of 2020 to around $3.50 today.

Last year, the fitness-at-home company paid a $19 million fine after safety issues with its treadmills were tied to injuries and the death of a child, while in May, CEO Barry McCarthy stepped down amid job losses.

Peloton and Drift have yet to respond to requests for comment.

The European Commission has told Meta its ‘pay or consent’ model for personalized ads is in breach of the Digital Markets Act (DMA).

Under the DMA, users should be given a choice on whether their data can be collected and used for targeted ads. 

Since November last year, the company has attempted to claim it is compliant by offering Facebook and Instagram users in the EU the choice of agreeing to accept tracking and targeting, or of paying a monthly subscription for an ad-free version of the platforms.

However, following an investigation, the Commission said its preliminary view is that giving users this binary choice forces them to accept the data collection, by failing to give them an equivalent service if they decline.

"Today we make another important step to ensure full compliance with the DMA by Meta. Our preliminary view is that Meta’s Pay or Consent business model is in breach of the DMA," said Thierry Breton, commissioner for internal market.

"The DMA is there to give back to the users the power to decide how their data is used and ensure innovative companies can compete on equal footing with tech giants on data access."

Meta has been classified under the DMA as one of a number of 'gatekeepers', meaning it’s subject to more stringent rules. These gatekeepers, according to the Commission, have been able to impose terms of services on their user base that allows them to collect vast amounts of personal data.

This has given them potential advantages compared to competitors, making it hard to compete in terms of providing online advertising and social network services.

As such, firms such as Meta are required to gain users' consent for combining their personal data between designated core platform services and other services; and if a user refuses consent, they should have access to a less personalized but equivalent alternative.

Gatekeepers can't make use of the service or certain functionalities conditional on users' consent.

Meta's policy, the Commission said, fails to allow users to opt for a service that uses less of their personal data but is otherwise equivalent to the personalized ads-based service. Nor does it give users a free choice when it comes to consenting to the combination of their personal data.

"Our investigation aims to ensure contestability in markets where gatekeepers like Meta have been accumulating personal data of millions of EU citizens over many years," said Margrethe Vestager, executive vice-president in charge of competition policy.

"We want to empower citizens to be able to take control over their own data and choose a less personalized ads experience."

Meta ruling has been welcomed by industry stakeholders

The Commission's verdict has been welcomed by the European Consumer Organisation (BEUC), which late last year submitted a formal complaint to European consumer protection authorities.

"It’s good news that the Commission is taking enforcement action based on the Digital Markets Act against Meta’s pay-or-consent model," said BEUC director general Agustin Reyna.

"It comes on top of the complaints against Meta’s model for breaches of consumer law and data protection law which consumer organizations have raised in the last few months. We now urge Meta to comply with laws meant to protect consumers."

Meta can now reply to the findings, and the Commission is expected to complete its investigation by the end of March next year. 

If the preliminary view is confirmed, the company could, in theory, be subject to fines up to 10% of the company's total worldwide turnover - or even 20% in the case of repeated infringement.

Wells Fargo’s decision to fire staff for using “mouse jiggler” tools highlights a pervasive culture of workplace surveillance – and there’s little staff can do to stop the trend in the age of hybrid work.

The financial services firm fired more than a dozen employees in May over what it described as a “simulation of keyboard activity” that created the “impression of active work”.

The aforementioned employees are believed to have been using devices or software used to imitate activity on their work devices. These are commonly referred to as “mouse jigglers” or “mouse movers”.

Devices such as these have grown in popularity since the onset of the Covid pandemic and the shift to remote and hybrid working.

According to reports from Bloomberg, it remains unclear whether the fired employees were using these devices at home or in the office. However, Wells Fargo said the actions of the dismissed employees amounted to gross misconduct.

“Wells Fargo holds employees to the highest standards and does not tolerate unethical behavior,” a company spokesperson said in a statement.

While the company may have been justified in this regard, the incident highlights a larger trend of workplace monitoring that has surged in recent years, according to Ellen Goodland, associate in the employment team at UK-based law firm, Burges Salmon.

“Prompted, no doubt, by the growth in home working since the pandemic, the monitoring, by employers, of their employees is becoming increasingly common,” she said.

Goodland added that this trend has given rise to a slew of new technologies and tools aimed at enabling employers to monitor staff during their daily activities.

“The tech market has been quick to catch on to this trend and, alongside the tried and tested methods of CCTV, attendance logs and email and telephone monitoring. numerous new monitoring technologies are now available including keystroke-logging, browser monitoring, and social media tracking.”

The use of monitoring technologies appears to be negatively impacting some employees and is placing workers at odds with their organizations.

A recent study from Forbes, for example, found that 43% of employees have their online activity monitored by employees. The issue has reached such an extent that some are even using virtual private networks (VPNs) to circumvent surveillance practices.

Hybrid employees in particular were found to experience far more scrutiny in this regard, according to Forbes. Nearly half (48%) of workers reported monitoring practices compared to 37% of fully remote employees.

Notably, 39% said workplace monitoring practices have a negative impact on their relationship with employers, and 43% said it negatively impacts company morale.

Workplace monitoring raises ethical and legal questions

There are serious considerations – and potential penalties – for employers employing invasive workplace monitoring practices. 

Last year, the UK’s Information Commissioner’s Office (ICO) issued fresh guidance urging organizations to “consider workers’ rights” when introducing such tools.

The warning from the data protection watchdog followed the publication of a report which found 70% of the public would find workplace monitoring practices “intrusive”.

Nearly one-in-five (19%) also told the ICO they believe they had been monitored by their employer at some stage.

The watchdog warned that excessive monitoring can “easily intrude into people’s private lives” and undermine privacy.

Ellen Goodland said employers must ensure any employee monitoring is undertaken lawfully as the “potential consequences of getting it wrong can be extensive”.

“The ICO has the powers to investigate monitoring off their own initiative or an employee may complain to the ICO about the (mis)use of their personal data, which could also result in an ICO investigation,” Goodland told ITPro.

“If the ICO finds there have been data breaches then it can take enforcement action, including through information notices (requiring certain information being provided to the ICO), enforcement notices (requiring action to be taken or not taken) and imposing (sometimes heavy) financial penalties.”

Crucially, Goodland said that communication with employees on the subject is key to ensure that staff can voice concerns and understand the rules being put in place.

“Transparency is a fundamental principle of data protection compliance, and organizations will be required to demonstrate they have been transparent with employees about what monitoring is taking place.”

European police chiefs have warned the increasing use of end-to-end encryption (E2EE) is making it harder for them to investigate crime and keep people safe.

Graeme Biggar, director general of the UK’s National Crime Agency said that encryption can be hugely beneficial, protecting users from a range of crimes.

However, the “blunt and increasingly widespread rollout” by major tech companies is putting users in danger due to a lack of sufficient consideration for public safety, he argued.

“These changes are also making it harder for us to investigate serious crime and protect the public, as the companies are less able to act on a warrant and provide us with the data of suspected criminals,” Biggar said.

The statement was issued by international policing agency Europol and backed by 32 European police chiefs.

E2EE means that a message is encrypted when it is sent, and only unscrambled when it arrives at the recipient’s device. It cannot be read by anyone in between.

While this means that sensitive messages can be securely sent over the internet, it also means that neither the tech companies themselves, nor police and other law enforcement agencies, are able to intercept these messages and – for example – uncover a criminal plot.

“Our homes are becoming more dangerous than our streets as crime is moving online. To keep our society and people safe, we need this digital environment to be secured,” said Europol executive director Catherine de Bole.

The authorities argue that moves like this will mean their ability to tackle serious crime threats will be hampered, as tech companies cannot respond to a warrant because the information has been encrypted.

The NCA pointed out that “one stream of data” provided by tech companies in response to warrants led to 327 arrests, the seizure of 3.5 tonnes of Class A drugs, the recovery of £4.8m, the identification of 29 previously unknown threats to life, and a further 100 threats to harm, between January and March this year.

For their part, the tech companies argue that by providing E2EE they are delivering the security that their customers want - and need - to keep them protected from crooks and scammers. They say the net result of strong encryption is to make most people more safe.

Europol noted that its declaration comes as Meta has started to roll out E2EE across its Messenger platform.

Meta told ITPro the overwhelming majority of Brits already rely on apps that use encryption to keep them safe from hackers, fraudsters, and criminals.

“We don’t think people want us reading their private messages so have spent the last five years developing robust safety measures to prevent, detect and combat abuse while maintaining online security,” a spokesperson said.

“As we roll out end-to-end encryption, we expect to continue providing more reports to law enforcement than our peers due to our industry leading work on keeping people safe.”

End-to-end encryption goals still unclear

While the police chiefs said industry and governments should “take action against end-to-end encryption roll-out” it’s not entirely clear what they want done instead.

“We do not accept that there need be a binary choice between cyber security or privacy on the one hand and public safety on the other. Absolutism on either side is not helpful,” the statement said.

“Our view is that technical solutions do exist; they simply require flexibility from industry as well as from governments. We recognize that the solutions will be different for each capability, and also differ between platforms,” it added.

But finding those technical solutions may be hard. Governments and tech companies have consistently struggled to find some form of compromise when it comes to E2EE. It’s a standoff that is unresolved and probably unresolvable. Data is either encrypted end-to-end or it is not.

Governments can ban E2EE but the most likely impact would be that big tech companies would simply stop offering services in any countries that did so. That would make the average user there much less secure, while crooks would just buy their encryption tools on the black market.

The UK government’s recent Online Safety Bill illustrated the bind that governments find themselves in. While the legislation theoretically gives the government the power to ask for encrypted messages, it also acknowledges that – at least for now – there is no technical way of doing it.

Pam Cowburn, head of communications and campaigns at The Open Rights Group, said E2EE keeps messages safe and secure, and helps to protect users from fraud, scams, and other criminal behaviour.

“Preventing Meta from following out end-to-end encryption could deny billions of users this security,” she told ITPro.

"While the UK government adopted powers that could allow the private messages of everyone in the UK to be scanned, it did concede that this could not be put into practice without jeopardizing people’s security and privacy.

"Open Rights Group has called for Ofcom to publish regulations that make clear that there is no available technology that can allow for scanning of user data to co-exist with strong encryption and privacy. “

Google has announced it will destroy billions of data records to settle an ongoing lawsuit in which plaintiffs accused the tech firm of tracking search activity improperly. 

The move follows allegations that Google tracked the search data of users operating in Chrome’s private browsing - or ‘incognito’ - mode without clearly stating that it would be doing so in privacy disclosures. 

Google tried unsuccessfully to have the case dismissed in the summer of 2023 following the lawsuit’s inception in 2020, claiming that users were adequately informed of data collection.

In the most recent development of the case, however, a settlement has been passed that will see Google forced to delete data and update its privacy policies. 

Google will destroy the billions of ill-gotten records it secured while also updating disclosures for its private browsing capabilities to clearly describe what data it collects. It will now also give users the option to disable third-party cookies within this function. 

These latest terms which hold Google to account, filed in a California federal court, now await approval from US district judge Yvonne Gonzalez Rogers. 

Google penalties are part of a wider wake-up call for businesses

In this case, Google was found to have been unclear about its data access and usage, leaving it open to a level of legal action that helps establish an important precedent for enterprises. 

With consumers increasingly aware of their privacy rights, businesses can ill afford to shirk responsibilities, according to Stephanie Liu, senior analyst at Forrester.

“The rise of privacy-oriented class action lawsuits and complaints shows consumers are increasingly privacy savvy and taking action,” Liu said. 

“Transparency is critical — companies have to explain how data is shared and used,” she added. 

Going forward, companies will need to ensure that they are open and honest about where and how they are tracking data, as violations such as these will leave enterprises vulnerable to accusations of data misuse, Liu noted.

“There has been a steady drumbeat of complaints, lawsuits, and regulatory action centered on companies collecting or sharing customer data in unexpected ways,” she said.

“The Google Chrome settlement is part of a broader trend of consumers filing complaints about their data being used in ways they don't expect."

Meta, for example, found itself caught up in the growing trend of class action privacy cases when it was forced to pay $725 million in 2022 over its handling of personal user information with Cambridge Analytica. 

Though Meta did not admit its guilt as part of the settlement, this was still the largest-ever monetary sum paid as part of a privacy lawsuit. 

Slightly further back, Zoom agreed to pay $85 million to settle privacy claims against it relating to the sharing of personal user data with other firms such as Google, Facebook, and LinkedIn.   

This case isn’t Google’s only run-in with privacy regulation in recent memory, as the firm forked out a $391.5 million settlement in 2022 following claims that it was tracking location data improperly.

Avast was a brand name that became synonymous with data privacy in recent years, but that’s all come crashing down in one fell swoop. 

Billing itself as a champion for users, the company offered a range of products, from antivirus software to Chrome extensions and various other tools aimed at boosting privacy, keeping snooping brands at bay online, and protecting from a growing array of cyber security threats.

It was a position - and product portfolio - that naturally resonated with consumers and businesses alike amidst an increasingly privacy-conscious age. But beneath the seemingly impeccable veneer, the company was secretly selling off user data to the highest bidder.

Between 2014 to 2020, Avast was hoovering up user browser information and selling it to upwards of 100 companies through a subsidiary firm known as Jumpshot, which Avast acquired in 2014 and has since shuttered.

Details on the relationship between Avast and Jumpshot appear to have been relatively unknown to customers throughout this period. It wasn’t until 2020 that reports from Motherboard found clients had been purchasing data from the firm.

These included major household brands including Google, Microsoft, Pepsi, McKinsey, and US retail giant Home Depot.

Documents obtained by Motherboard, for example, found that third parties could buy data pertaining to Google Maps queries and social media page searches on LinkedIn. Sources told the publication that the information sold to these parties was “very granular” and represented a treasure trove of data.

This campaign of selling user data has since landed Avast in hot water with US regulators. An investigation by the Federal Trade Commission (FTC) recently ordered the firm to pay $16.5 million to redress consumers impacted by the data sharing practices.

The FTC also ruled that Avast will be prohibited from selling future browsing data, and from here onward will be required to obtain express consent on data gathering.

A key talking point in this investigation, and one that alarmed regulators, is that both Avast and the now-shuttered Jumpshot claimed all data had identifying information removed. The regulator ruled this was “not sufficient”.

Jumpshot framed its products as being able to offer “unique insights” into user browsing behaviors, providing clients with device identifiers for specific browsers based on ‘feeds’.

This included an ‘All Clicks Feed’, 'Search Plus Click Feed’, and a ‘Transaction Feed’.

Clients, the FTC found, flocked to these, purchasing specific feeds and using this to collate with their own internal datasets to gain a detailed understanding of customer purchasing behavior and preferences.

Avast tried to quell Jumpshot data selling fears

The FTC’s investigation into the matter uncovered a concerning lack of transparency on the extent of the relationship between Avast and Jumpshot. Investigators found that Avast actively downplayed its involvement with Jumpshot through its own official web forums, for example.

The firm repeatedly insisted that Jumpshot only used non-aggregated data and that it told users during the installation of products and purchase of services that it conducted data collection to “better understand new and interesting trends”.

Lesley Fair, senior attorney for the FTC, described Avast’s practices as “alarming”, noting that the company’s claims for its software and browser extensions essentially amounted to nothing more than “attention-getters”.

“All companies must honor their privacy promises, but that holds especially true for businesses that pitch their products as a way for consumers to protect their privacy,” Fair wrote in a blog post.

“There aren’t enough r’s in “Arrrrrrrgghh” to convey the FTC’s concern about a company that advertises its products as a means for people to maintain their privacy online, and then double-crosses them by selling their highly personal browsing information.

“The irony – and injury – in this case is alarming and the FTC will give no quarter when businesses lie to consumers about how their personal information will be protected.”

The UK’s Information Commissioner’s Office (ICO) has warned it may impose harsh penalties and publicly name websites that fail to make changes to their cookie consent policies. 

The ICO said that some are failing to give users a clear choice about whether they want to opt-in to personalized advertising, and make it just as easy to 'reject all' as to 'accept all'.

While websites can still display adverts when users reject all tracking, they must not tailor these ads to the person browsing.

Stephen Almond, ICO executive director for regulatory risk issued a warning to websites that consistently fail on cookie consent, adding that the regulator will clamp down on those who don’t comply.

"We’ve all been surprised to see adverts online that seem designed specifically for us – an ad for a hotel when you’ve just booked a flight abroad, for instance. Our research shows that many people are concerned about companies using their personal information to target them with ads without their consent,” he said.

"Gambling addicts may be targeted with betting offers based on their browsing record, women may be targeted with distressing baby adverts shortly after miscarriage and someone exploring their sexuality may be presented with ads that disclose their sexual orientation."

Without naming names, the ICO said it has written to companies running some of the UK’s most-visited websites to voice concerns about their cookie consent policies.

The regulator has given them 30 days to ensure their websites comply with current legislation on the matter.

"Many of the biggest websites have got this right," said Almond. "We’re giving companies who haven’t managed that yet a clear choice: make the changes now, or face the consequences."

The ICO said it will provide an update on progress in January. For organizations that are still to comply, it will provide the public with details.  

Cookie consent crackdown

The move follows a warning earlier this summer in which the ICO began assessing cookie consent banners. The regulator said at the time it would take action against those who don’t comply.

While the legal requirement for cookie banners derives from the GDPR, the UK's departure from the EU hasn't yet led to any change in the rules.

Companies are required to gain explicit consent from users before using marketing cookies or trackers, and the buttons used for this must make it at least as easy to deny as to consent.

In the EU, rules are similar, although there's no clear rule that 'reject all' must appear at the same time, and be as easy to choose as 'accept all'.

Different countries within the union have slightly different policies. Austria and Spain, for example, require a 'reject all' button in the first layer of the consent process while Germany does not.

Earlier this month, the European Data Protection Board (EDPB) published new guidelines on the use of cookies, clarifying which tracking techniques are covered.

"These guidelines discuss solutions, such as tracking links and pixels, local processing, and unique identifiers, to ensure that the consent obligations set out by the article are not circumvented," said EDPB chair Anu Talus.

The Information Commissioner's Office (ICO) has issued fresh guidance urging organizations to “consider workers’ rights” when introducing workplace monitoring tools. 

The advisory follows a report that found 70% of the public would find workplace monitoring practices “intrusive”. Almost one-in-five (19%) of respondents told the ICO they believe they have been monitored by an employer at some stage. 

The watchdog warned that excessive monitoring can “easily intrude into people’s private lives” and undermine privacy. 

“With the rise of remote working and developments in the technology available, many employers are looking to carry out checks on workers,” the ICO said in a statement.  

“The ICO has today published guidance to help employers fully comply with data protection law if they wish to monitor their workers.” 

The guidance is aimed at employers spanning both the public and private sector, and provides a “clear direction” on how organizations can implement monitoring techniques in a fair and lawful manner. 

Monitoring can include tracking calls, messages and keystrokes, webcam footage or audio recordings, or using “specialist monitoring software” to track worker activity, the ICO said. 

In addition, the advisory outlines best practice techniques for employers to help “build trust with their workers and respect their rights to privacy”. 

This includes informing staff about monitoring practices in a “way that is easy to understand” and ensuring workers are made fully aware of the “nature, extent, and reasons for monitoring”. 

The guidance also warns that organizations must have a “lawful basis” for processing workers data - such as consent or legal obligation. 

This includes the need for data protection impact assessments, which must be conducted for any monitoring practices that are “likely to result in a high risk” to workers’ rights.

Transparency in workplace monitoring

Emily Keaney, deputy commissioner for regulator policy at the ICO said that while data protection laws permit monitoring, organizations must prioritize privacy and the potential impact on workers.  

“As the data protection regulator, we want to remind organizations that business interests must never be prioritized over the privacy of their workers,” she said. 

“Transparency and fairness are key to building trust and it is crucial that organizations get this right from the start to create a positive environment where workers feel comfortable and respected."

Ella Bond, senior employment solicitor at Harper James, commended the publication of the guidance, and echoed Keaney’s comments on transparency.  

Organizations that fail to communicate with staff could risk harming relationships with their workforce and impact performance and morale.  

“It is crucial for employers to strike a balance between managing productivity and performance whilst respecting workers' privacy,” said Bond. “Workers have a legitimate expectation of privacy, even in the course of carrying out their duties.” 

“Monitoring should only be undertaken when it is necessary and proportionate, and it should be conducted in a way that respects workers' rights and freedoms. It is essential that employers communicate clearly with their staff about the nature, extent, and reasons for any monitoring activities. 

“Employers should have clear signage, procedures and policy documentation in place in order to help them to achieve this.”

Workplace monitoring practices have increased significantly since the onset of the COVID pandemic in 2020 and the subsequent shift to remote and hybrid working practices as employers sought to keep tabs on employee activities.  

A 2021 survey conducted by Prospect recorded a sharp rise in cases of webcam and video-based monitoring practices among employers.  

At the time, a majority (52%) of employees polled by the firm said they believe monitoring practices should be banned outright, while 28% said more robust regulation of the trend was required.  

The UK’s Online Safety Bill is set to become law after officially passing through parliament on Tuesday. 

Framed by the government as a push to make Britain the “safest place in the world to be online”, the bill will impose requirements on tech firms and social media platforms to moderate and remove illegal content, and will be enforced by Ofcom. 

One of the most prominent debates around the Online Safety Bill so far has been in regard to its so-called ‘spy clause’ allowing the UK government to read messages and files sent over end-to-end encrypted messaging platforms.

The government’s stance on the matter has been firm, despite heavy pushback from the technology and privacy sectors.

Some of the most popular encrypted messaging platforms have suggested they would leave the UK if they were compelled to remove end-to-end encryption (E2EE) technology from their products. 

With the bill passing and set to become law imminently, questions still remain over the future of E2EE in the UK. But is it as bad as first thought? 

Here’s what you need to know. 

Will E2EE still exist in the UK?

Simply put, yes. The Online Safety Bill doesn’t equate to an outright ban of end-to-end encryption. However, there are certain clauses within the bill that will see changes introduced. 

Chief among these is a requirement that encrypted messaging apps, such as WhatsApp or Signal, will be legally obliged to examine user messages for illegal or harmful material, such as terrorism or child abuse-related content. 

Ofcom, the regulator in charge of overseeing the implementation of the bill, can request that providers conduct such activities, on the suspicion of materials being distributed via any given platform. 

This aspect of the bill is a serious point of contention, especially with regard to the feasibility of the practice. 

Why does the UK think it can break E2EE?

The Online Safety Bill specifically mentions the use of “accredited technology” to conduct such assessments, but some industry stakeholders have noted that the wording remains highly ambiguous. 

Earlier this month, techUK deputy CEO Antony Walker questioned the feasibility of this move and raised serious concerns about user privacy. 

"One of our biggest concerns centers on Ofcom’s ability to remotely view tests which use live user data, a move that not only poses a security threat but also jeopardizes user privacy,” he said. 

“We urge the government to restrict Ofcom’s ability to view live user data and to ensure these powers are only applied to viewing information in a test environment.”

"We support the objectives of the Online Safety Bill. Our emphasis lies in the practical implementation of these objectives.”

The government has repeatedly touted ‘client-side scanning’ as a solution to identifying extreme content distributed via encrypted messaging apps. However, given the nature of encrypted messaging, only the sender and recipient of messages can view the content. 

Providers are unable to access said content. In this context, CSS would require the examination of content before it was even sent. 

Opponents have argued that this is simply unfeasible. Apple famously introduced client-side scanning technology for iCloud content, but later rolled back the move after it was found to have serious discrepancies. 

However, research into the use of CSS techniques has been conducted by leading cryptographers in the UK in recent years. 

A 2022 research paper authored by experts at the UK’s NCSC and GCHQ lent credence to the idea that CSS-style content moderation could be achieved without compromising user privacy or security. 

“Researchers rightly point out that poor designs for safety systems could have catastrophic effects on users safety and security,” the paper reads. 

“However, we do not believe that the techniques necessary to provide user safety will inevitably lead to these outcomes.”

This, the paper argued, could include the use of language models “running entirely locally on the client” to detect language related to grooming, for example. 

The paper noted that this would require human moderation in certain circumstances, however. 

“If the model suggests that a conversation is heading towards a risky outcome, the potential victim is warned and nudged to report the conversation for human moderation. 

“Since the models can be tested and the user is involved in the provider’s access to content, we do not believe this sort of approach attracts the same vulnerabilities as others.”

Is E2EE weaker now?

End-to-end encryption is still very much available to users of apps such as WhatsApp or Signal at present. The government has been keen to emphasize that this doesn’t equate to a ban. 

However, the requirements of the bill do raise questions over the potential long-term implications of encryption for users of such platforms. 

Privacy campaigners have argued that the bill, if passed, will weaken encryption and as a result, wider digital privacy across the country. 

Does the UK still want to break E2EE?

The government’s stance on end-to-end encryption has been steadfast for several years now. Fundamentally, lawmakers view this as a serious inhibitor for law enforcement in tackling extreme materials online. 

This isn’t the first attempt by the government to tackle the technology, either. 

Former prime minister Theresa May called for new legislation to tackle encryption in the wake of a 2018 terrorist attack in London. In the year prior, she banged the drum for a charge against encryption also. 

Two former home secretaries, Amber Rudd and Priti Patel, were both vocal on the matter, calling for stronger legislative powers to tackle the issue. 

The government’s crusade against end-to-end encryption may have temporarily calmed in the wake of the bill’s passing. However, long term, there could be a renewed charge against the technology, providing the feasibility of techniques such as CSS or alternatives are realized

Will tech firms have to make any changes to E2EE?

Since there is no actual ban to E2EE, tech firms won’t have to make any changes to the technology itself, but may be responsible for developing, or helping to co-develop, a bespoke tool that can scan encrypted messages “as a last resort”.

That’s according to technology secretary Michelle Donelan speaking to Reuters earlier this month. She also told Times Radio that if tech companies were not implementing adequate mitigations, or showing they can abide by the Online Safety Bill’s requirements, then there would be a conversation about the long-term survival of E2EE.

She also admitted that the tools don’t currently exist, but pointed to the possible implementations outlined in the paper written by leading cryptographers Dr Ian Levy of the UK’s NCSC and Crispin Robinson of GCHQ.

Junior minister Stephen Parkinson, addressing the House of Lords, also said that Ofcom’s ability to request for content scanning would be limited to cases only where it was “technically feasible”.

The statements of the two ministers appear to contradict one another with one saying that tech firms must demonstrate they’re taking steps to adhere to the Online Safety Bill’s requirements, or risk the survival of E2EE altogether, and another saying they won’t have to comply unless it’s technically feasible.

How could the government achieve its goals while maintaining E2EE?

According to the paper from Levy and Robinson, due to messages being encrypted and not seen by servers, there must be some activity on the client’s (user’s) side to adequately identify harmful or criminal content.

The research paper outlined a selection of different methods that could be employed in this scenario, but insisted they don’t endorse any of the methods specifically and understood a range of approaches would likely be necessary to achieve results.

Included are ‘matching techniques’, whereby media of known abuse images or content would be compared with media being distributed via a service. 

Matching techniques in themselves can be approached from a variety of ways, the paper notes, such as ‘client-side hashing with client-side matching’. 

In this instance, the hashing process and the hashed database of abuse material would be stored on the user’s device. 

While researchers said this approach would afford “maximum privacy” to users as both images and the hash would “never leave the device unless a match occurs”, having the algorithm and database stored on the user’s device could open both up to compromise It’s possible that criminals could reverse-engineer the algorithm or manipulate the database in a way that allows them to evade detection.

Other techniques, such as ‘client-side hashing with server-side matching’ and ‘hashing with client-server multi-party computation’ were also touted as impactful and E2EE-preserving techniques. 

This would see the hashed material stored on the user’s device and sent to a third-party server that held the database of criminal material. It would lessen the risk of compromising the database itself but not eliminate it entirely. 

“It would be possible, at least in theory, for a malicious server to build a database of all known images, and thereby to gain the capability to discover which images are being shared in the majority of communications,” the paper reads.

This would be an incredibly expensive way to undermine E2EE, but the cryptographers noted that even the possibility of such a scenario could risk confidence in the model.

Using a multi-party model, whereby multiple servers communicate with a device to compute the hash would mean less of the algorithm required for the process would be stored on the user's device, lessening the chance of it being reverse-engineered. It would also mean the server sees less of the material, or in some cases none of it, preserving user privacy.

There are drawbacks to these approaches that involve a degree of on-device processing, however.

The possibility of compromising servers, databases, and algorithms have already been acknowledged but what hasn’t been said is the potential for these types of hashing, that connect to a third-party, potentially government-controlled database, to be used for other types of surveillance without the user’s knowledge.

The Internet Society cited a 2021 Columbia University study, saying: “System[s] could be built in a way that gives an agency the ability to preemptively scan for any type of content on any device, for any purpose, without a warrant or suspicion. 

“Likewise, the same techniques to prevent the distribution of child sexual abuse material (CSAM) can be used to enforce policies such as censorship and suppression of political dissent by preventing legitimate content from being shared or blocking communications between users, such as political opponents.”

Why does the UK want to ban E2EE?

The two main arguments for breaking E2EE are to scout out and prevent crimes related to child abuse and terrorism. 

It’s seen as a major inhibitor for law enforcement who cannot monitor content sent over the secure communication protocol like they can with SMS messages or telephone calls, for example.

The Online Safety Bill is not the first time the UK has tried to break E2EE with legislation. The Investigatory Powers Act 2016 also has provisions for encrypted messaging platforms to be “active participants” in data interception efforts - a legal gray area that has not led to any major cases of compromising E2EE for the benefit of law enforcement.

It’s thought that the UK government has so far resisted enacting its power to ban E2EE outright through fear of losing major tech companies from operating in the UK. 

What are the arguments against banning E2EE?

Digital privacy campaigners have long fought for E2EE to remain. Encrypted messaging channels are seen as crucial tools in democratic societies to preserve personal privacy from unauthorized actors looking to monitor individuals. These could be the platforms themselves, national governments, or cyber criminals of all flavors (including hackers and stalkers).

Proponents of E2EE also argue that the crimes that the technology is said to facilitate are not an issue that will be entirely solved, or are caused by, E2EE itself. 

Both crimes against children and terror offenses existed before widespread access to E2EE messaging platforms, and so campaigners argue that efforts should be focused on combating the source of the crime rather than a privacy-preserving technology that, regardless of its merits, undoubtedly helps to protect the worst kind of criminals in the UK.

If E2EE were banned, criminals would likely seek out alternative forms of anonymity such as a greater reliance on the dark web to mask their communications. 

While the dark web doesn’t offer the strength of protection for communications as does E2EE, it would still make the work of law enforcement agencies significantly difficult, all while the public is left without a means to communicate privately.

As the economy has become increasingly dependent on data, companies have sought to make more profit from mining user actions such as through loyalty schemes or social media interactions. 

But individual rights also have to be respected, and businesses have to follow strict data protection procedures.

Privacy-enhancing technologies (PETs) are one method for companies to securely search through data to derive value – for example, a bank could search through customer data to expose fraudulent activity without putting the personal information of all the customers involved at risk.

This episode, Rory and Jane are joined by Ellison Anne Williams, CEO and founder of privacy-enhancing technology company Enveil, to discuss the dos and don’ts of data use, and how organizations can make use of PETs for enhanced data mining.

Highlights

“Gartner predicts that by 2025, you're going to see about 60% of all large organizations globally, leveraging some form of privacy-enhancing technologies for secure data sharing collaboration, monetization etcetera.”

“Now, privacy enhancing technologies uniquely protect data in use, when it's being used or processed, not when the data is sitting at rest in the file system or moving around the network in transit.”

“So when you talk about allowing any type of organization to be able to securely and privately use data across those boundaries or silos, one form of kind of boundary or silo that you can cross for secure and private data sharing and collaboration is that of organization. So for example, bank to bank, or maybe a healthcare entity to another healthcare entity.”

“It's equally applicable even down to the consumer level. However, I don't believe that's the way we're going to see adoption actually occur. I think at first it's going to follow a natural kind of innovation technology adoption curve, I believe, which is it will start with very large organizations.”

Footnotes

• What are privacy-enhancing technologies (PETs)?
• What is AES encryption?
• Intel joins forces with DARPA to help build encryption ‘holy grail’
• What is machine learning and why is it important?
• What are the pros and cons of AI?

Subscribe

• Subscribe to The IT Pro Podcast on Apple Podcasts
• Subscribe to The IT Pro Podcast on Google Podcasts
• Subscribe to The IT Pro Podcast on Spotify
• Subscribe to the IT Pro newsletter
• Subscribe to IT Pro 20/20

Amazon subsidiary Ring has agreed to a $5.8 million settlement over allegations it failed to prevent employees from violating customer privacy.

The Federal Trade Commission (FTC) laid out the claims in a complaint, which stated that every Ring employee and hundreds of third-party contractors had full access to customer videos prior to February 2018.

One employee was found to have viewed “thousands of video recordings belonging to at least 81 unique female users” including video feeds from bathrooms and bedrooms. 

A co-worker of the employee is said to have discovered the activity by chance and reported it to a supervisor. 

Details of the misconduct were laid out in the FTC’s complaint [PDF], which alleged that no action was initially taken against the perpetrator and it was only after all the victims were proven to have been women that they were terminated.

“We want our customers to know that the FTC complaint draws on matters that Ring promptly addressed on its own, well before the FTC began its inquiry; mischaracterizes our security practices; and ignores the many protections we have in place for our customers,” Ring wrote.

“While we disagree with the FTC’s allegations and deny violating the law, this settlement resolves this matter so we can focus on innovating on behalf of our customers.”

Although employees used this access for legitimate purposes such as for training Amazon algorithms, the FTC found that adequate notice or consent of this practice was not given to customers.

Policies that required Ring employees or contractors to receive customer consent to access their videos were not put in place until February 2019.

The FTC stated that Ring has been unable to identify the number of employees that accessed videos prior to this date.

Although employees were required to sign an agreement prohibiting misuse of data, the complaint alleged, they were not provided with training on data privacy or data security prior to May 2018.

The complaint also alleged that Ring did not secure its devices against hacking techniques like brute force attacks and credential stuffing, which led to the compromise of 55,000 customers’ accounts.

Hackers gained access to video feeds from around 1,250 devices, with 40% of these being internal cameras. In some cases, threat actors used the intercom functions of the devices to verbally harass victims inside their homes.

This is not the first time that Ring has been put in the spotlight over privacy concerns.

In 2022, the firm admitted it had given police departments device footage without user consent on 11 occasions that calendar year.

At the time, the firm stated that it had determined the disclosure of videos “without delay” had helped to prevent the danger of serious injury or death.

In 2019, a Ring vulnerability let hackers intercept Wi-Fi passwords in clear text which exposed victims to follow-up attacks.

Further fines for Alexa child privacy allegations

Amazon has also agreed to a $25 million settlement over allegations it violated privacy laws pertaining to children and misled parents over its data practices.

The firm was accused of retaining voice recordings of children indefinitely, and in violation of a children’s privacy law that allows parents to request deletion.

An official FTC complaint [PDF], filed by the Department of Justice, stated that Amazon acted in violation of the Children’s Online Privacy Protection Act (COPPA) by retaining voice recordings and transcripts of children for “longer than is reasonably necessary”.

Amazon policy states that Alexa data will be deleted upon request and that parents can choose whether it is retained, but the FTC found that until September 2019 parents were required to delete data themselves.

It also alleged that Amazon failed to honor deletion requests in violation of COPPA. The FTC noted that child voice recordings are valuable to Amazon as training data for its algorithms.

The firm denied the allegations, and in a blog post drew attention to the privacy measures already in place to protect Alexa data.

“We take our responsibilities to our customers and their families very seriously,” Amazon stated.

“We have consistently taken steps to protect customer privacy by providing clear privacy disclosures and customer controls, conducting ongoing audits and process improvements, and maintaining strict internal controls to protect customer data. While we disagree with the FTC’s claims and deny violating the law, this settlement puts the matter behind us, and we believe it’s important to put the settlement in the right context.”

Alvaro M Bedoya, the commissioner of the FTC, noted that Amazon’s justification for retaining data was inadequate.

“Today’s settlement sends a message to all those companies: Machine learning is no excuse to break the law,” he stated. 

“Claims from businesses that data must be indefinitely retained to improve algorithms do not override legal bans on indefinite retention of data. The data you use to improve your algorithms must be lawfully collected and lawfully retained. Companies would do well to heed this lesson.”

In addition to the settlement, Amazon will be required to delete child data including geolocation, and will be barred from using said data to train algorithms.

Shopify has committed to providing its retail customers with new avenues to target prospective customers in the wake of Apple's ongoing privacy crackdown.

According to CEO Harley Finkelstein, Shopify aims to invest heavily into its 'Audiences' marketing tool which launched last year. Further development of Audiences aims to enable retailers housed on the platform to boost engagement with customers now it's more difficult to track iPhone users' shopping habits.

Finkelstein told the Financial Times that the rollout of Audiences with be a “key area of focus” moving forward. The tool allows retailers on the platform to consolidate customer data, improve outreach and ad targeting, and is integrated with Meta and Google’s advertising platforms.

Through this, the company said that marketers will be able to better target ads at “lookalike” customers based on purchases from other retailers. Shopify told the FT that the system is designed specifically to compensate for Apple’s current rules on tracking iPhone users.

Similarly, Finkelstein said the new tool will enable Shopify to compete with Amazon’s rapidly-expanding advertising business.

Competitive landscape

The expansion of Amazon’s advertising division poses a significant challenge for Shopify, which is used by more than 1.7 million retailers globally. Advertising revenue at Amazon increased rapidly across the second and third quarters of 2022, surging by around 30% in Q3 and surpassing $9.5 billion.

While this poses a lingering threat to Shopify, ongoing changes to how Apple processes and shares user data are also prompting concerns amidst a significant slowdown in the global ecommerce industry.

New requirements on data processing for iPhone users mean that users can now choose to opt out of tracking between apps and websites. The decision sparked major upheaval across the advertising industry, with businesses raising concerns that they will be effectively blocked from targeting users.

Meta was a vocal critic of the move, with the social media giant claiming that advertising on its family of platforms will become less effective without the ability to target users.

However, while the move by Apple raised concerns across the industry, Amazon is among a number of firms set to benefit from the decision due to its policy of targeting ads based on first-party data.

Shopify believes that the expansion of its Audiences tool will allow retailers to continue targeting customers in a similar fashion to pre-Apple changes and engage with customers via Instagram, Google’s search engine, and YouTube platform.

A key factor in this move is that retailers will be able to opt in to adding customer data to a broader pool, which it claims will constitute “first-party” data.

But although Finkelstein insisted there will be long-term benefits for merchants leveraging the platform, some have raised minor concerns about sharing data within a larger pool that might include rival businesses’ data sets.

There’s always going to be some apprehension about sharing data,” Finkelstein said. “But that’s often offset by, net net, am I making more money, am I selling more?”

Industry disruption

Shopify announced last year that it planned to implement more than $46 billion in cutbacks across the business while company share values dropped by nearly 75% compared to a 2021 peak.

In July, the firm also announced more than 1,000 redundancies after encountering an unexpected slowdown in ecommerce sales in the wake of a pandemic-induced boom.

The ecommerce giant appears concerned over the prospect of heightened industry competition ahead of a looming recession. As such, enabling retailers to bolster engagement and outreach could be crucial as the company weathers difficult market conditions.

“Especially right now, merchants want to be able to find more customers,” Finkelstein told the FT.

A World Cup security expert has warned that personal devices are among the most serious cyber security considerations tournament organisers face amid concerns over attacks targeting the event.

Michael Smith, field CTO at Neustar Security Services, who led the cyber security strategy for the 2014 World Cup and Winter Olympics, said threat actors could target devices and applications to launch damaging cyber attacks.

“This is a fascinating topic,” he told IT Pro. “It’s been commonplace for a long time to use mobile applications for events. They hold our stadium tickets and our schedule. People at the event use social media applications to share events and interact with the event, its sponsors, and other attendees.”

While event apps provide attendees with vital information and complement the visitor experience, there is a risk attached as user data can be harvested and used for nefarious reasons, Smith warned.

“It has a huge potential to be abused. If you build the application to export the data without any other kind of logic, the user really doesn’t know how or what you are using.”

In November, European privacy regulators warned that two official World Cup apps posed serious privacy and security risks.

Germany’s data protection commissioner said that data collected by the two apps “goes much further” than what the respective privacy notices claim. These concerns reached such a point that security experts advised visitors to use blank phones if they were absolutely required to download them.

This isn’t the first occasion that a global sporting event has triggered security concerns either. Earlier this year, Chinese authorities were accused of using official event apps to harvest user data and monitor athlete communications during the Beijing Winter Olympics.

Hacktivism and disruption

While data privacy risks for users were a key recurring topic throughout the build-up to the Qatar World Cup, Smith said that broader external threats are also a serious cause for concern.

Large sporting events are “very interesting” from the perspective of attackers and offer a prime opportunity to cause serious disruption to the event, target a huge pool of potential victims, and capitalise on the inevitable strain placed on infrastructure by the influx of visitors.

“An event like the World Cup is more like an ecosystem than it is a single unified event,” he says. “As a security expert, this means that you have a wide variety of attackers with different abilities and goals which leads to having multiple targets that need protecting.”

The two key targets include online resources such as websites and local digital infrastructure, and end-users at the event itself.

“Online targets such as the official event website where the schedule, results, and news are posted is like a 24/7 news site, and a common attacker objective is to cause a website outage or a defacement to get publicity about their issue.”

During the preparation for the 2014 World Cup in Brazil, hacktivists caused serious disruption amidst concerns that vital funds were being allocated to build stadiums rather than improve housing and address long-running social issues.

Smith watched this process unfold in real-time in 2014 and said that cyber threats rapidly escalated as hacktivists sought to raise wider awareness of their respective causes.

“The protest shifted into the online sphere, and at first focused on the state and local government,” he explained. “The hacktivists were wildly successful as far as their technical and tactical goals: gaining system access, stealing data, posting sensitive information in public, and causing website outages.”

Before long, hacktivists shifted their attention to a broader pool of critical targets. Attacks were launched against the Brazilian central government, critical infrastructure, and well-known Brazilian brands.

Similarly, organisations outside of Brazil were targeted, including FIFA and official World Cup sponsors.

Final security concerns

With previous instances of hacktivist-led disruption at sporting occasions, it comes as no surprise that security experts have been watching events closely in Qatar.

The competition has been fraught with long-running claims of corruption and criticism of domestic social policies, making the final an opportune moment for hacktivists to make a statement on the global stage.

In late November, the warning signs were already there. Hacktivists waged a successful attack on the Qatari Ministry of Justice which saw a large volume of data stolen from a web application database and disruption to the website.

Ahead of the final, Smith said there is a serious risk that threat actors will attempt to disrupt the occasion by targeting official websites and broadcasting.

“Live video streaming from the stadium is usually licensed to a series of broadcasters and can be disrupted by a distributed denial of service (DDoS) attack against the entry point where the distribution network gets the video feed,” he said.

“Or, in a worst-case, admittedly movie-plot scenario, the attackers [could] change the video feed to show their own content.”

The prospect of a movie-plot-type scenario isn’t as far-fetched as it seems. Earlier this week, US-based sports broadcaster FuboTV was the target of a sophisticated cyber attack which knocked services offline during the semi-final between France and Morocco.

The outage sparked a wave of complaints from frustrated viewers who were unable to watch France battle for a hard-earned victory.

In a statement, the broadcaster confirmed that the outage was due to a “criminal cyber attack” and revealed it was working with cyber security firm Mandiant to investigate the incident.

Ticketing risk

Visitors attending the final in person on Sunday are also at risk of the disruption posed by cyber attacks, Smith said.

In 2014, Smith's teams were forced to contend with a piece of bot malware known as ‘Scorpyn Scanner’ which affected ticket sales infrastructure. With match tickets being released on a timed basis, this malicious bot would reserve tickets and cause serious disruption to customers.

“When it detected that tickets were released, it would reserve them and pop up a dialogue in the users’ browser so that they could click through and fulfil the order. However, people were running this bot and doing the online equivalent of queue-cutting, resulting in people not getting their tickets,” he said.

“Bots like this are still being used and are easy to find through simple Google searches.”

Don’t take risks with personal devices

For fans on the ground in Qatar this weekend, Smith issued a final warning over the prospect of using personal mobile devices at the event.

Similar to calls made by European privacy regulators, Smith says that using mobile devices places fans at great risk and advised them to take steps to mitigate potential threats.

“For the Sochi and Beijing Olympics, there were a lot of warnings about not taking electronic devices into those countries because they have a higher risk of your device getting attacked,” he said.

“These hacked devices are then taken home or to work where they are then connected to a different network, enabling attackers to use that malware to pivot into that network. Those attackers are criminal gangs or nation-state actors who want to hack devices in order to get access to other systems.

“One thing I would take under serious consideration is taking a device to a sporting event. If you need to take it, the best practice would be enabling airplane mode, so it doesn’t connect to a network.”

Few things are more important than having quality data that is easy to use, but simultaneously secure and compliant. Being unable to fulfil this need can result in erroneous insights and reduced customer trust.

This whitepaper analyses several topics related to data governance and privacy such as scalability, establishing and implementing organisation-wide standards, and data lineage and traceability. Building blocks like data cataloguing, automated metadata generation, and reporting are also covered alongside a discussion of how governance and privacy are related to a data fabric.

Download now to learn more from real-world examples featuring ING.

Provided by

Business owners are constantly hearing about the threat of identity theft, but would you know what to do if you were a victim? Would you feel confident you could act swiftly to minimize any damage? For many entrepreneurs, the answer is no.

According to Javelin’s 2020 Identity Fraud Survey, this type of crime affected 13 million American consumers during 2019, and the total losses stood at almost $17 billion. Once a hacker has access to your business’s information or the personally identifiable data (PID) of your clients, they can buy goods illegally, take out a new line of credit, or even claim a fraudulent tax refund.

Even if you have one of the support packages discussed in our guide to the best identity theft protection, there are further steps you can take if your business’s data has been compromised.

It took the average victim of a data breach 280 days to detect the crime, according to data from IBM. More than any other, this statistic highlights the importance of acting quickly if you are a victim of this type of crime. However, the most effective actions you can take when it comes to identity theft and what to do about it are, in fact, preventative.

As you probably know, identity thieves often gain access to their victims’ data by rifling through their garbage or stealing their mail. It’s therefore essential you carefully dispose of any correspondence containing your personal details.

With many cases of identity theft taking place in cyberspace, it’s also crucial to take all the precautions you can to secure devices in your home and work networks against data breaches. It perhaps goes without saying that the principal step you should take is to routinely change the passwords on all your online accounts, ensuring you use random strings of numbers and letters.

As well as installing robust antivirus software, you might want to select a package that offers a VPN: a virtual private network, which will keep your details anonymous when browsing the internet.

Step 1: Contact the relevant fraud departments

If you suspect you’ve been a victim of identity theft, the feelings of stress and anxiety can be overwhelming. Luckily, most banks and credit card companies offer dedicated fraud departments, with specially trained advisors who can help you deal with these matters.

Contacting these departments should be your first port of call if you suspect you have been a victim. The first step the bank or credit card company is likely to take is to freeze your account, cancel your cards, and work with you to change your security details.

Even if you don’t have access to any paper statements about your account, you should be able to find the relevant phone numbers online. If information such as your Social Security number has also been used in the fraud, you may also want to notify the Internal Revenue Service.

Step 2: Notify your threat protection company

If you have identity theft protection, the next step you need to take is to report the matter to the company that provides your policy. As a part of their services, these providers will work to restore the affected accounts, which should dramatically reduce the amount of stress you experience.

These services often involve freezing your credit, cancelling any cards that have been issued, and arranging replacements. Depending on the policy you choose, the company may also cover any legal costs associated with the crime.

Step 3: Report the crime to the police/FTC

As a victim of identity theft, your first priority may be to limit the damage to your finances and future credit. However, you shouldn’t forget that identity theft is also a serious crime, and you should file a report with your local police department. As well as alerting the authorities to the crime, doing so can create a paper trail in the event of further investigation into the fraud.

You should also report the matter to the Federal Trade Commission (FTC), which monitors data on identity theft. As well as working with government agencies such as the FBI, the FTC can work with you to create a personalized recovery plan.

Step 4: Run a credit check

If you discover your PID has been stolen, there is a strong chance that more than one account will have been affected. The most effective method of checking for anomalies with your data is to run business credit checks with Equifax, Experian, and Dun & Bradstreet, which are the three major credit reporting bureaus.

You should also consider running a check on your personal finances. In order to do so, you should consult Experian and Equifax, as well as TransUnion. As a part of this process, you can ask for a fraud notification to be added to your file, which will notify potential borrowers checking your credit that your identity has been stolen in the past.

Step 5: Gather evidence

While you’ll no doubt be feeling overwhelmed as a result of the crime, it’s a good idea to provide as many details as possible about your business’s account when contacting the relevant fraud departments. It also helps if you can thoroughly explain the reasons you believe you have been the victim of fraud.

You’ll also be in a stronger position if you can provide a record of your activities during the period in which the fraud occurred, in order to demonstrate you could not have committed the theft.

Step 6: Get everything in writing

If your suspicions prove correct and you have indeed been the victim of identity theft, you may - in a worst-case scenario - struggle to prove you haven’t taken out certain loans, and find yourself pursued for debts you don’t owe.

Whenever you speak to a company representative over the phone, you should keep a note of the employee’s name and the time of the call. It’s also worth sending a follow-up email to confirm the details of your conversation, and request a confirmation of receipt from the company.

Step 7: Seek specialized legal advice

If you can afford to do so, it’s essential you contact a lawyer who has specialized experience in dealing with this type of crime. However difficult it may be for you to accept, the companies involved in the fraud may not automatically believe your version of events, and you may find yourself a suspect. In another major plus point, your lawyer may be able to deal with your alleged creditors on your behalf regarding the identity theft and what to do about it.

Step 8: Notify affected clients

As a business owner, you’re likely to be in a position of trust in which your clients enter some of their PID into your systems. Should you fall victim to a data breach, this means it isn’t only your data that could be at risk.

If your clients’ information has been compromised, you should let the affected individuals know as soon as possible, so they can take appropriate steps in order to minimize damage to their own identities. As such an incident has significant potential for reputational damage and also potential legal implications, it’s wise to take legal advice if your clients’ data has been stolen, as well as consulting your own PR department, if you have one.

Summary

When it comes to identity theft and what to do about it, your first instinct may be to panic as you struggle to determine what to do next. Fortunately, there are numerous steps you can take to minimize damage, and get your company’s finances in order.

One point to bear in mind is that you needn’t wait until your business’s data has been compromised to follow certain good hygiene practices in cyberspace, such as regularly changing your passwords and purchasing identity theft protection software. However much of a cliché it may sound, the best offense against identity theft could be a good defense.

Identity theft is a serious and unnerving crime. You could be a victim of it for some time without realizing, after which you might be left with troubling financial, or even legal, repercussions.

What’s more, identity theft can take several forms—from credit card cloning to online account hacking. Therefore, exploring the best identity theft protection is a wise move.

If you’re worried that you might be vulnerable to ID theft, there are some tell-tale signs to look out for, as well as proactive steps you can take to stay safe—all of which we’ll discuss in this article. Here’s everything you need to know about identity theft and how to check if you've been a victim of this crime.

Step 1: Check your bank account for unusual transactions

It’s important to carefully and regularly check your bank account and credit card statements—ideally every week—so you can quickly spot unfamiliar transactions. If you know the normal patterns of your expenditure, you can easily identify unusual activity.

Check for outgoing payments to vendors/services you don’t recognize, as well as any other spending or cash withdrawals that don’t seem right—however small. These could be signs that a criminal has stolen your banking or credit card details, perhaps by hacking into one of your online accounts or by cloning your card at an ATM.

If you’re sure that a transaction wasn’t made by you, you should immediately report it to your bank/credit card company. The faster you raise the red flag, the less damage a criminal can do.

Step 2: Check for suspicious activity on your online accounts

These days, most people have multiple online accounts containing sensitive data, including your home address, date of birth, and banking details. Therefore, these accounts are natural targets for identity thieves.

It’s important to look out for any activity that you can’t explain, including login attempts from unknown devices or locations, unauthorized password changes, and unfamiliar times and dates relating to last access. These could be indications that a cybercriminal has hacked into your account and should be investigated.

If you’re confronted with suspicious activity, re-secure your account by changing your password, remotely logging out on all devices, and enabling two-factor authentication (which means a second piece of verifying information, like a passcode or PIN, must be provided to log in). You’ll also want to check your bank account to see if any unrecognized purchases have been made.

Step 3: Look out for unusual emails, texts, and letters

Mail from an unfamiliar, official source could be an indicator of identity theft. This might be something like a letter from a bailiff demanding payment for debts you don’t owe, or a registration email or text message from a paid service you didn’t sign up for.

Unsolicited mail may not seem like a big issue, but if it doesn’t feel right, don’t be tempted to pass it off as misdirected junk. Instead, contact the helpline of the relevant service provider, company, or bank and ask them to investigate any irregularities.

Step 4: Take note of how much mail you’re receiving

One tell-tale sign of identity theft is if the amount of mail you’ve received over a four or five-month period has noticeably decreased. This is particularly true for postal bank or credit card statements but it can also apply to emails—especially if you’ve opted to go paperless.

If you haven’t received your usual statements or other regular mail for a while, and your bank or provider can’t account for the delay, it’s worth alerting your postal service to the possibility of fraudulent mail redirection.

Additionally, if you’re waiting for a new credit card that should have arrived weeks ago, contact your credit card provider and query the delay. There might be a harmless explanation, but it’s also possible that an opportunist may have intercepted it.

Step 5: Check your credit report

Checking your credit report is an effective way to see if any large loans have been applied for in your name, and several companies can provide this service for free. It’s advisable to check your credit score at least once a year—if not quarterly or every month—to make sure you have an accurate record of your financial activities.

If your credit score is inexplicably low, it might be a sign of fraudulent activity. Check the contents of the report carefully to see if you can spot anything untoward.

If something is obviously amiss that you can’t find an explanation for, you should contact a consumer credit bureau such as Equifax, Experian, or TransUnion, and outline the problem.

Step 6: Check for data breaches

Data breaches are unfortunate and, sadly, largely beyond most people’s control. Thankfully, it’s possible to check if your personal information has been involved in a data leak.

Firstly, if you become aware that a company holding your personal details has fallen victim to a breach, you can contact them to see whether your data was leaked. Secondly, you can use a free online service like Firefox Monitor or Have I Been Pwned, to check if your email address has been linked with any known data breaches.

Having your personal details leaked doesn’t automatically mean that you will have had your identity stolen. That said, it does increase the likelihood, as your details may have featured on dark web marketplaces. So, it’s wise to invest in an advanced antivirus suite that includes continual dark web monitoring, such as Norton 360 with LifeLock.

Step 7: Check your tax return status

Individuals may become aware of identity theft when they go to submit an electronic tax return and find it’s automatically rejected. In these cases, it could be that a criminal has already submitted one in the victim’s name, to gain access to their tax refund.

If you’re concerned that this might have happened to you, you can log in to your online tax account to check if any unfamiliar tax returns have been submitted. Should you find you’ve become a victim of tax-refund identity theft, contact the revenue service’s fraud department without delay.

Step 8: Check that your ID documents aren’t missing

This might seem a little obvious, but keeping a watchful eye over your ID is important, especially when you’re out in public spaces.

If you lose your passport or driver’s license, for example, there’s a chance it could be picked up by a criminal who can then use it to steal your identity. Similarly, a mislaid credit card could be used to make dubious financial transactions if it’s not swiftly reported to your credit lender and cancelled.

Summary

Although identity theft can be difficult to detect, these tell-tale signs and their subsequent actions can help you protect yourself from ID fraud.

It’s important to keep a close eye on your bank account and credit card statements, as well as on any emails, letters, and texts you receive. It’s also worthwhile checking to see if your personal details have been involved in any online data breaches, while exploring different identity theft protection providers can give you the upper hand over fraudsters.

In all cases, proactivity is the key to keeping your data safe. By keeping tabs on your regular spending activities and any correspondence you receive, you should be able to spot any irregularities before they become a bigger problem.

According to a recent study, there were over 12,000 data breaches in the US between 2008 and 2020. That’s millions of people who have had their sensitive personal data exposed online. Even today, you will be surprised at how easy it is to find leaked credit card details online if you know where to look.

Whether you are an individual or run or own a business, it has become more important than ever to secure your identity from potential fraud, be it online or offline. A good identity theft protection service can help you do just that.

The best identity theft companies use a variety of techniques to keep your personal data safe from online abuse. In exchange for a fee, they will carefully monitor any data breaches to make sure that your information hasn’t been exposed anywhere. And if there’s a breach that concerns you, knowing that your information has been compromised at the right time can make all the difference.

The best identitity theft companies for protecting your identity

1. Norton LifeLock

LifeLock was acquired by Symantec, the company behind Norton Antivirus, in 2017. Since then, it has made great strides establishing trust as an identity protection service. Its yellow interface denotes a feeling of trust, marked by a clean dashboard that gives you all the necessary tools right at your fingertips. Just by looking at the UI, you can tell that this is a company that cares about customer experience.

Right now, LifeLock offers comprehensive packages that monitor online traffic, dark web activity, finance applications, court records, and much more to issue real-time alerts whenever someone attempts to do anything criminal under your name. In the event that your identity does get stolen, LifeLock will take care of all the legal heavy lifting so that you can continue to live your life. Its team will make the necessary calls, inform all concerned authorities, and fill official forms to ensure that everything gets back to normal as soon as possible.

There are several plans to choose from. LifeLock Standard, which costs $8.99 a month, offers credit monitoring and social security number protection. It also comes with $25,000 in theft protection insurance. LifeLock Select, which also costs $8.99, offers all of this on top of a virtual private network (VPN). The pricing is only for the first year, however, after which Standard costs $12 and Select costs $15 a month. Then there’s LifeLock Advantage, which costs $20 a month. Finally, LifeLock Ultimate Plus sets you back $34.99 and offers $100,000 in insurance.

Read our full Norton LifeLock review.

2. IdentityForce

Based in Massachusetts, IdentityForce has versatile protection plans for individuals, businesses, and government agencies alike. Its most basic plan offers access to credit reports from providers like Equifax and Experian, whereas higher-tier subscriptions offer monitoring services for social security numbers, bank accounts, mailing addresses, and even the sex offender registry. With that, IdentityForce keeps track of any potential abuse of your identity and takes necessary steps to secure you against fallout.

Software-wise, IdentityForce is available as a web-based client as well as a smartphone app. It even throws in additional security services like keylogger protection and anti-phishing software to stop your data from being stolen in the first place.

There’s also a social media monitoring network that scans for fake accounts under your name on Facebook, Instagram, YouTube, and Twitter. All of this, combined with regular alerts via email and messaging, provide for complete peace of mind as you go about your daily business.

IdentityForce is priced reasonably, starting at just $8.99 a month, and it comes with an insurance cover of up to $1 million. If you require additional features, you can also upgrade to a plan that adds credit monitoring for a total of $19.99 a month.

3. Experian IdentityWorks

Experian is the same credit reporting agency that’s infamous for a 2015 data breach that exposed the email accounts of 15 million customers. While that doesn’t necessarily exude confidence, its identity protection service may still be worth considering in 2021. IdentityWorks specializes in credit report monitoring, but it also keeps track of other activity, like dark web activity, social media accounts, court records, and bank transactions, to give you a comprehensive protection plan against identity theft.

Once you’re logged in to the interface, IdentityWorks presents you with a professionally-designed dashboard that goes to great lengths to ensure that you understand what you’re looking at. Everything is very clearly explained, with an onboarding wizard that takes you through the steps for getting set up. There is no jargon anywhere, and the console is very easy to familiarize yourself with.

In terms of payment plans, the IdentityWorks Plus plan consists of credit report monitoring and dark web scanning. It comes with $500,000 in identity theft insurance, and costs $8.33 a month for one adult and up to 10 children. It’s easy to add another adult to the plan for another $8.33.

IdentityWorks Premium offers more well-rounded protection, monitoring court records and social networks, among other things. The insurance amount also goes up to $1 million, and the plan costs $19.99 a month.

4. PrivacyGuard

Owned and operated by the Trilegiant Corporation, PrivacyGuard offers credit reporting and identity protection services in exchange for a fee. At the base level, the credit monitoring plan is actually offered separately from identity protection, which means that if you want both, you’ll need to subscribe to the costliest plan.

Services include everything from social security monitoring to credit fraud protection, depending on the plan you choose. While this means you can pick and choose what you need, it also stands to reason that you’ll end up paying more if you need both services.

The identity theft protection service comes with dark web surveillance, social security event monitoring, annual public records reports, online fraud assistance, stolen credit card protection, anti-keylogging software, and secure web browsing. The credit report monitoring solution actually costs more, offering three-bureau credit reports, credit record monitoring, and online fraud assistance. It also comes with an anti-keylogger and a secure browser.

PrivacyGuard ID Protection costs $9.99 a month and offers $1 million in insurance. PrivacyGuard Credit Protection sets you back $19.99 a month and offers 24/7 credit monitoring. PrivacyGuard Total Protection offers the benefits of both plans for $24.99. If you’d like to try out the service before you commit, you can go for the trial plan, which costs $1 per day for the first 14 days of your subscription.

5. Identity Guard

Founded in 1996, Identity Guard uses proprietary machine learning algorithms developed by IBM Watson to constantly scan the internet for potential threats of identity theft. It issues real-time alerts to protect users against data leaks through websites, public records, and social media activity. For example, it scans the dark web for any potential mentions of your social security number to ascertain whether you might be exposed. It also provides annual credit reports to its users through Equifax, Experian, and TransUnion.

In a market saturated with competition, Identity Guard adds extra edge to its offering by using IBM Watson’s artificial intelligence technology. This strategic partnership helps the identity protection service identify possible data leaks faster than any other service provider on this list. It also comes with secure browsing and payment protection tools as an added bonus to subscribers. The highest-tier plan also includes a monthly credit score from TransUnion.

Identity Guard offers three different subscription plans. Value provides the most basic protection, with dark web scanning, safe browsing, and anti-phishing tools. You also gain access to a caseworker who will assist you with reclaiming your identity should the worst-case scenario ever happen. It costs $7.50 a month for individuals and $12.50 a month for families.

The Total plan offers all of this along with credit monitoring for $16.67 a month for individuals and $25 a month for families. Finally, the Identity Guard Ultra plan provides the most benefits, with three-bureau credit reports, card monitoring, criminal records scans, and sex offender registry monitoring. It costs $25 a month for individuals and $33.33 a month for families.

6. Complete ID

Complete ID is the product of a partnership between Experian and Costco. It offers wholesome identity protection services at attractive price rates. It’s packed with features like dark web scanning and social security monitoring. Apart from identity protection, Complete ID also offers credit monitoring and identity restoration services. While the user interface is a bit clunkier than the other providers on this list, the highly affordable packages make it well worth the compromise.

Complete ID scans court records, criminal databases, financial accounts, and change of address requests to locate and flag potential cases of identity theft. It also scans the dark web for your social security number (SSN). As it is owned by Experian, you can expect an in-depth credit monitoring service to go along with your plan. Detailed credit reports are obtained from all three credit bureaus and alerts are issued whenever someone opens an account with your information.

In case your identity gets stolen, Complete ID offers theft coverage of up to $1 million with no deductibles. This should be enough to cover things like legal fees, lost income, and emotional duress. The interface is clean and easy to use, even if slightly outdated.

Complete ID requires you to have a Costco membership in order to sign up. It usually costs $13.99 per user per month, but Costco Executive members get a discounted rate of $8.99. You can extend your coverage to include up to five children for another $3.99 a month ($2.99 if you have a Costco Executive membership).

7. ADT Identity Theft Protection

ADT is a company best known for its smart alarms and motion detectors. ADT Identity Theft Protection, however, is a new service that expands its offerings to security in the digital space. For a surprisingly affordable price, the company gives you access to features like theft insurance, credit monitoring, dark web scanning, financial account security, passport monitoring, and more. While these are run-of-the-mill features that you can get from any service provider, the brand reputation and price affordability alone make this deal worth considering.

Most services at this price point offer $100,000 to $500,000 in insurance. But not ADT. With no-strings-attached coverage up to $1 million, ADT Identity Theft Protection makes for a solid offering indeed. You are limited to only one credit report per year, but you can always obtain unlimited free credit reports from a website like Annual Credit Report.

There aren’t any major extras to speak of, but the package covers your most essential identity protection needs. Experian and Equifax offer limited plans at a similar price range, but they have both experienced data breaches that have been on the news for quite some time.

ADT Identity Theft Protection costs $9.99 a month. You can’t just sign up online, though; you have to call a dedicated hotline. You can also chat with the sales team online if you have questions.

• Read our guide to the best online security suite

If you're a business owner, you're no doubt concerned about any threat to your data and that of your customers, with identity theft being one of the most dangerous forms of cybercrime.

In fact, identity theft has become so prevalent that it now affects approximately one in 20 Americans every year, according to Javelin’s 2020 Identity Fraud Survey.

But even if you’re already using one of the packages discussed in our guide to the best identity theft protection, do you really know what identity theft is? And are you aware of the impact it could have on your business?

We’ll provide identity theft definitions, and walk you through some of the key points every business owner needs to know in order to safeguard themselves against this increasingly common form of cybercrime.

Identity theft - definition

As the name suggests, identity theft is the act of stealing another individual’s personal details, often with the intention of applying for credit or buying goods illegally in that person's name. Tax fraud is a common form of identity theft, in which a criminal uses a victim’s data to file a tax return and illegally claim a refund.

The consequences of identity crime can be devastating. Should credit be taken out in your name or that of your company, you could face significant difficulties in proving that you did not indeed take out the credit or purchase the item yourself. In a worst-case scenario, you could find yourself pursued for a debt you don’t owe.

Even if you’re able to demonstrate your identity has been stolen, you could discover your credit has been destroyed by the incident, leaving you and your business unable to borrow money in the future through legitimate means.

As a business owner, it’s also important to be aware of employment identity theft, in which a perpetrator uses another person’s details to falsely apply for employment.

How does identity theft happen?

For many identity thieves in the USA, gaining access to their victims’ Social Security number is key to the crime. Once a criminal is in possession of this information, he or she can easily represent themselves as the intended victim when dealing with financial institutions.

Non-digitally, identity theft has historically occurred when a perpetrator went through another’s post or rubbish in order to uncover correspondence, such as bank statements or tax details. In the case of businesses, criminals could obtain your details by entering your premises or stealing your business’s files, which can expose both your own information and that of your clients.

Other identity thieves may use similar low-tech methods of gaining access to your company’s details. They may, for example, call or email your business to ask for details about the organisation, perhaps masquerading as a potential customer, claiming to sell services, or claiming to represent a market research agency.

Account takeover is another common form of identity theft in which perpetrators, especially hackers, illegally gain access to another person's accounts in order to change passwords or transfer funds.

The dangers of cyberspace

In an increasingly digital landscape, it’s no surprise that old-school methods of identity theft are becoming less widespread, with many cases of identity theft against businesses occurring in cyberspace.

One of the most common forms of attack is through the use of spyware, in which a piece of malicious software covertly monitors a company’s online activity by gaining access to a hard drive within the company’s network, and then sharing this information with third parties.

Man-in-the-middle attacks are another common method of identity theft. Using this tactic, a hacker will monitor any business activity conducted over unsecured networks, and then steal information such as login details. Once inside your organisation's network, the criminal can easily access your most sensitive information.

Yet not all attacks in cyberspace need to be so high-tech. Hackers can frequently gain access to personal information the victim has (over) shared on social media. This can leave sole proprietors especially vulnerable, as these individuals often reveal a great deal of information about themselves online in order to promote their brands.

One point to bear in mind, given the rise of remote working, is the potential risk employees pose when logging into your network from home via their own devices and home Wi-Fi. In many cases, personal devices and networks lack adequate threat protection software, which could leave your entire business network vulnerable to attack.

Learn from big-name casualties

As we all know, stories of large-scale data breaches are constantly hitting the headlines. Some of the more high-profile examples include an attack against video conferencing giant Zoom. In April 2020, it was widely reported that the personal details of more than 500,000 users, including email addresses and passwords, had been found for sale on the dark web.

Although you probably don't class your business in the same league as Zoom, it's nevertheless essential to recognize the potential devastation a breach could cause. Should you fall victim to an attack, the reputation damage to your business could be devastating, and you may never recover your customers’ trust.

In more extreme cases, falling victim to a beach could potentially destroy your business. If, in the event of a data breach, your customers determine you have been negligent with your cybersecurity measures, they may decide to take legal action, leaving you with catastrophic legal bills.

As proof of this, aviation giant British Airways is currently facing an estimated $3.3 billion bill following a data breach that took place in 2018 in which the personal details of more than 43,000 passengers were exposed.

Get the right tech in place

With threats such as spyware and man-in-the middle attacks posing a risk to your data, it’s essential you have a comprehensive antivirus software in place. When you’re choosing threat protection software, it’s wise to look for a plan that provides a VPN: a virtual private network that will keep you anonymous when browsing the internet.

If you’re particularly concerned about the threat of identity theft across your business, however, you may want to take additional precautions. A number of companies offer specialized identity theft services to offer additional support. IdentityForce, for example, provides fraud monitoring services to alert you if your data is used illegally, as well as offering 24/7 support services and $1 million of identity theft cover.

Not all threats are external

It’s tempting to imagine that all data breaches originate from organized gangs of cybercriminals, or teenage hackers locked away in their bedrooms. It may therefore be a surprise to learn that most data breaches are caused by human error, according to research from CybSafe.

As a business owner, it’s therefore vital you provide your employees with adequate training on the potential dangers of identity theft, and ensure they understand the rules surrounding confidentiality within your organization.

Conclusion

Although we constantly hear about the importance of being on our guard in many aspects of our lives, vigilance really is the key to protecting your business against the threat of identity theft. Being familiar with identity theft definitions and the various guises the crime can take is the first step toward taking effective precautions.

We’ve witnessed tremendous advancements in the digital world. But as our digital tools grow powerful, so does the threat from cybercriminals. Identity theft, especially, has grown rampant over the years. It’s risen steadily across the globe, and many identity theft protection applications have been launched to curb this trend.

In this article, we’ll go over 14 identity theft statistics that may help you determine whether you need protection. If you choose to opt for it, you can read our guide to the best identity theft protection to find the right software for yourself.

• Identity theft: What it is, and how it can affect your business

1. There’s a new identity theft victim every two seconds

It’s an understatement to say that cybercrime is increasing rapidly. The fact that every two seconds there’s a new victim of identity fraud is testimony to this. In the US alone, there were close to 1.4 million reports of identity theft in 2020. What’s more shocking is that it’s more than twice the number of reports from 2019.

• Identity theft: What to do if the worst happens

2. Social media users are at a 46% higher risk

Social media users are more likely to experience fraud compared to those who aren’t active on these platforms. As exciting as it may feel to be active on social media, cybercriminals too are actively seeking targets through these platforms.

This particularly applies to users active on Instagram, Facebook, and Snapchat, who are at a 46% higher risk of identity theft. The popularity of a platform doesn’t guarantee foolproof safety. For example, during the Cambridge Analytica scandal of 2018, around 50 million accounts on Facebook had their data compromised.

3. 40% of fraud happens within 24 hours of account takeover

Improvements in technology are making it easier for cybercriminals to gain unauthorized access to people’s online accounts. Without a powerful security application, users may not even realize that their data has been compromised. This is dangerous, seeing how 40% of fraud happens within 24 hours of account takeover.

4. Kids are more likely to be identity theft victims than adults

Children and teenagers often lack financial experience and are not cautious about the websites they visit and the data they share online. This makes them 51 times more likely to face identity theft compared to an adult.

5. More than 1 million children in the US experienced identity theft in 2017

Cybercriminals value a child’s data over an adult’s because there’s no existing record and it’s easy to create a new identity and open a line of credit. Since children now leave digital footprints earlier than they used to, they’re also more susceptible to identity theft. 2017 saw over 1 million children in the US facing identity theft, resulting in a loss of $2.6 billion.

6. Consumers lost more than $1.9 billion to identity theft in 2019

Consumers reportedly lost over $1.9 billion due to identity theft and fraud in 2019. Compared to 2018, this was a 28% increase in losses. The median amount the victims lost in these cases was $320.

7. More than one in four older adults are victims of identity theft

An older adult refers to individuals aged 55 and above, and more than one in four in this category have been a victim of identity theft. One reason for this could be that older adults are often not tech-savvy, and are unable to distinguish an authentic website from a fraudulent one. Another reason could be difficulty in remembering passwords and using the same password across all websites, which makes it easier for cybercriminals to acquire access.

8. 33% of US respondents have been victims of identity theft

A 2018 report from Proofpoint found that 33% of US respondents had experienced identity theft. This was more than three times that of German and French respondents, and more than twice the global average. Turns out, US respondents also shared their social check-ins more than other global users, and this meant they were exposing more of their information to cybercriminals.

9. Stolen credit card data could be sold for 50 cents per card

Cybercriminals sell credit card data for as low as $0.50 per card on the dark web. Considering how much financial damage this can do, it’s astonishing to see the price at which such sensitive information is available. Cards that had more details, like the CVV number, were more expensive, sometimes going up to $0.45 per card.

10. Credit card fraud tops identity theft

2019 saw credit card fraud topping the list of identity theft reports. The Federal Trade Commission received over 271,000 reports from individuals who stated that their information was illegally used to open new credit card accounts, or that their existing account was misused.

11. 50% of US adults think cybercriminals won’t target individuals with poor credit

An online Experian survey in 2017 found that 50% of US adults believed that identity thieves wouldn’t target individuals with poor credit records. This, however, is far from the truth. The number of identity theft cases has been rising steadily, and this means even people with poor credit can be at risk.

12. 87% of consumers haven’t secured private information online

A report from Symantec saw that 87% of consumers had left their private information exposed online while accessing their email or important financial information.

Furthermore, 60% of consumers felt safe using public Wi-Fi, which means that these consumers don’t realize the dangers of accessing personal information on public channels. Not surprisingly, most users weren’t using a virtual private network (VPN) to secure their online information.

13. The global average cost of a data breach is $3.86 million

A 2020 report from IBM Security showed that around the world, the average data breach costs $3.86 million. Additionally, having a remote workforce increased the average cost of a data breach by $137,000.

14. 45% of victims feel a lack of trust in family members

Handling identity theft swiftly is crucial, but it’s also essential to handle the emotional turmoil this event can cause. The Identity Theft Resource Center published a study in 2018 that suggested that over 45% of identity theft victims felt a lack of trust in their family members after experiencing identity theft.

Summary

All these statistics about identity theft might feel overwhelming, but unfortunately, the threat is real. These cases of cybercrime are likely to increase as more of our transactions move online, and we can’t simply expect it to not happen to us.

By taking the right precautions, we can ensure security for our private data and information. Cybercrime is expensive, and general alertness while operating in the digital space is essential. To seriously bolster your security against identity theft, you must use identity theft protection.

Complete ID is an identity theft and credit monitoring service from Experian, one of the three major credit agencies. The service is only available to Costco members, but the price represents the kind of incredible deal for which Costco is known. Complete ID isn’t the best identity theft protection option on the market, but it’s a great option if you’re already a Costco member.

Complete ID: Plans and pricing

Complete ID requires a Costco membership (which starts at $60 per year) in order to sign up. The service costs $13.99 per person a month, but Costco Executive members get discounted pricing of $8.99 per person per month. You can also add identity monitoring for up to five children for $3.99 a month ($2.99 a month for Executive members).

Complete ID: Features

Complete ID offers a limited set of features compared to other identity monitoring services. That said, it covers all the basics well at a fraction of the cost of competing services.

To start, Complete ID monitors for any unauthorized use of your identity. The service automatically scans criminal databases, court records, change of address records, and financial accounts for your name. It also scans the dark web for your personal information, including your social security number. If Complete ID finds a match in any of its scans, you’ll receive a notification.

The service also offers in-depth credit monitoring, which makes sense given that Complete ID is owned by Experian. You get full credit reports from Experian, Transunion, and Equifax, along with alerts anytime a new account is opened using your information.

Perhaps the best part of Complete ID is that if your identity is stolen, you’re covered by up to $1 million in insurance to cover lost income, legal fees, and other damages. There’s no deductible to access this money, which makes the low monthly subscription fee an even sweeter deal.

In addition, Complete ID provides you with a dedicated identity restoration specialist. They can help you get new identification documents, work with credit agencies to restore your financial history, and wipe away any records forged under your name. You get direct contact information for your dedicated specialist, which can make the months-long process of restoring your identity feel a bit more smooth.

Complete ID: Interface and in use

Complete ID’s online interface is relatively easy to use, although sorting through alerts and other information isn’t as simple as it could be. To start, you can add personal details like your social security, passport, and driver’s license numbers to your account to enable comprehensive monitoring.

Once that’s set up, Complete ID will automatically collect information and add it to your online dashboard. Much of the dashboard is dedicated to credit monitoring, and the interface looks a lot like the credit reporting you might already receive from your bank or credit card provider. It’s not overly informative, although your credit score is graphed over time so that it’s easy to see if there’s a sudden change.

The alert system in Complete ID was also a little disappointing. You can opt to receive notifications about suspicious activities by email or push notification through the mobile app, but you cannot get alerts by text message. Alerts were also relatively few and far between. While no one wants to be bombarded with identity theft warnings, it would be nice to feel as if the service was picking up a bit more information in its scans.

Complete ID: Support

Complete ID’s support team is available by phone 24/7 every day of the year to answer questions and respond to identity theft incidents. One of the best things about this service is that you are assigned a dedicated identity restoration specialist when you report an incident, and that same agent remains your point of contact until your case is resolved.

The competition

Complete ID doesn’t have many of the bells and whistles of competing services. Norton LifeLock, for example, offers a suite of security tools that includes a VPN, cloud backup, webcam blocking, and a password manager. The online interface is also easier to use, and you have more control over how you receive alerts about suspicious activity. IdentityForce offers many of the same features, and it’s similarly easier to use than Complete ID.

That said, LifeLock costs $12.49 a month and IdentityForce costs $23.95 a month with credit monitoring. If you already have a Costco membership, and especially an Executive membership, Complete ID covers the essentials at a significantly cheaper price.

Final verdict

Complete ID doesn’t go above and beyond when it comes to features, but it’s still a fairly reliable identity theft monitoring service. You get credit monitoring and dark web monitoring among other essentials, plus up to $1 million in insurance coverage and dedicated support in the event of identity theft. We’d like to see a more robust user interface and more customizable alerts, but this isn’t a deal-breaker.

Overall, Complete ID is worthwhile if you already have a Costco membership. If you don’t, we recommend an alternative like Norton LifeLock or IdentityForce.

Anytime you share your credit card number, address, or even your name online, you become vulnerable to identity theft. Cybercriminals are always on the lookout for new ways to steal your personal information, in order to engage in fraudulent activities like maxing out your credit cards or stealing your tax refunds.

Even the most careful online users are vulnerable to data breaches, making identity theft protection essential.

In this article, we’ll compare two of the best identity theft protection services available, pitting LifeLock vs Identity Guard. We’ll take a look at the features, performance, support, and price of each, so you can find the best product for your identity theft protection needs.

Features

LifeLock is part of Norton AntiVirus, a well-known name in antivirus protection. That means that with most levels of LifeLock, you also get the anti-malware services of Norton 360 - a crucial component of identity theft protection, since cybercriminals can obtain your information through malware attacks.

Identity Guard also offers a virus scanning component with some of its services, but unfortunately, it is only for PCs, whereas Norton 360 is also compatible with Macs and mobile devices.

Both LifeLock and Identity Guard offer the standard identity theft protection services: monitoring databases, the web, and the dark web for your social security number and other private information. They both provide ID verification, alerting you of potentially malicious activities such as applications for a new credit card in your name.

Both will monitor your credit reports to alert you of any changes. Both will even help you replace or cancel credit cards if your wallet is stolen.

The main difference between the features of LifeLock and Identity Guard lie in the services they provide if you do become a victim of identity theft. If identity theft is detected, Identity Guard will appoint you a personal case manager so you won’t be stuck dealing with the problem on your own. They also offer up to $1 million of identity theft insurance, including stolen fund reimbursement, for all customers.

LifeLock also offers reimbursement for funds stolen due to identity theft, but the level of reimbursement varies depending on your membership level. Standard LifeLock customers only have access to $25,000 of stolen funds reimbursement. Only with the most expensive membership - LifeLock Ultimate Plus - does LifeLock match Identity Guard’s stolen fund reimbursement amount.

But this doesn’t necessarily make Identity Guard the clear winner. LifeLock offers other reimbursement features, such as personal expense compensation and coverage for lawyers, that could make up for the lower stolen funds reimbursement figure. Plus, with the benefit of Norton 360’s trusted antiviral scanning, we think LifeLock just beats Identity Guard when it comes to features.

Performance

LifeLock is extremely easy to set up, requiring just a few minutes and a valid ID and credit card. If you have been a Norton customer in the past, you will find the interface familiar and easy to navigate, although it is intuitive even for new users.

LifeLock customers can either log in to their account on the LifeLock website, or download the mobile app, available on both iOS and Android. The mobile app enables LifeLock users to receive fraud alerts on the go, so you don’t have to waste any time before taking action to protect your accounts.

One important time-saving feature of the app is the ability to contact LifeLock Member Services with an in-app calling service, meaning if there is an issue, you won’t be fumbling around trying to figure out who to call.

Like LifeLock, Identity Guard is very simple to set up and start using. Identity Guard also offers users the option to log in to the website or download a mobile app for iOS and Android. While Identity Guard and LifeLock offer comparable features on their browser login pages, we found that the LifeLock mobile app was better designed and more intuitive to use.

Support

As mentioned above, Identity Guard assigns users a personal case manager to work with them if they experience any identity theft issues. While this can be a nice benefit - saving users the time of having to explain their problem over and over again to a new customer service rep - it doesn’t make up for the one glaring problem with Identity Guard’s user support: it’s not available 24/7.

While Identity Guard’s monitoring services work around-the-clock, its customer services team is only available from certain hours Monday through Saturday, and not at all on Sundays.

Unfortunately, this means that if you experience an issue late at night or early in the morning, you’ll have to wait for Identity Guard’s business hours to deal with it—potentially costing you crucial hours.

LifeLock, however, offers 24/7 customer support. Cybercriminals don’t operate on normal business hours, and you never know when a security breach will happen. For the added peace of mind of knowing you won’t have to wait for help if you need it, we think LifeLock offers greater user support.

Pricing and plans

Identity Guard offers three levels of plans: Value, Total, and Ultra. The Value plan offers standard monitoring and data breach notifications at either $8.99 a month, or $7.50 a month billed annually. The Total plan adds credit monitoring and costs $19.99 a month, or $16.67 a month billed annually.

The Ultra plan adds monitoring of your bank accounts and credit cards, and for criminal activity associated with your name. The Ultra plan costs $29.99 a month, or $25 a month when billed annually. All of Identity Guard’s plans, even the Value plan, offer $1 million of identity theft insurance—a bargain if lost fund reimbursement is most important to you.

LifeLock offers four levels of plans. The Standard plan includes only LifeLock’s monitoring services without Norton 360, and costs $9.99 a month for your first year (or $8.29 a month annually.) LifeLock Select adds Norton 360 for up to five devices at the same price as the Standard plan for the first year. Both plans offer $25,000 of stolen fund reimbursement.

LifeLock Advantage ups that to $100,000 and enables you to secure up to 10 devices with Norton 360 for $17.99 a month for your first year (or $14.99 a month annually). LifeLock Ultimate Plus adds three-bureau credit monitoring, Norton 360 on unlimited devices, and $1 million in stolen fund reimbursement for $25.99 a month for the first year, or $20.99 a month annually.

It’s important to note that all of LifeLock’s plans renew at a higher price after the first year, so if you’re looking for long-term coverage, make sure the second-year price is within your budget.

Verdict

If you’re only looking for basic identity theft monitoring and reimbursement insurance, Identity Guard’s Value Plan is a great option, providing far more in stolen fund reimbursement than the equivalent LifeLock plan.

However, we believe the extra security of Norton 360, plus the access to 24/7 customer support, makes LifeLock the superior choice for greater peace of mind when it comes to securing your identity online. If you want more details on either service, please read our LifeLock review and our Identity Guard review.

If you buy things online, post to social media, or even file your taxes over the internet, you could be vulnerable to identity theft. Even users who are careful to only share their data on secure, trusted websites could be victims of data breaches undertaken by cybercriminals eager to max out your credit cards, or make fraudulent purchases in your name.

That’s why having the best identity theft protection service is essential for anyone who shares information online. In this article, we’ll compare two options for identity theft protection: IDShield vs LifeLock. We’ll look at their features, performance, support, and cost to help you find the best identity theft protection.

Features

Both IDShield and LifeLock come with the basic features you will need to monitor your information online: social security number monitoring, dark web monitoring, and alerts if there are unusual changes to your credit reports or bank accounts. Both even offer lost wallet assistance, helping you change or cancel your credit cards in case of a stolen or misplaced wallet.

IDShield users can choose between one-bureau credit monitoring or the more comprehensive three-bureau credit monitoring, whereas most LifeLock plans only offer one-bureau monitoring. IDShield comes with a few bonus features that LifeLock is missing, like social media scanning and reputation management. If you’re job hunting and want to ensure you’re making the best digital first impression possible, this is a useful tool.

LifeLock is part of Norton AntiVirus, a familiar and trusted name in antivirus protection. That means that with most levels of LifeLock, you’ll also have access to the scanning, privacy, and anti-malware services of Norton 360. Since one way cybercriminals can access your private information is through malware attacks, the added protection of Norton 360 is a huge benefit of LifeLock.

Another crucial benefit of the best identity theft protection services are the features and assistance they provide if you are the victim of identity theft. One unique feature offered by IDShield is access to in-house licensed private investigators to assist you in restoring your identity.

IDShield also offers unlimited consultations with identity theft specialists who can answer all your questions. Plus, every IDShield plan comes with $1 million in protection to cover stolen funds, legal fees, and other expenses. Only the most expensive level of LifeLock, LifeLock Ultimate Plus, matches IDShield’s stolen fund reimbursement.

The lower levels of LifeLock only offer between $25,000 and $100,000 of stolen fund reimbursement—but LifeLock also offers up to $1 million of coverage for lawyers and experts at all levels.

Overall, the core components of IDShield and LifeLock are pretty comparable, with IDShield offering a few more extras that may or may not be relevant to you. To us, however, IDShield’s handful of extras don’t compare to the security advantages of bundling LifeLock with Norton 360.

Performance

LifeLock is easy to set up, requiring answers to a few simple questions, a valid ID, and a credit card.

Once purchased, LifeLock users can either log on to their account via LifeLock’s website, or download the LifeLock mobile app for iOS or Android. With the LifeLock mobile app, you’ll receive alerts of fraudulent activity on your mobile device, enabling you to take action right away to protect your accounts.

Like LifeLock, IDShield also offers users the ability to log in to their account either from the web or on the go with an iOS or Android app. When you log in, your most recent credit score is front and center, as well as any new alerts that you may need to review.

If space on your phone is at a premium, you might want to go with IDShield, as the app takes up on only 29MB of space on an iPhone versus LifeLock’s 82MB. However, both apps and web interfaces are intuitive and easy-to-use. When it comes to performance, both LifeLock and IDShield offer comparable experiences.

Support

You never know when an attack on your identity may occur, and a key component of identity theft protection is knowing someone will be available to assist you, day or night.

LifeLock offers 24/7 support to its members, with priority support offered to Ultimate Plus members. In the event of identity theft, LifeLock also offers its members access to identity restoration specialists. Additionally, the LifeLock app features an in-app calling service connecting you to LifeLock Member Services, meaning if you do encounter an issue, help is right at your fingertips.

IDShield also offers 24/7 access to customer service. Like LifeLock, IDShield has identity restoration services for its members. IDShield offers a few extras when it comes to support, like the in-house private investigators and unlimited consulting mentioned above.

IDShield also makes it easy to contact their user support directly through their app, with a prominently-placed, hard-to-miss green button. Overall, IDShield and LifeLock both offer comprehensive, easy-to-access support for their members.

Pricing and plans

IDShield offers an Individual plan and a Family plan. With both options, users have the ability to select either one-bureau or three-bureau credit monitoring—meaning there are four total levels of plans.

IDShield’s Individual plan will cost you $13.95 a month for one-bureau credit monitoring, or $17.95 a month for three-bureau. The Individual plan only covers one person. The Family plan, however, covers one individual, a spouse or domestic partner, and up to 10 dependent children.

The Family plan is $26.95 monthly for one-bureau credit monitoring, or $32.95 a month for three-bureau credit monitoring. IDShield also offers users a free 30-day trial, so you can see if you like the service before committing.

LifeLock’s plans and pricing are a bit more confusing, offering four levels of support depending on your needs. The most basic, the Standard plan, includes just LifeLock’s monitoring services without Norton 360. The Standard plan costs $9.99 a month for your first year, or $8.29 a month if you choose to bill annually.

LifeLock Select includes Norton 360 for up to five devices at the same price as the Standard plan (all of LifeLock’s prices increase after the first year.) Both of these plans offer up to $25,000 of stolen fund reimbursement.

LifeLock customers looking for more stolen fund reimbursement might also want to opt for the LifeLock Advantage Plan, which offers up to $100,000 and Norton 360 protection for up to 10 devices. The Advantage Plan is $17.99 a month for your first year, or $14.99 a month billed annually.

The most comprehensive LifeLock plan is LifeLock Ultimate Plus, offering three-bureau credit monitoring, up to $1 million in stolen fund reimbursement, and Norton 360 protection for unlimited devices. LifeLock Ultimate Plus is $25.99 a month for the first year, or $20.99 a month if billed annually.

When it comes to pricing and plans, it’s nice that LifeLock offers a discount to users who pay annually, and a discount for your first year. But the 30-day free trial of IDShield is hard to beat.

Verdict

Ultimately, we think the extras IDShield provides - like social media monitoring - simply don’t stack up to the added benefits of bundling LifeLock with Norton 360. The most basic LifeLock with Norton 360 package, LifeLock Select, is cheaper for an individual than IDShield for the first year, and not significantly more expensive after.

For us, LifeLock is the superior choice for greater peace of mind when protecting your identity online. If you want more details, please read our LifeLock review.

US lawmakers and TikTok are negotiating changes to the short-form video app's data security and governance strategies, the New York Times reported on Monday.

The changes could prove instrumental in deflecting a plausible sale among rising security concerns. A potential agreement between the ByteDance-owned app and the Biden administration is in the works, as matters stand.

The company can "fully satisfy all reasonable US national security concerns" a TikTok spokesperson revealed.

Over two years have passed since a US national security panel ordered ByteDance to divest TikTok for concerns over data abuse by China's communist government.

As of September 2022, TikTok could face a £27 million fine under UK data protection laws for failing to safeguard children's privacy on its platform.

The app also suffered a data breach earlier this month, which included 790GB of user information. The firm, however, refuted the allegations of a massive security breach.

TikTok’s security incident follows the discovery of a “high-severity vulnerability” in its Android app by Microsoft researchers.

Oracle is facing a class-action lawsuit over its alleged use of extensive data aggregation to match the sensitive information of hundreds of millions of customers without informed consent.

In addition to its role as a data management, cloud, and enterprise solutions firm, Oracle also acts as a data broker, and runs Oracle Data Marketplace - the largest third-party data marketplace in the world.

The complaint alleges that Oracle’s current notice of consent for data collection does not justify the use of the Oracle’s BlueKai Data Management Platform cookies and tracking pixels to collect and store sensitive data of individuals including address, life events such as marriage or childbirth, education, and purchase history.

This, it states, builds up an excessively-detailed picture of each of the many millions of customers within its database. The major grievance outlined in the complaint is with the aggregation of this data within Oracle’s 'ID graphing', which matches sensitive data drawn from disaggregated sources to existing data profiles on US citizens and individuals around the world, in order to inform targeted advertising.

Oracle chairman Larry Ellison is credited as having claimed that there were five billion people in Oracle’s ID graph by 2016.

Internal documentation published by Oracle credits its BlueKai cookies and ID graphing with the successful collection of data of more than 155 million US households. Other tools such as AddThis, a widget service that Oracle acquired in 2016, tracks user activity on over 15 million websites, enabling the identification of 1.9 billion unique users.

The complaint notes that the cookies and pixels bundled with AddThis are utilised without prior notice or user consent.

Much of the complaint focuses on this issue of consent. The plaintiffs allege that Oracle is guilty of an invasion of privacy under the California constitution, which lists “privacy” as an inalienable right of the citizens of California, and of violating the California Invasion of Privacy Act.

“Oracle knows, or reasonably should know, that Internet users such as Plaintiffs and Class members have insufficient knowledge or basis to reasonably comprehend the extent to which Oracle is obtaining their data, tracking their activity, and compiling it into digital dossiers, nor the deeply invasive and detailed nature of those dossiers,” the complaint reads.

Unlike the UK and EU GDPR, the US has no federal digital privacy legislation, so state privacy laws are one of the few avenues by which individuals can assert rights to privacy in court.

In 2020, a lawsuit filed in the the Netherlands accused Oracle of GDPR violations in its handling of personal data through third-party cookies. BlueKai was specifically named in this lawsuit, with one expert noting that "Everyone who has ever used the internet is at risk from this technology".

“It may be largely hidden but it is far from harmless," said Dr Rebecca Rumbul, class representative and a claimant on the suit in England.

At the time, Oracle dubbed the lawsuit a "meritless action based on deliberate misrepresentations of the facts". Earlier in 2022, the suit was dismissed, although the new complaint claims that in response to the UK/NL suit, Oracle did “cease certain of the practices complained of in that lawsuit only weeks after it was filed”.

Oracle declined to provide comment to IT Pro.

The Indian government forced Twitter to hire a government agent and grant them unsupervised access to data, according to a former employee of the social media platform.

Former senior Twitter executive Peiter “Mudge” Zatko alleged that the government forced the social media company to hire one or more individuals who were government agents and who then had access to huge amounts of Twitter’s user data, as reported by The Indian Express.

Zatko, who made the comments during a whistleblower disclosure with US regulators, alleged that Twitter knowingly permitted an Indian government agent direct unsupervised access to the company’s systems and user data.

“The company did not in fact disclose to users that it was believed by the executive team that the Indian government had succeeded in placing agents on the company payroll,” Zatko, former head of safety at Twitter, said in his complaint filed with the US Securities and Exchange Commission (SEC).

This comes as Twitter is currently engaged in a legal challenge with India's Ministry of Electronics and IT (MeitY) after it asked a court in July to overturn some government orders to remove content from the platform, alleging abuse of power by officials.

MeitY introduced Information Technology Rules in February 2021 which forced social media companies to hire employees who would liaison with law enforcement agencies to help them in investigations. The platforms also had to hire a compliance officer who would ensure the companies were following the rules, as well as a grievance officer to respond to any complaints.

It isn’t clear whether there’s a link between the whistleblower’s allegations of the government agent being hired and the new rules requiring the platforms to hire employees for the new roles. However, Zatko told The Washington Post that the evidence to support his allegations has been shared with US intelligence agencies.

Zatko added that in countries where Twitter had to have a physical presence and employees, the threat of harm to Twitter employees was enough to cause it to seriously consider complying with foreign government requests it would otherwise fundamentally oppose. He said that the government of India, along with Russia and Nigeria, aimed to force Twitter to hire local employees that could be used as leverage.

IT Pro has contacted Twitter for comment.

Zatko was fired from his role for ineffective leadership and poor performance, a Twitter spokesperson told The Indian Express.

“What we’ve seen so far is a false narrative about Twitter and our privacy and data security practices that is riddled with inconsistencies and inaccuracies and lacks important context,” said the spokesperson. “Mr. Zatko’s allegations and opportunistic timing appear designed to capture attention and inflict harm on Twitter, its customers and its shareholders. Security and privacy have long been company-wide priorities at Twitter and will continue to be.”

German email provider Tutanota has publicly called out Microsoft for allegedly blocking users using Tutanota email addresses from registering a Teams account.

The company had discovered that anyone who attempts to sign up for Microsoft Teams with a Tutanota email address is shown an error message reading “[email address] hasn’t been added to your organization’s directory. Contact your admin or try a different email.”

Tutanota has been in a back-and-forth with Microsoft for weeks over the issue, but was repeatedly told by Microsoft that it is “currently not feasible for the domain to become a public domain”.

Disputing this claim, Tutanota has taken the issue to the public and accused Microsoft of engaging in an anti-competitive practice.

With millions of users worldwide, the company maintains that its customers have a right to privacy that should not be compromised through a requirement to use a secondary email provider.

The problem, according to TechCrunch, appears to be linked to the fact that Teams recognises Tutanota addresses as corporate emails, hence the request for denied users to contact their administrator.

At the time of writing, IT Pro has been informed, that emails using the Tutanota domains tutanota.com and tutanota.de now work with Teams registration. This follows a Twitter exchange that the company believes improved the situation behind the scenes.

Three other domains, tuta.io, keemail.me and tutamail.com, remain blocked.

"To us it is very frustrating that such a step is needed to get an issue resolved by Microsoft. In our view it is negligence on Microsoft's part that does result in antitrust issues,” said a Tutanota spokesperson.

Unlike many email providers, Tutanota encrypts its entire mailbox and address book and allows users to send end-to-end encrypted emails to any email address via the use of a password. For these reasons along with a whole host of other privacy features, it is considered one of the most secure email services available.

“This severe anti-competitive practice forces our customers to register a second email address – possibly one from Microsoft themselves – to create a Teams account,” said Tutanota co-founder Matthias Pfau, in a blog post.

“When asked to change the current situation, a spokesperson for Microsoft simply said it would not be possible for them to allow people to register a Teams account with a Tutanota email address. Period. We repeatedly tried to solve the issue with Microsoft, but unfortunately our request was ignored.”

IT Pro has approached Microsoft for comment.

TikTok has announced new initiatives aimed at improving transparency around the company’s data use, measurement of trends and moderation systems.

In a blog post, chief operating officer Vanessa Pappas laid out a series of plans in detail to involve researchers, industry experts and academics to test and advise on TikTok’s platform.

Researchers will be given access to an application programming interface (API) through which they will be able to study public and anonymised data about content on the platform. This will be made available later this year.

The short-form video hosting service and editing app is extremely popular, with an active base of over one billion users. If research led by the data is made publicly available, insight into the trends and data analysis of TikTok’s vast dataset could prove highly valuable to the tech sector.

Businesses could benefit from knowledge of the factors that drive content to do well on the platform, as well as an understanding of how trends grow in popularity to release videos before or during them. Often, by the time businesses engage with a viral trend, much of the user interest in it has waned.

This month, Ofcom published a report stating that TikTok is the second most popular news source for teenagers with 28% using it to inform themselves, just one percent behind Instagram’s 29% of teens.

This marks it as a vital frontier in the battle against disinformation, and the moves announced today will allow greater oversight into this ongoing issue. In the same announcement, the company pledged to publish information on covert influence operations in all further quarterly Community Guidelines Enforcement Reports.

Select researchers will be given a similar API focused on TikTok's moderation system, to probe existing content moderation systems and the current state of content on the platform. The API will also have the functionality to let researchers upload their own content, to see what is permitted, rejected, or passed on to moderators.

In addition, select independent experts will be given access to TikTok’s list of filter keywords, which it uses to identify content as harmful and asked to offer advice based on this.

Those chosen will include members of TikTok’s US Content Advisory Council, which was set up in 2020 to give industry experts a say in the company’s safety strategies and content policies. The expert members of TikTok’s regional Safety Advisory Councils, namely Europe, the Middle East and North Africa, Asia Pacific, Brazil and Latin America will also be included.

“We've been listening to feedback from different communities of researchers, academics, and experts, and are today sharing new initiatives to strengthen transparency and accountability of our platform,” wrote Pappas in the post.

TikTok and its parent company ByteDance have faced harsh criticism in recent months, with FCC commissioner Brendan Carr last month urging Apple and Google to remove TikTok from their respective app stores. This was prompted by growing concerns over the security risk posed by the app's data harvesting.

IT Pro has approached TikTok for comment.

An order issued by a US judge on Friday mandates Google to pay over $971,000 in legal fees and costs as part of litigation misconduct in a lawsuit filed in the Northern District of California.

“The plaintiffs' lawyers at Boies Schiller Flexner and other firms had sought more than $1 million in fees and costs, after US Magistrate Judge Susan van Keulen in San Jose, California, a federal court in May found Google had failed to timely disclose some pieces of evidence,” reported Reuters.

Back in 2020, Google was hit with a $5 billion privacy lawsuit over allegations of tracking users' data while in private or incognito mode. The penalty resulted from Google's "failure to timely identify witnesses, additional documents and data sources relevant to this litigation," Judge Keulen stated in a previous order. Nevertheless, Google has denied the allegation.

Per billing reports submitted in the case, Boies Schiller Flexner founder David Boies’ hourly rate accounts for $1,950. Altogether, he sought compensation for 49 hours, or about $96,000.

Google's lawyers at Quinn Emanuel argued the plaintiffs had not offered a "justification for their decision to have David Boies get up to speed to argue the complex issues in the sanctions motion."

Andrew Schapiro, one of Google’s lawyers, said in a statement that the plaintiffs "were seeking extreme sanctions and, at the end of the day, they are getting a partial payment of their inflated bill for the time they devoted to bringing the motion."

As matters stand, a hearing is set for September for the Brown v Google case.

Amazon’s Ring doorbell unit has admitted to providing police forces with data without users' consent 11 times so far this year, according to a prominent US politician.

Democratic senator Edward Markey released the findings from his probe into Ring, which highlighted the close relationship between the company and law enforcement, according to a letter the senator received from the company.

The company said it provided the videos to law enforcement in response to emergency requests. It said that in each instance, Ring made a good-faith determination that there was an imminent danger of death or serious physical injury to a person requiring disclosure of information without delay.

"It’s simply untrue that Ring gives anyone unfettered access to customer data or video, as we have repeatedly made clear to our customers and others," a spokesperson for Amazon's Ring said in a statement. "The law authorises companies like Ring to provide information to government entities if the company believes that an emergency involving danger of death or serious physical injury to any person, such as a kidnapping or an attempted murder, requires disclosure without delay. Ring faithfully applies that legal standard."

The doorbell unit also revealed that its Neighbors Public Safety Service (NPSS), a platform that allows police and others to ask Ring owners for footage, currently has 2,161 law enforcement agencies and 455 fire departments enrolled. This represents a more than five-fold increase in law enforcement partnerships on the platform since November 2019.

“As my ongoing investigation into Amazon illustrates, it has become increasingly difficult for the public to move, assemble, and converse in public without being tracked and recorded,” said Markey. “We cannot accept this as inevitable in our country. Increasing law enforcement reliance on private surveillance creates a crisis of accountability, and I am particularly concerned that biometric surveillance could become central to the growing web of surveillance systems that Amazon and other powerful tech companies are responsible for.”

The senator has called on Congress to pass the Facial Recognition and Biometric Technology Moratorium Act to stop law enforcement from accessing sensitive information about citizens’ faces, voices, and bodies.

Ring also refused to commit to not incorporating voice recognition technology in its products. It stated that only police and fire departments are on NPSS, despite the company’s commitment to actively recruit public health departments, animal services, and agencies that primarily address homelessness, drug addiction, and mental health onto Ring’s platform.

The doorbell unit failed to clarify the distance from which Ring products can capture audio recordings and refused to commit to eliminate Ring doorbells’ default setting of automatically recording audio, stated the senator. The company also refused to commit to make end-to-end encryption the default storage option for consumers.

"It takes a lot of nerve for Amazon's Ring to promise a sense of safety to the face of its customers only to go around their backs giving away their private footage to the police without consent," said Nuno Guerreiro de Sousa, a technologist from Privacy International. "Allowing police to skip due processes such as warrants is not making anyone safer, one the very contrary, it opens extremely dangerous precedents."

In 2019, over 30 civil rights organisations wrote an open letter that called on government officials to investigate Amazon Ring’s business practices and end its numerous police partnerships. The letter added that Amazon is able to vacuum up enormous amounts of data which is then used to bolster Amazon’s corporate interests, often at the expense of local businesses and smaller competitors.

“Amazon’s latest encroachment with the Ring-police partnerships exemplify the company’s willingness to do what it takes to expand their data empire,” the organisations said. “Once they have this data, there is nothing stopping them from using it for their own profit-driven purposes.”

Google is merging its Chrome and Android password manager to make it more consistent, as part of a number of new updates that aim to make the feature generally easier to use and more secure.

The tech giant is rolling out a simplified and unified management experience that’s the same in Chrome and Android settings, after receiving feedback that managing passwords between the two has been confusing at times.

“We're always grateful for feedback, and many of you have shared that managing passwords between Chrome and Android has been confusing at times: "It's the same info in both places, so why does it look so different?” wrote Ali Sarraf, product manager in Chrome.

Google will also automatically group passwords if a user has multiple ones for the same sites or apps. They will also be able to create a shortcut on their Android home screen to make it easier to access their passwords.

The company is also giving users the ability to generate passwords for iOS apps when they set Chrome as their autofill provider.

Chrome can automatically check passwords when users enter them into a site, but now it’s hoping to provide them with extra confidence by checking them in bulk with Password Checkup.

It will now be able to flag not only compromised passwords, but also weak and re-used passwords on Android. Users will be able to use the automated password change feature on Android to fix any passwords that Google warns them about. Additionally, the company is expanding its compromised password warning to all Chrome users on Android, Chrome OS, iOS, Windows, MacOS and Linux.

Lastly, Google is also allowing users to add their passwords directly to its app, and is bringing this functionality to Google Password Manager on all platforms. The tech giant will also bring Touch-to-Login to Chrome on Android to speed up logging in by allowing users to securely log into sites directly from the overlay at the bottom of the screen.

Google hasn’t explicitly said when the updates will be rolled out, but said they will be introduced over the next few months.

Blockchain smart document specialist ShelterZoom has announced the launch of its new Document GPS solution in the Google Chrome Store.

The first Gmail document tokenization tool on the market, the offering has been designed to monitor and control email attachments so users can manage their entire journey – gaining visibility over who downloaded the file, who opened it, and who forwarded it.

Document GPS also allows senders to revoke a recipient’s ability to download or share the attachments at any time – even after the email has been sent.

“ShelterZoom was built on the premise of upgrading the safety and security of how people exchange information online by making it easy and effortless to integrate with blockchain,” explained ShelterZoom CEO and Co-Founder Chao Cheng-Shorland.

“What we have already created for documents and contracts we have now brought to email attachments so the full lifecycle of a document’s journey is secure. Document GPS also complements our virtual negotiating platform so users can carry out a complete workflow in the same secure ecosystem.”

With the growth of Web3, ShelterZoom says that digital security will take on an even more crucial role than it already does. To help tackle this, Document GPS provides email senders with a timestamped log in their interactive Attachment Library built into their email interface – allowing complete visibility into how each recipient has interacted with the file.

The company has built the solution on the same blockchain technology that powers their entire platform to give Gmail and Google Workspace users an extra layer of security integrated into the system.

ShelterZoom says it plans to release a similar tool for Microsoft Outlook users later this year. For now, current use cases include crypto banking professionals, small business owners, as well as personal Google users.

“With the click of a button, our clients and collaborators are now empowered with total control over important documents, giving us peace of mind of their origin, authenticity and access, greatly reducing risk of fraud, document loss or mishandling,” commented Michel Garibaldi of Arab Bank. “For the finance industry, this is a game-changer.”

Gregg Farrauto, Founder and CEO of US-based Farrauto Wealth Management said: “By using Document GPS for high-stakes attachments, I can rest easier knowing I can track the documents I send and my clients' private information is protected even if their email system gets hacked."

US taxpayers will no longer need to use facial recognition or any other form of biometric authenticationjavascript:void(0) to access their online Internal Revenue Service (IRS) accounts, the agency announced on Monday.

Instead, taxpayers will have the option of verifying their identity through a live, virtual interview conducted by a tax agent.

The new option comes on the heels of IRS backtracking on its decision to mandate facial recognition through external identity verification firm ID.me, which raised privacy concerns among taxpayers, lawmakers, and advocacy groups.

"The IRS takes taxpayer privacy and security seriously, and we understand the concerns that have been raised," said Chuck Rettig, IRS commissioner.

"Everyone should feel comfortable with how their personal information is secured, and we are quickly pursuing short-term options that do not involve facial recognition."

However, the IRS noted that taxpayers will still be able to verify their identity using the self-assistance tool provided by ID.me, if desired.

For security reasons, all images provided during biometric verification will be deleted following account creation. The IRS will also permanently delete any biometric data gathered from taxpayers with existing accounts in the next few weeks.

Furthermore, the IRS announced that while it plans to use the short-term virtual interview solution for the current filing season, it intends to implement Login.Gov as an authentication tool in the future

A partnership between General Services Administration (GSA) and the IRS is underway to meet the standards and scale required of Login.Gov, which is slated to launch after the 2022 filing deadline.

Three US senators have urged the Department of Labor to ditch facial recognition technology for unemployment benefits, raising concerns around privacy and bias in the technology.

Senate Finance Committee members Ron Wyden, Sherrod Brown, and Elizabeth Warren urged the department to ensure state unemployment insurance (UI) programmes are able to securely verify their applicants’ identities without sacrificing claimant privacy.

In a letter sent to Labor secretary Marty Walsh, the senators highlighted that in over half of US states, workers filing for UI must sign up for an account with ID.me. Most users have to submit facial recognition to verify their identity and access benefits. They explained that many states started using the service during the pandemic to combat fraud and identity theft, but said that this shouldn’t mean claimant privacy is compromised in the process.

The three senators underlined that facial recognition should not be a prerequisite for accessing UI or any other essential government services. They added that facial recognition technologies don’t only raise privacy and civil liberty concerns, but also are biased in ways that negatively impact vulnerable groups, including people of colour, women, and seniors. They also said that it was concerning that so many state and federal government agencies have outsourced their core technology infrastructure to the private sector.

“It is particularly concerning that one of the most prominent vendors in the space, ID.me, not only uses facial recognition and lacks transparency about its processes and results, but frequently has unacceptably long wait times for users to be screened by humans after being rejected by the company’s automated scanning system,” stated the senators.

Instead, the senators advised that the department should assist state unemployment insurance programmes gain access to federal alternatives like login.gov, run by the General Services Administration, which offers a federal identity verification option.

Login.gov is currently used by 200 websites run by 28 Federal agencies, with over 40 million US citizens having accounts on the service.

“This call to transition away from private facial recognition contractors will only add further fuel to the debate around the practices of ethical data collection and analysis," said Camilla Winlo, head of Data Privacy at Gemserv. "This shows that organisations that want to harness the possibilities of AI and data-driven innovation must do so in a way that protects individuals. Organisations should be entitled to trust that providers are engaging in ethical practices and that their services can be used lawfully.

“Whether it’s fighting crime, preventing fraud or other forms of safeguarding through data, when the public and private sector combine, they must ensure the right processes are put in place in order to comply with data protection regulation.”

A spokesperson from ID.me told IT Pro: "ID.me isn’t commenting outside of publicly available statements.”

This comes after the IRS announced earlier in February it would no longer employ ID.me, following concerns over user privacy. It had announced that from the summer of 2022, taxpayers would have to validate their accounts by providing a government-issued photo document as well as taking a video selfie.

However, it reversed the decision, with the IRS commissioner stating that it takes taxpayer privacy and security seriously, and it understood the concerns that had been raised.

The state of Texas has sued Facebook parent company Meta over its discontinued facial recognition system, claiming that it captured citizens' facial data without their informed consent.

In a suit filed Tuesday, state Attorney General Ken Paxton accused the company of "illegal and deceptive conduct" that it repeated billions of times by running recognition algorithms on pictures of them, their friends and family.

The lawsuit says that the practices violated a 2009 state law known as CUBI that required informed consent for the capture of biometric identifiers. It also requires anyone holding biometric data to destroy it in a reasonable time period.

It accuses Meta of collecting biometric data from unwitting users and failing to delete it in line with CUBI's requirements. It also criticizes the company for running facial recognition on other pictures that users uploaded.

"Texas who used Facebook's social media services were oblivious to the fact that Facebook - without their permission - was capturing biometric information from photos and videos that users had uploaded for the sole purpose of sharing with family and friends," the suit said.

The company also failed to notify users of its Instagram service that it was using their data, it adds.

The suit requests payments of up to $25,000 per infraction, and says that Meta broke the law "not hundreds, or thousands, or millions of times - but billions of times".

Facebook shut down its facial recognition system in November 2021, vowing to delete more than a billion individual facial recognition templates.

Paxton is no stranger to big tech investigations. He launched an investigation into Twitter's content moderation practices last year, which prompted a retaliatory suit from Twitter. He filed an amicus brief last September with nine other AGs in support of Florida's social media censorship law, after Texas passed a similar bill, and also filed an amicus brief supporting Epic Games in its lawsuit against Apple earlier this month.

"This is yet another example of big tech’s deceitful business practices and it must stop. I will continue to fight for Texans’ privacy and security," Paxton said, describing the Meta lawsuit this week.

Video conferencing and collaboration platform Zoom has released an update to its macOS client addressing a security issue whereby a Mac's microphone remained enabled even after a meeting had ended.

Zoom users running the latest version of macOS Monterey had been concerned about the apparent privacy issues since December 2021, according to posts made on the official Zoom community support forums, first reported by The Register.

The issue in question involved the orange dot in the Mac's Control Centre appearing, indicating that the device's microphone was being used in an application. That app was revealed to be Zoom, which was open in the taskbar but not actively in a meeting.

Numerous replies to the original post echoed concerns regarding where the audio data was being sent, and that it wasn't a single use case.

"The Zoom client for macOS 5.9.3, released on January 25, 2022, fixed a bug involving the failure to properly terminate the microphone use post-meeting," a Zoo spokesperson told IT Pro.

"Zoom has determined that this bug did not result in audio data being transmitted back to Zoom's platform," they added. "As always, we recommend users make sure their Zoom client is updated to the latest version."

The release notes accompanying version 5.9.3 made no explicit mention of the macOS bug, but earlier release notes for version 5.9.1 issued on 20 December 2021 indicated the big had been fixed, though no explanation was provided as to why the bug presented itself, or what was done with recordings.

Numerous users also reported the bug persisting even after updating to version 5.9.1 and complaints persisted well into January 2022, long after even the 5.9.3 patch was released.

At the time, users commenting on the community support thread voiced their concerns around privacy, re-iterating their experience with Zoom's privacy issues in years gone by. One user said: "This is [a] major privacy breach and I am considering dropping Zoom and asking my IT department to replace Zoom with a more secure option".

In 2019, Zoom was criticised for installing a local web server on Mac users' machines that allowed websites to automatically launch users into meetings and enable their webcams.

The incident prompted Apple to roll out a silent update removing the web server from all Mac machines which followed Zoom's own update achieving the same purpose. Apple said at the time that no user intervention was required to enable the update but IT Pro's testing, at the time, showed the issue persisted until the user rebooted their machine.

The company also settled a case with the Federal Trade Commission (FTC) in 2020 after the claims it made about the use of end-to-end encryption (E2EE) on its platform, which was used by governments and local authorities during the pandemic, turned out to be false.

LastPass has announced a new integration with Google Workspace in a bid to provide a seamless login process for business users.

Employers can now automatically provide employees with a LastPass account through Google’s directory integration, allowing them to store all their passwords for seamless logins without compromising on security.

The integration allows users to access LastPass using their corporate Google Workspace credentials without any additional passwords, minimising password reset frustrations and time spent on logging into accounts.

The Google active directory also allows for employers to easily add and remove users, simplifying management and ensuring the security of the organisation.

Dan DeMichele, VP of Product Management at LogMeIn, said: “Between this new integration with Google Workspace, and the combination of zero-knowledge infrastructure and multi-key approach, this security model that is unique to LastPass offers a level of security uncommon with such a simple login experience.”

According to DeMichele, “this ensures the keys used to unlock a user’s vault only reunite locally on the end-user’s device”.

“LastPass is the leading password manager on the market, providing this level of security authentication for federated login integrations with identity providers,” he added.

The integration with Google Workspace comes months after LogMeIn, LastPass’ parent company, announced that users on the service’s free tier would no longer have unlimited access to their stored passwords on both desktop and mobile devices. Since 16 March 2021, users are only able to view and manage passwords on either desktop or mobile, being forced to choose which platform they want to use to access their password vaults and being locked out of the other.

LastPass’s Premium and Family subscriptions start at £2.60 and £3.40 per month, respectively, and include additional features such as expanded multifactor authentication support, dark web monitoring and improved password sharing.

LastPass’s business offerings start with Teams, priced at £40.80 per user, per year, and intended for SMEs or workgroups with up to 50 users, although this is a recommendation rather than a hard limit. This provides each user with an industry-standard password storage vault with optional two-factor authentication, shared folders for your team, and a dashboard to administrate everything.

The next tier up, Enterprise, has no recommended ceiling on user numbers and adds Single Sign-On support, personal customer support, API and app integrations and customisable security policies.