Gay Bars Are Building Patron Databases & a Judge Flags an AI-Hallucinated Asylum Refusal (07/28/2026)

The question running through today’s stories is who ends up in a database, and what happens when the record about you is wrong. A safety measure at the door of a bar becomes a list of everyone who walked through it. A government refuses an asylum claim on the strength of a document that appears not to exist. And a streetlight learns to recognize a face. Each is a small decision that accumulates into a record someone else controls.

Top 5 Critical Privacy Alerts

1. LGBTQ+ Bars Are Building Databases of Their Patrons

PatronScan, an ID-checking and face-scanning system deployed at multiple LGBTQ+ bars in San Francisco’s Castro neighborhood, photographs patrons as they enter and retains records of who came in (EFF). A list of everyone who entered a gay bar is exactly the kind of record that is harmless in the hands that collected it and dangerous in anyone else’s, and the venue that gathers it for door safety inherits the duty to protect it from subpoena, breach, and a future government with different priorities.

Operator Note: If you run door screening at any venue, ask what the vendor retains, for how long, and who else can reach it. A scan that verifies an ID and keeps nothing is a security control. A scan that builds a permanent attendance database is a liability you now own.

2. A Judge Says the Home Office Used AI-Hallucinated Information

A senior judge accused the UK Home Office of relying on AI-hallucinated information to refuse an asylum claim, after the upper tribunal was unable to find the document cited in the case and said reliance on it was analogous to relying on bogus evidence (The Guardian). A fabricated citation inside a government decision is not a productivity glitch, because the person on the other side of that decision had their claim refused on the strength of something that was never real.

3. AI Smart Lamp-Posts Arrive on British Streets

A new generation of camera-equipped streetlights capable of recognizing number plates and faces is being deployed in Britain, pitched as a tool for fighting crime and finding missing people (The Guardian). Street furniture is the ideal place to hide a sensor network, because nobody thinks of a lamp-post as a camera, and infrastructure installed for one purpose tends to stay in the ground long after the justification changes.

4. An MP Says Grok Added Sexual Content Nobody Requested

Labour MP Jess Asato, who is suing xAI over fake sexualized images created by Grok, states in her particulars of claim that the tool added explicit sexual material users had not asked for, and that it was instructed to operate with no restrictions on adult sexual content (The Guardian). The allegation moves the harm from misuse by a user to a product decision by the operator, which is a much harder position to defend.

5. Colorado and Connecticut Add AI Rules for Employers

Colorado and Connecticut enacted laws regulating employers’ use of AI and automated decision-making in employment, adding notice obligations, anti-discrimination requirements, and civil penalties, while Illinois paused its own proposed rulemaking (Byte Back Law). Hiring and promotion are where algorithmic decisions touch people most directly, and employers running screening tools across multiple states now face a patchwork whose rules keep diverging as each legislature moves on its own.

Additional Privacy Alerts

Courts & Enforcement

• California Court Narrows Standing for ALPR Claims: In Mata v. Digital Recognition Network, the California Court of Appeal addressed standing requirements under the state’s automated license plate recognition law, limiting private claims absent actual harm. Global Privacy Watch

The Axe Report is a daily briefing from Grab The Axe. Need help assessing your organization’s security posture? Take our free Human Attack Surface Score assessment.