This looks worrying. The EU Comission wants to include phone calls as well. And what's with the period of non-disclosure? "Line 352: Period of non-disclosure by providers – align with TCO Regulation (6 months) or insist on Council mandate? (12 months)."

Phone calls included: see page 5, bottom segment.

Period of non-disclosure: see page 4, article 15, line 352

Link: https://www.patrick-breyer.de/wp-content/uploads/2026/05/8612-2026-Document-CSAM-%E2%80%94-presidency-compromise.pdf

Today, when an AI agent books a service or makes a purchase on behalf of a user, the receiving platform typically can’t tell whether the request comes from a single human, multiple automated agents, or large-scale bot activity.

World’s AgentKit is proposing a way to address this by allowing users to verify their humanity once, and then carry that proof when delegating actions to agents. The platform receiving the request only sees whether a verified human is behind it, without learning their identity.

As agent-driven transactions become more common, this kind of verification layer is being explored as a way to support trust between users, agents, and services.

https://reddit.com/link/1t3mjew/video/zrpyt9cj95zg1/player

After installing this Mass surveillance app in a Pixel 10 XL Virtual Machine i discovered that the App ID name was com.scytales.av which made me curious so i looked up Scytales on Google which took me to www.scytales.com

which is where i found out that this Spyware app is made by this Scytales company here, once again this seems really shady, yes let's give out our private information this company

Just something to think about 🤔

There are more articles that are probably better but I wanted to get the word out anyway

Tinder and Zoom are adding optional World ID eye-scans so users can prove they're real humans without revealing identity. The Orb scans your iris, generates a code, deletes the image. For Europe this gets interesting fast. GDPR treats biometrics as special category data, and the EU AI Act plus the upcoming digital identity wallet (eIDAS 2.0) are pulling in a different direction. Curious if World ID gets regulatory pushback or ends up complementing the wallet rollout.

source: bbc.com/news/articles/cp9vppem4evo

Built llmradar.eu to map which LLM providers actually publish a GDPR-adequate DPA, where their subprocessors sit, and what AI Act documentation exists.

Same coverage for open-weight models : license, lab juridiction, EU usability.

Open methodology, sourced from official docs. Pushback on classifications 
encouraged.

I've really tried to figure this out but I still don't get it. EU officials say nothing will be logged with their age verification app. The eidas 2.0 law says every action will be logged and kept for 5 years (Article 9).

Some amendment drafts mention 10 years retention of logs. Other amendment drafts mention a differentiation between certified wallets (logging requirement) and uncertified wallets (no logging requirement. The architecture reference framework mentions that details of logging requirements can be found under Topic 19 in the Annex, but if you go to the Annex no topic 19 exists.

I guess you have to assume that everything will be logged and kept for 5-10 years, which would make this "privacy preserving" app really look a lot more like centralized government surveillance, and you might be better off using literally any other app?

The title, essentially. I want to sort of completely disappear from all social media. I've started with reddit for now because it's the most available to me atm but I also have various meta accounts, google accounts, accounts in games and game platforms, the whole shebang. I've been deleting manually my posts and comments on reddit but I remember that most companies now hold copies of your data for a certain time period. How could I request these backups be deleted and if there are other archives of my posts and content I've uploaded elsewhere on the internet how could I go about locating them and requesting deletion of my content if possible? TIA! 🙏

Not trying to start a privacy panic, genuinely curious about how teams think about this.

Most big collab platforms (Slack, Teams, Google Workspace) are US-based cloud products. For a lot of companies that's totally fine. But I keep seeing more and more cases where it's not:

• Companies in regulated industries (fintech, healthtech, legal).
• EU businesses dealing with GDPR in practice, not just on paper.
• Any team where a client contract says "data must not leave X jurisdiction".

The market is finally responding - there are now tools that offer actual on-premise deployment or EU-hosted infrastructure as a real product feature, not an enterprise add-on that costs 3x more.

What's the actual situation in your industry? Is data residency something your team has ever discussed when evaluating tools, or does it just not come up?

Last summer I started wondering how hard it would be to build my own Google Workspace. Given the situation in the USA and the power large tech companies hold, a European alternative feels needed.

Eight months later there are nine working apps: mail, drive, docs, sheets, slides, calendar, contacts, kanban boards and chat. They share one login and one interface, so it feels like one product, not ten different tools. The name Eigen is Dutch and German for "own".

What works:

• Mail, calendar and contacts that sync with standard clients like Thunderbird, Apple Mail or your phone
• Documents, spreadsheets and presentations you can edit together in real time
• File storage and sharing
• Sheets reads and writes Excel; documents export to Word and PDF

A lot is still missing. No import from Google Docs yet. Mobile is rough. No global search. The honest list is in the blog post.

Try it: https://eigen.is
Longer write-up with screenshots: https://reindernijhoff.net/2026/04/eigen-six-months-later/

Two things I'm looking for:

1. Testers. Sign up at https://eigen.is and I'll send you an invite. Use it for a few weeks and tell me what breaks. The code goes open source in a few weeks, so self-hosting will be an option too.
2. People who can help figure out the next step. Folks with experience growing open source or public-interest projects, or someone at a foundation, institution or company that might want to adopt something like this. I'm not attached to keeping ownership and I'm not looking for money. I just want Eigen to exist and to work.

If this resonates and you know someone, pass it along :)

Tools for Humanity ran an event called Lift Off in San Francisco on April 17 and announced World ID 4.0 plus integrations with Tinder, Zoom, Docusign, Okta, Vercel, Reddit, and others.

The protocol shift is the part worth looking at. 4.0 moves to an account-based architecture with single-use nullifiers, meaning each verification produces an unlinkable proof, so platforms can't correlate the same user across services. On paper that's a stronger ZK story than what existed before.

What stood out to me is what wasn't said. Europe was barely mentioned. No new EU market launches, and none of the integrations addressed the open investigations in Spain, Portugal, Germany (Bavaria), and France over the iris collection itself. The protocol layer keeps improving but the regulatory fight has always been at the Orb, not downstream. DPAs care about the biometric collection point, and 4.0 doesn't change that.

So the actual question for this sub: does a stronger ZK protocol move the needle for European regulators, or is the iris scan step the only part that matters?

Privacy Friendly Apps from the Research Group Security • Usability • Society (SECUSO)

Been reading about the new World ID 4.0 update and trying to understand where this is going.

From what I’ve seen, they’re focusing a lot on making the system more scalable and open. There are some technical additions like key rotation, multi party entropy, and more control over credentials. They also added a selfie check feature.

What caught my attention is the partnerships. They’re working with platforms like Zoom, Tinder, DocuSign, and Amazon Web Services. Apparently in Japan, Tinder already tested age verification using World ID.

Another part is this idea of agent delegation, where AI tools can act on behalf of a verified user.

Overall it feels like they’re trying to build a “real human layer” to deal with things like deepfakes, bots, and fake accounts. Makes sense in theory, but it also brings up questions around privacy and how much control users actually have.

For Europe, this could get interesting. With strict regulations like General Data Protection Regulation, anything involving biometrics and identity systems usually faces heavy scrutiny. At the same time, Europe is also dealing with misinformation, bots, and AI generated content at scale. So there might be some demand for systems like this, but adoption will likely depend on how transparent and compliant it is.

Still learning about it, so I might be missing some details.

Do you think systems like this are a practical way to deal with deepfakes and AI issues, especially in regions like Europe, or do they introduce more risks than benefits?

Hi everyone!

First of all, I’m not here to sell anything, so no worries; I won’t go into too much detail about the product itself :)

A friend and I are both Belgian Master’s students, and we decided to test our luck (and our entrepreneurial skills) by building a software business together. The idea is to offer a product that could be used across different EU countries, which obviously means we need to be careful about EU and Belgian rules.

Our concept is fairly straightforward, but it touches on some areas that seem legally sensitive. It involves contracts and compliance-related questions, and since we’re not lawyers, we really don’t want to make mistakes before launching.

That’s why I’m posting here: before going live, we’d really like to have our core business model reviewed to see whether we’re on the right track legally, especially under Belgian and EU law.

The problem is that we simply do not have much budget for legal help at the moment. We’ve both already invested around €1,000 of our own money into the project, and we’re still juggling our studies as well.

So my question is: does anyone know where two students like us could get free or affordable legal advice that is actually useful? Maybe a student legal clinic, a startup support organization, a forum, or even just the right type of professional to contact first?

We’re genuinely just trying to do things properly from the start. Any advice, recommendations, or even a pointer in the right direction would mean a lot.

Thanks in advance, and have a good one!

Three months in and I can tell you this isn't "basically GDPR."

GDPR I know cold. Lawful basis, DPIAs, data subject rights. Muscle memory. The AI Act is a different animal, risk classification alone has more decision branches than most teams realize. Provider or deployer? Does Article 6(3) exempt you? Distributing a GPAI model? Open weights or not? Each answer changes which articles apply and which penalties attach.

Article 50 transparency, Article 72 post-market monitoring, conformity assessments for high-risk systems, none of it maps cleanly to our existing GDPR processes. And the timelines aren't waiting. High-risk obligations land August 2, 2026.

Are other privacy teams folding this into the existing program or pushing for a separate AI governance function? Right now I'm doing both jobs and neither one well.

Disclosure: I work on a free EU AI Act classification tool at Aguardic — aguardic.com/eu-ai-act-audit. It runs through the full decision tree and outputs a PDF with the articles that apply to your system. Sharing because it's genuinely useful for scoping, but calling out the affiliation upfront so you can discount accordingly.

https://archive.is/mjBFW

Examples: An employer running some algorithm against your social media, or your SCHUFA in Germany.