Chat Control Vote, In-Car Cameras & Health Data Suits (07/07/2026)

Every story in today’s privacy roundup asks the same question: who gets to watch you, and did anyone ask first. The EU Parliament moved to fast-track a vote on scanning private messages before they leave your phone. New cars in Europe now come with a camera pointed at the driver’s face. And a health-tech company must face trial over piping patient data to Google. None of these waited for consent.

Top 5 Critical Privacy Alerts

1. EU Parliament Fast-Tracks a Chat Control Vote

The European Parliament narrowly voted 331 to 304 to use an urgent procedure that fast-tracks a Thursday vote on extending the EU’s temporary regime for scanning private messages to detect child sexual abuse material, the rules critics call Chat Control (Heise). The regime permits client-side scanning, where content is checked on the sender’s device before encryption protects it, and the procedural move raises the bar for rejecting it. Scanning a message on your device before it is encrypted weakens the promise of encryption for everyone, not just the people under suspicion.

Operator Note: Client-side scanning turns every private device into a checkpoint. If your people handle sensitive material, the threat model now includes the phone itself, not just the network it rides on.

2. Every New EU Car Must Watch the Driver’s Face

New rules require every new car sold in the European Union to carry a driver-monitoring camera that tracks the driver’s attention and face (All About Cookies). The stated goal is safety, and distracted driving is a real harm. The privacy cost is that a biometric sensor now sits in the cabin of every new vehicle by default, and where that footage goes and how long it lives are decisions made by manufacturers, not drivers.

3. Health Data Sharing Suit Against Veradigm Advances

A court refused to dismiss a proposed class action alleging that health-technology provider Veradigm shared patients’ health information with Google without consent, in violation of state and federal privacy law (PogoWasRight). Health data is the most intimate record a person keeps, and routing it to an advertising company treats a private medical fact as a marketing signal. The tracking tag someone added years ago is now the evidence in a lawsuit.

Operator Note: If your systems touch health data, inventory every third-party tag and SDK now. The pixel you forgot is the liability you will litigate.

4. Supreme Court Lets Texas App Age-Verification Law Take Effect

The Supreme Court declined to block the Texas App Store Accountability Act, letting a law that requires app stores to verify users’ ages take effect while the case continues (The Record). Age verification sounds narrow, but in practice it means collecting identity documents or biometric estimates from every user, including the adults the law was not written to protect. A rule meant to shield children ends up building an identity database for everyone.

5. Meta’s Muse Image Can Pull Other People Into AI Photos

Meta’s new Muse Image model, now powering AI image tools across Instagram, WhatsApp, and the Meta AI app, can insert other Instagram users into AI-generated photos (The Verge). A person’s face and likeness are becoming raw material for images they never posed for and never approved. When your likeness can appear in a scene you were never in, the harm is reputational and hard to undo.

Additional Privacy Alerts

Data Minimization & User Consent

• Patients sue healthcare corporations over data handling: A wave of class actions accuses large healthcare companies of exposing or sharing patients’ personal and health information. PogoWasRight
• EFF on automated moderation: The group argues that platform moderation by algorithm is here to stay and needs transparency and a real path to appeal. EFF

Regulatory Fines & Enforcement Actions

• FTC returns $2.7 million to gig workers: The agency is sending checks to consumers harmed by Handy Technologies’ deceptive earnings claims. FTC
• Predator spyware victims file 8 million euro suit: Greek victims are suing the spyware maker as campaigners press the EU to act on spyware abuse. The Register

The Axe Report is a daily briefing from Grab The Axe. Need help assessing your organization’s security posture? Take our free Human Attack Surface Score assessment.