Deeplinks

Yesterday, along with the ACLU, EFF filed an amicus brief in the Ninth Circuit court of appeals in United States v. Spurlock, a case involving a “tower dump” warrant. These overbroad warrants require cellular providers to turn over location data about every phone in a given area at a given time. This is the first such case to be heard by a federal appeals court since the US Supreme Court ruled this summer that highly similar “geofence” warrants are searches under the meaning of the Fourth Amendment.

Spurlock involves an investigation into two murder victims discovered on the side of a rural California highway. Police also found a car belonging to one of the victims several miles away on the same highway. They quickly sought a tower dump warrant for an area covering this stretch of road, which eventually revealed location data on nearly 1,700 unique phones. Faced with a motion to suppress, the district court relied on a Fifth Circuit court of appeals decision about geofence warrants to hold that tower dumps are similarly categorically unconstitutional “general warrants” that violate the Fourth Amendment. However, the court refused to suppress evidence on the basis of the “good faith doctrine.”

Our amicus brief on appeal makes several key arguments.

First, we point out that the Supreme Court’s decision in the geofence case Chatrie v. United States this summer only strengthens the arguments that tower dumps are unconstitutional general warrants. Tower dumps are a somewhat older technique than geofence warrants, but they are both “reverse location searches,” in which police “tap into an all-encompassing database, allowing them to undertake nearly perfect, retrospective surveillance of countless persons and places.” This is the sort of untargeted “general warrant” the framers of the Fourth Amendment wanted to prevent. As we write in the brief, “Searching all people in an area without probable cause to believe they were all involved in the criminal activity under investigation reproduces the evils of general warrants and is not constitutionally permitted.” It’s this rule of law that prevents police from searching the houses of a hundred, or even a thousand people in the vicinity of a crime.

Second, we note that even if high courts continue to allow tower dump and geofence warrants in any cases, core Fourth Amendment law requires strict limits to protect the privacy of innocent bystanders, including limits on the scope and duration of the warrants, as well notice to affected individuals and after-the-fact deletion and minimization of irrelevant data.

Finally, we argue that the Fourth Amendment requires the court to set aside the good faith doctrine in cases like these and actually decide the constitutional issue. Too often courts pass the buck in cases involving novel surveillance techniques, leading to situations where police can continue using the technique for years or even decades without a definitive ruling.

Whether they call it AI summaries, knowledge panels, or AMP, Google takes actions that are less about functionality and more about locking you into its own ecosystem. Knowing that makes it possible for all of us to choose better services than Google's, defeating their anticompetitive goal. In this case, as it is so often, knowledge is power.  

In the old days, when dinosaurs roamed the earth and getting online involved your computer making eldritch shrieking, Google was a website that took whatever you typed in and gave you a list of links that best matched what you were searching for. As it's grown beyond that, however, the core function of Google Search has moved from giving you the best answer to your query to a number of other things, most of them about making money for Google. 

This is obviously not a new observation. It's at the core of what EFF Special Advisor Cory Doctorow named "enshittification." But it's important to remember that whatever shiny new name or technology is wrapped around these tools, it's not about the wrapping, it's about the monetization. 

In the case of Google Search, the company has a history of rolling out new "features" that are less helpful to the searcher and more designed to keep you and your data within the Google ecosystem. One easy example of enshittification is putting sponsored links and ads at the top of search results, forcing you to scroll down past a bunch of not relevant links to get to your answers. Or, in some cases, accidentally clicking on sponsored links that might be designed to give you the opposite information of what you're looking for or for a competitor to the product you intended to buy.  

The other clumsy version of this is Google's self-preferencing, where Google's own services—say YouTube if you're looking for a video—are weighted so that they appear at the top of a search over a competitor's. Similar to this was Google's push for websites, particularly news ones, to be made available via what it called "Accelerated Mobile Pages" or AMP, which in theory stripped out features that might make loading a page on mobile too slow, but also handed over control of how webpages looked on mobile to Google and turned mobile links, often by default, into Google links.  

But the other way that Google has historically kept your—and your valuable eyeballs—on its website has been to just obviate the need to even click on a link and leave Google at all. The first version of this was what Google calls "knowledge panels." These are snippets of information shown on the results page of a search that purport to answer your question. Knowledge panels predate the AI push and haven't always been what you could call accurate.  

Knowledge panels are extremely similar to the AI summaries we now see at the top of Google Search results, except that instead of pulling quotes from specific linked sources, it's the AI doing the summarizing, though also sometimes with links. They are basically the same thing, mostly changed only in branding, because AI is now the cool kid on the block. The goal is essentially the same—it's less about providing you with the best answer to your query and more about making you think it's unnecessary to click a link and leave Google's ecosystem. And, more importantly, it keeps you on Google's pages longer to read the content. More time on the page is more time exposed to ads and sponsored links and more money for Google.  

The biggest irony here is that it didn’t even work. People choosing to use “AI mode”—and possibly made accustomed to getting information as text instead of links through the knowledge panels and the AI summaries at the top—has caused “lower monetization” via ads. Ads, remember, are Google’s main source of revenue. Like newspapers before them, Google is finding that counting on a monopoly on ad space maybe isn’t the most sound strategy in a shifting technological landscape. And to get out of the hole it has made for itself, it is lighting cash on fire to try to get back on top. Perhaps they should consider pivoting to video.  

Every time you see a feature like this, no matter what it is called or what "new" technology they claim fuels it, remember that it is Google's monetary incentives that drive the decisions and not necessarily the tech itself. And you can always choose to ignore it, scroll past, disable it, or even go to another service entirely.  

The U.S. Postal Service used social media surveillance to monitor and report on protests across the political spectrum, government records show.

The records, disclosed to EFF and other requesters suing the postal service under the Freedom of Information Act, show that the agency’s internet Covert Operations Program, or iCOP, routinely sifted through social media posts organizing and discussing protests with little records of any oversight or legal justification.

EFF filed suit in 2021 after Yahoo News disclosed the program’s existence and how the agency used it to monitor First Amendment protected activities. After years of delays and technical failures that led the agency to lose access to a trove of emails discussing the program, the postal service disclosed records to EFF and several other requesters this year.

The disclosures include a series of bulletins created from iCOP, which show that the postal service used the program in 2020 and 2021 to monitor and circulate information about a wide range of planned protests. They included a planned “Million MAGA March,” a guns rights advocacy event and counter-protest in Virginia, a nationwide Save the Post Office Saturday protest, and planned protests in front of then-Postmaster General Louis DeJoy’s home in Washington, D.C.

Many of the bulletins provide dry descriptions of the events being planned and reference public discussions or events on major social media services. Others seem to imply or anticipate that the protests would turn violent.

For example, in discussing planned national and international protests scheduled for March 20, 2021, the bulletin references potential violence in light of “online inflammatory material.” Yet the bulletin acknowledges that the agency has “no intelligence to suggest specific threats.” This bulletin was described by Yahoo News when it disclosed iCOP’s existence.

Another bulletin discussing an ongoing Black Lives Matter protests in response to police shooting and killing people styles itself as a “National Civil Unrest Update.” The bulletins also recount and monitor threats sent to then-Postmaster DeJoy.

The Postal Service also disclosed three email chains to EFF that, while heavily redacted, show how the agency queried iCOP and disseminated what it found (Read the emails here, here, and here). The government agreed to release the email messages as part of settling EFF’s FOIA suit this fall. To EFF’s knowledge, they are the only existing materials that reflect how the agency queried iCOP.

According to the agency, after Yahoo News disclosed the program in 2021, the postal service renamed it and publicly said that it had stopped issuing bulletins. But the documents do not say that the agency’s social media surveillance stopped.

At the same time, EFF and several other FOIA requesters sought records detailing how the agency used iCOP and what rules the postal service had for using the program and distributing information it gained from surveilling social media. EFF spent years pushing the agency to disclose email communications about the program, which the agency had stored on an external hard drive. Amid these negotiations, someone dropped the hard drive, rendering it inoperable, agency officials said. By the time that happened, the agency had already deleted the underlying email messages pursuant to the agency’s retention schedule.

EFF’s FOIA request sought internal rules, guidance, and training that would show what safeguard the Postal Service imposed to protect First Amendment rights. The agency disclosed very few documents in response to this part of EFF’s request.

For example, a series of slides give an overview of the program, but do not explain how officials used iCOP. The closest thing to internal guideline that the agency disclosed were talking points the Chief Postal Inspector authored in response to questions about iCOP.

The inspector wrote that, “In reviewing social media postings to gather information we did not single out any particular group and did not base what was reviewed on race, religion, gender, sexual orientation, immigration status, or a person’s exercise of First Amendment freedoms.” The statement echoes language in the bulletin stating that its purpose is not to infringe on First Amendment rights; Other parts of the talking points characterize the surveillance as providing officials with situational awareness.

The postal inspector’s talking points go on to say that “the recent attention on iCOP has highlighted opportunities for improvement, including enhanced executive oversight. We have stopped the distribution of the bulletins like the one you have seen in the media reports.”

Setting aside that it’s unclear whether internal oversight occurred or resulted in any changes, the claim that iCOP did not infringe on First Amendment rights rings hollow. As the records disclosed show, surveilling and reporting on social media users’ efforts to organize rallies and protests was a feature of iCOP.

But more fundamentally, the claims by Postal Service officials fail to recognize that surveillance directly chills First Amendment rights. Further, the government can misuse the information it obtained as part of its social media surveillance to harass or retaliate against those exercising their constitutional rights.

Although EFF’s case seeking records about iCOP has ended, we will continue to bring more transparency to the government’s use of social media surveillance and look for ways to challenge the practice, especially when people are caught in the dragnet for exercising the First Amendment rights.

The government’s surveillance powers grew rapidly after Sept. 11, 2001, some in public view and some in secret. EFF suspected but couldn’t prove that the National Security Agency was spying on Americans' communications. The New York Times sat on a story about it for over a year, finally publishing it in December 2005. Then, in January 2006, a retired AT&T technician named Mark Klein walked into EFF's office with a manila folder of documents that blew the story wide open. 

Welcome to the third episode of “Privacy’s Defenders,” a podcast about the people – lawyers, journalists, hackers, and others – who’ve fought to secure your digital liberties since before most people even knew what the internet was.

(You can also find this episode on YouTube.)

In this episode, former EFF Executive Director Cindy Cohn talks with former EFF lawyer Kevin Bankston, who was at his desk drafting a lawsuit against AT&T when Klein showed up. Less than two weeks later, EFF sued the phone company on behalf of its own customers in Hepting v. AT&T. Cindy speaks again with now-retired Justice Department lawyer Tony Coppolino, who asked for the opportunity to defend the case. He called EFF with a warning after Klein’s documents were filed in court: If they were classified, EFF would be in big trouble. You’ll also hear from Klein himself, and from Carolyn Jewel, a romance novelist and AT&T customer who became the lead plaintiff in EFF's related case against the NSA. 

It's the story of a secret room in a San Francisco phone company building, a heroic whistleblower, and the people who refused to let mass surveillance stay hidden. 

The “Privacy’s Defenders” podcast is a follow-up to Cindy’s book, “Privacy’s Defender: My Thirty-Year Fight Against Digital Surveillance,” bringing to life pivotal moments in the voices of those who fought for your rights. Sales of “Privacy’s Defender” benefit EFF, so pick up your copy today!  

Joanne Elgart Jennings co-produced and created this podcast.   

Jarrod Sport co-produced, mixed, and mastered it.   

Corinne Ruff is our story editor. 

We had additional help from Rachel Estabrook and Alison Broverman. 

The original music was composed and performed by Nat Keefe of Hot Buttered Rum with Ben Andrews on the fiddle. 

On November 11, Lina Attalah, founder and editor-in-chief of the independent Egyptian news outlet Mada Masr, will face trial for the second time in just two weeks. This time, she faces charges of spreading false news, an accusation that has become one of the Egyptian government's most frequently used tools for prosecuting journalists. 

The trial follows a conviction on October 27, when Attalah was found guilty of managing an unlicensed news website. The Mada Masr team had repeatedly applied for a license, but their attempts went unacknowledged. The proceedings took place in a single hearing, which Mada Masr states included serious violations of her right to a fair trial. She was sentenced to the maximum fine of 3 million Egyptian pounds (approximately 55,000 USD), forcibly removed from the courtroom, and held for seven hours until the fine was paid. The court also ordered Mada Masr's closure and the confiscation of all equipment belonging to the organization. 

The current wave of repression has also targeted Matsada2sh, a fact-checking and open-source intelligence initiative. Its entire six-person newsroom was violently arrested, illegally detained, and interrogated under torture before being charged with terrorism-related offenses and spreading false news. The team remains in pretrial detention. 

According to CPJ, at least 25 other journalists are currently incarcerated in Egypt. 

Governments seeking to control the flow of information increasingly rely on a combination of legal harassment, financial pressure, criminal prosecution, and restrictions on the infrastructure that makes independent publishing possible. Egypt's media licensing regime is a particularly troubling example. Requiring news organizations to obtain government authorization to operate creates an obvious mechanism for restricting who gets to publish and whose voices are allowed to reach the public.  

The charge of spreading false news is similarly dangerous. Governments around the world have increasingly invoked the language of misinformation to justify restrictions on speech, often without meaningful safeguards against political abuse, as we laid out in our recent submission to the United Nations Office of the High Commissioner for Human Rights. Governments should never be the arbiters of which reporting is permissible, particularly when that reporting concerns their own conduct. 

Founded in 2013, Mada Masr has spent more than a decade doing the kind of journalism that authoritarian governments find most threatening: documenting abuses, amplifying marginalized voices, and reporting on issues that powerful institutions would prefer remain hidden. 

Its reporting has given torture survivors and the families of political prisoners a platform. It has opened space for debate about reproductive rights. It has brought frontline reporting from Sudan and Gaza, and stood alongside refugees facing xenophobic attacks and security crackdowns. 

Emerging as a digital-first publication, in a media environment where traditional outlets were increasingly constrained, being purely digital allowed Mada Masr’s founders to build an independent publication outside the structures of legacy media.  

At a time when only 43% of Egyptians had access to the internet, going fully digital meant taking a big risk, but it was one that has been rewarding: Despite being blocked by the Egyptian government since 2017, Mada Masr has continued to reach Egyptian and global audiences, and Attalah has received numerous accolades, including the Knight International Journalism Award, the Ordre des Arts et des Lettres, and a spot in TIME Magazine’s 100 most influential people (2020). 

Mada Masr has also consistently engaged with technology and advocated for a free and independent internet for the global majority. It has covered dozens of hot-button tech stories in recent years, from Egypt’s Cybercrime Bill and Israel’s use of AI weaponry in Gaza, to stories about the “privacy chaos” caused by biometrics to more personal essays about the importance of the internet and tech. In August, they launched an open call for proposals on original critical reporting on artificial intelligence. 

Mada Masr may be thoroughly Egyptian, but it doesn’t belong just to Egypt. Its team has made into a publication that represents the kind of independent, local, grounded journalism that international audiences need, particularly at a time when international reporting on state repression is lacking. They built on-the-ground networks to center local voices in Sudan (publishing in both English and Arabic on the conflict) and Gaza out of a sense of cross-border responsibility and solidarity. 

This is precisely why its potential closure should concern everyone who cares about a free press. The ability to publish independently, investigate powerful institutions, and to share information without government interference is fundamental to the exercise of free expression.  

The international community has repeatedly expressed concern about restrictions on press and internet freedom in Egypt. More than 100 organizations have now joined statements of solidarity with Mada Masr, and with Matsada2sh.  

These expressions of support matter, particularly when journalists are increasingly isolated and under threat—but solidarity must also translate into sustained political and institutional pressure. 

The international governments and institutions that maintain relationships with Egypt—including those in the European Union, the United Kingdom, and the United States—should make clear that the prosecution of journalists and the forced closure of independent media outlets are unacceptable.  

The cases against Lina Attalah, Mada Masr, and Matsada2sh must be dropped. The journalists who remain in detention must be released. And Egypt's licensing regime, with its profound chilling effects on access to information and independent knowledge production, must be brought to an end. 

There is a particular urgency to defending independent media at a moment when governments are finding ever more ways to restrict the circulation of information. Whether through internet shutdowns, platform restrictions, surveillance, or the criminalization of reporting, the result is often the same: fewer opportunities for people to understand what is happening around them, to challenge official narratives, and to hold power accountable. 

We cannot allow the closure of one of Egypt's most important independent newsrooms and the prosecution of its editor-in-chief to become another routine episode in the global erosion of press freedom. Nor should we wait until the last independent journalists have been silenced before recognizing what has been lost. 

To learn more about Lina Attalah in her own reads, you can read our Speaking Freely interview from January 2026. 

In courts across the country, publishers and creators are suing large AI companies for training generative AI models on copyrighted works. It’s easy to see these cases as a David-and-Goliath showdown between authors and publishers fighting for a cut of Big Tech company profits. But this fight is actually much larger. It affects billions of people who aren’t represented in the case at all, including researchers, artists, activists, journalists, people with disabilities, and anyone who accesses and shares content online.   

That’s why EFF is stepping in to defend the public’s rights in these cases. Today, EFF filed an amicus brief in In re OpenAI, explaining how the court’s ruling on fair use could impact people worldwide. If fair use gets narrowed, it will impede work that benefits the public, like medical research and investigative journalism, and even limit access to privacy protection tools.

Let’s be clear: creators and workers deserve support as AI changes their fields, and Big Tech companies must be held accountable for the harms they cause. But giving copyright holders more control over the web won’t accomplish either of these goals. If the plaintiffs prevail in these cases, courts would have to rewrite copyright law in ways that hurt everyone except powerful media and tech companies.

Copyright exists for one reason: to stimulate creativity and innovation in service of the greater public good. Unfortunately, the plaintiffs in this lawsuit are arguing to limit everyone’s fair use rights, in ways that would thwart the basic purpose of copyright. The harms of shrinking fair use will go far beyond generative AI, impacting everyone.

Initial speculation that AI models would be infringement machines, churning out works highly similar to those on which they were trained, has proven unfounded. And courts have already found fair use in cases where copyrighted works were used to train generative AI models, recognizing that training uses those works for a fundamentally different purpose.

Plaintiffs in these cases argue that, even if the use is transformative, using their works to train AI is still unfair, because the AI models could generate new, non-infringing works that might compete with plaintiffs’ own works. They also argue that scraping or downloading the data without permission—or in some cases, from websites containing infringing copies—was independently infringing and/or rendered any subsequent uses of that data unfair.

These arguments would put beneficial research and reporting at risk. First, if copying without permission rules out fair use, the law will never protect transformative uses that benefit us all. Researchers, journalists, and other watchdog groups gather information the same way AI companies do—but they do it to serve the public interest, and often to hold Big Tech itself accountable. For example, journalists and nonprofit researchers have used “crawling” or “scraping” to investigate potentially anticompetitive practices by tech companies, and research misinformation and hateful content posted on X. Their data acquisition techniques are virtually identical to those used by AI giants—but they lack those companies’ deep pockets.

Requiring users to show that copyrighted material was lawfully obtained would also threaten everyday internet use. As EFF’s brief explained, that requirement would “cast legal doubt on the billions of copies we collectively make every day through routine online activities like opening emails, clicking on an embedded link, visiting websites, sharing pictures, streaming music, and watching videos. All of this activity requires intermediate copying.”

Fair use is what lets us all use the internet without being compelled to track the source of every image, video, and article that we click on, and make sure the rights are all cleared.

Additionally, while rightsholders are understandably concerned about competition from AI generated works, copyright law exists to promote new creation, not protect authors who published first. Under the plaintiffs’ theory, no one could stand upon the shoulders of giants. Copyright could prevent people from writing new books inspired by themes in a favorite novel or genre, or prevent academic researchers from publishing literature reviews that distill insights from prior research—simply because readers might prefer those new publications over those that came first.

Finally, general-purpose AI models are neither designed nor usually used to create works targeted at any particular market. These models have been used to generate new insights and tools for medicine, science, journalism, art, and accessibility. For instance, an AI-powered tool called Be My AI uses Open AI’s GPT models to provide visual descriptions for people who are blind or have low vision. Generative tools have also accelerated scientific research, and researchers have used these tools to develop new medical treatments and medications for conditions previously thought to be incurable.

Some creators and publishers argue that AI developers should just get a license. But requiring permission for every work used would give the largest companies massive advantages over small competitors and impede academic research. As Professor Lawrence Lessig recently noted:

If all training requires a license, then none but a handful of tech giants will be able to afford the costs of training. That’s not because authors are greedy but because the copyright system is the least efficient property system known to man.

Moreover, creators are unlikely to benefit from these licensing arrangements in many cases. Media and entertainment giants have exploited the imbalance between themselves and underpaid working artists for decades. Trying to help creators by giving them more rights under copyright is, as Cory Doctorow has written, like trying to help a bullied kid by giving them more lunch money for the bully to take. Artists aren’t getting good deals from record labels or publishers now; there’s no reason to think these companies, which already own the copyrights, will treat artists more fairly once they control the data that powers AI.

AI technologies will affect all of us, and copyright law is ill-equipped to address many of these consequences. The rules governing these technologies should be rules that serve the public—not just the small number of companies that can afford to litigate copyright battles for decades, or settle for billions.

Developers of virtual private network (VPN) apps are reporting that their products are again being pulled from Apple’s App Store in Russia. This is an unacceptable crackdown on a vital tool to protect privacy and speech online.

Why? VPNs give people a way to control their own online activities. When you visit a website through a VPN, that website only sees the VPN server's location (well, IP address) rather than your actual location. It's like sending a letter through a P.O. box so the recipient doesn't know where you really live. It can also disguise where you’re accessing information from, which can make it possible to access information banned by your government.

This is an unacceptable crackdown on a vital tool to protect privacy and speech online.

Going after tools that give people the space to communicate and access information freely is a common tactic from the totalitarian playbook. This latest demand comes after several steps the Russian government’s taken to surveil speech specifically on Apple products. In 2024, the Moscow Times reported that Russia’s state media watchdog, Roskomnadzor, went after VPN apps on the Apple App Store, after banning access to Western social media platforms and blacklisting opposition media sites. Russia then blocked Apple’s FaceTime software in 2025, according to Apple Insider.

Bloomberg also recently reported that the Russian government has added Apple and Microsoft to its state surveillance registry. This gives Roskomnadzor access to local users’ correspondence, Apple Insider reported, and puts both companies in a position to turn over customer information to the country’s security services as required.

With government control encroaching on their devices and less access to tools that give them alternate methods, people in Russia are left with shrinking options to communicate online or find information that isn’t state-sanctioned.

While Russia’s actions offer a more extreme vision of what happens when the government tries to enforce speech rules by attacking vital privacy tools, it is far from the only government doing so. Several states in the U.S., bent on making it difficult to circumvent invasive age-gating laws, have suggested banning VPNs—either to access certain content or in some cases to simply ban them outright. EFF has publicly (and loudly) criticized these proposals, because going after VPNs is a dangerous step down the road of censorship.

Attacks on speech and privacy online are deeply troubling, no matter where they happen. What those in power may see as a “loophole” in their invasive laws is actually an expression of user control. We’ll continue to speak out when we see governments going after them to take that control away.

In today’s digital world, the internet is an essential resource for young people to access information, explore community, and find themselves. But we know that this often comes alongside fears of experiencing online harms like doxxing, grooming, or bullying.

Trying to protect your family from everything all the time is impractical and exhausting, but some thoughtful planning can help families devise a workable plan that meets their needs and addresses their concerns.

That’s why this Digital Parent Week, we’re sharing easy tips on how parents and their children can work together to co-curate a digital safety plan that helps all members of the family enjoy the benefits of technology while protecting their online privacy and safety. 

Online safety begins with communication, not just restrictions. Talk with a young person about how they use the internet: their favourite apps, games, and social media platforms for example. Creating a supportive environment helps young people feel comfortable asking for help if something goes wrong online.

Together, you can think about:

It's easy to think of a young person's experience on the internet as being totally disconnected and different from your own. But now is a great time to also interrogate your own internet habits, like the sorts of sites you engage with, tools you use, and privacy settings you've set. These questions are as valuable to help you as a parent as they are just an internet user.

Sometimes even just figuring out what conversations are worth having can take some effort, we've put together some ideas to get you started in our guide.

Digital security training can feel overwhelming but this is why a community-oriented approach helps. In speaking with your family and friends, you can build out digital security practices that work for you. This makes it more likely that your privacy practices will become second nature to you and your loved ones.

Use secure messaging services for every communication: Choosing a secure service ensures that your privacy is protected from government and corporate surveillance. If you can convince your family to get on board, options like Signal provide the most extensive privacy protections out of the box through its use of end-to-end encryption and limited data collection. But we understand that sometimes it's easier to stick with whatever the family already uses for a group chat, like WhatsApp, Apple's iMessage, or Google Messages, so take the time to familiarize yourself with the limits of WhatsApp and RCS encryption.

Consider the content posted online: It's easy to accidentally share personal information through photos, messages, and other content. Children and adults may unknowingly share personal information through photos, messages, location settings and app permissions. Take time together to review privacy settings, check which apps can access the camera or location, and discuss why personal details should be shared carefully. Make sure you have family agreement about when and where to post photos of each other or your home.

Create incident response plans: Developing a plan for if or when something bad happens is a good practice for anyone, but especially with younger people. It’s important to strategize with your family around what to do in the event of such things happening, and doing so before an incident occurs is much easier than when you’re presently facing a crisis.

Alongside this, simple steps like using strong and unique passwords on all devices, including those that are shared in the family, can make a real difference. Regardless of age, there’s no time like the present to get started on good security hygiene, and for many that starts with a password manager and two-factor authentication.

Many sites permit parents to control features such as personalization, algorithmic feed, autoplay, endless scroll, reactions, notifications, and time limits. Talk as a family about which features are important and useful and which are problematic. The conversations above around boundaries and digital literacy are a more effective way to prepare youth for accessing the internet. To develop true autonomy, young people need the privacy to discover the world for themselves without their parents monitoring the contents of every conversation they have.

Explore new apps together and revisit family rules as they grow. These decision points where you’re exploring with a young person what you’re both comfortable with can be good moments to “find your way to a yes” for whatever feature or tool or game they’re asking about. The questions they ask, along with your responses, provide a road map for what to look for in privacy controls that can get you to a place where everyone is comfortable engaging with that technology. 

There is no one size fits all to the tech questions and concerns a parent will face, and keeping young people safe online is not about removing every risk and monitoring every click. This Digital Parenting Week, you can start to focus on what’s important for your family and how to best achieve those goals. 

If you're still not sure where to start, installing EFF’s Privacy Badger on every computer in your household is a great starting point to protecting everyone's privacy.

For more detailed information on all these tips and more, visit EFF’s Online Privacy Guide for Parents and Youth.

In the most recent update to Apple’s devices, iOS 27.2, the company has introduced a new setting to “Exclude Apps” from Siri AI, fulfilling one of our asks from our Encrypt It Already campaign earlier this year.

One of our main concerns with new AI features on devices is how those features interact with end-to-end encrypted content, particularly with secure messaging apps. Many AI features require cloud processing, and despite privacy protections engineered into these systems, the content of secure messaging apps may leave a user’s device without their knowledge. That changes the privacy concerns around using those tools. In a perfect world, users would be able to put a barrier up to ensure data from certain apps doesn’t leave the device. Here was our initial ask:

You should be able to tell the operating system’s AI to not access an app, even if that comes at the “cost” of missing out on some features. The setting should be straightforward and easy to understand in ways the Gemini and Apple Intelligence controls currently are not.

At launch, we found the settings to control Siri AI’s app access behavior pretty confusing. You had to toggle several options to block Siri AI off from accessing an app, or disable Siri AI entirely. Turning off Siri AI and reverting to Siri Classic is, for now, still a good option if you’d prefer to use the older version.

The most recent update is far more clear and does more to protect your data. And, just as expected, it comes at the cost of some features. That’s a good thing, actually. The features not working shows that the new setting is effective. 

Here’s how to add apps to the exclusion list, once you’ve updated to 27.2:

Now Siri AI cannot access the contents of the app. Excluding an app also means you may lose some features. For example, if you exclude the Apple Messages app, you will no longer be able to have Siri AI read or respond to messages for you. Even the “onscreen awareness” feature, where you invoke Siri and ask it for information about what you’re currently looking at, will not work anymore. For example, if you exclude Signal, you cannot invoke Siri and ask it to discern any information in the Signal app. You’ll just get these messages:

This update from Apple is also a good excuse to check in on the process on Android. It has improved a little, but is not as straightforward as Apple’s new settings, and lacks the ability to set the screen context feature per-app. But you do have some control over what Gemini can access: 

This process seems to work well enough for some data and we like that it’s opt in, but it’s not exactly intuitive. For example, Signal doesn’t appear there because Signal doesn’t support Gemini’s app access feature at all. That means Gemini can’t access the content of Signal directly, which is good. 

But Gemini can read notifications if you’ve enabled the “Device Assistance” Connected App (which you likely have, since that also enables basic features, like setting a timer—check under Settings > Personal Intelligence > Connected Apps), and it can use screen context unless you’ve disabled the Device controls > Screen context > “Use screen and app data” option in the Gemini Settings. These two features may access the contents of the Signal app or notifications, if you choose to use them. We’d prefer a more hard-lined approach that reduces the chances of user error here: Google should give users the ability to turn these features off per app.

Apple clearly understands that some users want stronger controls over what Siri AI can and cannot access. But we think they should go further and offer the option to only use “on device” AI features, similar to what Samsung offered with its Galaxy AI. We’re happy to see this change and think all operating systems need to consider similar controls moving forward.

A federal appeals court should curb the government’s abuse of grand jury subpoenas to unmask social media users who criticize lawless immigration enforcement.

That is the message from the ACLU, EFF, and other civil liberties and trade groups who filed a friend-of-the-court brief in a sealed case in the U.S. Court of Appeals for the District of Columbia.

The case involves the government’s investigation of an anonymous Reddit user who commented on a post about an immigration officer in Minnesota. The Department of Homeland Security (DHS) first issued an administrative subpoena to Reddit to unmask the user. When the user challenged the subpoena in court on free speech and statutory grounds (as many others have), DHS withdrew it. But then the government obtained a separate grand jury subpoena—a subpoena issued by a prosecutor to gather evidence to present to a grand jury before any criminal charges are filed—for much of the same information. The user then challenged the grand jury subpoena too, and the case is currently being appealed.

The right to speak anonymously is essential. It preserves privacy and shields critics from government retaliation. In the past year, the Department of Justice (DOJ) has issued grand jury subpoenas to social media companies for their users’ personal data. This is frequently done for improper purposes and without really showing that social media users have committed any crime. These subpoenas have the effect of intimidating and chilling critics, as immigration authorities have engaged in invasive, unconstitutional, and sometimes violent conduct.

As the amicus brief makes clear, courts should not defer to the government’s claims regarding the legitimacy of using grand jury subpoenas to unmask internet users. Instead, the subpoenas must receive proper First Amendment scrutiny. Like many other types of legal processes, grand jury subpoenas are issued by federal officials without prior court approval. And they too can be abused to harass or retaliate against people critical of the government.

The amicus brief was filed in early September and recently unsealed. The brief was signed by the American Civil Liberties Union of DC, EFF, the Center for Individual Rights, the Foundation for Individual Rights and Expression, the Cato Institute, and NetChoice.

It is notable that NetChoice signed the amicus brief. It is a trade group that represents many companies who have received similar subpoenas including Reddit, Google, Meta, PayPal, among others. EFF has called on these companies to do more to defend their users’ speech and privacy rights in the face of these subpoenas.