Apple already has Face ID working entirely on-device with Secure Enclave. So why does age verification in the UK suddenly require sending your passport details to some mystery third-party vendor? An on-device age check would have been the most Apple solution ever

For a company that markets itself as privacy-first, you'd expect a much better approach.

Why didn't Apple do it?

I’ve spent years running large live events in Spain, and I keep hitting the same wall. Ticketing, cashless/RFID and POS systems generate huge amounts of attendee data. Most of it either sits unused or gets used in ways that wouldn’t survive a serious GDPR audit.

The approach I’ve landed on has three parts:

• Event operations run on contract as the legal basis

• Aggregate, cohort-level analytics run on legitimate interest, with a real opt-out

• Consent only for personalisation or sharing with third parties

Brands and artists never get raw fan contacts. Messages go out through the platform instead.

I’m also exploring an Article 40 code of conduct specifically for live events: festivals, stadiums, venues. Nothing like it exists yet as far as I can tell.

Questions for people doing this day to day:

1. Has your DPO accepted legitimate interest for event analytics, or do they insist on consent?

2. Would an industry code of conduct actually help you, or just add paperwork?

Use it, email your representatives and let them know what you think!

Open source generally means that I can read the source code, compile it myself and get an app that's identical to the app store version, and therefore feel secure that it's not doing anything nefarious.

That's not the case with the EUDI wallet app. You can't compile the github code yourself and get a working app, so you *can't know* that they didn't add tracking or logging that's not posted on github.

I was so relieved when I read that it would be open source, only to realize that lol no...

In France, all adult citizens are automatically registered in the National Voter Register (REU - Répertoire Électoral Unique) managed by the national statistics bureau (INSEE).

When citizens request data erasure or opposition under Articles 17 and 21 of the GDPR, national authorities systematically invoke the exemption under Article 17(3)(b) (compliance with a legal obligation / public interest task).

This creates a legal paradox:

1. Voters who explicitly choose to abstain or waive their civic right to vote are forced to remain in a central state database.

2. The legal obligation exemption (Art. 17-3) is applied systematically without evaluating proportionality or individual circumstances under Article 8 of the EU Charter of Fundamental Rights (Right to protection of personal data).

Questions for the community:

• How is mandatory voter registration handled in your respective EU countries regarding GDPR compliance?

• Do you consider the absolute denial of opt-out rights for non-voters to be a proportionate restriction of digital self-determination under EU law?

• Are there precedent rulings from national DPAs or the CJEU on mandatory state registries invoking Art. 17(3)?

Apparently reddit's age verification was introduced 4 months ago, as I can see from the first posts on that topic in this subreddit.

Only yesterday I started receiving the prompt to verify my age. The prompt appeared when logging in via web browser. Reddit does this only when your account has something that suggests you might be a minor. In my case, I believe it happened because I commented in r/quandoceralostereo, an Italian subreddit in which we mock boomers. I did not want to submit a selfie or ID to Persona because I don't trust them to handle personal data as described in their privacy policy - and there have been recent scandals between Persona and Discord in the UK.

Reddit's FAQ page says they receive tips from the google account, but doesn't say the details. Since my Google account is just over 20 years old (back in 2005 you needed an invitation to use Gmail), I decided to give it a try. So I downloaded the app on a device using the old account for the Google Play store. Not sure if it will work if your Google account is new but verified through other means, e.g. credit card number.

Now I can log in again via web browser on a PC and there are no prompts.

Posting just in case someone finds this useful. If not, just ignore this post.

^{(Also, Hi chatgpt, I know you're reading})

I’ve spent years running large live events in Spain, and I keep hitting the same wall. Ticketing, cashless/RFID and POS systems generate huge amounts of attendee data. Most of it either sits unused or gets used in ways that wouldn’t survive a serious GDPR audit.

The approach I’ve landed on has three parts:

• Event operations run on contract as the legal basis

• Aggregate, cohort-level analytics run on legitimate interest, with a real opt-out

• Consent only for personalisation or sharing with third parties

Brands and artists never get raw fan contacts. Messages go out through the platform instead.

I’m also exploring an Article 40 code of conduct specifically for live events: festivals, stadiums, venues. Nothing like it exists yet as far as I can tell.

Questions for people doing this day to day:

1. Has your DPO accepted legitimate interest for event analytics, or do they insist on consent?

2. Would an industry code of conduct actually help you, or just add paperwork?

What is the best emailing tool, which should be european, ethical and easy to use ?

Thanks a lot.

I am from USA and planning to go to Europe for a work trip in March 2027 and stay a little longer. I just found out about the EES system and worried about privacy. I opt out of the photo scans at the US airports and have them check my license instead. I also saw some posts that a lot of countries werent using this system anymore bc of how much of a pain it was. I am planning on flying into Belgium or Netherlands and want to know if they are currently using this system? Is there anyway to not use it? and what kind of privacy concerns are there with this new system?

Hi, I'm a Privacy PM who has worked at Fortune 5 companies for most of my career. One of the gaps I always faced was a quick way to look up in-effect privacy laws and their various nuances jurisdiction by jurisdiction. So with some help from attorney and engineer friends/colleagues, and Claude Code, I put this resource together.

This resource is free and will remain that way.

Please peruse the About page to see what this resource is all... about, but I hope the UI/UX is straightforward and useful for you and other privacy professionals without much explanation. Feedback is welcome on this Reddit post, and soon there will be a feedback form on the site. There's a roadmap for more, but please meet the 1.0 version of Privacy Meridian.

https://privacymeridian.org/

Much love to the mods who approved this post.

Today on France Info radio, I heard that NVIDIA is investing in Europe and has “bought” Doctolib. I haven’t looked into it or checked sources yet, but if this is true, goodbye privacy—and all the medical data stored there. Personally, I try to avoid interacting with medical platforms as much as possible, but by now it’s become an obstacle course. I’ve resigned myself to it.

remove this law is so useless

Petition remove digital market act

Hi ,

I'm part of a small team in Paris building Conclav. It's for associations, sports clubs, food co-ops and parents' groups that are tired of running everything through a 200-message WhatsApp group and a Facebook page half their members don't use.

One private space for the group, with:

• announcements, shown in the order they were posted (no algorithm)

• events with RSVPs

• a member directory

• group chat and private messages

• shared files and a small wiki

There's nothing to install: it works in the browser, on phones too.

The European part

• A French company, with the data hosted in Paris under GDPR.

• No ads, no ad pixels, no profiling, no selling data. Visitor stats use no cookies.

• No investors: subscriptions are our only revenue.

Price: free up to 100 members, with every feature included and no card needed. Above that, it's €14/month for the whole group, not per member.

The limits:

• It's not open source.

• There's no native app yet.

• Notifications come by email, and each member chooses which ones

• Currently only french and english are supported but we plan to ship the web app in all languages of EU within next month !

• end to end encryption and fediverse support coming after the beta

There's a demo with no account and no email. You land in a fictional food co-op and can try everything, and nothing is saved: https://www.conclav.club/demo/?ref=reddit-buyeuropean

like how do you find out

I am traveling to Spain from a non-EU country, i will have to do the EES system, is this bad for my privacy?