Privacy and surveillance

🔍The Reality

Facial recognition in public spaces, behavioral inference from chat logs, and AI-driven surveillance in authoritarian contexts are genuinely concerning. Even in democracies, the combination of always-on smart devices, AI-enhanced data brokers, and weak federal US privacy law creates real risk. "Privacy by default" is still the exception, not the norm. And face matching is now a consumer product with ordinary startup security: in August 2026 researcher Jeremiah Fowler found that ClarityCheck, a service that lets anyone upload a photo and try to identify the person in it, had left about 9 million face images in an unsecured cloud bucket, including children, while telling visitors its image search was private and secure. The deeper problem is not the misconfiguration but who was in the database — people who were never customers, never consented, and had no way to know they were there, which is precisely the case that notice-and-consent privacy law does not reach. A third failure mode sits between the authoritarian case and the careless-startup case, and it is the one democracies actually have to solve: a lawful system, bought openly by an accountable public agency, misused by the people authorized to run it. Reporting in August 2026 identified 46 US police officers accused of using Flock Safety license-plate cameras to track wives, girlfriends and former partners, in departments that mostly did not know it was happening. Nothing was hacked and nothing leaked. The system worked exactly as designed, for the wrong person, which is why access logging and override review matter at least as much as the technology. A fourth mode is the most ordinary of all, and it involves no attacker, no misconfiguration and no misuse: the platform you already trusted, holding only data you gave it willingly, volunteering an inference you never asked for. In September 2026 an Instagram user posted a video of herself singing in the car with her daughter and Meta AI offered her the prompt "Who is the child passenger?" — following it, she says, assembled her children's ages, where the family lives and a photo she believed she had deleted years earlier, drawn from her own past posts and her relatives'. Meta said the feature "never should have prompted the individual with questions like that" and has changed it, while maintaining the assistant only surfaces content the asker could already reach. Take that defence seriously, because it is probably true and it is also the point: every item was individually visible to her, and the harm was in the aggregation and in the unprompted offer to perform it. Consent given piece by piece over years does not amount to consent for a model to assemble the pieces on demand, and no permission dialog in use today asks that question.