Facial Recognition Reaches the Underground, California Fines a Broker (08/11/2026)

Live facial recognition arrived in the London Underground today, starting at Victoria and rotating between stations. Everyone who walks through gets their face measured against a list. Nobody consented, and nobody can decline and still get to work. Meanwhile California issued the first fine of a data broker under its privacy law, and the amount is worth reading carefully.

Top 5 Critical Privacy Alerts

1. Live Facial Recognition Comes to the Underground

British Transport Police extended their live facial recognition trial into London Underground stations, with the first deployment beginning at Victoria and further deployments rotating between Underground and rail sites. Biometric Update

Operator Note: A transit system is the one place a person genuinely cannot route around. You can decline a shop that scans faces. You cannot decline the commute that pays your rent. Deploying this where refusal costs someone their job removes consent from the equation and calls the result acceptance.

2. California Fines a Data Broker $116,490

California’s privacy agency penalized LocateSmarter LLC for making it difficult for people to opt out of the sale of their personal information, the agency’s first fine of a data broker under the state privacy law. PogoWasRight

Operator Note: Read the number rather than the milestone. $116,490 against a business whose entire product is the friction they just got fined for. If the penalty is smaller than the revenue the behavior generates, it is a cost of doing business, and the brokers will price it that way until it isn’t.

3. Illinois Extends Genetic Privacy to Biomarkers

The Illinois governor signed SB 2886, expanding the state’s Genetic Information Privacy Act to cover biomarker testing and biomarkers. The Act already regulates the collection, use, and disclosure of genetic information. Inside Privacy

Operator Note: Illinois is the state where a private right of action turned biometric law into real liability. Any expansion of what counts as protected there is worth reading closely, because the enforcement pattern follows the definition.

4. Texas Goes After the Infrastructure Instead of the Sites

The Texas attorney general is testing enforcement of the state’s age assurance law against internet infrastructure providers rather than against noncompliant sites directly. Biometric Update

Operator Note: Pushing enforcement down to infrastructure means the party making the blocking decision has no relationship with the user and no stake in getting it right. That is how over-blocking becomes the safe default.

5. Roadside Cameras Start Reading the Devices in the Car

New technology attaches to automated license plate readers and captures the Bluetooth, Wi-Fi, and radio signals broadcast by devices in passing vehicles, converting them into identifiers tied to the plate. Ars Technica

Operator Note: This is today’s article. Leaving the phone at home was the last piece of practical advice that still worked, and it stops working when your watch, your earbuds, and the car itself are all broadcasting. We take it apart in your license plate is now a key to every device you carry.

The Axe Report is a daily briefing from Grab The Axe. Need help assessing your organization’s security posture? Take our free Human Attack Surface Score assessment.