An Officer Used a Plate Reader to Stalk a Woman (08/19/2026)

Every argument for a surveillance system assumes the operator. Not the policy governing the operator, the actual person with the terminal in front of them at two in the morning. Today an officer explained why he ran a plate reader against a woman he had never met, and the answer was that he saw a shiny thing.

Top 5 Critical Privacy Alerts

1. An Officer Used a Plate Reader to Stalk a Woman

An officer queried the automated license plate reader network to track a woman he did not know. His explanation for why: he saw a shiny thing. 404 Media

Operator Note: This is the case every plate reader debate has been waiting for, and it is worth being precise about what it proves. The system worked as designed. The query was authorized, logged, and returned. What failed is the assumption underneath every deployment, which is that the interface will only ever be used for the reason it was purchased. Audit logs record misuse. They do not prevent it, and reading them is somebody’s fourth priority.

2. ICE Tells Its Agents to Leave the Meta Glasses at Home

The head of ICE instructed agents to stop wearing Meta smart glasses on duty. An agency that has spent this month defending its use of facial recognition has decided the recording device on an agent’s face is a problem it does not want. The Register

Operator Note: Sit with the asymmetry for a second. The concern is not what the glasses collect about the public. It is what they capture about the agency and its people, which is a risk the agency can feel because it is theirs. Every organization reaches the same conclusion in the same order, and yours will too. We wrote the corporate version last week in why your visitor policy does not cover face recognition glasses.

3. California Moves on Wearable Recording Devices

A California bill would address wearable recording devices, glasses included. The legislature is reaching the question about six years after the hardware started shipping. PogoWasRight

Operator Note: Whatever California passes becomes the practical national standard for anyone selling into the state, the same way its privacy statute did. Read the draft now rather than the summary later, because the definitions in it will decide whether your conference room policy needs rewriting.

4. A Mental Health Provider Settles for $3 Million Over Meta and Google Trackers

The provider was accused of sharing patient data with Meta and Google and has settled for $3 million. Tracking pixels on a mental health provider’s website report who visited, which pages, and how often. PogoWasRight

Operator Note: Somebody in marketing installed a conversion tracker and did their job. The page it landed on was the one where a person looks for help with something they have told nobody. If you run any healthcare or behavioral health web presence, the audit is one afternoon: list every third-party script on every page, and ask what each one learns about a visitor who never fills in a form.

5. The FTC Opens Comment on Personalized Pricing

The Federal Trade Commission is seeking comment on an enforcement policy statement covering personalized pricing, meaning prices set from what a seller knows about the individual buyer. FTC

Operator Note: This is the practical end of the data broker economy, where the file assembled about a person is used to decide what that person pays. New Jersey banned it for groceries earlier this month. A federal enforcement posture would settle it far more broadly, and the comment period is open.

Additional Privacy Alerts

Privacy Laws & Regulations

• Colorado’s attorney general released proposed rules for the state’s automated decision-making act: More operational work than the statute suggests, which is the usual gap between a law and its rules. Byte Back Law
• A Ninth Circuit ruling will force platforms hosting user speech into longer litigation before Section 230 dismissal: The procedural change matters more than the doctrinal one. EFF

Privacy-Enhancing Technologies

• Zero-knowledge proofs are not an age verification silver bullet: The cryptography is real and the deployment assumptions around it are where the privacy leaks back in. EFF
• Google is rolling out a Play age signals interface: Age assurance moving into the platform layer rather than the app. Biometric Update

Data Minimization & User Consent

• Brazil’s regulator shut down biometric matching for classroom attendance: Taking children’s faces to record who came to school did not survive review. Biometric Update
• Comcast’s router motion sensing comes with a privacy catch: Millions of existing routers gain the ability to detect movement in the home. PogoWasRight

Regulatory Fines & Enforcement Actions

• The FTC and Connecticut secured a $4 million settlement with a Nissan dealership over deceptive fees: FTC

The Axe Report is a daily briefing from Grab The Axe. Need help assessing your organization’s security posture? Take our free Human Attack Surface Score assessment.