A federal judge has halted implementation of a California law intended to restrict companies’ use of information gathered from young internet users in order to protect the privacy of minors.

U.S. District Judge Beth Labson Freeman on Monday granted a preliminary injunction, saying the legislation interferes with firms’ use of the internet in ways the state has failed to justify.

The law would require businesses to report to the state on any product or service they offer on the internet that is likely to be accessed by those under 18, and provide plans to reduce any harms minors might suffer. It would also prohibit businesses from collecting most types of personal information about young internet users, including their physical locations.

“The State has no right to enforce obligations that would essentially press private companies into service as government censors,” Freeman wrote.

The judge wrote that while she is “keenly aware of the myriad harms that may befall children on the internet,” the law singles out for-profit businesses for restrictions that do not apply to other users, such as government agencies or nonprofits.

The law by Assembly Member Buffy Wicks, a Democrat from Oakland, passed both state legislative houses unanimously last year and was due to take effect in July 2024.

It was challenged by NetChoice, a commercial association whose members include Google, Amazon, Meta and TikTok. In a statement to the San Francisco Chronicle, NetChoice attorney Chris Marchese praised the judge’s decision “to prevent regulators from violating the free speech and online privacy rights of Californians, their families and their businesses as our case proceeds.”

Attorney General Rob Bonta’s office said it was disappointed by the ruling and declined to comment further. The state could appeal the injunction to the Ninth U.S. Circuit Court of Appeals in San Francisco, the Chronicle said.

Related: Apple, Civil Liberty Groups Condemn UK Online Safety Bill

Related: Ransomware Criminals Are Dumping Kids’ Private Files Online After School Hacks

Related: Microsoft Will Pay $20M to Settle US Charges of Illegally Collecting Children’s Data

https://www.securityweek.com/california-law-restricting-companies-use-of-information-from-kids-online-is-halted-by-federal-judge/

European regulators slapped TikTok with a $368 million fine on Friday for failing to protect children’s privacy, the first time that the popular short video-sharing app has been punished for breaching Europe’s strict data privacy rules.

Ireland’s Data Protection Commission, the lead privacy regulator for Big Tech companies whose European headquarters are largely in Dublin, said it was fining TikTok 345 million euros and reprimanding the platform for the violations dating to the second half of 2020.

The investigation found that the sign-up process for teen users resulted in settings that made their accounts public by default, allowing anyone to view and comment on their videos. Those default settings also posed a risk to children under 13 who gained access to the platform even though they’re not allowed.

Also, a “family pairing” feature designed for parents to manage settings wasn’t strict enough, allowing adults to turn on direct messaging for users aged 16 and 17 without their consent. And it nudged teen users into more “privacy intrusive” options when signing up and posting videos, the watchdog said.

TikTok said in a statement that it disagrees with the decision, “particularly the level of the fine imposed.”

The company pointed out that the regulator’s criticisms focused on features and settings dating back three years. TikTok said it had made changes well before the investigation began in September 2021, including making all accounts for teens under 16 private by default and disabling direct messaging for 13- to 15-year-olds.

“Most of the decision’s criticisms are no longer relevant as a result of measures we introduced at the start of 2021 — several months before the investigation began,” TikTok’s head of privacy for Europe, Elaine Fox, wrote in a blog post.

The Irish regulator has been criticized for not moving fast enough in its investigations into Big Tech companies since EU privacy laws took effect in 2018. For TikTok, German and Italian regulators disagreed with parts of a draft decision issued a year ago, delaying it further.

To avoid new bottlenecks, the Brussels headquarters of the 27-nation bloc has been given the job of enforcing new regulations to foster digital competition and clean up social media content — rules aimed at maintaining its position as a global leader in tech regulation.

In response to initial German objections, Europe’s top panel of data regulators said TikTok nudged teen users with pop-up notices that failed to lay out their choices in a neutral and objective way.

“Social media companies have a responsibility to avoid presenting choices to users, especially children, in an unfair manner — particularly if that presentation can nudge people into making decisions that violate their privacy interests,” said Anu Talus, chair of the European Data Protection Board.

The Irish watchdog, meanwhile, also had examined TikTok’s measures to verify whether users are at least 13 but found they didn’t break any rules.

The regulator is still carrying out a second investigation into whether TikTok complied with the EU’s General Data Protection Regulation when it transferred users’ personal information to China, where its owner, ByteDance, is based.

TikTok has faced accusations it poses a security risk over fears that users’ sensitive information could end up in China. It has embarked on a project to localize European user data to address those concerns: opening a data center in Dublin this month, which will be the first of three on the continent.

Data privacy regulators in Britain, which left the EU in January 2020, fined TikTok 12.7 million pounds ($15.7 million) in April for misusing children’s data and violating other protections for young users’ personal information.

Instagram, WhatsApp and their owner Meta are among other tech giants that have been hit with big fines by the Irish regulator over the past year.

Related: TikTok fined €750,000 for Violating Children’s Privacy

Related: Executive Fired From TikTok’s Chinese Owner Says Beijing Had Access to App Data in Termination Suit

Related: TikTok’s Trials and Tribulations Continue With UK Data Protection Fine

https://www.securityweek.com/tiktok-is-hit-with-368-million-fine-under-europes-strict-data-privacy-rules/

You may not know it, but thousands of often shadowy companies routinely traffic in personal data you probably never agreed to share — everything from your real-time location information to private financial details. Even if you could identify these data brokers, there isn’t much you can do about their activities, including in California, which has some of the strongest digital privacy laws in the U.S.

That’s on the verge of changing. Both houses of the California state Legislature have passed the Delete Act, which would establish a “one stop shop” where individuals could order hundreds of data brokers registered in the state to delete their personal data — and to cease acquiring and selling it in the future — with a single request.

The Delete Act isn’t law yet. Democratic Gov. Gavin Newsom still has to decide whether to sign the measure, whose impact could potentially extend well beyond state lines given California’s history of setting similar trends.

Here’s what you need to know.

What the Bill Does

While California law already gives individuals the right to request data deletion, doing so currently require making separate requests to hundreds of data brokers registered in the state, many with their own unique requirements for drafting and handling such requests. Even then, nothing stops these companies from simply reacquiring the data after they delete it.

The Delete Act would require the state’s new privacy office, the California Privacy Protection Agency, to set up a website where consumers can verify their identity and then make a single request to delete their personal data held by data brokers and to opt out of future tracking. Proponents call it a “do not track” signal similar to the “do not call” list for telemarketers maintained by the Federal Trade Commission.

California already regulates data brokers, but the Delete Act would strengthen those provisions by requiring the companies to disclose more information about the data they collect on consumers and beefing up the state’s enforcement mechanisms.

Meet the Data Brokers

The Electronic Privacy Information Center, a Washington, D.C., nonprofit focused on bolstering the right to privacy, defines data brokers as companies that collect and categorize personal information, usually to build profiles on millions of Americans that the companies can then rent, sell or use to provide services.

The data they collect, per EPIC, can include: “names, addresses, telephone numbers, email addresses, gender, age, marital status, children, education, profession, income, political preferences, and cars and real estate owned.”

That is in addition to “information on an individual’s purchases, where they shop, and how they pay for their purchases,” plus “health information, the sites we visit online, and the advertisements we click on. And thanks to the proliferation of smartphones and wearables, data brokers collect and sell real-time location data.”

Privacy advocates have warned for years that location and seemingly non-specific personal data — often collected by advertisers and amassed and sold by brokers — can be used to identify individuals. They also charge that the data often isn’t well secured and that the brokers aren’t covered by laws that require the clear consent of the person being tracked. They have argued for both legal and technical protections so consumers can push back.

Are Data Brokers That Bad?

Data brokers say they get a bad rap for serving a vital need.

Dan Smith, president of the Consumer Data Industry Association, which describes itself as “the voice of the consumer reporting industry,” called the Delete Act “severely flawed” and warned in a Wednesday release that the change could lead to unintended consequences by undermining consumer fraud protections, hurting the competitiveness of small businesses and entrenching big platforms such as Facebook and Google that collect vast amounts of consumer data but don’t sell it.

Smith also argued that the heart of the bill — the one-stop data deletion program — could potentially allow malicious outsiders to impersonate consumers and delete their data without permission. The organization also argues that the cost of the legislation will be much greater than California regulators currently suggest.

What Abuse of Data Broker Information Looks Like

In other respects, though, the information collected by these companies can be startlingly easy to abuse. The general lack of U.S. restrictions on what brokers can do with the vast amount of data they collect means there’s aren’t many legal protections to prevent outsiders from spying on politicians, celebrities and just about anyone who is a target of idle curiosity, or malice.

In mid-2021, for instance, the U.S. Conference of Catholic Bishops announced the resignation of its top administrative official, Monsignor Jeffrey Burrill, ahead of a report by the Catholic news outlet The Pillar probing his private romantic life. The Pillar said it obtained “commercially available” location data from an unnamed vendor that was “correlated” to Burrill’s phone to determine he had visited gay bars and private residences while using Grindr, a dating app popular with gay people.

The Pillar alleged “serial sexual misconduct” by Burrill, as homosexual activity is considered sinful under Catholic doctrine and priests are expected to remain celibate. Following an extended leave, Burrill resumed his ministry in the small town of West Salem, Wisconsin, according to the Catholic News Service.

https://www.securityweek.com/imagine-making-shadowy-data-brokers-erase-your-personal-info-californians-may-soon-live-the-dream/

Search giant Google agreed to a $93 million settlement with the state of California on Thursday over its location-privacy practices.

The settlement follows a $391.5 million settlement with 40 states, reached in November 2022, to resolve an investigation into how the company tracked users’ locations.

The states’ investigation was sparked by a 2018 Associated Press story, which found that Google continued to track people’s location data even after they opted out of such tracking by disabling a feature the company called “location history.”

“Our investigation revealed that Google was telling its users one thing — that it would no longer track their location once they opted out — but doing the opposite and continuing to track its users’ movements for its own commercial gain. That’s unacceptable, and we’re holding Google accountable with today’s settlement,” Attorney General Rob Bonta said in a statement.

As part of the settlement, in which Google admitted no wrongdoing, the company also agreed to a number of restrictions, including providing more transparency about location tracking, disclosing to users that their location information may be used for ad personalization, and showing additional information to users when enabling location-related account settings.

“Consistent with improvements we’ve made in recent years, we have settled this matter, which was based on outdated product policies that we changed years ago,” Google said in a statement.

Related: South Korea Fines Google, Meta Over Privacy Violations

Related: Spotify Fined $5 Million for Breaching EU Data Rules

Related: Norway Threatens $100,000 Daily Fine on Meta Over Data

https://www.securityweek.com/california-settles-with-google-over-location-privacy-practices-for-93-million/

Aiutare le aziende ad usare al meglio l’Intelligenza Artificiale, in modo semplice e corretto tramite i dati sintetici. Questa in sintesi la mission di Clearbox AI, una startup torinese specializzata in AI, la cui Ceo Shalini Kurapati è stata premiata dalla Commissione Ue come una delle principali ‘Lady Tech’ europee. Kurapati prenderà parte all’evento ‘State of Privacy ‘23’ organizzato dal Garante Privacy il 18 settembre a Roma, per parlare dell’impatto dell’AI sulla società.

Key4biz. Clearbox AI, start up di intelligenza artificiale, per fare cosa?

Shalini Kurapati. Clearbox AI è una startup tech italiana che aiuta le aziende a lanciare progetti di Intelligenza Artificiale attraverso l’utilizzo di Dati Sintetici. Nasciamo nel 2019 col supporto dell’Incubatore del Politecnico di Torino, abbiamo fondato la società con 4 co-fondatori, me compresa, che si sono uniti dopo una lunga esperienza di ricerca e professionale in molti paesi europei. La nostra missione: comprendere gli ostacoli che le aziende incontrano nello sviluppo di Intelligenza Artificiale.

<!-- ENERGIA ITALIA - 300x250 -->

Key4biz. Quali sono i principali ostacoli per le aziende?

Shalini Kurapati. Abbiamo scoperto che molto spesso queste sfide sono legate ai dati, quando questi sono sensibili e difficili da gestire a livello di privacy, la loro quantità non è sufficiente, o non sono abbastanza rappresentativi per tutte le fasce di popolazione per garantire risultati di successo.

Key4biz. E’ qui che entrano in gioco i Dati Sintetici?

Shalini Kurapati. Sì. I Dati Sintetici possono risolvere questi problemi. Sono generati artificialmente da algoritmi AI sulla base dei dati originali, dei quali mantengono le proprietà statistiche e il potere predittivo, risultando quindi realistici. Essendo simili ma non uguali ai dati reali, non contengono informazioni personali e possono essere condivisi rispettando i regolamenti di privacy, come il GDPR. Offriamo un prodotto/software basato sulla nostra tecnologia proprietaria che genera dati sintetici di alta qualità per le aziende che vogliono iniziare e accelerare il loro percorso di Intelligenza artificiale. Il nostro team ha una duplice anima: forti radici nel mondo R&D con lauree dalle migliori università tecnologiche in Europa, che vanno mano nella mano con un approccio ingegneristico e pratico nel risolvere i problemi dei clienti. Le strade professionali e personali dei componenti del gruppo hanno attraversato l’Europa per convergere a Torino, dove è nata la missione Clearbox AI: creare valore per le imprese attraverso le tecnologie IA, rispettandone i principi etici.

Key4biz. Ci può fare qualche esempio concreto di come i Dati Sintetici possono aiutare le aziende?

Shalini Kurapati. Oggi avere un modello di Intelligenza Artificiale è molto facile. Basta un download. Ma la sfida vera è avere dati giusti dal punto di vista dell’accesso privacy e della qualità. I dati sintetici sono una delle soluzioni a questo problema. Sono generati artificialmente tramite algoritmi. Noi produciamo dati sintetici per due motivi principali: la tutela della privacy e poi in molti casi i data set non sono rappresentativi per diversi motivi, il che può creare pregiudizi (bias) dell’algoritmo. Questo perché l’algoritmo pensa erroneamente che questo set di dati rappresenti la realtà, ma non è così. I dati sintetici possono aumentare questo data set sbilanciato in modo tale da far rappresentare la realtà.  

Key4biz. Ad esempio?

Shalini Kurapati. Ad esempio, sviluppiamo un algoritmo per riconoscere un tumore sulla pelle. L’algoritmo deve capire cosa vuol dire un algoritmo sulla pelle. Noi forniamo diversi esempi di tumori. Ma se forniamo soltanto esempi con carnagione bianca questo algoritmo non funziona per altre carnagioni di pelle. Quindi funziona soltanto per questo tipo di pelle. Un dato non rappresentativo può danneggiare altre persone se usiamo questo algoritmo senza testare tutti i tipi di persone.     

Key4biz. E ancora?

Shalini Kurapati. Storicamente le donne non erano tantissime nel mondo del lavoro. Quindi, se alleniamo un algoritmo soltanto con dati storici, se anche mettiamo in produzione con dati attuali, l’algoritmo pensa che i dati storici sono la realtà. Magari prende delle decisioni sulla base del fatto che 30 anni fa la percentuale di donne al lavoro erano meno e quindi prende decisioni in base a dati ormai superati. Qui vengono in soccorso i dati sintetici, che prendono sempre in considerazione la realtà.

Key4biz. Un altro esempio dal campo medico?

Shalini Kurapati. Per tanto tempo i dati della ricerca sono sempre stati presi su degli uomini. Per tante malattie i sintomi delle donne non sono presenti e sono troppo pochi. Per esempio, per un infarto i sintomi di un uomo sono male al cuore e al braccio. Per una donna, invece, può essere mal di schiena. Però, se alleniamo un modello è successo anche questo, che un’azienda che ha sviluppato un algoritmo di intelligenza artificiale per riconoscere una malattia dai sintomi, per un uomo ha detto di andare subito al pronto soccorso. Ma per una donna ha detto che era un attacco di panico, calmati! Invece era un infarto. Quando parliamo di responsabilità, un algoritmo soprattutto per una applicazione per prendere decisioni su un curriculum o prendere decisioni su un mutuo, o decisioni sulla salute, quindi un impatto grande, dobbiamo avere una metodologia per capire quali dati stiamo usando. Come possiamo migliorare questo. Lo stesso discorso vale anche per il riconoscimento di frodi per banche e assicurazioni. Qui il problema è che gli esempi di frodi non sono molto numerosi ed è quindi difficile per l’algoritmo riconoscerle. Grazie ai dati sintetici possiamo fornire all’algoritmo più esempi per riconoscere le frodi.

Key4biz. Quali sono le aree di competenza del team?

Shalini Kurapati. Le aree di competenza del team spaziano tra machine learning, data science, data privacy, uncertainty quantification, project management, innovazione e sviluppo software, e sono state fondamentali per creare una visione condivisa.

Key4biz. La Commissione Europea l’ha premiata come una delle 50 più geniali e innovative ‘Lady Tech’. Per questo motivo è entrata nel progetto pilota, voluto da Bruxelles, per supportare start up ad elevato contenuto tecnologico guidate da donne. Come considera l’approccio di Bruxelles sull’IA? (vedi AI ACT)

Shalini Kurapati. Sì, siamo molto contenti di essere stati selezionati tra i vincitori del progetto Women TechEU, finanziato dalla Commissione Europea. L’iniziativa ha come obiettivo il supporto alle startup deep-tech guidate da donne per valorizzare il talento e favorire un’innovazione più inclusiva nell’ecosistema tech europeo. In questo senso, i dati sintetici che produciamo giocano un ruolo fondamentale per gli obiettivi del bando, per i motivi di mitigazione bias che abbiamo raccontato. Anche la nostra missione aziendale è in linea con questi fini perché si colloca all’intersezione tra tecnologia ed etica dell’Intelligenza Artificiale. In particolare, utilizzeremo i finanziamenti della Commissione Europea per creare un modulo basato sui dati sintetici che punta a diminuire la presenza di bias nei progetti di Intelligenza Artificiale. Credo che a livello europeo si stiano facendo molti passi avanti nella promozione della conoscenza e creazione di framework legati all’AI. Uno su tutti è l’AI Act, apripista nell’istituzione di regole esaustive e realmente applicabili per garantire la sicurezza dell’IA e l’innovazione responsabile, attraverso un approccio basato sul rischio delle applicazioni IA. Nonostante alcuni limiti (se ne è parlato per anni e ci sono sempre discussioni in corso) e sebbene potrebbe richiedere da 2 a 3 anni per entrare in vigore, ci sono comunque molte ragioni per sostenerlo fortemente. Ha creato un punto di riferimento e un quadro per la cooperazione nella regolamentazione globale dell’IA. Ha attivato opportunità per adottare codici di condotta e patti sull’IA per iniziare a mettere in pratica i principi della regolamentazione mentre aspettiamo che entrino in vigore e per cominciare ad adattarsi all’evoluzione della tecnologia IA. A complicare il tentativo dell’Ue, però, è anche la portata di una norma che, per essere efficace, deve essere riconosciuta a livello globale. Altrimenti rischia di essere agevolmente aggirata. Infatti le principali società che sviluppano l’AI nel mondo sono oggi Microsoft/Open AI, Google, Meta, Tesla, solo per citarne alcune: un panorama che coinvolge gli Stati Uniti, ma che inizia a coinvolgere anche la Cina. E gli Stati Uniti, per il momento, non hanno alcuna intenzione di frenare la ricerca e lo sviluppo: per quanto l’amministrazione Biden sia consapevole dei rischi, dopo tanti discorsi tutto ciò che è stato fatto ad oggi – di fatto – sono una serie di misure non legislative che suggeriscono ai colossi dell’AI come dovrebbero comportarsi per auto-regolare la propria tecnologia. Dobbiamo tutti essere molto interessati e proattivi nell’implementare i requisiti dell’AI Act, non solo per essere conformi, ma per garantirci un futuro responsabile!

Key4biz. Come governare i rischi dell’AI e come l’Italia, secondo lei, dovrebbe sostenere di più lo sviluppo dell’AI in Italia?

Shalini Kurapati. Spesso si parla dell’Italia come terra di cultura e di buon cibo, il che è assolutamente vero, ma dovremmo considerare che l’Italia ha già una lunga storia e saper-fare nell’industrializzazione e soprattutto nell’automazione industriale. In termini di robot density (un’importante indicatore dell’automazione industriale), l’Italia è davanti a Francia e Canada. Tuttavia, anche se non si può dire lo stesso dell’adozione delle applicazioni di IA e dell’innovazione guidata dai dati, l’Italia ha un grande potenziale. Abbiamo bisogno di una bella spinta nella giusta direzione in termini di creazione di maggiore consapevolezza e di cambiamento di mentalità. Ad oggi siamo molto felici di riscontrare sempre più interesse da parte delle aziende italiane nell’approfondire come si può implementare l’AI in maniera efficiente all’interno dei processi e, da parte nostra, cerchiamo da sempre di diffondere messaggi precisi per aiutarle a beneficiarne. Ad esempio, che l’AI non è appannaggio solo delle grandi aziende. Allo stesso tempo, però, bisogna avere una conoscenza precisa degli obiettivi per i quali si vuole usare l’AI, affidarsi a delle professionalità specifiche e ridimensionare le aspettative dell’AI come “panacea di tutti i mali”.

“State of Privacy ’23”, il 18 settembre l’evento del Garante. Scopri il programma

https://www.key4biz.it/ai-kurapati-ceo-di-clearbox-ai-dati-sintetici-per-aiutare-le-aziende/459453/

Una multa di 45mila euro è stata comminata dal Garante Privacy al Comune di Modica per aver installato alcune telecamere per il controllo della raccolta differenziata dei rifiuti in violazione della disciplina che tutela i dati personali.

Il Comune, per contrastare il fenomeno diffuso dell’abbandono dei rifiuti, aveva incaricato due ditte, dell’acquisto, installazione e manutenzione di telecamere fisse, e della raccolta e analisi dei filmati relativi alle violazioni. Ma anche le società dunque operavano in modo illecito, ragion per cui entrambe sono state sanzionate anch’esse dal Garante, l’una per 10.000 euro, per non essere mai stata nominata responsabile del trattamento, e l’altra per 5.000 euro, per essere stata nominata responsabile in ritardo.

La denuncia di un cittadino e la violazione delle norme privacy

L’intervento dell’Autorità segue le segnalazioni di un cittadino che lamentava la ricezione di alcune multe per aver conferito i rifiuti indifferenziati in modo errato. Gli accertamenti della violazione sarebbero avvenuti più di un mese dopo la registrazione dei filmati, effettuata senza che i cittadini fossero stati adeguatamente informati della presenza delle telecamere e del trattamento dei dati. Il Comune infatti aveva apposto un cartello direttamente sul cassonetto, non facilmente visibile e per di più privo delle informazioni necessarie.

<!-- ENERGIA ITALIA - 300x250 -->

Il Municipio inoltre non aveva individuato i tempi di conservazione dei dati e non aveva nominato, prima dell’inizio del trattamento, le due aziende sopracitate quali responsabili del trattamento dati, come previsto dalla normativa privacy.

Il trattamento di dati personali mediante sistemi di videosorveglianza da parte di soggetti pubblici è generalmente ammesso se è necessario per adempiere un obbligo legale e la gestione dei rifiuti rientra tra le attività istituzionali affidate agli enti locali. Anche in presenza di una condizione di liceità il titolare del trattamento, ha ribadito il Garante, è in ogni caso tenuto a rispettare i principi in materia di protezione dei dati, fra i quali quelli di liceità, correttezza e trasparenza. In particolare, è necessario adottare misure appropriate per fornire all’interessato tutte le informazioni previste dal GDPR in forma concisa, trasparente, intelligibile e facilmente accessibile.

Ai fini dell’applicazione delle sanzioni il Garante ha tenuto conto del fatto che il trattamento ha riguardato potenzialmente i dati dei residenti del Comune (circa 53.000 interessati) e dei soggetti non residenti (il cui numero non è quantificabile).

Di contro, l’Autorità ha considerato il comportamento non doloso del Municipio e delle aziende, nonché l’assenza di precedenti violazioni a loro carico.

Per approfondire clicca qui.

https://www.key4biz.it/rifiuti-e-videosorveglianza-multa-di-45mila-euro-al-comune-di-modica-per-violazione-della-privacy/458936/

Mozilla has analyzed 25 major car brands and gave all of them failing marks for privacy and security. They collect significant amounts of personal data and they can share it with others, often without the customer’s explicit permission.

As part of its ‘Privacy Not Included’ project, Mozilla has analyzed privacy policies and apps provided by car manufacturers. Targeted brands include BMW, Renault, Subaru, Fiat, Jeep, Chrysler, Volkswagen, Toyota, Lexus, Ford, Audi, Mercedes-Benz, Honda, Lincoln, Acura, Kia, GMC, Chevrolet, Hyundai, Nissan, and Tesla.

The research showed that privacy policy documents provided by these companies inform customers about a wide range of data being collected, including health and genetic information, race, immigration status, weight, facial expressions, location, driving speed, multimedia content, and even sexual activity.

The data is collected through mobile apps, dealerships, company websites, vehicle telematics, sensors, cameras, microphones, and phones connected to the vehicle.

Mozilla has ranked companies based on data use, data control, track record, and security. The best are Renault and its subsidiary Dacia, which are European companies required to comply with the EU’s General Data Protection Regulation (GDPR).

At the other end of the chart are Nissan and Tesla. The former stands out for harvesting ‘creepy’ data about the user’s sexual activity, while the latter is the worst because — in addition to failing every privacy and security check — it uses what Mozilla describes as ‘untrustworthy AI’. 

Major car manufacturers often disclose data breaches impacting their customers’ personal data. In addition, privacy policies for more than half of the brands reveal that they can share collected information with law enforcement and other government agencies. Furthermore, 84% say they can share personal data with service providers, data brokers and others, while 76% state that they can sell the harvested personal data.  

In the case of many products with a cyber component, the consumer needs to specifically accept a privacy policy before using that product. In the case of cars, however, consent is often presumed simply by being a passenger. 

“For example, Subaru states that by being a passenger, you are considered a user — and by being a user, you have consented to their privacy policy. Several car brands also note that it is a driver’s responsibility to tell passengers about the vehicle’s privacy policies,” Mozilla said.

The organization also noted, “While consumers can choose to not use a car app or try not to use connected services, that might mean their car doesn’t work properly — or at all. Consumers have almost zero control and options in regard to privacy, other than simply buying an older model. Regulators and policy makers are behind on this front.”

Mozilla researchers attempted to reach out to each of the analyzed brands for clarifications on their privacy policies, but only Mercedes responded with a vague statement. 

Mozilla concluded that of all the types of products covered by its Privacy Not Included project, cars are the worst. 

“We’re worried about the amount and the sensitivity of the information car companies collect about you. Based on their track records alone, we don’t trust them to keep it safe. And we don’t think a lot of the ways that your information is being shared or sold benefits drivers or anyone besides the businesses who exist to make money off of your data,” Mozilla said.

“We’re also worried that this is just the beginning. We’re worried that new sensor technology could help car companies create, collect, combine, and sell even more information about you,” it added.

Related: Tesla Discloses Data Breach Related to Whistleblower Leak

Related: Toyota Discloses New Data Breach Involving Vehicle, Customer Information

Related: Ferrari Says Ransomware Attack Exposed Customer Data

https://www.securityweek.com/25-major-car-brands-get-failing-marks-from-mozilla-for-security-and-privacy/

On Tuesday, Google announced the launch of its Duet AI assistant across its Workspace apps, including Docs, Gmail, Drive, Slides, and more. First announced in May at Google I/O, Duet has been in testing for some time, but it is now available to paid Google Workspace business users (what Google calls its suite of cloud productivity apps) for $30 a month in addition to regular Workspace fees.

Duet is not just one thing—instead, it’s a blanket brand name for a multitude of different AI capabilities and probably should have been called “Google Kitchen Sink.” It likely represents several distinct AI systems behind the scenes. For example, in Gmail, Duet can summarize a conversation thread across emails, use the content of an email to write a brief or draft an email based on a topic. In Docs, it can write content such as a customer proposal or a story. In Slides, it can generate custom visuals using an image synthesis model. In Sheets, it can help format existing spreadsheets or create a custom spreadsheet structure suited to a particular task, such as a project tracker.

Some of Duet’s applications feel like confusion in branding. In Google Meet, Google says that Duet AI can “ensure you look and sound your best with studio look, studio lighting, and studio sound,” including “dynamic tiles” and “face detection”—functions that feel far removed from typical generative AI capabilities—as well as automatically translated captions. It can also reportedly capture notes and video, sending a summary to attendees in the meeting. In fact, using Duet’s “attend for me” feature, Google says that “Duet AI will be able to join the meeting on your behalf” and send you a recap later.

In Google Chat, Duet reads everything that’s going on in your conversations so that you can “ask questions about your content, get a summary of documents shared in a space, and catch up on missed conversations.”

Those are the marketing promises. So far, as spotted on social media, Duet in practice seems fairly mundane, like a mix of what we’ve seen with Google Bard and more complex versions of Google’s existing autocomplete features. An author named Charlie Guo ran through Duet features in a helpful X thread, noting the AI model’s awkward email compositions. “The writing is almost painfully formal,” he says.

In Slides, a Google-sponsored teacher named Alice Keeler asked Google Duet to make a robot teacher in front of a chalkboard and posted it on X. The results are awkward and arguably unusable, full of telltale glitches found in image synthesis artwork from 2022. Sure, it’s neat as a tech demo, but this is what a trillion-dollar company says is a production-ready tool today.

Of course, these capabilities can (and will) change over time as Google refines its offerings. Eventually, Duet may be absorbed into daily usage as if it weren’t even there, much like Google’s myriad other machine-learning features in its products.

https://arstechnica.com/?p=1964020

Starting Friday, Europeans will see their online life change.

People in the 27-nation European Union can alter some of what shows up when they search, scroll and share on the biggest social media platforms like TikTok, Instagram and Facebook and other tech giants like Google and Amazon.

That’s because Big Tech companies, most headquartered in the U.S., are now subject to a pioneering new set of EU digital regulations. The Digital Services Act aims to protect European users when it comes to privacy, transparency and removal of harmful or illegal content.

Here are five things that will change when you sign on:

You can Turn off AI-Recommended Videos

Automated recommendation systems decide, based on people’s profiles, what they see in their feeds. Those can be switched off.

Meta, owner of Facebook and Instagram, said users can opt out of its artificial intelligence ranking and recommendation systems that determine which Instagram Reels, Facebook Stories and search results to show. Instead, people can choose to view content only from people they follow, starting with the newest posts.

Search results will be based only on the words they type, not personalized based on a user’s previous activity and interests, Meta President of Global Affairs Nick Clegg said in a blog post.

On TikTok, instead of being shown videos based on what users previously viewed, the “For You” feed will serve up popular videos from their area and around the world.

Turning off recommender systems also means the video-sharing platform’s “Following” and “Friends” feeds will show posts from accounts users follow in chronological order.

Those on Snapchat “can opt out of a personalized content experience.”

Meta, owner of Facebook and Instagram, said users can opt out of its artificial intelligence ranking and recommendation systems that determine which Instagram Reels, Facebook Stories and search results to show. Instead, people can choose to view content only from people they follow, starting with the newest posts.

Search results will be based only on the words they type, not personalized based on a user’s previous activity and interests, Meta President of Global Affairs Nick Clegg said in a blog post.

On TikTok, instead of being shown videos based on what users previously viewed, the “For You” feed will serve up popular videos from their area and around the world.

Turning off recommender systems also means the video-sharing platform’s “Following” and “Friends” feeds will show posts from accounts users follow in chronological order.

Those on Snapchat “can opt out of a personalised content experience.”

The app by Chinese parent company ByteDance has added a new team of moderators and legal specialists to review videos flagged by users, alongside automated systems and existing moderation teams that already work to identify such material.

Facebook and Instagram’s existing tools for reporting content are “easier for people to access,” said Meta’s Clegg, without providing more details.

You’ll Know Why Your Post Was Taken Down

The EU wants platforms to be more transparent about how they operate.

So, TikTok says European users will get more information “about a broader range of content moderation decisions.”

“For example, if we decide a video is ineligible for recommendation because it contains unverified claims about an election that is still unfolding, we will let users know,” TikTok said. “We will also share more detail about these decisions, including whether the action was taken by automated technology, and we will explain how both content creators and those who file a report can appeal a decision.”

Google said it’s “expanding the scope” of its transparency reports by giving more information about how it handles content moderation for more of its services, including Search, Maps, Shopping and Play Store, without providing more details.

You Can Report Fake Products

The DSA is not just about policing content. It’s also aimed at stopping the flow of counterfeit Gucci handbags, pirated Nike sneakers and other dodgy goods.

Amazon says it has set up a new channel for reporting suspected illegal products and content and also is providing more publicly available information about third-party merchants.

The online retail giant said it invests “significantly in protecting our store from bad actors, illegal content and in creating a trustworthy shopping experience. We have built on this strong foundation for DSA compliance.”

Online fashion marketplace Zalando is setting up flagging systems, though it downplays the threat posed by its highly curated collection of designer clothes, bags and shoes.

“Customers only see content produced or screened by Zalando,” the German company said. “As a result, we have close to zero risk of illegal content and are therefore in a better position than many other companies when it comes to implementing the DSA changes.”

Your Kids Won’t be Targeted With Digital Ads

Brussels wants to crack down on digital ads aimed at children over concerns about privacy and manipulation. Some platforms already started tightening up ahead of Friday’s deadline, even beyond Europe.

TikTok said in July that it was restricting the types of data used to show ads to teens. Users who are 13 to 17 in the EU, plus Britain, Switzerland, Iceland, Norway and Liechtenstein no longer see ads “based on their activities on or off TikTok.”

It’s doing the same in the U.S. for 13- to 15-year-olds.

Snapchat is restricting personalized and targeted advertising to users under 18.

Meta in February stopped showing Facebook and Instagram users who are 13 to 17 ads based on their activity, such as following certain Instagram posts or Facebook pages. Now, age and location are the only data points advertisers can use to show ads to teens.

https://www.securityweek.com/europe-is-cracking-down-on-big-tech-this-is-what-will-change-when-you-sign-on/

Indian lawmakers Wednesday approved a data protection legislation that “seeks to better regulate big tech firms and penalize companies for data breaches” as several groups expressed concern over citizens’ privacy rights.

The legislation will limit cross-border transfer of data and provide a framework for setting up a data protection authority to ensure compliance from tech companies, Information Technology and Telecom Minister Ashwini Vaishnaw said.

Several opposition lawmakers and digital experts say the legislation would allow the government and its agencies to access user data from companies and personal data of individuals without their consent as well as collect private data in a country where digital freedoms have been shrinking since Prime Minister Narendra Modi took office in 2014.

Digital experts also fear that the legislation will weaken the landmark Right To Information law — passed in 2005 — that allows citizens to seek data from public officers, such as salaries of state employees.

“It jeopardizes privacy, grants excessive exemptions to the government, and fails to establish an independent regulator,” digital rights group Access Now said in a statement, adding it will enhance the government’s control over personal data and increase censorship.

The upper house of Parliament passed the Digital Personal Data Protection bill which would later be signed by the country’s ceremonial president, a formality, before becoming law. It was passed by the lower house of the Parliament on Monday.

The legislation is the government’s third attempt to pass such legislation and comes nearly six years after India’s top court ruled that privacy is a fundamental right of every citizen — a landmark judgment that was widely hailed as a win for individual freedom.

Earlier drafts of the legislation had raised similar concerns.

Proponents of the legislation have long been saying a data protection law is necessary for a country like India where financial fraud and data leaks are rampant, adding that it could act as a crucial step to protect people’s information from commercial and political exploits.

In 2021, India introduced sweeping regulatory laws that have put social media companies and digital platforms under direct government oversight. Modi’s government said it was needed to quell misinformation and hate speech and to give users more power to flag objectionable content. Critics of the law, however, said the law would lead to online censorship in India, particularly on social media platforms like X, previously known as Twitter.

Related: India Claims It Foiled Chinese Cyberattack on Disputed Border

Related: Indian Cyberspies Expose Their Operation After Infecting Themselves With RAT

Related: India-Linked Threat Actor Involved in Spying, Planting Evidence

https://www.securityweek.com/india-passes-data-protection-legislation-in-parliament-critics-fear-privacy-violation/