Facewatch in Shops, Meta's Addictive Design & Leaky VPN Apps (07/10/2026)

Facial recognition just moved from the airport and the police van into your corner shop, and in the UK it will now alert officers the moment it thinks it sees a known offender. The EU is calling Meta’s autoplay and infinite scroll what they are, engineered compulsion, while a US senator tries to legislate against automated systems that decide who gets hired. The connecting thread is that the surveillance and the manipulation both run on the same fuel: your data, collected in ordinary moments, turned into leverage over you.

Top 5 Critical Privacy Alerts

1. Facial Recognition in UK Shops Will Alert Police in Real Time

Civil liberties groups are warning about Facewatch, a system rolling into UK stores including Sainsbury’s and B&M that will flag people it identifies as serious offenders and alert police in real time (The Guardian). A live biometric checkpoint at the door treats every shopper as a database query, and the harm from a false match lands on a person who did nothing but walk in to buy groceries.

Operator Note: Once a face is enrolled in a watchlist, the person cannot patch it, rotate it, or opt out. That is the Human Zero-Day at the level of the population, and the burden of a wrong match sits entirely on the individual.

2. EU Accuses Meta of Ignoring the Mental Health Risks of Addictive Design

EU regulators issued preliminary findings that Meta failed to address the mental health risks of “addictive design” in Facebook and Instagram, naming autoplay and infinite scroll as features that drive compulsive use (The Guardian). Regulators are treating engagement mechanics as a design choice with consequences, which is the honest way to look at a system built to hold attention past the point the user would choose to stop.

3. Senator Markey Unveils an AI Accountability Package

Senator Ed Markey introduced a set of bills aimed at curbing datacenter growth, automated hiring systems, and AI harms to children (The Guardian). The automated-hiring piece matters most for working people, because a model that screens resumes makes a life-altering decision with no one in the room to explain it and no clear way to appeal.

4. Google’s reCAPTCHA Mobile Verification Revives Remote Attestation

The EFF argues that Google’s experimental reCAPTCHA Mobile Verification brings back a remote attestation scheme that is as bad as the last one, letting the platform decide which devices and configurations are allowed to reach a service (EFF). Attestation sounds like security, and in practice it hands the gatekeeper power over whether your device is trusted enough to use the open web.

5. Study Finds 281 Free Android VPN Apps Leaking and Tracking

Researchers ran 281 of the most popular free VPN apps on the Google Play Store through a new testing system and found widespread traffic leaks, unencrypted data, and tracking (The Hacker News). People install these apps to become harder to watch, and many of them quietly do the opposite, which is the worst kind of privacy tool: one that sells confidence while leaking the thing it promised to protect.

Operator Note: A free VPN monetizes the only asset it has, which is your traffic. Treat “free privacy tool” as a claim to verify, not a feature.

Additional Privacy Alerts

Privacy Laws & Regulations

• Bank of England Gains Power Over Critical Tech Vendors: UK regulators can now directly oversee “critical third parties” such as Amazon, Google, Oracle, and Microsoft to enforce cyber resilience across the financial system, a rare move to hold the infrastructure layer accountable rather than only the banks on top of it. The Guardian

The Axe Report is a daily briefing from Grab The Axe. Need help assessing your organization’s security posture? Take our free Human Attack Surface Score assessment.