The Agents Are Sending Mail Now (09/15/2026)

Spam has always been an economics problem. It works because sending is nearly free and the recipient’s attention is not, and every defense built over thirty years has been an attempt to reintroduce a cost. An agent platform that generates plausible individual messages at machine speed removes the last of that friction, and the mail arriving now is not even trying to sell anything.

Top 5 Critical Privacy Alerts

1. An Agent Platform Is Flooding Inboxes With Work Nobody Requested

Reporters documented an AI agent platform whose agents perform unrequested tasks for strangers and then message them asking for payment, producing a worldwide flood of unsolicited mail. The messages are individually plausible, which defeats the volume and template heuristics most filtering still leans on. The category this belongs to has no established name yet, since it is neither fraud nor advertising, and the systems built to sort mail have no bucket for a machine that decided to be helpful at you. 404 Media has the reporting.

Operator Note: Your inbound mail rules were tuned against economic senders who need a response rate, so expect the assumptions underneath your filtering thresholds to degrade over the next few months.

2. The EU Moves Toward a Minimum Social Media Age of 15

The European Commission is preparing to propose bloc-wide rules setting a minimum legal age of 15 for social media use, with tiered restrictions for younger users. A minimum age is a verification requirement wearing different clothes, because the only way to enforce one is to establish the age of every user rather than the ones below the line. We have spent several weeks covering what happens to identity documents once somebody collects them at scale, and this proposal creates the largest single occasion for that collection yet. Biometric Update has the proposal.

3. Google Is Guessing Ages in Canada Rather Than Verifying Them

Google began rolling out age inference on YouTube in Canada using its own machine learning to estimate user age, in preference to privacy-preserving age assurance technology certified against international standards. Inference avoids collecting a document, which is a genuine privacy gain, and it substitutes a behavioral profile detailed enough to guess how old somebody is. Neither approach is free, and the tradeoff is being made by the platform rather than by the user or the regulator. Biometric Update has the rollout.

Operator Note: If you are evaluating age assurance for your own product, ask each vendor what it retains and for how long, because inference and verification fail in completely different directions.

4. A Decoy Camera Was Worth Less Than the Charges Suggested

Three felony charges against a man who destroyed a 3D-printed decoy plate reader camera were reduced to two second-degree misdemeanors after the state conceded the object was not especially valuable. The original charging decision treated the destroyed item as though it were a functioning surveillance unit, and the correction came only when somebody asked what had actually been broken. Charging severity that tracks the symbolism of a target instead of its value is worth watching in a period when this equipment is drawing organized opposition. 404 Media has the case.

5. California Fines Data Brokers as Colorado Drafts AI Rules

The California Privacy Protection Agency issued fines against data brokers while Colorado published proposed AI regulations, two actions that anybody buying internet or social advertising should read together. Enforcement against brokers reaches the supply side of the advertising data most companies purchase without examining, and the Colorado draft signals where automated decision rules are heading. Both land on organizations that think of themselves as advertisers and have never considered themselves data processors. Data Protection Report has both actions.

Additional Privacy Alerts

Identity and Authentication

• UK pubs can now legally accept digital proof of age: Licensed premises across England and Wales gained the option for alcohol sales, which moves digital identity into an everyday transaction with no obvious fallback for people who lack it. Biometric Update
• GOV.UK One Login is expanding passkey sign-in: Users can authenticate with a face or fingerprint scan or a device passcode after a successful trial. Biometric Update

Enforcement

• FTC v. Kochava is being read as a sensitive data blueprint: The decision locks in sweeping terms and answers the question of whether companies need to worry about sensitive data outside states with privacy statutes. Fox Rothschild

The Axe Report is a daily briefing from Grab The Axe. Need help assessing your organization’s security posture? Take our free Human Attack Surface Score assessment.