License Photos Join the National Face Search (09/28/2026)

The photo on a driver’s license was taken so a police officer at a traffic stop could confirm the person holding the card is the person it belongs to. New South Wales has now passed a law that lets those photos feed a national face matching system, which is a different use with a different set of people being searched. Saturday it was Social Security data repurposed for voter checks in the US, and today it is license photos in Australia, and the pattern is the same one: data given for one reason, quietly available for another.

Top 5 Critical Privacy Alerts

1. NSW Brings Driver Photos Into Commonwealth Face Matching

New South Wales passed legislation aimed at organized crime that will also enable the state’s participation in the Commonwealth’s biometric face matching regime, opening its driver photo database to that system, per Biometric Update. A license database holds a photo of everybody licensed to drive in the state, which turns a transport record into a searchable face collection.

Operator Note: When a data set is reused for a new purpose, the people in it rarely get a second say. If you hold customer photos or ID scans, write down now what you will and will not share them for, before somebody asks.

2. California’s SB 923 Widens the CCPA Deletion Right

Governor Newsom signed SB 923 on September 27, expanding the CCPA deletion right from information collected from a consumer to information collected from or about them, including appended contact details, demographic data, marketing segments, and identity resolution data, per Fox Rothschild. It takes effect January 1, 2027, and allows a minimal suppression list so deleted third-party data is not reintroduced.

3. Human Contractors Are Reading Copilot Prompts

Internal documents obtained by 404 Media show human contractors reviewing Copilot users’ prompts and uploaded images, and being flooded with requests for sexual AI images, per 404 Media. People type things into an assistant that they would never say to a person, because they assume nobody is reading.

Operator Note: Tell employees plainly which AI tools may have human review of inputs, and keep confidential material out of any tool where you cannot confirm the answer.

4. Utah’s VPN Age Check Provision Is Blocked

A federal judge preliminarily blocked a provision of Utah’s SB 73 that tried to extend online age verification to VPN users, finding problems with its strict geolocation standard, per Biometric Update. Closing the VPN route would have required identifying where every user really is, which is a much larger surveillance requirement than the age check it was meant to protect.

5. The EFF Says San Francisco Police Drone Use Outran Its Policy

The EFF told the San Francisco Police Department that its drone program, in regular use for two years, has expanded faster than its documented policy and has evaded existing local and state oversight, per the EFF. A drone sees into yards and windows that a street camera never could.

Additional Privacy Alerts

Regulatory Fines & Enforcement Actions

• The New Mexico verdict counts nearly 44 million violations: The jury found Facebook violated state law nearly 44 million times in misleading consumers about its privacy practices, following Saturday’s liability finding. The Record

The Axe Report is a daily briefing from Grab The Axe. Need help assessing your organization’s security posture? Take our free Human Attack Surface Score assessment.