Feb 2021United StatesGoogle CSAM image classifier
In February 2021 a San Francisco father took photos of his toddler son's medical condition after a nurse asked for photos before a video consultation; the doctor used them to diagnose the problem and prescribe antibiotics. The New York Times reported in August 2022 that when the photos were backed up from his Android phone to Google's servers, Google's artificial-intelligence tool for recognising never-before-seen child abuse images flagged them. Two days after the photos were taken his Google account was disabled for 'harmful content', which cost him more than a decade of email, contacts and photos and, through Google Fi, his phone number. Google reported him to the National Center for Missing and Exploited Children, and the San Francisco police obtained search warrants for his account; the investigator concluded that no crime had occurred. Google refused to reinstate the account after two appeals, the second with the police report, and later notified him that it was being permanently deleted. The Times reported a second father in Houston whose photos of his toddler, taken at a paediatrician's request, were also flagged; his Gmail account was disabled in the middle of buying a house, Houston police questioned and cleared him, and he did not get the account back. Google said it stood by its decisions and that its reviewers had found a further video in the San Francisco father's account that it considered problematic.
Contextual tracker case Medium reported severity Investigation Opened
AI involvement reported · Causal attribution supported · 3 sources, 1 underlying account · Added 02/11/2026
10 Jul 2024Event location unknownGemini (reported)
In a thread on X on 10 July 2024, an AI governance adviser wrote that he had just opened his tax return and that Gemini, Google's AI assistant, summarised it without being asked. He wrote that he could not find a setting to stop it, that the two locations Gemini itself suggested did not work, and that when another user showed him the setting meant to keep Gemini out of his documents it was already turned off while Gemini kept giving document summaries. His later testing, in the same thread, suggested that once Gemini had been opened for one PDF in Google Drive it was invoked again for every PDF he opened until he closed it, and he put forward a working theory that his 2023 sign-up for Workspace Labs had overridden the opt-out. A Google spokesperson told technology outlets that using Gemini in Google Workspace requires a user to enable it proactively and that content is not stored without permission; Tom's Hardware reports that Google suggested he may have used Gemini through the Drive side panel and that closing the panel might solve the issue.
Contextual tracker case Low reported severity Media Coverage
AI involvement reported · Causal attribution alleged · 4 sources, 1 underlying account · Added 01/11/2026
Event date unknownEstoniaUnidentified AI web service
In its overview of personal-data breach notifications for the third quarter of 2026, published on 8 October 2026, Estonia's Data Protection Inspectorate (AKI) listed a case in which a bank employee uploaded employment contracts to a widely used AI web service, making them available to other employees who used the same AI account. Answering questions from the technology outlet Geenius, AKI said the employment contracts of a few individual employees had been entered into the AI system and became accessible to other employees using the same account; Geenius reports that those colleagues could view and download them. According to the report, the bank informed the people affected and blocked its employees from using that AI system. AKI did not name the bank, the AI service or further circumstances.
Contextual tracker case Low reported severity Internal Action
AI involvement supported · Causal attribution supported · 2 sources, 1 underlying account · Added 31/10/2026
2019Event location unknownSiri
On 26 July 2019 the Guardian reported that contractors grading a small share of Siri recordings for Apple regularly heard confidential information. Its anonymous source, a contractor, said Siri was often activated by mistake, for example by the sound of a zip, and that these accidental activations captured private discussions between doctors and patients, business deals, apparently criminal dealings and sexual encounters, with location, contact details and app data attached. Apple told the Guardian that requests were not linked to users' Apple IDs and that less than 1% of daily activations were graded. On 28 August 2019 Apple apologised, said it had suspended human grading, and said audio would no longer be retained by default, grading would become opt-in and recordings found to be inadvertent triggers would be deleted. Device owners' class action, Lopez v. Apple in the federal court in Oakland, alleged that Apple recorded private conversations after unintended Siri activations and disclosed them to third parties. Apple agreed to pay $95 million while denying wrongdoing, and co-class counsel say the judge granted final approval on 16 October 2025.
Contextual tracker case Medium reported severity Lawsuit Settled
AI involvement supported · Causal attribution supported · 4 sources · Added 29/10/2026
2019BelgiumGoogle Assistant
On 10 July 2019 the Belgian public broadcaster VRT NWS reported that it had listened to more than a thousand audio excerpts recorded by Google Home smart speakers and the Google Assistant phone app, passed to it by someone working for a Google subcontractor that transcribes Dutch-language recordings to improve Google's speech recognition. VRT said 153 of the excerpts were conversations in which "Okay Google" was clearly not said, and that it could hear addresses and other sensitive information, which let it find and visit people in Flanders who recognised their own or relatives' voices. Google said one of its language reviewers had leaked confidential Dutch audio data, and explained that its devices rarely have "false accepts", when background noise or words are interpreted as the hotword. Google suspended human review of Assistant audio in Europe, and the Hamburg data protection authority began an urgency procedure under Article 66 of the GDPR to stop the reviews for three months, according to TechCrunch.
Contextual tracker case Medium reported severity Regulatory Action
AI involvement supported · Causal attribution supported · 3 sources · Added 28/10/2026
2024United StatesGaggle
The Lawrence, Kansas, school district began using Gaggle, a student-monitoring service, on school accounts in November 2023. A federal lawsuit filed on 1 August 2025 by current and former students alleges that Gaggle, which the complaint says operates through artificial intelligence that flags items for review by Gaggle moderators, flagged original photography assignments uploaded by art and photography students. According to the complaint, in early 2024 security officers took students out of class to the front office of a Lawrence high school, where administrators told them their images had been flagged by Gaggle for indecent exposure and child pornography; an assistant principal accused a photography student of having such material, refused to let her view the images, and questioned her about them from memory, and administrators admitted they had not seen the flagged content. The student told them she had uploaded that day a photography assignment showing a fully clothed friend; the complaint says the flagged content consisted of original photographs taken for class assignments, that students found their photographs removed from their school accounts only by comparing them with personal backups, that one student had to explain each image in her portfolio to district staff and became concerned that future assignments would bring more scrutiny, and that the district restored the images only after months of advocacy. The Associated Press, in reporting that included an analysis of the district's Gaggle alert records, said the photos had been automatically deleted and that students with backups showed it was a false alarm, and that district officials said they later adjusted the software's settings to reduce false alerts. On 8 April 2026 the federal court dismissed, on qualified immunity, the claims against the assistant principal and another official, saying it had found no law establishing that a school official cannot rely on an AI surveillance flag to call in a student for questioning; other claims against the district continue, and the docket shows depositions noticed in October 2026.
Contextual tracker case Medium reported severity Lawsuit Ongoing
AI involvement reported · Causal attribution alleged · 5 sources · Added 27/10/2026
23 Feb 2024United KingdomMetropolitan Police live facial recognition
On 23 February 2024 Shaun Thompson, a London community volunteer whom the 2026 judgment describes as 39, walked past a Metropolitan Police live facial recognition deployment near London Bridge station. The High Court records as not in dispute that the system detected a high level of facial similarity between images of him and the watchlist image of his brother, who was the subject of an outstanding arrest warrant, and generated an alert. According to the court's account, officers stopped, detained and questioned him and made him prove his identity, and when he declined to have his fingerprints taken he was threatened with arrest; he says the experience left him angry and distressed. Officers ended the engagement after checking police records about his brother, and he confirmed his identity with a passport photograph on his phone. Big Brother Watch, whose director was his co-claimant, says he was held for almost 30 minutes despite showing several identity documents. His judicial review claim about the stop, issued in May 2024, was withdrawn under a consent order agreed on 18 December 2024 on terms including a settlement sum paid to him. An amended challenge to the Met's revised live facial recognition policy of September 2024, brought with Big Brother Watch's director, was dismissed by the Divisional Court on 21 April 2026; the court said it was not judging the merits of the technology, and the claimants announced plans to appeal.
Contextual tracker case Medium reported severity Lawsuit Dismissed
AI involvement supported · Causal attribution established · 4 sources, 3 underlying accounts · Added 26/10/2026
2024GermanyMicrosoft Copilot
A court reporter from the Tübingen area found in 2024 that Microsoft's Copilot, asked about him, described him as a man charged in a child abuse case, an escapee from a psychiatric institution and a fraudster who cheated widows, according to his account to the public broadcaster SWR as relayed by heise and ComputerBild. All were defendants in trials he had covered as a journalist. heise and ComputerBild, both citing SWR, report that Copilot also gave his private phone number and full home address and offered a route there. He told The Register that seeing his name tied to these crimes was traumatising and that prosecutors had rejected his criminal complaint in two instances; according to the SWR account relayed by heise, the complaint failed because no real person was the author. After the Bavarian data-protection authority contacted Microsoft the claims were briefly unavailable and then returned. Microsoft told The Register it had investigated and taken appropriate and immediate action.
Contextual tracker case Medium reported severity Internal Action
AI involvement supported · Causal attribution supported · 4 sources, 3 underlying accounts · Added 25/10/2026
Event date unknownEvent location unknownUnidentified chatbot
Panasonic Operational Excellence, a Panasonic Holdings subsidiary, announced on 23 October 2026 that a member of an in-house project introducing a personnel information system had uploaded part of that system's data, as registered in April 2026, to an external generative AI service whose use the company prohibits. According to the announcement as reported by ITmedia and CNET Japan, the data covered about 75,000 current and about 178,000 former employees of Panasonic group companies in Japan (employee numbers, addresses, phone numbers and email addresses, without names) and about 81,000 family members registered as emergency contacts (names, addresses, phone numbers and email addresses), about 334,000 people in all. The company says the upload broke internal rules and was not an outside attack, that the employee deleted the chat history and the local data immediately after the problem came to light, and that it reported the matter to Japan's Personal Information Protection Commission on 29 September. The provider told the company that training on the data was switched off at upload but that deleted data is kept for 30 days, until 25 October. No public exposure or misuse had been confirmed. The company has not named the AI service.
Contextual tracker case Medium reported severity
AI involvement reported · Causal attribution supported · 3 sources, 1 underlying account · Added 24/10/2026
9 Oct 2024 to 5 Dec 2024United StatesGaggle (reported)
On 9 October 2024 a Marana Unified School District pupil in Arizona, typing at home on a school Chromebook in front of his mother, wrote a threat-like joke about shooting up the school in a draft email to a teacher and deleted it without sending it, according to his family's federal lawsuit. The family says Gaggle, the AI-based monitoring software the district used, flagged it: the principal received a Gaggle notification with a photograph of the screen and, with the school resource officer, called the mother within the hour. The family says the pupil was suspended for ten days, a long-term suspension hearing imposed 45 days reducible to eleven with counselling, and the superintendent finally affirmed a nine-day suspension in December 2024. In March 2026 the District of Arizona let the family's First Amendment claim proceed and dismissed its procedural due process claims. The district declined to comment to the press.
Contextual tracker case Low reported severity Involving minors Lawsuit Ongoing
AI involvement reported · Causal attribution alleged · 3 sources, 2 underlying accounts · Added 23/10/2026
Dec 2019 to Jul 2020United StatesUnidentified facial recognition system
In a complaint filed in federal court in Pennsylvania on 19 December 2023, the US Federal Trade Commission alleged that the pharmacy chain Rite Aid used facial recognition in its stores to match customers against a database of people it suspected of shoplifting or other wrongdoing, and that staff acted on the match alerts by following, searching, ejecting and publicly accusing customers and by calling the police. The FTC says many alerts were false positives: employees recorded thousands of false-positive alerts between December 2019 and July 2020, staff stopped and searched an 11-year-old girl on a false match, and employees called the police on a Black woman matched to an image of a white woman with blonde hair. Rite Aid agreed to a proposed order barring it from using facial recognition in retail stores for five years, without admitting or denying the allegations.
Contextual tracker case Medium reported severity Regulatory Action
AI involvement reported · Causal attribution alleged · 2 sources, 1 underlying account · Added 22/10/2026
Sept 2023AustraliaChatGPT
Victoria's Information Commissioner (OVIC) found in a report published on 24 September 2024 that a child protection worker at the Department of Families, Fairness and Housing (DFFH) used ChatGPT in or around September 2023 to draft a Protection Application Report submitted to the Children's Court about a young child. On the balance of probabilities, OVIC found the worker entered personal information, including names, about the child, mother, father and carer, disclosing it to OpenAI; the worker admitted using ChatGPT but denied entering personal information. OVIC found generated content in the report described a doll that the father had reportedly used for sexual purposes as a parental strength ('age-appropriate toys'), downplaying the risk to the child, although the court's and the department's decisions did not change. The report was withdrawn and replaced, and the mother, father and carer described anxiety when told of the disclosure. OVIC found serious breaches of two privacy principles and issued a compliance notice requiring DFFH to ban and block generative AI text tools for child protection staff until November 2026; DFFH accepted the breach findings.
Contextual tracker case Medium reported severity Regulatory Action
AI involvement supported · Causal attribution supported · 2 sources, 1 underlying account · Added 22/10/2026
23 Sept 2024CanadaOtter.ai (reported)
An Ontario hospital reported to the provincial privacy commissioner that on 23 September 2024 the Otter.ai transcription tool, installed on a personal device by a physician who had left the hospital in June 2023 and was still on the meeting invite, joined a virtual hepatology rounds meeting, recorded it without notice and then emailed a summary and transcript access to the invite list. The personal health information of seven patients, including diagnoses and treatment, was captured; 12 of the 65 recipients appeared to have left the hospital. The commissioner's letter of 27 October 2025 recommended that the hospital itself ask Otter.ai to delete the retained patient data.
Contextual tracker case Medium reported severity Regulatory Action
AI involvement supported · Causal attribution supported · 3 sources, 1 underlying account · Added 21/10/2026
Dec 2025 to Aug 2026United StatesPega Voice AI (reported)
Four U.S. Bank account holders in California, Massachusetts and Pennsylvania allege in a federal class action filed on 2 October 2026 that Pegasystems' Pega Voice AI, which they say U.S. Bank uses in its contact centres, transcribed their customer-service calls in real time, analysed them with natural language processing and generated suggestions to the agent, without their prior consent. They say they gave account numbers, a date of birth and a home address on the calls, made between about December 2025 and August 2026. The claims are allegations; The CourtListener index of the docket, checked on 21 October 2026, listed the summons as returned executed on 16 October and no response from Pegasystems.
Contextual tracker case Low reported severity Lawsuit Ongoing
AI involvement reported · Causal attribution alleged · 1 source · Added 21/10/2026
18 Oct 2026Event location unknownUnidentified AI transcription tool
In a Reddit post on 19 October 2026, a member of an online creative writing group writes that the day before, the group's host started recording the session using AI transcription software without asking. According to the post, a participant noticed the notification and asked him about it, and the poster and that participant told him they were not comfortable with it. The poster says the host seemed embarrassed and said he should have asked first, but also said members had requested it. The poster had earlier told the host and regulars that they had left another group because it used AI transcription software, and describes the group as one where people read out their original work. The post does not name the software or say whether the recording stopped or what happened to it. The account is uncorroborated.
Contextual tracker case Low reported severity
AI involvement reported · Causal attribution alleged · 1 source · Added 20/10/2026
1 Mar 2025 to 18 Nov 2025United StatesFireflies.AI meeting assistant (reported)
Four Illinois residents who say they never had Fireflies accounts allege in four federal lawsuits, two of them later consolidated, that the Fireflies.AI meeting assistant, enabled by a colleague, boss or meeting organiser, recorded their voices in Zoom or Microsoft Teams meetings between March and November 2025, analysed their vocal characteristics to tell speakers apart and generated transcripts attributing statements to them, capturing voiceprints without telling them or obtaining written consent, in breach of the Illinois Biometric Information Privacy Act. One plaintiff dismissed her case without prejudice in March 2026; the California court stayed its case at both parties’ joint request in April 2026; Fireflies has moved to dismiss the consolidated Illinois case and does not concede that it collected biometric data about the plaintiffs.
Contextual tracker case Low reported severity Lawsuit Ongoing
AI involvement reported · Causal attribution alleged · 6 sources · Added 20/10/2026
Jul 2025United StatesAbridge (reported)
A proposed class action filed in San Diego Superior Court in late 2025 alleges that Sharp HealthCare, which began using the AI documentation app Abridge in April 2025, recorded doctor-patient conversations without telling patients, sent the audio to the vendor's servers and used it to generate draft medical notes. According to the lawsuit as reported by KPBS, the named plaintiff discovered that a July appointment at a Sharp clinic had been recorded only when he read his medical notes; the clinic apologised, acknowledged the recording and told him the file could stay on the vendor's servers for about a month. The complaint also alleges that Abridge inserted statements into charts that patients had been advised of the recording and had consented, when the plaintiff says that never happened. It seeks damages, corrected medical records and an order against using the tool without consent, and estimates that more than 100,000 patients may have been recorded. Sharp told reporters it could not comment on pending litigation. The allegations have not been tested in court in the sources read.
Contextual tracker case Low reported severity Lawsuit Filed
AI involvement reported · Causal attribution alleged · 3 sources, 2 underlying accounts · Added 17/10/2026
Oct 2026Event location unknownMeta AI (reported)
In a Reddit post on 13 October 2026, an owner of Ray-Ban Meta smart glasses says the glasses captured conversations they were having with another person although they had not said the wake word "Hey Meta" and the setting for responding without it was turned off. The owner says the Meta AI app saved audio recordings and text transcripts of these conversations in their history, that Meta AI never answered, and that they saw the same behaviour on three pairs (second and third generation) after a recent firmware update. A screenshot attached to the post shows the app's voice activity log with stored entries dated 12 October. The owner says Meta Support advised turning off microphone and camera permissions, Wear Detection and automatic updates and deleting voice history, and later replied that recording continued with everything turned off. On 16 October 2026, after Meta's statement, the owner replied that a new update had been pushed to their glasses and the issue was unchanged. A Meta spokesperson told Android Authority, as relayed by Futurism, Ars Technica and Mashable, that the issue had been resolved. Ars Technica reports that Meta has not said what caused the recordings or how many glasses were affected, and that Android Authority could not reproduce the problem before Meta's statement. The owner says they cannot establish whether the recordings were sent to Meta's servers. On 19 October 2026 a California buyer filed a proposed class action against Meta in federal court (Subia v. Meta Platforms) alleging that Meta AI glasses recorded his conversations without the wake phrase, in violation of California's wiretapping law; the complaint quotes reporting of this owner's three-pairs account. Its allegations are unproven.
Contextual tracker case Low reported severity
AI involvement reported · Causal attribution alleged · 6 sources, 3 underlying accounts · Added 16/10/2026
Aug 2026Event location unknownGoogle AI Mode
In late August 2026 a colleague told a German physician, until that summer a chief physician at a hospital, that searching his name with the word for suspension in Google's AI Mode produced what read like a factual report: that he had been suspended and dismissed and had received a suspended sentence for sexual coercion. According to legal news site beck-aktuell, none of it concerned him; the AI had apparently attached facts about another former senior employee of the same hospital to his name, and the newspaper articles it linked as sources did not name him. Google said it had reviewed his complaint and would take no action, and a lawyer's warning letter also failed. On 24 September 2026 the Aachen Regional Court issued a preliminary injunction (8 O 268/26) barring Google Ireland Limited from spreading the claims through AI Mode, finding that they violated his personality rights and that Google is responsible for its AI search answers.
Contextual tracker case Medium reported severity Lawsuit Ongoing
AI involvement supported · Causal attribution established · 2 sources, 1 underlying account · Added 15/10/2026
Sept 2026PakistanClaude (reported)
A teenager in Karachi was detained by Pakistan's National Cyber Crime Investigation Agency (NCCIA) and later released after his questions to an AI chatbot about how a character in a crime story could be killed were flagged, according to officials quoted by ARY News (29 September 2026) and the NCCIA as cited by ProPakistani (2 October 2026). ProPakistani reports that, according to the NCCIA, the platform's safety system flagged the queries on 4 September and the information was reportedly shared with the US FBI, which passed it to Pakistani authorities; ARY reports that the NCCIA carried out a raid and detained him. Bloom Pakistan, relaying The News, names the chatbot as Anthropic's Claude and reports that Anthropic reported the activity to the FBI. Officials said he told investigators he was writing a fictional crime story, and he was released after questioning; Bloom, relaying The News, says investigators found no grounds for prosecution but remained concerned.
Core + contextual relations Medium reported severity Involving minors Investigation Opened
AI involvement reported · Causal attribution supported · 3 sources, 2 underlying accounts · Added 14/10/2026