AlexanderHanff

This article contains a video which is a procedurally generated render of privacy relevant events in the web browser across the top 100 english language content web sites globally based on Tranco lists.

Over 500 000 privacy events which require consent (and were not consented to) captured in less than 5 minutes across 100 sites.

I wanted to find a way to make the data from my forensic audits more visual and accessible to non-experts.

So I created a Blender render pipeline which procedurally generates these scenes based on the audit's evidence bundles.

The entire renders (the full version of this one is 8 minutes long) will be made available along with the audit reports on November 17th when I release the research - this is just a small clip to share the concept.

So, I have been a privacy advocate and activist for 20 years and have achieved a great deal in that time including massive changes to EU law (such as ePrivacy and the GDPR) which have had ripple effects globally.

AI has allowed me to take my activism to the next level. I am creating a live action show called "WSI: Web Site Investigators" in the genre of CSI/NCIS as a means to raise awareness about web site tracking and profiling.

The show is based on real forensic audits of real web sites that are named and shamed in the show. the entire show is created with local, open weights AI models on my M1 Ultra Mac Studio with 128GB unified memory.

So far I have released a single (the theme song for the show) called "Leave my Data Alone" which is available on all the major streaming platforms; and today I released the first introductory video for the cast.

This is all new to me (I have never done video production before) and I learnt how to do all of this in just a couple of hours.

All the cases (each episode is based on a new case file) are real, the evidence in each episode is real and the web site is called out in each episode directly.

For all the bad things we can say about AI - here is a positive use case - making activism more affordable.

At least this is not widespread yet, in my recent forensic audit of the top 100 english language content sites globally, this was not present (audits conducted 1-3 October 2026) in any of the sites.

What we did find however, is that a number of big websites are now using Google Chrome's AI API to track and fingerprint people.

I had a local AI model create a song for a new live action show I am working on about web site privacy - this is the result...

Despite being a big supporter of Apple and having worked closely with them on a number of privacy issues - I have a problem with the fact that it is impossible for users to audit what apps are doing on the majority of Apple's devices and as such I am calling for Apple to be held liable when apps they control (they do the review and prevent us from auditing directly) which then break the law (which would include 97% of apps in the EU).

In this article I discuss how I use Claude Code to replace app store mobile apps with local PWAs that have the same functionality without the privacy abuses and explain that if mobile app developers don't start to obey the law, others will eventually do the same and they will go out of business.

No matter how many laws the US States pass for online provacy, none of them are fit for purpose because they are all based on Notice and Choice (OPT-OUT) which then hits the Same Origin Policy in the browser.

Many people have asked me how I manage my privacy first stance when it comes to AI - the answer is simple so I wrote a blog post about it.

OK it should be fixed now - there was a rate limit which doesn't normally land but due to multiple Tor users coming through the same exit node, it was triggering the limit.

Nothing to do with the certs just told me a cert error because it never finished the handshake.

I tested through Tor on multiple machines now and multiple circuits and is working clean - thanks for the heads up.

I cannot see what is causing the issue, the certificate's full chain is sent, the clock is synced, the cert is showing zero errors in OpenSSL - so this is very confusing.

The irony is, you don't actually need Tor on my site because there is no logging, no third parties, no adtech etc. it is just static HTML files - so whereas I would normally recommend Tor I designed the site specifically to be privacy first.

I will try to figure out what is going on though because obviously I am fully supportive of people protecting their privacy with Tor.

Not sure why, it is working fine everywhere else - I see in Tor it gives an invalid certificate error, but the Lets Encrypt certificate is working fine in other browsers, so seems to be a Tor thing specifically.

I will investigate.

I have put up a list of all the MEPs who voted for the urgency procedure yesterday (in breach of EU rules) as well as their voting history on fundamental rights issues and who has been lobbying them:

https://www.thatprivacyguy.com/blog/chat-control-the-415-who...

After yesterday disastrous result for democracy, where the President of the European Parliament used her power to force a vote on ChatControl I which the Parliament already voted against and allowed to expire earlier this year.

The move by the President is unprecedented and marks a dangerous time for EU democracy where if the President of the Parliament can overturn a democratic vote they disagree with - what is the point of the Parliament at all?

So I have collected all the details on the MEPs who failed to vite against the procedure yesterday along with their voting history on issues relating to fundamental rights and their history of meetings with lobbyists.

The results paint a very clear picture that these MEPs represent business, not the people who elected them.

As a CSA survivor I have spent decades campaigning for victims and survivors of CSA/CSAM and even wrote my Master Thesis on the topic.

Yesterday I once again pleaded with EU law makers not to pass Chat Control.

Whereas the main story here is the Commission's complete failure to do anything about Pegasus - I focused on the fact that the MEP in question and MEPs in general - should not be using their phones as information archives.

I haven't ever used Google Slides - does that make me special?

I saw this - so they are spending money 2x faster than they are making it and offering to give the public 5% of their debt whilst Sam takes home billions... sounds like a fantastic deal...

With Trump vs Slaughter gutting independence of the FTC - the Data Privacy Framework agreement used to transfer personal data from the EU to the US is unlikely to survive.

I wanted to see if US Frontier Models are exhibiting censorship so I asked Gemini a question about the current state of the world - the response was quite concerning as Gemini informed me it is "structurally protective of Donald Trump".

Given the recent German ruling on Gemini output being Google's speech and the DSA requirements on misinformation/disinformation it looks like more trouble ahead for Google Gemini.

I have also filed a report with the Commission's DSA enforcement team expressing concerns that Google is interfering with political speech.

Or you could actually read the article and look at the evidence which is based on peer reviewed research...

You are assuming that the author (me) hasn't tried to help the UN do it right in the past and that assumption would be wrong.

They don't get to shout at big tech when they are doing exactly the same thing and using the same vendors they are berating, to do it for them. It is rank hypocrisy.

Also, I was very clear in the introduction that I support the UN and their mission, which is precisely why they need to be held to account because their own Charter requires it.

The buck stops at him, whether he likes it or not.

As much as I support the UN (I have worked in privacy for 20 years, my life's work is in the field of human rights) - I do not support hypocrisy and it is long past due that the UN lead by example.

No, it argues that the use of javascript for purposes which require consent, requires consent...

EU law only allows strictly necessary use for the provision of the requested service so adtech and analytics require consent as they are not considered as strictly necessary.