In June 2022, The Markup tested the websites of Newsweek's top 100 U.S. hospitals. On 33 of them, reporters found a tracking tool called the Meta Pixel sending Facebook a packet of data whenever someone clicked a button to schedule a doctor's appointment. The data included doctor names, conditions or search terms, and an IP address. When combined with other data such as cookies or hashed identifiers in some browsers, an IP address can help link activity to a specific individual or household.

On some hospital booking pages, the pixel also sent contact details entered into the form, including name, email, phone number, city, and zip code.

The Markup also found the Meta Pixel installed inside the password-protected patient portals of seven health systems. On five of those, it documented the pixel sending Facebook data about real patient volunteers, including the names of their medications, descriptions of their allergic reactions, and details about their upcoming doctor's appointments.

After the reporting, many hospitals removed the tracker. As of Sept. 15, 2022, 28 of the 33 hospitals had removed the Meta Pixel from doctor booking pages or blocked it from sending patient information to Facebook, and at least six of the seven health systems had removed it from their portals.

If you're wondering what was sent, how it happened, and what you can do now, this guide explains the findings, the hospitals' responses, and how to disconnect future activity on Meta platforms.

#Watch: Hospitals told Facebook your appointment

This video walks through what The Markup found and how the Meta Pixel worked on hospital websites.

#What The Markup found

On June 16, 2022, The Markup published "Facebook Is Receiving Sensitive Medical Information from Hospital Websites," an investigation by Todd Feathers, Simon Fondrie-Teitler, Angie Waller, and Surya Mattu.

#The test

The Markup tested the websites of Newsweek's top 100 hospitals in America. On 33 of them, reporters found the Meta Pixel, a tracking tool, sending Facebook a packet of data whenever a person clicked a button to schedule a doctor's appointment.

The data was connected to an IP address, an identifier that's like a computer's mailing address. When combined with other data such as cookies or hashed identifiers in some browsers, an IP address can help link activity to a specific individual or household.

#What the pixel sent on booking pages

Here are specific examples from The Markup's June 2022 report:

University Hospitals Cleveland Medical Center: Clicking the "Schedule Online" button on a doctor's page prompted the Meta Pixel to send Facebook the text of the button, the doctor's name, and the search term used to find her: "pregnancy termination."

Froedtert Hospital, Wisconsin: Clicking the "Schedule Online Now" button for a doctor prompted the Meta Pixel to send Facebook the text of the button, the doctor's name, and the condition selected from a dropdown menu: "Alzheimer's."

Scripps Memorial Hospital: Clicking the "Finish Booking" button on a doctor's page caused the pixel to send Facebook not just the name of the doctor and her field of medicine but also the first name, last name, email address, phone number, zip code, and city of residence entered into the booking form. The Meta Pixel hashed those personal details before sending them to Facebook, but The Markup was able to reverse most of their hashed test information using a free online tool. Meta explicitly uses hashed information to link pixel data to Facebook profiles.

Brigham and Women's Faulkner Hospital: Clicking the "Request Appointment" button on a doctor's page caused the Meta Pixel to send Facebook the text of the button, the doctor's name, and the doctor's field of medicine.

#What the pixel sent from patient portals

The Markup also found the Meta Pixel installed inside the password-protected patient portals of seven health systems. On five of those systems' pages, reporters documented the pixel sending Facebook data about real patients who volunteered to participate in the Pixel Hunt project, a collaboration between The Markup and Mozilla Rally.

The data sent from portals included the names of patients' medications, descriptions of their allergic reactions, and details about their upcoming doctor's appointments.

Here are specific examples from The Markup's June 2022 report:

Piedmont Healthcare, Georgia: When a real patient logged in to the MyChart portal, the Meta Pixel installed in the portal told Facebook the patient's name, the name of their doctor, and the time of their upcoming appointment, according to data collected by the participant's Mozilla Rally browser extension.

Novant Health, North Carolina: When a Pixel Hunt participant (real patient volunteer) used the MyChart portal, the pixel told Facebook the type of allergic reaction the patient had to a specific medication. The Markup also created their own MyChart account through Novant Health to further investigate. In The Markup's own test account, clicking one button prompted the pixel to tell Facebook the name and dosage of a medication in the health record, as well as any notes entered about the prescription. The pixel also told Facebook which button The Markup's reporters clicked in response to a question about sexual orientation.

#The scale of the issue

The 33 hospitals The Markup found sending patient appointment details to Facebook collectively reported more than 26 million patient admissions and outpatient visits in 2020, according to the most recent data available from the American Hospital Association.

The Markup's investigation was limited to just over 100 hospitals. The data sharing likely affected many more patients and institutions than were identified.

#What hospitals did after the reporting

After The Markup's June 2022 investigation published, many hospitals removed the tracker.

According to The Markup's Sept. 19, 2022 follow-up article by Todd Feathers and Simon Fondrie-Teitler, "Meta Faces Mounting Questions From Congress on Health Data Privacy as Hospitals Remove Facebook Tracker":

• As of Sept. 15, 2022, 28 of the 33 hospitals had removed the Meta Pixel from their doctor booking pages or blocked it from sending patient information to Facebook.

• At least six of the seven health systems had also removed the pixels from their patient portals.

The Markup reached out to the institutions who removed the pixel from their websites after the investigation published in June. As of Sept. 19, 2022, three institutions had responded: Sanford Health, El Camino Health, and Henry Ford Health.

#Novant Health sent breach notifications

One health system, North Carolina-based Novant Health, mailed data breach notifications to 1.3 million customers following The Markup's report.

In the breach notification, Novant Health stated the pixel was added as part of a promotional campaign to encourage use of Novant's MyChart patient portal, but "the pixel was configured incorrectly and may have allowed certain private information to be transmitted to Meta."

On Sept. 16, 2022, Novant amended its data breach notification post to state that Meta informed the provider that it "generally" filtered out patients' sensitive medical information and that it did "not have information to return or destroy."

#Scripps removed the pixel after The Markup's inquiry

Scripps Memorial Hospital did not respond to The Markup's questions, but it did remove the Meta Pixel from the final webpages in the appointment booking process after The Markup shared its findings with the hospital.

#What Meta said

Meta, quoted by The Markup in June 2022, said its systems are designed to filter out potentially sensitive health data they detect.

The Markup could not confirm whether the data referenced in its story was in fact removed before being stored by Meta.

However, a joint investigation with Reveal found that Meta's sensitive health information filtering system didn't block information about appointments a reporter requested with crisis pregnancy centers.

#How the Meta Pixel works

The Meta Pixel (also called the Facebook Pixel) is a small piece of code that websites can add to their pages. When someone visits a page with the pixel, it sends information to Facebook about the visit.

Here's how it works:

1. A website adds the pixel. A hospital or business adds the Meta Pixel code to its website.

2. The pixel sends events. An event is a specific action, like viewing a page, clicking a button, or completing a form. The pixel sends these events to Facebook.

3. The pixel sends identifiers. Along with the event, the pixel sends information that can identify the user, such as an IP address or email address if available.

4. Facebook may link the event to a user account. When sufficient identifiers are available, such as cookies or other matching data, Facebook can use them to help link the event to a Facebook user account.

#Why IP addresses matter

An IP address is like a computer's mailing address. When combined with other data such as cookies or hashed identifiers in some browsers, an IP address can help link activity to a specific individual or household.

When a hospital website sent Facebook an IP address along with appointment details, Facebook could use it with other data to help connect that activity to a person's Facebook account, even if the person didn't provide their name or email on the hospital website.

#How to disconnect future activity on Facebook and Instagram

If you use Facebook or Instagram, Meta offers a setting to disconnect future activity that businesses send to Meta from your account.

Per the Meta Help Center, this setting can be found in Accounts Center under "Your information and permissions" and is called "Your activity off Meta technologies." The setting allows you to manage or disconnect future activity that businesses send via tools like the Meta pixel.

Sources:

• Meta Help Center, "Manage your future activity off Meta technologies": https://www.facebook.com/help/1224342157705160
• Meta Help Center, "Review your activity off Meta technologies": https://www.facebook.com/help/2207256696182627

#What this does and doesn't do

Per the Meta Help Center, this setting manages how your account is connected to activity that businesses report via Meta business tools.

What the setting affects: Disconnecting your activity off Meta technologies affects the association between your account and activity that businesses send via tools like the Meta pixel. This applies to both past and future activity sent by businesses.

What it does not do: Disconnecting the association between your account and off-Meta activity does not delete the underlying data that businesses have already sent to Meta. It does not control what businesses collect on their own websites or what they send to Meta.

#What this means for hospital websites in 2026

The Markup's investigation was published in 2022. This article describes historical findings.

As of November 2026, we cannot verify which hospitals currently use the Meta Pixel, whether any still send patient information to Facebook, or whether Meta's filtering systems have changed.

If you're scheduling an appointment on a hospital website or logging into a patient portal, consider:

1. Check the hospital's privacy policy. Look for sections on "third-party analytics," "advertising partners," or "tracking technologies."

2. Use browser extensions that block trackers. Extensions like Privacy Badger, uBlock Origin, or Ghostery can block tracking pixels from loading. Use them on hospital websites and patient portals.

3. Disconnect activity off Meta technologies. Use the setting in Accounts Center (described above) to manage the association between your account and activity that businesses send via the Meta pixel.

4. Ask your hospital. If you're concerned about what your hospital shares, contact its privacy office and ask whether it uses tracking pixels on its website or patient portal, and what data those pixels send to third parties.

#The difference between this and BetterHelp

This hospital case is distinct from the BetterHelp case. BetterHelp is an online therapy platform that, per the FTC's 2023 complaint, shared health data with advertising platforms. Read more about the BetterHelp case.

The hospital case involves hospital websites and patient portals, as documented by The Markup in 2022. These are separate incidents involving different entities, time periods, and types of services.

#The bigger picture: health data and tracking

The hospital case is part of a larger pattern of health data sharing. Health apps, symptom trackers, period apps, and now hospital websites have all been found sharing data with Facebook, Google, or other platforms.

If you're working on limiting health data sharing and removing your personal information from data brokers, hospital website tracking is part of the same issue. Our main guide, how to remove your personal information from the internet, covers the full process.

For more on health app tracking, see:

• Is My Period App Sharing My Data?
• Did BetterHelp Share Your Data With Facebook?

#Steps you can take today

1. Disconnect activity off Meta technologies. Use the setting in Accounts Center (described above) to manage the association between your account and activity that businesses send via the Meta pixel.

2. Use tracker-blocking extensions. Install Privacy Badger, uBlock Origin, or Ghostery. Use them when visiting hospital websites and patient portals.

3. Check your hospital's privacy policy. Look for what tracking technologies the hospital uses and what data it shares with third parties.

4. Use a separate email for sensitive sign-ups. If you're registering for a patient portal, use an email address that is not associated with your social media accounts to limit custom audience matching.

5. Clear cookies regularly. Or use a browser with built-in tracking protection like Firefox or Brave.

These steps take about 20 minutes the first time and a few minutes for each check-in. The goal is to reduce how much health data is shared with advertising platforms and data brokers.

UndoLeak erases your data from data brokers and keeps it off.

Run a free privacy check

#Sources

1. Todd Feathers, Simon Fondrie-Teitler, Angie Waller, and Surya Mattu, The Markup, "Facebook Is Receiving Sensitive Medical Information from Hospital Websites" (June 16, 2022): https://themarkup.org/pixel-hunt/2022/06/16/facebook-is-receiving-sensitive-medical-information-from-hospital-websites

2. Todd Feathers and Simon Fondrie-Teitler, The Markup, "Meta Faces Mounting Questions From Congress on Health Data Privacy as Hospitals Remove Facebook Tracker" (Sept. 19, 2022): https://themarkup.org/pixel-hunt/2022/09/19/meta-faces-mounting-questions-from-congress-on-health-data-privacy-as-hospitals-remove-facebook-tracker

3. Sara Morrison, Vox/Recode, "Meta is getting data about you from some surprising places" (June 17, 2022): https://www.vox.com/recode/23172691/meta-tracking-privacy-hospitals

4. Meta Help Center, "Manage your future activity off Meta technologies" (2026): https://www.facebook.com/help/1224342157705160

5. Meta Help Center, "Review your activity off Meta technologies" (2026): https://www.facebook.com/help/2207256696182627

6. Meta Help Center, "Account settings you will be able to manage in Accounts Center" (2026): https://www.meta.com/help/accounts-center/841741830388205/

Not affiliated with Meta, Facebook, or any hospital or health system mentioned.

If you use ChatGPT on a personal Free, Plus, or Pro account, what you type may be used to train OpenAI's models unless you change a setting that's on by default.

That includes work notes, medical questions, and source code people paste without thinking twice.

Here's what data is used for training, what's protected, and how to turn it off.

#What ChatGPT uses for training

On personal ChatGPT Free, Plus, and Pro workspaces, data sharing is enabled by default (OpenAI Help Center, 2026).

That means your conversations may be reviewed by OpenAI's AI trainers and used to improve the models, according to OpenAI's Help Center article "Data controls in ChatGPT" (2026).

#What may be used

When data sharing is on, OpenAI may use:

• Your prompts (what you type into ChatGPT)
• ChatGPT's responses
• Files you upload or create in conversations
• Feedback you provide (thumbs up or down)

The data may be reviewed by human AI trainers or used in automated training processes.

#What's not used for training by default

Business, Enterprise, Edu, Healthcare and API workspaces are not used for training by default (OpenAI Help Center, 2026).

Temporary Chat conversations are not used to improve models while they remain temporary. If you save a Temporary Chat, it becomes a regular chat subject to your account settings. Temporary chats are normally deleted within 30 days, subject to safety and legal retention exceptions (OpenAI Help Center, 2026).

#The Samsung incident: what happened in 2023

In May 2023, Samsung banned ChatGPT and other generative AI tools on company devices after employees uploaded sensitive internal source code to ChatGPT (The Verge, May 2, 2023, citing Bloomberg).

According to Fortune (May 2, 2023), a Samsung engineer uploaded confidential source code while using ChatGPT to help check the code.

Samsung's concern was that the material was now on outside servers and would be difficult to delete (The Verge, May 2, 2023).

The incident does not mean Samsung's code later appeared in someone else's ChatGPT answers. The risk was that the data had left Samsung's control and was stored on OpenAI's servers.

#What "may be used for training" means

When OpenAI says conversations may be used to train models, that does not guarantee every chat is reviewed or trained on.

It means OpenAI reserves the right to use the data. Some conversations may be sampled for training, while others may not be used at all.

According to OpenAI's Privacy Policy (Feb 6, 2026), personal information collected may be used to develop and improve services, which can include training AI models.

#How to turn off data sharing in ChatGPT

To prevent your new conversations from being used to train OpenAI's models:

1. Open ChatGPT (web, desktop, or mobile).
2. Click or tap your account menu (profile icon).
3. Go to Settings.
4. Open Data controls.
5. Find "Improve the model for everyone" and turn it off.
6. Click or tap Done.

#What happens to old conversations

Turning off data sharing does not delete saved chats (OpenAI Help Center, 2026).

The opt-out applies to new conversations. Content already used to improve models may have been de-identified and disassociated from your account.

#Thumbs up and down still send data on personal plans

On personal Free, Plus, and Pro accounts, giving a thumbs-up or thumbs-down on a ChatGPT response can still send that whole conversation into the training pipeline, even with data sharing turned off (OpenAI Help Center, 2026).

Feedback handling may differ on managed Business, Enterprise, and Edu workspaces.

If you don't want a conversation reviewed, avoid using the thumbs-up/down feedback buttons on personal accounts.

#What to do if you've already shared sensitive information

If you've pasted work documents, source code, or personal details into ChatGPT while data sharing was on, here's what you can do:

#1. Turn off data sharing now

Follow the steps above to prevent new conversations from being used for training.

#2. Delete old conversations

Go to your ChatGPT history and delete conversations that contain sensitive information. Deleting a chat removes it from your account, but OpenAI states that content already used to train models may have been de-identified.

#3. Use Temporary Chat for sensitive topics going forward

Temporary Chat conversations are not used to improve models while they remain temporary. If you save a Temporary Chat, it becomes a regular chat subject to your account settings.

Temporary chats are normally deleted within 30 days, subject to safety and legal retention exceptions.

Look for a Temporary Chat option in your ChatGPT interface to start a chat that won't be used for training.

#4. Consider a Business or Enterprise workspace for work projects

If you use ChatGPT for work, ask your employer about a Business or Enterprise plan. Those workspaces are not used for training by default.

#Why this matters for privacy

When you paste text into ChatGPT, you may include details that reveal more than you realize:

• File paths and folder names that show your company or project structure
• Variable names that reference internal systems
• Comments in code that mention coworkers, clients, or deadlines
• Error logs that include server names or IP addresses
• Medical or legal questions that describe a specific situation

#Understanding the scope of data controls

The "Improve the model for everyone" setting covers ordinary personal text chats in ChatGPT on personal Free, Plus, and Pro accounts.

However, OpenAI's data controls may not cover every training channel. According to OpenAI's Help Center, there may be separate controls for voice conversations and other specialized environments. Some session types, such as Trusted Access or Daybreak sessions, may have different policies.

Turning off data sharing does not guarantee that no aspect of your ChatGPT use will ever contribute to model improvement. It controls the primary training channel for standard text conversations.

#Protecting your data beyond ChatGPT

AI training policies are just one part of online privacy. Your personal information is already listed on data brokers and people-search sites that anyone can access.

Those sites collect your name, address, phone number, and relatives from public records, marketing lists, and old breaches, then sell access to that data.

Even if you opt out, many data brokers re-list you after a few months, so you have to check and remove your listings over and over.

UndoLeak erases your data from data brokers and keeps it off.

If you want to see what personal information about you is already listed online, run a free scan.

#Summary

On personal ChatGPT Free, Plus, and Pro accounts, data sharing is enabled by default. Your conversations may be used to train OpenAI's models unless you turn that setting off.

Business, Enterprise, Edu, Healthcare and API workspaces are not used for training by default. Temporary Chat is not used for training while it remains temporary.

To opt out:

1. Go to ChatGPT → account menu → Settings → Data controls.
2. Turn off "Improve the model for everyone".
3. Click Done.

Turning off data sharing does not delete saved chats. Content already used for training may have been de-identified and disassociated from your account.

Avoid using thumbs-up or thumbs-down feedback if you don't want a conversation reviewed. Use Temporary Chat for sensitive topics, or consider a Business or Enterprise workspace for work projects.

#Sources

1. OpenAI Help Center, "Data controls in ChatGPT" (2026)
2. OpenAI Help Center, "How your data is used to improve model performance" (2026)
3. OpenAI, "Privacy Policy" (Feb 6, 2026)
4. Jon Porter, The Verge, "Samsung tells employees not to use AI tools like ChatGPT, citing security concerns" (May 2, 2023)
5. Nicholas Gordon, Fortune, "Samsung threatens to fire employees that leak data to ChatGPT" (May 2, 2023, updated May 4, 2023)

On November 4, 2026, NTT Docomo detected unauthorized access to the Docomo Online Shop and My docomo systems. According to press conference reporting by CNET Japan, Cybersecurity-jp, and Impress Watch on November 6, 2026, customer information for up to 294,839 phone lines was accessed, including ID document numbers for all affected customers. Docomo's official third notice on November 6 stated the number as "up to approximately 300,000."

Both systems have been under emergency maintenance since around 1:05 AM Japan time on November 5 (7:05 PM Istanbul time November 4), with no restart date announced.

Here's what was leaked, who was affected, and what you should do if you have or had a Docomo phone line.

#What data was exposed

According to NTT Docomo's November 6, 2026 notice, the breach exposed different levels of information depending on the customer:

#Information exposed for all affected customers

#Additional information exposed for some customers

According to Docomo, some affected customers also had the following data exposed:

• Legal representatives' or procedural representatives' names and contact information
• Employer or company name and address
• Bank name, branch, account number, and account holder name (for customers paying by account transfer)
• Child-rearing support program information

#What was not leaked

NTT Docomo confirmed that:

• Credit card numbers were masked and not leaked
• My Number (Japan's national ID number) was not stored in the system

According to CNET Japan, Docomo confirmed that card numbers and My Number information were not included in the breach.

#Who was affected

According to November 6 press conference reporting by CNET Japan, the breach affected up to 294,839 phone lines:

• 204,157 individual contracts
• 90,682 business contracts

Docomo's official third notice on November 6 stated "up to approximately 300,000." The more precise figure comes from press conference reporting.

#Important distinctions

Phone lines vs. people: The 294,839 figure represents phone lines (contract accounts), not necessarily the number of unique people. One person can have multiple phone lines, so the actual number of affected individuals may be lower.

Cancelled customers included: According to CNET Japan and Cybersecurity-jp, customers who already cancelled their Docomo service are included in the breach.

#How the breach happened

According to November 6 press conference reporting by Cybersecurity-jp and Impress Watch:

1. The attacker used d account as the entry point
2. They abused the way multiple linked systems work to search and collect data automatically
3. Two-factor authentication and passkeys worked normally but did not prevent the breach because the attack exploited how systems communicated with each other
4. According to Cybersecurity-jp, the leaked data was reportedly not encrypted

Docomo's official third notice stated the cause as external unauthorized access. Docomo did not disclose which specific ID document type was exposed or who the attacker is.

#Timeline of the breach

As of November 6, both the Docomo Online Shop and My docomo remain under emergency maintenance with no announced restart date.

#Docomo's response

According to CNET Japan and Docomo's official notices, the company is:

• Sending SMS notifications to affected individuals starting November 6
• Considering a goodwill payment to affected customers (details and amount not yet announced)
• Operating a hotline at 0120-451-360 (9:00-20:00 Japan time, or 3:00 AM-2:00 PM Istanbul time)

Cybersecurity-jp reported that, within the sources it checked, it found no announcement confirming misuse.

#What to do if you're affected

If you have or had a Docomo phone line, follow these steps:

#1. Watch for phishing attempts

Scammers could exploit this information to send fake messages claiming to be from Docomo. The leaked ID document numbers could make their messages sound more legitimate.

Never click links or open attachments in messages that mention the breach, even if they look real.

Never enter passwords, PINs, or credit card details in response to any email, text, or call, even if the sender mentions your ID document number or other personal details.

#2. Check official sources directly

Don't trust links in messages. Go to docomo.ne.jp yourself by typing the address into your browser or using a bookmark.

Check Docomo's official notices for updates on the breach and what the company is doing.

#3. Monitor your bank account

If you pay your Docomo bill by bank account transfer, watch your account for any unusual activity. Your bank name, branch, account number, and account holder name may have been exposed.

Report any unfamiliar charges to your bank immediately.

#4. Wait for official communication from Docomo

Docomo is sending SMS notifications to affected customers. If you receive an SMS from Docomo about the breach:

• Do not click any links in the SMS
• Go to docomo.ne.jp directly
• Call the official hotline at 0120-451-360 (09:00–20:00 Japan / 03:00–14:00 Istanbul) if you need to confirm

#5. Be alert for targeted scams

With your name, birth date, address, phone number, and ID document number exposed, scammers can create very convincing targeted messages.

Common post-breach scams include:

• Fake "identity protection" or "credit monitoring" offers
• Messages claiming to help you check if you were affected
• Calls from fake Docomo representatives asking you to "verify" information
• Texts with urgent warnings about your account

When in doubt, hang up and call Docomo's official hotline directly.

#Why ID document numbers matter

Your ID document number combined with your name, birth date, and address creates a detailed identity profile. Docomo did not disclose which type of ID document was involved.

This information could increase the risk of:

• Identity fraud and impersonation
• Social engineering attacks that sound more convincing
• Targeted scams using your verified personal details

Cybersecurity-jp reported that, within the sources it checked, it found no announcement confirming misuse. Stay vigilant in the coming months.

#How data breaches fuel data brokers

When your personal information leaks in a breach like this, it can end up circulating for years. Data brokers collect information from breaches, public records, and other sources, then build detailed profiles that anyone can buy.

Your name, address, phone number, and birth date from this breach could appear on people-search sites long after the immediate crisis passes. These sites make it easy for scammers, stalkers, and identity thieves to find you.

If your email was in a data breach, you know the pattern: one leak leads to more spam, more phishing, and more risk over time.

UndoLeak erases your data from data brokers and keeps it off.

See where you're listed with a free scan.

#Sources

All facts in this article come from the following sources:

• NTT Docomo, "【お詫び】ドコモオンラインショップ、My docomoの緊急メンテナンス実施について/当社サーバーへの不正アクセスによるお客さま情報流出に関するお知らせ（第三報：11月6日 午後6時00分時点）" (Nov 6, 2026)
• CNET Japan, "ドコモ、不正アクセス被害者へお見舞金　流出は29万回線、本人確認書類の番号も（更新）" (Nov 6, 2026)
• Cybersecurity-jp, "NTTドコモがオンラインショップ等への不正アクセスで最大29万4,839件の情報流出を公表" (Nov 6, 2026)
• Impress Watch, "ドコモ不正アクセス、「料金プラン」などの情報も流出 「重く受け止めている」" (Nov 6, 2026)

Not affiliated with NTT Docomo or any company mentioned.

You clicked "Allow" on an email app or productivity tool to let it manage your inbox, unsubscribe from newsletters, or track packages. That permission can give the app full access to read every email you've ever received.

In 2018, The Wall Street Journal reported that hundreds of outside developers were scanning the inboxes of millions of users. In some cases, employees at those companies read actual emails. The permission model remains the same: when you grant access, apps can read your inbox.

If you've connected email apps over the years and haven't checked those permissions recently, this guide explains what was found in 2018, what happened after, and how to revoke access to apps you no longer use.

#Watch: Apps let strangers read your inbox

This video explains how app permissions work and what you can do about it.

#What The Wall Street Journal found in 2018

On July 2, 2018, The Wall Street Journal published an investigation titled "Tech's 'Dirty Secret': The App Developers Sifting Through Your Gmail."

The investigation, reported by Douglas MacMillan, found that hundreds of outside developers had the ability to scan the inboxes of millions of users who had granted them access. The WSJ reporting was corroborated by The Verge, MacRumors, and Engadget in July 2018.

#Return Path employees read about 8,000 emails

Per the WSJ reporting, Return Path, a company that provided email optimization services, had employees read about 8,000 unredacted personal emails to help train the company's software.

Return Path told the WSJ that its engineers reviewed emails to train algorithms and that its user agreement disclosed the practice. The company said it had the consent of the people whose emails were reviewed.

#Edison Software engineers read hundreds of emails to build smart replies

The Wall Street Journal also reported that engineers at Edison Software, maker of the Edison Mail app, had read emails from hundreds of users to help build a smart reply feature.

According to The Verge's July 2, 2018 reporting, Edison Software responded: "We have since stopped this practice and expunged all such data."

Edison Software told the WSJ that its privacy policy disclosed the practice and that the reading was done to improve products.

#The WSJ found no evidence of misuse

The Wall Street Journal stated in its 2018 investigation that it found no evidence the data was misused. The investigation focused on the extent of access and the fact that human employees at some companies read actual emails, not on unauthorized use of the data.

#What The New York Times found in 2017 about Unroll.me

On April 24, 2017, The New York Times reported that Unroll.me, a free service that helps users unsubscribe from email lists, scanned users' inboxes for e-receipts.

Unroll.me's parent company, Slice Intelligence, used anonymized purchase data derived from those receipts. Per the Times reporting, Uber purchased market research from Slice to monitor the use of competitor Lyft by reviewing receipts for Lyft rides.

Users reacted with surprise. Many said they thought Unroll.me's promise to "never touch your personal stuff" meant it would not use their email data commercially.

#FTC action in 2019

The Federal Trade Commission's Decision and Order with Unroll.me was issued December 16, 2019. The Federal Register published notice on August 20, 2019.

The FTC order prohibits misrepresentations about how consumer email data is disclosed or used. It requires Unroll.me to send notice to specified existing consumers within ten days. The order also required deletion of specified older receipt data unless express consent permits storage.

#What the sources document

On July 3, 2018, a blog post by Suzanne Frey, Google's Director of Security, Trust and Privacy, stated that Google vets apps and that "no one at Google reads your Gmail, except in very specific cases where you ask us to and give consent, or where we need to for security purposes, such as investigating a bug or abuse."

These sources document historical practices, not their status in 2026. Edison said in 2018 that it stopped the practice and deleted the data.

#How app permissions work

When you sign in to a third-party app using your email account, you see a permission screen that lists what the app wants to access.

For email apps, the permission screen may ask for:

• Read all your email messages and settings - The app can read every email in your inbox, including sent mail and archived messages.
• Send email on your behalf - The app can send emails from your account.
• Delete emails from your inbox - The app can permanently delete messages.

Once you click Allow, the app receives an OAuth access token. Tokens can expire, but many apps request renewable authorization that remains valid until you revoke it or the app deletes it. The app can perform the granted actions as long as the authorization is valid and the token hasn't expired.

#What apps can see

An app with read access to your inbox can see:

• Every email you've received, including old messages
• Your sent mail
• Email addresses of your contacts and correspondents
• Attachments in your emails
• Email metadata like timestamps and subject lines

The app does not need to ask for permission each time it reads an email. While granted and tokens remain valid, the access is ongoing until you revoke the authorization.

#How to see what apps have access to your account

Internet platforms provide tools to review and remove third-party apps connected to your account.

The exact steps vary by platform, but the general process is:

1. Go to your account security settings
2. Look for a section about third-party apps, connections, or access
3. Review the list of apps that have access
4. Select an app to see what permissions it has
5. Remove access to apps you don't use or don't recognize

For Google accounts, current steps from Google Account Help:

1. Go to Google Account linked apps at https://myaccount.google.com/linkedapps
2. Under "Access to your Google Account," select an app
3. Select "See details" to review permissions
4. Select "Remove access"
5. Select "Confirm"

A product filter can distinguish Gmail read access from generic account access. Check each app's specific granted scopes to confirm Gmail permissions.

#What to look for when reviewing app access

When you review connected apps, pay attention to:

#Apps you don't recognize

If you see an app you don't remember authorizing, remove access immediately. It could be:

• An app you tried once and forgot about
• An app that rebranded and now has a different name
• An unauthorized app if someone else accessed your account

After removing access, check your account activity for suspicious behavior. If you see unauthorized activity, change your password and enable two-factor authentication.

#Apps you no longer use

If you see an app you used in the past but haven't opened in months or years, remove access. If its authorization remains valid and includes Gmail read access, an unused app may still access your email.

Examples of apps people often forget about:

• Email clients you tried but didn't keep
• Productivity tools you used for a project that's finished
• Receipt trackers or expense tools you no longer need
• Calendar integrations for services you've stopped using

#Apps with broad permissions

Some apps ask for full inbox access when they only need limited access. For example:

• A calendar app might ask to read all email when it only needs to see calendar invitations
• A receipt tracker might ask for full inbox access when it only needs to see receipts

If an app has broader permissions than it needs for the service it provides, consider whether you still want to use it.

#What removing access does and doesn't do

When you remove an app's access:

What it does:

• Revokes the app's authorization to access your account
• Invalidates the app's current access token
• The app can no longer read new emails or send emails on your behalf (subject to granted scopes)

What it doesn't do:

• It does not delete data the app already collected before you removed access
• It does not delete your account with that app
• It does not prevent you from granting access again in the future

If you want the app to delete data it collected, you need to contact the app or use the app's data deletion tools separately from revoking access.

#The realistic approach to third-party email apps

Email apps and productivity tools can be genuinely useful. Many people rely on third-party email clients, receipt trackers, calendar integrations, and unsubscribe tools to manage their inboxes.

The question is not whether to ever grant access. The question is which apps to trust and how often to review those permissions.

Here's a practical routine:

#When you're about to grant access to a new app

1. Check what permissions the app is asking for. Does it need full inbox access, or could it work with more limited permissions?

2. Read the app's privacy policy. Does it say whether the app shares email data with third parties? Does it use email data to train AI or build features?

3. Search for recent news about the app. Has the app been involved in privacy controversies? Has it changed ownership recently?

4. Consider alternatives. Are there apps that provide the same service with fewer permissions or better privacy practices?

#Every six months

1. Review your connected apps. Go to your account security settings and check which apps have access.

2. Remove apps you no longer use. If you haven't opened an app in the past few months, you probably don't need to keep its access active.

3. Check for apps you don't recognize. If you see an app you don't remember, remove it and check your account activity for suspicious behavior.

#When an app changes ownership or policy

Apps sometimes get acquired, and the new owner may have different privacy practices. When you hear that an app you use has changed hands or updated its privacy policy, recheck what access it has and decide whether you still want to use it.

#What this means for data brokers and privacy

Email scanning is one piece of a larger data collection ecosystem. Apps that read your inbox can extract:

• Purchase history from order confirmations and receipts
• Travel patterns from flight confirmations and hotel bookings
• Financial information from bank statements and payment confirmations
• Health information from appointment reminders and prescription notices
• Social connections from the people you email

Some apps may use inbox data for purposes disclosed in their privacy policies, which can include advertising, analytics, or commercial purposes. Apps vary in how they handle this data, so review each app's privacy policy to understand its practices.

If you're working to remove your personal information from data brokers and people-search sites, limiting what email apps can access is part of the same effort. Our main guide, how to remove your personal information from the internet, covers the full process. Email tracking is another privacy concern you can address: see can senders see if you opened their email for how email tracking pixels work.

Revoking access to old email apps won't delete data those apps already collected and shared. But it stops them from continuing to scan your inbox and extract new data.

#The bottom line

The 2018 Wall Street Journal investigation and the 2017 New York Times reporting on Unroll.me revealed that third-party apps with inbox access were using email data in ways many users didn't expect. Employees at some companies read actual emails.

These sources document historical practices, not their status in 2026. The permission model remains: when you grant an app access to your Gmail, the app can read your emails according to the granted scopes, as long as the authorization is valid.

The practical step is to review your connected apps and remove access to apps you don't use or don't recognize. It takes a few minutes and limits how many companies have continuous access to your inbox.

UndoLeak erases your data from data brokers and keeps it off.

Run a free privacy check

#Sources

1. The Wall Street Journal, Douglas MacMillan, "Tech's 'Dirty Secret': The App Developers Sifting Through Your Gmail" (July 2, 2018): https://www.wsj.com/articles/techs-dirty-secret-the-app-developers-sifting-through-your-gmail-1530544442 (paywalled)

2. The Verge, "Gmail app developers have been reading your emails" (July 2, 2018): https://www.theverge.com/2018/7/2/17527972/gmail-app-developers-full-email-access

3. MacRumors, "Some Third-Party Email Apps Let Employees Read User Emails" (July 2, 2018): https://www.macrumors.com/2018/07/02/third-party-email-apps-reading-user-emails/

4. Engadget, "Third-party app developers could be reading your Gmail" (July 3, 2018): https://www.engadget.com/2018-07-03-third-party-app-developers-reading-gmail.html

5. The New York Times, Mike Isaac (April 24, 2017): https://www.nytimes.com/2017/04/24/technology/personal-data-firm-slice-unroll-me-backlash-uber.html (Unroll.me/Slice/Uber investigation; paywalled)

6. The Verge, "Unroll.me settles with FTC after falsely claiming it didn't collect and sell email data" (December 17, 2019): https://www.theverge.com/2019/12/17/21027159/unroll-me-email-privacy-ftc-settlement

7. Federal Trade Commission, "In the Matter of Unroll.me Inc." Decision and Order (December 16, 2019): https://search.ftc.gov/system/files/documents/cases/c-4692_172_3139_-_unrollme_order.pdf

8. Google, "Ensuring your security and privacy within Gmail" (July 3, 2018): https://blog.google/innovation-and-ai/technology/safety-security/ensuring-your-security-and-privacy-within-gmail/

9. Google Account Help, "Manage links between your Google Account & apps from other developers" (2026): https://support.google.com/accounts/answer/13533235?hl=en

Not affiliated with any company mentioned. These sources document practices from 2017-2018, not their status in 2026.

A vulnerability in Windows Paint could allow attackers to execute code on your PC, but Windows Update won't deliver the fix. Here's why and how to patch it.

#What is CVE-2026-83844?

CVE-2026-83844 is an out-of-bounds-read vulnerability in Microsoft Windows Paint that could allow remote code execution. Microsoft published the advisory on October 13, 2026, rating it Important with a CVSS 3.1 base score of 8.1.

#Attack vector and complexity

According to Microsoft's Security Update Guide:

• Attack vector: Network
• Attack complexity: High
• Privileges required: None

Microsoft notes that "a successful attack needs a deep understanding of the target," according to The Hacker News reporting on November 6, 2026.

#Exploitation status

As of November 6, 2026:

• Not known to be exploited at the time Microsoft published the advisory on October 13, 2026
• Not publicly disclosed when the advisory was published
• Not in CISA KEV (Known Exploited Vulnerabilities) when The Hacker News checked on November 6, 2026
• No active abuse reported by NCSC.nl as of November 6, 2026

#Why Windows Update won't fix it

Paint used to be a built-in Windows component. It's now a Microsoft Store app. Windows Update patches the operating system and built-in components, but it does not update Store apps.

That means running Windows Update will not patch CVE-2026-83844, even if Windows reports your system is fully updated.

#How to check and update Paint

#Check your version in Microsoft Store

1. Open Microsoft Store
2. Search for Paint
3. Click Update if available

#Check your version with PowerShell

Run this command in PowerShell:

Get-AppxPackage Microsoft.Paint | Select-Object Name, Version

The output shows your current Paint version. You need version 11.2609.401.0 or later.

#For multi-user PCs

On a PC with multiple user accounts, check Paint for all users. According to The Hacker News and RFF reporting, you should also check the provisioned package:

Get-AppxPackage -AllUsers Microsoft.Paint | Select-Object Name, Version
Get-AppxProvisionedPackage -Online | Where-Object DisplayName -like "*Microsoft.Paint*"

Update Paint separately for each user account, or remove and reinstall Paint from the Store to update the provisioned package.

#Version confusion: 11.2605.91.0 vs 11.2609.401.0

The CVE record originally listed version 11.2605.91.0 as the fixed version. However, security researchers and reporting from The Hacker News and RFF indicate the correct fixed version is 11.2609.401.0.

Use 11.2609.401.0 or later as the target version when verifying your patch status.

#What the vulnerability allows

The vulnerability is an out-of-bounds-read, which could allow an attacker to:

• Read memory contents outside the intended buffer
• Potentially execute arbitrary code
• Gain control of the affected system

The High attack complexity means exploiting this flaw requires significant technical skill and understanding of the target system. It is not a simple point-and-click exploit.

#What to do

1. Open Microsoft Store and search for Paint
2. Click Update to install version 11.2609.401.0 or later
3. Verify the update with PowerShell if you manage multiple PCs or user accounts
4. Do not rely on Windows Update to deliver this fix

If you don't use Paint, you can uninstall it from Settings, Apps, Installed apps.

#Sources

All facts in this article come from the following sources:

• Microsoft Security Update Guide, CVE-2026-83844
• The Hacker News, "Microsoft Paint RCE Fix Now Available Only via Microsoft Store" (Nov 6, 2026)
• NCSC.nl, "Kwetsbaarheid in Microsoft Windows Paint met risico op misbruik" (Nov 6, 2026)
• Neowin, "Microsoft Paint CVE-2026-83844 lets hackers hack Windows 11 PCs over internet" (Nov 4, 2026)
• RFF / Brian Vitko, "Windows Paint CVE-2026-83844: Store Fix Missing" (Nov 4-6, 2026)

#Keep your data off data brokers

Security patches protect your PC. Data broker removal protects your identity.

UndoLeak erases your data from data brokers and keeps it off.

Run a free scan to see where your information is listed right now.

Not affiliated with Microsoft.

Maya installs a family safety app so her parents can see she got home safe from school. The app tracks her location constantly. What she doesn't know is that in 2021, the app was selling her precise GPS coordinates to about a dozen data brokers who packaged and resold her movements.

In December 2021, The Markup reported that Life360, a family tracking app used by 33 million people, was selling precise location data on kids and families to data brokers. The investigation found that Life360 acted as one of the largest sources of location data for a multibillion-dollar industry.

Life360 stopped most of its location data sales in early 2022 after The Markup investigation. But as of August 2026, Life360's privacy policy still says it may sell sensitive personal data and licenses precise geolocation to partners for advertising and monetization.

If your family uses Life360, you should know what data the company collects, what it says it does with that data now, and how to turn off data sharing.

#Watch: How the family app sold location data

This video explains what happened and what you can do about it.

#What The Markup found in 2021

The Markup interviewed two former Life360 employees and two individuals who formerly worked at location data brokers Cuebiq and X-Mode. All four described Life360 as one of the largest sources of data for the location data industry.

Life360 sold data to about a dozen data brokers, including X-Mode, SafeGraph, Cuebiq, and Allstate's Arity. These companies bought precise location data and sold it to their own customers, including hedge funds, advertising firms, and government contractors. X-Mode sold location data to the U.S. Department of Defense, and SafeGraph sold location data to the CDC, according to public records.

In 2020, location data sales made up about 20 percent of Life360's revenue, netting the company $16 million.

The former employees told The Markup that Life360 could share location data within 20 minutes of collection, and the data was often shared raw rather than hashed, meaning it could be traced back to individual users more easily.

#What changed after The Markup investigation

In January 2022, Life360 announced it would stop selling precise location data to most data brokers. The company cut ties with most of its dozen partners but kept two:

• Arity (Allstate's data analytics subsidiary) continues to receive precise location data.
• Placer.ai receives aggregated location data, not raw precise coordinates.

Life360's CEO Chris Hulls said in a quarterly report to investors that the company would phase out all location data deals except with Arity.

#What Life360's 2026 privacy policy says now

Life360's privacy policy, last modified August 26, 2026, still permits selling and licensing location data. The Texas notice section states:

"We may sell your sensitive personal data."

A few lines later, the policy explains:

"We license certain information, including precise geolocation data (which is 'sensitive' personal data under certain State Privacy Laws) to select business partners for their own advertising and monetization purposes."

The policy says Life360 does not hand over your name, email, or phone number for this unless you ask it to share with a partner through the app, "but may share hashed versions of them with our partners." Hashing turns an email into a code, which can still match you across databases when two companies hold the same email.

#What data Life360 collects

Life360's August 2026 privacy policy lists:

• Precise geolocation data, including GPS coordinates, latitude and longitude, and motion sensor information
• Device details, including battery status and advertising identifiers
• Driving and movement data, including speed, altitude, estimated steps and distance, and heading
• Driving events, including phone usage while driving, high speed, hard braking, and rapid acceleration

The policy says Life360 asks iPhone users to set location to Always with Precise Location on. Its permissions page states: "Location data may be shared with partners for crash detection, research, analytics, attribution, and tailored advertising."

#What the app shows versus what Life360 keeps

The Life360 app shows your Circle limited history depending on your subscription tier: 2 days for free users, 7 days for Silver, and 30 days for Gold and Platinum.

But Life360 keeps location data much longer than what it shows in the app. The company's law enforcement guidelines, updated October 2, 2026, say:

"Life360 generally retains location data in the form of dwell data for up to 18 months. Raw location data is retained for approximately 30 days."

Dwell data means locations where you didn't move for at least 15 to 20 minutes, which typically captures home, work, school, and other regular places you visit.

#How to turn off data sharing in Life360

Life360 defaults to sharing your data with partners. You have to turn it off manually, and each adult in your Circle has to do it separately in their own account.

#Step 1: Open your Privacy Center

1. Open the Life360 app
2. Tap Settings in the upper left corner
3. Tap Privacy Center

#Step 2: Turn off Include my data

1. Tap Your Privacy Choices
2. Scroll down to Include my data
3. Turn off the toggle

This stops Life360 from using your data for personalized advertising and sharing it with partners for monetization. The setting also affects traffic and retail insights generated from aggregated Life360 data.

#Step 3: Each adult must do this separately

Your Privacy Choices setting only controls data for the account logged in at the time. If your Circle has multiple adults, each person needs to turn off Include my data in their own Life360 app on their own device.

Life360's support documentation confirms: "You must follow these in-app steps for each person in your Circle as the 'Your Privacy Choices' option is limited to the data for the account logged in at the time of the request."

#Step 4: Review Arity connection

Life360 shares data with Arity to power driving features like Drive Detection and Crash Alerts. If you want to disconnect Arity:

1. Open Settings
2. Tap Privacy Center
3. Scroll to Trusted Partners
4. Tap Arity
5. Turn off Connect to Arity

Disconnecting Arity disables Drive Detection, real-time speed tracking, driving history, and Crash Alerts.

#What turning off Include my data actually does

When you turn off Include my data, Life360 says it will no longer share your personally identifiable information with third-party partners for their own advertising and commercial purposes.

Life360 will still collect your location and movement data. It will still share that data with your Circle and with third parties as needed to provide Life360 services. But it should stop licensing your data to partners for monetization.

You may still see ads in the Life360 app, but the company says it won't use third-party data to personalize those ads.

#What turning it off does not do

Turning off Include my data does not delete the location data Life360 already collected and sold or licensed before you changed the setting. Data brokers who bought your historical location data still have it.

The setting also does not delete your location data from Life360's own servers. Life360 keeps raw location data for about 30 days and dwell data for up to 18 months.

To delete all your data from Life360, you need to delete your Life360 account. You can do this in the Privacy Center under Your Data Rights.

#The bigger question: do you need a family tracking app?

Life360 and similar apps were designed to help families coordinate and stay safe. Many parents find them useful for knowing when kids get home, checking in during emergencies, or locating a lost phone.

But every family tracking app creates a continuous record of where everyone goes. That data sits on company servers, subject to the company's privacy policy, which can change. It's accessible to law enforcement with legal process. And as Life360 demonstrated, it can be sold or licensed to data brokers for monetization.

Before using a family tracking app, consider:

• Do you need constant tracking, or would check-ins at specific times work? Some families use shared calendars and text check-ins instead of continuous location tracking.
• Who controls the data? With Life360, the company controls your location history. With Apple's Find My or Google's location sharing, the companies still have your data, but their business models rely less on selling it.
• What happens if the company's policy changes? Life360's policy as of August 2026 still permits selling sensitive personal data. That could change again, in either direction.

If you decide a family tracking app makes sense for your situation, the Privacy Center settings described above are the main controls Life360 offers.

#What this means for data broker removal

If you're working to remove your personal information from data brokers, know that location tracking apps can refill your profile even after you opt out from people-search sites.

Data brokers buy location data from apps like Life360, advertising networks, and other sources. They link that location data to other information they have about you, such as your name, address, phone number, and email. The result is a detailed profile that includes where you live, where you work, where you shop, and where you go regularly.

Even if you opt out from Spokeo, Whitepages, and other people-search sites, new location data can help data brokers rebuild parts of your profile or create new listings.

That's why a complete data broker removal strategy includes:

1. Opting out from major people-search sites
2. Limiting new data collection from apps, including location tracking
3. Monitoring for new listings and removing them when they appear

Our main guide, how to remove your personal information from the internet, covers the full process.

#The realistic routine

1. Today: If your family uses Life360, each adult should turn off Include my data in Settings, Privacy Center, Your Privacy Choices. This takes about two minutes per person.

2. When someone new joins your Circle: Remind them to turn off Include my data in their own account.

3. Every few months: Check the setting to make sure it's still off. App updates sometimes reset privacy settings, though Life360 has not been reported to do this.

4. If you're working on broader data broker removal: Consider whether continuous family location tracking fits with your privacy goals. If it doesn't, look into alternatives like scheduled check-ins or location sharing only when needed.

This routine takes a few minutes the first time and occasional check-ins after that. The goal is not to eliminate all location sharing if your family finds it useful. The goal is to stop that location data from being licensed to data brokers for monetization.

#Sources

1. The Markup, Jon Keegan and Alfred Ng, "The Popular Family Safety App Life360 Is Selling Precise Location Data on Its Tens of Millions of Users" (December 6, 2021). https://themarkup.org/privacy/2021/12/06/the-popular-family-safety-app-life360-is-selling-precise-location-data-on-its-tens-of-millions-of-user

2. The Markup, "Life360 Says It Will Stop Selling Precise Location Data" (January 27, 2022). https://themarkup.org/privacy/2022/01/27/life360-says-it-will-stop-selling-precise-location-data

3. Life360, Inc., "Life360 Privacy Policy" (last modified August 26, 2026). Life360 blocks automated access; the policy is available at Life360's legal center.

4. Default Privacy, "Family Location Apps and AirTags: Who Can See Where Your Family Is" (updated October 22, 2026). https://defaultprivacy.com/guides/family-location-apps-and-airtags

UndoLeak erases your data from data brokers and keeps it off.

Apple Support published a new page explaining the change, "Learn more about sharing content that can be accessed by Anyone with the Link," on its website in November 2026. The policy applies to version 27.3 or later of iOS, iPadOS, macOS and visionOS. Version 27.3 is currently in developer beta with a public release expected in December, MacRumors reported on November 4, 2026.

If you share an iCloud item with Share a Link, you can choose "People you choose" (only people you invite or approve can access it) or "Anyone with the link" (accessible to anyone with the link, including Apple). Starting in version 27.3, items shared using Anyone with the Link will be checked by Apple for harmful content. Such items are no longer end-to-end encrypted, even if the owner or participants have turned on Advanced Data Protection, according to Apple Support.

If content is flagged, Apple reserves the right to move, refuse, modify, remove or delete it. Apple may take action against the Apple Account, including blocking or disabling it, blocking new accounts with the same email or phone number, or, if necessary, involving law enforcement, per the support document.

UndoLeak erases your data from data brokers and keeps it off.

Last updated: November 5, 2026

#What is Apple checking?

Apple does not define "harmful content" in the support document. MacRumors reported on November 4, 2026 that it could mean malware, malicious files or CSAM given the law-enforcement mention, but MacRumors labels this as interpretation, not Apple's statement.

Bitdefender reported in November 2026 that Apple has not defined harmful content or explained its review process (automated, human or both), or how users could challenge an incorrect flag.

#What sharing is affected?

The policy applies to items shared in iCloud Photos or iCloud Drive using "Anyone with the link," according to Apple Support.

Items shared with "People you choose" are not mentioned in the policy and continue to support Advanced Data Protection when enabled, per Apple Support's iCloud data security overview.

Apple has not stated whether links created before version 27.3 will be checked, MacRumors reported on November 4, 2026.

#What about end-to-end encryption?

Items shared with "anyone with the link" do not support Advanced Data Protection, according to Apple Support's "iCloud data security overview" page. Encryption keys for such shared content are uploaded to Apple data centers so iCloud can facilitate web sharing.

Starting in version 27.3, items shared this way will also be checked by Apple.

Items shared with "People you choose" are not affected and continue to support Advanced Data Protection.

#How to share iCloud items privately

Follow these steps from Apple Support's iPhone guide to share items with "People you choose" instead of "Anyone with the link."

Step 1: Choose "People you choose" when sharing

When sharing from iCloud, tap Share, Share a Link, then choose "People you choose" instead of "Anyone with the link." Optionally turn on Access Requests so people who find the link can request permission instead of being blocked.

Only people you invite or approve can open the item. It supports Advanced Data Protection when enabled.

Step 2: Change existing public links to private

For links you already created with "Anyone with the link," you can switch them to "People you choose."

In the Files app, touch and hold the file or folder, tap Manage Shared File (or Manage Shared Folder), tap Sharing Options, change Access to "People you choose."

The original link stops working for everyone. Only people you re-invite can open it.

Step 3: Or stop sharing entirely

In the Files app, touch and hold the file or folder, tap Manage Shared File (or Manage Shared Folder), tap Stop Sharing.

Step 4: On the web

On icloud.com/iclouddrive, click Share, Manage Shared File, Sharing Options, then change Access or click Stop Sharing.

Step 5: Use "Send a Copy" for one-off files

For a file someone only needs once, use "Send a Copy" instead of "Share a Link." The recipient gets the file directly, with no link.

#What not to share with public links

Don't put documents you wouldn't want Apple or anyone with the link to see behind "Anyone with the link" sharing. This includes ID scans, bank documents, tax forms, or private photos.

Use "People you choose" for anything personal, or use "Send a Copy" for one-off files.

#Erase what's already out there

Changing how you share iCloud links keeps future items private. But people-search sites already list your name, home address, phone number and relatives from public records, and anyone can look you up.

Every major people-search site has a free opt-out form. You have to find each listing, submit the URL, and confirm the request from your email. Then check again in a few months, because listings come back.

Start with a free scan at undoleak.com to see which sites list your information right now.

Our complete guide to removing your personal information from the internet walks through every major site. TruePeopleSearch removal, BeenVerified opt-out, and our 30-day plan break it down step by step.

#Quick recap

1. Starting in iOS 27.3 (expected December 2026), items shared using "Anyone with the link" will be checked by Apple.
2. Such items are no longer end-to-end encrypted, even with Advanced Data Protection enabled, per Apple Support.
3. Flagged content may be moved, removed or deleted, and Apple may block accounts or involve law enforcement.
4. Apple has not defined what "harmful content" means or explained its review process, Bitdefender reports.
5. "People you choose" is not affected and continues to support Advanced Data Protection.
6. Change existing links in the Files app by tapping Manage Shared File, Sharing Options, then switching to "People you choose."
7. Erase your data from people-search sites so strangers can't connect your name to your home address.

#Sources

Accessed November 5, 2026.

1. Apple Support, "Learn more about sharing content that can be accessed by Anyone with the Link" (2026), https://support.apple.com/en-us/149168
2. Apple Support, "iCloud data security overview," https://support.apple.com/en-us/102651
3. MacRumors, "Apple Will Check Public iCloud Links for Harmful Content Starting in iOS 27.3" (November 4, 2026), https://www.macrumors.com/2026/11/04/ios-27-3-icloud-link-check/
4. Bitdefender, "Apple to Scan Public iCloud Links in iOS 27.3 Update" (2026), https://www.bitdefender.com/en-us/blog/hotforsecurity/apple-icloud-public-link-scanning-ios-27-3
5. Apple Support, "Share files and folders in iCloud Drive on iPhone" (iPhone User Guide), https://support.apple.com/guide/iphone/iph17f9f92a6/ios

Disclaimer: General information, not legal advice. UndoLeak is not affiliated with Apple or any company mentioned.

Flock Safety contracts with more than 5,000 law enforcement agencies and scans over 20 billion license plates per month, Kevin Collier reported for NBC News in November 2025, citing Flock's website. More than 75% of those offices opt into Flock's live national database, which allows agencies across the country to view plate numbers, locations, directions and times of recording without warrants, according to what Flock told Sen. Ron Wyden's office as reported by NBC.

These cameras don't just read plates. Deflock.org, an open-source community map of ALPR cameras, notes that ALPRs also capture make, model, color and identifying features such as dents, roof racks and bumper stickers, often as searchable data points.

There is no consumer opt-out for driving on public roads. But you can check Deflock.org to see where cameras are near you, and you can erase the name and home address that people-search sites attach to you.

UndoLeak erases your data from data brokers and keeps it off.

Last updated: November 5, 2026

#What are Flock Safety license plate cameras?

Flock Safety makes automated license plate readers (ALPRs) that scan passing vehicles on public roads. According to NBC News reporting from November 2025, Flock contracts with more than 5,000 law enforcement agencies and scans over 20 billion license plates per month, per Flock's website as reported.

The cameras are typically mounted on poles near roads and intersections. They capture still images of each passing vehicle.

#What do ALPR cameras capture?

Automated license plate readers capture more than just your plate number. According to Deflock.org and the ACLU's 2025 guide on fighting ALPR deployment, these cameras log:

• License plate number
• Make, model, and color
• Location and direction of travel
• Time and date
• Identifying features like dents, roof racks, and bumper stickers

Many of these details become searchable data points, creating what Flock calls a "Vehicle Fingerprint," a term discussed in Institute for Justice Senate testimony on September 23, 2026.

#Do police share ALPR data across jurisdictions?

Yes. According to what Flock told Sen. Ron Wyden's office as reported by NBC News, more than 75% of agencies that use Flock opt into the company's live national database. This database allows participating agencies across the country to view plate numbers, locations, directions and times of recording without warrants.

This statement represents what Flock told the Senator's office as reported by NBC and is not a court holding.

#How to find ALPR cameras near me

There is no official public map of ALPR camera locations, but you can check reported locations on community-maintained resources.

Step 1: Open Deflock.org

Deflock.org (also available at Deflock.me) is an open-source, community-maintained map of ALPR camera locations. The ACLU's 2025 guide "How to Fight Deployment of Flock Safety and Similar Automated License Plate Readers" lists Deflock.org as a crowdsourced resource for finding reported camera locations.

Step 2: Search your street or city

Enter your address, street name, or city into the search field on Deflock.org. The map will show reported ALPR camera locations near where you drive.

Step 3: Note there is no consumer opt-out

You cannot opt out of ALPR tracking on public roads. The cameras scan every passing vehicle. If you drive on a monitored road, the camera logs your vehicle.

Step 4: Check local policy and resources

For information about ALPR deployment and data retention policies in your area, contact your city council or police department. The ACLU provides resources on how to fight deployment of Flock Safety and similar automated license plate readers in your community.

#What can you actually erase?

You can't erase a camera's scan or delete yourself from the ALPR database. But you can erase what makes it easy for anyone to connect your plate to your front door.

People-search sites collect your name, address, phone number, and relatives from public records and sell access to that information. Type a name into Whitepages, Spokeo, or TruePeopleSearch, and anyone can see where you live.

That part, you can erase. Every major people-search site has a free opt-out form. You have to find each listing, submit the URL, and confirm the request from your email. Then check again in a few months, because listings come back.

Start with a free scan at undoleak.com to see which sites list your home address right now.

Our complete guide to removing your personal information from the internet walks through every major site. TruePeopleSearch removal, BeenVerified opt-out, and our 30-day plan break it down step by step.

#Related reading

• Flock Cameras: What They Record and Who Can Search It - Detailed guide to Flock camera data retention, misuse cases, and DRN's private license plate database
• How to Remove Your Address From Google - Use Google's Results about you tool to request removal of your home address from search results
• Why Data Brokers Re-List You After Opt-Out - Why your information comes back and what to do about it
• Is Your Car Tracking You for Insurance? The OnStar Case - GM's OnStar Smart Driver shared trip data with LexisNexis, who sold it to insurers

#Quick recap

1. Flock ALPR cameras scan over 20 billion license plates per month across more than 5,000 law enforcement agencies, as reported by NBC News.
2. Cameras capture plate numbers, make, model, color, location, time, direction, and identifying features like dents and bumper stickers.
3. More than 75% of agencies opt into a live national database that shares data without warrants, according to what Flock told Sen. Ron Wyden's office as reported by NBC.
4. Deflock.org is a community map where you can check for reported ALPR camera locations near you.
5. No consumer opt-out exists for driving on public roads monitored by ALPR cameras.
6. Erase the link to your home by opting out of people-search sites that list your name and address.

#Sources

Accessed November 5, 2026.

1. Kevin Collier, NBC News, "Police cameras track billions of license plates per month. Communities are pushing back." (Nov 1, 2025), https://www.nbcnews.com/tech/tech-news/police-cameras-track-billions-license-plates-month-communities-pushing-rcna178849
2. Deflock.org, https://deflock.org/
3. Deflock.me, https://deflock.me/
4. ACLU, "How to Fight Deployment of Flock Safety and Similar Automated License Plate Readers" (2025), https://www.aclu.org/documents/how-fight-deployment-flock-safety-and-similar-automated-license-plate-readers
5. Institute for Justice, Senate testimony on Flock "Vehicle Fingerprint" (Sept 23, 2026)

Disclaimer: General information, not legal advice. UndoLeak is not affiliated with Flock Safety, Deflock, the ACLU, NBC News, the Institute for Justice or any police agency.

On November 4, 2026, Ryohin Keikaku (the operator of MUJI) reported in a second notice that full MUJI Card numbers for about 1.09 million members may have been accessed by a third party around 1am on October 29, 2026. About 345,000 of those cards are currently valid.

This widened the scope from the company's first notice on October 30, which said card information was not included.

Here's what was leaked, who was affected, and what you should do if you have or had a MUJI Card.

#What data was exposed

According to Credit Saison's November 4, 2026 notice, the breach may have exposed the following information for about 1.09 million MUJI Card customers:

#What was not leaked

Credit Saison confirmed that:

• Card expiry dates were not included
• Security codes (CVV) were not included
• Credit Saison's own systems were not breached

The unauthorized access was to Ryohin Keikaku's system only. Ryohin Keikaku obtained card numbers from Credit Saison from October 2000 to July 2021 to give its own loyalty perks, and the company confirmed this information remained on its system.

#Who was affected

The affected group includes MUJI Card members who joined from October 2000 to July 2021:

• About 345,000 currently usable cards
• About 745,000 cards that are no longer valid (canceled, expired, etc.)

Cards issued from August 2021 onward are not affected because Ryohin Keikaku changed its system in July 2021 and no longer stores card numbers.

#How to check if you're affected

Your join date is shown in Credit Saison's member site:

1. Log in to Saison Portal or Net Answer
2. Go to Menu, customer information
3. Check your join date

If you joined from August 2021 onward, you're not affected. If you joined before that, follow the steps below.

#Why Ryohin Keikaku stored card numbers

From October 2000 to July 2021, Ryohin Keikaku obtained full card numbers, MUJI Card IDs, and dates of birth from Credit Saison to manage its own loyalty point program.

In July 2021, the company changed the mechanism so card numbers are no longer shared with Ryohin Keikaku. Cards issued from August 2021 are not included in this breach.

#Timeline of the breach

According to Ryohin Keikaku's second notice, further investigation showed the affected group also includes MUJI online store members (including people who don't use the MUJI app), some people's names, addresses, and phone numbers, and some card information.

As of November 4, 2026, no leak to the dark web and no misuse-related damage has been confirmed, according to Ryohin Keikaku.

#What to do if you're affected

If you have or had a MUJI Card issued from October 2000 to July 2021:

#1. Check your card statements

Check your Credit Saison statements for unfamiliar charges. If you see any, contact Credit Saison immediately.

#2. Request a card reissue if you're worried

If you're worried about the breach, you can ask Credit Saison to reissue your card with a new number. Keep in mind:

• It takes time for the new card to arrive
• Your old card will stop working once the new one is issued
• Any recurring payments linked to your card will need to be updated

#3. Watch for phishing

A card number without the expiry date and security code is harder to misuse for online purchases, but scammers can quote it in calls or emails to sound legitimate.

Never give your PIN, security code, one-time code, or full card number to anyone who contacts you by email, text, or phone. According to Ryohin Keikaku's notice, the company never asks for credit card information by email or phone.

Treat MUJI-themed emails, texts, and calls with links as suspicious. If you receive a message that mentions the breach, don't click links or open attachments. Go to the official MUJI or Credit Saison site yourself.

#4. If you're outside Japan

If you have a MUJI app or online store account but not a MUJI Card, your email address and date of birth may still be at risk. Watch for phishing emails that use your information to sound real.

#Response from Credit Saison

Credit Saison says it is:

• Strengthening monitoring for fraudulent use of affected cards
• Reissuing cards on request for worried customers
• Investigating and responding to unfamiliar charges reported by customers
• Contacting affected customers by email or post

The company reports no increase in fraudulent use has been confirmed so far.

#How the breach went viral

NHK's post about the breach on X (formerly Twitter) passed a million views within hours on November 4, 2026, showing how quickly news of data breaches spreads and how many people are concerned about their card information being accessed.

#Sources

All facts in this article come from the following sources:

• Ryohin Keikaku, "MUJIアプリにおけるお客さま情報の漏えいの可能性に関するお知らせとお詫び（続報）" (Nov 4, 2026)
• Credit Saison, "無印良品メンバー会員情報に関するお知らせ" (Nov 4, 2026)
• The Straits Times / Kyodo, "Credit card numbers may have leaked in cyberattack on Japan's Muji" (Nov 4, 2026)
• CNET Japan, "無印良品運営の良品計画、約1.09万件のカード情報が漏えいの可能性" (Nov 4, 2026)

#Keep your data off data brokers

Data breaches expose your information, but data brokers keep it circulating for years. Your name, address, and phone number can sit on people-search sites long after a breach.

UndoLeak erases your data from data brokers and keeps it off.

See where you're listed with a free scan.

Not affiliated with MUJI, Ryohin Keikaku, Credit Saison, or any company mentioned.

Amazon says an Echo listens on the device for its wake word and doesn't store or send audio until it detects it. Then the request (plus a fraction of a second before the wake word) goes to Amazon's cloud, where recordings and transcripts are saved by default.

But speakers do wake up by mistake. Researchers measured 1.5 to 19 accidental activations per day on average, depending on the device. So change four settings: Don't save, turn off Use of voice recordings, delete your history, and use the mic button.

Last updated: November 4, 2026

#Is Alexa always listening?

Yes and no.

Amazon's Alexa privacy FAQ (document GVP69FUJ48X9DK8V, accessed November 4, 2026) says that by default, Alexa devices detect only the wake word. According to Amazon:

"No audio is stored or sent to the cloud unless the device detects the wake word (or Alexa is activated by pressing a button)."

When an Echo detects the wake word, a light ring turns blue to indicate recording is active. The device then streams audio to Amazon's cloud, including what Amazon describes as "a fraction of a second of audio before the wake word."

You can enable an optional audible tone that plays when recording starts.

According to Amazon, when you join Alexa+ (the subscription service), Follow Up Mode is turned on automatically, which keeps the microphone active for a few seconds after a response so you can ask follow-up questions without repeating the wake word.

#Does Alexa record your conversations?

Amazon says it records only the audio that starts when the wake word is detected (or when you press the Alexa button), plus a brief fraction of a second before the word.

Each recording becomes two things:

1. The audio file
2. A written transcript

Amazon's Alexa Privacy hub states: "All of your voice recordings and transcripts are saved by default, but you can change how long they are saved or choose to delete them at any time."

The available options are:

• Save until deleted (default)
• Save for 18 months
• Save for 3 months
• Don't save

When you choose "Don't save," Amazon says it deletes saved voice recordings and stops saving new ones. Transcripts and typed requests are kept until the chat has been inactive for 30 days, then deleted. Voice ID stops working, and the setting may take up to 36 hours to apply.

#How often does Alexa wake up by mistake?

More often than you might think.

Researchers at Northeastern University's Mon(IoT)r Lab and Imperial College London played 125 hours of Netflix TV shows to four types of smart speakers: Echo Dot (2nd and 3rd generation), Google Home Mini, Apple HomePod, and Microsoft Invoke.

The result: speakers woke up by mistake between 1.5 and 19 times per device per day on average, depending on which device.

Most of these accidental recordings were short. But for several devices, 10% of misactivations lasted 10 seconds or more.

The researchers found no evidence of constant recording. The study, published in Proceedings on Privacy Enhancing Technologies (PETS) 2020, concluded that devices listened for the wake word but did not record continuously.

According to Northeastern Global News (July 14, 2020), the researchers identified certain words and phrases in TV dialogue that commonly triggered false activations. CBS Boston also reported on the findings.

The study does not test current devices or software versions. It's a snapshot of specific smart speaker models tested in 2020.

#Can you stop Echo from sending recordings to Amazon?

Not anymore.

On March 28, 2025, Amazon ended the "Do Not Send Voice Recordings" option, which allowed certain Echo devices (Echo Dot 4th Gen, Echo Show 10, and Echo Show 15) to process some requests locally on the device without sending them to Amazon's cloud.

According to the Associated Press and The Register (reporting in March 2025), all Alexa requests now go to Amazon's cloud. Users who had enabled local processing were automatically moved to the "Don't save recordings" setting.

With "Don't save" enabled, Amazon says voice requests are processed in the cloud and then deleted, but they are no longer processed locally.

#What does Amazon keep after you delete a recording?

Even after deletion, Amazon may retain other records.

Amazon Help (document G68KUKTXN92WY3C3, accessed November 4, 2026) states:

"We may still retain other records of your Alexa interactions, including records of actions Alexa took in response to your request and information about products you may have searched for or asked about."

Amazon also says:

• Data held by skill developers is not deleted when you delete your Alexa recordings
• Amazon may "continue to retain and use the systems trained on your data after your data has been deleted"

According to the FTC's May 31, 2023 complaint against Amazon (Case No. 2:23-cv-00811, paragraph 28), until mid-2019, when users or parents deleted Alexa voice recordings, Amazon in many instances deleted the audio but kept written transcripts in "residual data stores" and used those transcripts for product improvement.

The complaint states that when a user selected "delete recording," the play button and text disappeared, making it appear that both the audio and transcript were deleted. But the transcripts remained.

Amazon settled the case in 2023. In a statement on aboutamazon.com, Amazon said:

"While we disagree with the FTC's claims and deny violating the law, this settlement puts the matter behind us."

The stipulated order was entered on July 19, 2023 by the U.S. District Court for the Western District of Washington.

#Can Amazon employees hear Alexa recordings?

According to a Bloomberg report from April 10, 2019, Amazon employs thousands of people around the world to listen to, transcribe, and annotate Alexa voice clips in order to improve Alexa's speech recognition and natural language processing.

Amazon's FAQ (document GVP69FUJ48X9DK8V) states that humans review "an extremely small sample" of voice recordings.

The Guardian reported in August 2019 that Amazon allows users to opt out of having their recordings included in this human review process by turning off the "Use of voice recordings" setting.

#What did the FTC say Amazon did with deleted recordings?

The FTC and Department of Justice filed a complaint on May 31, 2023, alleging violations of the Children's Online Privacy Protection Act (COPPA).

Paragraph 29 of the complaint alleged that between August 2018 and September 2019, Alexa voice recordings were accessible to 30,000 Amazon employees, approximately 15,000 of whom lacked any business need for such access.

Paragraph 28 alleged that until mid-2019, when users or parents requested deletion of Alexa voice recordings, Amazon in many instances deleted the audio but kept the written transcripts in "residual data stores."

The FTC press release (May 31, 2023) stated: "even when a parent sought to delete that information, the FTC said, Amazon failed to delete transcripts of what kids said from all its databases."

On July 19, 2023, the U.S. Department of Justice announced that a stipulated order was entered. Amazon agreed to a permanent injunction and a civil penalty, and is required to delete inactive child profiles and honor deletion requests.

Amazon's statement (published on aboutamazon.com) says:

"We disagree with the FTC's claims and deny violating the law."

The complaint describes Amazon's practices as they existed until mid-2019, not current practices.

#How do I stop Alexa from saving my voice?

Here are the four settings that address most privacy concerns with Alexa voice recordings. Menu names can differ by app version and region.

#1. Turn on "Don't save"

This is the most important setting. It deletes your saved recordings and stops saving new ones.

1. Open the Alexa app on your phone
2. Tap More (usually three horizontal lines at the bottom)
3. Tap Alexa Privacy
4. Tap Manage Your Alexa Data
5. Under Voice Recordings (and Transcripts), choose "Don't save"
6. Tap Confirm

According to Amazon Help (document G68KUKTXN92WY3C3):

• Amazon deletes your saved voice recordings
• Future voice recordings will not be saved
• Transcripts and typed requests are kept until the chat has been inactive for 30 days, after which they are automatically deleted
• Voice ID will be deleted and will no longer work
• The setting may take up to 36 hours to take effect

#2. Turn off human review

This opts your recordings out of being heard by Amazon employees or contractors.

On the same screen (Manage Your Alexa Data), scroll to Help improve Alexa, then:

• Turn off "Use of voice recordings"
• Turn off "Use messages to improve transcriptions" (if present)

According to The Guardian (August 5, 2019) and Amazon's FAQ, recordings from users who turn off this setting are excluded from the supervised learning review workflow.

#3. Delete what's already saved

Go back to Alexa Privacy, then:

1. Tap Review Voice History
2. Choose a date range (today, yesterday, this week, this month, all time), or filter by device or type
3. Tap Delete for individual recordings, or Delete All Recordings for the selected period

You can also enable deletion by voice. This setting is opt-in and, according to Amazon Help (document GYRPHMGANH7M2BNH), does not work with Alexa+ or on Amazon Kids devices.

Once enabled, you can say:

• "Alexa, delete what I just said"
• "Alexa, delete everything I said today"

#4. Use the microphone button

Every Echo device has a physical microphone button. Press it and the light turns red.

Amazon says that when the red light is on, the power to the microphones is disconnected and Alexa cannot hear you.

This is the only setting that stops audio from being captured at all, but it also means Alexa won't respond to the wake word until you press the button again.

#Can people find my home address without Alexa?

Yes, and they don't need Alexa to do it.

Your voice history sits with one company. But your name, home address, and phone number sit with companies you've never heard of: data brokers and people-search sites.

According to the Federal Trade Commission's consumer guidance on people-search sites (accessed November 4, 2026):

"People-search sites collect and sell your information, including your address and phone number."

Type a name into one of these sites, and many will show where that person lives, their phone number, and their relatives' names.

These listings come from:

• Public records (property deeds, voter registrations, court filings)
• Marketing databases
• Data bought and resold by other data brokers

The only way to remove them is to opt out of each site individually. And even after you do, listings often come back, because the sites re-scrape or re-buy the data.

See which people-search sites list your home address (free scan)

#Erase the part Alexa doesn't control

You can turn off Alexa's recordings in four steps. But the data that's already out there, on people-search sites and data brokers, requires a different approach.

You can opt out site by site. Or you can check and re-check, because listings come back.

UndoLeak erases your data from data brokers and keeps it off.

Start with a free scan

Related guides:

• How to Delete Alexa Recordings (and What Amazon Kept After You Did)
• Is Your Phone Listening to You? What Researchers and the FTC Found
• Is Your Smart TV Spying on You?
• Can Ring Employees See My Videos?
• How to Remove Yourself from the Internet
• Why Data Brokers Re-List You After Opt-Out
• What Data Brokers Know About You

Sources (accessed November 4, 2026):

• Amazon, "Alexa, Echo Devices and Your Privacy" (FAQ, document GVP69FUJ48X9DK8V): amazon.com/gp/help/customer/display.html?nodeId=GVP69FUJ48X9DK8V
• Amazon, Alexa Privacy hub: amazon.com/b?ie=UTF8&node=23608614011
• Amazon Help, "Delete Alexa Voice Recordings and Transcripts Automatically" (document G68KUKTXN92WY3C3): amazon.com/gp/help/customer/display.html?nodeId=G68KUKTXN92WY3C3
• Amazon Help, "Delete Voice Recordings by Voice" (document GYRPHMGANH7M2BNH): amazon.com/gp/help/customer/display.html?nodeId=GYRPHMGANH7M2BNH
• Northeastern University Mon(IoT)r Lab, "Privacy Analysis of Smart Speakers" (PETS 2020): moniotrlab.khoury.northeastern.edu/publications/smart-speakers-study-pets20/
• Northeastern Global News, "Are Alexa, Siri, and Cortana recording your private conversations?" (July 14, 2020): news.northeastern.edu/2020/07/14/are-alexa-siri-and-cortana-recording-your-private-conversations/
• CBS Boston, "Smart speakers record when they shouldn't, study finds" (July 15, 2020): cbsnews.com/boston/news/smart-speakers-record-alexa-apple-google-northeastern-study/
• Associated Press, "Amazon ends Echo 'Do Not Send Voice Recordings' option" (March 2025): apnews.com/article/amazon-privacy-echo-7fb3c19fa7f664bde5c5be259f8b23ee
• The Register, Sharon Harding, "Amazon kills off on-device Alexa processing for Echo owners" (March 17, 2025): theregister.com/software/2025/03/17/amazon-kills-off-on-device-alexa-processing-for-echo-owners/1214755
• Bloomberg, Matt Day and Giles Turner, "Is Anyone Listening to You on Alexa? A Global Team Reviews Audio" (April 10, 2019): bloomberg.com/news/articles/2019-04-10/is-anyone-listening-to-you-on-alexa-a-global-team-reviews-audio
• The Guardian, Alex Hern, "Alexa allows users to disable human review of voice recordings" (August 5, 2019): theguardian.com/technology/2019/aug/05/alexa-allows-users-to-disable-human-review-of-voice-recordings
• Federal Trade Commission and U.S. Department of Justice, Complaint, United States v. Amazon.com, Inc., Case No. 2:23-cv-00811 (W.D. Wash., filed May 31, 2023): ftc.gov/system/files/ftc_gov/pdf/Amazon-Complaint-(Dkt.1).pdf
• Federal Trade Commission, "FTC and DOJ Charge Amazon with Violating Children's Privacy Law by Keeping Kids' Alexa Voice Recordings Forever and Undermining Parents' Deletion Requests" (May 31, 2023): ftc.gov/news-events/news/press-releases/2023/05/ftc-doj-charge-amazon-violating-childrens-privacy-law-keeping-kids-alexa-voice-recordings-forever
• U.S. Department of Justice, "Amazon Stipulated Order and Injunctive Relief for Alleged Violations of Children's Privacy Law" (July 19, 2023): justice.gov/archives/opa/pr/amazon-agrees-injunctive-relief-and-25-million-civil-penalty-alleged-violations-childrens
• Amazon, "Amazon's response to our recent settlement with the U.S. Department of Justice regarding Alexa" (2023): aboutamazon.com/news/policy-news-views/amazon-response-to-ftc-settlement-regarding-alexa
• Federal Trade Commission, "What to know about people-search sites that sell your information": consumer.ftc.gov/articles/what-know-about-people-search-sites-sell-your-information

UndoLeak is not affiliated with Amazon or any outlet named. General information, not legal advice.

You didn't add it. You don't need to own an Apple device or a Google phone. If anyone near you does, and they have location services on, your router's hardware identifier and your home's location were likely sent to a crowd-sourced database. That database is used for location services, the technology that helps phones and tablets determine where they are when GPS is unavailable or slow. It's also used by anyone who queries the database and supplies nearby Wi-Fi identifiers.

Over the course of a year, two University of Maryland researchers querying Apple's Wi-Fi positioning system learned the precise locations of over 2 billion Wi-Fi access points. They reported precision "on the order of meters," often enough to "identify individual homes or businesses." They tracked routers moving between cities and countries, potentially revealing their owners' relocations. For people fleeing intimate partner violence or stalkers, the researchers wrote, "their router simply being online can disclose their new location" (Erik Rye and Dave Levin, "Surveilling the Masses with Wi-Fi-Based Positioning Systems," IEEE Symposium on Security and Privacy, 2024).

Apple and Google both offer an opt-out. To use it, you add "_nomap" to the end of your Wi-Fi network name. Here's how it works, what the researchers found, and how to opt your router out.

#How Wi-Fi location works

When you open a map app on your phone, or when an app asks for your location, your phone needs to figure out where you are. GPS works well outdoors, but indoors or in dense urban areas, it's slow or unavailable. So phones use another method called Wi-Fi positioning.

Your phone scans for nearby Wi-Fi networks. It doesn't connect to them. It just sees them, the same way you see a list of available networks when you open your Wi-Fi settings. Each Wi-Fi router broadcasts a unique identifier called a BSSID (Basic Service Set Identifier), which is the router's hardware address. It looks like this: 3C:7A:9F:21:B4:08.

Your phone sends the list of nearby BSSIDs to a location service, Apple's or Google's, depending on your phone. The service looks up those BSSIDs in a database and returns a location based on where those routers were previously seen. Your phone now knows where you are, usually within a few meters.

The database is crowd-sourced. Every time a phone with location services on detects a Wi-Fi network, it can send that network's BSSID and the phone's GPS location to the database. Over time, millions of devices contribute location data for millions of routers. The database grows, and Wi-Fi positioning gets more accurate.

You don't opt in. If you have a Wi-Fi router, and someone near you has a phone with location services on, your router is likely already in the database.

#What the University of Maryland researchers found

In 2024, Erik Rye and Dave Levin from the University of Maryland published a study on Wi-Fi-based positioning systems. They queried Apple's Wi-Fi positioning API over a year, from November 2022 to November 2023, and learned the precise locations of over 2 billion BSSIDs.

Apple's API, they reported, returns up to 400 nearby BSSIDs per request. The precision is "on the order of meters." In many cases, the researchers wrote, the location data is precise enough to "identify individual homes or businesses."

The researchers also found that "people who own no Apple products ... can have their AP in Apple's WPS merely by having Apple devices come within Wi-Fi transmission range." You don't need to own an Apple device. You just need to be near someone who does. As University of Maryland researcher Erik Rye told Krebs on Security in May 2024, "You may not have Apple products, but if you have an access point and someone near you owns an Apple device, your BSSID will be in [Apple's] database" (Krebs on Security, "Why Your Wi-Fi Router Doubles as an Apple AirTag," May 21, 2024).

The study included case studies on Ukraine, Gaza, and the 2023 Maui fires, showing how router location data could reveal sensitive movements. The researchers specifically highlighted the risk for people fleeing domestic violence or stalkers, writing that "their router simply being online can disclose their new location."

Routers that move are especially trackable. The researchers observed routers moving between cities and countries, revealing their owners' relocations. Travel routers (the researchers mentioned GL.iNet models) move frequently. Mobile hotspots from phones use randomized BSSIDs per connection, making them less trackable. Starlink, the researchers reported, began randomizing BSSIDs in 2023.

After the study was published, Krebs on Security reported that Apple updated its support page in March 2024 to document the _nomap opt-out and said it had respected _nomap "for some time" before that (Krebs on Security, May 21, 2024). The researchers did not claim the surveillance method still works unchanged in 2026 or that Apple still returns 400 BSSIDs per request today. What we know is what the researchers reported in 2024 based on 2022-2023 data, and that Apple said it was making changes.

#How to opt out with _nomap

Apple and Google both recognize a simple opt-out: add "_nomap" to the end of your Wi-Fi network name (SSID).

Apple's support page, "Location Services and Privacy," states: "The owner of a Wi-Fi access point can opt it out of Apple's Location Services by changing the access point's SSID (name) to end with '_nomap.' For example, 'Access_Point' would be changed to 'Access_Point_nomap.' This prevents devices from sending the access point's location to Apple" (Apple Support, "Location Services and Privacy," 2026). The same page notes, "This opt-out doesn't work for hidden networks."

Google's Maps Help page, "Manage your Wi-Fi access point and Google's Location services," says: "To opt out, change the SSID (name) of your Wi-Fi access point ... so that it ends with '_nomap.'" Google gives the example of changing "12345" to "12345_nomap." For ISP-provided routers, Google advises contacting your ISP. Google also notes that "each location provider operates independently" and that Google "encourage[s] other providers to respect the '_nomap' convention" (Google Maps Help, "Manage your Wi-Fi access point and Google's Location services," 2026).

Apple's documentation says the crowd-sourced location data is encrypted and doesn't personally identify you. The opt-out prevents your router from being added to new location reports, but it may not immediately remove your BSSID from existing databases.

#How to add _nomap to your Wi-Fi network name

Here's how to rename your Wi-Fi network to add the _nomap suffix. The exact steps depend on your router, but the process is similar for most home routers.

#For most home routers

1. Open your router's admin page or app. Common addresses are 192.168.1.1, 192.168.0.1, or 192.168.1.254. Some routers (like those from Eero, Google Nest, or TP-Link) have mobile apps. Your ISP may also provide an app for your router.
2. Log in with your router's admin username and password. If you haven't changed it, the default credentials are often printed on a label on the router, or in the manual.
3. Find the Wi-Fi settings, wireless settings, or SSID settings.
4. Locate the SSID (network name) field. If your router has separate 2.4 GHz and 5 GHz networks with different names, you'll need to rename both.
5. Add "_nomap" to the end of the network name. For example, change "Home_WiFi" to "Home_WiFi_nomap".
6. Save the changes. Your router may restart.
7. Reconnect all your devices to the renamed network. You'll need to forget the old network name and join the new one.

#For ISP-provided routers

If your router is provided by your internet service provider (Comcast, Verizon, AT&T, etc.) and you cannot access the admin page or the page does not allow you to change the SSID, contact your ISP's customer support and ask them to add "_nomap" to your network name.

#Important notes

• Renaming your network means every device must reconnect. Phones, laptops, smart TVs, smart home devices, printers, and anything else connected to your Wi-Fi will lose connection when you rename the network. You'll need to go to each device, forget the old network, and connect to the new one.
• Hidden networks cannot use _nomap. If your network is hidden (SSID broadcast is disabled), the opt-out will not work. You must make your network visible for _nomap to be effective.
• Rename all bands. If your router has separate SSIDs for 2.4 GHz and 5 GHz, add "_nomap" to both.
• Travel routers and mobile hotspots. If you use a travel router, add _nomap to its SSID, or choose a model that randomizes its BSSID. Phone hotspots typically use randomized BSSIDs by default, making them harder to track.

#Why this matters

Wi-Fi positioning systems are useful. They help your phone figure out where you are when GPS is slow or unavailable. But they also mean your Wi-Fi router can be used to locate your home or business, track when and where a router moves, and potentially reveal someone's new address.

The University of Maryland researchers documented how the system can be used for surveillance. They tracked routers moving across countries. They highlighted the risk for people fleeing domestic violence, stalkers, or other threats, for whom "their router simply being online can disclose their new location."

The _nomap opt-out is simple, but most people don't know it exists. Apple added documentation for it in March 2024. Google has documented it since at least 2016. But unless you're looking for it, you won't find it. Most people don't know their router is in a crowd-sourced location database, let alone that they can opt out.

Adding _nomap takes five minutes. It won't remove your router from existing database entries immediately, but it will stop new location reports from being sent. If you're concerned about your router's location being tracked or shared, or if you move your router frequently, adding _nomap is a straightforward step.

#Other ways to protect your location privacy

Adding _nomap to your Wi-Fi network name is one step. Here are a few others:

#Turn off location services when you don't need them

On iPhone, go to Settings, Privacy & Security, Location Services, and either turn Location Services off entirely or review which apps have access and set them to "While Using the App" or "Never." On Android, go to Settings, Location, and turn off location, or tap App permissions and review which apps can access your location.

When location services are off, your phone won't contribute to crowd-sourced Wi-Fi location databases.

#Use a VPN

A VPN encrypts your internet traffic and hides your IP address, making it harder for websites, apps, and internet providers to see what you're doing online or where you are. A VPN doesn't stop Wi-Fi positioning systems from detecting your router's BSSID, but it does add a layer of privacy for your internet activity.

#Review your router's other privacy settings

Some routers broadcast additional information, like UPnP (Universal Plug and Play) services that can be detected from the internet. Check your router's security settings, disable features you don't use, and make sure your router's firmware is up to date.

#Conclusion

Your Wi-Fi router is likely already on Apple's and Google's maps. Over 2 billion BSSIDs were in Apple's database as of 2024, according to University of Maryland researchers. Your router can reveal your location to within meters, often precise enough to identify your home or business. Routers that move can reveal relocations, including for people fleeing domestic violence or stalkers.

Apple and Google both honor the _nomap opt-out. Add "_nomap" to the end of your Wi-Fi network name (for example, "Home_WiFi_nomap") to prevent devices from sending your router's location to crowd-sourced databases. Rename all bands (2.4 GHz and 5 GHz) if they have separate names. Hidden networks cannot use this opt-out.

It takes five minutes, and every device will need to reconnect, but it's a simple, documented way to opt your router out.

UndoLeak erases your data from data brokers and keeps it off.

If you want to see where else your personal information is listed, run a free scan.

#Sources

1. Erik Rye and Dave Levin, University of Maryland, "Surveilling the Masses with Wi-Fi-Based Positioning Systems", IEEE Symposium on Security and Privacy (2024)
2. Krebs on Security, "Why Your Wi-Fi Router Doubles as an Apple AirTag" (May 21, 2024)
3. Apple Support, "Location Services and Privacy" (2026)
4. Google Maps Help, "Manage your Wi-Fi access point and Google's Location services" (2026)

#What happened

#The security flaw

On October 30, 2026, TechCrunch reported that a security researcher had found a password for an internal customer database hardcoded inside the Applebee's mobile app's source code.

Hardcoding a credential means anyone who downloads and decompiles the app can extract the password and use it to access the same database the app connects to.

Security researcher Robert Wiggins of What Security in the UK used AI tools to help find the credential in the Android app's code. The app has more than one million downloads on Google Play.

TechCrunch verified the finding by decompiling the app and using the password to retrieve a dummy account it had created.

#What was in the database

According to TechCrunch, the exposed database contained:

• Customer names
• Email addresses (including whether the email was verified)
• Dates of birth
• Phone numbers
• ZIP codes
• Veteran status
• Number of logins
• Account creation dates
• IP addresses of most recent logins (which can reveal approximate location)

Payment card details and account passwords were not among the listed fields.

#Applebee's response

Applebee's confirmed on October 29, 2026, that it had addressed the issue. Its parent company, Dine Brands, told TechCrunch it "has not currently found any evidence of unauthorized access" and said "our investigation is ongoing."

Dine Brands would not say whether it has server logs to determine whether anyone accessed the database, or any logs at all. TechCrunch asked whether the company would alert customers or regulators and how long the credential had been in the app. The company did not respond to those questions.

As of November 2, 2026, Applebee's had not notified customers or publicly disclosed the incident.

#How many customers were affected

It is unclear how many customers were affected. TechCrunch noted that Applebee's had at least 8.5 million rewards members as of last year, but the company would not say how many were exposed.

#No reporting mechanism

Neither Applebee's nor Dine Brands had a way to report security issues at the time of the discovery, according to TechCrunch.

#What to do if you have an Applebee's account

#1. Assume scammers may have your basic info

Even though Dine Brands says it has not found evidence of unauthorized access, Malwarebytes notes that we do not know whether anyone accessed the database before the fix. So watch for targeted scams.

Assume scammers may know:

• Your name
• Your email address
• Your phone number
• Your date of birth
• Your ZIP code

#2. Watch for Applebee's-themed phishing attempts

Be wary of unexpected Applebee's-themed emails, texts or calls, especially messages that:

• Offer refunds or compensation
• Warn that your account will be closed
• Ask you to verify payment details
• Claim there is a problem with your recent order

#3. Do not click links in unexpected messages

If you receive an unexpected message that appears to be from Applebee's, do not click any links or call any phone numbers in the message.

Instead, open the Applebee's app directly or type the website address (applebees.com) into your browser yourself.

#4. Never give sensitive details to someone who contacts you

Your Applebee's password and payment card were not among the listed fields that were exposed, but scammers may still try to trick you into giving them up.

Never give anyone who contacts you:

• A credit or debit card number
• A password or security question answer
• A one-time code sent to your phone or email

Legitimate companies will not ask for these details in an unexpected call, email or text.

#5. Change your password if you reused it

Your Applebee's password was not among the listed fields that were exposed, but if you reused your Applebee's password on other sites, changing it is cheap insurance.

Turn on two-factor authentication where offered.

#6. Consider a credit freeze if you are worried about identity theft

Your birthday is often used as a security question or identity check at banks, credit card companies, and other services.

If you are worried about identity theft, consider a credit freeze. The FTC says anyone can freeze their credit at Equifax, Experian, and TransUnion for free, and it lasts until you lift it.

A credit freeze prevents new accounts from being opened in your name. When you need to apply for credit, temporarily lift the freeze at the bureau the lender uses, then refreeze it afterward.

To freeze your credit, contact all three nationwide credit bureaus:

• Equifax: Equifax.com/personal/credit-report-services, (800) 685-1111
• Experian: Experian.com/help, (888) 397-3742
• TransUnion: TransUnion.com/credit-help, (888) 909-8872

#7. Report scam messages

If you receive a scam text, do not click any links or reply. Forward the message to 7726 (SPAM) to report it to your wireless carrier. The FTC says this helps carriers spot and block similar messages.

Report scams to the FTC at ReportFraud.ftc.gov.

#How it spread

The story spread widely on social media, particularly on X (formerly Twitter), from October 30 to November 3, 2026.

#What makes this exposure different

Most data breaches involve an external attacker breaking into a system. This case is different: the credential was built into the app itself, meaning anyone who downloaded the app and knew how to decompile it could extract the password and access the customer database.

TechRadar noted that at press time, Applebee's had not notified customers or publicly disclosed the incident, and there was no indication the data had been exfiltrated or leaked on the dark web.

Malwarebytes noted that the exposed fields did not include payment card details or account passwords, but emphasized that not knowing whether anyone accessed the database before the fix means customers should remain vigilant for targeted scams.

#The big picture

This incident is a reminder that your birthday, phone number, and email address are often enough for a scammer to make a phishing message feel real. A message that says your full name and knows your birthday looks more legitimate than a generic "Dear customer" message.

UndoLeak erases your data from data brokers and keeps it off.

If you are concerned about how much personal information is available about you online, run a free scan to see where your data appears.

#Sources

1. TechCrunch (Zack Whittaker, October 30, 2026): Applebee's exposed customers' personal data after leaving database password in app
2. Malwarebytes (Pieter Arntz, November 2, 2026): Applebee's customer data exposed by password left in app
3. TechRadar (November 2, 2026): Applebee's forced to fix serious security issue which exposed customer data
4. FTC: Credit Freezes and Fraud Alerts
5. FTC Consumer Alert (June 2023): Have you been getting scammy text messages?

When you take a photo with your phone, the image is not the only thing that gets saved. If Location Services is on for your Camera app, your phone saves the exact GPS coordinates of where you were standing inside the photo file itself. That information can be seen by anyone you share the photo with, and in one well-documented case, embedded location data helped authorities find someone who was actively hiding.

This guide explains how photo location metadata works, why it matters for your privacy, and the exact steps to turn it off or remove it before sharing.

#How photo location metadata works

Modern phones save a lot of information inside each photo and video file. This hidden data is called EXIF metadata (Exchangeable Image File Format), and it can include:

• The date and time the photo was taken
• The camera model and settings (aperture, shutter speed, ISO)
• GPS coordinates pinpointing the exact location

When Location Services is turned on for the Camera app, your iPhone uses GPS, Wi-Fi, and cell tower data to determine your location and embeds those coordinates into every photo and video you take. The same is true for Android phones with location access enabled for the camera.

Apple's own support documentation states: "When Location Services is turned on for the Camera app, it uses information from GPS and wireless networks to determine the location coordinates where the photo or video is taken. These coordinates are embedded into each photo and video."

The important part: Apple also says that "when photos and videos that include location metadata are shared, the people you share them with may be able to access the location metadata and learn where it was taken."

This means that unless you take steps to remove or hide it, anyone you text, email, or AirDrop a photo to can see exactly where you were when you took it.

#When photo location data revealed someone's hiding place

In December 2012, Vice published an article with a photo of tech entrepreneur John McAfee, who was in hiding and wanted for questioning by police in Belize. The article, which Vice later removed, was meant to show that the publication was with McAfee and he was safe. What Vice did not realize at the time was that the photo, taken with an iPhone 4S, contained embedded GPS coordinates.

Security researcher Mat Honan, writing for Wired, checked the metadata and found that "the location information embedded in the photo indicates the foursome is in Guatemala, specifically along the Rio Dulce in the Parque Nacional Rio Dulce. Near the Ranchon Mary restaurant. By a swimming pool."

McAfee initially claimed the data was faked. According to NPR, he later admitted the truth, calling it "the accidental release of my exact co-ordinates by an unseasoned technician at Vice headquarters."

Two days after the photo went up, Reuters reported that Guatemalan police arrested McAfee for illegally entering the country. Wired later wrote that the photo "effectively, forced McAfee out of hiding."

The case is often cited as a warning about the risks of photo metadata. While the circumstances were unusual (most people are not hiding from authorities), it demonstrates how easy it is to overlook location data and how specific the information can be.

#How to remove location from photos before sharing (iPhone)

You can remove location from a photo on a per-share basis, which means the photo in your library still keeps its location data, but the version you send will not include it.

1. Open the Photos app and select the photo you want to share.
2. Tap the Share button (the square with an arrow pointing up).
3. At the top of the share sheet, tap Options.
4. Turn off Location.
5. You'll see "Location Not Included" appear above the Options button.
6. Complete the share as usual (text, email, AirDrop, etc.).

Important: This only affects that one share. The photo in your library still has its original location data. If you share the same photo again later, you'll need to turn off Location again.

If you tap "All Photos Data" instead, the original photo with all metadata, including location, will be shared.

#How to stop iPhone Camera from saving location data

If you want to stop your phone from saving GPS coordinates in new photos entirely, you can turn off Location Services for the Camera app.

1. Open Settings.
2. Go to Privacy & Security.
3. Tap Location Services.
4. Scroll down and tap Camera.
5. Tap Never.

After you do this, new photos and videos will no longer have location coordinates embedded. Photos you took before making this change will still have their original location data.

You can also choose While Using the App if you want the Camera app to have location access only when you are actively using it, though this still saves coordinates in your photos.

#What about other platforms and devices?

#Android and Google Photos

If you use Android, the process to turn off camera location is similar, though the exact menu path varies by device manufacturer. On most Android phones:

1. Open the Camera app.
2. Go to Settings.
3. Look for Location tags, Save location, or GPS tag, and turn it off.

Google Photos has its own removal tool. Check the Google Photos Help page for current instructions on how to remove location from photos before sharing.

#Do social media platforms strip location from photos?

Most major social networks, including Instagram, Facebook, and Twitter, strip EXIF metadata (including GPS coordinates) when you upload a photo. However, this is not guaranteed across all platforms or upload methods, and policies can change.

The safest approach is to remove location yourself before posting, using the per-share method above or a dedicated EXIF removal tool. Do not assume the platform will do it for you.

#How to check if a photo has location data

On iPhone, you can check whether a photo includes location data:

1. Open the photo in the Photos app.
2. Swipe up or tap the info button (i).
3. If location is saved, you'll see a map showing where the photo was taken.

If you see "No Location Info", the photo does not have GPS coordinates embedded.

On a computer, you can view EXIF data by right-clicking the photo file, selecting Properties (Windows) or Get Info (Mac), and looking at the Details or More Info section.

#Why this matters for your privacy

Location metadata in photos can reveal:

• Your home address, if you take photos at home and share them.
• Your workplace, school, or places you visit regularly.
• Travel patterns, showing where you've been and when.
• Sensitive locations, such as medical offices, places of worship, or support groups.

For most people, sharing one photo with location data is not a crisis. The bigger risk comes from patterns. If you regularly share photos taken at home, at work, and at the gym, someone could piece together your daily routine.

The risk is higher for:

• People escaping abusive relationships or stalking
• Journalists, activists, or anyone whose safety depends on location privacy
• Parents who do not want their children's locations shared
• Anyone who posts photos publicly on social media

Even if you trust the person you're sending a photo to, that person's phone or account could be compromised, or they might forward the photo without thinking about the metadata.

#Make location removal a habit

The best approach is to turn off location for Camera entirely if you do not need it. If you do want location saved for your own records (for example, to organize travel photos), get in the habit of checking the Options menu before every share.

A few other photo privacy habits worth building:

• Check the background before posting. House numbers, street signs, school logos, and car license plates can be as revealing as GPS coordinates.
• Review your old posts. Go back through your social media and check for photos that show too much.
• Use a different profile picture on each platform, so your accounts are harder to link together.

UndoLeak erases your data from data brokers and keeps it off. Get a free scan to see where your personal information is listed online.

#Sources

1. Apple Support, "Manage location metadata in Photos" (Personal Safety User Guide, 2026). https://support.apple.com/guide/personal-safety/manage-location-metadata-in-photos-ips0d7a5df82/web
2. Apple Support, "Share photos and videos on iPhone" (iPhone User Guide for iOS 26, 2026). https://support.apple.com/guide/iphone/share-photos-and-videos-iphf28f17237/26/ios/26
3. Wired, Mat Honan, "Oops! Did Vice Just Give Away John McAfee's Location With Photo Metadata?" (Dec 3, 2012). https://www.wired.com/2012/12/oops-did-vice-just-give-away-john-mcafees-location-with-this-photo/
4. NPR, "Betrayed By Metadata: John McAfee Admits He's Really In Guatemala" (Dec 4, 2012). https://www.npr.org/sections/thetwo-way/2012/12/04/166487197/betrayed-by-metadata-john-mcafee-admits-hes-really-in-guatemala
5. Reuters, "Guatemala detains McAfee, to expel him to Belize" (Dec 2012). https://www.reuters.com/article/us-belize-mcafee-arrest-idUSBRE8B504H20121206/
6. Wired, Mat Honan, "How Vice Got John McAfee Caught" (Dec 6, 2012). https://www.wired.com/2012/12/how-vice-got-john-mcafee-caught/

Not affiliated with Apple, Vice, Wired, NPR, Reuters, or any company mentioned. John McAfee was a real person whose case has been widely reported; the details above are sourced from published news coverage. He denied wrongdoing and was wanted for questioning, not charged, at the time these events occurred.

Frontier Airlines passengers are reporting phishing emails that include their real booking details, confirmation numbers and even schedule changes the airline made. Here's what the emails ask for, what Frontier says about them, and what to do if you got one.

#What passengers are reporting

#Real booking details inside the emails

According to View from the Wing on November 2, 2026, Frontier Airlines passengers are reporting emails from scammers using their real flight details and confirmation numbers.

The blog post reports that in a Frontier GoWild! Pass Holders discussion, numerous passengers said they received these emails. Several report that the confirmation numbers matched actual bookings, including trips they had already taken and upcoming trips.

Privacy Affairs reported on November 2, 2026, that the emails "carry their real names, flight itineraries and booking confirmation numbers."

#Even schedule changes appeared

Privacy Affairs also noted that in some cases the phishing emails "even reflected schedule changes Frontier had made."

#What the emails say and where they lead

#Two versions reported

According to Privacy Affairs, one version says the booking has an "unconfirmed status due to payment." Another offers a "billing and adjustment refund."

View from the Wing reported that one reader's refund email blamed a ticketing error for duplicate taxes and fees.

#The lookalike site

Privacy Affairs reported that the links in the emails "go to a lookalike site whose address contains 'flyfrontier' but isn't Frontier's." The fake site asks for card details, a billing address and an email address.

#Some passengers entered card details

According to View from the Wing, some passengers say they entered card numbers on the fake site.

#Frontier's statement and advice

#Active phishing campaign confirmed

Frontier Airlines posted a phishing awareness page stating: "We are aware of an active email phishing campaign targeting our customers."

The page was also reported by NBC10 Philadelphia on November 2, 2026.

#What Frontier says it never asks for

Frontier says on the page: "Frontier Airlines does not email customers requesting flight, reservation, payment or contact detail information."

The airline says it will never contact you to:

• Revalidate or confirm an upcoming flight or reservation
• Re-enter or confirm credit card information
• Provide payment information to receive a partial or full refund
• Click a link or button to confirm card details, billing information, or a refund

#Where the data came from

As of November 2, 2026, Frontier hasn't said how scammers obtained passengers' booking data.

Privacy Affairs reported: "As of November 2, 2026, it hasn't said how the scammers got passengers' booking data." The phishing awareness page does not mention a data breach.

View from the Wing noted: "That doesn't tell us where the reservation information came from."

#What to do if you got one of these emails

#1. Don't click, don't reply

Don't click any link or button in the email, and don't reply to it. Don't use any contact information provided in the message.

#2. Check your trip directly

To check a trip, open the Frontier Airlines app or type the website address (flyfrontier.com) into your browser yourself. Log in to your account or use the "Manage Booking" feature with your confirmation code and last name.

Frontier recommends: "If you need to review a Frontier reservation, navigate to Frontier through the trusted website or app rather than through a link in the message."

#3. Remember Frontier's rule

Frontier does not email asking you to confirm a reservation, re-enter card details, or pay to get a refund.

#4. If you entered a card, call your card issuer

Frontier advises: "If you have provided payment information ... please contact your card issuer or financial institution."

Call the phone number on the back of your card. Ask for a new card. Include every card you tried, according to View from the Wing.

View from the Wing also notes: "Web forms can collect what you type before you press submit."

Watch your statements for unauthorized charges.

#5. If you entered a password, change it

If you entered a password on the fake site, change it everywhere you use it. Enable two-factor authentication on your accounts if you haven't already.

View from the Wing recommends: "Change reused passwords."

#6. Expect follow-up texts and calls

Be aware that scammers may follow up with phone calls or text messages pretending to be Frontier. Hang up and call the number on the official Frontier website if you want to verify anything.

#7. Report it

Report the phishing email to the FTC at reportfraud.ftc.gov.

#How scammers pick their targets

Scammers find email addresses, phone numbers, and other contact details from data brokers, people-search sites, old data breaches, and marketing lists. They use this data to personalize phishing attempts and make messages like these more convincing.

UndoLeak erases your data from data brokers and keeps it off. See where you're listed with a free scan.

#Sources

All facts in this article come from the following sources:

• Frontier Airlines: Phishing Awareness (2026)
• View from the Wing: Airline Passengers Are Getting Scam Emails With Real Confirmation Numbers—Some Frontier Customers Are Entering Credit Card Details (November 2, 2026)
• Privacy Affairs: Frontier Airlines Phishing Emails Use Real Booking Details (November 2, 2026)
• NBC10 Philadelphia: Frontier Airlines warns passengers to active email phishing scam (November 2, 2026)

Not affiliated with Frontier Airlines or any company mentioned.

When you upload a run to Strava, you're sharing a GPS trail. If that trail starts and ends at your home, and your activities are public, anyone can see where you live. This isn't hypothetical. In 2018, analysts used Strava's global heatmap to map secret military bases because soldiers were running laps inside restricted areas. In 2024, French newspaper Le Monde identified Secret Service agents protecting US presidents by their public Strava profiles, and tracked their runs to locations where Biden and Trump traveled before those trips were announced.

If you use Strava and your runs start at home, your address might be visible to strangers right now. Strava has privacy settings that can hide your home, but they're not automatic. This guide explains what the heatmap and StravaLeaks revealed, and the exact steps to hide your home address using Strava's Map Visibility settings.

#Watch: How Strava runs can show where you live

#What the Strava heatmap revealed in 2018

In November 2017, Strava released a global heatmap that showed every public activity uploaded to the platform, aggregated from more than 3 trillion individual GPS data points. The heatmap was supposed to be a visualization of where people exercise. In cities, it showed dense networks of running and cycling routes. But in remote areas, it revealed something else.

On January 27, 2018, Nathan Ruser, an analyst at the Institute for United Conflict Analysts, tweeted that the heatmap made US military bases clearly identifiable. In Syria, known coalition bases "light up the night," as analyst Tobias Schneider noted. In Afghanistan, Djibouti, and Syria, the users seemed almost exclusively foreign military personnel.

The Guardian reported on January 28, 2018:

"Zooming in on one of the larger bases clearly reveals its internal layout, as mapped out by the tracked jogging routes of numerous soldiers. The base itself is not visible on the satellite views of commercial providers such as Google Maps or Apple's Maps."

Because the heatmap was aggregated, it didn't show individual names or runs. But the patterns were clear. Soldiers running laps inside a base created bright loops on the heatmap. In areas where almost no civilians were active, those loops stood out.

The Guardian's follow-up article on January 29, 2018, noted that individual service members could be identified if their Strava profiles were public and linked to their real names. Strava argued that the information had already been made public by the users who uploaded it, which was technically true, but the heatmap made it searchable at a global scale.

Reuters reported in March 2018 that Strava responded by restricting street-level heatmap detail to registered users and hiding roads with little activity until several users uploaded routes there.

#What StravaLeaks revealed in 2024

On October 28, 2024, the Associated Press reported on an investigation by French newspaper Le Monde called StravaLeaks. Le Monde identified 26 US Secret Service agents, 12 members of France's GSPR (the security service protecting the French president), and six members of Russia's FSO (the Federal Protective Service) with public Strava accounts.

#The Biden hotel example

Le Monde found a Secret Service agent whose Strava profile revealed the hotel where President Biden later stayed in San Francisco for talks with Chinese President Xi Jinping in November 2023. According to the AP:

"A few hours before Biden's arrival, the agent went jogging from the hotel."

The agent's run, visible on Strava, showed the exact hotel before Biden's visit was publicly announced. The Secret Service responded:

"We do not assess that there were any impacts to protective operations or threats to any protectees."

#Macron's private trips

Le Monde also tracked French security agents' runs to reveal President Emmanuel Macron's private weekend in Honfleur, a coastal town in Normandy, in 2021. The agents' Strava activities showed when and where Macron traveled, even when those trips were not on his public schedule.

Macron's office said the consequences were "very slight."

#The wider risk

Le Monde did not name the agents they identified, but the investigation showed how identifying bodyguards "could also help in finding other details about their personal addresses, their families."

LSU professor Ibrahim Baggili, quoted in the AP story, noted that fitness app data can be used to track potential victims for stalking or robbery.

The StravaLeaks stories were not about Strava leaking data. The agents' profiles were public. Strava was working as designed. The problem was that the agents, and millions of other users, did not realize that public Strava activities starting at home reveal home addresses.

#How Strava's Map Visibility setting works

Strava introduced Map Visibility settings to let you hide parts of your activity map. According to Strava Support, after your first upload, the first and last 200 meters (about 650 feet) of future activity maps are hidden by default. But 200 meters might not be enough if you run a small loop or if your home is on a visible street.

Map Visibility gives you three options:

1. Hide activities near an address. You enter your home address (and work, gym, or other frequent locations), and Strava hides the start and end of activities within up to 1 mile of that address. This applies to past and future activities, unless you previously edited individual activities using the per-activity setting.

2. Hide the start and end of all activities. This hides the start and end of every future activity, regardless of location. It does not apply to past activities.

3. Hide the entire map. This hides the entire route for all future activities. Only you can see the map. It does not apply to past activities.

Strava's documentation includes an important caveat:

"Applying Map Visibility settings to your activity does not mean it would be impossible for someone to deduce a hidden location using additional information."

If you run the same route every day and someone knows your neighborhood, they might still figure out where you start. But Map Visibility makes it much harder.

#Six steps to hide your home on Strava

Do all six steps to protect your privacy. These steps work on both the Strava app (iPhone and Android) and the website.

#Step 1: Set Map Visibility to hide your home address

This is the most important step. It hides the start and end of your activities near your home, and it applies to past activities automatically (unless you edited them individually).

On the Strava app:

• Open the app and go to the You tab (bottom right).
• Tap the settings icon in the upper right corner.
• Tap Privacy Controls.
• Scroll down to Additional Controls and tap Map Visibility.
• Tap Hide activities near an address.
• Enter your home address. You can add multiple addresses (work, gym, etc.).
• Slide the radius to the maximum distance (up to 1 mile).

On the Strava website:

• Go to strava.com and log in.
• Click your profile photo in the upper right, then Settings.
• Click Privacy Controls in the left sidebar.
• Scroll to Additional Controls and find Map Visibility.
• Select Hide activities near an address.
• Enter your home address and set the radius to the maximum.

#Step 2: Review who can see your activities

Map Visibility hides parts of your map, but it doesn't change who can see your activities. If your activities are set to Everyone, anyone on the internet can see them (minus the hidden start and end). If your activities are set to Followers, only people who follow you can see them. If your activities are set to Only You, only you can see them.

Check your activity privacy:

• In the app: You tab, settings icon, Privacy Controls, Activities.
• On the website: Settings, Privacy Controls, Activities.

Choose Followers if you only want friends to see your runs, or Only You if you want complete privacy.

#Step 3: Review your follower list

If your activities are set to Followers, check who follows you. If there are people you don't know, remove them.

On the app:

• Go to the You tab, tap your profile name, tap Followers.
• Tap a follower's name, then tap the three dots and select Remove Follower.

On the website:

• Click your profile photo, go to your profile, click Followers.
• Click a follower's name, then click Remove Follower.

#Step 4: Edit old activities that start at home

If you changed Map Visibility settings but some old activities still show your home, it's because you edited those activities individually in the past. You need to manually update them.

On the app:

• Open an activity, tap the three-dot menu in the upper right, tap Edit.
• Scroll down and tap Edit Map Visibility.
• Choose to hide the start and end, or hide the entire map.

On the website:

• Open an activity, click the pencil icon (Edit), scroll down to Map Visibility, and select your preferred setting.

Do this for any old activities that reveal your home.

#Step 5: Use a different profile name or location

If your Strava profile uses your full legal name and lists your home city, consider changing it. A first name or nickname is enough. Your profile location doesn't need to be specific.

Change your profile:

• In the app: You tab, settings icon, Edit Profile.
• On the website: Settings, My Profile.

#Step 6: Check other connected apps

If you use a Garmin, Fitbit, Apple Watch, or other device that syncs to Strava, check that device's app too. Your run might also upload to Garmin Connect, Apple Health, or another service, and those might have different privacy settings.

#What about the global heatmap?

The global heatmap at strava.com/heatmap still exists. After the 2018 controversy, Strava restricted street-level detail to registered users and hid low-activity roads until enough users uploaded routes there. If you set your activities to Only You or use Map Visibility to hide your routes, your activities should not contribute to the heatmap.

But the heatmap is aggregated and anonymized. The bigger privacy risk is your individual public profile showing runs that start at your home.

#Is Strava safe?

Strava is safe to use if you configure it correctly. The 2018 heatmap and 2024 StravaLeaks stories were not about data breaches or Strava selling your data. They were about users uploading public activities without realizing what they revealed.

The risks:

• Public activities that start at your home reveal your home address.
• Public profiles with your real name make it easy to connect your Strava account to your identity.
• If you follow strangers or accept follower requests from people you don't know, they can see your routes (if your activities are set to Followers).

The solutions are in the six steps above. If you use Strava with privacy settings configured, you can keep sharing your runs with friends without broadcasting your home address to the internet.

#Why running apps need better defaults

The problem with Strava, and other fitness apps, is that privacy settings are optional. New users don't know to hide their home address until they read a guide like this or hear about StravaLeaks. By then, months or years of runs might already be public.

Strava's default 200-meter hidden zone is a start, but it's not enough. A better default would ask new users, during onboarding: "Do you want to hide your home address on your activity maps?" with clear options and examples.

Until apps like Strava change their defaults, the responsibility is on users to find and configure these settings manually.

#The bigger picture: fitness apps and location privacy

Strava is one app. The same privacy issues apply to Garmin Connect, Nike Run Club, MapMyRun, and other fitness apps that upload GPS routes. If an app shows a map of your run, and that map is public, anyone can see where you start and end.

The six-step routine works for most fitness apps:

1. Find the app's map privacy or route privacy setting and hide your start and end locations.
2. Set your activities to private or friends-only.
3. Review your follower or friend list and remove people you don't know.
4. Edit old public activities if they show your home.
5. Use a nickname instead of your full name.
6. Check all connected apps and devices for separate privacy settings.

Location privacy also applies to photo metadata, Google Maps reviews, and data brokers. Our main guide, how to remove your personal information from the internet, covers the full process. If you're working on cleaning up your online presence, fixing your Strava privacy settings is one piece of a larger project.

#The six-step routine (summary)

1. Today: Open Strava, go to Privacy Controls, Map Visibility, and hide activities near your home address. Set the radius to the maximum (1 mile). Check your activity privacy (set it to Followers or Only You, not Everyone). Review your follower list and remove strangers.

2. Check old activities: Open activities from the past few months. If any still show your home, edit them individually (three-dot menu, Edit Map Visibility).

3. Review your profile: If your profile shows your full legal name and home city, change it to a first name and a general location.

4. Check connected apps: If you sync Strava with Garmin, Fitbit, Apple Watch, or other devices, check those apps' privacy settings too.

5. When you add new addresses: If you move, or start running from a new gym or work location, add those addresses to Map Visibility.

6. When you accept new followers: Only accept follower requests from people you know, or set activities to Only You.

These steps take about 10 minutes the first time. After that, it's a quick check whenever you add a new follower or upload from a new location.

#Sources

1. The Guardian, Alex Hern, "Fitness tracking app Strava gives away location of secret US army bases" (January 28, 2018). https://www.theguardian.com/world/2018/jan/28/fitness-tracking-app-gives-away-location-of-secret-us-army-bases

2. The Guardian, "Strava shuts down heatmap of military bases after backlash over secret army base locations" (January 29, 2018). https://www.theguardian.com/technology/2018/jan/29/strava-secret-army-base-locations-heatmap-public-users-military-ban

3. Reuters, "Exclusive: Fitness app Strava overhauls map that revealed military positions" (March 2018). https://www.reuters.com/article/technology/exclusive-fitness-app-strava-overhauls-map-that-revealed-military-positions-idUSKCN1GP1WF/

4. Associated Press, "Fitness app Strava gives away location of Biden, Trump and other leaders, French newspaper says" (October 28, 2024). https://apnews.com/article/biden-trump-macron-bodyguards-security-strava-0a48afca09c7aa74d703e72833dcaf72

5. Le Monde, StravaLeaks investigation (October 2024). https://www.lemonde.fr/en/stravaleaks/

6. Strava Support, "How Do I Edit My Map Visibility on Strava?" (2026). https://support.strava.com/en-us/articles/15402012-edit-map-visibility

7. Strava Support, "Privacy Controls" (2026). https://support.strava.com/en-us/articles/15401951-privacy-controls

UndoLeak erases your data from data brokers and keeps it off. We handle people-search sites, Google results, leaked photos, and ongoing monitoring so your information stays private. Start your free privacy scan.

Flock cameras are license plate readers, mostly used by police, that log a still image "sighting" of each passing vehicle. Flock says each sighting can include the make, color, direction, time, location, and plate when visible (Flock, Oct 19, 2026). Agencies can share searches across statewide and nationwide networks. You can't erase the camera's sighting, but you can see where cameras are, check your city's rules, and erase the name and home address that people-search sites attach to you.

Last updated: November 2, 2026

#What are Flock cameras?

Flock cameras are automated license plate readers (ALPRs) that capture still images of passing vehicles. Flock Safety, the company that makes them, says it has more than 120,000 cameras across 49 states (Stateline, Aug 14, 2026). A researcher's map built from Flock's own device database counted more than 170,000 cameras (TrestleWire, Sept 2026).

The cameras are typically mounted on poles near roads and intersections. They're small, often with a solar panel on top and a dark lens. Most drivers pass them without noticing.

#What does a Flock camera record?

Every time a car passes, a Flock camera captures still images. Flock says each sighting can include the make, the color, the direction of travel, the time, the location, and the plate, when it's visible (Flock, Oct 19, 2026).

Pass another camera, and that's another sighting. Line them up, and investigators can see where a car was seen over time. Each pass by another camera is a separate sighting.

#Does Flock use facial recognition?

No. Flock says it does not use facial recognition or identify drivers (Flock, Oct 19, 2026).

But it doesn't need to. Police can match a plate to its registered owner. The camera records the car, and the plate connects the car to a person through DMV records.

#Who can search Flock camera data?

Flock's main customers are police departments. And they can share. Agencies can opt into statewide and nationwide networks, so one search can reach cameras far from home.

The Electronic Frontier Foundation (EFF) reported in May 2025 that at least 4,000 agencies are able to run searches through some agencies in Flock's network (EFF, May 2025). Flock later stopped out-of-state searches of cameras in California, Illinois and Virginia (404 Media).

Every search requires a reason. Agencies log who searched, what they searched, and why.

#How long is Flock data kept?

It depends on the agency. Local police departments and cities set their own retention periods.

Flock cut its recommended default retention from 30 to 7 days in August 2026 and made Audit Assistance (a tool that logs and flags searches) mandatory for all customers (Flock, Aug 13, 2026; Stateline). But existing customers keep their current retention periods.

If you want to know your city's retention period, check for a transparency portal (see below) or ask your police department.

#Has Flock data been misused?

Yes. USA Today analyzed more than 75 million Flock searches from January 2023 to July 2026 across more than 6,300 agencies. Some of the reasons officers typed? "SUS", "TEST", or a single letter (USA Today, Aug 28, 2026).

In just two months, at least 19 police and sheriff's office employees in five states were arrested, fired, put on leave or placed under investigation (USA Today, Aug 28, 2026).

Court documents show a former Milwaukee police officer used Flock to search the location of his romantic partner 124 times (CNN, Aug 13, 2026).

Flock says its new Audit Assistance tool, now mandatory, logs all searches and flags suspicious activity. But the tool depends on agencies actually reviewing the alerts.

#Who else scans license plates?

Police cameras aren't the only ones. Repo trucks drive around with plate cameras too, scanning the cars they pass.

Many of those scans feed a private company called DRN Data, owned by Motorola Solutions. WIRED reported DRN has collected more than 15 billion vehicle sightings, partly from "affiliate" cameras on repossession trucks (WIRED, Oct 3, 2024).

DRN's customers include insurers, lenders, repo agents and private investigators. Vigilant gives police access to the same data (WIRED, Oct 3, 2024).

DRN markets "Radius Response" to insurers to detect a vehicle operating outside its designated radius (drndata.com/insurance). And those cameras don't only see plates. WIRED found DRN search results included lawn signs and bumper stickers outside homes, each with date, time and location (WIRED, Oct 3, 2024).

DRN is not Flock. It's a separate network, and most people have never heard of it.

#How do I find Flock cameras near me?

You can't see an official map, but you can see reported locations.

Step 1: Find the cameras near you

DeFlock's crowdsourced map (deflock.org) shows reported plate readers across the country. In October 2026, MapQuest added a Surveillance Layer to its app that plots them on your route (Engadget, Oct 16, 2026).

Both show reported locations, not an official inventory. But they're the closest thing to a public map.

Step 2: Check your city

Some police departments publish a Flock Transparency Portal, with camera counts, how long data is kept, how many searches were run, and who else can search it.

No portal? Ask your police department or city council. Local agencies set retention and sharing rules. You have a right to ask.

Step 3: California residents, send DRN a privacy request

If you live in California, you can send DRN (Digital Recognition Network) a privacy request to know or delete the personal information it holds about you.

Email: privacy@drndata.com with subject "California Rights Request", or call 1-800-538-4427 (DRN privacy page).

DRN says it may decline or limit requests and some data is excluded. Exceptions can apply, but you're allowed to ask.

Step 4: Erase the link to your front door

A plate on its own isn't your name. The Driver's Privacy Protection Act generally blocks using a plate to get the owner's name and address from DMV records (NY DMV).

But a stranger doesn't need your plate. Type your name into a people-search site, and many will show your home address. The FTC says these sites collect your information and sell it (FTC).

That part, you can erase. Opt out of people-search sites one by one. Then check again, because listings come back.

Our complete guide to removing your personal information from the internet walks through every major site. TruePeopleSearch removal, BeenVerified opt-out, and our 30-day plan break it down step by step.

California residents can use DROP to send one free deletion request to over 600 registered data brokers.

#What can I actually erase?

Here's the thing. You can't erase a camera on a pole. You can't delete a sighting that's already in the system.

But you can erase what turns your plate into your front door.

A plate reader logs your car. People-search sites log your name and home address. Put them together, and a stranger can find where you sleep at night.

The camera? That's outside your control. Your home address listed on Whitepages, Spokeo, TruePeopleSearch and dozens of other sites? That part, you can erase.

Start with a free scan at undoleak.com to see which people-search sites list your home address.

Then opt out site by site, or let UndoLeak do the heavy lifting. UndoLeak erases your data from data brokers and keeps it off, re-checking and erasing it again when it comes back.

#Related reading

• Is Your Car Tracking You for Insurance? The OnStar Case - GM's OnStar Smart Driver shared trip data with LexisNexis, who sold it to insurers
• Why Data Brokers Re-List You After Opt-Out - Why your information comes back and what to do about it
• How to Remove Your Address From Google - Use Google's Results about you tool
• LexisNexis Report Request: Your Complete Guide - How to request your free LexisNexis consumer disclosure report

#Quick recap

1. Flock cameras are license plate readers that log every passing vehicle. Flock says it has more than 120,000 cameras across 49 states.
2. Police can share searches across statewide and nationwide networks. At least 4,000 agencies can run searches through some agencies in Flock's network.
3. Searches have been misused. USA Today found reasons like "SUS" or "TEST". At least 19 officers were arrested or fired over two months.
4. The private network DRN has collected over 15 billion vehicle sightings and sells access to insurers, repo agents and private investigators.
5. Find the cameras near you with DeFlock's map or MapQuest's Surveillance Layer.
6. Check your city for a Flock Transparency Portal, or ask your police department.
7. California residents can send DRN a privacy request to know or delete personal information.
8. Erase the link to your home by opting out of people-search sites that list your name and address.

#Sources

Accessed November 2, 2026.

1. Flock Safety, "How Flock LPR cameras work: what they capture, what they don't, and the guardrails around their use" (Oct 19, 2026), https://www.flocksafety.com/blog/how-flock-license-plate-reader-cameras-work-what-they-capture-what-they-dont-and-the-guardrails-around-their-use
2. Flock Safety, "Flock Safety Guardrails Address LPR Privacy Concerns and Police Transparency" (Aug 13, 2026), https://www.flocksafety.com/blog/flock-guardrails-address-lpr-privacy-concerns-and-police-transparency
3. Stateline, "Flock Safety Tightens Safeguards as States, Cities Question Surveillance Network" (Aug 14, 2026), https://stateline.org/2026/08/14/flock-safety-tightens-safeguards-as-states-cities-question-surveillance-network/
4. TrestleWire, "Flock Safety Camera Count Map Sparks Trademark Complaint" (Sept 2026), https://www.trestlewire.com/article/flock-safety-camera-count-map-trademark-complaint
5. USA Today, "Flock camera investigation: Police arrested, fired over surveillance searches" (Aug 28, 2026), https://www.usatoday.com/story/news/nation/2026/08/28/flock-camera-investigation-police-arrested-fired-surveillance/91383586007/
6. CNN, "Flock cameras: Police push back on auditing and oversight controls" (Aug 13, 2026), https://www.cnn.com/2026/08/13/tech/flock-cameras-police-auditing-controls
7. 404 Media, "Flock Removes States From National Lookup Tool After ICE and Abortion Searches Revealed", https://www.404media.co/flock-removes-states-from-national-lookup-tool-after-ice-and-abortion-searches-revealed/
8. Electronic Frontier Foundation, "She Got an Abortion, So a Texas Cop Used 83,000 Cameras to Track Her Down" (May 2025), https://www.eff.org/deeplinks/2025/05/she-got-abortion-so-texas-cop-used-83000-cameras-track-her-down
9. WIRED, "License Plate Readers Can Photograph Your Political Signs, Bumper Stickers" (Oct 3, 2024), https://www.wired.com/story/license-plate-readers-political-signs-bumper-stickers/
10. DRN Data, "Insurance", https://drndata.com/insurance/
11. DRN Data, "Privacy and Security Statements", https://drndata.com/privacy-and-security-statements/
12. DeFlock, https://deflock.org/
13. Engadget, "MapQuest will now show you where Flock cameras are in your neighborhood" (Oct 16, 2026), https://www.engadget.com/2288729/mapquest-will-now-show-you-where-flock-cameras-are-in-your-neighborhood/
14. NY DMV, "Driver's Privacy Protection Act (DPPA)", https://dmv.ny.gov/records/drivers-privacy-protection-act-dppa
15. Federal Trade Commission, "What To Know About People Search Sites That Sell Your Information", https://consumer.ftc.gov/articles/what-know-about-people-search-sites-sell-your-information

Disclaimer: Dana Ruiz, plate DRZ 3417, and every screen shown are fictional recreations, not real people, plates or screenshots. General information, not legal advice. UndoLeak is not affiliated with Flock Safety, DRN, Motorola Solutions, DeFlock, MapQuest or any outlet named.

A scam email is hitting inboxes that passes every authentication check, because it's a real, signed Google security alert. Here's how the trick works, and how to check your account safely.

#How the scam works

Scammers have found a way to hide their message inside a genuine Google security alert.

According to PlayCISO, the attacker creates an app password on their own Google account and types the scam into the app password's custom name: a fake bill, an invoice, or a threat.

Google's systems then generate a genuine, signed "new app password" security alert that contains that name. The scammers forward the alert to their targets.

Because the alert is authentic and passes DKIM and DMARC email authentication checks, it gets through security filters.

#The University of Michigan example

The University of Michigan Safe Computing team flagged one of these emails on October 6, 2026. Some U-M community members reported receiving it.

The attack "leveraged a Google apps security notification to show a scammer's custom phishing message," the team wrote. The app password name contained a fake $399 McAfee invoice and a support phone number.

It was designed to make recipients think their account was compromised, "although no U-M account or system compromise occurred."

The goal: get the recipient to call the phone number.

#Why it passed email checks

The University of Michigan team explained that the attacker set the fake invoice and phone number as a Google app password label, "forcing Google's systems to generate an authentic, signed security alert containing the scammer's phishing message."

Google sent the alert to the scammer's recovery domain, which routed it through a compromised high school's Microsoft 365 tenant to auto-forward it to U-M.

"Stacking valid Microsoft and Google DKIM/DMARC signatures allowed the message to pass all gateway checks," the team wrote.

#The dead end that makes you call

According to the University of Michigan team, clicking the legitimate Google account links in these alerts leads to the recipient's own clean dashboard. That's an intentional dead end.

"The recipient only has one actionable resolution left in the email: calling the scammer's phone number," the team wrote.

PlayCISO also noted a variant with a 24-hour "permanent access" threat and a shortened link in the app password name. Gmail showed DKIM and DMARC passing.

#How to spot the scam

PlayCISO lists these giveaways:

• The alert and its real 'Check activity' button refer to someone else's account. If the email address shown isn't yours, it's not about your account.
• A link inside the alert wording. The normal buttons are fine, but a link embedded in the message text is a red flag.
• A false threat. App passwords can be revoked any time. Claims of "permanent access" or "24-hour deadline" are designed to push you into acting fast.
• Odd forwarding traces in 'Show original.' Check the email's full headers if you know how.

#What to do if you get one of these alerts

Google's safety guide recommends these steps for checking any Google security alert:

1. Don't call a number or use a link inside the alert. The scam relies on you taking that action.
2. Open your Google Account yourself. Type myaccount.google.com into your browser, or use the Google app.
3. Check Security, Recent security events. Look for unfamiliar locations or devices.
4. If you see something you don't recognize, secure your account. Change your password. Google's Account Help says app passwords are revoked when you change your Google Account password.
5. Report the email as phishing. In Gmail, click More, then Report phishing.

#If you already called

If you already called the number and gave remote access to your device or payment details:

• Contact your bank right away.
• Change your passwords, starting with your Google password and any financial accounts.
• Enable two-factor authentication if you haven't already.
• Check your Google Account's Security, Recent security events for unfamiliar activity.

#The earlier OAuth version

This isn't the first time scammers have exploited Google's security alerts.

BleepingComputer reported in April 2025 that phishers abused Google OAuth to spoof Google in a DKIM replay attack, using an OAuth app name instead of an app password name. Google said it had rolled out protections for that avenue.

As of November 1, 2026, no public statement from Google has addressed the app password variant specifically.

#How scammers pick their targets

Scammers find your email address, phone number, and other contact details from data brokers, people-search sites, old breaches, and marketing lists. They use that data to personalize phishing attempts and make messages like these more convincing.

UndoLeak erases your data from data brokers and keeps it off. See where you're listed with a free scan.

#Sources

All facts in this article come from the following sources:

• University of Michigan Safe Computing: App password created to sign in to your account (Oct 6, 2026)
• PlayCISO: Google App Password Phishing: Real Alert, Fake Threat (Oct 31, 2026)
• Google safety guide: Verify a security alert (2026)
• Google Account Help: Sign in with app passwords (2026)
• BleepingComputer: Phishers abuse Google OAuth to spoof Google in DKIM replay attack (Apr 20, 2025)

Not affiliated with Google or McAfee.

In April 2023, Reuters published an investigation based on interviews with nine former Tesla employees. According to the report, between 2019 and 2022, groups of Tesla employees privately shared via an internal messaging system sometimes highly invasive videos and images recorded by customers' car cameras.

One former employee described a video of a man approaching a vehicle completely naked. Images of crashes and road-rage incidents were also shared. Another former employee said: "We could see inside people's garages and their private properties."

Seven former employees told Reuters the software they used at work could show the location of recordings, which potentially could reveal where a Tesla owner lived.

Reuters contacted more than 300 former Tesla employees. Tesla did not respond to detailed questions sent to the company for this report.

Here's what the investigation found, what Tesla says about camera privacy, and the settings you can check today.

#What the Reuters investigation reported

On April 6, 2023, Reuters published a special report by Steve Stecklow, Waylon Cunningham, and Hyunjoo Jin titled "Tesla workers shared sensitive images recorded by customer cars".

The report was based on interviews with nine former employees who worked as data labelers for Tesla's self-driving program. Starting around 2016, Tesla employed data labelers to review car-camera clips and label objects for the self-driving system. The labeling work started in Africa and later expanded to the US. As of February 2023, Tesla employed around 675 data labelers in Buffalo, New York, according to the report.

#What the former employees said

According to the Reuters report:

• Between 2019 and 2022, groups of Tesla employees privately shared videos and images recorded by customers' car cameras through an internal messaging system.

• One former employee described a video of a man approaching a vehicle completely naked. "Also shared were images of crashes and road-rage incidents," the report stated. One former employee mentioned a 2021 crash video of a Tesla hitting a child riding a bike.

• Some postings were between two employees, others were seen by scores of people, according to the report.

• "We could see inside people's garages and their private properties," said another former employee.

• Seven former employees told Reuters the computer program they used at work could show the location of recordings, which potentially could reveal where a Tesla owner lived.

• Some recordings appeared to be made when cars were parked and off, one former employee said. Tesla used to receive such recordings with owner consent and has since stopped, according to the report.

#What Reuters could not verify

Reuters stated clearly what it could not independently confirm:

• Reuters could not obtain the videos described by the former employees.

• Reuters could not determine whether the practice continues or how widespread it was.

• Some former employees saw only legitimate work sharing, meaning not all employees witnessed inappropriate sharing.

Reuters contacted more than 300 former Tesla employees. More than a dozen answered, all anonymously. Tesla did not respond to detailed questions sent to the company for this report.

#What happened after the report

According to Reuters follow-up reporting in April 2023:

• A California Model Y owner filed a proposed class action lawsuit in the Northern District of California on April 7, 2023, the day after the Reuters report was published.

• US Senators Ed Markey and Richard Blumenthal wrote to Elon Musk on April 14, 2023, asking about the allegations.

The current status of the lawsuit has not been independently verified for this article. If you know the outcome, contact information is available on the Tesla court docket or the law firm handling the case.

#What Tesla says about camera data

Tesla has published guidance on its support pages and in vehicle owner's manuals explaining how camera data is collected and shared.

#Tesla Support: consent required, recordings remain anonymous

According to Tesla Support's page "Obtain a Copy of the Data Associated With Your Tesla Account":

"In order for camera recordings to be shared with Tesla, your consent is required and can be controlled through the vehicle's touchscreen at any time (Software > Data Sharing). Even if you choose to opt-in, camera recordings remain anonymous and are not linked to you or your vehicle, unless we receive the recording as a result of a safety event (such as a vehicle collision or airbag deployment)."

The support page includes a table showing what data is shared with Tesla:

Tesla's statement that camera recordings "remain anonymous and are not linked to you or your vehicle" applies unless there is a safety event. The Reuters 2023 report quoted the same line from Tesla's Customer Privacy Notice.

#Tesla Owner's Manual: images don't leave the vehicle by default

According to the Tesla Model Y Owner's Manual, section "Cabin Camera":

"By default, images and video from the camera do not leave the vehicle itself and are not transmitted to anyone, including Tesla, unless you enable data sharing."

The manual states that when data sharing is enabled, short clips are shared after a safety-critical event or for diagnostics. The manual also says:

• Camera recordings are not associated with your vehicle identification number (VIN).
• Tesla does not use facial recognition.
• You can adjust data sharing at any time: Controls, Software, Data Sharing, Allow Cabin Camera Analytics.
• You can see which features use the cabin camera: Controls, Software, Cabin Camera.

The manual emphasizes that you can change your data sharing settings at any time.

#How to check your Tesla Data Sharing settings

If you own a Tesla and want to review or change what camera data is shared, here's how, based on Tesla's owner's manual and support guidance.

#Step-by-step: review and adjust Data Sharing

1. In your Tesla, tap Controls on the touchscreen.
2. Tap Software.
3. Tap Data Sharing.
4. Review every toggle.
5. Turn off Allow Cabin Camera Analytics if you don't want cabin camera data shared.
6. Turn off any other camera or Autopilot analytics sharing toggles you don't want.

Menu names may vary by model and software version. Older or newer Tesla models may use slightly different names for these settings. The core path is Controls, Software, Data Sharing.

#What turning off data sharing does (and doesn't do)

• Turning off data sharing stops Tesla from receiving camera recordings, according to the owner's manual.

• It does not disable safety features that use the cameras. Autopilot, safety monitoring, and other features that rely on cameras continue to work.

• Sentry Mode and Dashcam footage stays on your USB drive. Those recordings are never shared with Tesla according to Tesla's support page, but they are stored locally. Protect your USB drive if you don't want others to access the footage.

#Other steps to consider

1. See what uses the cabin camera. Go to Controls, Software, Cabin Camera to see which features are using the camera.

2. Protect your Sentry Mode and Dashcam USB drive. Since those recordings stay local, anyone with physical access to your USB drive can view them. Remove the drive when you're not using those features, or encrypt the drive if your model supports it.

3. Request a copy of your Tesla data. Tesla's privacy page lets you request a copy of the data associated with your Tesla account. Visit the Tesla account privacy page to submit a request.

#What this means for Tesla owners

The Reuters investigation and Tesla's privacy disclosures present two different pictures.

Tesla's official stance is that camera recordings are only shared with your consent, they remain anonymous, and they are not linked to you or your vehicle unless there is a safety event like a crash.

The Reuters report, based on interviews with nine former employees, said that between 2019 and 2022, groups of Tesla employees privately shared videos and images from customers' car cameras, including highly invasive footage like a naked man, the inside of people's garages, and private properties. Seven former employees said the software could show the location of recordings.

Reuters could not obtain the videos, could not determine if the practice continues, and noted that some former employees saw only legitimate work sharing. Tesla did not respond to Reuters' questions.

#The data labeling context

The former employees interviewed by Reuters worked as data labelers. Their job was to review car-camera clips and label objects (pedestrians, cars, signs, obstacles) to train Tesla's self-driving system. This kind of human review is standard in the machine learning industry.

The allegations are about what happened to that footage after it was collected: that some employees shared it inappropriately through internal messaging, and that the software allowed them to see the location of recordings.

Tesla has not publicly addressed these specific allegations.

#Other connected cars and camera privacy

Tesla is not the only automaker with cameras that collect data. Many new cars come with driver-facing cameras, external cameras for parking and safety, and cameras used for advanced driver-assistance systems.

#Mozilla's 2023 car privacy review

In September 2023, Mozilla Foundation's Privacy Not Included team reviewed 25 car brands and gave all 25 brands its privacy warning label. Key findings:

• 84% (21 of 25) said they can share personal data with service providers, data brokers, and other businesses.
• 76% (19 of 25) said they can sell personal data.
• 92% give drivers little or no control over their data.

Only Renault and Dacia said that all drivers can have their data deleted.

The Mozilla review looked at privacy policies across the automotive industry, not just camera data. But it shows that automotive data collection and sharing is widespread, and most drivers have limited control.

#What you can do with any connected car

If you drive any car with cameras or connected features:

1. Read your car's privacy policy. Look for it in the owner's manual, in the car's settings, or on the automaker's website. Search for "data collection," "camera," "privacy," and "opt-out."

2. Review your car's app settings. Many automakers have companion apps. Check the app's privacy settings and data sharing options.

3. Turn off features you don't use. If you don't use remote start, stolen vehicle tracking, or other connected features, disable them in the car's settings or the app.

4. Protect local recordings. If your car records to a USB drive or SD card (like Tesla's Sentry Mode), remove the drive when you're not using it, or keep it secure.

5. Request your data. Many automakers let you request a copy of your data. Check the automaker's privacy page or contact customer support.

#Why this matters

The Reuters investigation is one of the few cases where former employees have spoken publicly about what happens to car camera footage behind the scenes.

Most privacy policies describe data collection in broad terms: "We may collect camera data to improve our products." The Reuters report made it specific: videos of a naked man, the inside of people's garages, and private properties, shared through internal messaging, with software that could show where the recordings were made.

Tesla says camera recordings are anonymous and require your consent. The former employees said they could see inside people's homes and their locations. Both statements can be true at the same time if the anonymization or access controls were not as strong as the policy suggested, or if the policy changed between when the recordings were made and when Tesla updated its disclosures.

The case also shows the limits of consent. Even if you agreed to share camera data "to improve safety and develop features," that may not feel like informed consent if you later learn that employees shared a video of someone naked or the inside of your garage.

#What you can do today

If you own a Tesla:

1. Go to Controls, Software, Data Sharing in your car.
2. Review every toggle.
3. Turn off Allow Cabin Camera Analytics and any other camera or Autopilot analytics sharing you don't want.
4. Remember: Sentry Mode and Dashcam footage stays on your USB drive, so protect that drive.
5. Request a copy of your Tesla data at Tesla's privacy page to see what Tesla has on file.

If you drive any car with cameras:

• Read the privacy policy.
• Review the app settings.
• Turn off connected features you don't use.
• Protect local recordings.

The Reuters investigation happened between 2019 and 2022. It's now 2026. Tesla has updated its privacy disclosures and data sharing controls since then. But the case is a reminder: the cameras in your car see what you see. The question is, who else sees it too?

UndoLeak erases your data from data brokers and keeps it off. Car cameras are one place your data can leak. We handle the rest: people-search sites, Google results, leaked information, and ongoing monitoring so brokers can't rebuild your profile. Run a free scan to see where your information is listed right now.

#Sources

1. Reuters, Steve Stecklow, Waylon Cunningham, Hyunjoo Jin, "Tesla workers shared sensitive images recorded by customer cars" (April 6, 2023)

2. ABC News Australia (syndicated full text of Reuters report), "Tesla workers shared sensitive images recorded by customer cars" (April 8, 2023)

3. Reuters, "Tesla hit with class action lawsuit over alleged privacy intrusion" (April 8, 2023)

4. Reuters, "Two U.S. senators write to Tesla CEO Elon Musk after Reuters probe" (April 14, 2023)

5. Tesla Support, "Obtain a Copy of the Data Associated With Your Tesla Account" (2025)

6. Tesla Model Y Owner's Manual, "Cabin Camera" (2025)

7. Mozilla Foundation, "It's Official: Cars Are the Worst Product Category We Have Ever Reviewed for Privacy" (September 6, 2023)

Not affiliated with Tesla, Reuters, or any company mentioned.

Your Discord messages in big public servers may soon show up in Google search results. Starting in mid-December 2026, Discord is rolling out a change that will let search engines index some messages from public channels.

Here's what's changing, who's affected, and how to turn it off before your messages go live on the web.

#What Discord is changing

On October 27, 2026, Discord announced that Discoverable Servers will have their content made easier to discover on the web (Discord blog, Oct. 27, 2026).

Discoverable Servers are the most public spaces on Discord. They're public servers with at least 1,000 members, at least eight weeks old, and meeting Discord's activity and safety requirements. More than 63,000 Discoverable Servers exist as of October 2026.

#Two rollouts: Server Web Pages on Nov 16, messages in search from mid-December

Starting November 16, 2026, all Discoverable Servers will have a Server Web Page, a default page built from the server's Server Profile if admins haven't made one. These pages may display Channel Summaries, which are automated summaries of discussions in public channels.

Starting in mid-December 2026, some messages from public channels may appear on Server Web Pages and in web search engines like Google. The rollout will be gradual. Messages will appear "in their own words," but usernames and avatars won't be shown alongside messages.

Channels where content may appear on the web will be labeled in Discord.

#What will and won't be indexed

What may appear:

• Messages from public channels in Discoverable Servers
• Messages sent after mid-December 2026 (when the rollout begins)
• Automated Channel Summaries on Server Web Pages

What won't appear:

• Messages sent before mid-December 2026
• Messages from private servers, DMs, or group DMs
• Usernames and avatars alongside messages
• Messages from members who turn off the Channel Messages setting before they post

#Who's affected

You're affected if:

• You're a member of a Discoverable Server (a public server with 1,000+ members)
• You post in public channels on that server
• You're not in the EU, UK, Canada, Brazil, Australia, or South Korea (where the setting is off by default)
• You're not a teen account (also excluded)

Discord's pilot included servers for NBA 2K, Rust, and Dead by Daylight communities, where admin and moderator posts were shown (Discord blog, Oct. 27, 2026).

You're not affected if:

• You only use private servers (servers that aren't Discoverable)
• You only use DMs or group DMs
• You're in the EU, UK, Canada, Brazil, Australia, or South Korea, where the setting is off by default
• You're under 18 and have a teen account

#How to turn off Discord messages in search (step by step)

To prevent your new messages from appearing in web search, turn off the setting before mid-December 2026.

1. Open Discord (desktop or mobile).
2. Go to User Settings (the gear icon next to your username).
3. Click Data and Privacy.
4. Find the Channel Messages setting (the exact in-app label may vary).
5. Turn it off.

One setting covers Channel Messages in every Discoverable Server. You don't have to turn it off for each server separately.

#What happens to messages already sent

Messages sent while the setting was on will stay up unless you delete them from Discord (Discord blog, Oct. 27, 2026).

If you turn the setting off today, any messages you sent in public channels before turning it off may still appear in search once the rollout begins in mid-December. To remove those, you'll need to delete them manually in Discord before mid-December.

#What admins can do

Server admins have their own controls. They can:

• Go to Server Settings > Web Presence.
• Choose which channels appear on the web, or opt all channels out.
• If nothing changes, public channels stay on by default.
• Turn off Channel Summaries (automated discussion summaries) for their server.

A server that doesn't want a Server Web Page at all has to switch back to a Community Server (Discord blog, Oct. 27, 2026).

Both the member setting (your Channel Messages toggle) and the admin settings are on by default for admins. Turning a feature off stops new content going forward, but already-published content may remain until removed (Discord Help Center, Oct. 27, 2026).

#Why this matters for privacy

The change means that a message you type in a big public Discord server could show up in a Google search weeks or months later, even though your username won't be attached to it.

#Public chats are a privacy risk

A public message can reveal more than you think. It can include:

• Where you work
• What city or neighborhood you're in
• Your schedule (when you're home, when you're traveling)
• Your username or handle on other platforms
• References to people in your life

When someone combines those clues with people-search and data broker listings, it's easier to find you in the real world.

Discord's policy makes this risk bigger. Before, someone had to join a server and scroll through channels to find a message you posted. Now, they can search Google.

#Channel Summaries won't respect your opt-out

Even if you turn off the Channel Messages setting, Channel Summaries (automated summaries of public channel discussions) will still appear on Server Web Pages unless the server admin turns them off (The Next Web, Oct. 28, 2026).

You cannot opt out of Channel Summaries as a user. Only admins can.

#Search engines have their own timelines

Even after Discord removes a message or you delete it, search engines have their own caching and indexing systems. It may take extra time or action for content to stop appearing in search results (Discord Help Center, Oct. 27, 2026).

If a message was indexed by Google before you deleted it, the cached copy may stay in search results for days or weeks. You may need to request removal from Google directly.

#Practical steps you can take now

Here's what to do before mid-December 2026:

#1. Turn off the setting before mid-December

Go to User Settings > Data and Privacy and turn off the Channel Messages setting. Do it before mid-December so new messages aren't indexed.

#2. Review what you've posted in public servers

Think about the big public Discord servers you're in. Have you posted messages that mention:

• Your city, neighborhood, or workplace
• Your schedule or travel plans
• Your real name, email, or username on other platforms
• Family members, roommates, or friends

Find those messages and delete them before mid-December. Once the rollout starts, even deleted messages may have already been indexed by search engines.

#3. Be cautious about what you post in public channels going forward

Even with the setting off, Channel Summaries may still reference topics you discussed. If you want a conversation to stay private, use a private server, a DM, or a different platform entirely.

#4. Check what personal details about you are already listed online

If someone searches for your name, what do they find? Are your home address, phone number, or email listed on people-search sites or data broker sites?

Removing those listings makes it harder for someone to connect a Discord message (even without a username) to your real identity. Our guide on how to remove your personal information from the internet walks through the full process.

#What about AI scraping and other concerns?

When Discord announced the change, some users expressed worries about AI scraping, according to TechCrunch's coverage reported by The Next Web (The Next Web, Oct. 28, 2026).

Discord's announcement did not address AI training or data sales. The blog post focused on making Discoverable Server content easier to discover on the web and in search engines.

What we know from Discord's announcement:

• Messages may appear in web search and on Server Web Pages.
• Usernames and avatars won't be shown alongside messages.
• Discord did not state that it sells messages or trains AI models on them.

If a message is indexed by Google, it's part of the public web. What happens to that data after that, whether Google or other companies use it for AI training or other purposes, is outside Discord's control.

#Regional differences: EU, UK, Canada, and others

In the EU, UK, Canada, Brazil, Australia, and South Korea, the Channel Messages setting is off by default given legal restrictions (Discord blog, Oct. 27, 2026).

If you're in one of those regions, your messages won't appear in search unless you turn the setting on.

Teen accounts (accounts for users under 18) are excluded everywhere.

Everywhere else, the setting is on by default. If you're in the US, for example, you need to turn it off manually.

#What happens after December 16

The rollout is gradual, so not every Discoverable Server will have messages indexed on day one. But once the feature is live, messages from public channels may start appearing in search results over the following weeks and months.

Discord has said that channels where content may appear on the web will be labeled (Discord blog, Oct. 27, 2026). Check for those labels in the servers you're in.

If you see a message of yours appear in search results after the rollout, and you've since deleted it or turned off the setting, you can request removal from the search engine. For Google, use the Remove outdated content tool.

#The bigger picture: social platforms and search indexing

Discord is not the first platform to make user-generated content searchable. Reddit posts have appeared in Google search for years, and Reddit has deals with Google to make its content more prominent in search results.

The difference with Discord is that many users thought of Discord as a more private, closed-off space compared to Reddit or Twitter. Public servers existed, but the content didn't show up in Google searches unless someone explicitly posted a link.

That assumption is changing. If you post in a public channel on a Discoverable Server after mid-December 2026, treat it the same way you'd treat a public Reddit comment or a public tweet: it may show up in search results, and it may be seen by people who never joined the server.

#Conclusion

Starting November 16, 2026, Discord Discoverable Servers will have Server Web Pages. From mid-December 2026, some messages from public channels in those servers may appear in web search engines like Google.

Your username won't be shown alongside your messages, but the message text itself may be indexed and searchable. Messages sent before mid-December won't be included.

To opt out:

1. Go to User Settings > Data and Privacy in Discord.
2. Turn off the Channel Messages setting before mid-December 2026.
3. Review and delete any past messages in public channels that you don't want indexed.
4. Don't post location, workplace, or schedule details in public channels.
5. Check what personal information about you is listed on data broker and people-search sites, and remove it.

The setting is off by default in the EU, UK, Canada, Brazil, Australia, and South Korea. Teen accounts are excluded. Everywhere else, it's on unless you turn it off.

UndoLeak erases your data from data brokers and keeps it off. If you want to see what personal information about you is already listed online, run a free scan.

#Sources

1. Discord, "Making Content from Discoverable Servers Easier to Discover" (Kelsey Duncombe-Smith, Oct. 27, 2026)
2. Discord Help Center, "Discoverable Server Web Presence" (Oct. 27, 2026)
3. The Next Web, "Discord public server messages are going to start appearing in Google search" (Oct. 28, 2026)
4. 9to5Google, "Discord updates server web pages for search" (Oct. 28, 2026)

You turned off Location History. You thought you stopped Google from tracking where you go. Then you learned you didn't, because there was a second setting you didn't know about.

In August 2018, the Associated Press published an investigation that found many Google services on Android and iPhone were storing location data even when users explicitly turned Location History off. Researchers from Princeton University confirmed it. The problem was that Location History and Web & App Activity were two separate settings, and Web & App Activity, which most people had never heard of, was turned on by default (Associated Press, Aug. 13, 2018).

Seven years later, in September 2025, a US federal jury found Google liable for collecting data from about 98 million users after they had turned off a tracking feature, in violation of privacy assurances in its Web & App Activity setting. The jury awarded roughly $425 million in damages (BBC News, Sept. 2025).

If you've turned off Location History and assumed that stopped Google from saving your location, this guide explains what actually happened, what the 2025 verdict means, and the settings you need to change right now.

#What the Associated Press found in 2018

The Associated Press investigation in August 2018 revealed that "Google wants to know where you go so badly that it records your movements even when you explicitly tell it not to." The report found that many Google services on Android devices and iPhones stored location data even with a privacy setting that users believed would prevent it (Associated Press, Aug. 13, 2018).

Researchers from Princeton University's Computer Science Department, specifically Jonathan Mayer's lab, independently confirmed the AP's findings.

The investigation found that even with Location History paused, some Google apps automatically stored time-stamped location data without asking. Specifically:

• Google Maps stored a snapshot of your location when you merely opened the app, even if you didn't search for anything or get directions.
• Automatic daily weather updates on Android phones pinpointed roughly where you were.
• Some searches that had nothing to do with location, like "chocolate chip cookies" or "kids science kits," pinpointed your precise latitude and longitude, accurate to the square foot, and saved it to your Google account.

The issue affected what the AP described as "some two billion users" of Android devices, plus hundreds of millions of iPhone users who relied on Google Maps or Google Search.

#Google's response in 2018

When the AP asked Google how users could prevent this tracking, Google pointed to a different setting: Web & App Activity. That setting was enabled by default.

Google said it provided "clear descriptions" of its settings and "robust controls" so users could turn off location tracking. But the descriptions were not as clear as Google suggested. The Location History setting's description said "Google will not be able to store your location" when it was off, but other Google services continued storing location through the separate Web & App Activity setting (AP, 2018).

It's important to note: this was what the AP found in 2018. Google's settings descriptions and data collection practices have been updated since then. This guide reflects how the settings work as of October 2026.

#The 2025 federal verdict: $425 million

In September 2025, a US federal jury found Google liable on two of three privacy claims related to the collection of data from millions of users after they had turned off a tracking feature (BBC News, Sept. 2025).

The verdict:

• Class size: About 98 million Google users and 174 million devices.
• Time period: July 1, 2016, to September 23, 2024.
• Damages: $425.7 million, roughly $4 per device (Associated Press, Sept. 2025).
• Key finding: The jury found Google liable for violating privacy assurances in its Web & App Activity setting, but did not find that Google acted with malice.

The class action, filed in July 2020, alleged that Google collected location and other data through the Firebase SDK and Google Mobile Ads SDK embedded in hundreds of thousands of non-Google apps, including apps from Uber, Lyft, Alibaba, Amazon, Instagram, and Facebook, even when users had turned off Web & App Activity or its sub-setting "Include Chrome history and activity from sites, apps, and devices that use Google services."

According to the class action website (googlewebappactivitylawsuit.com, 2026), the case applied to users who had Web & App Activity and/or the supplemental Chrome/apps sub-setting turned off, and whose data was sent to Google via the Firebase SDK or Google Mobile Ads SDK in non-Google apps.

#Google's position

Google denied improper tracking. In a statement after the verdict, Google said, "This decision misunderstands how our products work, and we will appeal it" (BBC News, Sept. 2025).

Google has stated that data collected via Google Analytics when Web & App Activity is off does not identify individual users.

As of October 2026, judgment has been entered, Google has asked the court to vacate the judgment, and Google may appeal. No payments have been made to class members yet (googlewebappactivitylawsuit.com, 2026).

#Location History vs Web & App Activity: what's the difference?

Google has multiple settings that control what data it saves, and they work independently. Turning one off does not turn the others off. Here's what each one does:

#Timeline (formerly Location History)

Timeline (called Location History before Google renamed it) saves a detailed map of where you've been with your device. When it's on, Google uses GPS, Wi-Fi, mobile networks, and sensors to record your precise location and save it to your account. You can see this history in the Timeline view in Google Maps.

Timeline is off by default. If you've never turned it on, Google is not saving a Timeline.

When Timeline is on, the location data is saved to your device. If you sign in to Google Maps on another device, you can access the same Timeline because it syncs across devices (Google Account Help, 2026; Android Help, 2026).

#Web & App Activity

Web & App Activity saves your searches, browsing, and activity on Google services. It's on by default. When it's turned on, Web & App Activity can include:

• Location information from your device's general area
• Location derived from your IP address
• Searches and other activity on Google Search, YouTube, Google Maps, Google Assistant, and other Google services

Web & App Activity has a sub-setting: "Include Chrome history and activity from sites, apps, and devices that use Google services." This checkbox controls whether Google also saves your activity from apps that partner with Google or use Google services, such as apps that use the Firebase SDK or Google Analytics (Google Search Help, 2026).

The 2018 AP investigation and the 2025 class action both centered on Web & App Activity, not Timeline.

#Other history settings

Google has other history settings under Data & privacy > History settings:

• YouTube History (Watch History and Search History)
• Search history (being updated; may appear separately from Web & App Activity in some accounts)

Each setting is independent. You need to review and configure each one.

#How to stop Google from tracking your location (step by step)

Here are the steps to turn off location tracking, delete existing activity, and set auto-delete for any history you choose to keep. Menu paths are based on the Google Account settings as of October 2026. Google has said it is updating Search settings, so some options may appear in different places depending on your account.

#Step 1: Turn off Web & App Activity and delete existing activity

1. Sign in to your Google Account.
2. Go to Data & privacy (you can visit myaccount.google.com/data-and-privacy directly).
3. Under History settings, find Web & App Activity and click or tap it.
4. Toggle Web & App Activity to off.
5. If the "Include Chrome history and activity from sites, apps, and devices that use Google services" checkbox is checked, uncheck it before turning the setting off (or uncheck it if you're keeping Web & App Activity on but want to stop collection from non-Google apps).
6. Choose Turn off and delete activity.
7. Select what to delete: you can delete all activity, or choose a time range. If you want to delete everything, select All time.
8. Confirm the deletion.

#Step 2: Turn off Timeline (Location History) if it's on

1. In your Google Account, go to Data & privacy, History settings.
2. Find Timeline (or Location History on older accounts) and click or tap it.
3. If it's on, turn it off.
4. Choose Turn off and delete activity if you want to delete existing Timeline data.

#Step 3: Review and turn off other history settings

While you're in History settings, check every setting listed:

• YouTube History (Watch History, Search History)
• Search history (if it appears separately; Google is updating this)
• Any other history settings shown

For each one you want to turn off, click it, turn it off, and choose Turn off and delete activity.

#Step 4: Set auto-delete for any history you keep on

If you choose to keep any history setting on (for example, you find Web & App Activity useful for personalized search results), you can set Google to auto-delete old activity.

1. Go to the history setting you want to configure (for example, Web & App Activity).
2. Look for Auto-delete and click or tap it.
3. Choose 3 months, 18 months, or 36 months.
4. Save your choice.

Auto-delete will automatically delete activity older than the time you selected. 3 months is the most privacy-protective option if you decide to keep a setting on.

Google also automatically deletes location information and IP address from Web & App Activity after 30 days, even if you have the setting on (Google Account Help, 2026).

#Step 5: Review and delete activity at myactivity.google.com

Even after turning off settings and deleting activity through the History settings pages, it's a good idea to visit myactivity.google.com and confirm everything is deleted.

1. Sign in to myactivity.google.com.
2. Click Delete on the left sidebar.
3. Choose All time.
4. Select All products (or choose specific Google products).
5. Confirm the deletion.

#Step 6: Review location permissions for Google apps on your phone

Turning off Google Account settings stops Google from saving location to your account, but you should also review which Google apps on your phone have location permission.

On iPhone:

1. Open Settings, Privacy & Security, Location Services.
2. Scroll through the list of apps and check Google apps like Google Maps, Google Search, Gmail, YouTube, etc.
3. For each app, choose Never, Ask Next Time, or While Using the App depending on whether you need that app to access your location.

On Android:

1. Open Settings, Location, App location permissions (the path varies by Android version and phone manufacturer).
2. Check Google apps.
3. For each app, choose Don't allow, Ask every time, or Allow only while using the app.

Avoid Always or Allow all the time unless you have a specific reason, such as navigation apps you use for turn-by-turn directions.

#What the settings changes actually do

Turning off Web & App Activity and Timeline stops Google from saving new location data to your account through those settings. It does not:

• Delete data Google collected before you turned the settings off, unless you also choose "Turn off and delete activity" or manually delete activity at myactivity.google.com.
• Stop all data collection. Google may still collect location data for other purposes, such as real-time traffic analysis, fraud prevention, or ad measurement, under different terms.
• Delete data already shared with third parties. If apps used the Firebase SDK or Google Analytics and sent your data to Google before you changed your settings, that historical data may still exist in aggregate or anonymized form.

The 2025 class action verdict addressed data collected when Web & App Activity was already off. The steps above stop future collection, but the court case shows that enforcement and interpretation of these settings is still evolving.

#What about the $425 million? Will users be paid?

As of October 2026, judgment has been entered in the class action case, but Google has asked the court to vacate the judgment and may appeal. No payments have been made to class members yet (googlewebappactivitylawsuit.com, 2026).

If you were a Google user between July 1, 2016, and September 23, 2024, and had Web & App Activity or its Chrome/apps sub-setting turned off during that time, you may be part of the class. The class action website is googlewebappactivitylawsuit.com. Check the site for updates on the case status and any eventual claims process.

#The bigger picture: why this matters

The 2018 AP investigation and the 2025 jury verdict show a common pattern in tech privacy: settings don't always work the way users expect them to work.

When you turned off Location History in 2018, you likely thought you had stopped Google from saving your location. The setting's own description suggested that. But the actual behavior was more complicated: Location History controlled one specific feature (the Timeline map), and a separate setting, Web & App Activity, controlled location saving in most other Google services.

Even if you read both settings carefully, the connection between them was not obvious.

The 2025 verdict found that Google collected data from apps even when Web & App Activity was off. Google disputes this and says the decision misunderstands how its products work. The case is likely headed to appeal.

For users, the takeaway is clear: if you want to stop location tracking, you need to turn off every relevant setting, delete existing activity, and periodically check that settings haven't changed.

#Does this affect other apps and services?

The issues described in this guide are specific to Google, but the underlying problem is not.

Many apps and services collect location data, and many have multiple settings that control different aspects of data collection. Turning off one setting may not turn off everything.

If you use other apps that collect location, such as social media apps, weather apps, or navigation apps, review their privacy settings as well. Check:

• Whether the app has location access in your phone's settings (Settings, Privacy & Security, Location Services on iPhone; Settings, Location, App location permissions on Android).
• Whether the app has its own in-app privacy settings that control data collection or sharing.
• Whether the app's privacy policy says it shares location data with third parties, and if so, whether there's an opt-out.

The steps to limit Google's location tracking are one part of a broader privacy effort. If you're also working to remove your personal information from data brokers and people-search sites, controlling location data makes that effort more effective. Our main guide, how to remove your personal information from the internet, covers the full process.

#The realistic routine (what to do now and later)

Here's a practical plan:

Today:

1. Turn off Web & App Activity in your Google Account (Data & privacy, History settings), uncheck the Chrome/apps sub-setting, and delete all activity.
2. Turn off Timeline if it's on, and delete all activity.
3. Check every other setting under History settings and turn off anything you don't need.
4. Visit myactivity.google.com, delete All time.
5. Review Google apps' location permissions on your phone and set them to While Using or Never unless you have a specific reason for Always.

Every few months:

1. Check myactivity.google.com to see if any new activity has been saved (it shouldn't be if settings are off, but it's worth confirming).
2. Review your Google Account's History settings to make sure nothing has turned back on (settings changes can happen after app updates or account changes).

When you install a new Google app or update an existing one:

1. Check what permissions it asks for. If it requests location, decide whether it needs it.
2. Check whether the app update reset any settings.

These steps take about 10 minutes the first time and a few minutes for each periodic check. The goal is not to make yourself invisible. The goal is to stop location data from being saved to your account when you've explicitly said you don't want it saved.

#Conclusion

Google tracked users' locations even when Location History was turned off, as the 2018 Associated Press investigation revealed. The actual setting that controlled most location tracking was Web & App Activity, a separate setting most users didn't know about. In 2025, a federal jury found Google liable for collecting data from about 98 million users after they had turned tracking off, awarding $425 million in damages. Google disputes the verdict and plans to appeal.

To stop Google from saving your location:

1. Turn off Web & App Activity (and its Chrome/apps sub-setting) in your Google Account at Data & privacy, History settings.
2. Turn off Timeline (formerly Location History).
3. Delete existing activity at myactivity.google.com, All time.
4. Set auto-delete to 3 months for any setting you keep on.
5. Review Google apps' location permissions on your phone.

Check these settings every few months to make sure nothing has turned back on. The 2018 investigation and 2025 verdict both show that privacy settings don't always work the way users expect, and stopping location tracking requires more than turning off the setting with "Location" in its name.

UndoLeak erases your data from data brokers and keeps it off. If you want to see where else your personal information is listed, run a free scan.

#Sources

1. Associated Press, "AP Exclusive: Google tracks your movements, like it or not" (August 13, 2018)
2. BBC News, "Google told to pay $425m in privacy lawsuit" (September 2025)
3. Associated Press, "Google to pay $425M after Silicon Valley jury finds internet company improperly tracked smartphone users" (September 2025)
4. Google Web & App Activity Lawsuit class action website, FAQ (2026)
5. Google Account Help, "Delete your activity" (2026)
6. Google Search Help, "Find & control your Web & App Activity" (2026)
7. Google, "Location data & privacy" (2026)
8. Android Help, "Manage your Location History" (2026)

On October 29, 2026, Binance experienced what appears to be the largest cryptocurrency theft on record.

According to Binance's Security Incident Update posted October 30, 2026, the company's initial investigation suggests the incident "may involve a compromised DevOps engineer's laptop, which allowed an attacker to gain access to a service container and submit unauthorized withdrawal transactions."

Binance says there is "no evidence of any wallet private key leak." The estimated total impact is around $6.3 billion. About $3 billion has been frozen on-chain so far. Binance says it "will cover all losses from the SAFU fund and the company's funds. User funds are safe."

Withdrawals were temporarily suspended while security checks were completed. Binance says it is working with law enforcement and blockchain intelligence partners.

#How the attack happened

BBC News reported that Binance is the world's largest crypto exchange by trading volume, with hundreds of millions of registered users. The hack hit Binance.com. Binance.US said it was not affected.

Binance co-CEO Richard Teng later said the hack was "not carried out by one person" and was a "more complex attack process," according to BBC News. A subsequent investigation "uncovered additional points of breach."

BleepingComputer reported that TRM Labs tracked about $6.36 billion moving out of Binance wallets on ten blockchains, most of it within about 20 minutes starting at 20:05 UTC on October 29.

BleepingComputer notes this is the largest crypto theft on record, about four times the $1.5 billion Bybit hack of February 2025.

#Attribution to North Korea

TRM Labs attributes the attack to TraderTraitor, a North Korea-linked group. Chainalysis confirms "with a high degree of confidence," according to BleepingComputer.

BBC News reports that this attribution is from analytics firms and has not been officially confirmed.

#What funds can be recovered

CNBC reports that frozen stablecoins are most recoverable. Returning funds can take months or years, according to Chainalysis' Eric Jardine.

#Scams that follow a big hack

After any major crypto incident, expect a wave of fake messages, support accounts, and recovery offers.

BBC News quoted NordVPN CTO Marijus Briedis warning to look out for:

• An email claiming your funds are at risk
• A fake support account offering help
• A message urging you to move your cryptocurrency to a "safe" wallet

Briedis said: "Check updates through the Binance app or a website address you already trust." And: "Avoid links in unsolicited messages, and never give anyone your password, verification codes or wallet recovery phrase."

Chainalysis and Malwarebytes both echo similar warnings: watch out for fake support or recovery offers, never give anyone your authentication codes, and be wary of anyone promising to recover crypto. The FBI has previously warned about fake recovery services that emerge after crypto thefts.

#Common scam tactics

Here are the patterns to watch for:

1. Fake "your funds are at risk" emails or texts that push you to act fast.
2. Fake support accounts on X, Telegram, or WhatsApp offering to "help" or "secure" your account.
3. "Move to a safe wallet" messages designed to trick you into transferring crypto to an attacker's address.
4. Fake compensation, refund, or recovery services promising to get back stolen funds.

#Practical steps

• Never share passwords, 2FA codes, or a recovery phrase. Real support will never ask for these.
• Never move crypto because a message says so. Open the app or type the site yourself.
• Set Binance's anti-phishing code if you use the exchange. This adds a personalized word or code to official Binance emails.
• Use app-based 2FA or passkeys instead of SMS where possible. They are harder to intercept.
• Check what personal details about you are listed online. Scammers personalize messages using emails, phone numbers, and addresses they find on people-search sites and data brokers. Removing those listings makes phishing attempts less convincing.

UndoLeak erases your data from data brokers and keeps it off. See where you're listed with a free scan.

#Sources

All facts in this article come from the following sources:

• Binance Security Incident Update (2026-10-30)
• Who could be behind the Binance hack and what we know so far
• Binance links $6.3 billion crypto theft to compromised DevOps laptop
• Billions in crypto frozen in Binance hack: Here's what happens next
• Binance Exploit: Latest Findings and Response
• Binance Hit by Largest Ever Crypto Theft with $6.3 Billion Stolen

#Related

• Coinbase Data Breach 2026: What the Amplitude Leak Exposed
• How Scammers Know Your Mom's Name (And Use Data Brokers to Target You)

Not affiliated with Binance.

Facebook's People You May Know feature can suggest someone you've never met on the platform. Here's how it works, why it suggests people you didn't add as friends, and the settings you can change to limit who sees you in those suggestions.

#Watch: Who gave Facebook your number?

This video explains how People You May Know works and what you can do about it.

#How Facebook's People You May Know works

According to Meta's Help Center, People You May Know suggests people based on several signals, including:

• Mutual friends
• Groups, networks or workplaces you share
• Contacts you or others uploaded

The contact-upload connection is the one that surprises people most.

#The contacts others uploaded

When someone uses Facebook's Find Friends feature or turns on continuous contact uploading in the app, Facebook gets the names, phone numbers and email addresses from their address book, according to Meta's Help Center page "How contact uploading works."

Facebook uses those contacts to check whether each person has an account, and to power suggestions and invitations.

That means if someone else uploaded your phone number or email, Facebook may suggest you to them and suggest them to you, even if you never gave Facebook that information yourself.

#The shadow profile

In November 2017, Gizmodo reporter Kashmir Hill investigated People You May Know and spoke with users who were recommended people they only knew from contexts Facebook shouldn't have known about.

One attorney told Gizmodo that Facebook recommended "a man who was defense counsel on one of my cases. We had only communicated through my work email." The attorney believed Facebook was scanning her work email.

Gizmodo reported that Facebook isn't scanning work email, but it likely had her work email address on file, even though she never gave it to Facebook herself. The attorney's case was, according to a Facebook spokesperson, "the likeliest case for a shadow-profile connection."

Gizmodo and others call the result a "shadow profile", built from the contacts other Facebook users handed over. Facebook doesn't like or use that term, and says it doesn't create profiles for non-users.

But when users share contacts, Facebook holds on to all the contacts they handed over, according to the Gizmodo investigation.

#Contact chaining

If two people both have your email or phone number in their contacts and both upload them, Facebook may infer that those two people know each other.

"This is how a psychiatrist's patients were recommended to one another," Gizmodo reported. Facebook says there can be other explanations, such as mutual friends or shared networks, and won't confirm specific connections.

A Facebook spokesperson told Gizmodo: "Today, we use contacts uploaded to Facebook and Messenger to inform PYMK suggestions."

#How to change who can find you by phone number or email

You can restrict who sees your profile in People You May Know based on your phone number or email address.

Go to your profile picture, then:

1. Settings & privacy, then Settings
2. Under Audience and Visibility, click How people find and contact you
3. Next to People with your phone number, click View
4. Change the setting

#Your options

According to Meta's Help Center page "Control who Facebook can suggest your profile to based on your email address or phone number," the options are:

• Possible Connections: People who uploaded your phone number or email and your Friends of Friends (this is the default)
• Friends of Friends
• Friends
• No one: Your profile won't be suggested to anyone based on your phone number or email address

Repeat for email. The setting for People with your phone number is separate from the setting for People with your email address. Change both if you want to restrict both.

#What this doesn't stop

Even if you set both to No one, Meta's Help Center says plainly: "People You May Know may suggest your profile based on information other than your email address or phone number."

That includes mutual friends, shared groups, shared workplaces and other signals.

#How to delete contacts you uploaded

If you've ever uploaded contacts to Facebook or turned on continuous contact uploading, those contacts are still on Facebook's servers unless you delete them.

#Turn off continuous contact uploading

First, turn off continuous uploading in the Facebook app on every phone where you turned it on. According to Meta's Help Center, disabling contact access in your phone's settings does not delete contacts already uploaded.

#Delete uploaded contacts

1. Go to the Uploading and managing your contacts screen in Facebook settings
2. Select Delete All

This deletes contacts you uploaded. It does not delete or affect contacts other people uploaded.

#For people who don't use Facebook

Meta offers a form for people who don't use its products to check whether their phone number or email appears in Facebook's address-book database and to request deletion and blocking.

The form is at facebook.com/contacts/removal.

#What phone numbers from two-factor authentication are used for

In July 2019, the Federal Trade Commission announced a $5 billion settlement with Facebook. As part of the order, the FTC alleged that Facebook didn't disclose that phone numbers users gave for two-factor authentication were also used for advertising.

The order prohibits Facebook from using phone numbers obtained for security features, such as two-factor authentication, for advertising.

#The practical steps

1. Set People with your phone number to No one (or Friends if you want to stay visible to your friends' friends). Go to Settings & privacy, then Settings, then How people find and contact you under Audience and Visibility.
2. Set People with your email address to No one (or Friends), using the same path.
3. If you ever uploaded contacts, turn off continuous contact uploading in the Facebook and Messenger apps on every device, then go to Uploading and managing your contacts and select Delete All.
4. Know the limits: Other people's uploads can't be deleted by you. Other signals, such as mutual friends, groups and workplaces, can still produce suggestions.
5. Optional: Use a separate email address for social accounts. This is general privacy advice with no specific source claim, but it limits the reach of any one address.

#Why this matters

Facebook's People You May Know suggestions can reveal private connections, such as the psychiatrist and patient example reported by Gizmodo. Changing the settings limits one pathway for those suggestions, but it doesn't eliminate them completely.

UndoLeak erases your data from data brokers and keeps it off. Free scan.

#Sources

1. Kashmir Hill, Gizmodo, "How Facebook Figures Out Everyone You've Ever Met" (Nov 7, 2017). https://gizmodo.com/how-facebook-figures-out-everyone-youve-ever-met-1819822691
2. Meta Help Center, "Control who Facebook can suggest your profile to based on your email address or phone number" (2026). https://www.facebook.com/help/131297846947406
3. Meta Help Center, "How contact uploading works." https://www.facebook.com/help/917434021127849
4. Meta Help Center, "Delete contacts uploaded to Facebook." https://www.facebook.com/help/147699975301738
5. Federal Trade Commission, "FTC Imposes $5 Billion Penalty and Sweeping New Privacy Restrictions on Facebook" (Jul 24, 2019). https://www.ftc.gov/news-events/news/press-releases/2019/07/ftc-imposes-5-billion-penalty-sweeping-new-privacy-restrictions-facebook

Not affiliated with Meta, Facebook, Gizmodo or any company mentioned.

In July 2017, Purple, a UK Wi-Fi provider, added a hidden "Community Service Clause" to its free Wi-Fi hotspot terms. Anyone who agreed would be required to carry out 1,000 hours of community service, including "Cleaning portable lavatories at local festivals and events," "Providing hugs to stray cats and dogs," and "Scraping chewing gum off the streets." The clause stayed in the terms for two weeks. 22,000 people signed up. Only one person spotted it and claimed the prize (Purple press release, Jul. 13, 2017; The Guardian, Jul. 14, 2017).

Purple said it would not enforce the clause. It was a publicity stunt to prove a point: nobody reads free Wi-Fi terms. But buried in those same unread terms is often another clause, a real one, that says the network can track you.

Every time your phone searches for Wi-Fi, it broadcasts a unique identifier called a MAC address. Free Wi-Fi providers, retail stores, and anyone operating a Wi-Fi network or sensor can detect that address and use it to see when you visit, how long you stay, and whether you come back. In 2013, one retail tracking company monitored approximately nine million unique mobile devices this way. The Federal Trade Commission stepped in, but only after the data had been collected (FTC complaint, In the Matter of Nomi Technologies, 2015).

If you've ever wondered whether free Wi-Fi is tracking you, the answer is yes, it can. Here's how it works, what the tracking companies did with the data, and how to turn on private Wi-Fi address or MAC randomization on your phone to stop it.

#How free Wi-Fi and stores track your phone

Your phone has a hardware address called a MAC address (Media Access Control address). It looks like this: 3C:7A:9F:21:B4:08. Every network-capable device has one. It's meant to be unique, and in most cases, it is.

When your phone searches for Wi-Fi networks, even if you don't connect to anything, it broadcasts that MAC address. Any nearby access point or Wi-Fi sensor can see it. If the same MAC address appears at the same location multiple times, the network operator knows it's the same device returning.

Retail stores, shopping malls, airports, cafes, and other public spaces have used this to track foot traffic and customer behavior. Some do it themselves. Others hire third-party companies to place Wi-Fi sensors or analyze access point logs.

#What the tracking companies saw

Nomi Technologies was one of the first companies to face regulatory action for this kind of tracking. Between January 2013 and September 2013, Nomi placed sensors in retail stores that detected MAC addresses from mobile devices searching for Wi-Fi. Nomi's sensors tracked approximately nine million unique devices during that period (FTC complaint, Apr. 23, 2015).

Even though Nomi hashed the MAC addresses, the FTC said the hashed addresses were still persistent unique identifiers. Nomi used them to generate aggregate reports for retailers, showing:

• How many people passed by the store vs how many entered
• Average visit duration
• Repeat customer rates
• Visits to other locations in the same retail chain

Nomi's privacy policy promised an in-store opt-out, but no such opt-out existed, and shoppers were not told they were being tracked. The FTC settled with Nomi in 2015. It was the first FTC case against a retail tracking company (FTC press release, Apr. 23, 2015; final order, Sep. 2015).

That was 2013. The tracking didn't stop. What changed is that Apple and Google both added features to randomize your phone's MAC address so networks can't track you the same way anymore. But those features have to be turned on, and on some phones or networks, they're off by default or get disabled when you connect to certain types of networks.

#What private Wi-Fi address and MAC randomization do

Instead of broadcasting your phone's real MAC address, private Wi-Fi address (iPhone) and MAC randomization (Android) make your phone use a temporary random address that changes periodically or per network.

When you connect to a free Wi-Fi network at a cafe, your phone presents a random MAC address. The next time you visit, it may present a different one (depending on your settings). The network can't tie those two visits together because the identifier changed.

#iPhone: Private Wi-Fi Address (Rotating or Fixed)

Starting with iOS 18, iPhone offers two modes for Private Wi-Fi Address (Apple Support, Dec. 2025):

• Rotating: Changes your private MAC address every 2 weeks. This is the default for open or weak-security networks. It makes it harder for networks to track you over time because the identifier keeps changing.
• Fixed: Uses one consistent private MAC address per network. This is the default for WPA2 and WPA3 secured networks. It's more stable (useful for home or work networks that expect a consistent device identifier) but still hides your real hardware MAC address.

Earlier iOS versions had a simple on/off toggle. iOS 18 added the Rotating/Fixed choice.

#Android: Use randomized MAC

Android 10 and later use a randomized MAC address by default (Android Open Source Project, 2026). You can enable or disable it per network in the network settings. Menu paths vary by phone manufacturer, but the setting is usually called "Privacy" or "Use randomized MAC."

Android's randomization can be persistent (one random MAC per network, similar to iPhone's Fixed mode) or non-persistent (a new random MAC each time you connect, similar to Rotating mode). Most Android phones use persistent randomization by default.

#How to turn on private Wi-Fi address on iPhone

1. Open Settings
2. Tap Wi-Fi
3. Tap the info button (i) next to the network you're connected to or want to configure
4. Tap Private Wi-Fi Address
5. Choose Rotating (for public or free Wi-Fi) or Fixed (for home or work networks)

Rotating is recommended for open networks, coffee shop Wi-Fi, airport Wi-Fi, hotel Wi-Fi, and any network where you don't want to be tracked. Fixed is better for your home or office network, especially if your router uses MAC address filtering or if you need a stable identifier for network access control.

If you're on iOS 17 or earlier, Private Wi-Fi Address is a simple on/off toggle. Turn it on.

You can also configure Private Wi-Fi Address before connecting to a network. In the Wi-Fi settings, tap the network name, tap the info button, and choose your setting before tapping Join.

#How to turn on randomized MAC on Android

The exact steps vary by phone manufacturer and Android version, but the setting is usually in the network details:

1. Open Settings
2. Tap Network & internet (or Connections on Samsung)
3. Tap Wi-Fi (or Internet)
4. Tap the network name or the gear icon next to it
5. Look for Privacy, Advanced, or MAC address type
6. Select Use randomized MAC (or Randomized MAC, or Use device MAC to turn it off)

On Android 10 and later, randomized MAC is on by default for new networks. If you see "Use device MAC" or "Phone MAC," that means randomization is off for that network. Change it to "Use randomized MAC."

Some Android phones label the setting differently. Common names:

• Use randomized MAC
• Randomized MAC address
• Privacy: Use randomized MAC
• MAC address type: Random

If you can't find the setting, search your phone's settings for "MAC" or "randomized."

#Other ways to protect yourself on free Wi-Fi

Turning on private Wi-Fi address or MAC randomization stops one type of tracking, the kind that relies on your device's hardware identifier. But free Wi-Fi terms often ask for other information: your email address, phone number, or social media login. Here's what else you can do:

#1. Give the minimum information at the sign-in page

When a free Wi-Fi captive portal asks for your email or phone number, use a secondary email address or a temporary email service if the network allows it. Skip any marketing checkboxes. Don't link your social media account unless you have to, and if you do, review what permissions the network is requesting.

Some networks won't let you connect without providing real information. That's your signal to decide whether the convenience is worth the data you're giving up.

#2. Forget public networks you no longer use

Your phone remembers networks you've connected to and may try to reconnect automatically. If you connected to a free Wi-Fi network at an airport, hotel, or cafe you don't visit often, forget the network after you leave.

On iPhone: Settings, Wi-Fi, tap the info button next to the network, tap Forget This Network.

On Android: Settings, Network & internet, Wi-Fi, tap the network, tap Forget.

Forgetting a network deletes it from your saved networks list and prevents your phone from broadcasting that it's looking for that network later.

#3. Use a VPN on public Wi-Fi

Private Wi-Fi address hides your MAC address from the network, but it doesn't encrypt your internet traffic. On open or weak-security Wi-Fi, anyone else on the network can potentially see what sites you visit or intercept unencrypted data.

A VPN encrypts your traffic between your device and the VPN server, so other people on the network can't see it. Many privacy-focused VPN services are available, some free, some paid. If you use public Wi-Fi often, a VPN is a good second layer of protection.

#4. Read the terms if you can

Most people don't read free Wi-Fi terms. Purple proved that. But if you have the time, skim them. Look for phrases like "we collect," "we share," "third parties," "advertising," and "location." Those sections tell you what data the network collects and who gets it.

If the terms say the network tracks your location, browsing history, or device identifiers, and you're not comfortable with that, don't connect.

#When you might need to turn private Wi-Fi address off

Private Wi-Fi address and MAC randomization work on most networks, but some networks or devices expect to see your real MAC address. You may need to turn it off in these cases:

• Home router MAC filtering: Some routers are configured to allow only specific MAC addresses to connect. If your router uses MAC filtering, add your phone's random MAC address to the allow list, or turn off Private Wi-Fi Address for your home network and add your real MAC address instead.
• University or corporate networks: Some schools and workplaces tie your network account to your device's MAC address for access control or billing. If the network won't let you connect with Private Wi-Fi Address on, you may need to turn it off and register your real MAC address with the network administrator.
• Smart home or IoT device setup: Some smart home devices, like cameras or smart plugs, expect your phone to have a consistent MAC address during initial setup. If setup fails, try turning off Private Wi-Fi Address temporarily, complete the setup, then turn it back on.

If you turn off Private Wi-Fi Address or MAC randomization for one specific network (like your home Wi-Fi), it stays on for all other networks. You can configure it per network.

#Why this matters

The Purple free Wi-Fi stunt and the Nomi Technologies case both show the same thing: when you connect to free Wi-Fi, you're often agreeing to tracking you didn't know about, and the tracking happens even if you don't connect, as long as your phone is searching for networks.

Nomi tracked nine million devices in 2013. That was before MAC randomization was common. Today, if you haven't turned on private Wi-Fi address or randomized MAC, your phone is still broadcasting the same identifier it did a decade ago. Stores, malls, airports, cafes, and anyone with a Wi-Fi sensor can still track you the same way Nomi did.

The FTC's settlement with Nomi was a start, but it didn't ban the practice. It just required transparency and a real opt-out. Many stores and Wi-Fi providers still track foot traffic via MAC addresses, and most people don't know it's happening.

Turning on private Wi-Fi address or MAC randomization takes 30 seconds. It stops one of the oldest and most widespread forms of mobile tracking. Do it for every public or free Wi-Fi network you use.

#Conclusion

Free Wi-Fi and retail stores can track your phone through its MAC address, a unique identifier your device broadcasts when searching for networks. One tracking company monitored nine million devices in 2013 before the FTC stepped in. 22,000 people agreed to clean toilets for free Wi-Fi without reading the terms, showing how easily consent is buried in agreements nobody reads.

Turn on Private Wi-Fi Address (Rotating mode) on iPhone or Use randomized MAC on Android for public and free Wi-Fi networks. It takes 30 seconds and stops the tracking.

On iPhone: Settings, Wi-Fi, tap the info button next to the network, Private Wi-Fi Address, choose Rotating.

On Android: Settings, Network & internet, Wi-Fi, tap the network, Privacy, Use randomized MAC.

Forget public networks after you leave, give the minimum information at Wi-Fi sign-in pages, and use a VPN if you're on public Wi-Fi often. Read the free Wi-Fi terms if you can, even though most people don't. That's how 22,000 people agreed to clean toilets.

UndoLeak erases your data from data brokers and keeps it off. If you want to see where else your personal information is listed, run a free scan.

#Sources

1. Purple press release, "22,000 sign up to clean loos in return for free WiFi" (July 13, 2017)
2. The Guardian, "WiFi terms and conditions: thousands sign up to clean sewage as they did not read small print" (July 14, 2017)
3. FTC complaint, In the Matter of Nomi Technologies, Inc. (2015)
4. FTC press release, "Retail Tracking Firm Settles FTC Charges It Misled Consumers About Opt-Out Choices" (April 23, 2015)
5. FTC press release, "FTC Approves Final Order in Nomi Technologies Case" (September 2015)
6. Apple Support, "Use private Wi-Fi addresses on Apple devices" (December 2025)
7. Android Open Source Project, "MAC randomization behavior" (2026)

Search your name and your city right now. For many people, the top results aren't their own profiles. They're people-search sites showing your address, your phone number, and your relatives. Those listings come from data brokers. California alone has over 600 of them registered (CalPrivacy).

So here's the full checklist, in the order that actually works. Seven steps. And step seven decides whether any of this lasts.

Last updated: October 30, 2026

#Can you completely remove yourself from the internet?

No. Public records, news articles, and government websites usually stay. Google won't remove most of those results. What you can do is remove the people-search listings that put your address on page one, the Google results that point to them, and the hidden data broker files that feed them.

For most people, that's enough. The stranger who could find your home address in four minutes will stop at an empty search page instead.

#Where should you start?

Step 1: See what a stranger sees.

Search your name in quotes, plus your city. Then your phone number. Then your email address. Write down every site that shows something about you. That list is your map. Every step after this works from it.

For example, our fictional character Jordan Hale (41, Tampa, Florida) searched his own name and found his home address on page one. He's fictional, like every screen in this video and guide, but the process is real.

Our free people-search check shows which people-search sites list your address and phone.

#How do you get off people-search sites?

Step 2: The people-search sites.

These are the sites that put your address on page one. The FTC says most of them let you opt out (FTC). Find your listing, find the opt-out link, and repeat. Site by site.

Start with the big ones. Privacy Guides points out that most of these sites are run by a small handful of companies (Privacy Guides). So one opt-out can clear several sites at once.

We've covered Whitepages, Spokeo, BeenVerified, and TruePeopleSearch in detail:

• TruePeopleSearch removal guide
• BeenVerified opt-out
• Intelius opt-out
• USPhoneBook removal

And even done by hand, it's not perfect. In a Consumer Reports study published in August 2024, manual opt-outs worked only 70% of the time (Consumer Reports).

For the complete walkthrough of 15 major sites, see our full guide to removing your personal information from the internet.

#Does Google's Results about you remove your info from the internet?

Step 3: Google's Results about you.

Google has a free tool called Results about you. Add your name, address, phone, and email. It watches search for pages that show them, and you can request removal right there.

Over 10 million people have used it (Google Blog, Feb 2026). But Google says it plainly: removing a result doesn't mean the info is gone from the internet. It still sits on the source page. That's why step two comes first.

Our step-by-step guide to removing your address from Google covers setup, alerts, and removal requests.

#What about data brokers you can't search?

Step 4: The brokers you never see.

Not every data broker runs a site you can search. Many sell your data behind the scenes, to marketers and to other brokers.

If you live in California, there's a shortcut. The state's free DROP tool sends one deletion request to over 600 registered data brokers (CalPrivacy). And they have to delete your data again every 45 days.

Everywhere else, it's broker by broker. Look for the privacy request or opt-out page on each one.

Read our complete DROP guide to learn how California residents can use this free tool.

#Should you delete old accounts?

Step 5: Old accounts.

That forum you joined years ago. The shop you ordered from once. Forgotten accounts still hold your name, your email, sometimes your address.

And they're easy targets. Google found abandoned accounts are at least 10 times less likely to have two-step verification on (Google Blog, May 2023). Delete what you don't use. Lock down the rest.

#What can't you erase?

Step 6: Breaches.

Some copies of you can't be erased. Breached data is already out there. Have I Been Pwned holds over 17 billion breached accounts (HIBP).

Check your email there. Change any reused password. Turn on two-factor. And if your Social Security number leaked, freeze your credit at all three bureaus. It's free (IdentityTheft.gov).

See our guide on what to do when your email is in Have I Been Pwned and how to freeze your credit.

#Why does your info come back, and how often should you re-check?

Step 7: Keep it off.

This is the step most checklists skip. Opt-outs don't stay done. The FTC warns that when your public records change, your information can reappear on people-search sites (FTC).

So check again, on a schedule. Privacy Guides suggests every three, six, or twelve months (Privacy Guides). Consumer Reports says twice a year (Consumer Reports).

Jordan? He opted out of nine people-search sites, filed his Google removals, deleted old accounts, and froze his credit. Four months later, his address was back on two sites.

Our 30-day plan to delete yourself from the internet breaks this down into a daily schedule.

#Quick recap

1. Search yourself: your name in quotes plus your city, then phone, then email
2. Opt out of people-search sites one by one, starting with the big ones
3. Use Results about you to remove Google results (doesn't remove source pages)
4. Reach hidden brokers: California DROP or each broker's opt-out page
5. Delete old accounts you don't use; lock down the rest
6. Lock down breaches: check HIBP, change passwords, two-factor, freeze credit
7. Keep it off: re-check every 3, 6, or 12 months

#Or let UndoLeak do the heavy lifting

UndoLeak erases your data from data brokers and keeps it off.

It sends removal requests for you, keeps checking the sites on a schedule, and re-files when a listing comes back. Start with a free scan at undoleak.com.

#Free checklist

• Search Google for your name + city, phone, and email
• Write down every site showing your information
• Set up Google Results about you with all your details
• Opt out of Whitepages, Spokeo, BeenVerified, TruePeopleSearch, and other sites on your list
• California residents: file a DROP request at privacy.ca.gov/drop
• Delete old accounts you don't use
• Check your email on Have I Been Pwned
• Change reused passwords and turn on two-factor authentication
• Freeze your credit if your SSN leaked (all three bureaus, free)
• Set calendar reminders to re-check every 3-6 months
• Re-check immediately after moving or changing your phone number

#Conclusion

You can't erase yourself from the internet, but you can make yourself much harder to find. The listings that show your address exist because nobody has done this work yet. Start with Google's Results about you, work through people-search opt-outs, file DROP if you're in California, and put your re-check dates on your calendar.

Which step are you starting with?

#Sources

Accessed October 30, 2026.

1. Federal Trade Commission, "What To Know About People Search Sites That Sell Your Information," https://consumer.ftc.gov/articles/what-know-about-people-search-sites-sell-your-information
2. Privacy Guides, "Data Removal Services," https://www.privacyguides.org/en/data-broker-removals/
3. Consumer Reports, "Services That Delete Your Data From People-Search Sites Don't Work Very Well, Study Finds" (Scott Medintz, Aug. 8, 2024), https://www.consumerreports.org/electronics/personal-information/services-that-delete-data-from-people-search-sites-review-a2705843415/
4. Google Search Help, "Find and remove personal info in Google Search results," https://support.google.com/websearch/answer/12719076
5. Google Blog, "Stay in control of your personal information online" (Phoebe Wong, Feb. 10, 2026), https://blog.google/products-and-platforms/products/search/results-about-you-government-id-numbers/
6. California Privacy Protection Agency, "DROP," https://privacy.ca.gov/drop/
7. California Privacy Protection Agency, "Personal information and data brokers," https://privacy.ca.gov/drop/personal-information-and-data-brokers/
8. Federal Trade Commission, "FTC Recommends Congress Require the Data Broker Industry to be More Transparent..." (May 27, 2014), https://www.ftc.gov/news-events/news/press-releases/2014/05/ftc-recommends-congress-require-data-broker-industry-be-more-transparent-give-consumers-greater
9. Google Blog, "Updating our inactive account policies" (Ruth Kricheli, May 16, 2023), https://blog.google/technology/safety-security/updating-our-inactive-account-policies/
10. Have I Been Pwned, https://haveibeenpwned.com/
11. IdentityTheft.gov, "Data Breach," https://www.identitytheft.gov/databreach

Disclaimer: Jordan Hale and every listing, form, and screen shown are fictional recreations, not real people or screenshots. General information, not legal advice. UndoLeak is not affiliated with Google, the FTC, CalPrivacy, Consumer Reports, Privacy Guides, or Have I Been Pwned.

One system, four airlines.

In late October 2026, Amadeus IT Group notified Japan Airlines, ANA, Korean Air and Asiana Airlines that traces were found indicating customer reservation data had been accessed externally. Amadeus provides the passenger service system these airlines use for flight reservations, ticketing and check-in.

Japan Airlines disclosed that approximately 92,000 customers were affected, with data accessed between August 2023 and September 2026. Korean Air, Asiana Airlines and ANA have confirmed incidents but have not yet disclosed customer counts or the full scope of data accessed.

The leaked booking details can be used to build convincing phishing messages that pretend to be the airline. This guide covers what was disclosed, what to do if you flew those airlines, and why a booking code matters.

#Watch: Amadeus data breach explained

This Short walks through the breach and what happens when a booking record leaks.

#What happened in the Amadeus data breach?

Amadeus IT Group is a provider of airline passenger service systems. Airlines use Amadeus software to manage flight reservations, ticketing and check-in procedures. In late October 2026, Amadeus notified Japan Airlines, ANA, Korean Air and Asiana Airlines that traces indicated customer data had been accessed externally.

#Japan Airlines and Japan Transocean Air

On October 28, 2026, Japan Airlines posted a notice titled "Regarding Unauthorized Access to Amadeus Passenger Service System".

JAL stated that on October 23, 2026, JAL and Japan Transocean Air were informed by Amadeus that traces were found indicating a portion of customer reservation data had been accessed externally. JAL described Amadeus as the provider of their Passenger Service System "that integrates flight reservations, ticketing, and check-in procedures."

Affected customers: approximately 92,000.

Data accessed:

• For approximately 90,000 customers: reservation code (PNR), name, flight date, flight sector, class of service.
• For approximately 2,000 customers, additionally: email address, phone number, passport number, nationality, frequent flyer number, airline name, flight number, ticket number, seat number, and other details.

Period: Records with traces of external access are dated from August 10, 2023 through September 23, 2026.

Not compromised: JAL stated "No compromise of credit card numbers or any passwords."

JAL also noted that Amadeus has completed security measures, that there is no evidence of misuse so far, and that there has been no impact on flight operations. JAL said it will contact affected customers and remind them to watch for phishing emails, fraudulent phone calls, and fake websites impersonating JAL. A dedicated inquiry desk was opened from October 29.

#Korean Air and Asiana Airlines

On October 23, 2026, Korean Air and Asiana Airlines confirmed customer data leaks from Amadeus.

According to Seoul Economic Daily and The Asia Business Daily, Amadeus notified Korean Air on the night of October 20, 2026.

Korean Air stated that the incident "resulted from unauthorized access using login credentials assigned to an Amadeus system account." The access is believed to have occurred between August 2023 and September 2026, with the exact timing under investigation.

Korean Air: Booking numbers were among the leaked data. The scale and data categories are not yet confirmed.

Asiana Airlines: Reservation-related information leaked. Payment information was not included.

Both airlines stated there were no signs that Korean Air or Asiana's own systems were breached. Korean Air emailed customers and warned against clicking unknown links or opening attachments.

#ANA (All Nippon Airways)

On October 29, 2026, ANA posted a notice that unauthorized access at contractor Amadeus may have led to leakage of customers' personal information. Kyodo News and Nikkei reported the disclosure.

ANA said there are traces some customers' personal information was viewed. The number of affected customers and the contents of the leaked data are still being investigated.

According to Nikkei and ITmedia, ANA uses Amadeus's Altea system for international reservations (since 2015) and domestic reservations (since May 2026). StarFlyer, which uses the system via ANA, posted a similar notice on October 29.

#What is a PNR, and why does it matter when it leaks?

PNR stands for Passenger Name Record, also called a booking code or record locator. It is a short alphanumeric code the airline gives you when you book a flight. Airlines use it to pull up your reservation.

A PNR plus your name and travel dates is enough for a scammer to build a message that looks like it came from the airline. Common scams include:

• Fake "re-confirm your flight" emails or texts with links to credential-harvesting sites.
• Calls claiming there is a problem with your booking and asking for payment or identity details.
• Passport verification phishing if the leak included passport numbers.

If the booking record also includes your phone number and email, the scammer can send a message that references your real flight and code. That makes the phish more convincing than a generic "your flight was canceled" spam.

The Record reported that Japan Airlines warned of the breach as the country grapples with a series of recent incidents. iSec News noted that the exposed reservation and identity details "could support targeted impersonation attempts."

#What to do if you flew JAL, ANA, Korean Air or Asiana

If you are among the affected customers, the airline will contact you. Here is what to do whether you receive a notice or not.

#Do not click links or call numbers in unexpected booking messages

If you get an email, text or call claiming to be the airline and asking you to re-confirm your flight, update payment, or verify your passport, do not click the link or call the number.

Open your airline app or type the official airline site into your browser yourself. Check your booking there for any unexpected changes.

#Check your booking for unexpected changes

Log in to your airline account or enter your confirmation code on the airline's official site. If the booking was changed, contact the airline using the official phone number from their website.

#Watch for passport-related scams if you were notified

If you were among the approximately 2,000 Japan Airlines customers whose passport numbers were accessed, watch for messages asking you to verify or re-submit passport details. Do not send a passport photo to an email address or upload it to a site linked from an unexpected message.

#Use a unique password and enable two-factor authentication

Change your password on your airline account and frequent-flyer account if you have reused that password anywhere. Use a unique password for each account.

Turn on app-based two-factor authentication or add a passkey to your account. That way a leaked password alone is not enough to get in. Prefer an authenticator app or passkey over text-message codes.

#Check where your contact details are listed online

Airline booking scams are more convincing when a scammer already has your name, phone number and home address from a people-search site. See how to remove your personal information from the internet.

UndoLeak erases your data from data brokers and keeps it off. A leaked booking record tells scammers your flight. Data brokers tell them where you live.

Run a free privacy check

#What the Amadeus breach does not tell us

The airline notices do not disclose who the attacker was, whether data has been published or sold, how the login credentials Korean Air mentioned were obtained, whether the same credentials were used for all four airlines, or whether other airlines using Amadeus were affected.

Amadeus IT Group has not issued a public statement as of the sources reviewed for this article.

#Related reading

If you are concerned about your data in airport and travel systems, see:

• How to Opt Out of TSA Facial Recognition at the Airport
• How to Remove Your Personal Information from the Internet

#Sources

1. Japan Airlines, "Regarding Unauthorized Access to Amadeus Passenger Service System" (October 28, 2026): https://www.jal.co.jp/en-jp/news/general/2026/other/261028.html

2. Seoul Economic Daily, "Korean Air says customer data leaked at booking system" (October 23, 2026): https://en.sedaily.com/finance/2026/10/23/korean-air-says-customer-data-leaked-at-booking-system

3. The Asia Business Daily, "Korean Air customer data leak" (October 23, 2026): https://www.asiae.co.kr/en/article/2026102321412357867

4. Kyodo News, "Unauthorized access at ANA contractor may have leaked customer data" (October 29, 2026): https://english.kyodonews.net/articles/-/89809

5. Nikkei, "ANA unauthorized access article" (October 29, 2026): https://www.nikkei.com/article/DGXZQOUC295CD0Z21C26A0000000/

6. ITmedia, "ANA Amadeus Altea article" (October 29, 2026): https://www.itmedia.co.jp/news/article/2610/29/2000002722/

7. StarFlyer, "Regarding unauthorized access to Amadeus passenger service system" (October 29, 2026): https://www.starflyer.jp/news/2026/news_20261029_info.html

8. The Record, "Japan Airlines warns of breach in passenger service system as country grapples with incidents": https://therecord.media/japan-airlines-warns-of-breach-country-grapples-with-incidents

9. iSec News, "Japan Airlines Amadeus Breach Exposes Reservation Data for 92,000 Travelers" (October 28, 2026): https://www.isec.news/2026/10/28/japan-airlines-amadeus-breach-reservation-data/

Not affiliated with Amadeus IT Group, Japan Airlines, ANA, Korean Air, Asiana Airlines, StarFlyer, or any organization mentioned.

Type your name into a search engine. Chances are, sites like Whitepages, Intelius and PeopleFinders will show your birthday, home address, marital status and a list of your relatives. Nobody hacked you. Much of this information is drawn from public records and social media profiles, according to Consumer Reports (Aug 8, 2024), by pulling it together in one place.

The scale is striking. When more than 500,000 Californians signed up for the state's free deletion platform in 2026, 99.9% of them had their profile deleted by at least one data broker, and the typical California DROP user had their information removed by over 40 brokers (CalPrivacy, Aug 25, 2026).

You can hide your address from Google Search with one free tool, and remove it from people-search sites by opting out one by one. Here's how.

#Watch: How did a stranger get your address?

This video explains how people-search sites build your profile and what you can do about it.

#Where people-search sites get your address

Nobody needs to hack you to find your home address. People-search sites collect it from:

• Public records, including real estate transactions, marriages, divorces, lawsuits, bankruptcies and arrests (Consumer Reports, 2024)
• Social media profiles, where you or others have shared your location, workplace or life events
• Data purchased from other brokers, who trade and resell the same records across hundreds of sites

According to Consumer Reports (Aug 8, 2024), "Just type your name into a search engine, and websites like Intelius, PeopleFinders, and Whitepages will display your birthday, home address, marital status, a list of your relatives, and more." Paid reports add even more detail from the same public sources.

The key fact: opting out doesn't erase the underlying public records. Those still exist at the courthouse or county recorder. What it does is stop that site from showing and selling your assembled profile.

#How to hide your address from Google Search

Google doesn't host people-search listings, but it's where most people find them. Removing the search result cuts off the easiest path to your address while you work on the source sites.

#Step 1: Open Results about you

Google's free Results about you tool monitors Google Search for your home address, phone number, email and government ID numbers. Over 10 million people have used it (Google, Feb 10, 2026).

In the Google app:

1. Tap your profile photo or initial
2. Tap Results about you

Some features are rolling out by country and are currently available for users over 18 in certain markets (Google Search Help, 2026).

#Step 2: Add your details

Enter your name and the contact information you want to monitor:

• Your full legal name, plus nicknames if you use them
• Your current home address
• Your phone number
• Your email address

You can add government ID numbers like your Social Security number. Google also monitors for those.

#Step 3: Turn on notifications

Turn on notifications so Google alerts you by email or in the Google app when new results appear. This saves you from having to search manually every few weeks.

#Step 4: Request removal for each result

Google lists search results that show your contact details. On each one:

1. Tap the result to expand it
2. Tap Request to remove
3. Follow the steps

Google reviews each request. It may keep results it considers valuable to the public, such as results from government websites, news outlets or business sites (Google Search Help, 2026).

#What Results about you does and doesn't do

It does:

• Hide the search result from Google Search
• Alert you when new results appear
• Work for addresses, phone numbers, emails and ID numbers

It doesn't:

• Remove the page itself from the web
• Delete your information from other search engines like Bing or DuckDuckGo
• Stop the people-search site from listing you

According to Google (Feb 10, 2026), "Removing this information from Google Search doesn't remove it from the web entirely." To take down the listing itself, you need to opt out at each people-search site.

Full walkthrough: Our step-by-step guide, How to remove your address from Google, covers setup, troubleshooting and what Google won't remove.

#How to remove your address from people-search sites

Every major people-search site has a free opt-out form. Most follow the same pattern: find your listing, copy its exact URL, paste it into the opt-out form, and confirm by email or phone.

#The most effective sites to opt out of first

Start with these five. They rank highest in Google for name searches and are the most likely to expose your address:

Full removal walkthrough: Our pillar guide, How to remove your personal information from the internet, has step-by-step opt-out instructions for 15 major people-search sites, including TruePeopleSearch, FastPeopleSearch, Instant Checkmate, TruthFinder, Radaris, Nuwber and more.

We also have dedicated removal guides for the biggest sites:

• How to remove yourself from Whitepages
• How to remove yourself from Spokeo
• How to remove yourself from Intelius
• How to remove yourself from PeopleFinders

#Before you start

Make a tracker. You'll need the exact URL of each listing when you opt out, so keep a simple spreadsheet:

Use a separate email address. Most opt-outs send a confirmation link. A dedicated email for privacy requests keeps your main inbox out of more databases.

#How effective are manual opt-outs?

In 2024, Consumer Reports and security firm Tall Poppy tested manual opt-outs against paid removal services with 32 volunteers across 13 people-search sites (Consumer Reports, Aug 8, 2024).

The findings:

• Manual opt-outs removed about 70% of profiles, and most worked within a week
• Paid removal services removed about 35% after four months (ranging from 4% to 68% depending on the service)
• Some sites made opting out harder with ID requirements or deceptive designs

The honest answer: doing it yourself takes more time up front, but it's more thorough.

#California residents: use DROP

If you live in California, you have access to the strongest removal tool in the country.

DROP (the Delete Request and Opt-out Platform at privacy.ca.gov/drop) is a free state service created by California's Delete Act. It sends one deletion request to more than 600 registered data brokers.

#How effective is DROP?

According to the California Privacy Protection Agency (CalPrivacy, Aug 25, 2026):

• More than 500,000 Californians have registered for DROP (launched Jan 1, 2026)
• 654 data brokers are now part of the system
• 99.9% of consumers have already had their profile deleted by at least one broker
• The typical California DROP user has had their information removed by over 40 brokers
• Sign-up "generally takes less than 10 minutes"

Since August 1, 2026, registered brokers must process DROP requests at least every 45 days.

#What DROP covers

DROP is California-only and covers registered data brokers. You'll still need to:

• Use Google's Results about you to remove Google Search results
• Opt out of individual people-search sites not covered by DROP
• Re-check every few months, because listings can reappear

Full DROP walkthrough: California DROP: how to delete your data from 600+ brokers at once

#Why your address comes back (and what to do about it)

Opting out stops a site from selling what it has now. It doesn't stop the site from collecting new information (Consumer Reports, 2024).

Your address can reappear when:

• You move and the new property sale becomes public record
• A relative's report lists you as an associate with your address
• The site buys a fresh batch of data from another broker
• You opted out of one listing but had several on the same site

Consumer Reports (2024) found that information can reappear on people-search sites, so experts suggest repeating opt-outs about twice a year.

#A simple maintenance schedule

• Week 1: Set up Results about you, opt out of every site on your tracker, and file DROP if you're in California
• Day 30: Re-check every listing URL and re-submit any that are still live
• Day 90: Search your name on Google again and check DROP status
• Every 3-6 months: Repeat the full search, especially after a move or phone number change
• Ongoing: Keep Results about you notifications on so you're alerted to new results

#The honest summary

Your home address is probably one search away right now. Type your name into a search engine and see for yourself.

You can't erase yourself from the internet, but you can make yourself much harder to find. Use Google's free Results about you tool to hide the search results. Opt out of Whitepages, Spokeo, BeenVerified, Intelius and PeopleFinders using their official forms. If you live in California, sign up for DROP and reach 600+ brokers at once.

Then put a re-check date on your calendar for three months from now, because listings come back.

UndoLeak erases your data from data brokers and keeps it off. Free scan.

#Sources

1. Consumer Reports (Scott Medintz), "Services That Delete Your Data From People-Search Sites Don't Work Very Well, Study Finds" (Aug 8, 2024): https://www.consumerreports.org/electronics/personal-information/services-that-delete-data-from-people-search-sites-review-a2705843415/
2. California Privacy Protection Agency (CalPrivacy), "Half a Million Californians Have Signed up for DROP to Delete Their Personal Information From Data Brokers" (Aug 25, 2026): https://privacy.ca.gov/2026/08/half-a-million-californians-have-signed-up-for-drop-to-delete-their-personal-information-from-data-brokers/
3. Google Search Help, "Find and remove personal info in Google Search results" (2026): https://support.google.com/websearch/answer/12719076
4. Google blog, "Results about you update" (Feb 10, 2026): https://blog.google/products-and-platforms/products/search/results-about-you-government-id-numbers/

All addresses, phone numbers and personal details shown in the cover illustration are fictional. Not affiliated with Google, Consumer Reports, CalPrivacy or any organization mentioned.

That airport face scan is optional.

At many US airport checkpoints, a TSA camera takes your photo and matches it to the photo on your ID. TSA calls this facial comparison. TSA says it is voluntary: you can decline and get a standard ID check instead.

A lot of people never hear that. In a 2025 report built from traveler-submitted scorecards, 99 percent said no officer told them they could opt out. TSA still says the photo is optional, and that saying no does not cost you your place in line.

This guide is the practical TSA facial recognition opt out: what the camera does, the words to use at the podium, whether TSA says it keeps your photo, and how that differs from TSA PreCheck Touchless ID.

#Watch: Can you opt out of the TSA face scan?

This video walks through the checkpoint opt-out and what TSA says happens to the photo.

#Can you opt out of a TSA face scan?

Yes.

TSA's FAQ, "Am I required to be processed by the biometric technology tested at an airport checkpoint?", answers:

"No. Facial comparison technology is voluntary. Tell a TSA officer if you do not wish to participate. The officer will use the standard ID verification process."

TSA's Digital Identity and Facial Comparison Technology page says the same thing in shorter form: "The photo is optional." It also says: "Tell the officer if you do not want your photo taken. You will not lose your place in line." If you plan to decline, TSA says to notify the officer before presenting your ID.

You do not have to take a picture at TSA.

#How TSA facial comparison works

This is not a search of a mugshot database. For the standard checkpoint camera, TSA describes 1:1 facial matching: a camera takes a picture of you and compares it to the image on the photo ID you just handed over, such as a passport or driver's license.

TSA calls the hardware Credential Authentication Technology 2, or CAT-2. On TSA's Biometrics Technology page, the agency says this approach "does not require a database of pre-staged images because it simply compares an image from the document presented by the passenger against an image taken of the passenger at the checkpoint."

TSA's Facial Comparison Technology fact sheet (2026) adds:

• CAT-2 units are deployed at approximately 350 airports.
• Signage at the camera says participation is voluntary.
• Travelers under 18 are not photographed.
• TSA says the technology is not used for surveillance or law enforcement. It is used to check that the person at the podium matches the photo on their ID.

If the live photo and the ID photo do not match, or if you decline the camera, TSA says the officer falls back to a manual ID check.

#How to opt out of TSA facial recognition

Do this at the ID podium, before you hand over your ID or step in front of the camera.

1. Walk up to the officer. Stay off the camera marks if you can see them.
2. Say: "I'd like to opt out of the photo." That wording is ours. TSA does not publish a script. TSA's FAQ only says to tell a TSA officer if you do not wish to participate.
3. Hand over your physical ID when asked. The officer checks it by hand.
4. Keep your place in the same line. TSA says this action will not take longer.

Say it early. The 2025 traveler report below found that some people who did not opt out were already scanned before they had a chance. TSA's Digital ID page also says: "If you decide to decline the optional photo, notify the TSA officer before presenting your ID."

TSA's fact sheet says travelers who decline "will receive an alternative ID credential check by the TSO at the podium," "without recourse." It also says: "This action will not take longer, and travelers will not lose their place in line for security screening."

If an officer tells you the camera is required, you can repeat that you want the standard ID check. TSA's published policy is that the photo is optional.

#Does TSA keep your photo?

TSA says usually no, with one stated exception.

The fact sheet says:

"Photos are not stored or saved after a positive ID match has been made except in a limited testing environment for evaluation of the technology's effectiveness."

The Digital ID page says, in TSA's words: "Your photo and personal data are deleted after your identity is verified." That line appears with a footnote marker on TSA's site. Treat it as what TSA says, not as an independent audit.

TSA also says images are not used for law enforcement or surveillance, and are not shared with other entities.

TSA PreCheck Touchless ID is different on timing. On the Touchless ID page, TSA says that under that opt-in program, "your photo and personal data are deleted within 24-hours of your scheduled flight departure." That is a separate program from the CAT-2 camera in a regular lane. See below.

#What a 2023 Washington Post report found

TSA's policy is clear on paper. Getting it honored at the podium has not always been.

On July 11, 2023, Shira Ovide wrote in The Washington Post: "You can say no to a TSA face scan. But even a senator had trouble."

When Sen. Jeff Merkley said no to the face scan at Washington's Reagan National Airport, "he was told it would cause a significant delay, a spokeswoman for the senator said."

There was no delay. The spokeswoman said the senator showed his photo ID to the TSA agent and cleared security.

The same column described another traveler, Tawana Petty, who asked at Reagan National whether the camera was optional and was told it was required. With a flight to catch and a line behind her, she went along. The Post noted it did not independently confirm either trip. TSA said it could not comment on individual interactions without more details.

The point of that reporting is not that the opt-out is fake. It is that some travelers have been told something different from TSA's written policy. TSA told the Post that saying no will not take longer and will not trigger extra screening. The fact sheet still says there is "no issue and no delay" when a traveler declines.

#What travelers reported in 2025

In July 2025, the Algorithmic Justice League published Comply To Fly?, a report on how travelers said they experienced TSA's facial recognition program.

This was not a random sample of all passengers. AJL asked people to submit a TSA scorecard through its Freedom Flyers campaign. The operational-period analysis covers 420 traveler-submitted responses from 91 US airports, for flights from March 1, 2024 through June 2, 2025. People who already care about face scans are more likely to fill out a scorecard. Read the numbers as reports from those travelers, not as a census of every lane.

From those scorecards, AJL reported:

• 99 percent said they were not told verbally by TSA officers that they could opt out. AJL wrote that only 4 travelers (1 percent) indicated officers asked for consent.
• Among the 174 respondents who did not verbally opt out, 47.7 percent said they did not know opt-out was an option, and 27.6 percent said they were scanned before they had a chance.
• Some travelers who did opt out described rude or hostile treatment, including raised voices and comments that they were being ridiculous.

AJL recommends halting TSA's use of facial recognition so the public can debate it. TSA's published position is the opposite on consequences: the fact sheet says travelers who decline get an alternative ID check "without recourse," will not lose their place in line, and "will not experience any negative consequences for choosing not to participate."

Both can be true in the record at once. TSA's policy says there is no penalty. AJL's self-reported scorecards say many people never heard the opt-out, and some who used it were treated poorly. If you want the opt-out, say it early and stay on the written policy: the photo is optional, and the fallback is a hand ID check.

#TSA PreCheck Touchless ID is a separate opt-in

Do not mix this up with the CAT-2 camera in a regular lane.

TSA PreCheck Touchless ID is a program you have to join. TSA's Touchless ID page says you need to be a current TSA PreCheck traveler with a valid passport, plus either:

• an active profile with a participating airline, where you add your Known Traveler Number and passport and select opt in, or
• a Google Wallet ID pass, then opt in from your boarding pass.

That program is 1:n matching. TSA's biometrics page says it uses CBP's Traveler Verification Service to compare a live photo to a gallery of photos you previously gave the government for travel, such as a passport. That is a different check from CAT-2's "this face vs. this ID."

TSA says consenting passengers can opt out at any time. If you enrolled and then change your mind, skip the dedicated Touchless ID lane and use a standard PreCheck or regular ID check. At the podium you can still tell the officer you do not want your photo taken.

Bring a physical ID either way. TSA says even Touchless ID travelers must carry a REAL ID-compliant physical ID and present it if asked.

#What opting out does not do

Declining the TSA camera only changes how your ID is checked at that checkpoint.

• It does not remove photos of you from the public web.
• It does not opt you out of private face search engines such as PimEyes.
• It does not take your name, address, or phone number off people-search sites.
• It does not stop airline, hotel, or border systems that use their own photos.

If the worry is "someone can find me from a picture," the checkpoint opt-out is one slice. Face search sites and people-search listings are a different problem. Start with how to opt out of PimEyes and how to remove your personal information from the internet.

UndoLeak erases your data from data brokers and keeps it off. The airport camera is one place your face is checked. Data brokers are where a name turns into a phone number and a home address.

Run a free privacy check

#Sources

1. TSA, "Am I required to be processed by the biometric technology tested at an airport checkpoint?" (2026): https://www.tsa.gov/travel/frequently-asked-questions/am-i-required-be-processed-biometric-technology-tested-airport

2. TSA, "Facial Comparison Technology" fact sheet (2026): https://www.tsa.gov/news/press/factsheets/facial-comparison-technology

3. TSA, "Digital Identity and Facial Comparison Technology" (2026): https://www.tsa.gov/digital-id

4. TSA, "Biometrics Technology" (2026): https://www.tsa.gov/biometrics-technology

5. TSA, "TSA PreCheck Touchless ID" (2026): https://www.tsa.gov/touchless-id

6. The Washington Post, Shira Ovide, "You can say no to a TSA face scan. But even a senator had trouble." (July 11, 2023): https://www.washingtonpost.com/technology/2023/07/11/tsa-airport-security-facial-recognition/

7. Algorithmic Justice League, "Comply To Fly?" report (July 2025): https://www.ajl.org/flyreport

Not affiliated with TSA, DHS, CBP, the Algorithmic Justice League, The Washington Post, or any organization mentioned.

Pwned means your email was found in a known data breach: compromised, not cursed. Have I Been Pwned is a free check, run by security researcher Troy Hunt since 2013. The first thing to do is open each breach and read what leaked. A password, a phone number, and a Social Security number each need a different fix.

Have I Been Pwned's own FAQ puts the rest plainly. Your email being in a breach is an immutable historic fact. It cannot be changed. The goal is to make the leaked data useless.

On October 29, 2026, the homepage listed 1,048 breached sites and 17,846,896,404 pwned accounts. If your address came up red, you are not the exception.

#What does Have I Been Pwned actually tell you?

Type in an email and Have I Been Pwned lists every breach in its database that includes that address: when it happened, and which data types leaked. Common classes are email addresses, passwords, names, phone numbers, and physical addresses.

What it will not show you is the password itself. The FAQ says any ability to send passwords to people would put them at greater risk.

Not every breach is a site you signed up for. Have I Been Pwned's public breach list includes National Public Data, a background-check service. That record is flagged unverified. The listed data classes include names, phone numbers, physical addresses, dates of birth, and government-issued IDs, and the description mentions US Social Security numbers and 134 million unique email addresses.

A fictional example: Dana Mercer, 29, Columbus, Ohio, checked one email and got four breaches (Canva, Dubsmash, MyFitnessPal, and National Public Data). Each one exposed a different mix. That is why the next step is not "change every password and close the tab." It is read the list.

For a wider hour-by-hour playbook that is not tied to this one site, see Your Email Was in a Data Breach: What to Do Now.

#What should I do in the next 10 minutes?

Do these in order. Each one matches a data type, not a feeling.

1. Read what leaked. Open each breach. Note whether it includes a password, a phone number, a home address, a Social Security number, or a card number. Each type has a different fix.
2. Change reused passwords and security questions. If a password leaked, change it on that site and everywhere you used the same one. The FTC's 2018 breach alert also says to change your security questions.
3. Use a password manager, then check Pwned Passwords. Unique passwords stop one leak from unlocking three other accounts. Pwned Passwords uses k-anonymity: only the first five characters of a SHA-1 hash go to the API, never the password. You can run the same private check with our password leak check.
4. Turn on two-factor authentication. A leaked password alone should not be enough to get in. Prefer an authenticator app or a security key over a text-message code.
5. Turn on Notify Me. Notify Me is free. It emails you when your address shows up in a newly indexed breach.

That is the ten-minute block. If the breach also has an SSN or a card number, keep going.

#What if my SSN or card number leaked?

Social Security number. IdentityTheft.gov says to check your credit reports and freeze your credit with all three bureaus. The freeze is free. Pull reports at AnnualCreditReport.com. Freeze Equifax, Experian, and TransUnion separately. Our credit freeze guide walks through all three, plus ChexSystems.

Payment card. The FTC says to request a new card number. If the company offers free credit monitoring, accept it.

Then expect the follow-up. In its Capital One alert, the FTC calls a data breach a magnet for scammers. Emails and calls will pretend to be the company, or the government. Do not click. Do not call the number in the message. Go to the site yourself. The 2018 alert also notes that caller ID can be spoofed.

#Is a clean result proof I'm safe?

No.

Have I Been Pwned's FAQ says the database "contains but a small subset of all the records that have been breached," and quotes the line: "Absence of evidence is not evidence of absence."

A clean result means this collection did not find your address. It does not mean your data was never sold, never leaked, or never copied by a vendor you never heard of.

Keep unique passwords and 2FA anyway. Turn on Notify Me so the next indexed breach does not sit unnoticed.

#What can't a password change fix?

You can change a password in thirty seconds. You cannot easily change your home address. Or your phone number.

We counted Have I Been Pwned's breach list on October 29, 2026. 383 breaches include phone numbers. 309 include physical addresses.

Have I Been Pwned does have an opt-out. The FAQ is clear about the limit: it only hides your email from the site's own search. The breach itself is still out there.

And your address and phone do not just sit in old dumps. People-search sites list them openly for anyone who types your name. That is the part you can erase. See how scammers use data brokers and how to remove personal information from the internet.

Dana's recap, still fictional: new passwords, two-factor, a credit freeze. Then she searched her own name. Her address and number were on six people-search sites.

UndoLeak erases your data from data brokers and keeps it off.

See which people-search sites list your address and phone

#Sources

Accessed October 29, 2026.

1. Have I Been Pwned homepage (1,048 pwned websites, 17,846,896,404 pwned accounts): https://haveibeenpwned.com/
2. Have I Been Pwned FAQs (what pwned means, passwords not sent, small subset, immutable historic fact, opt-out): https://haveibeenpwned.com/FAQs
3. Have I Been Pwned, Who, What and Why (Troy Hunt, running since 2013): https://haveibeenpwned.com/About
4. Have I Been Pwned, Pwned Passwords (k-anonymity, first 5 hash characters): https://haveibeenpwned.com/Passwords
5. Have I Been Pwned, Notify Me (free breach notifications): https://haveibeenpwned.com/NotifyMe
6. Have I Been Pwned breach list API (1,048 breaches; 383 with phone numbers; 309 with physical addresses; National Public Data data classes): https://haveibeenpwned.com/api/v3/breaches
7. IdentityTheft.gov, What to do if your information was part of a data breach: https://www.identitytheft.gov/databreach
8. FTC Consumer Alert, Breaches at Lord and Taylor, Saks, and MyFitnessPal (change password and security questions; new card number; phishing; caller ID): https://consumer.ftc.gov/consumer-alerts/2018/04/breaches-lord-taylor-saks-myfitnesspal
9. FTC Consumer Alert, The Capital One data breach (a data breach is a magnet for scammers): https://consumer.ftc.gov/consumer-alerts/2019/07/capital-one-data-breach-time-check-your-credit-report
10. FTC, What to know about people-search sites that sell your information: https://consumer.ftc.gov/articles/what-know-about-people-search-sites-sell-your-information
11. AnnualCreditReport.com (official free credit reports): https://www.annualcreditreport.com/

Dana Mercer and every email, inbox, and screen in the paired video are fictional recreations (example.com address, 555 number), not real people or screenshots. Breach names, dates, and data types are from Have I Been Pwned's public breach list. General information, not legal advice. UndoLeak is not affiliated with Have I Been Pwned or Troy Hunt.

Coinbase says it was not hacked. Some customers' contact data leaked anyway.

On the evening of October 27, 2026 (US time; October 28 UTC), Coinbase Support posted on X:

"Coinbase has not had a data breach. Amplitude, an analytics vendor, experienced a security incident which impacted a small subset of Coinbase customer contact data, among other Amplitude customers. We've found no evidence of unauthorized access to Coinbase systems, and customer funds were not impacted. We are notifying impacted customers and regulatory agencies in accordance with our legal obligations."

The company did not name how many people were in that "small subset." It did not say when Amplitude's incident happened. It did not list the exact contact fields. And it did not name the other Amplitude customers who were also hit.

Here is what is known, what is not, and why leaked contact details still matter even when funds stay put.

#Was Coinbase hacked?

Coinbase says no. The support account's wording is direct: "Coinbase has not had a data breach." It also said there is "no evidence of unauthorized access to Coinbase systems."

What leaked came from Amplitude, an analytics company Coinbase uses. Customers deal with Coinbase. They do not sign up with Amplitude. The data still moved to a vendor, and a security incident at that vendor is what Coinbase says exposed it.

Decrypt, Cointelegraph, and TokenPost all reported the same core claim: Coinbase denies a breach of its own systems, and an Amplitude incident exposed some customer contact data.

If you searched "was Coinbase hacked," that is the distinction. The exchange says its systems were not broken into. A vendor copy of some customer data still leaked.

#What the Amplitude leak exposed

A Coinbase spokesperson told Unchained on October 28, 2026 that "contact and limited transaction data were impacted" but "not home addresses, or any other information that would allow someone to directly access your account or your funds."

Coinbase Support said the company is notifying impacted customers and regulators.

A viral post on X claimed hackers obtained contact details for more than 70,000 Coinbase users. The Coinbase spokesperson called that claim "false."

Do not treat any circulating headcount as confirmed. Coinbase has not published its own number.

#What Coinbase has not disclosed

Say this plainly, because search results will fill the gaps with guesses:

• How many customers were affected. Not disclosed.
• When the Amplitude incident happened. Not disclosed.
• Exactly which contact fields were in the vendor copy. Not disclosed. CoinDesk noted that Coinbase did not specify the contact-data fields involved.
• Which other Amplitude clients were hit. Not disclosed. Coinbase Support only said the incident impacted Coinbase data "among other Amplitude customers."

As of publication, Unchained reported that Amplitude had not posted a statement on its blog and had not immediately responded to a request for comment.

This article does not claim who the attacker was, how Amplitude was breached, or that the data was published or put up for sale. Those details are not in the sources above.

#This is not the May 2025 Coinbase incident

Coinbase has had a separate customer-data case before. Keep the two apart.

In May 2025, Coinbase disclosed that bribed overseas support staff passed customer data to criminals. A filing with Maine's attorney general said 69,461 users would be notified, according to Unchained and TokenPost.

Tuesday's Amplitude post did not tie the new incident to that earlier case. Coinbase did not link the two.

If a message, headline, or chatbot blends the viral headcount with the 2025 filing, treat that mix as unverified. The 2025 count is from a different incident. The new count has not been disclosed.

#Why leaked contact data still matters

Funds were not touched. That does not make the leak harmless.

CoinDesk noted that exposed emails and phone numbers "can still serve as valuable raw material for phishing and social-engineering attacks." Unchained wrote that leaked contact details such as email addresses and phone numbers are "a common starting point for phishing."

After a disclosure like this, expect messages that mention Coinbase, a "new sign-in," or an "account locked" warning and push you to act fast. The sender can look close to official because they already have a real email or phone number.

If you want a broader playbook for an exposed address, see Your Email Was in a Data Breach: What to Do Now. For how brokers turn a name and number into a script, see How Scammers Know Your Mom's Name.

#Your data can leak from companies you never signed up with

You did not open an Amplitude account. Your contact details can still sit there.

Apps share customer data with vendors you never picked: analytics, ads, support, shipping. A breach at any of them can expose you. The company you see in the app store is not the only company holding a copy.

That is the durable lesson, and it is not unique to crypto. The same pattern shows up in support contractors, payment processors, and marketing tools. You cannot audit every vendor. You can assume extra copies exist.

Practical steps:

1. Treat unexpected texts, emails, or calls about "a new sign-in" or "account locked" as phishing. Do not click links or call numbers in those messages. Open the app or type the site yourself.
2. Use a unique email and password per service. If one vendor copy leaks, reused logins are how one leak becomes several.
3. Prefer app-based two-factor authentication or passkeys instead of SMS where the service offers them. A leaked phone number makes SMS codes easier to target.
4. Check where your contact details are listed online and remove them. People-search sites and data brokers often republish emails and phone numbers from many sources. Fewer public listings means fewer easy targets for a phishing script.

These steps reduce risk. They do not guarantee that a vendor leak will never reach you, and they do not undo a copy that already left the vendor.

#What to do if you use Coinbase

1. Watch for a notice from Coinbase if you are in the affected subset. Coinbase said it is notifying impacted customers. Go to the official app or site yourself rather than following a link in a message.
2. Ignore unexpected Coinbase alerts that ask you to "verify," "unlock," or "confirm a new device." Type the address or open the app.
3. Keep a unique password on the account, and turn on app-based 2FA or a passkey if you have not already.
4. Scan for public listings of your email and phone. See where you're listed with a free scan.

UndoLeak erases your data from data brokers and keeps it off.

#Sources

All facts in this article come from the following sources:

• Coinbase Support on X (Oct 28, 2026)
• Coinbase Says Amplitude Incident Hit Contact and Some Transaction Data, Denies 70K Claim
• Coinbase says user funds are safe after vendor exposes customer data
• Coinbase Customer Data Hit in Analytics Vendor Breach, Funds Not Impacted
• Coinbase denies systems breach, says vendor exposed customer data
• Coinbase Says Amplitude Incident Exposed Some Customer Contact Data

Not affiliated with Coinbase or Amplitude.

Your face is a search term.

A face search engine can take one photo of you and find other photos of that same face online. That is reverse face search, and it is different from reverse image search: it is not looking for copies of one file. It is looking for you.

In 2024, 404 Media reported that two Harvard students wired that kind of search into a pair of Meta smart glasses. Their demo, called I-XRAY, used PimEyes "and some other tools" so someone could "automatically go from face, to name, to phone number, and home address." They said they are not releasing the code.

The same reporting also showed a limit. Ars Technica wrote that an attempt to identify 404 Media reporter Joseph Cox did not work, because he had opted out of PimEyes.

This guide is the practical PimEyes opt out: how to remove your face from PimEyes, what that request does and does not do, and why one photo can still find you on other sites.

#Watch: Can someone find you from one photo?

This video walks through the 2024 smart glasses demo and the PimEyes removal steps.

#What is PimEyes?

PimEyes is a face search engine. Anyone with access can upload a picture and look for other public photos of that face.

PimEyes says it does not "identify" people. As Ars Technica reported in October 2024, PimEyes says it only points to links to photos, where a viewer can often find a name.

The New York Times reported in 2022 that PimEyes does not include results from social media sites. The photos it found came from news articles, wedding photography pages, review sites, and blogs.

If you want to search for copies of a specific file, rather than other photos of your face, use reverse image search tools such as Google Lens, Bing Visual Search, and TinEye. Our guide to finding your photos online covers that workflow.

#Can someone find me from a picture?

Often, yes.

In May 2022, Kashmir Hill of The New York Times published "A Face Search Engine Anyone Can Use Is Alarmingly Accurate." The Times used PimEyes on the faces of a dozen Times journalists, with their consent.

The Times reported:

"PimEyes found photos of every person, some that the journalists had never seen before, even when they were wearing sunglasses or a mask, or their face was turned away from the camera, in the image used to conduct the search."

One foreign correspondent appeared "in the blurry background of a photo taken of someone else at a Greek airport in 2019."

That is the gap between "I never posted that" and "a stranger can still find me." A face search engine does not need a photo you uploaded. It needs a photo of you, taken by anyone, sitting on a public page.

#What the 2024 smart glasses demo showed

On October 2, 2024, 404 Media (Joseph Cox) reported that two Harvard students built I-XRAY on Meta's commercially available Ray-Ban smart glasses.

According to 404 Media, the project "marries Meta's smart Ray Ban glasses with the facial recognition service Pimeyes and some other tools" and lets someone "automatically go from face, to name, to phone number, and home address." 404 Media also reported that the glasses pulled family members, that the students tested the setup "in some cases on unsuspecting people in the real world," and that they are not releasing the code.

The Verge described the chain this way: the glasses livestream to Instagram, a program uses AI to identify faces, and those photos are fed into public databases to find names, addresses, phone numbers, and relatives. The Verge reported that the students were shown chatting up complete strangers on public transit. It also reported that Meta's privacy light, which turns on when the glasses record, can be hard to notice in bright light.

Ars Technica reported that the students cross-searched people-search databases and used a large language model to combine the data, and that they tested the technology at a subway station. Ars also reported PimEyes' response: PimEyes says it does not "identify" people, it only links to photos.

This is smart glasses facial recognition as a demo, not a product you can buy. The students said they built it to show what existing tools already make possible.

#Why the glasses failed on one reporter

Ars Technica reported that an attempt to use I-XRAY to identify 404 Media reporter Joseph Cox "didn't work because he'd opted out of PimEyes."

That is the reason this page exists. PimEyes removal will not hide you from a camera. It can stop this particular face search engine from turning that camera into a name, a number, and a door.

Ars Technica also reported that the students' document explained how to remove faces from PimEyes and FaceCheck.ID, and from people-search sites including FastPeopleSearch, CheckThem, and Instant Checkmate. Each of those sites has its own opt-out. One PimEyes request does not cover them.

#How to opt out of PimEyes

PimEyes publishes two paths. The full opt-out is the one that hides your likeness from current and future searches. There is also a per-image exclusion from search results.

PimEyes' blog, "How to remove your images from PimEyes search results" (updated 2026), says of the opt-out: "This feature is free of charge, and it will permanently remove your likeness from both current and future searches."

#Step 1. Go to the opt-out page

Open the PimEyes Opt-Out Request Form at pimeyes.com/en/opt-out.

#Step 2. Upload a clear photo of your face

PimEyes asks for a clear photo of your face. The opt-out page says: "For better results, please upload more than one photo to include different face angles."

Use a photo that already looks like you in public. PimEyes says it uses the picture to search for face fingerprints it already has from public websites.

#Step 3. Upload an anonymized scan of your ID or passport

PimEyes asks for an anonymized scan of a government ID or passport for identity confirmation. Hide everything except the photo. Cover the name, address, date of birth, ID number, and any other printed details.

PimEyes' blog says it wants a government-issued ID (ID, passport, or driving license) "with sensitive details hidden, so that only your photo is visible."

#Step 4. Give an email for the confirmation letter

The opt-out form asks for an email so PimEyes can send a confirmation letter. PimEyes' privacy policy also says a telephone number may be requested "to communicate in case of such need."

#What happens after you submit

PimEyes says the opt-out "will permanently remove your likeness from both current and future searches." It also says "the removal from PimEyes search results does not mean that these images will be removed from the original websites where the images were found."

PimEyes' blog notes that images can have different index combinations, "so sometimes it's a good idea to request removal several times using the image that shows your search results." If a photo of you still appears after the first request, it may be worth repeating the opt-out with that photo.

In a November 1, 2024 Washington Post column, a reporter who submitted the opt-out wrote that PimEyes confirmed the reporter's face was removed from search results within about 48 hours, and that the confirmation email said the reporter might need to repeat the opt-out with more photos.

PimEyes' privacy policy (updated April 23, 2026) says that for opt-out, it retains uploaded data for "no more than 96 hours" to carry out the request, then permanently removes that personal data and keeps only a record of the request and the steps taken.

#The per-image option

If you only want one result gone, PimEyes describes a second path from search results:

1. Select the image directly from the search results.
2. Choose exclude from public results.
3. Indicate the reason for removal.

PimEyes says the image "will be permanently deleted from PimEyes within 48 hours after your request is approved."

That is a per-image exclusion, not a full likeness opt-out. Use the opt-out form if you want current and future searches to stop matching your face.

#What PimEyes removal does not do

PimEyes opt-out is PimEyes removal only.

• It does not take photos down from news sites, wedding galleries, blogs, or review pages.
• It does not hide you from other face search engines.
• It does not remove your name, address, or phone number from people-search sites.
• It does not stop someone from photographing you in public.

To find copies of a specific photo and request takedowns at the source, use how to find out if your photos are online. To work through people-search listings, start with how to remove your personal information from the internet.

#Other face search sites and people-search sites

Ars Technica reported that the I-XRAY students' document pointed people to opt-outs on FaceCheck.ID and on people-search sites including FastPeopleSearch, CheckThem, and Instant Checkmate.

Those sites do not share a form with PimEyes. If you want to be harder to find from a photo, treat each one as a separate request:

• FaceCheck.ID has its own face-search opt-out.
• FastPeopleSearch and Instant Checkmate are people-search sites with their own removal forms.
• CheckThem, named in the same student document, also has its own process.

No extra claim is being made here about how those other forms work. Open each site's current opt-out page and follow it.

UndoLeak erases your data from data brokers and keeps it off. Face search is one path to a name and an address. We handle the people-search listings that fill in the rest, then keep checking so they stay off.

Run a free privacy check

#Sources

1. 404 Media, Joseph Cox, "Someone Put Facial Recognition Tech onto Meta's Smart Glasses to Instantly Dox Strangers" (October 2, 2024): https://www.404media.co/someone-put-facial-recognition-tech-onto-metas-smart-glasses-to-instantly-dox-strangers/

2. The Verge, Victoria Song, "College students used Meta's smart glasses to dox people in real time" (October 2, 2024): https://www.theverge.com/2024/10/2/24260262/ray-ban-meta-smart-glasses-doxxing-privacy

3. Ars Technica, Ashley Belanger, "Harvard students make auto-doxxing smart glasses to show need for privacy regs" (October 2, 2024): https://arstechnica.com/tech-policy/2024/10/harvard-students-make-auto-doxxing-smart-glasses-to-show-need-for-privacy-regs/

4. The New York Times, Kashmir Hill, "A Face Search Engine Anyone Can Use Is Alarmingly Accurate" (May 26, 2022): https://www.nytimes.com/2022/05/26/technology/pimeyes-facial-recognition-search.html

5. PimEyes, Opt-Out Request Form (accessed October 28, 2026): https://pimeyes.com/en/opt-out

6. PimEyes, "How to remove your images from PimEyes search results" (updated 2026): https://pimeyes.com/en/blog/how-to-remove-your-images-from-pimeyes-search-results

7. PimEyes, Privacy Policy (updated April 23, 2026): https://pimeyes.com/en/privacy-policy

8. The Washington Post, "They made a public Rolodex of our faces. Here's how I tried to get out." (November 1, 2024): https://www.washingtonpost.com/technology/2024/11/01/face-search-privacy-pimeyes/

Not affiliated with PimEyes, Meta, Ray-Ban or any company mentioned.

#Related

• How to opt out of TSA facial recognition

To remove your phone number from USPhoneBook, go to usphonebook.com/removal, enter your name and email and complete the captcha, then click the emailed link within 24 hours and fill in the removal form so it matches your listing. USPhoneBook says to allow 3 days, and because it keeps receiving new public records, it recommends refreshing your opt-out periodically. Also check its sister sites such as FastPeopleSearch.

Quick answer: USPhoneBook's U.S. State Supplemental Privacy Notice reports for 2025: 11,176 delete requests received, all 11,176 denied. But 3,634,288 opt-out requests were complied with in whole. So use the opt-out (removal) form, not a delete request. Click the emailed link within 24 hours (after that you must request a new one), match the form to your listing exactly (missing or inaccurate details only hinder the opt-out), and allow 3 days. Then refresh it periodically, because USPhoneBook says your information may appear again when it receives new public records.

Every fact below comes from USPhoneBook's official pages (opt-out form, U.S. State Supplemental Privacy Notice dated July 2026 with California metrics for 2025, Privacy Notice dated September 2026, and homepage), the California Privacy Protection Agency's Data Broker Registry, and the FTC's guidance on people-search sites, accessed October 28, 2026. Jenna Walsh, her family and every record shown in the video are fictional recreations (555 numbers), not real people.

#Watch: USPhoneBook removal explained

If eleven thousand delete requests were all denied, but over three million opt-outs were honored, this video walks through the removal steps that actually work, the 24-hour trap, and why your number can come back anyway.

#What does USPhoneBook show about you?

USPhoneBook is a free reverse phone lookup. According to its homepage, it's completely free, with no registration required, no credit card, and no account required. The person whose telephone number you search is never notified.

USPhoneBook says it searches over 2.5 billion records.

Type in a number, and results may include:

• Full name
• Current and previous addresses
• Additional phone numbers
• Carrier and line type
• Possible relatives and associates
• Email addresses
• Age

A stranger typed in a fictional example person's number and got her full name, her street, and her mom's name. In seconds.

#Who owns USPhoneBook?

In California's data broker registry, the company behind USPhoneBook, Mississippi Tornado Alley, LLC (Sacramento), lists ten DBA sites:

1. CyberBackgroundChecks.com
2. AdvancedBackgroundChecks.com
3. FastBackgroundCheck.com
4. PeopleSearchNow.com
5. Phonebooks.com
6. SearchPeopleFree.com
7. SmartBackgroundChecks.com
8. USA-People-Search.com
9. USPhoneBook.com
10. FastPeopleSearch.com

The filing says consumers may exercise their right to opt out of the sale of certain personal information by submitting a request on any of these sites. It does not state that one request covers all ten.

So check each one.

#How do I remove myself from USPhoneBook (step by step)?

USPhoneBook's removal is free and runs at usphonebook.com/removal (same page at usphonebook.com/opt-out). According to USPhoneBook's Opt-Out Form, here's how it works:

#Step 1: Search yourself first

Search your name and every phone number you've had on usphonebook.com.

Write down exactly how the listing shows your name, your city, and your numbers. You'll need this to match the removal form to your listing.

#Step 2: Go to usphonebook.com/removal

Go to usphonebook.com/removal. It's also in the site footer as "Do Not Sell My Personal Information" (according to USPhoneBook's Privacy Notice dated September 14, 2026).

Enter your name and email and complete the captcha.

#Step 3: Open the email and click the link

USPhoneBook emails you a link to the removal form.

The form says: "It may take some time to arrive. If you wait more than 24 hours to click this link you will need to request a new one."

Check your spam folder. Then click the link.

#Step 4: The 24-hour trap

If you wait more than 24 hours to click that link, it's dead.

You have to go back to usphonebook.com/removal and request a new one, starting over.

#Step 5: Fill in the removal form to match the listing

The link opens the removal form.

Enter information that matches the listing you found in Step 1.

USPhoneBook warns: "Omitting information or providing inaccurate information on the opt-out form will only hinder the opt-out process."

That matters, because USPhoneBook's U.S. State Supplemental Privacy Notice reports opt-outs are denied where the company "was unable to locate relevant records in our system."

In 2025, that was 829,506 opt-out requests denied.

#Step 6: Confirmation

Submit the form. You get a confirmation page and a confirmation email.

USPhoneBook says: "Please allow 3 days for your request to be fully processed."

Then search your name and phone numbers again on usphonebook.com to make sure the listing is gone.

#Step 7: Form not working? Call the opt-out line

If the removal form isn't working, USPhoneBook lists 888-747-4095 for opt-out requests (according to USPhoneBook's U.S. State Supplemental Privacy Notice dated July 1, 2026).

#Step 8: Refresh it periodically

Here's the line most people never read.

USPhoneBook's U.S. State Supplemental Privacy Notice says: "we regularly receive new public records so even if you opt out, your publicly available information may appear in our Data Products again in the future. We recommend you periodically refresh your opt-out request."

So removal isn't a one-time thing. It's maintenance.

#Step 9: Check the sister sites

USPhoneBook also says: "this will not remove the data from its original source. This means your information may still appear on other websites."

The FTC says the same about people-search sites: your information can reappear for sale when public records change, and you may still show up in your relatives', neighbors', or associates' reports.

And check those ten sites from the California registry. The filing doesn't say one request clears all ten.

Search FastPeopleSearch and the rest of that registry list. Then opt out of each one.

#Should I use the opt-out or a delete request?

Use the opt-out (removal) form.

Here are the numbers from USPhoneBook's U.S. State Supplemental Privacy Notice (last updated July 1, 2026), Section 6, California Metrics Reporting, for requests received and handled by USPhoneBook.com from January 1 to December 31, 2025 ("not limited to California residents"):

Right to Delete:

• 11,176 received
• 0 complied in whole
• 0 complied in part
• 11,176 denied

Right to Opt-out:

• 4,466,794 received
• 3,634,288 complied in whole
• 829,506 denied

Delete isn't the button that works. Over three point six million opt-out requests were honored. Same site. Same year.

USPhoneBook says deletion was denied where "the data subject was determined to not be a covered consumer under an applicable consumer privacy law, we were unable to verify the identity of the requester, or we were unable to locate relevant records in our system."

Opt-outs were denied where the requester was not a covered consumer "or we were unable to locate relevant records in our system."

So use the opt-out.

#Why did my USPhoneBook opt-out get denied?

According to USPhoneBook's U.S. State Supplemental Privacy Notice, opt-outs are denied where:

• The requester was not a covered consumer under an applicable consumer privacy law, or
• USPhoneBook was unable to locate relevant records in its system

In 2025, 829,506 opt-out requests were denied.

That's why matching the removal form to your listing exactly matters.

USPhoneBook warns: "Omitting information or providing inaccurate information on the opt-out form will only hinder the opt-out process."

If you can't find your listing when you search in Step 1, or if the form keeps getting denied, try variations:

• Different spellings of your name (middle initial vs no middle initial, nickname vs full name)
• Every phone number you've had
• Current and past addresses

#What if the USPhoneBook removal link expired?

If the link expired (you waited more than 24 hours), go back to usphonebook.com/removal and request a new one.

Enter your name and email again, complete the captcha, and click the new link within 24 hours.

The clock resets every time you request a new link.

#How long does USPhoneBook removal take?

USPhoneBook says allow 3 days.

Then search your name and phone numbers again on usphonebook.com to confirm the listing is gone.

If it's still there after a week, email support or call the opt-out line.

#Can I remove my number from USPhoneBook by phone?

USPhoneBook lists 888-747-4095 for opt-out requests.

The phone line is an option if the removal form isn't working.

According to USPhoneBook's U.S. State Supplemental Privacy Notice (July 2026), the phone number is provided for opt-outs. The notice also says: "opt-out requests do not require verification."

#Why does my info come back on USPhoneBook?

USPhoneBook's U.S. State Supplemental Privacy Notice is clear:

"we regularly receive new public records so even if you opt out, your publicly available information may appear in our Data Products again in the future. We recommend you periodically refresh your opt-out request."

And: "this will not remove the data from its original source. This means your information may still appear on other websites."

The FTC says the same about people-search sites:

• Your information can reappear for sale when public records change
• You may still appear in your relatives', neighbors', or associates' reports

So a new public record (a move, a new phone number, an updated voter registration, a property transaction) creates a fresh listing.

Check again every few months. And when you find a new listing, sign back into the removal form with the same email to manage it.

#Does removing USPhoneBook remove me from FastPeopleSearch?

No.

In California's data broker registry, Mississippi Tornado Alley, LLC lists ten sites, including USPhoneBook.com and FastPeopleSearch.com.

The registry filing says "Consumers may exercise their right to opt out of the sale of certain personal information by submitting a request on any of these sites." It does not state that one request covers all ten.

So search each one. Then opt out of each one.

We have guides for:

• FastPeopleSearch removal
• USPhoneBook removal

And check the other eight: CyberBackgroundChecks.com, AdvancedBackgroundChecks.com, FastBackgroundCheck.com, PeopleSearchNow.com, Phonebooks.com, SearchPeopleFree.com, SmartBackgroundChecks.com, and USA-People-Search.com.

#Or let undoleak handle USPhoneBook for you

USPhoneBook is free, and you can do it yourself. But here's what you're managing:

1. Search your name and every phone number you've had
2. Request the removal link
3. Click it within 24 hours
4. Match the form to the listing exactly
5. Wait 3 days and recheck
6. Do the same for FastPeopleSearch and the other eight sister sites
7. Refresh it every few months when new public records bring your listing back

That's what UndoLeak does. UndoLeak erases your data from data brokers and keeps it off. We re-check and erase it again when it comes back.

Check your data free to see which people-search sites list your number and address right now. The first scan is free.

#Related guides

• USPhoneBook opt-out - quick-reference guide
• How to remove your phone number from people-search sites - step-by-step
• TruePeopleSearch removal (2026) - another free opt-out
• Why data brokers re-list you after opt-out - why listings come back
• How to stop spam calls - your number is the first thing to erase
• California DROP - one request to 600+ data brokers if you're in California
• Delete yourself from the internet in 30 days - the full plan

#Sources

1. USPhoneBook, Opt-Out Form: usphonebook.com/removal (accessed October 28, 2026)
2. USPhoneBook, U.S. State Supplemental Privacy Notice ("Notice at Collection"), last updated July 1, 2026: usphonebook.com/notice-at-collection (accessed October 28, 2026)
3. USPhoneBook, Privacy Notice, last updated September 14, 2026: usphonebook.com/privacy (accessed October 28, 2026)
4. USPhoneBook homepage: usphonebook.com (accessed October 28, 2026)
5. California Privacy Protection Agency, Data Broker Registry: cppa.ca.gov/data_broker_registry (accessed October 28, 2026)
6. FTC, What To Know About People Search Sites That Sell Your Information: consumer.ftc.gov/articles/what-know-about-people-search-sites-sell-your-information (accessed October 28, 2026)

Jenna Walsh, her family and every record, form and screen shown in the video are fictional recreations (555 numbers), not real people or screenshots. Sites change their forms over time; check the official pages for the most current instructions. This is general information, not legal advice.

Your therapy app asked if you were depressed, on medication, or had been in therapy before. It told you the answers would stay private between you and your counselor. Then, according to the FTC, it told Facebook.

In March 2023, the Federal Trade Commission announced a proposed order with BetterHelp, an online therapy platform used by millions of people. The FTC alleged that BetterHelp promised to keep health data private but shared it with Facebook, Snapchat, Criteo, and Pinterest for advertising.

BetterHelp settled without admitting wrongdoing. In a 2023 statement, BetterHelp called the practices "industry-standard" and said it stopped them in 2020.

If you're wondering what BetterHelp shared and how it happened, this guide explains what the FTC alleged, the two mechanisms used to share the data, and how to disconnect future activity that businesses send to Meta from your account.

#Watch: Did BetterHelp share your data with Facebook?

This video walks through what the FTC found and how to disconnect activity businesses send to Meta.

#What the FTC alleged

On March 2, 2023, the FTC announced a proposed consent order with BetterHelp. On July 14, 2023, the FTC issued its final order.

Per the FTC's complaint, In the Matter of BetterHelp, Inc., File No. 2023169:

#BetterHelp promised privacy

From at least August 2017 to December 2020, when a visitor reached the question about medication during the sign-up process, BetterHelp displayed this statement:

"Rest assured—any information provided in this questionnaire will stay private between you and your counselor."

Per the FTC complaint (paragraph 24), this promise was shown while visitors answered sensitive health questions.

#The sign-up questionnaire asked sensitive health questions

Per the FTC complaint (paragraph 21), the intake questionnaire asked whether visitors were:

• "experiencing overwhelming sadness, grief, or depression"
• having thoughts they "would be better off dead or hurting yourself in some way"
• "currently taking any medication"
• had previously been in therapy

#BetterHelp uploaded over 7 million email addresses to Facebook

According to the FTC complaint (paragraph 52), between 2017 and 2018, BetterHelp uploaded lists of over 7 million visitors' and users' email addresses to Facebook. Facebook matched over 4 million of these with Facebook user IDs, linking their use of the service for mental health treatment with their Facebook accounts.

In October 2017, the FTC alleged (paragraph 52c), BetterHelp uploaded nearly 2 million current and former users' email addresses to target them with "refer a friend" ads.

Per the FTC complaint (paragraph 49), hashing the email addresses did not hide identities from Facebook, which matched them with user accounts.

#BetterHelp disclosed past therapy to Facebook via tracking pixels

According to the FTC complaint (paragraph 53b), from November 2018 to March 2020, BetterHelp disclosed to Facebook over 1.5 million visitors' and users' previous therapy, gathered through their answers to the intake questionnaire question "Have you been in counseling or therapy before?"

Per the FTC complaint (paragraph 54), an affirmative answer to the question was coded as the tracking pixel event "AddToWishlist." A junior analyst revealed to Facebook that this event meant the "user completes questionnaire marking they have been in therapy before."

#BetterHelp also shared data with Snapchat and Criteo

Per the FTC complaint (paragraph 55), BetterHelp also disclosed IP addresses and email addresses of approximately 5.6 million visitors to Snapchat in January 2019. BetterHelp also shared emails with Criteo, including visitors to Pride Counseling and Faithful Counseling, two BetterHelp-affiliated services.

#BetterHelp's response

BetterHelp settled without admitting wrongdoing.

In a 2023 statement reported by Healthcare Dive on March 2, 2023, BetterHelp said data sharing for targeted advertising is an "industry-standard practice" that is "routinely used by some of the largest health providers."

BetterHelp also stated, as reported by Fierce Healthcare in 2023, that it never shared names or clinical data from therapy sessions.

Per Healthcare Dive's reporting in March 2023, BetterHelp halted the practices in 2020.

#How email list uploads work

One way BetterHelp shared data with Facebook, according to the FTC, was by uploading email lists. This practice is called creating custom audiences.

Here's how it works:

1. A company collects emails. BetterHelp collected email addresses from people who signed up for or inquired about therapy services.

2. The company uploads the emails to Facebook. BetterHelp uploaded lists of over 7 million email addresses to Facebook, per the FTC.

3. Facebook matches the emails with user accounts. Facebook matched over 4 million of these email addresses with Facebook user IDs, per the FTC.

4. The company targets ads to those accounts. Once matched, BetterHelp could show ads to those Facebook users, or exclude them, or build lookalike audiences based on their characteristics.

#Why an email alone revealed health information

Per the FTC complaint (paragraph 48), BetterHelp collected email addresses only from people who were seeking mental health treatment through the service. The fact that someone's email was in BetterHelp's system revealed that they had sought therapy.

As the FTC explained, even though BetterHelp did not send Facebook a name or the content of therapy sessions, the email address itself was enough to link the person's Facebook account to the fact that they were seeking mental health treatment.

#How tracking pixels work

The second way BetterHelp shared data with Facebook, according to the FTC, was through tracking pixels and pixel events.

Here's how it works:

1. A company adds a pixel to its website. A tracking pixel is a small piece of code, often called the Meta pixel or Facebook pixel. When embedded on a website, it sends information about user activity to Facebook.

2. The pixel sends events. An event is a specific action, like viewing a page, clicking a button, or completing a form. The company can name these events anything, like "Purchase" or "AddToCart" or, in BetterHelp's case, "AddToWishlist."

3. The pixel sends identifiers. Along with the event name, the pixel sends information that can identify the user, such as IP address or email address if available.

4. Facebook links the event to a user account. Facebook uses the identifiers to link the event to a Facebook user account, building a profile of the user's activity on that website.

#What BetterHelp's pixel sent

Per the FTC complaint (paragraph 53b), from November 2018 to March 2020, BetterHelp's tracking pixel sent Facebook an event every time someone answered "yes" to the question "Have you been in counseling or therapy before?"

The event was coded as "AddToWishlist."

Per the FTC complaint (paragraph 54), a junior analyst from BetterHelp revealed to Facebook the meaning of this event: "user completes questionnaire marking they have been in therapy before."

This disclosure allowed Facebook to connect the "AddToWishlist" event to a person's therapy history, per the FTC.

#What the FTC's final order requires

On July 14, 2023, the FTC issued its final order with BetterHelp.

Per the FTC press release, the order:

• Bans sharing health data for advertising. BetterHelp is prohibited from sharing consumers' health data for advertising purposes.
• Requires consent. BetterHelp must obtain affirmative express consent before sharing health information with others.
• Requires deletion. BetterHelp must instruct third parties, including Facebook, to delete the data previously shared.
• Imposes data retention limits. BetterHelp must limit how long it retains health data.

The FTC press release is available at: https://www.ftc.gov/news-events/news/press-releases/2023/07/ftc-gives-final-approval-order-banning-betterhelp-sharing-sensitive-health-data-advertising

#How to disconnect future activity on Facebook and Instagram

If you use Facebook or Instagram, you can disconnect future activity that businesses send to Meta from your account. This stops the platform from linking activity that businesses send via tools like the Meta pixel to your account.

Here's how, per the Meta Help Center:

1. Go to your profile photo
2. Tap Settings & privacy
3. Tap Settings
4. Tap Accounts Center
5. Tap Your information and permissions
6. Tap Your activity off Meta technologies
7. Tap Manage future activity
8. Tap Disconnect future activity
9. Tap Continue
10. Tap Disconnect future activity

Source: Meta Help Center, "Manage your future activity off Meta technologies," https://www.facebook.com/help/1224342157705160

#What this does and doesn't do

What it does: This setting disconnects activity that businesses send to Meta via business tools, such as the Meta pixel, from your Facebook or Instagram account. Future pixel events from websites and apps will not be linked to your profile.

What it doesn't do: This setting does not prevent a company from uploading an email list to Meta. If a company has your email address and uploads it to create a custom audience, Meta can still match it with your account.

For sensitive sign-ups, you can use an email address that is not associated with your social media accounts to limit this type of matching.

#What this means for therapy apps and mental health apps

BetterHelp is one case, but the issue extends to other health apps and mental health apps. Per the FTC, period tracking apps like Flo also shared health data with Facebook and Google as app events until 2019.

If you use a therapy app, mental health app, symptom tracker, or similar service, consider:

1. Check the app's privacy policy. Look for how the app shares data with third parties, especially for advertising or analytics.

2. Check the app's privacy label. On iPhone, go to the App Store, search for the app, and scroll to App Privacy. On Android, go to Google Play, search for the app, and check the Data safety section. Look for whether Health data is shared with third parties.

3. Use an email address not tied to social accounts for sensitive sign-ups. This limits the ability of custom audience matching to connect your activity with your social media profile.

4. Disconnect future activity on Meta. Follow the steps above to stop businesses from linking activity sent via the Meta pixel to your account.

#The bigger picture: health data and data brokers

Health app data sharing is part of a larger ecosystem of data collection and data brokerage. Once your data is shared with Facebook, Google, or a data broker, it can be combined with other data about you, from your browsing history to your location to your purchases.

If you're working on removing your personal information from data brokers, limiting what health apps share is part of the same effort. Our main guide, how to remove your personal information from the internet, covers the full process.

If you used BetterHelp or another therapy app that shared data, the data that was shared is already out there. But you can limit future sharing by checking privacy settings, using separate email addresses for sensitive services, and disconnecting future activity on platforms like Meta.

UndoLeak erases your data from data brokers and keeps it off. Health app tracking is one piece. We handle the rest: people-search sites, Google results, leaked photos, and ongoing monitoring so your information stays private.

Run a free privacy check

#Sources

1. Federal Trade Commission, "Complaint, In the Matter of BetterHelp, Inc." (2023), File No. 2023169: https://www.ftc.gov/system/files/ftc_gov/pdf/2023169betterhelpcomplaintfinal.pdf

2. Federal Trade Commission, "FTC Gives Final Approval to Order Banning BetterHelp from Sharing Sensitive Health Data for Advertising" (July 14, 2023): https://www.ftc.gov/news-events/news/press-releases/2023/07/ftc-gives-final-approval-order-banning-betterhelp-sharing-sensitive-health-data-advertising

3. Healthcare Dive, "FTC orders BetterHelp over alleged health data sharing" (March 2, 2023): https://www.healthcaredive.com/news/ftc-betterhelp-settlement-health-data-sharing-fine/644021/

4. Fierce Healthcare, "Teladoc-owned BetterHelp reaches FTC order over alleged data misuse" (March 2, 2023): https://www.fiercehealthcare.com/health-tech/teladoc-owned-betterhelp-pay-78m-users-alleged-data-misuse-ftc-order

5. Meta Help Center, "Manage your future activity off Meta technologies" (2026): https://www.facebook.com/help/1224342157705160

Not affiliated with BetterHelp, Meta, or any company mentioned.

On October 27, 2026, Sony Network Communications, the Sony Group company behind the Japanese internet provider So-net, disclosed that a third party gained unauthorized access to its So-net member database on October 19, 2026. The company noticed the breach on October 23, immediately stopped the server and blocked access, then confirmed the information leak on October 24.

The breach exposed 2,585,481 member records (2,141,986 So-net members and 443,495 plala S course members), including 293,345 records belonging to people who had already canceled their accounts.

Here's what was leaked, who was affected, and what you should do if you're one of them.

#What data was exposed

According to Sony Network Communications' October 27, 2026 notice, the breach exposed the following information:

#What was not leaked

Sony Network Communications confirmed that:

• Member account passwords were not leaked
• Credit card data was not involved
• No leak was confirmed for NURO or other Sony Network Communications services

#Email passwords leaked

54,401 email addresses together with their email passwords were leaked across four So-net mail services:

• Mail Service (G): 24,655 records
• A-Box: 17,672 records
• So-net VAIO Mail: 7,005 records
• PostPet Mail: 5,069 records

So-net force-reset all 54,401 email passwords on October 27, 2026. Affected users must set a new password through My Page on the So-net website.

#Former members were affected

Here's what should worry everyone: 293,345 of those records belonged to people who had already canceled their So-net or plala accounts.

That breaks down to:

• 272,215 former So-net members who canceled from March 2026 onward
• 21,130 former plala members who canceled from March 2026 onward

People who canceled by the end of February 2026 were not affected.

#Why So-net keeps data after cancellation

According to So-net's official FAQ about the breach, the company keeps member information for a certain period after cancellation for final-month billing and inquiries. The FAQ states (translated):

"We retain information for a certain period after cancellation for final-month billing and inquiries."

In other words: quitting a service isn't the same as deleting your data.

#Timeline of the breach

Sony Network Communications reported the breach to Japan's Personal Information Protection Commission. As of October 27, 2026, the company says no secondary harm has been confirmed, though the cause remains under investigation.

#Does canceling an account delete your data?

The So-net breach shows a reality that catches many people off guard: companies often keep your account data for a period after you cancel.

The reasons vary. Companies may keep data for:

• Final billing and payment processing
• Customer support inquiries about past accounts
• Legal and compliance requirements (tax records, dispute resolution)
• Internal analytics and reporting

Some of these reasons are legitimate. Others are not. And the retention periods vary wildly, from 30 days to years, depending on the company and jurisdiction.

#What you can do

Here are practical steps you can take:

1. Ask companies to delete your data after you cancel. Where privacy law gives you that right (for example, GDPR in Europe or CCPA-style deletion rights in some US states), submit a deletion request after canceling. Not every company is covered, and not every request will be honored, but it's worth asking.

2. Close old email accounts you no longer use. An abandoned email account linked to breached services can become a phishing target for years.

3. Change passwords you reused. If you used the same password on multiple sites, change it everywhere else. Breached credentials from one service are often tried on others.

4. Watch for phishing that mentions the breach. After a breach is disclosed, expect fake emails, texts, or calls pretending to be from the company. Don't click links or respond to unexpected messages. Go to the official site yourself.

These steps won't guarantee your data is deleted, but they reduce the risk of it being misused after a breach.

#What to do if you're affected

If you have or had a So-net or plala account:

1. Reset your So-net mail password if you used Mail Service (G), A-Box, So-net VAIO Mail, or PostPet Mail. Do this through the official My Page on the So-net website, not through any link in an email.

2. Don't respond to unexpected messages. Sony Network Communications warns that affected members may receive suspicious emails, SMS, or phone calls. Don't click links, open attachments, or provide personal information in response.

3. Change passwords you reused. If you used your So-net email password on other sites, change those passwords too.

4. Watch your accounts for unusual activity, especially if your email address or phone number was leaked.

#Sources

All facts in this article come from the following sources:

• So-net / Sony Network Communications, "So-net会員データベースへの不正アクセスに伴う情報漏洩に関するお詫びとお知らせ" (Oct 27, 2026)
• So-net Support FAQ, "So-net会員データベースへの不正アクセスに関するご質問と回答" (Oct 2026)
• ITmedia NEWS, "So-net、会員情報約259万件が漏えい" (Oct 27, 2026)
• Yomiuri Shimbun (Oct 27, 2026)
• CyberInsider, "Sony discloses data breach exposing 2.6 million customer records" (Oct 27, 2026)
• INTERNET Watch (Oct 27, 2026)

#Keep your data off data brokers

Your name, address, and phone number can sit on people-search sites long after you've left a service.

UndoLeak erases your data from data brokers and keeps it off. See where you're listed with a free scan.

Not affiliated with Sony or So-net.

That's the curious paradox of modern phone privacy: ads feel so targeted that people suspect their phones are secretly recording conversations, but the data already collected without listening, from app analytics to data broker lists, is often enough to explain it.

Here's what researchers found when they actually tested whether apps listen, what the FTC said about one company that claimed they did, and the practical steps you can take right now to check which apps have access to your microphone.

#The 2018 study: over 17,000 apps, zero audio leaks

In 2018, researchers at Northeastern University set out to answer a question that millions of people had already asked themselves: Is my phone secretly listening to me?

They analyzed 17,260 of the most popular apps on the Android operating system, all of which had requested camera and/or microphone permissions. The researchers monitored whether any of these apps activated the microphone or camera without the user's knowledge and whether they sent audio or video to third parties.

The result: "There were no audio leaks at all—not a single app activated the microphone," according to David Choffnes, one of the researchers, as reported by Northeastern Global News in July 2018.

The full study, titled "Panoptispy: Characterizing Audio and Video Exfiltration from Android Applications," was published in the Proceedings on Privacy Enhancing Technologies (PoPETs) 2018.

#What this study does and doesn't prove

This is important context: the 2018 Northeastern study analyzed a large set of popular Android apps at one point in time and found no evidence of secret microphone activation. It does not prove that no app, anywhere, ever listens. It's one study of Android apps from 2018, not a blanket guarantee about every app on every platform.

The study's value is in what it tested rigorously and what it found: among thousands of the most widely used apps, none were secretly turning on the microphone.

#What they did find: apps recording your screen

While the researchers found no apps secretly using the microphone, they discovered something else: some apps were automatically taking screenshots and screen video of themselves and sending them to third parties, without users' awareness or consent.

One example from the study: GoPuff, a food delivery app, sent video of its own screen activity to Appsee, a mobile analytics company. This happened as soon as a user opened the app. According to the published study, the video exposed personally identifiable information, in this case a user's ZIP code.

Appsee's screen recording did not require any special Android permission, and it did not notify users that it was happening. According to Northeastern Global News, GoPuff later updated its terms of service to alert users.

The key point: apps can collect information about what you're doing without using the microphone. Screen recording and analytics SDKs can capture text you type, screens you view, and even data you enter, all without triggering the microphone permission.

#The Cox Media Group "Active Listening" pitch

In August 2024, 404 Media (journalist Joseph Cox) obtained and published a pitch deck from Cox Media Group (CMG), a large media company, for a service called "Active Listening."

According to the pitch deck, the service claimed it could target ads based on what people said out loud near their devices' microphones.

Shortly after 404 Media asked Google for comment about the pitch, Google removed Cox Media Group from its Partners Program.

Cox Media Group had previously said in December 2023 that it does not "listen to any conversations," as reported by Ars Technica.

#What the FTC found in 2026

On May 21, 2026, the Federal Trade Commission issued a press release announcing proposed consent orders with Cox Media Group, MindSift, and 1010 Digital Works to settle charges that they deceived customers about the "Active Listening" service.

According to the FTC's press release, the three companies falsely claimed that the service listened to consumers' conversations through their devices' microphones. In reality, according to the FTC's complaint:

"this service did not, in fact, listen in on consumers' conversations or use voice data at all—nor did the service accurately place ads in customers' desired locations. Instead, the service the companies provided consisted of reselling—at a significant markup—email lists obtained from other data brokers."

In other words, the FTC alleged that the companies marketed the service as if it listened to conversations, but what they actually sold were email lists bought from data brokers.

The FTC also stated that consumers had not opted in to the service, explaining that "clicking through terms of service is not opt-in consent."

The proposed consent orders were subject to public comment. The FTC did not allege that Meta, Google, Amazon, or any other platform used the service.

#What the data brokers had instead

The FTC's findings point to an uncomfortable truth: voice data wasn't necessary because data brokers already had email lists, purchase histories, and other personal data available for resale.

This is one reason ads can feel like your phone is listening even when it isn't. The data that companies do collect, from app usage to location history to data broker profiles, is often detailed enough to predict your interests without ever recording your voice.

#Why ads feel like your phone is listening

If apps aren't listening, why do ads sometimes feel so creepily on target?

Here are the data sources that are actually being collected, based on what researchers and regulators have found:

#1. Data broker email lists

As the FTC's case against Cox Media Group shows, data brokers sell email lists that include demographic information, purchase history, and inferred interests. These lists are compiled from public records, marketing databases, app usage, and online activity.

When you see an ad for something you mentioned in conversation, it's often because you've been browsing related topics online, visiting related stores, or searching for similar products, and that activity was captured and sold by data brokers.

#2. App and screen analytics

As the Northeastern study found, apps can record what's on your screen and send it to analytics companies without triggering microphone permissions. This includes:

• Text you type into forms
• Products you view
• How long you spend on each screen
• Which buttons you tap

This data is used to build a profile of your interests and behavior, even if the app never uses the microphone.

#3. Location data

Your phone's location history can reveal which stores you visit, which neighborhoods you spend time in, and even which events you attend. Data brokers buy and sell this location data (see our guide on how apps sell your location).

When combined with other data, your location history can predict your interests, income level, and purchasing behavior, often well enough to serve you targeted ads that feel like they're reading your mind.

#4. Browsing and search history

Your web searches, the sites you visit, and the products you view all contribute to ad targeting. Even if you never said a word out loud, your browsing history alone can reveal what you're interested in.

#The result: eerily accurate targeting without voice data

When these data sources are combined, email lists from data brokers, app analytics, location tracking, and browsing history, the result can be ads that feel like your phone must have been listening.

In most cases, the explanation is simpler and more invasive: the phone was watching, tracking, and logging everything else.

#How to check which apps can use your microphone

Even though the evidence suggests most apps aren't secretly listening, it's still a good idea to review which apps have microphone access and turn off access for apps that don't need it.

#On iPhone

1. Open Settings
2. Tap Privacy & Security
3. Tap Microphone
4. You'll see a list of apps that have requested microphone access. Turn off any app that doesn't need it.

Indicator for active use: On iPhone, an orange indicator appears in the status bar (usually at the top right) when an app is using the microphone. A green indicator means an app is using the camera, or both the camera and microphone.

You can swipe down from the top right (on iPhones with Face ID) or swipe up from the bottom (on iPhones with a Home button) to open Control Center, which will show you which app recently used the microphone or camera.

Source: Apple iPhone User Guide, "Control access to hardware features," https://support.apple.com/guide/iphone/control-access-to-hardware-features-iph168c4bbd5/ios

#On Android

1. Open Settings
2. Tap Security & privacy
3. Tap Privacy
4. Tap Permission manager
5. Tap Microphone
6. For each app, choose:
   • Allow only while using the app (recommended for most apps)
   • Ask every time
   • Don't allow

Alternative method: On some Android versions, you can turn off microphone access entirely:

1. Open Settings
2. Tap Security & privacy
3. Tap Privacy
4. Tap Privacy controls
5. Turn off Microphone access

Note: Menu names and paths vary depending on your phone maker (Samsung, Google Pixel, OnePlus, etc.), but the options are generally found under Settings, Security & privacy or Privacy.

Source: Google Android Help, "Change app permissions on your Android phone," https://support.google.com/android/answer/9431959

#What to turn off

Good candidates for turning off microphone access:

• Apps that don't obviously need it (games, photo editors, flashlight apps, weather apps)
• Apps you rarely use
• Apps from developers you don't recognize

Apps that legitimately need microphone access:

• Voice recording apps
• Video calling apps (Zoom, FaceTime, WhatsApp)
• Voice assistants (Siri, Google Assistant)
• Navigation apps that respond to voice commands

When in doubt, turn it off. If the app needs the microphone for a feature you actually use, it will ask for permission again when you try to use that feature.

#What this means for your privacy

The Northeastern study and the FTC's findings about Cox Media Group both point to the same conclusion: your phone probably isn't secretly recording your conversations, but that doesn't mean your privacy is secure.

Apps are collecting enormous amounts of data through other means: screen recording, location tracking, app usage analytics, and purchases from data brokers. That data is often detailed enough to serve you eerily targeted ads without ever using the microphone.

The practical steps you can take:

1. Review microphone permissions and turn off apps that don't need access.
2. Limit location tracking for apps that don't need it (see our guide on app location tracking).
3. Remove your information from data brokers, who are often the source of the email lists and profiles that power ad targeting.

UndoLeak erases your data from data brokers and keeps it off. Voice data is just one piece. We handle the rest: people-search sites, Google results, leaked photos, and ongoing monitoring so your information stays private.

Run a free privacy check

#Sources

1. Northeastern Global News, "Is your smartphone spying on you?" (July 6, 2018): https://news.northeastern.edu/2018/07/06/is-your-smartphone-spying-on-you/

2. Pan, Ren, Lindorfer, Wilson, Choffnes, "Panoptispy: Characterizing Audio and Video Exfiltration from Android Applications," Proceedings on Privacy Enhancing Technologies (PoPETs) 2018(4): https://petsymposium.org/popets/2018/popets-2018-0030.pdf

3. 404 Media, Joseph Cox, "Here's the Pitch Deck for 'Active Listening' Ad Targeting" (August 26, 2024): https://www.404media.co/heres-the-pitch-deck-for-active-listening-ad-targeting/

4. Ars Technica, "No, a marketing firm isn't tapping your device to hear private conversations" (December 2023): https://arstechnica.com/gadgets/2023/12/no-a-marketing-firm-isnt-tapping-your-device-to-hear-private-conversations/

5. Federal Trade Commission, "FTC Proposed Consent Orders with Cox Media Group and Two Other Firms Over Alleged Deceptive Claims About 'Active Listening' Marketing Service" (May 21, 2026): https://www.ftc.gov/news-events/news/press-releases/2026/05/ftc-require-cox-media-group-two-other-firms-pay-nearly-1-million-settle-charges-they-deceived

6. Apple iPhone User Guide, "Control access to hardware features on iPhone": https://support.apple.com/guide/iphone/control-access-to-hardware-features-iph168c4bbd5/ios

7. Google Android Help, "Change app permissions on your Android phone": https://support.google.com/android/answer/9431959

Not affiliated with Apple, Google, Cox Media Group, or any company mentioned.

According to a 2023 complaint filed by the FTC and the Department of Justice, until mid-2019, when Alexa users deleted a voice recording (including parents deleting their children's recordings), Amazon in many instances deleted the audio but kept the written transcript in "residual data stores" and used those words to improve Alexa.

In the app, the play button and text disappeared, so it looked gone. It wasn't.

#What the FTC said Amazon kept

The FTC and DOJ's complaint against Amazon was filed on May 31, 2023 in the U.S. District Court for the Western District of Washington (Case No. 2:23-cv-00811).

Paragraph 28 of the complaint states:

"until mid-2019, Amazon's practice was to delete the requested voice recordings but keep written transcripts of those recordings. Specifically, when users requested deletion of their voice recordings, or when parents used the Alexa Privacy Hub or the Alexa App to delete their children's voice recordings, Alexa deleted the voice recordings but retained written transcripts of those recordings in residual data stores. Those transcripts remained available for Amazon's benefit and use for product improvement. ... In fact, when the user selected "delete recording," the "play" button for the recording and the written text disappeared, suggesting that both the audio and text files had been deleted. Accordingly, in many instances Amazon kept users' or children's written transcripts ... Amazon used children's recordings, both audio files and transcripts, for purposes such as refining Alexa's voice recognition and natural language processing capabilities."

The FTC's press release on May 31, 2023 said: "even when a parent sought to delete that information, the FTC said, Amazon failed to delete transcripts of what kids said from all its databases."

#How many employees had access

The same complaint, paragraph 29, alleged:

"between August 2018 and September 2019, Amazon Alexa users' voice recordings were accessible to 30,000 of its employees, approximately 15,000 of whom lacked any business need for such access."

That's 30,000 employees who could access your recordings. About half of them, the FTC alleged, had no business reason to see them.

#Amazon denies breaking the law

Amazon settled the case and released a statement on its website:

"While we disagree with the FTC's claims and deny violating the law, this settlement puts the matter behind us."

The settlement was entered as a stipulated order on July 19, 2023. The complaint describes past practices and allegations, not Amazon's current systems.

#What Amazon says today

Amazon's Alexa privacy page states: "All of your voice recordings and transcripts are saved by default, but you can change how long they are saved or choose to delete them at any time."

As of March 28, 2025, Amazon discontinued the "Do Not Send Voice Recordings" setting, which allowed local processing on certain Echo devices (Echo Dot 4th Gen, Echo Show 10, and Echo Show 15) for U.S. English. According to Ars Technica, all Alexa requests now go to Amazon's cloud. With "Don't save" enabled, Amazon says requests are deleted after processing.

#How to turn on "Don't save" in the Alexa app

Here's how to stop Alexa from saving your voice recordings and transcripts, according to Amazon Help:

1. Open the Alexa app
2. Tap More (the three horizontal lines, usually at the bottom right)
3. Tap Alexa Privacy
4. Tap Manage Your Alexa Data
5. Tap Voice Recordings (and Transcripts)
6. Choose Don't save (other options: save until deleted, save for 18 months, save for 3 months)
7. Tap Confirm

According to Amazon Help, when you choose "Don't save":

• All previously saved voice recordings will be deleted (may take up to 36 hours)
• Future voice recordings will not be saved
• Chat transcripts and typed requests are kept until the chat has been inactive for 30 days, after which they are automatically deleted
• Any Voice IDs linked to this account will also be deleted

You can delete transcripts sooner by going to Review Voice History in the Alexa app and deleting them manually.

#Optional: Enable deletion by voice

You can also tell Alexa to delete recordings by saying:

• "Alexa, delete everything I said today"
• "Alexa, delete what I just said"

To enable this feature, go to Alexa Privacy, then Review Voice History, then turn on Enable deletion by voice.

#For kids' profiles

If your child has an Alexa profile through Amazon Kids or a family account, review their voice recordings separately in the Parent Dashboard or Amazon Kids settings.

#What you lose when you turn on "Don't save"

When "Don't save" is enabled, some Alexa features stop working or become less personal:

• Voice ID is deleted and will no longer work
• Alexa may not recognize you for personalized responses
• Some skills that rely on your voice history may not work as expected

Amazon says basic Alexa commands and smart home controls still work.

#Why this matters for your privacy

Voice recordings and transcripts reveal sensitive details about your household: your schedule, what you watch, what you buy, health questions you ask, and whether children are present.

According to the FTC's complaint, Amazon's default settings as of 2023 saved children's and adults' recordings and transcripts indefinitely. Even when users thought they had deleted recordings, the FTC alleged Amazon kept the transcripts.

To see where else your personal information is listed, run a free check to find your profiles on people-search sites, data brokers, and leak forums.

Run a free privacy check

#Keep your data off data brokers

Even after you turn on "Don't save," your data can still spread through data brokers who buy and resell personal information. UndoLeak erases your data from data brokers and keeps it off.

Sources:

• Federal Trade Commission and U.S. Department of Justice, Complaint, United States v. Amazon.com, Inc., Case No. 2:23-cv-00811 (W.D. Wash., filed May 31, 2023): ftc.gov/system/files/ftc_gov/pdf/Amazon-Complaint-(Dkt.1).pdf
• Federal Trade Commission, "FTC and DOJ Charge Amazon with Violating Children's Privacy Law by Keeping Kids' Alexa Voice Recordings Forever and Undermining Parents' Deletion Requests" (May 31, 2023): ftc.gov/news-events/news/press-releases/2023/05/ftc-doj-charge-amazon-violating-childrens-privacy-law-keeping-kids-alexa-voice-recordings-forever
• U.S. Department of Justice, "Amazon Stipulated Order and Injunctive Relief for Alleged Violations of Children's Privacy Law" (July 19, 2023): justice.gov/archives/opa/pr/amazon-agrees-injunctive-relief-and-25-million-civil-penalty-alleged-violations-childrens
• Amazon, "Amazon's response to our recent settlement with the U.S. Department of Justice regarding Alexa" (2023): aboutamazon.com/news/policy-news-views/amazon-response-to-ftc-settlement-regarding-alexa
• Amazon Help, "Delete Alexa Voice Recordings and Transcripts Automatically" (2026): amazon.com/gp/help/customer/display.html?nodeId=G68KUKTXN92WY3C3
• Ars Technica, Scharon Harding, "Everything you say to your Echo will be sent to Amazon starting on March 28" (March 14, 2025): arstechnica.com/gadgets/2025/03/everything-you-say-to-your-echo-will-be-sent-to-amazon-starting-on-march-28/

Not affiliated with Amazon or Alexa.

To freeze your credit, place a free freeze separately with each of the three nationwide credit bureaus (Equifax, Experian and TransUnion) online or by phone. It's free, doesn't affect your credit score and lasts until you lift it. Also freeze ChexSystems, which banks use to approve new checking and savings accounts, and keep the PIN or password each one gives you.

Quick answer: A credit freeze stops anyone (including you) from opening new credit in your name. Freeze at Equifax (equifax.com/personal/credit-report-services/credit-freeze or 1-888-298-0045), Experian (experian.com/freeze/center.html or 1-888-397-3742) and TransUnion (transunion.com/credit-freeze or 1-888-909-8872). Each freeze only covers that bureau, so you need all three. Also freeze ChexSystems (chexsystems.com/security-freeze/place-freeze or 800-887-7652). By law, online or phone freezes must be placed within one business day. It's free to place and lift, doesn't affect your score, and lasts until you lift it. Save every PIN or password. When applying for credit, find out which bureau the lender uses and lift only that one (within one hour online or by phone), then refreeze.

Every fact below comes from official FTC, CFPB and USA.gov pages, the three credit bureaus' freeze pages, ChexSystems' official security freeze information, and the FTC's Equifax complaint and Consumer Sentinel Data Book 2024, accessed October 27, 2026. Maya Brooks and all records shown in the video are fictional.

#Watch: How to freeze your credit

If 406,110 reports of new credit card fraud in one year (FTC Consumer Sentinel 2024) sounds like a reason to freeze, this video walks through all four freezes step by step, the PIN you'll need to save, and the gap a freeze leaves wide open.

#What does a credit freeze actually do?

The FTC says while a freeze is in place, "nobody can open a new credit account in your name." That includes you.

It's free to place, and free to lift. It doesn't affect your credit score. And it lasts until you lift it.

#The Equifax breach: 145.5 million Social Security numbers

Think your number is safe? In 2017, attackers stole approximately 147 million names and dates of birth, 145.5 million Social Security numbers, and 99 million physical addresses from Equifax. A credit bureau.

#Anyone can freeze, any time, for any reason

So the FTC says you don't have to wait for a breach. Anyone can freeze their credit, any time, for any reason.

#Credit lock vs freeze: freezes are free

One trap. Credit bureaus also sell credit locks. The CFPB says locks are no more effective than freezes, and freezes are free.

#How do I freeze my credit with all three bureaus?

A freeze only works at the bureau you freeze. So you need all three. Equifax, Experian and TransUnion. Each one, separately.

#Step 1: Freeze Equifax

Go to equifax.com/personal/credit-report-services/credit-freeze. Create a free account, confirm your identity, and choose freeze.

You can also call: 1-888-298-0045 (toll-free number from the FTC's credit freeze article).

#Step 2: Freeze Experian

Go to experian.com/freeze/center.html. Create a free account, confirm your identity, and choose freeze.

You can also call: 1-888-397-3742.

#Step 3: Freeze TransUnion

Go to transunion.com/credit-freeze. Create a free account, confirm your identity, and choose freeze.

You can also call: 1-888-909-8872.

#Step 4: Save each PIN or password

You'll usually get a PIN or a password to lift it later. The FTC says you'll need it to place or lift the freeze. Save all three somewhere safe.

#How long does a freeze take?

By law, a freeze you request online or by phone must be placed within one business day. By mail, within three business days. (CFPB, USA.gov)

#The freeze nobody tells you about

Credit bureaus cover loans and credit cards. But when you open a checking account, banks often check a different file. It's called ChexSystems.

#What is ChexSystems?

The CFPB lists ChexSystems as a consumer reporting company that reports checking account applications, openings, and closures. It will freeze on request, and you're entitled to one free report every 12 months.

#ChexSystems freeze: free and separate

ChexSystems says its freeze "is designed to prevent approval of checking, savings, credit accounts, loans, or other services from being approved in your name without your consent."

You can place it free through the ChexSystems consumer portal, or by phone at 800-887-7652. It sends you a PIN.

#Freeze credit for children under 16

Got kids? The FTC says parents and guardians can freeze credit for children under 16, for free. Some bureaus want that request by mail.

#How do I unfreeze (lift) my credit freeze?

Need a loan or a new card? The FTC says find out which bureau the lender will check, lift only that one, then freeze it again when you're done.

#Lifts happen fast

The CFPB says online or phone lifts must happen within one hour.

#Lifting is free

Just like placing a freeze, lifting one is free. Log into the bureau's site with your PIN or password and lift it temporarily or permanently.

#Credit freeze vs fraud alert: what's the difference?

A fraud alert is different. You contact one bureau, and it tells the other two. The FTC says lenders have to verify it's you. But they can still see your report.

A fraud alert lasts one year. A freeze lasts until you lift it.

#Does a credit freeze stop people-search sites from showing my info?

No.

#The gap a freeze leaves open

A freeze locks your credit file. It doesn't touch what people-search sites sell about you.

The FTC says with just your name or phone number, someone can buy a report with your age, date of birth, current and previous addresses, and family members.

That's exactly the detail an impostor needs.

#Opt out site by site, for free

You can opt out of people-search sites one by one, for free. But the FTC warns your information can reappear when public records change.

#How many reports of credit card fraud in 2024?

Four hundred six thousand, one hundred ten.

That's how many people told the FTC, in 2024, that someone opened a new credit card in their name. Not their old card. A brand new account. (FTC Consumer Sentinel Data Book 2024)

Total identity theft reports in 2024: 1.1 million.

#Quick recap: freeze all four

1. Freeze Equifax (equifax.com/personal/credit-report-services/credit-freeze or 1-888-298-0045)
2. Freeze Experian (experian.com/freeze/center.html or 1-888-397-3742)
3. Freeze TransUnion (transunion.com/credit-freeze or 1-888-909-8872)
4. Freeze ChexSystems (chexsystems.com/security-freeze/place-freeze or 800-887-7652)
5. Save every PIN or password somewhere safe
6. When you apply for credit, ask which bureau the lender uses and lift only that one (within one hour online or by phone)
7. Refreeze after the application is done

Then the part a freeze can't do.

#Credit freezes don't remove your data from people-search sites

UndoLeak erases your data from data brokers and keeps it off.

Start with a free scan at undoleak.com.

#Related guides

A credit freeze stops new accounts. But your Social Security number, address and birthday are already public on people-search sites.

• What to do after a data breach: Found your email in a breach? First hour, first day, first week steps, including when to freeze
• Have I Been Pwned? What to Do If You're Pwned: What pwned means, the 10-minute checklist, and when to freeze after Have I Been Pwned
• How scammers use data brokers: The public detail that makes identity theft easy
• How to remove personal information from the internet: Step-by-step guide to opting out of people-search sites
• Why data comes back after you opt out: The public records cycle that refills listings

Have you frozen all four yet? A freeze is free and you do it yourself. UndoLeak doesn't freeze credit. But we erase the detail people-search sites sell about you, which is exactly what an impostor needs.

Strangers might be showing up in your PlayStation family.

Players have reported unknown child accounts added to their PSN family without permission. Some say it happened even with two-step verification turned on. One post about it on X passed 340,000 views on October 26, 2026. Sony told Japan's Sankei Shimbun newspaper it is "under investigation."

Here's what's been reported, what Sony has said, and how to check your own account.

#What players are reporting

As of October 26, 2026, PlayStation players have been reporting unknown child accounts appearing in their PlayStation Network family without permission.

#The reports

According to Japan's Sankei Shimbun newspaper (October 26, 2026), "posts keep appearing on social media that family accounts were added without the user's permission." The paper reports that the issue reportedly began in early October 2026. GamingBible also reported that "similar PSN security complaints appear to date back to early October" (October 26, 2026).

#What some players say about two-step verification

Sankei Shimbun reported that passwords and two-step verification are bypassed. Beebom reported that "some users allege that attackers got past both passwords and 2FA set up on PSN accounts" (October 26, 2026).

Important: Sony has not confirmed a breach or a bypass of two-factor authentication. These are player reports.

#Email changes

Some users have also reported receiving emails about changes to their sign-in IDs or email addresses that they didn't make, according to Beebom (October 26, 2026).

#Viral post

A post by @Pirat_Nation on X (October 26, 2026) about the PSN security issue had reached 346,663 impressions as of October 26, 2026, at approximately 16:30 UTC.

#What Sony has said

Sony told Japan's Sankei Shimbun newspaper that the issue is "under investigation" (調査中), according to the paper's October 26, 2026 report.

Sony has not publicly confirmed:

• What is causing the issue
• How many accounts are affected
• Whether this is a breach or a security vulnerability
• Whether payment details or personal data were accessed

#What has not been confirmed

It's important to note what has not been confirmed:

According to VGTimes (October 26, 2026), "no theft of data or unauthorized purchases has been confirmed."

There is no confirmed evidence that:

• Payment details were stolen
• Personal data was accessed
• Unauthorized purchases were made
• A PlayStation Network breach occurred
• Two-step verification was bypassed

These remain player reports under investigation by Sony.

#The problem: child accounts can't be removed by you

Here's the worst part: according to PlayStation Support's help page "How to set up your family on PlayStation," child members cannot be removed from your family.

The help page states: "Please note, child members cannot be removed from your family."

This means if an unknown child account appears in your family, you likely cannot remove it yourself. You'll need PlayStation Support's help.

#What to check now

Even if you haven't seen any suspicious activity, it's worth checking your PSN account and family settings.

#1. Check your Family Management

On PS5:

1. Go to Settings
2. Go to Users and Accounts
3. Go to Family (or Family Management)
4. Look for any members you don't recognize

On mobile or web: Use the PlayStation Family Management app or website to review your family members.

If you see a child account you don't recognize, that's a red flag.

#2. Check your inbox for email changes

Watch for emails from PlayStation about:

• Changes to your sign-in ID
• Changes to your email address
• Password reset requests you didn't make
• Two-step verification codes you didn't request
• Sign-in from devices or locations you don't recognize

If you receive any of these and you didn't make the change, that's a sign your account may have been accessed.

#3. Review your account information

Log in to your PlayStation account and check:

• Your sign-in ID (email address)
• Your personal information (name, date of birth, address)
• Your linked payment methods
• Recent sign-in activity if available

Look for any changes you didn't make.

#4. Check your transaction history

Review your purchase history for any transactions you don't recognize. While no unauthorized purchases have been confirmed in these reports, it's still worth checking.

#5. Review your security settings

Make sure you have strong security in place:

• Password: Use a strong, unique password you don't use anywhere else
• Two-step verification: Even though some players report issues occurred with 2FA enabled, it's still an important security layer. Make sure it's turned on.
• Passkeys: If PlayStation supports passkeys, consider using one
• Remove unknown passkeys: Check your security settings for passkeys you don't recognize and remove them

#6. Sign out of all devices

If you're concerned your account was accessed, you can sign out of all devices from your PlayStation account settings. This will log you out everywhere, and you'll need to sign in again on your own devices.

#What to do if you find something suspicious

If you find an unknown family member, a change you didn't make, or any suspicious activity:

#1. Contact PlayStation Support immediately

Since child members cannot be removed by you, you'll need PlayStation Support's help. Contact them through their official support channels.

Do not click links in emails claiming to be from PlayStation. Go to the official PlayStation support website yourself by typing the URL directly.

#2. Change your password

Change your PlayStation account password to a new, strong, unique password you don't use anywhere else.

Do this by going to the official PlayStation website or account settings, not by clicking a link in an email.

#3. Review and update two-step verification

Even though some players report this happened with 2FA enabled, make sure your two-step verification is still turned on and working properly.

If you use backup codes, generate new ones and store them safely.

#4. Check linked accounts and apps

Review what third-party accounts, apps, or services are connected to your PlayStation account. Remove any you don't recognize or no longer use.

#5. Monitor your email and payment methods

Keep an eye on:

• Your email inbox for PlayStation notifications
• Your bank or card statements for PlayStation charges
• Your PlayStation purchase history

#The scam risk: fake PlayStation emails

After news like this spreads, scammers send phishing emails pretending to be from PlayStation.

Red flags to watch for:

• "Your PlayStation account was compromised. Click here to secure it."
• "Verify your account immediately to prevent suspension."
• Urgent language with links or attachments
• Emails asking you to re-enter your password or payment information
• Messages that look official but come from suspicious email addresses

The rule: Never click links in unsolicited emails claiming to be from PlayStation or Sony. If you need to check your account, go to the official PlayStation website yourself by typing the URL directly into your browser.

#A fictional example

Jordan Park, a PlayStation player in Seattle, saw the news about PSN family security issues on October 26 and decided to check his own account. He:

1. Opened Settings > Users and Accounts > Family on his PS5
2. Found two child accounts he didn't recognize: accounts created in early October with usernames he'd never seen
3. Checked his email and found no notifications from PlayStation about adding family members
4. Immediately contacted PlayStation Support through their official website (not an email link) and reported the unknown accounts
5. Changed his PlayStation password to a new, unique one saved in his password manager
6. Verified his two-step verification was still enabled and working
7. Reviewed his transaction history and found no unauthorized purchases
8. Checked his linked payment methods and didn't see any changes

While waiting for PlayStation Support to respond, Jordan kept monitoring his email for any PlayStation notifications and checked his bank statements for any suspicious PlayStation charges. None appeared.

Three days later, PlayStation Support responded and removed the unknown child accounts from his family.

#Timeline

#The bigger picture: protecting gaming accounts

Gaming accounts are valuable targets because they:

• Are tied to verified email addresses
• Often have payment methods saved
• Hold purchased games, progress, and in-game items worth real money
• Have loyal users who respond quickly to urgent security messages

Common gaming account security issues include:

Best practices:

• Use a strong, unique password for your gaming accounts
• Never reuse passwords across accounts
• Enable two-factor authentication or passkeys
• Don't click links in unsolicited emails
• Sign out when using a shared or public device
• Keep your email account secure (it's the key to account recovery)

#The honest summary

PlayStation players have reported unknown child accounts appearing in their PSN families without permission, reportedly since early October 2026. Some say it happened even with two-step verification enabled. Sony told Sankei Shimbun it is investigating, but the company has not confirmed what is causing the issue, how many accounts are affected, or whether personal data was accessed.

The complicating factor: PlayStation's own help page says child members cannot be removed from a family, so if you find an unknown account, you'll likely need PlayStation Support's help.

What you can do: Check your Family Management settings on PS5 or via the PlayStation Family Management app for members you don't recognize. Watch your email for sign-in ID or email change notifications you didn't request. Review your password and security settings. If you find anything suspicious, contact PlayStation Support through their official channels.

After the headlines: Be extremely cautious about any emails claiming to be from PlayStation over the next few weeks. Scammers will send fake "security alert" messages with links to phishing sites. If you need to check your account, go to the official PlayStation website yourself.

UndoLeak erases your data from data brokers and keeps it off. Your PlayStation account is just one place your information lives online. People-search sites list your email, phone number, and address in public profiles that anyone can find. We remove those listings and monitor so they can't come back. Run a free scan to see where your information is listed right now.

#Sources

1. Sankei Shimbun, "PSN不正アクセスか 本人の許可なく家族アカウント追加相次ぐ ソニー「調査中」" [Unauthorized PSN access? Family accounts added without permission, Sony says "under investigation"] (October 26, 2026). https://www.sankei.com/article/20261026-R6W5WIZL4NJALL4QF4H4KKVXHM/

2. @Pirat_Nation, X post (October 26, 2026, 09:29 UTC). 346,663 impressions as of October 26, 2026, ~16:30 UTC. https://x.com/Pirat_Nation/status/2114650492038938740

3. PlayStation Support, "How to set up your family on PlayStation." https://www.playstation.com/en-us/support/account/playstation-family-account-set-up/

4. GamingBible, "PlayStation Users Report Mysterious Security Issue After 'Unknown Family Members' Added Without Consent" (October 26, 2026). https://www.gamingbible.com/news/platform/playstation/playstation-psn-security-issue-unknown-family-accounts-600427-20261026

5. Beebom, "PlayStation Users Report Unauthorized Child Accounts, Email Changes" (October 26, 2026). https://beebom.com/playstation-users-report-unauthorized-child-accounts-email-changes/

6. VGTimes, "PlayStation Network Users Report Unknown Child Profiles in Family Groups" (October 26, 2026). https://vgtimes.com/tech-and-hardware/172397-playstation-network-users-report-unknown-child-profiles-in-family-groups.html

Jordan Park and his details are fictional. Not affiliated with Sony or PlayStation.

You returned the rental car. Your phone didn't leave with you.

When you pair your phone with a car's infotainment system, the car can store far more than you might expect. The FTC says that unless you delete it, future renters or rental car employees may be able to see it.

#What rental cars can keep

In December 2025, the FTC updated its consumer advice on renting cars, with a section specifically about connected cars and privacy. According to the FTC, a rental car with infotainment features "might keep your personal information long after you've returned the car."

What may be stored:

• Locations you entered into the GPS (like where you work or live)
• Your phone number
• Call and message logs
• Contacts
• Text messages

The FTC notes that "unless you delete that data before you return the car, future renters or rental car employees may be able to see it."

The guidance was first issued by the FTC in August 2016, according to a CISA alert from that month. The December 2025 update reflects that the issue has remained relevant as more rental cars come equipped with these systems.

#How to delete your phone before returning a rental

The FTC provides clear steps to protect your privacy before you hand back the keys:

#Step 1: Find the paired devices list

Go into the infotainment system's settings menu and look for the list of devices that have been paired with the system. This is usually under Bluetooth settings or a connected devices menu.

If you can't find it, check the owner's manual (often stored in the glove compartment) or ask the rental company for help.

#Step 2: Delete your device

Once you've found your device in the list, follow the prompts to delete it. This removes your phone's pairing record and should clear the associated data.

#Step 3: Clear navigation history if possible

If the car's GPS system has a history of recent destinations, clear that too. Not all systems allow this, but if the option exists, it's worth using before you return the car.

#Charging without pairing

If you only want to charge your phone, the FTC recommends avoiding the car's USB port entirely.

Why? In some cases, the USB connection may transfer data automatically, even if you only intended to charge.

What to do instead: Use a cigarette lighter adapter (also called a 12V adapter). This provides power without creating a data connection.

#Grant only the access you need

When you do pair your phone with a rental car, pay attention to what permissions the system requests.

According to the FTC, if you're only using the system to stream music, you don't need to grant access to your contacts, call logs or text messages. Deny those permissions if the system asks for them.

Some systems may not give you granular control over permissions, in which case your best option is to avoid pairing at all and use the cigarette lighter adapter for charging.

#The bigger picture: car privacy policies

The rental car data issue is just one part of a much larger problem with automotive privacy.

#Mozilla's 2023 car privacy review

In September 2023, Mozilla Foundation's Privacy Not Included team published a comprehensive review of 25 car brands. The findings were stark.

Key results:

• All 25 brands received Mozilla's Privacy Not Included warning label
• 84% (21 of 25) said they can share personal data with service providers, data brokers, and other businesses
• 76% (19 of 25) said they can sell personal data
• 56% said they can share data with government or law enforcement on a "request" (not requiring a warrant or court order)
• 92% give drivers little or no control over their data

Only Renault and Dacia said that all drivers can have their data deleted.

#What the policies listed

Mozilla's review highlighted particularly invasive categories in some privacy policies:

• Nissan: Policy listed "sexual activity" among the data it may collect
• Kia: Policy listed "sex life"
• Six brands: Policies mentioned "genetic information"

It's important to note: these are categories listed in the privacy policies, meaning the companies claim they may collect this data. Mozilla did not report that any of these companies actually collected this data in practice, only that their policies allow for it.

#Context: CNBC reporting on rental car policies

In September 2024, CNBC reported that rental companies like Avis and Enterprise place the responsibility for deleting synced phone data on the renter, according to their privacy policies. This aligns with the FTC's guidance: it's your job to delete your data before you return the car.

#The same advice applies to your own car

If you're planning to sell or trade in your own car, the same steps apply.

The FCC's Bluetooth security tips recommend that you unpair your phone from any vehicle before you sell it or trade it in. Go through the same process: open the car's settings, find the list of paired devices, and delete your phone.

You should also clear any saved destinations from the navigation system and reset the infotainment system to factory settings if the option is available.

#Why this matters

The rental car scenario makes the privacy risk concrete: you give back the car, and someone else gets in. That next person, or the rental company's employees, may have access to your texts, call logs, contacts, and the places you visited.

But the Mozilla report shows that the data collection risk extends far beyond the rental lot. Modern cars collect vast amounts of data, and the majority of car brands' privacy policies allow them to share or sell that data.

The FTC's guidance is practical: delete your phone, use a plug adapter for charging, and grant only the permissions you actually need. These steps won't solve the systemic privacy issues in the automotive industry, but they will limit what data you leave behind when you return the keys.

#What you can do

Before returning a rental car:

1. Open the car's settings
2. Find the list of paired devices
3. Delete your phone
4. Clear navigation history if possible

For charging only:

• Use a plug-in cigarette lighter adapter, not the USB port

When pairing:

• Grant only the access you need (music doesn't require contacts)

Before selling or trading in your own car:

• Unpair your phone from the car's system
• Clear saved destinations from the navigation system
• Reset the infotainment system to factory settings if available

UndoLeak erases your data from data brokers and keeps it off. Rental car infotainment systems are one place your data can leak. We handle the rest: people-search sites, Google results, leaked information, and ongoing monitoring so brokers can't rebuild your profile. Run a free scan to see where your information is listed right now.

#Sources

1. Federal Trade Commission, Consumer Advice, "Renting a Car", section "Connected Cars and Privacy" (page updated December 2, 2025; guidance first issued August 2016)

2. Mozilla Foundation, Jen Caltrider, Misha Rykov, Zoë MacDonald, "It's Official: Cars Are the Worst Product Category We Have Ever Reviewed for Privacy" (September 6, 2023) - Archived copy

3. CNBC, "Hidden risk of syncing your phone to rental car infotainment system" (September 25, 2024)

4. Federal Communications Commission, "Wireless Connections and Bluetooth Security Tips" (PDF)

5. CISA, Alert (TA16-243A), "Rental Vehicles May Be Recording Driver Location Data" (August 30, 2016)

Not affiliated with any car manufacturer, rental company, or Mozilla Foundation.

You scan your loyalty card at checkout. The register prints coupons matched to what you buy. It feels personalized. What you might not know: the store keeps a file on you.

In 2025, Consumer Reports looked at one Kroger shopper's loyalty profile. It was 62 pages long.

#What one shopper's Kroger file contained

In May 2025, Consumer Reports published an investigation based on a Kroger customer's profile, obtained through Oregon's new data and privacy law.

What the profile included:

• An estimated annual income (the estimate was wrong, the shopper made much more)
• Education level (listed as high school degree when he had graduated from college)
• Inferred preferences (the profile said he was very likely to want to go on a cruise, he doesn't)
• A "non-loyal" label despite years of shopping at Kroger

Consumer Reports noted that almost everything in the 62-page profile was wrong.

Where it went. Kroger acknowledged in writing to the shopper that his report may have been sent to more than 50 different U.S. companies, including:

• Two tobacco companies
• One of the country's largest data brokers
• Financial institutions
• Analytics and marketing firms

Kroger stated to Consumer Reports: "Kroger does not personalize prices on its products," clarifying that it personalizes offers and discounts, not base prices.

#How grocery stores build these profiles

#They start with what you give them

When you sign up for a loyalty card, you typically provide:

• Your name
• Your address
• Your phone number
• Your email address

Then the store links every purchase you make to that profile.

#They add data from brokers

In February 2023, The Markup reported that many grocers systematically "enrich" the information you provide with additional data purchased from third-party data brokers.

What gets added, according to The Markup:

• Race and ethnicity
• Age
• Financial information
• Employment details
• Online activities

This lets stores infer details about you that you never directly provided.

#They track thousands of variables

84.51° is Kroger's in-house data unit. According to The Markup, an 84.51° marketing brochure titled "Taking the Guesswork Out of Audience Targeting" claimed: "We have collected over 2,000 variables on customers."

The unit's name comes from the longitude of Kroger's Cincinnati headquarters.

#The surveillance pricing context

In January 2025, the FTC released initial findings from its surveillance pricing study, which examined how companies use personal data to set individualized consumer prices.

The study was conducted under Section 6(b) of the FTC Act and covered multiple industries. It did not name specific grocery retailers or make findings about whether particular companies engage in surveillance pricing.

The FTC described surveillance pricing as using detailed consumer data to set personalized prices, noting that this practice raises concerns about potential discrimination and privacy.

This is separate from Kroger's statement that it does not personalize product prices.

#How to request your data and opt out

Many U.S. states give residents the right to know what personal information companies collect about them and the right to opt out of data sales. Consumer Reports noted that as of 2025, 13 states had opt-out rights, with more states adding these protections by 2026. Some companies honor these requests nationwide, regardless of where you live.

#Step 1: Find your store's privacy request page

Search your store's name plus "privacy request" in Google, or look for a "Privacy Policy" or "Your Privacy Rights" link at the bottom of the store's website.

For Kroger specifically:

• Visit kroger.com/i/privacy-policy/rights-and-choices
• Or call Kroger's customer contact center at 1-800-576-4377

#Step 2: Request a copy of your data (Right to Know)

This is sometimes called a "Right to Access" or "Right to Know" request. The store will verify your identity (Kroger asks for your name, address and Loyalty ID) and provide a copy of what they have on file.

Expect the response within a few weeks. Some states require companies to respond within 45 days.

#Step 3: Opt out of data sales and sharing

Look for options labeled:

• "Do not sell or share my personal information"
• "Opt out of sale"
• "Right to opt out"

According to Kroger's privacy policy, loyalty members can opt out of the sale of their information through the customer contact center. The policy notes that some loyalty features may change after you opt out.

#Step 4: Consider requesting deletion or correction

Many privacy laws also give you the right to:

• Delete your data (though this might mean losing your loyalty account)
• Correct inaccurate information (useful if your profile has wrong details like the Consumer Reports example)

#The trade-off

Opting out may affect some loyalty features. Personalized coupons might become less targeted, or you might receive generic offers instead of ones matched to your purchase history.

This is the cost of limiting data collection: less personalization, but more privacy.

#What about other grocery stores?

Kroger is not unique. According to The Markup's 2023 investigation, many major grocery chains use similar loyalty data practices.

Other grocers with loyalty programs:

• Albertsons (which owns Safeway, Vons, Jewel-Osco, and others)
• Ahold Delhaize (Food Lion, Giant, Stop & Shop)
• Target
• Walmart

Each has its own privacy policy. The steps above apply to any store: find their privacy policy, request your data, and opt out of sales.

#What you can do without a loyalty card

If you want to shop without being tracked:

• Pay cash without using a loyalty card. Cash purchases aren't linked to your identity unless you provide a card or phone number.
• Use a generic loyalty number. Some stores let you use a phone number instead of scanning a card. You could use a phone number that isn't yours (though this may violate the store's terms of service).
• Accept that you'll pay more. Loyalty discounts can be significant. The trade-off is direct: tracked data or higher prices.

At many stores, loyalty pricing has become the default, with non-members paying substantially more. This makes avoiding tracking expensive.

#Sources

1. Consumer Reports, Derek Kravitz, "Inside Kroger's Secret Shopper Profiles: Why You May Be Paying More Than Your Neighbors" (May 21, 2025). https://www.consumerreports.org/money/questionable-business-practices/kroger-secret-grocery-shopper-loyalty-profiles-unfair-a1011215563/

2. The Markup, Jon Keegan, "Forget Milk and Eggs: Supermarkets Are Having a Fire Sale on Data About You" (February 16, 2023). https://themarkup.org/privacy/2023/02/16/forget-milk-and-eggs-supermarkets-are-having-a-fire-sale-on-data-about-you

3. Kroger privacy policy, "Your Rights and Choices." https://www.kroger.com/i/privacy-policy/rights-and-choices

4. Federal Trade Commission, "FTC Surveillance Pricing Study Indicates Wide Range of Personal Data Used to Set Individualized Consumer Prices" (January 17, 2025). https://www.ftc.gov/news-events/news/press-releases/2025/01/ftc-surveillance-pricing-study-indicates-wide-range-personal-data-used-set-individualized-consumer

UndoLeak erases your data from data brokers and keeps it off. Loyalty card data is one source. We handle the rest: people-search sites, Google results, leaked information, and ongoing monitoring so brokers can't rebuild your profile. Run a free scan to see where your information is listed right now.

Not affiliated with Kroger or 84.51°.

To stop spam calls, turn on your phone's built-in spam filter (iPhone: Settings > Apps > Phone > Screen Unknown Callers and Call Filtering > Spam; Android/Google Phone app: Settings > Spam and Call Screen > Filter spam calls), turn on your carrier's free blocker (AT&T ActiveArmor, Verizon Call Filter, T-Mobile Scam Block via #662#), register at donotcall.gov and report calls that get through. Then fix the source: don't hand your number to giveaway/job/quiz forms with partner-consent checkboxes, revoke consent, and opt out of people-search sites, because blocking one number doesn't take your number off the lists.

Every fact below comes from official FTC and FCC pages, Apple/Google/carrier support pages, and FTC Operation Stop Scam Calls (July 18, 2023), accessed October 26, 2026. Dana Ortiz and all numbers shown in the video are fictional (555 numbers).

#Watch: How to stop spam calls

If you're blocking numbers but the calls keep coming, this video walks through every free fix in order: the spam switches already on your phone, your carrier's free blocker, the Do Not Call Registry, reporting, and the step most people skip - cutting off the source that keeps feeding your number to new lists.

#Why am I getting so many spam calls?

#Scammers can call cheap over the internet

Why so many robocalls? The FTC says: "it's cheap and easy for them to make robocalls over the internet from anywhere in the world." One operation can dial huge numbers of phones for very little money.

In fiscal year 2025, the FTC got more than 2.6 million Do Not Call complaints. The top topics: reducing debt, imposters, and medical and prescriptions. As of September 30, 2025, there were more than 258 million active registrations on the Do Not Call Registry.

#Your number is on lists

In July 2023, the FTC announced Operation Stop Scam Calls, a sweep with 100+ federal and state partners and 180+ actions. The targets were lead generators that "deceptively collect and provide consumers' telephone numbers to robocallers and others, falsely representing that these consumers have consented."

One company, Fluent, LLC, ran deceptive ads promising employment opportunities or free items (for example, a job interview or a $1,000 gift card). The consent was buried in fine print. According to the FTC complaint, "From January 2018 to December 2019" Fluent "obtained and sold more than 620 million telemarketing leads." The proposed order includes a $2.5 million civil penalty and a robocall ban.

That's one company. Your number can end up on lists through:

• Giveaway, job and quiz forms. Many include consent language allowing several "partners" to contact you.
• People-search sites. The FTC says with just your phone number, someone could buy a report with your age, your current and previous addresses, and the names and addresses of your family members.
• Data breaches. Leaked databases often include phone numbers tied to names.
• Answering robocalls. The FTC warns that pressing a number to be "removed" from a list "might lead to more unwanted calls" because it tells the caller the number is live.

#Why doesn't blocking a number stop spam calls?

You're blocking the caller. Not the source.

The FTC says caller ID is easy to fake. The number you just blocked probably wasn't real. The next call can show a different number, often one that looks local.

Blocking catches calls. It doesn't take your number off the lists.

#How do I stop spam calls on iPhone?

Apple's spam call settings have two layers.

#Step 1: Turn on Screen Unknown Callers

Open Settings > Apps > Phone. Under Screen Unknown Callers, pick Ask Reason for Calling or Silence.

Apple explains:

• Never - calls come through normally
• Ask Reason for Calling - unknown callers must state why they're calling before your phone rings
• Silence - unknown callers go straight to voicemail

#Step 2: Turn on Spam filtering

Under Call Filtering, turn on Spam.

According to Apple's guide, "Calls identified by your carrier as potential spam or fraud are silenced, sent to voicemail, and moved to the Spam list."

#Save important numbers first

Apple advises: "Add important numbers to your Contacts - family, friends, your child's school, your doctor's office." Otherwise silencing unknown callers can hide calls you need.

#How do I stop spam calls on Android?

Android spam call protection varies by phone.

#Google Phone app (most Android phones)

Tap the menu (three dots or lines), then Settings, then Spam and Call Screen. Turn on Filter spam calls.

Google's support page says the Phone app can filter spam calls automatically.

#Pixel: Call Screen

On a Pixel, Call Screen can screen unknown callers for you. The Google Assistant answers, asks why they're calling, and shows you a transcript. You pick whether to answer or hang up.

Call Screen is available in the same Spam and Call Screen settings.

#Samsung phones

Go to Phone app settings > Caller ID and spam protection. The FCC lists Samsung Smart Call as a built-in option.

Phone settings menus vary by device and software version.

#Does my carrier block spam calls for free?

Yes. All three big carriers have free spam blockers.

#AT&T ActiveArmor

AT&T ActiveArmor is "FREE ... Free with every AT&T wireless plan." It includes "Fraud & spam call blocking: Choose to block unwanted calls or have them sent to voicemail."

#Verizon Call Filter

Verizon Call Filter is free on standard monthly and prepaid plans with compatible devices. Verizon says Call Filter "detects spam and blocks high-risk spam calls by forwarding to voicemail."

#T-Mobile Scam Block

T-Mobile's Scam Block is free. Turn it on via:

• The free Scam Shield app
• Your T-Mobile account or T-Life
• Or dial #662# from your T-Mobile device

#Does the Do Not Call Registry stop spam calls?

It stops sales calls from real companies that follow the law. It won't stop scammers.

#How to register

Go to donotcall.gov or call 1-888-382-1222 from the phone you want to register. You'll get an email. Click the link within 72 hours to confirm.

The FTC says:

• It's free
• "Your registration will never expire"
• "It can take up to 31 days for sales calls to stop"

As of September 30, 2025, there were more than 258 million active registrations.

#What it does and doesn't do

The Do Not Call Registry tells law-abiding telemarketers which numbers not to call. The FTC is clear: it "stops sales calls from real companies that follow the law," but "it won't stop scammers."

The registry doesn't block calls. It's a list. Scammers ignore it.

Combine the registry with call blocking to catch what gets through.

#Should I press 1 to be removed?

No. Hang up.

The FTC says: "Pressing numbers to speak to someone or remove you from the list will probably only lead to more robocalls."

Don't press buttons. Don't call back. Just hang up.

#How do I report spam calls?

Report at donotcall.gov or ReportFraud.ftc.gov (if you lost money).

The FTC says to include:

• Your phone number (the number that received the call)
• The caller ID number, even if it's faked
• Any call-back number
• The date and time

The FTC releases reported numbers to the public each business day to help phone companies with call-blocking and labeling.

#How do spam callers get my number?

Two main sources you can do something about.

#1. Forms with buried consent

Giveaway contests. Job offers that aren't real. "Get a free quote" forms.

The FCC says: "Before submitting your number on websites, read the privacy policy and look for opt-out options - often a checkbox."

That checkbox is how your number ends up sold to telemarketers. Many forms have consent language like "I agree to be contacted by [company name] and its partners." "Partners" can mean dozens of telemarketers.

The FTC's Operation Stop Scam Calls found one company sold more than 620 million leads in under two years, collected with ads promising a job interview or a $1,000 gift card. The consent was buried in fine print.

#2. People-search sites and data brokers

The FTC says: "If someone has just one piece of information about you, like your name or phone number, they could buy a report that tells them a lot about you," including your current and previous addresses and "the name and address of your family members."

People-search sites scrape public records, buy data from other brokers, and publish it. Your phone number shows up next to your name, address and relatives. That's what makes "Hi Dana, this is about your home on Oak Street..." calls sound believable.

Search your phone number in quotes on Google: "(555) 555-0100". If a people-search site shows your name next to it, that's one source to cut off.

#How do I stop my number being sold to telemarketers?

#Stop handing it out

Read the privacy policy before you type your number into a website. Look for the opt-out checkbox. Untick "I agree to be contacted by partners."

Leave "phone" blank whenever it's optional. Use a secondary number (many apps and some carriers offer one) for quote forms, store loyalty programs and online sign-ups.

#Revoke consent

Already said yes somewhere? The FCC says "You may opt out of any robocall or robotext at any time and in any reasonable manner, even if you previously gave consent."

If a real telemarketer calls, tell them to stop. The FTC says companies must stop if you ask them not to call. Write down the date you asked them to stop.

#How do I get my number off people-search sites?

Opt out of each site one by one, for free. Then re-check.

#Where to start

Search your phone number in quotes on Google:

• "(555) 555-0100"
• "555-555-0100"

If a people-search page shows your name, follow its opt-out process. Start with the biggest sites:

• Whitepages removal guide
• Spokeo opt out
• BeenVerified opt out
• TruePeopleSearch removal
• Intelius opt out (one form covers four sites)

Our 15-site pillar guide has step-by-step opt-out instructions.

#Why listings come back

The FTC warns: "if the information in your public records changes, your information could re-appear for sale on people search sites."

Opting out stops a site from selling what it has now. It doesn't stop the site from collecting new records. Listings come back when:

• Public records change (a move, a new property listing)
• A relative's report lists you with your phone number
• The site buys fresh data from another broker

Our guide on why data brokers re-list you after opt-out explains what triggers re-listings.

Recheck every 3 to 6 months. Or let UndoLeak do that re-checking for you.

#The full checklist to stop spam calls

Here's everything in order:

1. iPhone: Settings > Apps > Phone > Screen Unknown Callers: Ask Reason for Calling or Silence. Under Call Filtering, turn on Spam.
2. Android (Google Phone app): menu > Settings > Spam and Call Screen > turn on Filter spam calls. Pixel: Call Screen. Samsung: Phone app settings > Caller ID and spam protection.
3. Save important numbers (doctor, school, family) to Contacts first, so silencing unknown callers doesn't hide them.
4. Turn on your carrier's free blocker: AT&T ActiveArmor, Verizon Call Filter, or T-Mobile Scam Block (dial #662#).
5. Register at donotcall.gov or call 1-888-382-1222. It's free and never expires. Sales calls can take up to 31 days to stop. It won't stop scammers.
6. Hang up on robocalls. Don't press buttons or call back.
7. Report spam calls at donotcall.gov with your number, the caller ID number, date and time. If you lost money, also report at ReportFraud.ftc.gov.
8. Fix the source: Read privacy policies and untick partner/marketing consent boxes before typing your number into giveaways, quizzes or job offers. You can opt out of robocalls and robotexts at any time in any reasonable manner. Tell live telemarketers to stop calling and note the date.
9. Opt out of people-search sites one by one (free), and re-check, because listings can come back when public records change.

#What this fixes and what it doesn't

What these steps do:

• Silence most spam calls before your phone rings
• Stop sales calls from companies that follow the law
• Let you screen unknown callers without answering
• Report patterns to the FTC and phone companies
• Break the public link between your phone number and your name/address

What they don't do:

• They don't stop every call, because scammers ignore the rules
• Caller ID spoofing means the next call can show a different number
• Listings can reappear on people-search sites when public records change

The honest summary: call blocking handles the volume. The Do Not Call Registry cuts legal sales calls. Not engaging keeps you off "live number" lists. Removing your number from people-search sites stops the calls that sound like they know you. Listings come back, so recheck every few months.

UndoLeak erases your data from data brokers and keeps it off. We re-check and erase it again when it comes back.

Check your data free to see where your phone number is listed right now.

#Related guides

• Why am I getting so many spam calls? - the reasons spam calls happen
• How do spam callers know my name? - lead generators and data brokers
• How to remove your phone number from people-search sites - stop your number being sold
• How scammers use data brokers - why your data matters
• California DROP - one request to 600+ brokers (California residents)
• How to remove personal information from the internet - 15-site pillar guide

#Sources

1. FTC, "Robocalls": consumer.ftc.gov/articles/robocalls
2. FTC, "How To Block Unwanted Calls": consumer.ftc.gov/articles/how-block-unwanted-calls
3. FTC, "National Do Not Call Registry FAQs": consumer.ftc.gov/articles/national-do-not-call-registry-faqs
4. FTC, National Do Not Call Registry Data Book FY 2025: ftc.gov/reports/national-do-not-call-registry-data-book-fiscal-year-2025
5. FTC, Operation Stop Scam Calls (July 18, 2023): ftc.gov/news-events/news/press-releases/2023/07/ftc-law-enforcers-nationwide-announce-enforcement-sweep-stem-tide-illegal-telemarketing-calls-us
6. FTC, Robocall sweep announcement transcript: ftc.gov/system/files/ftc_gov/pdf/Robocall-Sweep-Announcement-Transcript-July-18-2023.pdf
7. FTC, "What To Know About People Search Sites That Sell Your Information": consumer.ftc.gov/articles/what-know-about-people-search-sites-sell-your-information
8. FCC, "Stop Unwanted Robocalls and Texts": fcc.gov/consumers/guides/stop-unwanted-robocalls-and-texts
9. FCC, "Call Blocking Tools and Resources": fcc.gov/call-blocking
10. Apple, "Screen and block calls on iPhone": support.apple.com/guide/iphone/screen-and-block-calls-iphe4b3f7823/ios
11. Apple, "Manage unknown callers on iPhone": support.apple.com/en-us/111106
12. Google, "Phone app Help, Screen your calls": support.google.com/phoneapp/answer/9118387
13. AT&T, "What is ActiveArmor?": att.com/wireless/what-is-activearmor-security/
14. Verizon, "Call Filter FAQs": verizon.com/support/call-filter-faqs/
15. T-Mobile, "Block unwanted calls": t-mobile.com/support/plans-features/block-unwanted-calls

Dana Ortiz, her phone number (614) 555-0182, and every call, form and screen shown in the video are fictional recreations (555 numbers). Phone settings menus vary by device and software version. This is general information, not legal advice. UndoLeak is not affiliated with the FTC, FCC, Apple, Google, Samsung, AT&T, Verizon or T-Mobile.

Deleted? Not quite.

A viral post saying your "deleted" iPhone photos aren't really deleted passed 1.3 million views on X this weekend (October 24, 2026). Another post claimed that a Mac backup of one iPhone still held 147,863 files in a folder called PhotoData/Thumbnails. That number is one user's claim, not something we verified.

What's true: forensic examiners have said for years that iOS keeps small thumbnail copies of photos in its PhotoData folder, that those thumbnails can remain after the original photo is deleted, and that they can be retrieved from computer backups.

What's overstated: the claim that "any app with file access can read them." Apple says all third-party apps on iPhone are sandboxed, which is designed to stop apps from reading data stored by other apps.

The real fix: Apple says local iPhone backups on your computer aren't encrypted by default. Here's how to turn it on, plus what else you can do.

#What the viral posts claimed

The fastest-growing post came from @0xCortiq on X (formerly Twitter) on October 24, 2026:

"BREAKING NEWS : Your 'deleted' photos aren't deleted. Claude Code found years of them sitting in a hidden cache on my iPhone."

As of October 25, 2026, that post had 1,355,055 views according to X's public metrics.

An earlier post by @starmexxx on October 23, 2026 said:

"While backing up my iPhone to my MacBook, I scanned the backup folder and discovered a directory called PhotoData/Thumbnails with over 147,000 files ... 147,863 files in total."

That user also claimed "any app with file access can read" these files and that "Apple never clears it."

We did not verify the file count claim. The number of thumbnail files varies by device and use.

#What's actually true about iPhone thumbnails

Forensic experts have documented this behavior for years.

Athena Forensics, a UK digital forensics firm, published an article in February 2020 titled "iPhone Photodata Thumbnails." The article states:

"The Thumbnails are retained within the Photodata folder even if the original version of the image has been deleted from the device."

The article explains that when photos are backed up to a computer via iTunes or Finder, "the iThmb files are stored separately and can also be retrieved as part of a forensic analysis."

The key phrase: "If images have been deleted from a phone, it is sometimes possible to recover deleted thumbnail copies."

Sometimes possible. Not guaranteed. Not full-resolution. Small thumbnails used by iOS for faster display and navigation.

#The part that's overstated

The viral claim said "any app with file access can read them."

Apple Platform Security (published December 19, 2024) says:

"All third-party apps are sandboxed. Sandboxing is designed to prevent apps from gathering or modifying information stored by other apps."

Third-party apps on iPhone cannot freely read other apps' data or system folders like PhotoData. The sandboxing model restricts each app to its own container.

The viral claim did not provide evidence that any app actually read anyone's photos from this folder. It described a theoretical risk based on file access, not Apple's documented access controls.

#How to encrypt your Mac backup (the real fix)

Apple Support says in its article "About encrypted backups on your iPhone, iPad, or iPod touch" (published September 21, 2026):

"Your backup isn't encrypted by default."

Here's how to turn on encryption for local backups on a Mac:

1. Connect your iPhone to your Mac with a USB cable
2. Open your iPhone in Finder (on macOS Catalina and later, Finder replaced iTunes)
3. Go to the General tab
4. Select "Encrypt local backup"
5. Create a password you'll remember. You need this password to restore from the backup.
6. Click Encrypt Backup

According to Apple Support, this "immediately overwrites and encrypts your previous backups" on that Mac.

Look for the lock icon in Manage Backups to confirm encryption is on.

On a PC: The process is the same, but use the Apple Devices app instead of Finder.

Important: Keep your password safe. Apple cannot help you recover your backup if you forget the password.

#What about iCloud backups?

iCloud backups are already encrypted during transmission and storage on Apple's servers. The setting above applies only to local backups stored on your Mac or PC.

The local backup encryption you enable on your computer is separate from iCloud backup encryption, which is on by default.

#Other steps you can take

#Empty Recently Deleted

When you delete a photo, it goes to Recently Deleted and stays there for 30 days (or 40 days if you use iCloud Photos). Empty this album manually to remove photos sooner:

1. Open the Photos app
2. Go to Albums
3. Scroll down to Recently Deleted
4. Tap Select → Delete All

#Delete old backups you don't need

If you have old local backups on your Mac or PC that you no longer need, you can delete them:

1. On Mac: Finder → your iPhone → General → Manage Backups
2. Select the backup you want to delete
3. Click Delete Backup

Old unencrypted backups can still hold data even after you've turned on encryption for new backups.

#Update to the latest iOS

Apple released iOS 17.5.1 in May 2024 to fix a bug that resurfaced old deleted photos for some users. The Verge reported on May 24, 2024 that the bug caused photos that "were still lying around on the filesystems" to reappear in users' photo libraries.

Apple said the bug affected "a small number of users" and was fixed in iOS 17.5.1.

If you're on an older iOS version, update to the latest version:

1. Go to Settings → General → Software Update
2. Download and install any available updates

#Context: Why this went viral now

The posts from October 23-25, 2026 passed 1.3 million combined views during a weekend. According to X post counts we checked, mentions of "iPhone" or "iOS" paired with "deleted photos" or "PhotoData" went from 0-6 posts per day (October 19-23) to 315 posts on October 24 and 753 posts on October 25 (through 16:21 UTC).

X News ran a trending story titled "AI Scans Reveal Hidden iPhone Backup Photos on Macs" (updated October 25, 2026).

The speed of spread, the "breaking news" framing, and the personal stakes (everyone deletes sensitive photos at some point) drove the virality.

The underlying facts about thumbnail retention have been documented since at least 2020. The encryption fix has been available for years. What changed was awareness.

#What we're not claiming

We are not claiming:

• That Apple keeps every deleted photo forever
• That full-resolution originals survive deletion and Recently Deleted removal
• That any app has actually read anyone's photos from this folder
• That iCloud backups are unencrypted
• That the specific 147,863 file count is accurate or typical

We are saying:

• Small thumbnail copies can outlive the original deleted photo
• Those thumbnails can appear in computer backups
• Recovery from backups is "sometimes possible" (forensic experts' language), not guaranteed
• Local Mac/PC backups aren't encrypted by default, but you can turn encryption on
• Third-party apps are sandboxed and cannot freely read system folders like PhotoData

#Sources

1. X post by @0xCortiq, "Your 'deleted' photos aren't deleted" (October 24, 2026, 1.35M views as of October 25, 2026): x.com/0xCortiq/status/2113976294798967018
2. X post by @starmexxx, original claim with the 147,863 file count (October 23, 2026): x.com/starmexxx/status/2113758545216729163
3. Athena Forensics, "iPhone Photodata Thumbnails" (February 1, 2020): athenaforensics.co.uk/iphone-photodata-thumbnails/
4. Apple Platform Security, "Security of runtime process in iOS, iPadOS, and visionOS" (December 19, 2024): support.apple.com/guide/security/security-of-runtime-process-sec15bfe098e/web
5. Apple Support, "About encrypted backups on your iPhone, iPad, or iPod touch" (September 21, 2026): support.apple.com/en-us/108353
6. The Verge, "Here's why deleted iPhone photos returned to some iOS devices" (May 24, 2024): theverge.com/2024/5/24/24163826/apple-iphone-ios-17-5-update-deleted-photos-explained

Deleted isn't gone, and the same is true online. Your name, address and phone number can sit on people-search sites long after you've forgotten about them. Run a free scan to see where your data is listed.

UndoLeak erases your data from data brokers and keeps it off. Not affiliated with Apple.

Watch the full walkthrough: Can Ring Employees See Your Videos? (2026 Fix)

According to the FTC's May 2023 complaint, between June and August 2017, a Ring employee viewed thousands of video recordings belonging to at least 81 unique female users, including Ring customers and Ring employees. The complaint states that the employee "focused his prurient searches on cameras with names indicating that they surveilled an intimate space, such as 'Master Bedroom,' 'Master Bathroom,' or 'Spy Cam.'"

The FTC alleged that Ring failed to detect this inappropriate access through any technical means. "By good fortune, in August 2017, an employee discovered her co-worker's actions and reported the misconduct," the complaint states. It was a coworker who caught him, not Ring's systems.

In the FTC's press release on May 31, 2023, the agency said Ring had been "compromising its customers' privacy by allowing any employee or contractor to access consumers' private videos."

It wasn't just employees.

#Police got videos without owner consent

In July 2022, Amazon disclosed to Senator Edward J. Markey that Ring had provided videos to law enforcement without the owners' consent.

In a letter dated July 1, 2022, Amazon's vice president Brian Huseman wrote: "So far this year, Ring has provided videos to law enforcement in response to an emergency request only 11 times. In each instance, Ring made a good-faith determination that there was an imminent danger of death or serious physical injury."

Reuters, the Associated Press, and Politico reported on the letter on July 13, 2022. Senator Markey's press release that day confirmed that Ring provided videos to law enforcement "through a process that does not require the consent of the device owner, 11 times this year."

Amazon's letter covered the first half of 2022. It specified "so far this year," meaning through the date of the letter.

#How to turn on End-to-End Encryption

If you have a Ring camera, you can turn on End-to-End Encryption so only your enrolled phones can see your videos. Ring says when this is on, not even Ring itself can access your content.

Here's how, according to Ring Support:

1. Open the Ring app
2. Tap the menu (three horizontal lines, usually at the top left)
3. Go to Control Center
4. Tap Video Encryption
5. Tap Let's turn on End-to-End Encryption
6. Tap Continue
7. Set up your recovery options
8. The app generates a unique 12-word passphrase. Save it somewhere safe. Ring cannot recover your videos if you lose this passphrase.
9. Enroll each camera you want to protect

According to Ring Support: "Only your enrolled mobile devices can view videos, and no one else, including Ring services, can access your encrypted content."

Ring also states: "By design, Ring cannot access or help recover access to your end-to-end encrypted videos."

#What you lose when you turn on encryption

When End-to-End Encryption is on, some Ring features stop working:

• You can't view videos on ring.com
• You can't use Alexa or Echo Show integration
• You can't use shared users
• Some other features are unavailable

Ring says obstacle avoidance and other core features still work. You just can't share access with other people or view on devices other than your enrolled phones.

#Which cameras support End-to-End Encryption

Most Ring cameras support End-to-End Encryption, but some older models don't, including:

• 1st generation Ring Video Doorbell
• 2nd generation Ring Video Doorbell
• Some 1st generation Stick Up Cams

Check Ring Support's article "Using video end-to-end encryption" to see if your camera is supported.

#Community Requests are voluntary

Ring's "Community Requests" feature lets law enforcement post a public request asking Ring users in an area to voluntarily share video from a specific time and place. According to Ring's policy, participation is voluntary. You can ignore these requests. They appear in the Ring app's Neighbors feed.

Turning on End-to-End Encryption also prevents you from responding to Community Requests, since your encrypted videos cannot be shared through Ring's systems.

#What the FTC complaint said

The FTC's complaint filed May 31, 2023, alleged that the 2017 incident showed Ring's "failure to implement appropriate access controls and monitoring" (paragraph 18).

The complaint stated that the employee's inappropriate access continued for months before being discovered. The FTC alleged Ring did not have technical systems in place to detect this kind of misuse.

The complaint did not specify the settlement amount or any penalties. The FTC and Ring reached a proposed order that was announced in the May 31, 2023 press release.

#What you can do now

If you own a Ring camera and you're concerned about who can access your videos:

• Turn on End-to-End Encryption in the Ring app if your camera supports it
• Save your 12-word passphrase somewhere secure (not on your phone)
• Review your privacy settings in the Ring app under Control Center
• Ignore Community Requests if you don't want to share video (participation is voluntary)
• Read Ring's privacy policy to understand how your data is used

The FTC complaint from 2023 covers events from 2017 and earlier. Ring's current practices and systems may differ from what the FTC described. End-to-End Encryption gives you technical control over who can view your videos, regardless of Ring's policies or access controls.

Your camera watches strangers. Now you can stop strangers from watching you.

#Sources

• Federal Trade Commission, "FTC Says Ring Employees Illegally Surveilled Customers, Failed to Stop Hackers from Taking Control of Users' Cameras" (May 31, 2023): ftc.gov/news-events/news/press-releases/2023/05/ftc-says-ring-employees-illegally-surveilled-customers-failed-stop-hackers-taking-control-users
• Federal Trade Commission, Complaint, FTC v. Ring LLC (May 31, 2023): ftc.gov/system/files/ftc_gov/pdf/complaint_ring.pdf
• Amazon letter to Senator Edward J. Markey (July 1, 2022): s3.documentcloud.org/documents/22084569/amazon-response-sen-markey-071322.pdf
• Reuters, Krystal Hu, "Amazon.com's Ring gave police data without user consent 11 times in 2022" (July 13, 2022): reuters.com/technology/amazoncoms-ring-gave-police-data-without-user-consent-11-times-2022-2022-07-13/
• Ring Support, "Using video end-to-end encryption": ring.com/support/articles/myr75/using-video-end-to-end-encryption

Want to see where else your personal data is listed online? Run a free scan to find your listings on data brokers and people-search sites.

UndoLeak erases your data from data brokers and keeps it off. Not affiliated with Ring or Amazon.

You can request your free LexisNexis consumer disclosure report online at consumer.risk.lexisnexis.com/request, by phone (1-866-897-8126), or by mail. Provide your name, date of birth, address, and your Social Security number or driver's license number and state (at least one is required). LexisNexis says to allow about two weeks, then a letter arrives by U.S. mail with a URL and a PIN that opens your encrypted report.

A LexisNexis security freeze is free and separate (consumer.risk.lexisnexis.com/freeze). It only applies at LexisNexis, not at Equifax, Experian or TransUnion.

Quick answer: Request your free LexisNexis consumer disclosure report at consumer.risk.lexisnexis.com/request. Enter your name, date of birth, current address, and your SSN or driver's license number and state. Email is optional but must be provided and verified to include email-linked data in your report. Allow about two weeks for a letter with a URL and PIN to arrive. The report can include real estate records, liens, judgments, bankruptcies, professional licenses, historical addresses, C.L.U.E. insurance claims, and in some cases, driving data from connected cars. To place a free LexisNexis security freeze, go to consumer.risk.lexisnexis.com/freeze (online, mail, or phone 1-800-456-1244). The freeze only covers LexisNexis, not Equifax, Experian or TransUnion.

Every fact below comes from LexisNexis Risk Solutions' official consumer pages (accessed October 25, 2026), the Consumer Financial Protection Bureau, Washington State Office of the Insurance Commissioner, The New York Times reporting (March 2024), and the FTC final order against GM (January 2026). Nora Price and all records shown in the video are fictional.

#Watch: LexisNexis report request explained

If you've heard about the 258-page LexisNexis file with car data, or you just want to see what LexisNexis knows about you, this video walks through the free report request step by step, what C.L.U.E. is, how driving data ended up in files, and the free LexisNexis freeze.

#How do I request my LexisNexis report?

LexisNexis Risk Solutions is a consumer reporting agency. You're entitled to one free LexisNexis consumer disclosure report every 12 months under the FACT Act, per the Consumer Financial Protection Bureau.

You can request it online, by phone, or by mail. The online request is fastest.

#Step 1: Go to the LexisNexis consumer request page

Go to consumer.risk.lexisnexis.com/request. You may see a reCAPTCHA check before the form loads.

#Step 2: Enter your name, date of birth, and current address

Enter your first name, middle name (if any), last name, date of birth, and your current resident address (street, city, state, ZIP code). Per LexisNexis's Online Request Form Instructions, this information is required to submit a report request.

#Step 3: Add your Social Security number or driver's license number and state

LexisNexis requires at least one of these to process your report request. According to the Online Request Form Instructions, you must provide "either SSN or Driver's License and State" to submit a report.

Enter your Social Security number, or your driver's license number and the state that issued it.

#Step 4: Provide an email address (optional, but recommended)

Email is optional. However, per LexisNexis's online request form, "Email is optional but must be provided and verified to include email-linked data in your report."

If you want your report to include any data associated with your email address, enter your email and verify it when LexisNexis sends you a verification link.

#Step 5: Tick "Request Your Consumer Disclosure Report" and submit

Check the box next to "Request Your Consumer Disclosure Report." Complete the reCAPTCHA check ("I'm not a robot"). Then click "Submit Request."

#Step 6: Wait about two weeks for your letter

Per the Online Request Form Instructions, "please allow approximately two weeks for processing."

You will receive a letter by U.S. mail containing a PIN and a URL. Open the URL in your browser, enter the PIN from the letter, and download your report. The report is an encrypted PDF. Use the same PIN as the PDF password.

#Requesting by phone or mail

You can also request your LexisNexis consumer disclosure report by phone (1-866-897-8126) or by mail. To request by mail, print and complete the form from consumer.risk.lexisnexis.com/request and mail it to LexisNexis Risk Solutions, P.O. Box 105108, Atlanta, GA 30348-5108.

#What is in a LexisNexis consumer disclosure report?

Per LexisNexis's Consumer Disclosure page, "The report includes items such as real estate transaction and ownership data, lien, judgment, and bankruptcy records, professional license information, and historical addresses."

Residents of states including California, Colorado, Connecticut, Delaware, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, and Virginia also receive a State Privacy Act Report, per the Online Request Form Instructions.

Your report may also include C.L.U.E. insurance claims data and, in some cases, driving data from connected car features (more on that below).

#What is a C.L.U.E. report?

C.L.U.E. stands for Comprehensive Loss Underwriting Exchange. It's a LexisNexis database of insurance claims. Per Washington State Office of the Insurance Commissioner, C.L.U.E. "generally contains up to seven years of personal-auto and personal-property claims history."

The data includes:

• Your name
• Date of birth
• Policy number
• Date of the loss
• Type of loss
• Amount the insurer paid
• Property or vehicle information

Per Washington's Insurance Commissioner, "An insurer may request a CLUE report when you apply for coverage or request a quote."

If you find an error in your C.L.U.E. report, you can dispute it. Per Washington's Insurance Commissioner, "LexisNexis will verify your information with the reporting insurance company and notify you of the results within 30 days. You can also add an explanation to an item in the report that will show in all future reports."

#Can my car's driving data be in my LexisNexis file?

Your car's driving data can be in your LexisNexis file, but it depends on whether you used a connected car feature that shared data with LexisNexis.

In March 2024, The New York Times reported on a Chevrolet Bolt driver whose insurance rate jumped 21% in 2022. When he requested his LexisNexis consumer disclosure report, it came back 258 pages long. More than 130 of those pages listed 640 trips over six months, each with start and end times, distance traveled, hard braking events, and rapid acceleration. According to the report, the trip details had been provided by General Motors.

#How did driving data get into LexisNexis files?

The data came from OnStar Smart Driver, a feature in GM's connected car apps. Per The New York Times, GM confirmed it shared "select insights" about hard braking, hard accelerating, speeding over 80 mph, and drive time of Smart Driver enrollees with LexisNexis and Verisk (another data broker).

Later that month, GM announced that it had stopped sharing OnStar Smart Driver data with LexisNexis and Verisk.

#The FTC order against GM

In January 2026, the Federal Trade Commission finalized an order that includes:

• A five-year ban on GM disclosing consumers' geolocation and driver behavior data to consumer reporting agencies
• A requirement for affirmative express consent before any future data sharing
• A way for consumers to request a copy of their data and request deletion

The FTC's final order applies only to GM and OnStar. Other automakers are not covered by this order.

#How to check if your file contains driving data

Request your free LexisNexis consumer disclosure report at consumer.risk.lexisnexis.com/request. When your report arrives, look for sections that mention:

• Trip logs or trip history
• Driving data or driving behavior
• Telematics data
• Vehicle location history
• Hard braking, hard acceleration, or speeding events

If you find driving data in your report that's wrong or shouldn't be there, you can dispute it under the Fair Credit Reporting Act. Contact information for disputes is included with your report.

#How do I freeze my LexisNexis file?

A LexisNexis security freeze is free. Per LexisNexis's Security Freeze page, "Applying a security freeze prohibits LexisNexis Risk Solutions from releasing your LexisNexis Consumer Disclosure Report or your credit score without your express authorization."

#How to place a LexisNexis security freeze

You can request a LexisNexis security freeze online, by mail, or by phone.

Online: Go to consumer.risk.lexisnexis.com/freeze and complete the online form.

By mail: Mail your request to LexisNexis Risk Solutions Consumer Center, Attn: Security Freeze, P.O. Box 105108, Atlanta, GA 30348-5108.

By phone: Call 1-800-456-1244.

Per LexisNexis, it "does not charge a fee to apply, lift, or remove a security freeze." You'll receive a confirmation letter by U.S. Mail. The letter includes a PIN. Keep your PIN. You'll need it to lift or remove the freeze later. If you lose your PIN, you can order a replacement.

#What the LexisNexis freeze does and doesn't cover

The LexisNexis security freeze applies only at LexisNexis. Per the Security Freeze page, it "will only be in place at LexisNexis Risk Solutions and not other credit reporting agencies, such as TransUnion, Equifax, Experian, Innovis or others."

The freeze also "does not apply to companies or entities with which you have an existing account that requests information in your consumer report for the purposes of reviewing or collecting the account."

To freeze your file at Equifax, Experian, and TransUnion, you must place a separate freeze with each of those credit reporting agencies.

#Does a LexisNexis freeze also freeze Equifax, Experian and TransUnion?

No. A LexisNexis security freeze only covers LexisNexis Risk Solutions. Per LexisNexis, it "will only be in place at LexisNexis Risk Solutions and not other credit reporting agencies, such as TransUnion, Equifax, Experian, Innovis or others."

If you want a freeze at Equifax, Experian, and TransUnion, you must place a separate security freeze with each of those agencies. Each freeze is free.

#How do I dispute something on my LexisNexis report?

You have the right to dispute inaccurate information under the Fair Credit Reporting Act. Your LexisNexis consumer disclosure report includes instructions for disputes along with contact information.

For C.L.U.E. claims data, per Washington's Insurance Commissioner, "LexisNexis will verify your information with the reporting insurance company and notify you of the results within 30 days."

You can also add an explanation to an item on your C.L.U.E. report. Per Washington's Insurance Commissioner, the explanation "will show in all future reports."

#How do I opt out of LexisNexis prescreened offers and marketing?

LexisNexis offers an opt-out page at consumer.risk.lexisnexis.com/opt.

Per LexisNexis, you can opt out of:

• Firm Offers of Credit and Insurance (Prescreen)
• Direct Marketing Services
• Suppression due to threat of personal safety

This opt-out is separate from the security freeze and the consumer disclosure report request.

#What this means for your data

LexisNexis is one data broker. Your name, address, phone number, and other personal information also sit on people-search sites and data brokers you have never heard of.

If you drove a GM vehicle with OnStar Smart Driver turned on between 2022 and March 2024, your trip data may be in a LexisNexis file right now. Request your free report to see what's there.

But that's just LexisNexis. Dozens of other people-search sites and data brokers list your name, address, phone number, relatives, and more. Each one sells access to anyone willing to pay. That's how scammers, stalkers, and spammers find you.

Our guide on how scammers use data brokers explains the real-world harm. Why data brokers re-list you after opt-out explains why one-time removals don't last.

UndoLeak erases your data from data brokers and keeps it off. We re-check and erase it again when it comes back.

Check your data free to see where you're exposed right now. The first scan is free.

#California DROP: one request to 600+ brokers

If you or your family live in California, you have the strongest tool in the country.

DROP (at privacy.ca.gov/drop) sends one free deletion request to more than 600 registered data brokers. Since August 1, 2026, brokers must check DROP at least every 45 days and keep deleting you.

Our California DROP guide walks through how to file and what each status means.

#Related guides

• Is Your Car Tracking You for Insurance? The OnStar Data Sharing Case - deep dive on the GM/OnStar case
• How scammers use data brokers - why your data matters
• Why data brokers re-list you after opt-out - why listings come back
• How to remove personal information from the internet - 15-site pillar guide
• BeenVerified opt out - another people-search site removal
• Intelius opt out - one form covers four sites
• How to remove your phone number from people-search sites - stop spam calls

#Sources

1. LexisNexis Risk Solutions, Consumer Disclosure: consumer.risk.lexisnexis.com/consumer (accessed October 25, 2026)
2. LexisNexis Online Request Form: consumer.risk.lexisnexis.com/request (accessed October 25, 2026)
3. LexisNexis Online Request Form Instructions: consumer.risk.lexisnexis.com/img/Online_Request_Form_Instructions.pdf (accessed October 25, 2026)
4. LexisNexis Security Freeze: consumer.risk.lexisnexis.com/freeze (accessed October 25, 2026)
5. LexisNexis Opt-Out: consumer.risk.lexisnexis.com/opt (accessed October 25, 2026)
6. LexisNexis FACT Act disclosure: consumer.risk.lexisnexis.com/factact (accessed October 25, 2026)
7. Consumer Financial Protection Bureau, LexisNexis Risk Solutions: consumerfinance.gov/consumer-tools/credit-reports-and-scores/consumer-reporting-companies/companies-list/lexis-nexis-risk-solutions/ (accessed October 25, 2026)
8. Washington State Office of the Insurance Commissioner, CLUE: insurance.wa.gov/insurance-resources/auto-insurance/credit-and-insurance/clue-comprehensive-loss-underwriting-exchange (accessed October 25, 2026)
9. The New York Times, Kashmir Hill, "Automakers Are Sharing Consumers' Driving Behavior With Insurance Companies" (March 11, 2024): nytimes.com/2024/03/11/technology/carmakers-driver-tracking-insurance.html
10. The New York Times, "General Motors Quits Sharing Driving Behavior With Data Brokers" (March 22, 2024): nytimes.com/2024/03/22/technology/gm-onstar-driver-data.html
11. FTC, "FTC Finalizes Order Settling Allegations that GM and OnStar Collected and Sold Geolocation Data Without Consumers' Informed Consent" (January 14, 2026): ftc.gov/news-events/news/press-releases/2026/01/ftc-finalizes-order-settling-allegations-gm-onstar-collected-sold-geolocation-data-without-consumers

Nora Price, her address, phone number, and every record shown in the video are fictional. All LexisNexis and report screens in the video are simplified recreations, not screenshots. This is general information, not legal advice.

In 2020, test versions of iRobot's Roomba J7 photographed homes from floor level. The images were sent to Scale AI, a startup that contracts workers around the world to label photos and videos used to train artificial intelligence. Some of those gig workers posted screenshots in private Facebook and Discord groups. One image showed a woman on the toilet (MIT Technology Review, Dec. 19, 2022).

iRobot confirmed that the images were captured by its Roombas in 2020. The company said these were "special development robots with hardware and software modifications that are not and never were present on iRobot consumer products for purchase," and that they were given to "paid collectors and employees" who signed written agreements. iRobot also said it had shared over 2 million images with Scale AI and other data annotation platforms.

Some participants who provided the test robots later said they felt misled. "The agreements shared with us never explicitly mention that personal images will be seen and analyzed by other humans," MIT Technology Review reported in a follow-up investigation in January 2023.

In 2024, a separate security issue emerged. Researchers at the Def Con security conference demonstrated that some Ecovacs robot vacuums and lawn mowers could be hacked over Bluetooth to surreptitiously switch on cameras and microphones remotely, from as far away as 450 feet (around 130 meters), according to TechCrunch (Aug. 9, 2024). Ecovacs released security updates in November 2024.

If your robot vacuum has a camera, here's what you can do now.

#How to turn off Obstacle Image Review (iRobot)

If you have a Roomba with a camera, you can turn off Obstacle Image Review in the iRobot Home app. When you turn it off, your robot will still avoid obstacles, but it won't capture or send images to iRobot.

Here's how:

1. Open the iRobot Home app
2. Tap the three horizontal lines in the top right corner
3. Go to Account, then Privacy
4. Select Map Features, then choose your robot
5. Turn off Obstacle Image Review

According to iRobot Support, if you opt out, "your robot will still be able to avoid obstacles." If your images are not contributed, "your encrypted images are automatically deleted from our servers after 30 days" (iRobot Support, article 31163).

#Leave "Contribute to Database" unchecked

When you review obstacle images in the app, each image has a checkbox labeled "Contribute to Database." If you check this box, you're allowing iRobot's development teams to view and use that specific image. If you keep the box unchecked, the image remains encrypted and is automatically deleted from iRobot's servers after 30 days (iRobot Support, article 30949).

#Update your firmware (any brand)

For Ecovacs owners, the security issue researchers found in 2024 has been patched. Ecovacs released security updates for affected X2, X5, and T30 series models in November 2024. "Users can complete the fix by performing the system update," according to Ecovacs' security advisory (Ecovacs DSA 20241119).

For any robot vacuum with a camera, make sure you install firmware updates when they're available. Updates often fix security vulnerabilities and improve privacy protections.

#What happened with the test Roombas

The images that appeared in online groups came from special test robots, not consumer units. iRobot said these were development versions of the Roomba J7 series with hardware and software modifications that are not present in products sold to the public.

The company gave these test robots to paid collectors and employees who signed written agreements. The images were then sent to Scale AI, where gig workers around the world labeled the photos to train AI models that help the robots recognize objects.

The issue was that some of those gig workers posted the images to private groups on Facebook, Discord, and elsewhere. The images included household scenes captured from low angles, including the image of a woman on the toilet that MIT Technology Review reported.

#Some testers said they felt misled

In January 2023, MIT Technology Review published a follow-up investigation based on interviews with participants and copies of the agreements they signed. The publication reported that "the participants feel misled" and that "the agreements shared with us never explicitly mention that personal images will be seen and analyzed by other humans."

iRobot's position remained that the participants had signed agreements, but the testers said the language in those agreements did not clearly explain that photos from inside their homes, including potentially embarrassing or sensitive images, would be viewed by human workers.

#The Ecovacs security issue

The Ecovacs issue was different. It wasn't about data sharing. It was about a vulnerability that could let attackers take control of the robots remotely.

At the Def Con security conference in August 2024, researchers Dennis Giese and Braelynn Luedtke demonstrated that they could "hack the robots via Bluetooth and surreptitiously switch on microphones and cameras remotely," according to TechCrunch. The hack could work from as far away as 450 feet (around 130 meters).

Ecovacs released security updates for the affected models. The company's advisory, published November 19, 2024, credits Giese, Luedtke, and researcher Anderson for reporting the vulnerability. The updates fix a "BLE RCE" (Bluetooth Low Energy remote code execution) vulnerability.

ABC News (Australia) ran a demonstration in October 2024 under the headline "We hacked a robot vacuum — and could watch live through its camera."

#What to do if you're concerned

If you own a robot vacuum with a camera and you're concerned about privacy:

• Turn off Obstacle Image Review in the iRobot Home app if you have a Roomba, or check your brand's app for similar settings
• Leave "Contribute to Database" unchecked for any images you review
• Install firmware updates when they're available
• Read the privacy policy for your robot vacuum and its app
• Disable features you don't use, especially if they involve sharing data with the manufacturer

The test Roomba images from 2020 came from development units that were not sold to consumers, but the incident shows how images from robot vacuums can end up being viewed by people you don't know. The Ecovacs security issue shows that even without data sharing, vulnerabilities can let attackers access cameras and microphones on connected devices.

If your robot vacuum has a camera, it can see what's on your floor. Now you know who else might see it.

#Sources

• MIT Technology Review, Eileen Guo, "A Roomba recorded a woman on the toilet. How did screenshots end up on Facebook?" (December 19, 2022): technologyreview.com/2022/12/19/1065306/roomba-irobot-robot-vacuums-artificial-intelligence-training-data-privacy/
• MIT Technology Review, Eileen Guo, "Roomba testers feel misled after intimate images ended up on Facebook" (January 10, 2023): technologyreview.com/2023/01/10/1066500/roomba-irobot-robot-vacuum-beta-product-testers-consent-agreement-misled/
• TechCrunch, Lorenzo Franceschi-Bicchierai, "Ecovacs home robots can be hacked to spy on their owners, researchers say" (August 9, 2024): techcrunch.com/2024/08/09/ecovacs-home-robots-can-be-hacked-to-spy-on-their-owners-researchers-say/
• ABC News (Australia), "We hacked a robot vacuum — and could watch live through its camera" (October 4, 2024): abc.net.au/news/2024-10-04/robot-vacuum-hack-demonstration/104419070
• Ecovacs Security Advisory, "Bluetooth Low Energy Remote Code Execution" (November 19, 2024): ecovacs.com/global/userhelp/dsa20241119
• iRobot Support, "What is Obstacle Image Review opt-in?": homesupport.irobot.com/s/article/31163
• iRobot Support, "Contribute to Database": homesupport.irobot.com/s/article/30949

Want to see where else your personal data is listed online? Run a free scan to find your listings on data brokers and people-search sites.

UndoLeak erases your data from data brokers and keeps it off. Not affiliated with iRobot, Roomba, Scale AI, Ecovacs, or MIT Technology Review.

On October 23, 2026, clips show IShowSpeed's phone number flashing on screen while he tested a new iPhone Duo live. Fans started calling him again and again. One clip passed 2 million views on X in about a day.

It isn't the first time. In 2023, a leak on stream flooded his WhatsApp with tens of thousands of messages from all over the world, according to The SportsRush (Nov 18, 2023).

Most people's numbers don't need a livestream to get out. People-search sites collect and sell reports about you, and the FTC says that with just one piece of information, like your phone number, someone could buy a report with your current and previous addresses and the names and addresses of your family members.

You can opt out of those sites one by one, and check back, because the FTC says your information can reappear.

He can change his number. You can erase your listings.

#Watch: IShowSpeed leaked his phone number

This video explains what happened and why your phone number is probably for sale.

#Where people-search sites get your phone number

People-search sites are one kind of data broker. According to the Federal Trade Commission, they build reports from:

• Public records, such as property records, court filings and voter files where those are public
• Data bought from other companies, including other brokers and marketing lists
• Old breaches and leaks, where phone numbers often appear next to names

Then they sell those reports to anyone willing to pay (FTC Consumer Advice).

A typical people-search listing shows your phone number next to:

• Your full name
• Your current and past addresses
• Your age
• Your relatives' names and addresses

What someone can buy with just your number. The FTC says plainly: "If someone has just one piece of information about you, like your name or phone number, they could buy a report that tells them a lot about you," including your current and previous addresses and "the name and address of your family members" (FTC).

That's the link between a phone number and everything else. It's public, it's legal in most of the US, and you can break it.

#How to find where your phone number is listed

Before you remove anything, make a list. Opt-out forms almost always ask for the exact URL of your listing.

Step 1: Search Google. Try your phone number in both formats, with quotation marks:

• "(555) 555-0100"
• "555-555-0100"

If a people-search site shows up in the results, that's one listing to remove.

Step 2: Search the big sites directly. Go to each site below and search your phone number. Many listings don't rank in Google but are still on the site:

• Whitepages
• Spokeo
• BeenVerified
• TruePeopleSearch
• FastPeopleSearch
• Intelius
• PeopleFinders
• Nuwber

Step 3: Keep a tracker. A simple spreadsheet works. Note the site name, listing URL, date submitted and confirmation status for each. You'll need this for re-checking.

Use a separate email address. Most opt-outs send a confirmation link. A dedicated email for privacy requests keeps your main inbox out of more databases.

Our free people-search check builds these searches for 39 sites at once, with the opt-out link for each.

#How to remove your phone number from people-search sites

Every site works a little differently, but most follow the same pattern:

1. Find your listing by searching your phone number
2. Copy the exact URL of the listing
3. Paste it into the site's opt-out form
4. Confirm the request from your email

Opting out is free on every major site. If a page asks you to pay to remove your listing, you're not on the official form.

#Start with the biggest sites

Full step-by-step instructions: Our pillar guide, how to remove your personal information from the internet, has opt-out walkthroughs for 15 major sites, including Intelius, Instant Checkmate, TruthFinder (all covered by one request), PeopleFinders, MyLife, Nuwber, ThatsThem, USPhoneBook and PeopleLooker.

#Remove your number from Google results