enshit.club

The data trail

Where the data went.

What regulators found companies doing with personal data, what services say in their own terms, and how hard each one is to leave. Those are deliberately different kinds of evidence.

Regulator record
A final order, settlement, court ruling or finding, with the regulator's own source.
Policy profile
Our summary of a provider's published terms, with editorial signals. It is not an allegation or evidence that a service sells data; terms change, so check the source.
A red data receipt winding between a phone, router, server, filing cabinet and locked archive.
A connection leaves more than a click behind.

Regulator records

What regulators found.

Decisions, court rulings and settlements about how companies collected, shared or protected personal data. Each describes the action taken, not a claim about what the company does today.

Kind of data

25 of 25 records, newest first

Faces & biometrics · Australia

Bunnings

Retail facial recognition · Administrative Review Tribunal decision 2026

Regulator decision
Data
Facial images and biometric templates of people entering selected Australian stores
What happened
Bunnings used facial recognition in 62 stores between 2018 and 2021 to identify repeat offenders. The privacy dispute concerned collection and use of biometric information, not a finding that Bunnings sold it.
Outcome
The tribunal upheld findings that Bunnings failed to give adequate notice and maintain appropriate privacy governance. It also found that the limited use to address serious retail crime and protect staff and customers could be justified; the decision is not a general permission for retail facial recognition.
OAIC statement on the Bunnings tribunal decision ↗

Office of the Australian Information Commissioner

Browsing & ad profiles · United States

Cox Media Group (“Active Listening”)

Voice-data ad targeting claims · FTC final orders August 2026

Settlement
Data
Claimed: conversations picked up by consumers’ smart devices, used to target local ads
What happened
Cox Media Group and two partner firms told business customers an AI service could target ads using conversations heard by smart devices and that consumers had opted in. The FTC says the service did not use voice data and consumers had not consented.
Outcome
Final FTC orders: $930,000 for customer refunds and a ban on misrepresenting the services’ capabilities, how voice data is collected and used, and whether consumers consented.
FTC finalizes orders with Cox Media Group over “Active Listening” ↗

US Federal Trade Commission

Read our case file →

Location · United States

GM and OnStar

Connected vehicles · FTC order finalised January 2026

Settlement
Data
Precise location and driving-behaviour data
What happened
The FTC says data was sold to consumer reporting agencies, which insurers used in reports and rate decisions.
Outcome
Final FTC order: five-year ban on sharing covered driver data with consumer reporting agencies, plus consent, access, deletion and opt-out requirements.
FTC case: GM and OnStar ↗

US Federal Trade Commission

Read our case file →

Location · United States

Kochava and Collective Data Solutions

Location-data broker · Court-entered order June 2026

Settlement
Data
Precise mobile-device location data, including visits to sensitive places
What happened
The FTC alleged the companies' location-data products could reveal people's movements to health facilities, places of worship and other sensitive locations without their knowledge or consent.
Outcome
The stipulated court order restricts disclosure of sensitive location data without affirmative express consent and requires supplier checks, a sensitive-location program, retention limits and consumer controls.
FTC case and entered order: Kochava ↗

US Federal Trade Commission

Health & genetic · Australia

Medmate and Monash IVF

Australian health websites · Privacy determinations June 2026

Regulator decision
Data
Sensitive health-related information inferred from visits and activity on telehealth and fertility websites
What happened
The Australian Privacy Commissioner found that third-party tracking pixels collected sensitive information from visitors to the two providers' websites for social-media advertising without the required consent.
Outcome
Two separate OAIC determinations found privacy breaches. The finding concerns these providers' use of tracking pixels; it is not a finding about every health website or every use of analytics.
OAIC findings: health-site tracking pixels ↗

Office of the Australian Information Commissioner

Read our case file →

Platforms & transfers · European Union

TikTok (EEA data transfers)

Cross-border platform data · DPC decision 2025; High Court judgments June 2026

Court ruling
Data
Personal data of European Economic Area users remotely accessed by personnel in China
What happened
Ireland's Data Protection Commission found that TikTok had not shown the transferred data received protection essentially equivalent to EU standards and had not adequately explained the transfers in its privacy information.
Outcome
The Irish High Court upheld the core infringement findings. The DPC imposed fines totalling €530 million and ordered corrective measures, but issues concerning the calculation of the fines remained before the court in June 2026; the imposed amount should not be treated as a final payment.
Irish High Court judgment on TikTok's data-transfer appeal ↗

Courts Service of Ireland

Platforms & transfers · United Kingdom

TikTok (UK children’s data)

Children’s data · Fined 2023; final September 2026

Regulator decision
Data
Personal data of children under 13, who TikTok’s own rules say should not have accounts
What happened
The ICO estimated that up to 1.75 million UK children under 13 used TikTok in 2020. It found TikTok did not do enough to identify and remove them, used their data without parental consent and did not explain clearly how data was collected, used and shared.
Outcome
The ICO fined TikTok £12.7 million in 2023. In September 2026 TikTok withdrew its appeals and accepted the penalty, which is now final. A separate ICO investigation into how its recommender systems use the data of 13 to 17-year-olds can now continue.
ICO: TikTok withdraws appeals and accepts £12.7m fine ↗

UK Information Commissioner’s Office

Automated decisions · European Union

Uber (automated deactivations)

Driver accounts · Dutch AP fine August 2026

Regulator decision
Data
Driving behaviour, fraud signals and customer ratings of drivers
What happened
Between 2018 and 2022, Uber’s software temporarily deactivated drivers’ accounts when it suspected fraud or ratings were too low, and permanently deactivated some for persistently low ratings. No human reviewed those decisions, and drivers were not properly told how they were made.
Outcome
The Dutch data protection authority fined Uber €824,990,000 for breaking the GDPR’s ban on fully automated decisions with major effects. Uber has stopped the practice and has appealed the fine.
AP: Uber fined nearly €825 million for automated driver blocking ↗

Dutch Data Protection Authority (AP)

Read our case file →

Health & genetic · United Kingdom

23andMe

Genetic testing · ICO penalty June 2025

Regulator decision
Data
Names, birth years, locations, ethnicity, family trees and health reports of 155,592 UK customers
What happened
In 2023 an attacker reused passwords stolen in other breaches to break into 23andMe accounts. The ICO found the company lacked basic protections such as mandatory multi-factor authentication and was slow to respond to warning signs.
Outcome
The ICO fined 23andMe £2.31 million under UK data protection law, in an investigation run jointly with Canada’s privacy commissioner. It also warned that any buyer of the company in its US bankruptcy must follow UK law.
ICO: 23andMe fined £2.31 million ↗

UK Information Commissioner’s Office

Health & genetic · Australia

Australian Clinical Labs

Pathology data breach · Federal Court penalty October 2025

Court ruling
Data
Personal and health information of more than 223,000 people held on Medlab Pathology’s systems
What happened
A February 2022 cyberattack on ACL’s Medlab Pathology business led to the unauthorised access and theft of personal information. The regulator argued ACL had not taken reasonable steps to protect it, or assessed and reported the breach quickly enough.
Outcome
The Federal Court ordered A$5.8 million in penalties: the first civil penalties ever ordered under Australia’s Privacy Act. They were set under the lower maximums in force at the time; much higher penalties now apply to serious breaches.
OAIC: Australian Clinical Labs ordered to pay penalties ↗

Office of the Australian Information Commissioner

Location · United States

Gravy Analytics and Venntel

Location-data broker · Final order January 2025

Settlement
Data
Mobile location data associated with persistent identifiers
What happened
The FTC said Gravy sold data commercially and its Venntel subsidiary sold location-data products to public-sector customers, including government contractors.
Outcome
Final FTC order: prohibition on selling sensitive location data and requirements relating to consent verification, deletion and privacy practices.
FTC case: Gravy Analytics and Venntel ↗

US Federal Trade Commission

Browsing & ad profiles · European Union

Meta (“consent or pay”)

Combined data for personalised ads · Commission DMA decision April 2025

Regulator decision
Data
Personal data combined across Facebook, Instagram and other Meta services for personalised advertising
What happened
From November 2023, EU users had to consent to Meta combining their data for personalised ads or pay a monthly subscription for no ads, with no free option using less personal data.
Outcome
The European Commission fined Meta €200 million under the Digital Markets Act. Meta has appealed; since January 2026 EU users are also offered a less-personalised-ads option, which the Commission is assessing.
Commission finds Apple and Meta in breach of the DMA ↗

European Commission

Read our case file →

Location · United States

Mobilewalla

Location-data broker · Final order January 2025

Settlement
Data
Sensitive location data, including visits to healthcare facilities and places of worship
What happened
The FTC alleged the broker tracked and sold sensitive location data without reasonable consent verification, including data sourced from real-time-bidding advertising exchanges.
Outcome
Final FTC order: prohibition on selling sensitive location data and limits on data collection from advertising exchanges.
FTC final order: Mobilewalla ↗

US Federal Trade Commission

Browsing & ad profiles · United States

Avast and Jumpshot

Security software · Conduct alleged 2014–2020; order finalised June 2024

Settlement
Data
Detailed, re-identifiable web-browsing information
What happened
The FTC says Avast collected browsing data through antivirus software and extensions, then sold it through Jumpshot to advertising, marketing, analytics and data-broker clients.
Outcome
Final FTC order: ban on selling or licensing browsing data from Avast products for advertising, deletion obligations and US$16.5 million for consumer redress.
FTC final order: Avast browsing data ↗

US Federal Trade Commission

Security & retention · United States

Blackbaud

Data retention and security · Final FTC order May 2024

Settlement
Data
Customer-held personal data, including Social Security and bank-account numbers
What happened
The FTC alleged that weak safeguards and unnecessary retention increased the amount of sensitive customer data exposed when an attacker breached Blackbaud's network in 2020.
Outcome
The final order requires Blackbaud to delete data no longer needed for its products or services, adopt a retention schedule and information-security program, and avoid misleading claims about security and retention.
FTC final order: Blackbaud security and retention ↗

US Federal Trade Commission

Faces & biometrics · European Union

Clearview AI

Facial recognition database · Dutch AP fine September 2024

Regulator decision
Data
More than 30 billion photos scraped from the internet, each turned into a biometric face code
What happened
Clearview built its database by automatically collecting photos of people online, including Dutch people, without their knowledge or consent, and sells identification searches to intelligence and investigative agencies.
Outcome
The Dutch authority fined Clearview €30.5 million, added orders with penalties of up to more than €5 million for continued non-compliance, and warned that Dutch organisations using Clearview could themselves face heavy fines.
AP: fine on Clearview for illegal facial-recognition data collection ↗

Dutch Data Protection Authority (AP)

Location · United States

InMarket

Marketing and data aggregation · Final order May 2024

Settlement
Data
Precise location data and audience segments inferred from visits
What happened
The FTC said InMarket collected location data through its apps and third-party app SDKs, combined it with other data and used it to target advertising.
Outcome
Final FTC order: prohibition on selling, sharing or licensing precise location data and sensitive-location audience products, plus deletion and withdrawal controls.
FTC final order: InMarket ↗

US Federal Trade Commission

Browsing & ad profiles · European Union

LinkedIn

Behavioural advertising · Irish DPC decision October 2024

Regulator decision
Data
Members’ own activity and data from third parties, used to analyse behaviour and target advertising
What happened
The Irish regulator found LinkedIn had no valid legal basis for using members’ data, including data from other companies, for behavioural analysis and targeted ads, and did not explain that use clearly enough. The case began with a 2018 complaint by the French group La Quadrature du Net.
Outcome
A reprimand, an order to bring the processing into line with the GDPR and fines totalling €310 million. LinkedIn has appealed, and under Irish law the fine cannot be collected while the appeal is pending.
DPC fines LinkedIn Ireland €310 million ↗

Irish Data Protection Commission

Location · United States

Outlogic (formerly X-Mode)

Location-data broker · Final order April 2024

Settlement
Data
Precise location data, including visits to sensitive locations
What happened
The FTC alleged the broker sold raw location data that could be used to track visits to medical facilities, places of worship and other sensitive locations.
Outcome
Final FTC order: prohibition on selling or sharing sensitive location data, deletion requirements and supplier-consent controls.
FTC final order: X-Mode and Outlogic ↗

US Federal Trade Commission

Faces & biometrics · United States

Rite Aid

Retail facial recognition · Court-entered order February 2024

Settlement
Data
Store-camera images, facial recognition matches and watchlist information
What happened
The FTC alleged Rite Aid used facial recognition in hundreds of stores without reasonable safeguards, leading to false matches and harmful treatment of some shoppers.
Outcome
The stipulated order bars Rite Aid from using facial recognition for security or surveillance for five years and requires safeguards for future biometric systems and an information-security program.
FTC case and court order: Rite Aid facial recognition ↗

US Federal Trade Commission

Platforms & transfers · European Union

Uber (driver data sent to the US)

EU–US data transfers · Dutch AP fine August 2024

Regulator decision
Data
Drivers’ account details, taxi licences, location data, photos, payment details, identity documents and in some cases criminal and medical data
What happened
For more than two years Uber stored European drivers’ data at its US headquarters without a valid transfer mechanism, after it stopped using standard contractual clauses in August 2021.
Outcome
The Dutch authority fined Uber €290 million. Uber has since moved to the EU–US Data Privacy Framework and is contesting the fine.
AP: €290 million fine on Uber for drivers’ data transfers ↗

Dutch Data Protection Authority (AP)

Health & genetic · United States

BetterHelp

Telehealth · Final order July 2023

Settlement
Data
Email addresses, IP addresses and answers to health questionnaires
What happened
The FTC said BetterHelp disclosed data to Facebook, Snapchat, Criteo and Pinterest for advertising and retargeting after promising to keep health information private.
Outcome
Final FTC order: ban on sharing health data for advertising or retargeting, consent and deletion requirements, and US$7.8 million for consumer refunds.
FTC final order: BetterHelp health-data sharing ↗

US Federal Trade Commission

Health & genetic · United States

GoodRx

Health and prescription discounts · Conduct alleged July 2017–April 2020; federal order 2023

Settlement
Data
Health-condition searches and prescription-medication information
What happened
The FTC said GoodRx shared identifiable health information with advertising companies including Facebook and Google, and used some of it for health-related ads.
Outcome
FTC action: restrictions on sharing health data for advertising, deletion notices to recipients, a privacy program and civil penalty judgment.
FTC case: GoodRx health-data disclosures ↗

US Federal Trade Commission

Platforms & transfers · European Union

Meta Platforms Ireland (Facebook)

EU–US data transfers · Irish DPC decision May 2023

Regulator decision
Data
Personal data of Facebook users in the EU and European Economic Area
What happened
Meta kept transferring European Facebook users’ data to the United States after the EU’s top court ruled in 2020 (Schrems II) that US surveillance law put such transfers at risk. The Irish regulator found Meta’s contract clauses and extra measures did not address that risk.
Outcome
Following a binding decision by the European Data Protection Board, the Irish DPC fined Meta €1.2 billion and ordered it to suspend future transfers of that data to the US and to bring its processing into line with the GDPR, including stopping storage of unlawfully transferred data in the US.
DPC concludes inquiry into Meta Ireland’s data transfers ↗

Irish Data Protection Commission

Platforms & transfers · United States

Facebook

Social platform · FTC order and penalty announced 2019

Settlement
Data
Profile and friend data available through third-party apps
What happened
The FTC alleged Facebook shared users’ friends’ data with third-party app developers despite more restrictive privacy settings, and inadequately controlled developer access.
Outcome
US$5 billion FTC penalty and a privacy order requiring product privacy reviews, stronger developer oversight and restrictions on certain uses of security phone numbers.
FTC privacy order and penalty: Facebook ↗

US Federal Trade Commission

Published policy profiles

What the services say they do.

The terms behind the apps, platforms and cloud services people use, most exposed first. Open a row for the detail, the provider's current policy and its official export guide. Note how often low collection still comes with a high switching cost: contacts, purchases and history keep people on a network.

Signals: 1–5, higher means more.Collection beyond core flags published uses such as advertising, cross-service personalisation or off-platform activity beyond delivering the product's basic job. Sharing exposure flags the breadth of named recipients or advertising/partner disclosures. Switching cost: 1–5, higher means harder to leave. These are editorial reading aids, not legal findings or a measure of security.

Takes a lot, hard to leave

Each dot is a service. Across: how much data it takes beyond the core job, the average of its collection and sharing signals. Up: how hard it is to leave. Select a dot to open its profile.

Harder to leave →

Takes more data →

In the red zone, taking the most data and hardest to leave: Meta consumer services, TikTok, Messenger and X (formerly Twitter).

X (formerly Twitter)Social media and advertising platformCollection5/5Sharing5/5Switching5/5
Products covered
X social platform
Data in scope
Account, posts, direct messages, engagement, device, inferred interests, location and advertising information
Published practice
X says it collects activity, direct-message and device information, receives information from ad partners, developers and publishers, and uses information to personalise content and ads. It describes public posts as broadly viewable and searchable.
Reader controls
Review privacy, personalisation, advertising and audience settings; download an archive before deactivating an account and remember that public copies can persist elsewhere.
Why these signals
X's policy describes advertising, inferred interests, off-platform interactions, public availability and affiliate or partner disclosures in addition to running a social service.
Leaving
X offers an HTML and JSON archive, but posts, followers, public visibility, direct-message relationships and audience context do not transfer to a different network.

X Privacy Policy ↗Access and download X data ↗Tools to reduce tracking →

Meta consumer servicesMessaging and social mediaCollection5/5Sharing5/5Switching4/5
Products covered
WhatsApp and Instagram
Data in scope
Account, device, activity and off-Meta business-partner information
Published practice
Meta says it uses information across its products and from businesses that use Meta tools to personalise ads and measure advertising. The exact controls and data available differ by product; message content is governed by WhatsApp's separate security and privacy terms.
Reader controls
Review Accounts Centre privacy and ad preferences, connected businesses and activity controls; read the product-specific WhatsApp policy before relying on a setting.
Why these signals
The published terms describe cross-product use, off-Meta business-partner information and advertising measurement—purposes beyond simply delivering a message or social feed.
Leaving
Instagram information can be exported and WhatsApp supports supported-phone chat transfers, but social relationships, account identity and a usable equivalent of the service do not move with the file.

Meta Privacy Policy ↗Export Instagram information ↗Tools to reduce tracking →

MessengerMessaging and social platformCollection5/5Sharing5/5Switching4/5
Products covered
Messenger and linked Meta account services
Data in scope
Account, device, activity, connection and Meta ecosystem information
Published practice
Messenger is covered by Meta's broader policy, which describes product, device, network, partner and off-product activity information, as well as use across Meta products and advertising systems.
Reader controls
Review Accounts Centre privacy, advertising, connected-business and activity settings; export information before deleting or changing an account.
Why these signals
The published Meta terms describe cross-product use, business-partner information and advertising measurement beyond delivering a private conversation.
Leaving
Meta supports exporting available account information, but a new messaging service cannot inherit the same conversation history, contacts or group relationships.

Meta Privacy Policy ↗Export Meta account information ↗Tools to reduce tracking →

Yahoo MailEmail and advertising-supported servicesCollection5/5Sharing4/5Switching3/5
Products covered
Yahoo Mail and Yahoo account services
Data in scope
Email content, account, device, activity, advertising and location-related information
Published practice
Yahoo says its Communications Services may analyse and store email content. Its general policy says analysis of retailer and organisation emails can be used to create advertising-interest profiles, subject to opt-out controls and, in some places, consent; it distinguishes those messages from personal emails between individuals.
Reader controls
Use Yahoo Privacy Controls to manage targeted advertising, marketing preferences and account information; read the service-specific communications policy for the mail terms that apply.
Why these signals
Yahoo describes email-content analysis for some advertising-interest profiles, cross-device association and targeted-advertising purposes, subject to its stated controls.
Leaving
Yahoo documents backing up mail through a third-party app. That preserves messages, but folders, addresses, rules and account-linked services need their own migration plan.

Yahoo Privacy Policy ↗Yahoo Mail backup options ↗Tools to reduce tracking →

TikTokShort-form video and advertising platformCollection4/5Sharing4/5Switching4/5
Products covered
TikTok app and web platform
Data in scope
Account, device, usage, content metadata and approximate-location information
Published practice
TikTok's US policy says it collects device and user identifiers, can identify activity across devices, and processes user-content metadata. It also describes use of data for content and ad recommendations.
Reader controls
Review in-app privacy, advertising and recommendation settings; check the policy that applies to your country because terms and legal rights vary by region.
Why these signals
The terms describe cross-device identification, content analysis and recommendation or advertising uses in addition to operating the video platform.
Leaving
TikTok lets users request a data copy, but some data may be unavailable and the export does not recreate the feed, audience or social graph somewhere else.

TikTok US Privacy Policy ↗Request and download TikTok data ↗Tools to reduce tracking →

Google account ecosystemEmail, browser, mobile platform, video and cloud storageCollection4/5Sharing4/5Switching3/5
Products covered
Gmail, Google Chrome, Android, Google Play services, YouTube and Google Drive
Data in scope
Account, activity, device, app, service-use and email information
Published practice
Google says its policy covers Gmail, Chrome, Android, YouTube, Drive and services integrated into other apps and sites. It describes account activity and personalisation controls, including controls for YouTube History and Web & App Activity; it also says it does not show personalised ads based on content from Gmail, Drive or Photos.
Reader controls
Use Google Privacy Checkup, Activity Controls and My Ad Center; export or delete account content where the individual product provides those tools.
Why these signals
The policy covers a broad account ecosystem, personalisation and advertising services, including activity on third-party sites and apps. It also sets an important content limit for Gmail, Drive and Photos advertising.
Leaving
Google Takeout can create archives for email, documents, YouTube uploads and account data; Chrome can export browser data. Moving collaborative work, app purchases and recommendation history remains a separate task.

Google Privacy Policy and Privacy Checkup ↗Download Google data with Takeout ↗Tools to reduce tracking →

Adobe Creative CloudCreative software and cloud servicesCollection4/5Sharing4/5Switching3/5
Products covered
Adobe Creative Cloud and Adobe ID services
Data in scope
Account, licence, support, preference, usage and device information
Published practice
Adobe says it collects data to deliver and improve services, tailor experiences and communicate offers. Its policy describes sharing with authorised partners and offers choices for targeted-advertising and cross-contextual advertising controls where applicable.
Reader controls
Use Adobe's Privacy Choices page and product settings to manage preferences, advertising choices and requests to access, correct, delete or export data.
Why these signals
The policy describes tailoring, marketing communications, authorised partners and opt-outs for targeted or cross-contextual advertising where applicable.
Leaving
Local Creative Cloud files remain accessible after cancellation or downgrade, but cloud-storage limits, collaboration links and product-specific formats still need a planned export.

Adobe Privacy Policy ↗Creative Cloud membership and files FAQ ↗Tools to reduce tracking →

RingHome security camerasCollection3/5Sharing3/5Switching4/5
Products covered
Ring video doorbells and security cameras
Data in scope
Account, device and event information; cloud video where a recording plan or feature is active
Published practice
Ring says recordings from eligible devices are stored in the cloud under an active plan and can be managed or deleted by the account holder. Shared videos and optional Neighbors participation have separate consequences; recording availability and retention vary by plan and region.
Reader controls
Review recording, retention, sharing and Neighbors settings in Ring's Control Center; check whether a subscription and any optional encryption feature are active for each device.
Why these signals
Account and device data support the service, while subscribed cloud storage and optional sharing create additional data flows controlled by the selected features.
Leaving
Ring allows eligible saved videos to be downloaded, but the download is not a portable camera history, device configuration or subscription. Save needed clips before their retention period ends.

Ring Privacy Notice ↗Ring privacy and video controls ↗Tools to reduce tracking →

Microsoft consumer servicesEmail and cloud file storageCollection3/5Sharing3/5Switching3/5
Products covered
Outlook.com / Hotmail and OneDrive
Data in scope
Email, files, account, device, usage and subscription information
Published practice
Microsoft says it processes files uploaded to OneDrive to operate the service, and that it discloses personal data to Microsoft-controlled affiliates, subsidiaries and vendors working on its behalf. Its statement says it does not use email, personal files, photos or documents to target ads.
Reader controls
Use OneDrive and Outlook.com to access, download or delete account content where available; use the Microsoft privacy dashboard for account-level controls and review sharing links separately.
Why these signals
The statement includes product-improvement, recommendation and advertising uses, plus affiliates and vendors. It says email and personal files are not used to target ads.
Leaving
OneDrive files can be downloaded locally and an Outlook.com mailbox can be exported, but Microsoft says mailbox export requires desktop Outlook and shared links or cloud-only files need checking.

Microsoft Privacy Statement ↗Export an Outlook.com mailbox ↗Tools to reduce tracking →

LG webOS Smart TVsSmart TV viewing dataCollection3/5Sharing3/5Switching2/5
Products covered
LG smart TVs with available viewing-information features
Data in scope
TV and network identifiers, content-identification fingerprints and viewing information when optional ACR is enabled
Published practice
LG says its automatic content recognition (ACR) is off by default and requires a Viewing Information Agreement where available. It uses audio fingerprints, not screenshots or recordings; depending on market and consent, viewing information may be shared with LG Ad Solutions for measurement or advertising-related uses.
Reader controls
Review the TV's User Agreements and turn off Viewing Information or ACR if unwanted. Interest-based and cross-device advertising require separate agreement; exact menus and rights vary by market.
Why these signals
Optional viewing recognition goes beyond displaying content, and LG describes conditional affiliate or partner uses. These are not claims that every TV or user has ACR enabled.
Leaving
LG says optional viewing and ad agreements can be withdrawn while core TV use continues in supported markets. Disabling collection is easier than moving TV apps, preferences or the device itself.

Understanding privacy on LG smart TVs ↗Manage LG TV user agreements ↗Tools to reduce tracking →

TelegramMessaging and public channelsCollection3/5Sharing2/5Switching4/5
Products covered
Telegram cloud chats and Secret Chats
Data in scope
Phone number, account, cloud-chat content, device and anti-abuse metadata; Secret Chats are separate and device-specific
Published practice
Telegram says ordinary cloud chats are stored on its servers so they can sync across devices. It distinguishes them from Secret Chats, which use end-to-end encryption and are not stored in the Telegram cloud. Its policy says it may collect IP, device and app metadata for security and anti-spam purposes.
Reader controls
Use Secret Chats only when that device-specific model fits the conversation; review phone-number visibility, location, cloud-chat and account self-destruction settings separately.
Why these signals
Cloud storage is central to Telegram's multi-device product, and the policy describes anti-abuse metadata. Telegram says it does not use data to show ads, while Secret Chats have a different, end-to-end encrypted storage model.
Leaving
Telegram Desktop can export cloud chats in HTML or JSON, but social relationships and channels do not transfer to another messenger. Secret Chats are device-specific and are not part of the cloud export path.

Telegram Privacy Policy ↗Telegram data and chat export ↗Tools to reduce tracking →

Samsung Smart TVsSmart TV viewing dataCollection3/5Sharing2/5Switching2/5
Products covered
Samsung smart TVs with Viewing Information Services
Data in scope
Viewing history, TV identifiers and IP address when optional automatic content recognition is enabled
Published practice
Samsung says its optional automatic content recognition (ACR) generates signatures to identify viewed programs after a user opts into Viewing Information Services. Samsung says it does not record the displayed content, and the feature can be turned off in TV settings.
Reader controls
Review Viewing Information Services and Smart Hub privacy notices in the TV settings, and turn ACR off there if you do not want viewing-history collection.
Why these signals
Opt-in viewing-history collection goes beyond showing a picture; the cited ACR explainer does not establish that every TV shares this information with advertisers or has the feature enabled.
Leaving
Samsung says ACR can be turned off in TV settings. This controls the optional viewing feature, but does not export TV apps, purchases or preferences to another brand.

Samsung Smart TV ACR explainer ↗Samsung Smart TV ACR controls ↗Tools to reduce tracking →

DropboxCloud file storage and collaborationCollection3/5Sharing2/5Switching2/5
Products covered
Dropbox cloud storage
Data in scope
Account, usage, device and stored-content-related information
Published practice
Dropbox says it uses trusted third parties to provide, improve, protect and promote its services. Its policy FAQ says it may analyse account activity for product features and, in some cases, to identify people who may be interested in premium services; it also says it does not sell personal data.
Reader controls
Review account privacy and notification settings, connected apps and shared links; use the account privacy tools for access or deletion requests.
Why these signals
The published FAQ describes product, security and premium-service marketing uses, and named trusted third parties acting on Dropbox's behalf; it says Dropbox does not sell personal data.
Leaving
Dropbox supports downloading files and folders as local copies. Large folders have browser and file-count limits, so test a full export before closing an account.

Dropbox Privacy Policy FAQ ↗Download Dropbox files and folders ↗Tools to reduce tracking →

eufy SecurityHome security camerasCollection2/5Sharing2/5Switching3/5
Products covered
eufy cameras, video doorbells and HomeBase
Data in scope
Account and device details, service logs, and recordings or event data according to the device and storage options
Published practice
Anker's notice covers eufy and says supported security-camera analysis and person-feature data are processed locally unless separate cloud or sharing features are enabled. Optional cloud backup and expert monitoring change where footage may be processed; the path depends on the model and settings.
Reader controls
Check each camera's local or cloud storage, sharing and monitoring settings. Review any optional improvement-program choices separately from the core recording setup.
Why these signals
Local processing is a meaningful limit in the published terms, but optional cloud, monitoring and account features can add processing beyond recording on the device.
Leaving
The app can download supported event clips as files. That is not a full account export or a promise that every model's continuous recording and settings will move to another camera system.

Anker and eufy Privacy Notice ↗Download and delete videos in the eufy app ↗Tools to reduce tracking →

Hik-ConnectCamera access and recordingCollection2/5Sharing2/5Switching3/5
Products covered
Hikvision cameras and recorders used with Hik-Connect
Data in scope
Account identifiers, linked-device information, app activity, event alerts and optional cloud-stored video
Published practice
Hik-Connect says camera preview and playback streams pass through its servers but are not stored there. Event alarms can include clips or images retained for seven days; separately enabled cloud storage keeps video in the cloud. Local recorder footage is a different storage path.
Reader controls
Confirm whether each camera records to local media, a recorder or an enabled cloud plan, then review app permissions, device sharing and retention for that setup.
Why these signals
Remote streams and event alerts use Hik-Connect infrastructure even without a cloud-storage plan; further exposure depends on enabled cloud, alarm and sharing features.
Leaving
Supported Hikvision recorders and cameras can export video through iVMS-4200, sometimes needing Hikvision's player or conversion. The app account and device configuration do not transfer with those clips.

Hik-Connect Privacy Policy ↗Export recorder or camera video with iVMS-4200 ↗Tools to reduce tracking →

Session Private MessengerPrivacy-focused messagingCollection1/5Sharing1/5Switching5/5
Products covered
Session private messenger
Data in scope
A pseudonymous account ID and limited connection information; no phone number or email is required
Published practice
Session's app policy says it does not collect or share information, does not require a phone number or email, and does not store identifying device information such as IP address. Its documentation describes end-to-end encryption and onion-routed paths intended to reduce metadata exposure.
Reader controls
Keep control of your account ID and keys, review device access and do not confuse an anonymous account with a verified real-world identity of a contact.
Why these signals
Session's stated model is intentionally unlike ad-funded messengers: pseudonymous IDs, no required phone or email and no collected or shared app data according to its policy.
Leaving
The privacy model reduces account linkage, but it is not interoperable with other messengers. Session's donation page said core Foundation operations could cease in July 2026 without funding, so verify current service continuity before relying on it for irreplaceable communication.

Session App Privacy Policy ↗Session continuity notice ↗Tools to reduce tracking →

SignalMessagingCollection1/5Sharing1/5Switching4/5
Products covered
Signal messaging
Data in scope
Phone number, account details and limited service metadata; messages and media remain end-to-end encrypted
Published practice
Signal says messages and calls are end-to-end encrypted and that message and media content is stored locally on the device rather than being available to the Signal service.
Reader controls
Review account-data settings and local backup or transfer choices before changing devices; treat device access and backups as part of the security model.
Why these signals
Signal's published support material describes a deliberately limited service model: message and media content are end-to-end encrypted and not available to the service for advertising or profiling.
Leaving
Account data can be exported, but Signal says the report does not include messages or media. Leaving a messenger still means rebuilding conversations and group participation elsewhere.

Signal legal and privacy information ↗Request Signal account data ↗Tools to reduce tracking →

Product exit index

Can you take it with you?

Product-level exit assessments for the services above. A data export is only the first step; the score reflects how much access, identity, history or workflow remains behind.

Hard to leave 11

Identity, contacts or purchases stay behind.

  • Session Private Messenger5/5
    Privacy-focused messaging

    Its pseudonymous, non-interoperable design makes moving conversations to another messenger difficult. Session has also published a continuity warning: verify the network's current status before depending on it.

    Session continuity notice ↗
  • X (formerly Twitter)5/5
    Social media

    An HTML or JSON archive preserves an account snapshot, not its public identity, audience, direct-message relationships or platform visibility.

    Access and download X data ↗
  • Android and Google Play services4/5
    Mobile platform

    Direct transfer can move much data, but some apps, app data, accounts and manufacturer-specific features do not transfer cleanly.

    Android backup and transfer data ↗
  • Instagram4/5
    Social media

    You can export information, but followers, recommendations, direct-message relationships and account identity stay on the network.

    Export Instagram information ↗
  • Messenger4/5
    Messaging

    Meta can export available information, but a different messaging service cannot inherit the same history, contacts or group relationships.

    Export Meta account information ↗
  • Ring doorbells and cameras4/5
    Home security

    Download eligible saved clips within their retention window; cloud history, account relationships and camera setup do not become portable with them.

    Ring privacy and video controls ↗
  • Signal4/5
    Messaging

    The account report excludes message and media content; moving to another messenger also means rebuilding groups and conversations.

    Request Signal account data ↗
  • Telegram4/5
    Messaging and public channels

    Cloud chats can be exported from Telegram Desktop, but social relationships and channels do not move. Secret Chats are device-specific and deliberately outside cloud synchronisation.

    Telegram data and chat export ↗
  • TikTok4/5
    Video platform

    A data copy is available, but the feed, audience and social graph are not portable to a replacement platform.

    Request and download TikTok data ↗
  • WhatsApp4/5
    Messaging

    Supported phone transfers move chat history, but conversations, groups and phone-number identity do not become usable on another service.

    WhatsApp chat transfer information ↗
  • YouTube4/5
    Video platform

    You can download your uploads, but audiences, subscriptions, comments, recommendations and creator tools are platform-specific.

    Download uploaded YouTube videos ↗

Some work 6

Exports exist, but history or setup is lost.

  • Adobe Creative Cloud3/5
    Creative software

    Local files remain accessible after cancellation or downgrade, but cloud limits, sharing links and native formats still need a plan.

    Creative Cloud membership and files FAQ ↗
  • eufy Security3/5
    Home security

    Download supported event clips in the app before changing systems; storage and export options vary by model, and settings do not follow the files.

    Download and delete videos in the eufy app ↗
  • Gmail3/5
    Email

    Takeout creates an archive, but a real move still needs another mail provider or client and a mailbox import plan.

    Download Google data with Takeout ↗
  • Hikvision / Hik-Connect3/5
    Home security

    Export supported recorder footage with iVMS-4200; playback or conversion may need Hikvision software, and device configuration remains a separate move.

    Export recorder or camera video with iVMS-4200 ↗
  • Outlook.com / Hotmail3/5
    Email

    Mailbox export is supported, but Microsoft says it requires desktop Outlook and is not a one-click transfer to another mail service.

    Export an Outlook.com mailbox ↗
  • Yahoo Mail3/5
    Email

    Yahoo documents backup through a third-party mail app; folders, rules and account-linked services need separate migration work.

    Yahoo Mail backup options ↗

Easier to leave 6

Files and settings move with little loss.

  • Dropbox2/5
    Cloud storage

    Files and folders can be downloaded as local copies, but large-folder limits make a tested export important before leaving.

    Download Dropbox files and folders ↗
  • Google Chrome2/5
    Browser

    Bookmarks and selected signed-in browser data can be exported; extensions and web habits still need manual replacement.

    Export Chrome data ↗
  • Google Drive2/5
    Cloud storage

    Takeout can create an archive; check formats, sharing links and collaboration workflows before moving important work.

    Download Google data with Takeout ↗
  • LG webOS Smart TVs2/5
    Smart TV

    Optional viewing-information and ad agreements can be withdrawn in TV settings; that is distinct from moving apps and preferences to another TV.

    Manage LG TV user agreements ↗
  • OneDrive2/5
    Cloud storage

    Files and folders can be downloaded, but shared links, online-only files and specialised content need a deliberate migration check.

    Download OneDrive files and folders ↗
  • Samsung Smart TVs2/5
    Smart TV

    ACR can be switched off in TV settings, but Samsung does not describe that control as an export of apps, purchases or preferences.

    Samsung Smart TV ACR controls ↗

Follow the purpose, not just the permission.

A location permission tells you what an app can access. It does not, by itself, tell you how long the information is kept, who receives it, or whether it is used to build an advertising profile. Read those questions separately.

  1. Collection: distinguish information you supply from activity the service observes and conclusions it infers. A purchase history and an inferred interest are different records.
  2. Purpose: look for a connection between the data and the feature you chose. Put optional advertising and cross-service personalisation on a separate list from delivery, billing and security.
  3. Recipients: identify whether the policy names service providers, affiliated companies or advertising partners. A recipient category is not proof that every record is sent to every recipient.
  4. Retention: check what account closure changes and what the provider says it retains. An export, a deletion request and turning off personalisation are three different actions.

Make an export useful

Open a sample before relying on it. Check whether the download includes the original files, timestamps and attachments you need, and whether another tool can read them. Keep the request confirmation and record the date you changed privacy settings.

For Australian readers, the OAIC explains the general right to request access to personal information and the exceptions that can apply. That is a different question from whether a provider offers a convenient migration tool. Read the OAIC access guide →