The Linkielist

Linking ideas with the world

The Linkielist

Even Volkswagen Is Doing Horsepower Subscriptions Now

[…]

we’re used to hearing about subscriptions for improved performance and creature comforts on luxury cars, but VW’s trialing BMW and Mercedes-Benz’s greatest hits of consumer-hostile policies and gating an additional 27 horsepower behind a $22.30 monthly payment on the ID.3. Alternatively, owners can shell out $878 to unlock that power permanently, for the life of the vehicle.

This news comes courtesy of AutoExpress, and it’s alarming for several reasons. First, again, the ID.3 isn’t exactly a bargain, starting at the equivalent of $41,770, but it’s also no Mercedes EQE. Second, as the article points out, the car is registered at 228 hp stock, which affects insurance rates, even though owners only get 201 hp before subscribing. So, you’re paying a penalty on your insurance premium based on power that you can only access if you give Volkswagen yet more money every month.

This monthly fee also lifts torque from the standard 195 lb-ft to 228 lb-ft, and VW says that the increase in output doesn’t impact range

[…]

The best outcome we can hope for in these cases is that the outcry against it becomes so loud that VW relents. That’s worked to some degree on this side of the pond, with BMW’s heated-seat policies. But the retractions don’t last forever, and automakers are pretty much set on biding their time until software-locking everything is normalized, and they can get away with all of it.

Source: Even Volkswagen Is Doing Horsepower Subscriptions Now

So… you paid for the hardware. It is sitting in the car you own, which is parked in front of your house. And they want to ask more for what you already bought? Absolutely ridiculous and I hope the car hacking scene finds a way to circumvent this.

EU Chat Control Plan Gains Support Again, Threatens Encryption, mass surveillance, age verification

A controversial European Union proposal dubbed “Chat Control” is regaining momentum, with 19 out of 27 EU member states reportedly backing the measure.

The plan would mandate that messaging platforms, including WhatsApp, Signal and Telegram, must scan every message, photo and video sent by users starting in October, even if end-to-end encryption is in place, popular French tech blogger Korben wrote on Monday.

Denmark reintroduced the proposal on July 1, the first day of its EU Council presidency. France, once opposed, is now in favor, Korben said, citing Patrick Breyer, a former member of the European Parliament for Germany and the European Pirate Party.

Belgium, Hungary, Sweden, Italy and Spain are also in favor, while Germany remains undecided. However, if Berlin joins the majority, a qualified council vote could push the plan through by mid-October, Korben said.

A qualified majority in the EU Council is achieved when two conditions are met. First, at least 55 percent of member states, meaning 15 out of 27, must vote in favor. Second, those countries must represent at least 65% of the EU’s total population.

EU Chat Control bill finds support. Source: Pavol Luptak

Pre-encryption scanning on devices

Instead of weakening encryption, the plan seeks to implement client-side scanning, meaning software embedded in users’ devices that inspects content before it is encrypted. “A bit like if the Post Office came to read all your letters in your living room before you put them in the envelope,” Korben said.

He added that the real target isn’t criminals, who use encrypted or decentralized channels, but ordinary users whose private conversations would now be open to algorithmic scrutiny.

The proposal cites the prevention of child sexual abuse material (CSAM) as its justification. However, it would result in “mass surveillance by means of fully automated real-time surveillance of messaging and chats and the end of privacy of digital correspondence,” Breyer wrote.

Beyond scanning, the package includes mandatory age verification, effectively removing anonymity from messaging platforms. Digital freedom groups are asking citizens to contact their MEPs, sign petitions and push back before the law becomes irreversible.

[…]

Source: EU Chat Control Plan Gains Support, Threatens Encryption

Age verification is going horribly wrong in the UK and mass surveillance threatens freedom of thought, something we fortunately still have in the EU. This must be stopped.

Meta eavesdropped on period-tracker app’s users, SF jury rules

Meta lost a major privacy trial on Friday, with a jury in San Francisco ruling that the Menlo Park giant had eavesdropped on the users of the popular period-tracking app Flo. The plaintiff’s lawyers who sued Meta are calling this a “landmark” victory — the tech company contends that the jury got it all wrong.

The case goes back to 2021, when eight women sued Flo and a group of other tech companies, including Google and Facebook, now known as Meta. The stakes were extremely personal. Flo asked users about their sex lives, mental health and diets, and guided them through menstruation and pregnancy. Then, the women alleged, Flo shared pieces of that data with other companies. The claims were largely based on a 2019 Wall Street Journal story and a 2021 Federal Trade Commission investigation.

Google, Flo and the analytics company Flurry, which was also part of the lawsuit, reached settlements with the plaintiffs, as is common in class action lawsuits about tech privacy. But Meta stuck it out through the entire trial and lost.

[…]

Their complaint also pointed to Facebook’s terms for its business tools, which said the company used so-called “event data” to personalize ads and content.

In a 2022 filing, the tech giant admitted that Flo used Facebook’s kit during this period and that the app sent data connected to “App Events.” But Meta denied receiving intimate information about users’ health.

Nonetheless, the jury ruled against Meta. Along with the eavesdropping decision, the group determined that Flo’s users had a reasonable expectation they weren’t being overheard or recorded, as well as ruling that Meta didn’t have consent to eavesdrop or record. The unanimous verdict was that the massive company violated the California Invasion of Privacy Act.

The jury’s ruling could have far-reaching effects. Per a June filing about the case’s class action status, more than 3.7 million people in the United States registered for Flo between November 2016 and February 2019. Those potential claimants are expected to be updated via email and on a case website; it’s not yet clear what the remittance from the trial or settlements might be.

[…]

Source: Meta eavesdropped on period-tracker app’s users, SF jury rules

Didn’t Take Long To Reveal The UK’s Online Safety Act Is Exactly The Privacy-Crushing Failure Everyone Warned About

[…]the real kicker is what content is now being gatekept behind invasive age verification systems. Users in the UK now need to submit a selfie or government ID to access:

Yes, you read that right. A law supposedly designed to protect children now requires victims of sexual assault to submit government IDs to access support communities. People struggling with addiction must undergo facial recognition scans to find help quitting drinking or smoking. The UK government has somehow concluded that access to basic health information and peer support networks poses such a grave threat to minors that it justifies creating a comprehensive surveillance infrastructure around it.

[…]

And this is all after a bunch of other smaller websites and forums shut down earlier this year when other parts of the law went into effect.

This is exactly what happens when you regulate the internet as if it’s all just Facebook and Google. The tech giants can absorb the compliance costs, but everyone else gets crushed.

The only websites with the financial capacity to work around the government’s new regulations are the ones causing the problems in the first place. And now Meta, which already has a monopoly on a number of near-essential online activities (from local sales to university group chats), is reaping the benefits.

[…]

The age verification process itself is a privacy nightmare wrapped in security theater. Users are being asked to upload selfies that get run through facial recognition algorithms, or hand over copies of their government-issued IDs to third-party companies. The facial recognition systems are so poorly implemented that people are easily fooling them with screenshots from video games—literally using images from the video game Death Stranding. This isn’t just embarrassing, it reveals the fundamental security flaw at the heart of the entire system. If these verification methods can’t distinguish between a real person and a video game character, what confidence should we have in their ability to protect the sensitive biometric data they’re collecting?

But here’s the thing: even when these systems “work,” they’re creating massive honeypots of personal data. As we’ve seen repeatedly, companies collecting biometric data and ID verification inevitably get breached, and suddenly intimate details about people’s online activity become public. Just ask the users of Tea, a women’s dating safety app that recently exposed thousands of users’ verification selfies after requiring facial recognition for “safety.”

The UK government’s response to widespread VPN usage has been predictably authoritarian. First, they insisted nothing would change:

“The Government has no plans to repeal the Online Safety Act, and is working closely with Ofcom to implement the Act as quickly and effectively as possible to enable UK users to benefit from its protections.”

But then, Tech Secretary Peter Kyle deployed the classic authoritarian playbook: dismissing all criticism as support for child predators. This isn’t just intellectually dishonest—it’s a deliberate attempt to shut down legitimate policy debate by smearing critics as complicit in child abuse. It’s particularly galling given that the law Kyle is defending will do absolutely nothing to stop actual predators, who will simply migrate to unregulated platforms or use the same VPNs that law-abiding citizens are now flocking to.

[…]

Meanwhile, the actual harms it purports to address? Those remain entirely unaddressed. Predators will simply move to unregulated platforms, encrypted messaging, or services that don’t comply. Or they’ll just use VPNs. The law creates the illusion of safety while actually making everyone less secure.

This is what happens when politicians decide to regulate technology they don’t understand, targeting problems they can’t define, with solutions that don’t work. The UK has managed to create a law so poorly designed that it simultaneously violates privacy, restricts freedom, harms small businesses, and completely fails at its stated goal of protecting children.

And all of this was predictable. Hell, it was predicted. Civil society groups, activists, legal experts, all warned of these results and were dismissed by the likes of Peter Kyle as supporting child predators.

[…]

A petition set up on the UK government’s website demanding a repeal of the entire OSA received many hundreds of thousands of signatures within days. The government has already brushed it off with more nonsense, promising that the enforcer of the law, Ofcom, “will take a sensible approach to enforcement with smaller services that present low risk to UK users, only taking action where it is proportionate and appropriate, and will focus on cases where the risk and impact of harm is highest.”

But that’s a bunch of vague nonsense that doesn’t take into account that no platform wants to be on the receiving end of such an investigation, and thus will take these overly aggressive steps to avoid scrutiny.

[…]

What makes this particularly tragic is that there were genuine alternatives. Real child safety measures—better funding for mental health support, improved education programs, stronger privacy protections that don’t require mass surveillance—were all on the table. Instead, the UK chose the path that maximizes government control while minimizing actual safety.

The rest of the world should take note.

Source: Didn’t Take Long To Reveal The UK’s Online Safety Act Is Exactly The Privacy-Crushing Failure Everyone Warned About

Belgium Targets Internet Archive’s ‘Open Library’ in Sweeping Site Blocking Order

The Business Court in Brussels, Belgium, has issued a broad site-blocking order that aims to restrict access to shadow libraries including Anna’s Archive, Libgen, OceanofPDF, Z-Library, and the Internet Archive’s Open Library. In addition to ISP blocks, the order also directs search engines, DNS resolvers, advertisers, domain name services, CDNs and hosting companies to take action. For now, Open Library doesn’t appear to be actively blocked.

booksTraditional site-blocking measures that require local ISPs to block subscriber access to popular pirate sites are in common use around the world.

Note: this article was updated to add that Open Library does not appear to be actively blocked. More details here.

[…]

A few months ago DNS blocking arrived in Belgium, where several orders required both ISPs and DNS resolvers to restrict access to pirate sites. This prompted significant pushback, most notably Cisco’s OpenDNS ceasing operations in the country.

Broad Blocking Order Targets Internet Archive’s ‘Open Library’

A new order, issued by the Brussels Business Court in mid-July, targets an even broader set of intermediaries and stands out for other reasons as well.

[…]

Open Library was created by the late Aaron Swartz and Internet Archive’s founder Brewster Kahle, among others. As an open library its goal is to archive all published books, allowing patrons to borrow copies of them online.

The library aims to operate similarly to other libraries, loaning only one copy per book at a time. Instead of licensing digital copies, however, it has an in-house scanning operation to create and archive its own copies.

 

Open Library
 

open library
 

The Open Library project was previously sued by publishers in the United States, where the Internet Archive ultimately losing the case. As a result, over 500,000 books were made unavailable.

[…]

According to the publishers, the operators of the Open Library are not easily identified, while legally required information is allegedly missing from the site, which they see as an indication that the site is meant to operate illegally.

This description seems at odds with the fact that Open Library is part of the Internet Archive, which is a U.S.-registered 501(c)(3) non-profit.

[…]

Internet Archive was not heard in this case, as the blocking order was issued ex parte, without its knowledge. This is remarkable, as the organization is a legal entity in the United States, which receives support from many American libraries.

The broad nature of the order doesn’t stop there either. In addition to requiring ISPs, including Elon Musk’s Starlink, to block the library’s domain names, it also directs a broad range of other intermediaries to take action.

This includes search engines, DNS resolvers, advertisers, domain name services, CDNs, and hosting companies. An abbreviated overview of the requested measures is as follows;

[…]

Update: After publication, a representative from Internet Archive informed us that they are not aware of any disruption to their services at this time.

The Open Library domain (openlibrary.org) doesn’t appear on the master blacklist of FOD Economie either, while several domains of the other four ‘target sites’ are included. We have reached out to the responsible authority in Belgium to get clarification on this discrepancy and will update the article if we hear back.

A copy of the order from the Business Court in Brussels (in Dutch) is available here (pdf)

Source: Belgium Targets Internet Archive’s ‘Open Library’ in Sweeping Site Blocking Order (Update) * TorrentFreak

So this decision is totally unenforceable by Belgium, but does show how corrupt and in the pocket of big businesses the system in Belgium actually is.

Public ChatGPT Queries Are Getting Indexed By Google and Other Search Engines (update: fixed!)

An anonymous reader quotes a report from TechCrunch: It’s a strange glimpse into the human mind: If you filter search results on Google, Bing, and other search engines to only include URLs from the domain “https://chatgpt.com/share,” you can find strangers’ conversations with ChatGPT. Sometimes, these shared conversation links are pretty dull — people ask for help renovating their bathroom, understanding astrophysics, and finding recipe ideas. In another case, one user asks ChatGPT to rewrite their resume for a particular job application (judging by this person’s LinkedIn, which was easy to find based on the details in the chat log, they did not get the job). Someone else is asking questions that sound like they came out of an incel forum. Another person asks the snarky, hostile AI assistant if they can microwave a metal fork (for the record: no), but they continue to ask the AI increasingly absurd and trollish questions, eventually leading it to create a guide called “How to Use a Microwave Without Summoning Satan: A Beginner’s Guide.”

ChatGPT does not make these conversations public by default. A conversation would be appended with a “/share” URL only if the user deliberately clicks the “share” button on their own chat and then clicks a second “create link” button. The service also declares that “your name, custom instructions, and any messages you add after sharing stay private.” After clicking through to create a link, users can toggle whether or not they want that link to be discoverable. However, users may not anticipate that other search engines will index their shared ChatGPT links, potentially betraying personal information (my apologies to the person whose LinkedIn I discovered).
According to ChatGPT, these chats were indexed as part of an experiment. “ChatGPT chats are not public unless you choose to share them,” an OpenAI spokesperson told TechCrunch. “We’ve been testing ways to make it easier to share helpful conversations, while keeping users in control, and we recently ended an experiment to have chats appear in search engine results if you explicitly opted in when sharing.”

A Google spokesperson also weighed in, telling TechCrunch that the company has no control over what gets indexed. “Neither Google nor any other search engine controls what pages are made public on the web. Publishers of these pages have full control over whether they are indexed by search engines.”

Source: Public ChatGPT Queries Are Getting Indexed By Google and Other Search Engines

UK’s most tattooed man blocked from accessing porn online by new rules

Britain’s most tattooed man has a lot more time on his hands and not a lot else thanks to new porn laws.

The King of Ink says facial recognition tech has made it harder to chat to webcam girls, after sites started mistaking his tattooed face for a mask.

The new rules came into force last week, introducing stricter checks under Ofcom’s children’s codes.

The King of Ink, as he’s legally known, said: ‘Some of the websites are asking for picture verification, like selfies, and it’s not recognising my face.

‘It’s saying “remove your mask” because the technology is made so you can’t hold up a picture to the camera or wear a mask.

‘Would this also be the case for someone who is disfigured? They should have thought of this from day one.’

The businessman and entrepreneur, from Stechford, Birmingham, feels discriminated against on the basis of his permanent identity.

Britain's most tattooed man can't watch porn under new rules because it doesn't recognise his face King Of Ink Land King Body Art The Extreme Ink-ite (Mathew Whelan)
The tattoo enthusiast says his heavily tattooed face is a permanent part of his identity (Picture: @kingofinklandkingbodyart)

‘It’s as important as the name really and I changed my name legally,’ he said

‘Without a name you haven’t got an identity, and it’s the same with a face.

[…]

Source: UK’s most tattooed man blocked from accessing porn online by new rules | News UK | Metro News

So many ways to circumvent it, so many ways it break and really, age verification’s only winners are the tech companies that people are forced to pay money to.

Google AI is watching — how to turn off Gemini on Android

[…]Why you shouldn’t trust Gemini with your data

Gemini promises to simplify how you interact with your Android — fetching emails, summarizing meetings, pulling up files. But behind that helpful facade is an unprecedented level of centralized data collection, powered by a company known for privacy washing, (new window)misleadin(new window)g users(new window) about how their data is used, and that was hit with $2.9 billion in fines in 2024 alone, mostly for privacy violations and antitrust breaches.

Other people may see your sensitive information

Even more concerning, human reviewers may process your conversations. While Google claims these chats are disconnected from your Google account before review, that doesn’t mean much when a simple prompt like “Show me the email I sent yesterday” might return personal data like your name and phone number.

Your data may be shared beyond Google

Gemini may also share your data with third-party services. When Gemini interacts with other services, your data gets passed along and processed under their privacy policies, not just Google’s. Right now, Gemini mostly connects with Google services, but integrations with apps like WhatsApp and Spotify are already showing up. Once your data leaves Google, you cannot control where it goes or how long it’s kept.

The July 2025 update keeps Gemini connected without your consent

Before July, turning off Gemini Apps Activity automatically disabled all connected apps, so you couldn’t use Gemini to interact with other services unless you allowed data collection for AI training and human review. But Google’s July 7 update changed this behavior and now keeps Gemini connected to certain services — such as Phone, Messages, WhatsApp, and Utilities — even if activity tracking is off.

While this might sound like a privacy-conscious change — letting you use Gemini without contributing to AI training — it still raises serious concerns. Google has effectively preserved full functionality and ongoing access to your data, even after you’ve opted out.

Can you fully disable Gemini on Android?

No, and that’s by design.

[…]

How to turn off Gemini AI on Android

  1. Open the Gemini app on your Android.
  2. Tap your profile icon in the top-right corner.
  3. Go to Gemini Apps Activity*.
  1. Tap Turn offTurn off and delete activity, and follow the prompts.
  1. Select your profile icon again and go to Apps**.
  1. Tap the toggle switch to prevent Gemini from interacting with Google apps and third-party services.

*Gemini Apps Activity is a setting that controls whether your interactions with Gemini are saved to your Google account and used to improve Google’s AI systems. When it’s on, your conversations may be reviewed by humans, stored for up to 3 years, and used for AI training. When it’s off, your data isn’t used for AI training, but it’s still stored for up to 72 hours so Google can process your requests and feedback.

**Apps are the Google apps and third-party services that Gemini can access to perform tasks on your behalf — like reading your Gmail, checking your Google Calendar schedule, retrieving documents from Google Drive, playing music via Spotify, or sending messages on your behalf via WhatsApp. When Gemini is connected to these apps, it can access your personal content to fulfill prompts, and that data may be processed by Google or shared with the third-party app according to their own privacy policies.

Source: Google AI is watching — how to turn off Gemini on Android | Proton

Visa and Mastercard Fielding A Ton Of Complaints Over “NSFW” Games Disappearing On Platforms, acting as censors

A week or so ago, Karl Bode wrote about Vice Media’s idiotic decision to disappear several articles that had been written by its Waypoint property concerning Collective Shout. Collective Shout is an Australian group that pretends to be a feminist organization, when, in reality, it operates much more like any number of largely evangelical groups bent on censoring any content that doesn’t align with their own viewpoints (which they insist become your viewpoints as well). The point of Karl’s post was to correctly point out that Collective Shout’s decision to go after the payment processors for the major video game marketplaces over their offering NSFW games shouldn’t be hidden from the public in the interest of clickbait non-journalism.

But that whole thing about Collective Shout putting on a pressure campaign on payment processors is in and of itself a big deal, as is the response to it. Both Steam and itch.io recently either removed or de-indexed a ton of games they’re labeling NSFW, chiefly along guidelines clearly provided by the credit card companies themselves. Now, Collective Shout will tell you that it is mostly interested in going after games that depict vile actions in some ways, such as rape, child abuse, and incest.

No Mercy. That’s the name of the incest-and-rape-focused game that was geo-blocked in Australia this April, following a campaign by the local pressure group Collective Shout. The group, which stands against “the increasing pornification of culture”, then set its sights on a broader target – hundreds of other games they identified as featuring rape, incest, or child sexual abuse on Steam and itch.io. “We approached payment processors because Steam did not respond to us,” said the group of its latest campaign.

The move was effective. Steam began removing sex-related games it deemed to violate the standards of its payment processors, presenting the choice as a tradeoff in a statement to Rock Paper Shotgun: “We are retiring those games from being sold on the Steam Store, because loss of payment methods would prevent customers from being able to purchase other titles and game content on Steam.”

Itch.io followed that up shortly afterwards with its de-indexing plan, but went further and did this with all NSFW games offered on the platform. Unlike Steam, itch.io was forthcoming as to their reasoning for its actions. And they were remarkably simple.

“Our ability to process payments is critical for every creator on our platform,” Corcoran said. “To ensure that we can continue to operate and provide a marketplace for all developers, we must prioritize our relationship with our payment partners and take immediate steps towards compliance.”

Digital marketplaces being unable to collect payment through trusted partners would be, to put it tersely, the end of their business. Those same payment processors can get predictably itchy about partnering with platforms that host content that someone out there, or many someones as part of a coordinated campaign, may not like for fear that will sully their reputation. And because these are private companies we’re talking about, their fear along with any of their own sense of morality are at play here. The end result is a digital world filled with digital marketplaces that all exist under an umbrella of god-like payment processors that can pretty much dictate to those other private entities what can be on offer and what cannot.

And, as an executive from Appcharge chimed in, the processors will hang this all on the amount of fraud and chargebacks that come along with adult content, but that doesn’t change the question about whether payment processors should be neutral on legal but morally questionable content or not. Because, as you would expect, the aims of folks like Collective Shout almost certainly don’t end with things like rape and incest.

It’s possible that Collective Shout’s campaign highlighted a level of operational and reputational risk that payment processors weren’t aware of, and of a severity they didn’t expect. “I’m guessing it’s also the moral element,” Tov-Ly says. “It just makes sense, right? Why would you condone incest or rape promoting games?”

Tov-Ly is of the opinion that payment processors offer a utility, and should have no more role in the moral arbitration of art than your electricity company – meaning, none at all. “Whenever you open that Pandora’s box, you’re not impartial anymore,” he says. “Today it’s rape games and incest, but tomorrow it could be another lobbying group applying pressure on LGBT games in certain countries.”

We’ve already seen this sort of thing when it comes to book and curriculum bans that are currently plaguing far too much of the country. When porn can mean Magic Treehouse, the word loses all meaning.

What is actually happening is that payment processors are feeling what they believe is “public pressure”, but which is actually just a targeted and coordinated campaign from a tiny minority of people who watched V For Vendetta and thought it was an instruction manual. Well, the public has caught wind of this, as have game publishers that might be caught up in this censorship or whatever comes next, and coordinated contact campaigns to payment processors to complain about this new censorship are being conducted.

Gilbert Martinez had just poured himself a glass of water and was pacing his suburban home in San Antonio, Texas while trying to navigate Mastercard’s byzantine customer service hotline. He was calling to complain about recent reports that the company is pressuring online gaming storefronts like Steam and Itch.io to ban certain adult games. He estimates his first call lasted about 18 minutes and ended with him lodging a formal complaint in the wrong department.

Martinez is part of a growing backlash to Steam and Itch.io purging thousands of games from their databases at the behest of payment processing companies. Australia-based anti-porn group Collective Shout claimed credit for the new wave of censorship after inciting a write-in campaign against Visa and Mastercard, which it accused of profiting off “rape, incest, and child sexual abuse game sales.” Some fans of gaming are now mounting reverse campaigns in the hopes of nudging Visa and Mastercard in the opposite directions.

If noise is what is going to make these companies go back to something resembling sanity, this will hopefully do the trick. We’re already seeing examples of games that are being unjustly censored, described as porn when they are very much not. Not to mention instances where nuance is lost and the “porn” content is actually the opposite.

Vile: Exhumed is a textbook example of what critics of the sex game purge always feared: that guidelines aimed at clamping down on pornographic games believed to be encouraging or glorifying sexual violence would inevitably ensnare serious works of art grappling with difficult and uncomfortable subject matter in important ways. Who gets to decide which is which? For a long time, it appeared to be Steam and Itch.io. Last week’s purges revealed it’s actually Visa and Mastercard, and whoever can frighten them the most with bad publicity.

Some industry trade groups have also weighed in. The International Game Developers Association (IGDA) released a statement stating that “censorship like this is materially harmful to game developers” and urging a dialogue between “platforms, payment processors, and industry leaders with developers and advocacy groups.” “We welcome collaboration and transparency,” it wrote. “This issue is not just about adult content. It is about developer rights, artistic freedom, and the sustainability of diverse creative work in games.”

This is the result of a meddling minority attempting to foist their desires on everyone else, plain and simple. Choking the money supply is a smart choice, sure, but one that should be recognized in this case for what it is: censorship based on proclivities that are not widely shared. And if there really is material in these games that is illegal, it should obviously be done away with.

But we should not be playing this game of pretending content that is not widely seen as immoral should somehow be choked of its ability to participate in commerce.

Source: Credit Card Companies Fielding A Ton Of Complaints Over NSFW Games Disappearing On Platforms | Techdirt

Google Is Rolling Out Its AI Age Verification to More Services, and I’m Skeptical

Yesterday, I wrote about how YouTube is now using AI to guess your age. The idea is this: Rather than rely on the age attached to your account, YouTube analyzes your activity on its platform, and makes a determination based on how your activity corresponds to others users. If the AI thinks you’re an adult, you can continue on; if it thinks your behavior aligns with that of a teenage user, it’ll put restrictions and protections on your account.

Now, Google is expanding its AI age verification tools beyond just its video streaming platform, to other Google products as well. As with YouTube, Google is trialing this initial rollout with a small pool of users, and based on its results, will expand the test to more users down the line. But over the next few weeks, your Google Account may be subject to this new AI, whose only goal is to estimate how old you are.

That AI is trained to look for patterns of behavior across Google products associated with users under the age of 18. That includes the categories of information you might be searching for, or the types of videos you watch on YouTube. Google’s a little cagey on the details, but suffice it to say that the AI is likely snooping through most, if not all, of what you use Google and its products for.

Restrictions and protections on teen Google accounts

We do know some of the restrictions and protections Google plans to implement when it detects a user is under 18 years old. As I reported yesterday, that involves turning on YouTube’s Digital Wellbeing tools, such as reminders to stop watching videos, and, if it’s late, encouragements to go to bed. YouTube will also limit repetitive views of certain types of content.

In addition to these changes to YouTube, you’ll also find you can no longer access Timeline in Maps. Timeline saves your Google Maps history, so you can effectively travel back through time and see where you’ve been. It’s a cool feature, but Google restricts access to users 18 years of age or older. So, if the AI detects you’re underage, no Timeline for you.

[…]

Source: Google Is Rolling Out Its AI Age Verification to More Services, and I’m Skeptical

Of course there is no mention of how to ask for recourse if the AI gets it wrong.

After the UK, online age verification is landing in the EU

Denmark, Greece, Spain, France, and Italy are the first to test the technical solution unveiled by the European Commission on July 14, 2025.

The announcement came less than two weeks before the UK enforced mandatory age verification checks on July 25. These have so far sparked concerns about the privacy and security of British users, fueling a spike in usage amongst the best VPN apps.

[…]

The introduction of this technical solution is a key step in implementing children’s online safety rules under the Digital Services Act (DSA).

Lawmakers ensure that this solution seeks to set “a new benchmark for privacy protection” in age verification.

That’s because online services will only receive proof that the user is 18+, without any personal details attached.

Further work on the integration of zero-knowledge proofs is also ongoing, with the full implementation of mandatory checks in the EU expected to be enforced in 2026.

[…]

Starting from Friday, July 25, millions of Britons will need to be ready to prove their age before accessing certain websites or content.

Under the Online Safety Act, sites displaying adult-only content must prevent minors from accessing their services via robust age checks.

Social media, dating apps, and gaming platforms are also expected to verify their users’ age before showing them so-called harmful content.

[…]

The vagueness of what constitutes harmful content, as well as the privacy and security risks linked with some of these age verification methods, have attracted criticism among experts, politicians, and privacy-conscious citizens who fear a negative impact on people’s digital rights.

While the EU approach seems better on paper, it remains to be seen how the age verification scheme will ultimately be enforced.

[…]

Source: After the UK, online age verification is landing in the EU | TechRadar

And so comes the EU spying on our browsing habits, telling us what is and isn’t good for us to see. I can make my own mind up, thank you. How annoying that I will be rate limited to the VPN I get.

Gamers Flood Credit Card Hotlines Demanding End To Censorship in games – this won’t just blow over

[…] Martinez is part of a growing backlash to Steam and Itch.io purging thousands of games from their databases at the behest of payment processing companies. Australia-based anti-porn group Collective Shout claimed credit for the new wave of censorship after inciting a write-in campaign against Visa and Mastercard, which it accused of profiting off “rape, incest, and child sexual abuse game sales.” Some fans of gaming are now mounting reverse campaigns in the hopes of nudging Visa and Mastercard in the opposite directions.

A screenshot shows an email sent to Collective Shout.
Screenshot: Bluesky / Kotaku

“Seeing the rise of censorship and claiming it’s to ‘protect kids,’ it sounds almost like the Satanic Panic, targeting people that have done nothing to anyone except having fun,” Martinez told Kotaku. “We’re already seeing the negative effect this has on people’s personal and financial lives because of such unnecessary restrictions. If parents are so concerned over protecting kids, then they should parent their own kids instead of forcing other people to meet their ridiculous demands.”

Indie horror game Vile: Exhumed is one of the titles that’s been banned from Steam by Valve. Released last year by Cara Cadaver of Final Girl Games, it has players rummage through a fictional ‘90s computer terminal to uncover a twisted man’s toxic obsession with an adult horror film actress, using this format to engage with themes of online misogyny and toxic parasocial relationships. “It was banned for ‘sexual content with depictions of real people,’ which, if you have played it, you know is all implied, making this all feel even worse,” Cadaver wrote on Bluesky on July 28.

Valve did not immediately respond to a request for comment.

Vile: Exhumed is a textbook example of what critics of the sex game purge always feared: that guidelines aimed at clamping down on pornographic games believed to be encouraging or glorifying sexual violence would inevitably ensnare serious works of art grappling with difficult and uncomfortable subject matter in important ways. Who gets to decide which is which? For a long time, it appeared to be Steam and Itch.io. Last week’s purges revealed it’s actually Visa and Mastercard, and whoever can frighten them the most with bad publicity.

VILE: Exhumed | Announcement Trailer

“Things are definitely changing as reports of responses to calls have gone from ‘Sorry what are you talking about?’ to then ‘Are you ALSO calling about itch/steam’ to now some [callers] receiving outright harassment,” a 2D artist who goes by Void and who has helped organize a Discord for a reverse call-in campaign told Kotaku. It’s hard to have any clear sense of the scope of these counter-initiatives or what ultimate impact they might have on the companies in question, but anecdotally the effort seems to be gaining traction. For instance, callers are now needing to spend less time explaining what Steam, Itch.io, or “NSFW” games are to the people on the other end of the line.

“For calls I was originally focusing on Mastercard, but I ended up getting a lot of time out of Visa,” Bluesky user RJAIN told Kotaku. “Two days ago I had a call with Visa that lasted over an hour, and a follow-up call later on that lasted over 2.5 hours. Those calls, I spoke with a supervisor and they seemed very calm and understanding. Yesterday, the calls were different. The reps seemed angry and exhausted. They refused to let me speak to a supervisor and kept insisting that it is now protocol for them to disconnect the call on anyone complaining about this issue.”

[…]

Some industry trade groups have also weighed in. The International Game Developers Association (IGDA) released a statement stating that “censorship like this is materially harmful to game developers” and urging a dialogue between “platforms, payment processors, and industry leaders with developers and advocacy groups.” “We welcome collaboration and transparency,” it wrote. “This issue is not just about adult content. It is about developer rights, artistic freedom, and the sustainability of diverse creative work in games.”

For the time being, that dialogue appears to mostly be taking place at Visa’s and Mastercard’s call centers, at least when they allow it.

Source: Gamers Flood Credit Card Hotlines Demanding End To Censorship

Echolon Exercise Bikes Lose Features, must phone home to work at all after Firmware Update

[…] It seems like a simple concept that everyone should be able to agree to: if I buy a product from you that does x, y, and z, you don’t get to remove x, y, or z remotely after I’ve made that purchase. How we’ve gotten to a place where companies can simply remove, or paywall, product features without recourse for the customer they essentially bait and switched is beyond me.

But it keeps happening. The most recent example of this is with Echelon exercise bikes. Those bikes previously shipped to paying customers with all kinds of features for ride metrics and connections to third-party apps and services without anything further needed from the user. That all changed recently when a firmware update suddenly forced an internet connection and a subscription to a paid app to make any of that work.

As explained in a Tuesday blog post by Roberto Viola, who develops the “QZ (qdomyos-zwift)” app that connects Echelon machines to third-party fitness platforms, like Peloton, Strava, and Apple HealthKit, the firmware update forces Echelon machines to connect to Echelon’s servers in order to work properly. A user online reported that as a result of updating his machine, it is no longer syncing with apps like QZ, and he is unable to view his machine’s exercise metrics in the Echelon app without an Internet connection.

Affected Echelon machines reportedly only have full functionality, including the ability to share real-time metrics, if a user has the Echelon app active and if the machine is able to reach Echelon’s servers.

Want to know how fast you’re going on the bike you’re sitting upon? That requires an internet connection. Want to get a sense of how you performed on your ride on the bike? That requires an internet connection. And if Echelon were to go out of business? Then your bike just no longer works beyond the basic function of pedaling it.

And the ability to use third-party apps is reportedly just, well, gone.

For some owners of Echelon equipment, QZ, which is currently rated as the No. 9 sports app on Apple’s App Store, has been central to their workouts. QZ connects the equipment to platforms like Zwift, which shows people virtual, scenic worlds while they’re exercising. It has also enabled new features for some machines, like automatic resistance adjustments. Because of this, Viola argued in his blog that QZ has “helped companies grow.”

“A large reason I got the [E]chelon was because of your app and I have put thousands of miles on the bike since 2021,” a Reddit user told the developer on the social media platform on Wednesday.

Instead of happily accepting that someone out there is making its product more attractive and valuable, Echelon is instead going for some combination of overt control and the desire for customer data. Data which will be used, of course, for marketing purposes.

There’s also value in customer data. Getting more customers to exercise with its app means Echelon may gather more data for things like feature development and marketing.

What you won’t hear anywhere, at least that I can find, is any discussion of the ability to return or get refunds for customers who bought these bikes when they did things that they no longer will do after the fact. That’s about as clear a bait and switch type of a scenario as you’re likely to find.

Unfortunately, with the FTC’s Bureau of Consumer Protection being run by just another Federalist Society imp, it’s unlikely that anything material will be done to stop this sort of thing.

Source: Exercise Bike Company Yanks Features Away From Purchased Bikes Via Firmware Update | Techdirt

Visa and Mastercard are getting overwhelmed by censorship gamer fury

In the wake of storefronts like Steam and itch.io curbing the sale of adult games, irate fans have started an organized campaign against the payment processors that they believe are responsible for the crackdown. While the movement is still in its early stages, people are mobilizing with an eye toward overwhelming communication lines at companies like Visa and Mastercard in a way that will make the concern impossible to ignore.

On social media sites like Reddit and Bluesky, people are urging one another to get into contact with Visa and Mastercard through emails and phone calls. Visa and Mastercard have become the targets of interest because the affected storefronts both say that their decisions around adult games were motivated by the danger of losing the ability to use major payment processors while selling games. These payment processors have their own rules regarding usage, but they are vaguely defined. But losing infrastructure like this could impact audiences well beyond those who care about sex games, spokespeople for Valve and itch.io said.

In a now-deleted post on the Steam subreddit with over 17,000 upvotes, commenters say that customer service representatives for both payment processors seem to already be aware of the problem. Sometimes, the representatives will say that they’ve gotten multiple calls on the subject of adult game censorship, but that they can’t really do anything about it.

The folks applying pressure know that someone at a call center has limited power in a scenario like this one; typically, agents are equipped to handle standard customer issues like payment fraud or credit card loss. But the point isn’t to enact change through a specific phone call: It’s to cause enough disruption that the ruckus theoretically starts costing payment processors money.

“Emails can be ignored, but a very very long queue making it near impossible for other clients to get in will help a lot as well,” reads the top comment on the Reddit thread. In that same thread, people say that they’re hanging onto the call even if the operator says that they’ll experience multi-hour wait times presumably caused by similar calls gunking up the lines. Beyond the stubbornness factor, the tactic is motivated by the knowledge that most customer service systems will put people who opt for call-backs in a lower priority queue, as anyone who opts in likely doesn’t have an emergency going on.

Artwork from the erotic game Forbidden Fantasy, featuring a purple-haired elf character shushing the camera
Image: OppaiMan

“Do both,” one commenter suggests. “Get the call back, to gum up the call back queue. Then call in again and wait to gum up the live queue.”

People are also using email to voice their concerns directly to the executives at both Visa and Mastercard, payment processors that activist group Collective Shout called out by name in their open letter requesting that adult games get pulled. Emails are also getting sent to customer service. In light of the coordinated effort, many people are getting a pre-written response that reads:

Thank you for reaching out and sharing your perspective. As a global company, we follow the laws and regulations everywhere we do business. While we explicitly prohibit illegal activity on our network, we are equally committed to protecting legal commerce. If a transaction is legal, our policy is to process the transaction. We do not make moral judgments on legal purchases made by consumers. Visa does not moderate content sold by merchants, nor do we have visibility into the specific goods or services sold when we process a transaction. When a legally operating merchant faces an elevated risk of illegal activity, we require enhanced safeguards for the banks supporting those merchants. For more information on Visa’s policies, please visit our network integrity page on Visa.com. Thank you for writing.

On platforms like Bluesky, resources are being shared to help people know who to contact and how, including possible scripts for talking to representatives or sending emails. A website has been set up with the explicit purpose of arming concerned onlookers with the tools and knowledge necessary to do their part in the campaign.

Through it all, gamers are telling one another to remain cordial during any interactions with payment processors, especially when dealing with low-level workers who are just trying to do their job. For executives, the purpose of maintaining a considerate tone is to help the people in power take the issue seriously.

The strategy is impressive in its depth and breadth of execution. While some charge in with an activist bent, others say that they’re pretending to be confused customers who want to know why they can’t use Visa or Mastercard to buy their favorite games.

Meanwhile, Collective Shout — the organization who originally complained to Steam, Visa, and Mastercard about adult games featuring non-consensual violence against women — has also recently put out a statement of its own alongside a timeline of events.

“We raised our objection to rape and incest games on Steam for months, and they ignored us for months,” reads a blog post from Collective Shout. “We approached payment processors because Steam did not respond to us.”

Collective Shout claims that it only petitioned itch.io to pull games with sexualized violence or torture against women, but allegedly, the storefront made its own decision to censor NSFW content sitewide. At current, itch.io has deindexed games with adult themes, meaning that these games are not viewable on their search pages. The indie storefront is still in the middle of figuring out and outlining its rules for adult content on the website, but the net has been cast so wide that some games with LGBT themes are being impacted as well.

In another popular Reddit thread, users say that customer service representatives are shifting from confusion to reiterating that their concerns are being “heard.”

“I will be calling them again in a few to days to see if there is any progress on changing the situation,” says the original poster.

Perhaps a different comment in that thread summarizes the ordeal best: “There’s really only 2 things that can unite Gamers: hate campaigns and gooning.”

Source: Visa and Mastercard are getting overwhelmed by censorship gamer fury | Polygon

Automata Dev Warns That Letting Credit Card Companies Censor Internet is an attack on Democracy

As a fight with credit card companies over adult games leads to renewed concerns about censorship on Steam and even on indie platforms like itch.io, a recent warning by Nier: Automata director Yoko Taro calling censorship a “security hole that endangers democracy itself” has become relevant again.

The comments came last November when the Manga Library Z online repository for digital downloads of out-of-print manga was forced to shut down. The group blamed international credit card companies, presumably Visa and Mastercard, who wanted the site to censor certain words from its copies of adult manga.

“Publishing and similar fields have always faced regulations that go beyond the law, but the fact that a payment processor, which is involved in the entire infrastructure of content distribution, can do such things at its own discretion seems to me to be dangerous on a whole new level,” Taro wrote in a thread at the time, according to a translation by Automaton.

He contionued:

It implies that by controlling payment processing companies, you can even censor another country’s free speech. I feel like it’s not just a matter of censoring adult content or jeopardizing freedom of expression, but rather a security hole that endangers democracy itself.

Manga Library Z was eventually able to come back online thanks to a crowdfunding campaign earlier this year, but now video game developers behind adult games with controversial themes are facing similar issues on Steam and itch.io due to recent boycott campaigns. Some artists and fans have been organizing reverse boycotts calling for Visa, Mastercard, and others to end their “moral panic.” One such petition has nearly 100,000 signatures so far.

“Some of the games that have been caught up in the last day’s changes on Itch are games that up-and-coming creators have made about their own experiences in abusive relationships, or dealing with trauma, or coming out of the closet and finding their first romance as an LGBTQ person,” NYU Game Center chair Naomi Clark told 404 Media this week. She mentioned Jenny Jiao Hsia’s autobiographical Consume Me as one example of the type of work that could be censored under the platform’s shifting definitions of what’s acceptable

[…]

Source: Nier: Automata Dev Warned About Credit Card Company Censorship

UK’s Stupid and Dangerous New Age Verification Requirement Thwarted in the Simplest Ways Imaginable

TL;DR – use a VPN or take a picture of yourself in Death Stranding

Earlier this week, the United Kingdom’s age assurance requirement for sites that publish pornographic material went into effect, which has resulted in everything from Pornhub to Reddit and Discord displaying an age verification panel when users attempt to visit. There’s just one little problem. As The Verge notes, all it takes to defeat the age-gating is a VPN, and those aren’t hard to come by these days.

Here’s the deal: Ofcom, the UK’s telecom regulator, requires online platforms to verify the age of their users if they are accessing a site that either publishes or allows users to publish pornographic material. Previously, a simple click of an “I am over 18” button would get you in. Now, platforms are mandated to use a verification method that is “strong” and “highly effective.” A few of those acceptable methods include verifying with a credit card, uploading a photo ID, or submitting to a “facial age estimation” in which you upload a selfie so a machine can determine if you look old enough to pleasure yourself responsibly.

Those options vary from annoying to creepily intrusive, but there’s a little hitch in the plan: Currently, most platforms are determining a user’s location based on IP address. If you have an IP that places you in the UK, you have to verify. But if you don’t, you’re free to browse without interruption. And all you need to change your IP address is a VPN.

Ofcom seems aware of this very simple workaround. According to the BBC, the regulator has rules that make it illegal for platforms to host, share, or allow content that encourages people to use a VPN to bypass the age authentication page. It also encouraged parents to block or control VPN usage by their children to keep them from dodging the age checkers.

It seems that people are aware of this option. Google Trends shows that searches for the term “VPN” have skyrocketed in the UK since the age verification requirement went into effect.

[…]

But the thing about Ofcom’s implementation here is that it’s not just blocking kids from seeing harmful material—it’s exposing everyone to invasive, privacy-violating risks. When the methods for accomplishing the stated goal require people to reveal sensitive data, including their financial information, or give up pictures of their face to be scanned and processed by AI, it’s kinda hard to blame anyone for just wanting to avoid that entirely. Whether they’re horny teens trying to skirt the system or adults, getting a face scan before opening Pornhub kinda kills the mood.

Source: UK’s New Age Verification Requirement Thwarted in the Simplest Way Imaginable

An X user named Dany Sterkhov appears to be the first to discover the hack. On July 25, he posted that he had bypassed Discord’s age verification check using the photo mode in the video game Death Stranding.

[…]

The Verge and PCGamer have both tried Sterkhov’s hack themselves and confirmed it works.

Most of these companies rely on third-party platforms to handle age verification. These services typically give users the option to upload a government-issued photo ID or submit photos of themselves.

Discord uses a platform called k-ID for age verification. According to The Verge’s Tom Warren, all he had to do to pass the check was point his phone’s camera at his monitor to scan the face of Sam Bridges, the protagonist of Death Stranding, using the game’s photo mode. The system did ask him to open and close his mouth—something that is easy enough to do in the game.

Warren was also able to bypass Reddit’s age check, which is handled by Persona, using the same method. However, the trick didn’t work with Bluesky’s system, which uses Yoti for age verification.

[…]

ProtonVPN reported on X that it saw an over 1,400 percent increase in sign-ups in the U.K. after the age verification requirements took effect. VPNs let people browse the web as if they were in a different location, making it easier to bypass the U.K.’s age checks.

In the U.S., laws requiring similar age verification systems for porn sites have passed in nearly half the states. Nine states in the U.S. have also passed laws requiring parental consent or age verification for social media platforms.

Source: ‘Death Stranding’ Is Helping UK Users Bypass Age Verification Laws

The problem is that besides being unenforceable you are leaving a lot of very personal data inside the age verifiers databases. These databases are clear targets and will get hacked.

Internet Archive is now an official US government document library

The US Senate has granted the Internet Archive federal depository status, making it officially part of an 1,100-library network that gives the public access to government documents, KQED reported. The designation was made official in a letter from California Senator Alex Padilla to the Government Publishing Office that oversees the network. “The Archive’s digital-first approach makes it the perfect fit for a modern federal depository library, expanding access to federal government publications amid an increasingly digital landscape,” he wrote.

[…]

With its new status, the Internet Archive will be gain improved access to government materials, founder Brewster Kahle said in a statement. “By being part of the program itself, it just gets us closer to the source of where the materials are coming from, so that it’s more reliably delivered to the Internet Archive, to then be made available to the patrons of the Internet Archive or partner libraries.” The Archive could also help other libraries move toward digital preservation, given its experience in that area.

It’s some good news for the site which has faced legal battles of late. It was sued by major publishers over loans of digital books during the Coronavirus epidemic and was forced by a federal court in 2023 to remove more than half a million titles. And more recently, major music label filed lawsuits over its Great 78 Project that strove to preserve 78 RPM records. If it loses that case it could owe more than $700 million damages and possibly be forced to shut down.

The new designation likely won’t aid its legal problems, but it does affirm the site’s importance to the public. “In October, the Internet Archive will hit a milestone of 1 trillion pages,” Kahle wrote. “And that 1 trillion is not just a testament to what libraries are able to do, but actually the sharing that people and governments have to try and create an educated populace.”

Source: Internet Archive is now an official US government document library

Finally something goes right in the world of copyright.

Copilot Vision on Windows 11 next MS spy but now sends data to Microsoft servers

[…]

Copilot Vision is an extension of Microsoft’s divisive Recall, a feature initially sort of exclusive to the Copilot+ systems with a neural co-processor of sufficient computational power. Like Recall, which was pulled due to serious security failings and subject to a lengthy delay before its eventual relaunch, Copilot Vision is designed to analyze everything you do on your computer.

It does this, when enabled, by capturing constant screenshots and feeding them to an optical character recognition system and a large language model for analysis – but where Recall works locally, Copilot Vision sends the data off to Microsoft servers.

According to a Microsoft spokesperson back in April, users’ data will not be stored long-term, aside from transcripts of the conversation with the Copilot assistant itself, and “are not used for model training or ads personalisation.”

[…]

While the screen snooping only happens when the user expressly activates it as part of a Copilot session, unlike Recall, which is constantly active in the background when enabled, it’s also designed to be more proactive than previous releases – which, for many readers, will conjure memories of Clippy and his cohort of animated assistants from the days of Microsoft Office 97 and onward.

At the time of writing, Microsoft was only offering Copilot Vision in the US, with the promise (or threat) that it will be coming to very specifically “non-European countries” soon – a tip of the hat, it seems, to the European Union’s AI Act.

[…]

Source: Copilot Vision on Windows 11 sends data to Microsoft servers • The Register

WhoFi: Unique ‘fingerprint’ based on Wi-Fi interactions allows reidentification of people being observed

Researchers in Italy have developed a way to create a biometric identifier for people based on the way the human body interferes with Wi-Fi signal propagation.

The scientists claim this identifier, a pattern derived from Wi-Fi Channel State Information, can re-identify a person in other locations most of the time when a Wi-Fi signal can be measured. Observers could therefore track a person as they pass through signals sent by different Wi-Fi networks – even if they’re not carrying a phone.

In the past decade or so, scientists have found that Wi-Fi signals can be used for various sensing applications, such as seeing through walls, detecting falls, sensing the presence of humans, and recognizing gestures including sign language.

Following the approval of the IEEE 802.11bf specification in 2020, the Wi-Fi Alliance began promoting Wi-Fi Sensing, positioning Wi-Fi as something more than a data transit mechanism.

The researchers – Danilo Avola, Daniele Pannone, Dario Montagnini, and Emad Emam, from La Sapienza University of Rome – call their approach “WhoFi”, as described in a preprint paper titled, “WhoFi: Deep Person Re-Identification via Wi-Fi Channel Signal Encoding.”

(The authors presumably didn’t bother checking whether the WhoFi name was taken. But an Oklahoma-based provider of online community spaces shares the same name.)

Who are you, really?

Re-identification, the researchers explain, is a common challenge in video surveillance. It’s not always clear when a subject captured on video is the same person recorded at another time and/or place.

Re-identification doesn’t necessarily reveal a person’s identity. Instead, it is just an assertion that the same surveilled subject appears in different settings. In video surveillance, this might be done by matching the subject’s clothes or other distinct features in different recordings. But that’s not always possible.

The Sapienza computer scientists say Wi-Fi signals offer superior surveillance potential compared to cameras because they’re not affected by light conditions, can penetrate walls and other obstacles, and they’re more privacy-preserving than visual images.

“The core insight is that as a Wi-Fi signal propagates through an environment, its waveform is altered by the presence and physical characteristics of objects and people along its path,” the authors state in their paper. “These alterations, captured in the form of Channel State Information (CSI), contain rich biometric information.”

CSI in the context of Wi-Fi devices refers to information about the amplitude and phase of electromagnetic transmissions. These measurements, the researchers say, interact with the human body in a way that results in person-specific distortions. When processed by a deep neural network, the result is a unique data signature.

Researchers proposed a similar technique, dubbed EyeFi, in 2020, and asserted it was accurate about 75 percent of the time.

The Rome-based researchers who proposed WhoFi claim their technique makes accurate matches on the public NTU-Fi dataset up to 95.5 percent of the time when the deep neural network uses the transformer encoding architecture.

“The encouraging results achieved confirm the viability of Wi-Fi signals as a robust and privacy-preserving biometric modality, and position this study as a meaningful step forward in the development of signal-based Re-ID systems,” the authors say. ®

Source: WhoFi: Unique ‘fingerprint’ based on Wi-Fi interactions • The Register

As site blocks pile up, European Commission issues subtle slapdown to Italy’s Piracy Shield

As numerous Walled Culture posts attest, site blocking is in the vanguard of the actions by copyright companies against sites engaged in the unauthorised sharing of material. Over the past few months, this approach has become even more pervasive, and even more intrusive. For example, in France, the Internet infrastructure company Cloudflare was forced to geoblock more than 400 sports streaming domain names. More worryingly, leading VPN providers were ordered to block similar sites. This represents another attack on basic Internet infrastructure, something this blog has been warning about for years.

In Spain, LaLiga, the country’s top professional football league, has not only continued to block sites, it has even ignored attempts by the Vercel cloud computing service to prevent overblocking, whereby many other unrelated sites are knocked out too. As TorrentFreak reported:

the company [Vercel] set up an inbox which gave LaLiga direct access to its Site Reliability Engineering incident management system. This effectively meant that high priority requests could be processed swiftly, in line with LaLiga’s demands while avoiding collateral damage.

Despite Vercel’s attempts to give LaLiga the blocks it wanted without harming other users, the football league ignored the new management system, and continued to demand excessively wide blocks. As Walled Culture has noted, this is not some minor, fringe issue: overblocking could have serious social consequences. That’s something Cloudflare’s CEO underlined in the context of LaLiga’s actions. According to TorrentFreak, he warned:

It’s only a matter of time before a Spanish citizen can’t access a life-saving emergency resource because the rights holder in a football match refuses to send a limited request to block one resource versus a broad request to block a whole swath of the Internet.

In India, courts are granting even more powerful site blocks at the request of copyright companies. For example, the High Court in New Delhi has granted a new type of blocking order significantly called a “superlative injunction”. The same court has issued orders to five domain registrars to block a number of sites, and to do so globally – not just in India. In America, meanwhile, there are renewed efforts to bring in site blocking laws, amidst fears that these too could lead to harmful overblocking.

The pioneer of this kind of excessive site blocking is Italy, with its Piracy Shield system. As Walled Culture wrote recently, there are already moves to expand Piracy Shield that will make it worse in a number of ways. The overreach of Piracy Shield has prompted the Computer & Communications Industry Association (CCIA) to write to the European Commission, urging the latter to assess the legality of the Piracy Shield under EU law. And that, finally, is what the European Commission is beginning to do.

A couple of weeks ago, the Commission sent a letter to Antonio Tajani, Italy’s Minister of Foreign Affairs and International Cooperation. In it, the European Commission offered some comments on Italy’s notification of changes in its copyright law. These changes include “amendments in the Anti-Piracy Law that entrusted Agcom [the Italian Authority for Communications Guarantees] to implement the automated platform later called the “Piracy Shield”.” In the letter, the European Commission offers its thoughts on whether Piracy Shield complies with the Digital Services Act (DSA), one of the key pieces of legislation that regulates the online world in the EU. The Commission wrote:

The DSA does not provide a legal basis for the issuing of orders by national administrative or judicial authorities, nor does it regulate the enforcement of such orders. Any such orders, and their means of enforcement, are to be issued on the basis of the applicable Union law or national law in compliance with Union law

In other words, the Italian government cannot just vaguely invoke the DSA to justify Piracy Shield’s extended powers. The letter goes on:

The Commission would also like to emphasise that the effective tackling of illegal content must also take into due account the fundamental right to freedom of expression and information under the Charter of Fundamental Rights of the EU. As stated in Recital 39 of the DSA “[I]n that regard, the national judicial or administrative authority, which might be a law enforcement authority, issuing the order should balance the objective that the order seeks to achieve, in accordance with the legal basis enabling its issuance, with the rights and legitimate interests of all third parties that may be affected by the order, in particular their fundamental rights under the Charter”.

This is a crucial point in the context of overblocking. Shutting down access to thousands, sometimes millions of unrelated sites as the result of a poorly-targeted injunction, clearly fails to take into account “the rights and legitimate interests of all third parties that may be affected by the order”. The European Commission also has a withering comment on Piracy Shield’s limited redress mechanism for those blocked in error:

the notified draft envisages the possibility for the addressee of the order to lodge a complaint (“reclamo”) within 5 days from the notification of the order, while the order itself would have immediate effect. The Authority must then decide on these complaints within 10 days as laid down in Article 8-bis(4), 9-bis(7) and Article 10(9) of the notified draft. The Commission notes that there do not seem to be other measures available to the addressee of the order to help prevent eventual erroneous or excessive blocking of content. Furthermore, as also explained in the Reply, the technical specifications of the Piracy Shield envisage unblocking procedures limited to 24 hours from reporting in the event of an error. This limitation to 24 hours does not seem, in principle, to respond to any justified need and could lead to persisting erroneous blockings not being resolved.

The letter concludes by inviting “the Italian authorities to take into account the above comments in the final text of the notified draft and its implementation.” That “invitation” is, of course, a polite way of ordering the Italian government to fix the problems with Piracy Shield that the letter has just run through. They may be couched in diplomatic language, but the European Commission’s “comments” are in fact a serious slapdown to a bad law that seems not to be compliant with the DSA in several crucial respects. It will be interesting to see how the Italian authorities respond to this subtle but public reprimand.

Source: As site blocks pile up, European Commission issues subtle slapdown to Italy’s Piracy Shield – Walled Culture

Google Ordered to Pay $314M for Misusing Android Users’ Cellular Data Without Permission – calling home 389 times per day even when completely idle and all google apps closed!

Google has been ordered by a court in the U.S. state of California to pay $314 million over charges that it misused Android device users’ cellular data when they were idle to passively send information to the company.

The verdict marks an end to a legal class-action complaint that was originally filed in August 2019.

In their lawsuit, the plaintiffs argued that Google’s Android operating system leverages users’ cellular data to transmit a “variety of information to Google” without their permission, even when their devices are kept in an idle state.

“Although Google could make it so that these transfers happen only when the phones are connected to Wi-Fi, Google instead designed these transfers so they can also take place over a cellular network,” they said.

“Google’s unauthorized use of their cellular data violates California law and requires Google to compensate Plaintiffs for the value of the cellular data that Google uses for its own benefit without their permission.”

The transfers, the plaintiffs argued, occur when Google properties are open and operating in the background, even in situations where a user has closed all Google apps, and their device is dormant, thereby misappropriating users’ cellular data allowances.

In one instance, the plaintiffs found that a Samsung Galaxy S7 device with the default settings and the standard pre-loaded apps, and connected to a new Google account, sent and received 8.88 MB/day of cellular data, out of which 94% of the communications were between Google and the device.

The information exchange happened approximately 389 times within a span of 24 hours. The transferred information mainly consisted of log files containing operating system metrics, network state, and the list of open apps.

“Log files are typically not time-sensitive, and transmission of them could easily be delayed until Wi-Fi is available,” according to court documents.

“Google could also program Android to allow users to enable passive transfers only when they are on Wi-Fi connections, but apparently it has chosen not to do so. Instead, Google has chosen to simply take advantage of Plaintiffs’ cellular data allowances.”

That’s not all. The court complaint also cited another 2018 experiment that found that an Android device that was “outwardly dormant and stationary” but had the Chrome web browser app opened and in the background resulted in about 900 passive transfers in 24 hours.

[…]

Source: Google Ordered to Pay $314M for Misusing Android Users’ Cellular Data Without Permission

Wow! And when did anyone agree to send this much data about their phone to Google then?

Someone Built a Concept Ad Blocker for Real Life, and I Can’t Wait to Try It

I use as many ad-blocking programs as possible, but no matter how many I install, real-life advertising is still there, grabbing my attention when I’m just trying to go for a walk. Thankfully, there may be a solution on the horizon. Software engineer Stijn Spanhove recently posted a concept video showing what real-time, real-life ad-blocking looks like on a pair of Snap Spectacles, and I really want it. Check it out:

The idea is that the AI in your smart glasses recognizes advertisements in your visual field and “edits them out’ in real time, sparing you from ever seeing what they want you to see.

While Spanhove’s video shows a red block over the offending ads, you could conceivably cover that Wendy’s ad with anything you want—an abstract painting, a photo of your family, an ad for Arby’s, etc.

Source: Someone Built an Ad Blocker for Real Life, and I Can’t Wait to Try It

Note – it looks like Stijn took everything related to this down. So it’s probably just a concept. But it’s a really cool concept!

The Conservatives On The Supreme Court Are So Scared Of Nudity, They Threw Out The First Amendment

he Supreme Court this morning took a chainsaw to the First Amendment on the internet, and the impact is going to be felt for decades going forward. In the FSC v. Paxton case, the Court upheld the very problematic 5th Circuit ruling that age verification online is acceptable under the First Amendment, despite multiple earlier Supreme Court rulings that said the opposite.

Justice Thomas wrote the 6-3 majority opinion, with Justice Kagan writing the dissent (joined by Sotomayor and Jackson). The practical effect: states can now force websites to collect government IDs from anyone wanting to view adult content, creating a massive chilling effect on protected speech and opening the door to much broader online speech restrictions.

Thomas accomplished this by pulling off some remarkable doctrinal sleight of hand. He ignored the Court’s own precedents in Ashcroft v. ACLU by pretending online age verification is just like checking ID at a brick-and-mortar store (it’s not), applied a weaker “intermediate scrutiny” standard instead of the “strict scrutiny” that content-based speech restrictions normally require, and—most audaciously—invented an entirely new category of “partially protected” speech that conveniently removes First Amendment protections exactly when the government wants to burden them. As Justice Kagan’s scathing dissent makes clear, this is constitutional law by result-oriented reasoning, not principled analysis.

[…]

The real danger here isn’t just Texas’s age verification law—it’s that Thomas has handed every state legislature a roadmap for circumventing the First Amendment online. His reasoning that “the internet has changed” and that intermediate scrutiny suffices for content-based restrictions will be cited in countless future cases targeting online speech. Expect age verification requirements to be attempted for social media platforms (protecting kids from “harmful” political content), for news sites (preventing minors from accessing “disturbing” coverage), and for any online speech that makes moral authorities uncomfortable.

And yes, to be clear, the majority opinion seeks to limit this just to content deemed “obscene” to avoid such problems, but it’s written so broadly as to at least open up challenges along these lines.

Thomas’s invention of “partially protected” speech, that somehow means you can burden those for which it is protected, is particularly insidious because it’s infinitely expandable. Any time the government wants to burden speech, it can simply argue that the burden is built into the right itself—making First Amendment protection vanish exactly when it’s needed most. This isn’t constitutional interpretation; it’s constitutional gerrymandering.

The conservative justices may think they’re just protecting children from pornography, but they’ve actually written a permission slip for the regulatory state to try to control online expression.

[…]

By creating his “partially protected” speech doctrine and blessing age verification burdens that would have been unthinkable a decade ago, Thomas has essentially told state governments: find the right procedural mechanism, and you can burden any online speech you dislike. Today it’s pornography. Tomorrow it will be political content that legislators deem “harmful to minors,” news coverage that might “disturb” children, or social media discussions that don’t align with official viewpoints.

The conservatives may have gotten their victory against online adult content, but they’ve handed every future administration—federal and state—a blueprint for dismantling digital free speech. They were so scared of nudity that they broke the Constitution. The rest of us will be living with the consequences for decades.

Source: The Conservatives On The Supreme Court Are So Scared Of Nudity, They’ll Throw Out The First Amendment | Techdirt

Denmark to tackle deepfakes by giving people copyright to their own features

The Danish government is to clamp down on the creation and dissemination of AI-generated deepfakes by changing copyright law to ensure that everybody has the right to their own body, facial features and voice.

The Danish government said on Thursday it would strengthen protection against digital imitations of people’s identities with what it believes to be the first law of its kind in Europe.

[…]

It defines a deepfake as a very realistic digital representation of a person, including their appearance and voice.

[…]

“In the bill we agree and are sending an unequivocal message that everybody has the right to their own body, their own voice and their own facial features, which is apparently not how the current law is protecting people against generative AI.”

He added: “Human beings can be run through the digital copy machine and be misused for all sorts of purposes and I’m not willing to accept that.”

[…]

The changes to Danish copyright law will, once approved, theoretically give people in Denmark the right to demand that online platforms remove such content if it is shared without consent.

It will also cover “realistic, digitally generated imitations” of an artist’s performance without consent. Violation of the proposed rules could result in compensation for those affected.

The government said the new rules would not affect parodies and satire, which would still be permitted.

[…]

Source: Denmark to tackle deepfakes by giving people copyright to their own features | Deepfake | The Guardian

An interesting take on it. I am curious how this goes – defending copyright can be a very detailed thing, so what happens if someone alters someone else’s eyebrows in the deepfake by making them a mm longer? Does that invalidate the whole copyright?

Federal judge sides with Meta in lawsuit over training AI models on copyrighted books, close on Federal judge ruling for Anthropic

A federal judge sided with Meta on Wednesday in a lawsuit brought against the company by 13 book authors, including Sarah Silverman, that alleged the company had illegally trained its AI models on their copyrighted works.

Federal Judge Vince Chhabria issued a summary judgment — meaning the judge was able to decide on the case without sending it to a jury — in favor of Meta, finding that the company’s training of AI models on copyrighted books in this case fell under the “fair use” doctrine of copyright law and thus was legal.

The decision comes just a few days after a federal judge sided with Anthropic in a similar lawsuit. Together, these cases are shaping up to be a win for the tech industry, which has spent years in legal battles with media companies arguing that training AI models on copyrighted works is fair use.

However, these decisions aren’t the sweeping wins some companies hoped for — both judges noted that their cases were limited in scope.

Judge Chhabria made clear that this decision does not mean that all AI model training on copyrighted works is legal, but rather that the plaintiffs in this case “made the wrong arguments” and failed to develop sufficient evidence in support of the right ones.

“This ruling does not stand for the proposition that Meta’s use of copyrighted materials to train its language models is lawful,” Judge Chhabria said in his decision. Later, he said, “In cases involving uses like Meta’s, it seems like the plaintiffs will often win, at least where those cases have better-developed records on the market effects of the defendant’s use.”

Judge Chhabria ruled that Meta’s use of copyrighted works in this case was transformative — meaning the company’s AI models did not merely reproduce the authors’ books.

Furthermore, the plaintiffs failed to convince the judge that Meta’s copying of the books harmed the market for those authors, which is a key factor in determining whether copyright law has been violated.

“The plaintiffs presented no meaningful evidence on market dilution at all,” said Judge Chhabria.

[…]

Source: Federal judge sides with Meta in lawsuit over training AI models on copyrighted books | TechCrunch

I have covered the Silverman et al case before here several times and it was retarded on all levels, which is why it was thrown out against OpenAI. Most importantly is that this judge and the judge in the Anthropic case rule that AI’s use of ingested works is transformative and not a copy. Just like when you read a book, you can recall bits of it for inspiration, but you don’t (well, most people don’t!) remember word for word what you read.