153 Million Driver's Licenses For Sale (09/02/2026)

The largest privacy story today involves data that people handed over on purpose, to prove they were who they said they were, at the moment somebody demanded proof. Verification is the one context where a person cannot decline and cannot negotiate the terms, and that is exactly why the record created in that moment ends up being worth so much to somebody else.

Top 5 Critical Privacy Alerts

1. More Than 150 Million License Photos Offered For Sale

An identity theft search site claimed to hold more than 150 million driver’s license photos taken from an ID card verification service, and the site has since shut down while the FBI reportedly investigates. One reporter rented a car and found his own license listed for sale within hours, which puts a useful edge on how quickly a verification record travels once it leaves the place it was collected. Nobody in that dataset chose to be in it in any meaningful sense, because the alternative was not renting the car. Ars Technica has the firsthand account and TechCrunch traces the source.

Operator Note: If your onboarding or age-check flow hands a scanned government ID to a third party, the retention schedule in that vendor’s contract is now a live liability question rather than a procurement detail.

2. Texas Police Used AI to Write Up Their Own Plate Reader Search

A Texas police department used an AI tool to draft the report documenting its use of a Flock search for a woman who had an abortion, which puts an automated writing layer between an officer’s decision and the record of that decision. The accountability chain for surveillance depends entirely on a person having written down why they ran the query. When the justification is generated rather than composed, the review that reads it later is checking the output of a language model and not the reasoning of an officer. 404 Media has the documents.

Operator Note: Any log that exists to establish intent has to be written by the person who held the intent, and that principle applies to your own access justifications as much as to a police department’s.

3. Austria’s Supreme Court Clears a Credit Data Class Action

The Austrian Supreme Court ruled in favor of noyb in several unrelated cases against credit reference agency CRIF, finding the agency unlawfully collected data on millions of people and opening the way for a class action. Credit reference data is the clearest example of information gathered about a person entirely without their participation, then used to make decisions that shape what they can rent, borrow, or buy. The people in that database were never customers of the company holding it. noyb has the ruling.

4. The EFF Asks Newsom to Veto California’s Under-16 Social Media Ban

California’s legislature passed AB 1709, which functions as a sweeping ban on social media use by anyone under 16, and the EFF has asked Governor Newsom to veto it on the grounds that the mechanism does far more damage than the harm it targets. A ban of this shape requires every platform to establish the age of every user, which means universal identity verification arriving through a child safety bill. The first story in this briefing is what that infrastructure looks like a few years after it is built. EFF sets out the objection.

Operator Note: Age assurance is identity collection with a sympathetic label, so read any age-gating requirement as a mandate to build and retain a verification database.

5. Police Ask Axon to Make Its Cameras Look Less Like Flock’s

During a since-deleted Axon webinar, an apparent police participant asked whether the company would redesign its Outpost camera so it does not look like a Flock camera, on the reasoning that the visual difference would help agencies with public perception. The request is an unusually direct admission that the objection people have is to the surveillance rather than to the vendor. Changing the housing addresses whether people recognize the camera, and leaves the question of whether they ever agreed to it exactly where it was. 404 Media has the webinar detail.

Additional Privacy Alerts

Privacy Laws and Regulations

• Europe’s digital ID wallets move from pilots to public rollout: Governments across Europe are launching wallet apps, passing enabling legislation, and integrating the wallets into banking and public administration, moving the programs out of the pilot stage. Biometric Update
• UK watchdog says digital identity can build on existing foundations: The UK’s independent public spending watchdog says digital identity could reduce fraud and improve public services, with the benefits contingent on complex integrations delivered over a long timeline. Biometric Update
• Mobile driver’s license standards are becoming free to access: Leading identity organizations are backing an effort to make ISO/IEC 18013, ISO/IEC 23220, and related credential standards free to download. Biometric Update

Regulatory Fines and Enforcement Actions

• Delaware court highlights the hurdles in cookie wiretapping suits: A US District Court decision in Delaware dismissed a claim over class certification and ascertainability problems, which tempers the assumption that the wave of tracking suits favors plaintiffs by default. Fox Rothschild
• Oklahoma tells a city it cannot charge $17,125.44 for records: A city tried to bill a farmer more than $17,000 for bodycam footage and records connected to his arrest at a council meeting about a data center, and the state told it the fee was not allowed. 404 Media

Privacy-Enhancing Technologies

• A digital camouflage shirt confuses AI-powered cameras: Artist Simon Weckert’s garment is designed to defeat recognition by surveillance camera systems, and a reporter watched it work in practice. 404 Media
• Canada expands its national biometric authentication standard: The updated edition adds sections on presentation attack detection and public key cryptography as organizations integrate biometrics with digital identity systems. Biometric Update

The Axe Report is a daily briefing from Grab The Axe. Need help assessing your organization’s security posture? Take our free Human Attack Surface Score assessment.