u/EFForg

We don’t have to stand in the middle of the information super highway and let companies run us over. With a little work, we can stand our ground and take control over what happens with our data. This month—Opt Out October—we’re walking through some of the steps to do just that.

EFF's Surveillance Self-Defense team wrote four guides to help, and we thought DeGooglers may find them useful.

• How to Opt Out of AI Tools or Training Made by Big Tech
• How to Opt Out of Social Media Controlled by Big Tech
• How to Opt Out of Software Made by Big Tech
• How to Opt Out of the Major Operating Systems

Here's a riddle: Why did a Goshen Police Department officer search 6,474 automated license plate reader (ALPR) networks, representing data from 82,413 cameras, on May 7, 2025? 

If your answer is "I don't know," it turns out you're 100% correct. The officer left the letters "idk" in the search field where cops are supposed to document the reason for the search.

Flock Safety claims it has improved its system by requiring officers to select from a dropdown list of crimes before running a search–but that only makes it easier for officers to hide improper searches behind the veneer of uniformity. The system does not require proof that the dropdown reason actually matches the true purpose of the search. 

With no warrant requirements, limited guardrails, and deficient audit processes, ALPR databases have fostered a culture of unrestricted access to everyone’s location information. This culture of abuse has allowed police to treat a mass surveillance network like their own personal search engine, permitting the tracking of the movements of everyday citizens for low-level complaints, personal whims, and sometimes, seemingly, for the lols.

https://preview.redd.it/mfri59womcqh1.png?width=1250&format=png&auto=webp&s=c841ce004e18fddf59a16dd121f79e1dd16b4caf

EFF's got a big list of what these public records uncovered. Here's just a few.

• Belton Police Department (Mo.) ran searches (Aug–Sept 2024) for “d*ckhead.”  (asterisk/redaction our own)
• A Manteca Police Department (Ill.) employee ran searches in June 2024 for “sh*thead”  (asterisk/redaction our own)
• A Norton Police Department (Mass.) employee ran searches in December 2024 for “Sexy.”
• Corona Police Department (Calif.) employees ran searches (2023–2025) for “weird” or “WEIRD KID.”
• Thornton Police Department (Colo.) employees ran several searches in October 2025 for “driving around being weird.”
• A Columbus Police Department (Ohio) officer ran searches in 2023 for “idiot.”
• A Michigan City Police Department Officer (Ind.) ran searches in June 2025 listing “f*ck this new search engine.” (asterisk/redaction our own)

If police want the power to track a person's movements, they must be required to convince a judge with evidence and probable cause. They should not be able to bypass the Constitution with a search for "haha."

Read more in our blog: https://www.eff.org/deeplinks/2026/09/high-crime-lmao-how-cops-are-treating-mass-surveillance-joke

EFF is a member-supported U.S. 501(c)(3) organization. Become a member today and help us win against Flock and ALL Mass Surveillance Tech!

EFF has worked for more than 13 years to expose the harms of ALPR surveillance and the practices of vendors like Vigilant/Motorola Solutions, Flock, Axon, and others. Donating to EFF means supporting one of the most knowledgeable organizations documenting the legal, technical, and social harms of ALPRs—and one committed to providing research, legal firepower, and technical expertise to those fighting against community surveillance across the country.

Thank you to the support of EFF members, who have helped us to spend over a decade on this fight, and to be ready to jump into action as the dangers of ALPRs became widely known to the public.

Freedom, openness, interoperability, and the ability to connect without a single gatekeeper defined the internet's core promise 25 years ago. Today, most of our online life happens on centralized platforms that control our data, shape our experiences, and set the rules for communication.

What can the Fediverse offer? Real user agency means real choices: who hosts your data, who sets the rules, who you connect with. Monopolization brings real risks: digital surveillance, censorship, and a loss of user agency. Join us live to talk about what the Fediverse can and cannot offer users. Rather than asking if decentralized platforms can replace today's dominant social networks, we'll focus on a deeper question: What would it take to build an internet where people and communities have real choices about participation, data control, and governance of their digital spaces?

Join us 9/17 at 11 AM PT followed by a Q&A: https://eff.org/livestream-rweb

Babette Ngene and Rory Mir of EFF will be in conversation with renowned technologist and security expert Bruce Schneier and Social Web Foundation Executive Director Mallory Knodel. We hope to see you there!

What can the Fediverse offer? Real user agency means real choices: who hosts your data, who sets the rules, who you connect with. Monopolization brings real risks: digital surveillance, censorship, and a loss of user agency. Join us live to talk about what the Fediverse can and cannot offer users. Rather than asking if decentralized platforms can replace today's dominant social networks, we'll focus on a deeper question: What would it take to build an internet where people and communities have real choices about participation, data control, and governance of their digital spaces?

Join us to discuss more on 9/17 at 11 AM Pacific Time, followed by a Q&A: https://eff.org/livestream-rweb

Babette Ngene and Rory Mir of EFF will be in conversation with renowned technologist and security expert Bruce Schneier and Social Web Foundation Executive Director Mallory Knodel. We hope to see you there!

This brand-new guide is an overview of the many considerations to make before choosing to use an AI tool or software with AI features—whether you intend to or not, because just figuring out if some tool or app you’ve been using for years is now implementing some sort of AI feature can be a journey on its own. Most AI tools require some sort of privacy sacrifice, so understanding the risk is important. But these risks apply differently depending on your needs at the moment.

Learn more at EFF's Surveillance Self-Defense Hub—Dozens of up-to-date tips, tools, and how-tos for safer online communications.

Recent reports have raised alarm about the use of PatronScan, an ID-checking and face-scanning system, at multiple LGBTQ+ bars in San Francisco’s Castro neighborhood. In California, it’s not at all clear how PatronScan’s business model of scanning IDs and sharing the information from those scans with other bars comports with the law. California’s ID privacy law, which was amended in 2018 to add ID “scans,” states that no businesses shall “retain or use” any information from a scanned ID card except for limited purposes such as to verify age, comply with a legal requirement, or prevent fraud. 

Separate from that — What do you think about the use of databases like PatronScan?

Recordings of law enforcement, whether by bystanders or by those directly encountering officers, can be powerful tools of government accountability and can support movements for social change. But recording officers can come with risks. Here is the Electronic Frontier Foundation's latest guide to the legal and practical considerations for recording the police and other law enforcement officers.

Hope you'll join us when it starts. Video recording will be available!

https://preview.redd.it/i1pmo7xgr39h1.png?width=1200&format=png&auto=webp&s=2c1aa7a95ceb1d90edd2fc884f0e10127d04b0d0

Hey all, EFF is hosting a free livestream at 9AM, July 23, about the right to repair movement, with a Q&A portion. Hope you'll join us!

https://preview.redd.it/i1pmo7xgr39h1.png?width=1200&format=png&auto=webp&s=2c1aa7a95ceb1d90edd2fc884f0e10127d04b0d0

Hey all, EFF is hosting a free livestream today, about the right to repair movement, in 10 minutes! with a Q&A portion. Hope you'll join us!

Few of these tools provide the sorts of privacy and security promises we demand from all technology, let alone tech that captures personal health data. It’s time they step up and start providing transparency reports and stronger encryption options.

We're chatting with Corynne McSherry and Hayley Tsukayama of EFF along with Adam Savage and Kyle Wiens, CEO of iFixit, to dive into how manufacturers lock you out of the stuff you own, how the Right to Repair movement is fighting back, and what you can do to take back control of your devices.

Register for a reminder so you don't miss the livestream and live Q&A, July 23, 9AM PT.

We’re answering digital rights questions in season two of our initiative, LGBT Q&A. 

You Asked: I live in the UK, and we have age verification now on a bunch of websites (including Reddit) and now on more mobile devices. Can you explain what sort of data companies are actually collecting when they check for age and whether there are any real threats to my safety? 

As of July 2025, all platforms in the UK that host content considered by the UK government and the country’s telecommunications regulator Ofcom to be harmful are legally obligated to check that their users are over the age of 18. If not, users cannot access the content. 

There are various privacy implications for data sharing with age verification. Unfortunately, because services may use different methods to verify users’ ages, you’ll usually have to do a little digging to learn how each provider you have verifies their users, and consider what information might be harmful to your personal safety: 

• The data itself: What info does each method require users to disclose?
• Access: Who can see the data during the course of the verification process? Does anything other than the age result leave your device? Is the provider told your date of birth, or just if you’re over 18? Which third party services see the information you send?
• Retention: Who will hold onto that data after the verification process, and for how long? Sometimes it’s deleted immediately. Sometimes it hangs around forever, waiting for a data breach.
• Audits: How sure are we that the provider’s stated claims around data access and retention will happen in practice? For example, are there external audits confirming that data is not accidentally leaked to another site along the way? Ideally these will be in-depth, security-focused audits by specialized auditors like NCC Group or Trail of Bits, instead of audits that merely certify adherence to standards. 
• Visibility: Who will be aware that you’re attempting to verify your age, and will a third party provider know which platform you’re trying to verify for? Will they hang onto that data to build a profile of you?

Last year, Ofcom outlined a number of methods for online services and platforms to check users' ages. You can read more about these methods in our blog for more detail!

If you're wondering what you should you do if asked to confirm your identity or age online, or what options create the least risk to your personal information, this guide is for you.

It was written as part of EFF's Age Verification and Age-Gating Resource Hub. 

Age verification laws are proliferating fast across the United States and around the world, creating a dangerous and confusing tangle of rules about what we’re all allowed to see and do online. Though these mandates claim to protect children, in practice they create harmful censorship and surveillance regimes that put everyone—adults and young people alike—at risk.

The term “age verification” is colloquially used to describe a wide range of age assurance technologies, from age verification systems that force you to upload government ID, to age estimation tools that scan your face, to systems that infer your age by making you share personal data. While different laws call for different methods, one thing remains constant: every method out there collects your sensitive, personal information and creates barriers to accessing the internet. We refer to all of these requirements as age verification, age assurance, or age-gating.

If you’re feeling overwhelmed by this onslaught of laws and the invasive technologies behind them, you’re not alone. It’s a lot. But understanding how these mandates work and who they harm is critical to keeping yourself and your loved ones safe online. Age verification is lurking around every corner these days, so we must fight back to protect the internet that we know and love.

That’s why we launched EFF’s Age Verification Resource Hub (EFF.org/Age): a one-stop shop to understand what these laws actually do, what’s at stake, why EFF opposes all forms of age verification, how to protect yourself, and how to join the fight for a free, open, private, and yes—safe—internet. 

Within the next week, Congress is preparing to vote on the KIDS Act, a sprawling package of legislation that seeks to control Americans’ web browsing and private messaging. The package includes a revised version of the Kids Online Safety Act, or KOSA, combined with a collection of other internet bills, study bills, reporting requirements, and new regulations. Instead of debating any of these proposals on their merits, lawmakers are attempting to move them all at once under an ultra-expedited process. 

Many Congress members don't like The KIDS Act—on both sides.
Tell your elected official to vote NO here.

The package of cobbled-together bills is a mess, with different age-gating schemes for different services, using different standards. It’s a lot of complexity, and a lot of legal risk. Faced with that, many companies will conclude that the safest option is restrictive age-checking practices across their entire platforms.

Buried inside the KIDS Act are provisions that will push online services to verify all users’ ages, require government-directed moderation policies for online speech, and even create new rules about private and encrypted communications. While supporters continue to claim this bill protects minors online, its requirements come at the expense of privacy, free expression, and the ability of people of all ages to use the internet without revealing sensitive data. 

Technically, the KOSA section of the KIDS Act does say that KOSA shouldn’t be read to require age verification. 

That disclaimer is hollow, and you know it. 

Under this law, services will have to determine which users are teenagers and which are not to try to avoid liability. The bill’s authors seem to know this is a problem. On the one hand, the new KOSA section says age verification is not required. On the other, it repeatedly imposes obligations that depend on knowing whether a user is under 17. But a disclaimer doesn’t magically eliminate legal risk, especially for smaller services and startups that can’t afford to defend lawsuits or fight regulators.  

And KOSA is not the only part of this package that creates age-verification pressure. The SAFE BOTS Act, like KOSA, says that if a service “knows or should have known” that a user is a minor, it can’t offer certain chatbot features. 

The SCREEN Act requires services that host sexually explicit content to determine whether users are “more likely than not” under the relevant age limit, before allowing access to certain content. 

The consequences of this liability will not be limited to minors. If websites and apps are expected to reliably identify teenagers, adults will be asked to prove they are adults. The result is a less private internet for everyone.

Tell your elected official to vote NO here.