Most people who check have found their home address listed on at least 5 data broker sites. Have you checked? https://indigoprivacy.com/audit #databrokers #privacy #indigoprivacy

Nearly a million #passports just exposed on the public internet—and anyone could access them with a simple URL

A journalist typing a few letters and numbers into a web browser pulled up the #passport of a young woman from Germany. Then a Spanish man’s passport. Then another man’s driver’s license. All of it sitting on the public internet with no password, no encryption, no access control whatsoever.
#privacy #security

https://cambridgeanalytica.org/data-breaches-scandals/passports-driver-licenses-exposed-public-internet-2026-51096/

SCOTUS ruled that law enforcement "looking to obtain sweeping data on cellphone users in the vicinity of a crime scene must have a warrant."

"...broad 'geofence' surveillance equals a search" under the Constitution's Fourth Amendment, "which protects people against unreasonable searches and seizures."

The #Trump admin had argued that police "didn't need a warrant for the information at all..."

/1
#USA #law #privacy #4thAmendment
#SurveillanceState
---

https://www.upi.com/Top_News/US/2026/06/29/supreme-court-rules-geofence-searches-require-warrant/5381782764680

In major #privacy win, #SupremeCourt rules #geofence #warrants are protected by privacy rights
In the 6-3 ruling, #SCOTUS said that “an individual has a reasonable expectation of privacy in his cell-phone #location information.” According to the court, that means people have privacy rights when it comes to the location history collected by their phones, as well as the services and apps running on them. #4thAmendment protects against unreasonable searches and seizures.
https://techcrunch.com/2026/06/29/in-major-privacy-win-supreme-court-rules-geofence-warrants-are-protected-by-privacy-rights/

Voicebox is a free and open-source AI voice studio that runs entirely on your computer.

It lets you clone voices, generate speech, transcribe audio with Whisper, and use voice dictation without sending recordings to the cloud. It also supports multiple TTS engines and MCP integration for AI assistants.

More details: https://digitalescapetools.com/tools/tool.html?id=voicebox

#OpenSource #AI #Privacy #SelfHosted #Linux #Windows #macOS #SpeechToText #TextToSpeech

Alt...

Screenshot of the Voicebox project page featuring a gold microphone icon and the title "Voicebox." The page describes it as an open-source AI voice studio that runs entirely on your computer, allowing users to clone voices, generate speech, dictate into any application, and interact with AI agents using custom voices. Project badges show approximately 1.4 million downloads, version 0.5.0, 36k GitHub stars, an MIT license, and a link to DeepWiki.

Heads up for #golang Chatmail bots developers:

The Chatmail API for Go library got a new release to support the latest chatmail core 2.53.0

https://github.com/chatmail/rpc-client-go

#chatmail #deltachat #bots #dev #devs #developer #api #e2ee #privacy #security #opensource #go #programming #automation

Reminder that our #cfp for the 14th annual SeaGL is closing very soon. You have until Tuesday, June 30th 11:59:59pm PDT to submit your talk!!

Submit yours now!

https://pretalx.seagl.org/2026/cfp

#SeaGL2026 #linux #FLOSS #FOSS #OSS #libre #opensource #ophw #privacy #ai #art #security #devops

American privacy rights just got a little stronger. The Supreme Court has limited the use of “geofence” search warrants in a major legal ruling that is likely to have broad ramifications for individuals and law enforcement officers. The top court said that “an individual has a reasonable expectation of privacy in his cell-phone location information.” So, does this mean authorities will have to get a warrant when asking tech companies for user location data? Read more from
@Techcrunch:

https://flip.it/LMSs4_

#Tech #Privacy #SupremeCourt

"A little white box would sit under a table or chair and silently monitor for danger. It seemed like an easy way to help my dad preserve his independence and give me peace of mind from Europe."

Steven Blum for Architectural Digest and WIRED: https://www.architecturaldigest.com/story/sensi-ai-seniors-homecare-aging-in-place

#Longreads #Aging #Surveillance #AI #Privacy #Elderly

In major privacy win, Supreme Court rules #geofence warrants are protected by #privacy rights | TechCrunch

https://techcrunch.com/2026/06/29/in-major-privacy-win-supreme-court-rules-geofence-warrants-are-protected-by-privacy-rights/

Well it finally happened, I got notified that my medical records, which were in the custody of a third party company without my knowledge, were involved in a big medical data breach last year. This breach apparently went back as far as January 2025 but law enforcement prevented notification of victims until now. Absolute fuckery. I am incandescent. 🤬 🤬 🔪 #privacy #infosec

Democrats & Republicans’ KIDS Act would push online age verification, forcing platforms to collect more identity data—undermining anonymity for everyone, especially journalists and whistleblowers. Mandating verification can hand government a “skeleton key” to sources, not make kids safer. 🗞️🔍🚫 https://theintercept.com/2026/06/28/age-verification-privacy-surveillance-journalists-whistleblowers/ #FirstAmendment #Privacy #PressFreedom #Whistleblowing

This is a very important bi-partisan privacy issue, and for anyone who is interested in free journalism, a must-read. It also has a section about Vimeo.

#ATF cancels phone tracking contract after lawmakers raise concerns

https://apnews.com/article/atf-surveillance-wyden-cloud-566f702fe6082310d6b7c64e5b2de009

#privacy #surveillance #politics #Webloc

Google's new CAPTCHA asks you to wave at your camera. It records your hand movements, extracts 21 joint coordinates, then deletes the video. Google says it's safe. But normalizing camera checks for basic website access is a privacy line worth noticing. #privacy #captcha #google #biometrics #indigoprivacy

new channel for #ArcaneChat, #DeltaChat and other #chatmail clients (encrypted email newsletter!)

Pluralistic - Daily links from Cory Doctorow

The channel is auto-generated from @pluralistic 's #RSS feed

here is the invite link 👇️
https://i.delta.chat/#EB87F92DC57303205E7F3ACB6DAA06D8FE761414&v=3&x=qGsBzEyxwfXZHdC3c_xgTSt4&j=dfmqdw31uNWGhZOWTmC9kt6m&s=V-0OT8cqMFvtYK5kH7E2Phcy&a=6j2tb0xyz%40arcanechat.me&n=ChannelsBot&b=Pluralistic

#newsletter #encryption #e2ee #privacy #decentralization #email #blog

Alt...

an screenshot of the Pluralistic channel

#DataBreach exposes up to 14.2 million #email logins at six ISPs

https://www.bleepingcomputer.com/news/security/data-breach-exposes-up-to-142-million-email-logins-at-six-isps/

#ISP #privacy #cybersecurity #STNet #JCOM #Chubut #NIFTY #BIGLOBE

#Framingham #police will not renew #Flock Safety contract after months of resident opposition

https://www.boston.com/news/local-news/2026/06/25/framingham-police-will-not-renew-flock-safety-contract-after-months-of-resident-opposition/

#ALPR #surveillance #privacy #Boston

new ArcaneChat channel for you:

Street Art Utopia - We declare the world as our canvas!
Website: streetartutopia.com
Mastodon: @streetartutopia

here is the invite link 👇️
https://i.delta.chat/#EB87F92DC57303205E7F3ACB6DAA06D8FE761414&v=3&x=MgHEG7vN3vvZdX3fA38ATHwk&j=BuL4xJ-tKn7MUeFq4CXK04m6&s=k58srCpWmRoJvvshCf2Icg7j&a=6j2tb0xyz%40arcanechat.me&n=ChannelsBot&b=Street+Art+Utopia

#ArcaneChat #DeltaChat #chatmail #decentralization #encryption #privacy #e2ee #autonomy #digitalindependence #europe #european #photography #artist #art #streetart #streetartutopia #android #openSource #email #graffiti #activism

Alt...

an screenshot of the Street Art Utopia channel and its content/posts

Jakiej przeglądarki używasz jako Daily Driver na Androidzie w swoim privacy setupie?

#AskFedi #Poll #Privacy #GrapheneOS #Android #DeGoogle #Browsers #Cromite #Brave #Firefox

🚨 Discord is testing **Incode** for age verification, but the real privacy story is far more complicated.

📌 On-device facial age estimation
📌 Government ID verification
📌 Credit card & Google Wallet checks
📌 TikTok comparisons explained
📌 What happens to your biometric data?
📌 The hidden behavioral profiling almost nobody is discussing

If you use Discord, read this before you verify your age.

🔗 https://thecybersecguru.com/news/discord-incode-age-verification-privacy/

#Discord #Privacy #CyberSecurity #DataPrivacy #Biometrics #IdentityVerification #Infosec #TechNews #CyberNews #OnlinePrivacy #Incode #AgeVerification #DigitalRights #CyberSecurityNews

Privacy and Surveillance boosted

The CyberSec Guru » 🌐 2026-06-29 / 2026-06-29
@guru@thecybersecguru.com

Discord Is Testing Incode for Age Verification, and the Privacy Concerns Are Legitimate

Discord is running a limited trial with Incode for facial age estimation and ID scanning. Here is what the vendor actually does, what are the privacy concerns [SENSITIVE CONTENT]

Discord has a new age verification vendor. The vendor is Incode. Community reaction has been immediate, furious, and in some important ways – partly based on a real problem, and in other ways based on a misread of what is actually happening technically.

I want to be precise here, because precision is what this story needs. The anger being passed around X right now treats Incode’s involvement in Discord as an obvious red flag, pointing primarily to the vendor’s work with TikTok as proof that handing your face and government ID to this company is reckless. That concern is not invented. But it is also not a clean one-to-one comparison, and the way it is being discussed right now is collapsing some genuinely important distinctions that determine whether the risk is real or overstated.

Discord Logo

So let me take this apart properly. The breach history, the vendor architecture, Incode’s actual technical design, its TikTok implementation and how it differs from the Discord configuration, the behavioral profiling that is already running on every account right now, and what the sum of all this means for anyone who uses Discord and cares about where their biometrics end up.

How We Got Here: The Full Disaster Timeline

None of this exists in a vacuum. You cannot understand why Incode’s addition to Discord’s verification stack sparked the reaction it did without understanding the 15 months of wreckage that preceded it.

September 2025: The Breach

The story starts on September 20, 2025, though Discord would not tell its users about it until October 3rd. That day, attackers compromised a support agent at 5CA, a Netherlands-based customer experience firm that Discord had outsourced its helpdesk and Trust and Safety ticket handling to. The method was straightforward social engineering: a deceptive phone call to a support agent at 5CA tricked the employee into surrendering their login credentials. With those credentials, the attackers had unfettered access to Discord’s customer support system for 58 hours.

What they found there was a honeypot that never should have existed. According to Discord, the stolen data included names, Discord usernames, email addresses and other contact details users had provided to receive support; messages and conversation transcripts with support agents; limited billing and payment metadata including payment method, purchase history, and the last four digits of credit cards; IP addresses associated with support interactions; and limited corporate data such as training materials stored in the support system. Most critically, it included government ID photos. Passports. Driver’s licenses. The kind of data you cannot rotate like a password.

Discord’s official figure was approximately 70,000 affected users. The group claiming responsibility, calling itself Scattered Lapsus$ Hunters – a name that explicitly references three separate notorious threat actors, Scattered Spider, LAPSUS$, and ShinyHunters claimed something very different. The group publicly taunted Discord and demanded ransom, asserting they held 2,185,151 government-issued identification photos. Their initial ransom demand was $5 million, later reduced to $3.5 million. Discord refused to pay.

Discord disputed the 2.1 million figure as an extortion-inflated claim. The underlying point – that concentrated identity document handling creates a catastrophic target is not in dispute by anyone.

The situation got stranger. 5CA, the vendor Discord named as responsible, issued its own denial, stating that “none of 5CA’s systems were involved, and 5CA has not handled any government-issued IDs for this client.” The company said the incident may have resulted from human error occurring outside its systems, without offering further explanation. So Discord blamed 5CA. 5CA denied responsibility. The 70,000+ people whose ID photos were now in circulation had no clear answer about what had actually happened to their documents.

What is technically confirmed: government IDs submitted through the manual age verification appeals process ended up in a customer support ticketing environment that a single compromised agent’s credentials could access. Whatever the precise chain of custody, that architecture created the exposure. The lesson was obvious. Nobody acted on it immediately.

February 2026: The Announcement That Lit Everything on Fire

Four months after those 70,000 IDs were stolen, Discord announced mandatory global age verification.

The timing was not lost on users. The announcement was timed to coincide with Safer Internet Day. People noticed. The February 9 announcement said that all new and existing users worldwide would receive a “teen-appropriate experience by default” starting in early March, and that adults wanting full access would need to prove their age via video selfie or government ID upload. The rollout was framed as necessary compliance with mounting global legislative pressure from the UK’s Online Safety Act, Australia’s social media age restrictions, Brazil’s incoming requirements, and a patchwork of US state laws.

The response was immediate. Google searches for Discord alternatives spiked worldwide. Hundreds of users on Reddit announced they were cancelling Nitro subscriptions or deleting accounts entirely. Discord head of product policy Savannah Badalich told The Verge the company expected “some sort of hit” to user numbers. They were right.

The backlash was about more than timing. It was about what researchers found when they started actually examining Discord’s verification infrastructure.

The Persona Revelation

Discord had been quietly running a limited UK test with Persona, an identity verification startup backed by Peter Thiel’s Founders Fund. Users were not clearly told. When the partnership became public, researchers investigated. What they found was not a simple age-checking tool.

Researchers investigating Discord’s age verification checks discovered an exposed frontend belonging to Persona on a US government-authorized server. It revealed a far more expansive surveillance and financial intelligence stack than a simple teen safety tool. Nearly 2,456 accessible files were found sitting on a US government-authorized endpoint without any exploit required. The files showed Persona conducted 269 distinct verification checks, including screening for adverse media across 14 different categories such as terrorism and espionage.

The researchers’ description of their discovery was almost offhand in its contempt: “We didn’t even have to write or perform a single exploit. The entire architecture was just on the doorstep.”

Persona is backed by Founders Fund, a venture firm co-founded by Peter Thiel, who also co-founded Palantir. Palantir is known for creating large-scale intelligence and surveillance software used by US government agencies and law enforcement. Whether or not the connection was operationally relevant, the optics were catastrophic.

Discord cut Persona loose. Discord’s CTO confirmed in a public post that the UK experiment ran for less than a month, that Persona did not meet the new requirement that any partner offering facial age estimation must perform it entirely on-device, and that all data was deleted after completing verification.

The Retreat and the Promises

Discord’s CTO Stanislav Vishnevskiy posted a public admission that the company had “made mistakes” and acknowledged that in hindsight, they should have provided far more detail about how the verification process actually works. “Many of you walked away thinking we’re requiring face scans and ID uploads from everyone just to use Discord. That’s not what’s happening, but the fact that so many people believe it tells us we failed at our most basic job.”

The commitments made in that post matter because they are what Discord is now being judged against:

Full vendor transparency. Every verification vendor documented on the website with data handling practices. Users would be told in the product who each vendor is.

On-device requirement. Any partner offering facial age estimation must perform it entirely on-device. Biometric data must never leave the user’s phone.

More verification options. Credit card verification and others were in development and would be completed before global scaling.

Technical documentation. A blog post explaining the age inference methodology before global launch.

Age assurance data in transparency reports. Numbers on how often users were asked to verify, which methods they used, and how often the automated system handled it without any user action.

The global rollout was pushed to the second half of 2026. The UK, Australia, and Brazil remained under existing regulatory requirements in the meantime.

And now, four months later, Incode is in the trial.

Who Is Incode

Before getting into what the Discord trial does or does not mean, it is worth understanding what Incode actually is, because the community reaction has been treating it as an opaque, shadowy data company, and the reality is more complicated.

Incode Logo

Incode Technologies was founded in 2015 and raised $220 million in a Series B funding round in 2021 at a $1.25 billion valuation, led by General Atlantic and SoftBank’s Latin America fund, with additional backing from J.P. Morgan, Capital One Ventures, and Coinbase Ventures. As of late 2025, the company was in preliminary talks to raise between $150 million and $300 million at a valuation of up to $3 billion, with annual recurring revenue of approximately $170 million.

CEO Ricardo Amper has said that Incode processed more than 4.1 billion identity checks in 2024 and serves 8 of America’s top 10 banks, 8 of North America’s top 9 telcos, and 4 of Latin America’s top 5 banks. The company has also achieved FedRAMP Ready status, meaning it has cleared the preliminary requirements to handle US federal government data.

That last point is worth noting. Incode is not a scrappy startup with questionable security practices. It is a significant enterprise identity infrastructure company chasing government contracts. That context does not make every privacy concern moot, but it shapes what kind of risk we are actually talking about.

The Technical Architecture

Incode’s identity verification platform runs on what the company calls its “Incode Omni” stack. It combines several distinct modules: facial recognition, document verification via optical character recognition, passive liveness detection, deepfake detection, and age estimation. These can be deployed individually or together depending on the customer’s requirements.

For age verification specifically, Incode operates across two architectural paths.

The first, and the one most relevant to the Discord selfie trial, is fully on-device. The face is detected on-device, a privacy-safe facial landmark map is created without identifying who the person is, and the model analyzes age-related facial features like skin texture and landmarks to estimate an age range, not a precise identity. The only output that leaves the device is a pass/fail result against a configured age threshold. No face image, no biometric template, nothing identifiable.

A second architectural path exists for environments where server-side intelligence is needed. In this mode, the image is encrypted on-device before anything is transmitted. What reaches the server is not a face image. It is an encrypted vector. Inference, including liveness detection, deepfake resistance, and anti-spoofing checks, runs directly on the encrypted signal. Decryption outside the user’s device is not possible. The result is returned and decrypted on-device.

For the Discord trial, the stated path is the fully on-device option. No biometric data transmitted. Selfie never leaves the phone.

The ML Models: What They Are Actually Running

Incode’s own manifesto describes the on-device age estimation flow: the face is analyzed locally, and only a result leaves, not the data that produced it. The underlying model has been through independent evaluation.

In the National Institute of Standards and Technology Face Analysis Technology Evaluation covering 8 age estimation algorithms, Incode achieved a mean absolute error of 3.0 years on the Application dataset. The Application dataset specifically uses images typical of real-world user uploads, not controlled lab photos. That is meaningful because it reflects the accuracy someone using the Discord app will actually experience, not a sanitized benchmark score.

The NIST FATE evaluation found that accuracy of age estimation algorithms has improved markedly since initial evaluations in 2014. Incode’s internal testing claims 99.9% accuracy, though that figure comes from their own testing rather than NIST.

The Liveness and Deepfake Problem

One thing that does not get discussed enough in coverage of age verification is what happens when someone submits a deepfake, a high-quality printed photo, or a video replay attack instead of a live face. The question of whether the selfie is coming from a real human present at the device matters enormously for whether the system actually works, and it is distinct from the privacy question.

Incode’s liveness detection software passed presentation attack detection evaluations to iBeta’s Level 3 on both iOS and Android, becoming the first liveness vendor with independent confirmation of this level for both platforms. No errors were reported during the tests, based on the ISO/IEC 30107-3 standard, for both attack presentation classification error rate and bona fide presentation classification error rate of 0 percent.

Incode’s Deepsight product won the 2026 Fortress Cybersecurity Award in Deepfake Detection and Anti-Phishing, recognized for iBeta Level 3 certification and AI-powered fraud defense.

Incode has also processed over 7 billion identity verifications total, and its own data shows that in 2024, agentic fraud i.e. fraud attempts with the help of AI agents comprised only 3% of fraud attempts but is growing rapidly. The deepfake and injection attack detection is becoming the arms race, and it is one Incode is genuinely competing in at a serious level.

The TikTok Problem, Decoded

Here is where the community criticism has a real foundation, and where precision matters most.

Incode powers age verification for TikTok Live eligibility checks. When users fail TikTok’s automated checks and need to confirm they are old enough to go live, some are routed to Incode for manual ID verification.

TikTok’s own support page explicitly states: “Our trusted partner, Incode, will retain the information you submit to confirm your age.”

The Electronic Frontier Foundation examined this specific implementation and was direct about what they found. In a disappointing failure to meet the industry standard, Incode itself does not automatically delete the data once the process is complete, but TikTok does claim to “start the process to delete the information you submitted,” which should include telling Incode to delete your data once the process is done. If you want to be sure, you can ask Incode to delete that data yourself. Incode tells TikTok that you met the age threshold without providing your exact date of birth, but then TikTok wants to know the exact date anyway, so it’ll ask for your date of birth even after your age has been verified.

Incode’s own privacy policy confirms the concern: for biometric data, the company will retain the information until the initial purpose for collecting it has been satisfied, or three years after your last interaction with the customer, whichever comes first.

That three-year default window is the problem. The TikTok implementation relies on TikTok initiating a deletion process after verification rather than Incode deleting data automatically on completion. That is a gap. It is the kind of gap that matters when retention equals exposure window.

Incode’s biometric data policy also notes that the company and its partners collect, store, and use biometric data for identity verification services, as well as related training of models if the individual has consented. That last clause is worth reading again. If you consented somewhere in the verification flow, your data may also be used to train their models.

Why the Discord Comparison Is Not Clean

Now here is where the community discussion is getting the comparison wrong.

Discord’s trial documentation does not reflect the TikTok configuration. Per Discord’s support page: for the Incode ID scan trial, “everything is permanently deleted once your age is confirmed and Discord never sees it.” That is a different contractual mandate from TikTok’s arrangement with the same vendor.

Identity verification vendors do not deploy identically across every customer. The data handling configuration, the retention schedule, the deletion mandate – these are negotiated at the customer level. When Incode deploys for a bank doing KYC onboarding, the retention requirements are completely different from when it deploys for a social platform doing age gating. What TikTok’s agreement with Incode says tells you almost nothing certain about what Discord’s agreement with Incode says.

What users are trusting, if they believe Discord’s documentation, is two things: first, that Discord actually negotiated a deletion-on-verification mandate with Incode for this trial; and second, that Incode is implementing it correctly.

Both of those are things you cannot independently verify. That is the actual problem. Not Incode specifically, not TikTok’s implementation specifically, it is the fundamental architecture of trusting a multi-vendor chain with your most sensitive documents on the basis of a support page entry that cannot be audited.

The Vendor Stack Nobody Is Talking About

When people discuss Discord’s age verification, they mostly talk about Discord and Incode. The real picture is considerably more complicated.

Discord’s primary age assurance vendor right now is k-ID, a Singapore-based compliance orchestration firm. k-ID is not a biometrics company. k-ID is technically an orchestration platform, not a biometrics vendor with its own algorithm. While it may process the selfie, the technology it uses to analyze facial features on-device is provided by external vendors it calls subprocessors.

k-ID’s list of subprocessors includes Veratad for age checks based on ID documents and server-based facial age estimation, while the k-ID privacy policy names Privately as the provider of on-device facial age estimation. Privately is a Swiss firm. Their on-device FAE technology is what actually runs when you take a selfie through k-ID’s flow on Discord.

Discord’s public vendor transparency page mentions k-ID and Veratad. Privately does not appear. So users reading that transparency page are seeing two of the three companies that handle their data, not all three.

k-ID also led the launch of the OpenAge Initiative in November 2025, a reusable age check system. Persona, Incode, and Veratad are among the companies in the OpenAge network. So Persona, the vendor Discord dropped and publicly cut ties with is in a reusable credential network alongside Incode and Veratad, who are still active in Discord’s stack. The age assurance industry is small and heavily interconnected. Treating one vendor relationship as cleanly separate from another is not entirely realistic.

Now Incode is being added as a parallel experiment, and users still have no mechanism to know, in a given verification session, whether they are hitting k-ID’s stack (which uses Privately for on-device FAE and Veratad for server-side ID checks) or Incode’s stack. There is no indication of how or when Discord will advise a user which facial age estimation method is being deployed in any given scenario. The implication is not that anything sinister is afoot. Rather, it illustrates how accountability gets layered through orchestrated age assurance, leaving users to follow a breadcrumb trail to find out who is actually feeding their biometrics into an algorithm.

Discord promised full transparency on vendors. That promise has not been fully kept. You cannot tell which vendor processed your biometrics in a specific session.

The Silent Surveillance That Is Already Running

Before any of the vendor drama. Before Persona, before Incode, before the breach. Discord was already profiling every account for age.

Discord leverages an advanced machine learning model developed in-house to predict whether a user falls into a particular age group based on patterns of user behavior and several other signals associated with their account on Discord. The model only assigns users to an age group when its confidence level is high; when it is not, users go through the standard age assurance flow.

The signals feeding that model: account tenure, whether you have a payment method on file, the types of servers you are in, activity timing, device type, game metadata. The model excludes message content but not overall usage.

Over 90% of users are reportedly classified this way and never prompted to do anything active. Discord frames this as the least invasive option – the thing that spares most users from explicit verification. That framing holds up if you compare it only to submitting a face scan. It does not hold up if you compare it to not being demographically profiled at all.

What Discord does not acknowledge is that silent, universal behavioral profiling is itself a form of surveillance, even if no face scan is involved. Anti-spam detection, which Discord uses the same signal categories to describe, identifies bad behavior. Age inference assigns you a demographic classification based on how you use the platform, which servers you join, what games you play, when you are online. The purpose is categorically different even when the data inputs overlap.

Discord expanded its data collection and ad targeting capabilities in August 2025, broadening the behavioral signals it captures to power sponsored content and Quests. The age inference model uses many of the same signal categories 0 activity patterns, server joins, connected accounts, usage behavior that feed Discord’s advertising engine. Discord’s FAQ says age assurance data will not be used for ad targeting. When the underlying behavioral data already serves both purposes, that distinction is narrower than it sounds.

The Methods Discord Is Testing Right Now

The Incode trial is one piece of a larger verification expansion happening between June and July 2026. Here is the full picture of what is being tested.

Selfie via Incode (Facial Age Estimation)

Your selfie never leaves your device, and no biometric data is shared. The experiment may not be available to all users and runs from June 2026 to July 2026. The on-device ML model analyzes facial features, returns an age estimate, and sends only a pass/fail result to Discord. Discord receives your age group, nothing else.

ID Scan via Incode

Your ID and selfie go directly to Incode. Only the date of birth is reviewed for age confirmation purposes, and the entire process is fully automated so no human ever sees your ID. Everything is permanently deleted once your age is confirmed and Discord never sees it. Discord only receives your age and your ID is never linked to your Discord account.

This is the flow where the TikTok comparison is most relevant. Incode’s servers receive actual identity documents in this path. Whether the deletion mandate in Discord’s contract is being correctly implemented is what users cannot independently verify.

Credit Card Check

This method confirms you are an adult by verifying ownership of a credit card. Card details are passed to k-ID, who sends them to Stripe, a secure payment processor. Your details are never seen by Discord and are not retained by k-ID or Discord. Discord only receives confirmation of whether or not you are an adult. A small temporary charge under $0.50 USD may be placed to confirm the card is valid, and if charged, you will be fully refunded within 14 business days. Only credit cards are accepted. Debit cards and prepaid gift cards are not eligible.

This is the possession proxy model. If you own a credit card, the system infers you are an adult. No biometrics. No government ID. For anyone already paying for Nitro with a credit card, this is probably the least invasive verification path available.

Google Wallet

This method uses a passport ID pass saved in Google Wallet to confirm age. Google shares the birthdate with Discord, and Discord derives the age from it. Discord does not store or retain the birthdate after that. All other information included in the form of ID stays within Google Wallet and is never shared.

The Google Wallet path introduces a different trust question: instead of trusting Incode or k-ID with your documents, you are trusting Google’s handling of your passport data within their wallet infrastructure. For users already deeply embedded in the Google ecosystem, this may feel more acceptable. For users trying to limit Google’s data collection, it is a different kind of problem.

The Legal Landscape Underneath All of This

The reason Discord is building this system at all comes down to regulatory pressure, and understanding that pressure explains both the urgency and why the company has made choices that look, from the outside, like they prioritize compliance over user privacy.

The UK’s Online Safety Act creates mandatory age assurance obligations for platforms with significant UK user bases. All UK users are already under the new requirements: automatic content filtering enabled by default, age assurance required before accessing content flagged by sensitive media filters, age-restricted channels, or before turning off message request filtering.

Australia banned social media for under-16s starting December 2025. Brazil has its own incoming requirements. The EU is moving toward an EU-wide minimum age of 16 for social media. At least 20 US states had enacted some form of age gating laws for certain content by mid-2025, with more in progress.

Discord is explicitly preparing for a public stock listing. A company heading toward an IPO with age verification non-compliance across multiple major jurisdictions is a company with a serious regulatory liability problem. The teen safety push is not purely altruistic, and acknowledging that is not cynical, it is just accurate.

The Biometric Privacy Law Problem

On the US side, platforms doing age verification are operating in the overlap of four distinct legal regimes that push in different directions: state mandates requiring age verification, state biometric privacy statutes penalizing how verification is done, federal statute that has not yet arrived, and Supreme Court precedent that has settled some constitutional ground while leaving social-media mandates in active litigation.

Illinois’s Biometric Information Privacy Act, Texas’s Capture or Use of Biometric Identifier Act, and Washington’s My Health My Data Act all apply differently to biometric age verification flows. BIPA in particular is the one that has generated significant litigation. TikTok agreed to pay $92 million to settle a BIPA class action alleging collection and sharing of biometric data without consent. The suit alleged TikTok collected facial scans without providing proper notice, informing subjects their biometric information was being collected, or seeking and obtaining written releases.

An on-device facial age estimation flow where no biometric data is transmitted sidesteps most BIPA exposure, because BIPA’s core requirements apply to the collection and storage of biometric identifiers. If the identifier never leaves the device, the legal exposure profile changes significantly. That is part of why Discord’s on-device requirement for facial age estimation vendors is both a genuine privacy improvement and a compliance-driven decision.

What the EFF’s Position about this

The EFF’s position goes beyond specific vendor choices. They have stated that Discord went beyond what any applicable law requires, and have encouraged all services to stop adopting these systems when they are not mandated by law, framing voluntary age verification as both a censorship and surveillance risk.

The EFF’s 10 dangers of age verification, published in December 2025, catalogues specific harms that do not appear in most news coverage of these systems:

15 million US adults lack driver’s licenses. 2.6 million have no government photo ID at all. 34.5 million do not have ID with their current name and address. These populations skew Black, Hispanic, low-income, and disabled. Age verification systems that require government ID lock these populations out of online spaces that have become essential to daily life.

AI age estimation has documented racial bias. These systems show higher error rates for Black, Asian, Indigenous, and Southeast Asian faces. Adults get misclassified as minors. Unequal platform access based on skin color.

Transgender users face particularly sharp tradeoffs. 43% of transgender Americans lack ID reflecting their correct name or gender. Age estimation fails more often on trans faces. The choice becomes: out yourself by submitting mismatched ID, or lose access.

Anonymity in communities built around sensitive topics – mental health, sexuality, political activism disappears when accessing those spaces requires identity verification. Discord is not a pornography platform. It is where queer teens find community, where people in crisis reach support networks, where marginalized people build space for themselves. The identity verification requirement changes the character of those spaces in ways that go beyond what a simple “teen safety” framing captures.

The Breach Architecture That Has Not Been Fixed

The October 2025 breach has been widely characterized as a vendor problem. Discord used a third-party support system that got compromised. The fix is better vendors. But that reading misses the structural issue.

Even with on-device processing for facial estimation, a structural vulnerability remains. The October breach did not occur because Discord collected face scans. It occurred because the manual appeals process required government documents to be held within a third-party vendor’s support system, accessible via a single compromised agent’s credentials. Replacing the vendor does not eliminate that architecture.

The manual appeals flow – the path for users whose automated age estimation fails and who want to contest a teen classification – still requires submitting identity documents that get routed through a processing environment accessed by support staff. On-device selfie processing solves the problem for the majority path. It does not solve the problem for the minority path where a user needs to appeal a failed estimate or provide documentary proof.

The CTO’s post says that information submitted for age verification “is stored only for the minimum time necessary, which in most cases means it’s deleted immediately.” The qualifier “in most cases” is doing significant work there. For users routed into manual appeals, retention and handling practices remain unclear.

This is not an accusation of bad faith. It is a statement about unsolved architecture. Any system that has a manual appeals track with human review of identity documents is a system that creates the same category of exposure that produced the October breach, regardless of which vendors are handling the primary verification flow.

The Identiq Acquisition and What It Means

One development in the Incode story that has not received much coverage in the Discord context is the acquisition Incode completed on June 25, 2026 – four days before this article went to publication.

Identiq spent nearly a decade and invested over $50 million developing patented privacy-enhancing technology that enables fraud pattern sharing across institutions without any raw customer data leaving each organization. No central data lakes. No data brokerage. Institutions share fraud signals without exposing customer data to any third party.

The acquisition’s stated purpose is to add a third architectural layer to Incode’s platform: collaboration without exposure. The underlying cryptographic approach is that companies can detect repeat fraud patterns across a network without centralizing the personal data that would make that network a breach target.

For the Discord trial specifically, the Identiq acquisition is not directly relevant – the trial uses Incode’s on-device age estimation and ID scan capabilities, not the fraud network layer. But it does indicate where Incode is heading architecturally. If the acquisition represents genuine implementation of privacy-by-design rather than marketing, Incode in two years may look meaningfully different from Incode in its TikTok deployment from a year ago.

What it does not do is address the specific concern about Incode’s TikTok retention configuration. Acquiring Identiq demonstrates a long-term architectural intent. It does not retroactively change what TikTok’s implementation agreement with Incode says about deletion timelines.

The OpenAge Problem

Here is something almost nobody is discussing: the age verification industry is building shared infrastructure, and Incode is in the middle of it.

The OpenAge Initiative, launched under k-ID’s leadership in November 2025, aims to create reusable age verification credentials. The concept: a user verifies their age once, using approved methods like biometric FAE or credit card checks, receives a FIDO passkey-based “AgeKey” credential, and can then reuse that verification across multiple platforms without re-verifying each time. Persona, Incode, and Veratad are all members.

On paper, this sounds like a privacy improvement. Verify once, prove everywhere, reduce the number of times you hand your face or ID to a vendor.

In practice, the implications depend entirely on how the credential is implemented at each layer. If the OpenAge AgeKey is truly device-bound and issuer-blinded – meaning the issuer does not see where the credential is used after issuance then it could represent a genuine privacy advance. If the issuer is involved in each verification request, the AgeKey becomes a cross-platform tracking token, and the issuer can build a profile of everywhere you have used it.

Critics have noted this distinction clearly. “Token-based on its own tells you almost nothing until you know what it is anchored to and what gets logged,” one researcher noted. “A backend token sounds less invasive than uploading your face or your credit card, but that is mostly marketing.”

Discord is involved with k-ID, which runs OpenAge. Incode is a member of OpenAge. Veratad, which processes Discord’s ID scans through k-ID, is also in OpenAge. The network of companies handling Discord’s age verification data is tighter than the public documentation suggests.

What Incode’s Manifesto Says

I read Incode’s public “manifesto” document – it went up on their website four days ago, alongside the Identiq acquisition announcement and it is worth quoting from because it describes the technical approach in more precise terms than press releases usually do.

On why they built on-device processing: “By their very nature, these workflows involve sensitive populations, including those under 18. For us, that means the privacy standard is not just high – it is absolute. When you estimate age with Incode, a human never sees an end user’s biometric data as part of the standard verification process. Now, we are taking these safety measures even further. With On-Device Age Estimation, zero data transmission occurs, period. Biometric processing happens entirely on the user’s own device. Sensitive information stays inside the user’s environment by design, with no tradeoff on accuracy. We are the first company to deliver on-device age assurance at enterprise scale and at this level of accuracy.”

And: “We did not build it this way because the law required it. We built it this way because we saw no other responsible option. The law has since caught up.”

That is a strong statement. It is also a marketing document, and the company’s TikTok retention configuration exists alongside that marketing document. Both things are true simultaneously. The architecture they describe is technically real and technically achievable. Whether it is correctly implemented in every customer deployment is a different question.

What the Biometric Update Analysis Found

The most technically precise coverage of the Discord-Incode trial came from Biometric Update, which covers the identity verification industry professionally rather than as a consumer tech story. Their analysis identified something important that most other coverage missed.

Discord’s announcement is simple enough on the surface. But language again becomes a load-bearing hinge. Most industry experts agree that the technical challenges of age assurance have largely been solved, at least by top providers. The technology is available. Regulatory challenges remain a going concern. But the largest challenge facing the age assurance industry may be communications. The perception that age assurance vendors are nefariously collecting user data to sell at a profit is fueled in part by an inability of providers to adequately explain to users what they actually do. Erasing that paranoia will require work from providers to ensure their privacy policies clearly reflect actions made in good faith, and do not come off as tortuous or evasive.

That is a fair characterization of the gap between what these systems actually do technically and how they are perceived. It is also somewhat self-serving from the identity industry’s perspective – the “paranoia” framing assumes that user skepticism is primarily a communications problem rather than a rational response to a documented breach and a market full of opaque data handling.

Both things can be true. The technical controls being described by Incode are real. User skepticism about whether those controls are correctly implemented is also rational. These positions are not mutually exclusive.

The Honest Assessment

So where does this leave us?

The Incode trial’s selfie flow on-device processing, no data transmitted, pass/fail result sent to Discord is technically what Discord promised after the Persona debacle. It implements the on-device requirement Discord set as a condition for any facial age estimation partner. The NIST accuracy data is real. The iBeta Level 3 liveness certification is real. The architecture Incode describes for the selfie path is genuinely privacy-preserving relative to the alternatives.

The Incode trial’s ID scan flow – government ID and selfie sent to Incode’s servers, date of birth extracted, everything deleted on confirmation is where the legitimate concern lives. The TikTok retention issue the EFF documented applies to the TikTok customer configuration, not necessarily the Discord configuration. But users cannot verify that Discord’s deletion mandate is being implemented correctly. That is the gap, and it applies equally to k-ID’s ID scan path through Veratad, which has the same structural trust problem.

The transparency failure is real. Discord promised users would be told in the product which vendor is active in a given verification session. That has not happened. Incode is now in the trial, and users have no mechanism to know when Incode processed their data versus k-ID’s stack.

The behavioral profiling is real and separate from all of this. Every account on Discord is being classified by an in-house ML model using activity signals, account history, server membership, payment data, and device information. That classification is already happening. The debate about Incode is happening on top of a surveillance layer that is not vendor-specific and that predates any of the explicit verification choices.

The structural breach risk has not been solved. The manual appeals path still exists. Anyone who fails automated estimates and wants to contest the result still submits identity documents to a processing environment. Swapping vendors does not fix the architecture that produced the October 2025 exposure.

The community’s anger is not wrong. It is pointing at real problems. The TikTok comparison is the most frequently cited and the least precise. The transparency failure is real and underreported. The behavioral profiling layer is the most significant and the least discussed. And the manual appeals architecture is the most dangerous piece of the puzzle that nobody outside of security analysts seems to be talking about.

Discord is trying, badly, to build something it was not designed to build, under regulatory pressure it did not anticipate, on top of a trust deficit it created itself. Incode may well be the best facial age estimation vendor currently on the market by several technical metrics. That does not mean Discord’s implementation of it is above criticism. And it definitely does not mean the underlying premise that a 200-million-user communication platform should be building a biometric identity infrastructure at all, absent legal compulsion is beyond questioning.

It is not beyond questioning. The EFF is right about that. But that argument is different from the argument that Incode specifically is storing your Discord selfie forever, because that is not what the technical documentation says is happening.

Keep those two arguments separate. They matter differently. And only one of them can be answered with better engineering.

Alt...

Discord Is Testing Incode for Age Verification

Alt...

Discord Logo

Alt...

Incode Logo

Alt...

Discord Is Testing Incode for Age Verification, and the Privacy Concerns Are Legitimate

• #Privacy

@eff , #TEDIC and #CEJIL Challenge #Secrecy in the Use of #FaceRecognition in #Paraguay

Seeking #transparency and #accountability in Paraguay’s use of facial recognition, EFF, the Association of Technology, Education, Development, Research, Communication (TEDIC), and the Centre for Justice and International Law (CEJIL) filed a complaint with the Inter-American Commission on #HumanRights against the state for arbitrarily denying access to information about its implementation and use of the technology as a tool for mass #surveillance that erodes people’s #privacy #rights.

https://www.eff.org/deeplinks/2026/06/eff-tedic-and-cejil-challenge-secrecy-use-face-recognition-paraguay

Public bicycle share programs collect GPS ride data linked to account identity that has been shared with city transportation agencies and third parties. #privacy #dataprivacy #indigoprivacy

No sponsored content. Just one privacy story per week that's worth reading. #privacy #indigoprivacy

The Circle: The Scariest Part Isn't Big Tech. It's Us.

When The Circle hit theaters in 2017, many people saw it as another tech thriller. Today, it feels less like science fiction and more like tomorrow's news feed.

The movie is based on Dave Eggers' bestselling novel, often called the 1984 of the digital age. Ironically, the film improves on the book in one important way. Instead of explaining every idea through endless dialogue, it lets us see them. The result is faster, smoother and much easier to watch. But it still feels more like an essay than a real story.

Mae Holland lands her dream job at The Circle, a giant tech company that looks like a mix of Google, Apple, Meta and TikTok. The campus is bright, colorful and full of smiling people. Everyone talks about changing the world. That is the first warning sign.

Modern tech companies rarely say they just want to build products or make money. They promise to make humanity better. The Circle sells exactly that dream. Soon Mae believes privacy is outdated. If you have nothing to hide, why keep secrets? She starts wearing a tiny camera that livestreams her entire life. Every second. Every conversation. Every emotion. Imagine if your entire life became one endless Twitch stream.

This world feels like a strange combination of George Orwell's 1984 and Aldous Huxley's Brave New World. Control no longer comes through fear alone. It comes through convenience, entertainment and the promise of a better future. Looking at today's AI boom, smart homes and endless social media feeds, the movie suddenly feels much less fictional than it did a few years ago.

One scene stands out. The Circle suggests that voting should happen through its own platform. If everyone already has an account, why not connect democracy directly to the app? It sounds efficient. Maybe even practical. The movie briefly asks whether democracy itself could become a product owned by a private company. That is one of its most interesting ideas.

Sadly, it never explores that question.

Instead, the ending takes the easy Hollywood route. Rather than challenging the system, it blames a few powerful executives. Once their private emails are exposed, the audience is expected to believe justice has been served. As if replacing a CEO could solve everything.

But that misses the real problem.

Systems survive because people are replaceable. Remove one tech billionaire and another one will take the job. The real issue is a business model built on collecting more data, measuring human behavior and turning attention into profit. It doesn't matter whether the CEO is friendly or arrogant. If the machine stays the same, the result stays the same.

That idea feels even more relevant today. We often argue about individual tech leaders. But should we? The real question is why any company should have that much power in the first place. Whether it is Meta, Google, Apple or the next AI giant, the structure remains the same.

The movie also lets us off the hook too easily. It is comforting to blame powerful corporations. Harder to admit that we help build this world ourselves. We accept the cookies. We install the apps. We trade privacy for convenience. We buy smart speakers, connect everything to the cloud and tell ourselves it is worth it because life becomes easier.

That may be The Circle's biggest weakness. It criticizes Silicon Valley's worldview but forgets to criticize ours. Most people are not driven by ideology. They simply choose what is new, useful and comfortable. That is how surveillance becomes normal—not because anyone forces us, but because we quietly invite it into our homes.

The movie offers only one alternative: rejecting technology completely and escaping into nature. But that feels just as unrealistic as total digital transparency. It presents two extremes while ignoring everything in between.

Despite its flaws, The Circle remains a fascinating warning. Not because it predicts the future perfectly, but because so much of its future has already become our present.

Why am I writing about such an old movie? Shouldn't we have much smarter, deeper movies about AI, surveillance and Big Tech by now? Or have we simply become so used to these technologies that we no longer notice what is happening? Has Silicon Valley slowly won us over with its own propaganda? If you know any newer movies or series that tackle these questions in a more thoughtful way, let me know in the comments. I'm always looking for the next great warning before it becomes reality.

#TheCircle #movie #film #entertainment #cinema #Hollywood #criticism #filmcritic #siliconvalley #bigtech #bigdata #bigbrother #orwell #surveillance #privacy #warning #danger #today #future #ai #technology #software #algorithm #freedom #democracy #economy #power #billionaires #finance #money #company #humanity #ethics #world #life #control

Alt...

movie poster from the circle with the face of Emma Watson

Canadian Government Recommends VPNs as it Drives Them Out of the Country

VPN services are saying they will leave Canada thanks to warrantless wiretapping. Guess what the Canadian government recommended people use.

https://www.freezenet.ca/canadian-government-recommends-vpns-as-it-drives-them-out-of-the-country/

#News #Privacy #Security #BillC22 #Canada #government #NordVPN #ProtonVPN #Signal #VPN #WarrantlessWiretapping #Windscribe

Ventoy is a free and open-source tool that lets you boot multiple operating systems from a single USB drive without reformatting.

Install Ventoy once, then simply copy ISO files to your USB drive. It supports Windows, Linux, Secure Boot, persistence, and many rescue and diagnostic tools.

More details: https://digitalescapetools.com/tools/tool.html?id=ventoy

#OpenSource #Linux #Windows #USB #SysAdmin #Privacy #Tech

Alt...

Screenshot of the Ventoy project page showing the Ventoy logo and a brief description. It explains that Ventoy is an open-source tool for creating bootable USB drives for ISO, WIM, IMG, VHD(x), and EFI files without repeatedly formatting the USB. Users can simply copy multiple image files to the drive and choose which one to boot from a menu. The page also displays project badges including version 1.1.16, GPL-3.0 license, 78k GitHub stars, 16 million downloads, and a passing build status.

This game could be used as a huge explainer into how surveillance capitalism works and how people are exploited on both sides of the screen.

MajorOffline: Hae Stack – MajorLinux

https://majorlinux.com/majoroffline-hae-stack/

#Gaming #HaeStack #Investigation #PointAndClick #Political #Privacy #Puzzle #Steam #SteamNextFest #Surveillance #Capitalism #Tech #YouTube

🚨 The EU's controversial "Chat Control" proposal is back.

EU governments are reportedly trying to revive rules that could allow private messages to be scanned for child sexual abuse material, reigniting the debate over encryption, privacy, and mass surveillance. The proposal remains highly controversial and has not become law.

Read more: https://digitalescapetools.com/2026/06/eu-chat-control-revival-private-messages.html

#Privacy #Encryption #CyberSecurity #EU #ChatControl #DigitalRights

The Guardian: ‘It’s dangerous and it’s going to erode trust’: redesign of US government websites stokes surveillance fears

The National Design Studio, staffed by Doge veterans, installed visitor-tracking software on vital federal websites

"...An opaque White House office staffed largely by veterans of Elon Musk’s “department of government efficiency” (Doge) has quietly rebuilt some of the federal government’s most sensitive websites – for passport applications, voter registration, prescription-drug pricing and children’s savings – in ways critics say appear to violate federal law...."

https://www.theguardian.com/us-news/2026/jun/28/government-website-visitor-tracking-surveillance-fears

#cybersecurity #privacy #bigbrother #doge #fascism

Alt...

‘It’s dangerous and it’s going to erode trust’: redesign of US government websites stokes surveillance fears The National Design Studio, staffed by Doge veterans, installed visitor-tracking software on vital federal websites

🔮ArcaneChat Spoilers✨

for the next version of #ArcaneChat the message input bar got redesigned!

now it looks more modern, similar to #Telegram & #WhatsApp 's, and more in line with #Android 's edge-to-edge design

💜 if you like ArcaneChat and what we do, please consider making a donation, no amount is too small!
https://arcanechat.me/#contribute

#ArcaneChatSpoilers #privacy #encryption #security #decentralization #opensource #e2ee #european #europe #autonomy #digitalindependence #family #chatapp

Alt...

screenshot of arcanechat, showing the new input bar, looking pill-like instead of the old rectangular input bar

It seems like politicians are once again trying to infringe on citizens' right to privacy with this chat control bill. The bill will be discussed tomorrow. To EU citizens, please email your representative politicians! Details in the link: https://fightchatcontrol.eu/

https://www.patrick-breyer.de/en/double-threat-to-private-communications-undemocratic-chat-control-backroom-deals-and-imminent-concessions-spark-relaunch-of-fightchatcontrol-eu/

#Europe #privacy #chatcontrol #eu #surveillance

EU to legislate about Chat Control behind closed doors

https://www.patrick-breyer.de/en/double-threat-to-private-communications-undemocratic-chat-control-backroom-deals-and-imminent-concessions-spark-relaunch-of-fightchatcontrol-eu/

#HackerNews #EU #Chat #Control #Privacy #Legislation #Backroom #Deals #Communication

Flock cameras track more than your license plate, and they're spreading fast

https://www.engadget.com/2203000/flock-cameras-recording-license-plate/

#HackerNews #FlockCameras #LicensePlate #Privacy #Surveillance #Technology

RE: https://mastodon.online/@mullvadnet/116822244689326681

You cannot claim to be fighting for free speech and privacy while one of your CEOs is funding a fascist political party (i.e. people who actively work to destroy the very things you claim to be fighting for).

If you want any chance of repairing your reputation, you will oust Daniel from your company ASAP. If you continue to downplay/defend Daniel's actions, you will only succeed in making things worse for yourself.

#Privacy #FreeSpeech #DigitalRights #MullvadVPN #Mullvad #VPN

Mullvad VPN » 🌐 2026-06-27
@mullvadnet@mastodon.online

@lostgen

Mullvad is a political company fighting for free speech, free information and privacy, with two equal co-founders, co-owners and co-CEOs who fundamentally disagree on many issues. Daniel's donation to a political party is private and not part of Mullvad's mission. We protect the right to express and access views we disagree with. We welcome anyone sharing these core values, whatever their other opinions. We are happy to refund others who don't, where we can.

The European Court of Human Rights ruled GCHQ's mass surveillance UNLAWFUL.

14 judges dissented. Three quoted Orwell's 1984:

"There was of course no way of knowing whether you were being watched at any given moment."

https://thomaster.substack.com/p/gchq-mass-surveillance-declared-unlawful

#GCHQ #Surveillance #ECHR #Privacy #BigBrotherWatch #Liberty #Orwell #InvestigatoryPowersAct #Snowden #HumanRights

OpenShot is a free and open-source video editor available for Windows, macOS, and Linux.

It features unlimited tracks, timeline editing, keyframe animations, transitions, titles, audio editing, chroma key, speed controls, hardware encoding, and support for hundreds of formats through FFmpeg.

A privacy-friendly alternative to subscription-based video editors.

More details: https://digitalescapetools.com/tools/tool.html?id=openshot

#OpenSource #OpenShot #VideoEditing #Linux #Windows #macOS #FOSS #Privacy

Alt...

Screenshot of the OpenShot Video Editor project page. The page describes OpenShot as a free and open-source video editor for Linux, macOS, and Windows focused on high-quality video editing and animation. Below, a "Build Status" section shows GitHub CI badges for openshot-qt, libopenshot, and libopenshot-audio, all marked as "passing," along with a Discord badge showing 131 users online.

Reminder: the EU’s final Chat Control negotiation is today.

If you’re in the EU, contacting your representative still counts in these final hours. It takes two minutes: https://fightchatcontrol.eu

Whatever happens today, this is exactly why we built Zerion with no server to scan.

https://zerion.chat

#chatcontrol #privacy #foss

UK launched largest facial recognition programme in British history: 27 police forces, £26m, LFR in knife crime hotspots. Algorithm has documented racial bias, scans everyone, 50 vans deployed. Mainstream coverage: almost none.

https://thomaster.substack.com/p/the-uks-largest-facial-recognition

#FacialRecognition #LFR #Surveillance #Police #KnifeCrime #Privacy #AI #UKPolitics

Meet ArcaneChat: a secure and #decentralized private messenger

Anonymous: No SIM card needed! No phone numbers required for registration, just set a name and start chatting!

Private: All your conversations are end-to-end encrypted

Discreet: No one can discover you or know that you are using the app! only people you share your invitation link or QR with can contact you

#digitalindependence #privacy #security #family #encryption #autonomy #european #openSource #europe #diday #decentralization

My take on the Mullvad mayhem from today:

https://markwrites.io/if-your-company-funnels-money-to-fascists-youre-a-fascist-company

–
But hate speech isn’t free speech. It demands violence against marginalized people. There is no “both sides” to it. It’s not okay to “fundamentally disagree” on it. If you are a company who earns income, and that income is funneled to a fascist political party, it is absolutely part of your mission. Even if it’s turning a blind eye to a teammate with whom you disagree.
–

It saddens me to have to walk away from @mullvadnet, but I have a zero tolerance policy for fascism.

I hope they learn from this and reconsider their position.

#Privacy #Mullvad #VPN #DanielBerntsson #OrebroParty #Antifascism #Capitalism #Sweden

When did you last check who has your data? The free Privacy Audit covers the basics in 10 minutes. https://indigoprivacy.com/audit #dataprivacy #privacy #indigoprivacy

Implanted cardiac devices transmit patient heart rhythm data wirelessly to manufacturer servers, and security researchers have found these transmissions are often unencrypted. #privacy #healthcare #indigoprivacy

We cover the privacy legislation your state just passed and explain what it actually means for you. #privacy #legislation #indigoprivacy