AlexanderHanff

This article contains a video which is a procedurally generated render of privacy relevant events in the web browser across the top 100 english language content web sites globally based on Tranco lists.

Over 500 000 privacy events which require consent (and were not consented to) captured in less than 5 minutes across 100 sites.

I wanted to find a way to make the data from my forensic audits more visual and accessible to non-experts.

So I created a Blender render pipeline which procedurally generates these scenes based on the audit's evidence bundles.

The entire renders (the full version of this one is 8 minutes long) will be made available along with the audit reports on November 17th when I release the research - this is just a small clip to share the concept.

So, I have been a privacy advocate and activist for 20 years and have achieved a great deal in that time including massive changes to EU law (such as ePrivacy and the GDPR) which have had ripple effects globally.

AI has allowed me to take my activism to the next level. I am creating a live action show called "WSI: Web Site Investigators" in the genre of CSI/NCIS as a means to raise awareness about web site tracking and profiling.

The show is based on real forensic audits of real web sites that are named and shamed in the show. the entire show is created with local, open weights AI models on my M1 Ultra Mac Studio with 128GB unified memory.

So far I have released a single (the theme song for the show) called "Leave my Data Alone" which is available on all the major streaming platforms; and today I released the first introductory video for the cast.

This is all new to me (I have never done video production before) and I learnt how to do all of this in just a couple of hours.

All the cases (each episode is based on a new case file) are real, the evidence in each episode is real and the web site is called out in each episode directly.

For all the bad things we can say about AI - here is a positive use case - making activism more affordable.

At least this is not widespread yet, in my recent forensic audit of the top 100 english language content sites globally, this was not present (audits conducted 1-3 October 2026) in any of the sites.

What we did find however, is that a number of big websites are now using Google Chrome's AI API to track and fingerprint people.

I had a local AI model create a song for a new live action show I am working on about web site privacy - this is the result...

Despite being a big supporter of Apple and having worked closely with them on a number of privacy issues - I have a problem with the fact that it is impossible for users to audit what apps are doing on the majority of Apple's devices and as such I am calling for Apple to be held liable when apps they control (they do the review and prevent us from auditing directly) which then break the law (which would include 97% of apps in the EU).

In this article I discuss how I use Claude Code to replace app store mobile apps with local PWAs that have the same functionality without the privacy abuses and explain that if mobile app developers don't start to obey the law, others will eventually do the same and they will go out of business.

No matter how many laws the US States pass for online provacy, none of them are fit for purpose because they are all based on Notice and Choice (OPT-OUT) which then hits the Same Origin Policy in the browser.

Many people have asked me how I manage my privacy first stance when it comes to AI - the answer is simple so I wrote a blog post about it.

OK it should be fixed now - there was a rate limit which doesn't normally land but due to multiple Tor users coming through the same exit node, it was triggering the limit.

Nothing to do with the certs just told me a cert error because it never finished the handshake.

I tested through Tor on multiple machines now and multiple circuits and is working clean - thanks for the heads up.

I cannot see what is causing the issue, the certificate's full chain is sent, the clock is synced, the cert is showing zero errors in OpenSSL - so this is very confusing.

The irony is, you don't actually need Tor on my site because there is no logging, no third parties, no adtech etc. it is just static HTML files - so whereas I would normally recommend Tor I designed the site specifically to be privacy first.

I will try to figure out what is going on though because obviously I am fully supportive of people protecting their privacy with Tor.

Not sure why, it is working fine everywhere else - I see in Tor it gives an invalid certificate error, but the Lets Encrypt certificate is working fine in other browsers, so seems to be a Tor thing specifically.

I will investigate.

I have put up a list of all the MEPs who voted for the urgency procedure yesterday (in breach of EU rules) as well as their voting history on fundamental rights issues and who has been lobbying them:

https://www.thatprivacyguy.com/blog/chat-control-the-415-who...

After yesterday disastrous result for democracy, where the President of the European Parliament used her power to force a vote on ChatControl I which the Parliament already voted against and allowed to expire earlier this year.

The move by the President is unprecedented and marks a dangerous time for EU democracy where if the President of the Parliament can overturn a democratic vote they disagree with - what is the point of the Parliament at all?

So I have collected all the details on the MEPs who failed to vite against the procedure yesterday along with their voting history on issues relating to fundamental rights and their history of meetings with lobbyists.

The results paint a very clear picture that these MEPs represent business, not the people who elected them.

As a CSA survivor I have spent decades campaigning for victims and survivors of CSA/CSAM and even wrote my Master Thesis on the topic.

Yesterday I once again pleaded with EU law makers not to pass Chat Control.

Whereas the main story here is the Commission's complete failure to do anything about Pegasus - I focused on the fact that the MEP in question and MEPs in general - should not be using their phones as information archives.

I haven't ever used Google Slides - does that make me special?

I saw this - so they are spending money 2x faster than they are making it and offering to give the public 5% of their debt whilst Sam takes home billions... sounds like a fantastic deal...

With Trump vs Slaughter gutting independence of the FTC - the Data Privacy Framework agreement used to transfer personal data from the EU to the US is unlikely to survive.

I wanted to see if US Frontier Models are exhibiting censorship so I asked Gemini a question about the current state of the world - the response was quite concerning as Gemini informed me it is "structurally protective of Donald Trump".

Given the recent German ruling on Gemini output being Google's speech and the DSA requirements on misinformation/disinformation it looks like more trouble ahead for Google Gemini.

I have also filed a report with the Commission's DSA enforcement team expressing concerns that Google is interfering with political speech.

Or you could actually read the article and look at the evidence which is based on peer reviewed research...

You are assuming that the author (me) hasn't tried to help the UN do it right in the past and that assumption would be wrong.

They don't get to shout at big tech when they are doing exactly the same thing and using the same vendors they are berating, to do it for them. It is rank hypocrisy.

Also, I was very clear in the introduction that I support the UN and their mission, which is precisely why they need to be held to account because their own Charter requires it.

The buck stops at him, whether he likes it or not.

As much as I support the UN (I have worked in privacy for 20 years, my life's work is in the field of human rights) - I do not support hypocrisy and it is long past due that the UN lead by example.

No, it argues that the use of javascript for purposes which require consent, requires consent...

EU law only allows strictly necessary use for the provision of the requested service so adtech and analytics require consent as they are not considered as strictly necessary.

Today I have successfully managed to get the police to investigate the deployment of adtech software (scripts) without consent as a criminal offence under unauthorised computer access and misuse.

I am basically arguing that deployment of these adtech payloads by websites and apps without consent, is a criminal offense.

Yes this is the difference, they did not allow you to opt out previously, they explicitly said that if you want to be in the club you have to accept their spam. Now they allow you not to accept their spam.

Now they rely on Soft Opt-In (which again might not be valid in your case, if you signed up to their site but didn't actually buy anything the soft opt-in exemption does not apply) so you may still have an actionable complaint here.

Processing my personal data in such a way (to ban me from your services pre-emptively) would be a breach of the GDPR and in some member states could involve criminal sanctions.

For example, in the UK we have a very famous case (The Consulting Association (TCA)) where building contractors joined together to build a list of construction workers they didn't want to hire - this was determined as a criminal breach of UK data protection law.

So have at it, I love a challenge...

They are not written by an LLM lol, I have severe ADHD, this is how I write and there is plenty of my material out there spanning the last 20+ years (long before LLMs existed) to illustrate that.

They actually are bound by the ePrivacy Directive due to jurisprudence (EU bodies must comply with CJEU rulings).

I actually wrote to the EDPB on 25th May 2018 (the day GDPR came into effect) and forced them to make their own website compliant with the ePrivacy Directive (I still have the email thread, it was quite an interesting discussion).

I also filed a complaint against the Court of Justice on October 1st 2019 within minutes of them publishing their Judgment on the Planet49 case (C-673/17) because their own website didn't comply with the judgment - they fixed it within 18 minutes.

So yes EU institutions get it wrong sometimes, but they generally fix it quickly when they are informed. I currently have a big case ongoing with the EDPS against the European Commission and the European Parliament for hosting live streams directly on social media instead of the official live streaming platform setup for EU bodies (on the basis that forcing people to engage on social media is a breach of fundamental rights because it allows those platforms to infer special category data (political interests and others depending on the topic of the live stream).

EDPS just actually updated me this week that they have concluded their side and are now waiting on the final responses from the Commission and Parliament.

So yes, the rules do work, but you have to be pro-active, armchair activism doesn't work.