Internet Freedom in October 2026: The Month in Review
The EU KIDS Act Explained: What It Does and What It Means
We covered the KIDS Act announcement within hours of von der Leyen's State of the Union address. Now that the Commission has published its full FAQ, the picture is clearer. The law does two things: a three-tier age staircase — no accounts under 13, parent-supervised accounts for ages 13 to 14 with a one-hour daily limit, independent accounts from 15 — and a safe-by-design mandate covering social media, video platforms, games, AI chatbots, and app stores, banning infinite scrolling, streak mechanics, and recommender systems optimized for engagement over wellbeing.
Age verification uses "zero-knowledge proof" technology that tells the platform only whether a user is above or below the threshold. Very large platforms must submit audited compliance plans before their services come into contact with children, at their own expense. Fines reach 6% of global annual turnover.
A Federal Judge Blocked Utah's VPN Age Verification Law
U.S. District Judge David Barlow granted a preliminary injunction against Utah's SB 73 — the first US state law to explicitly require platforms to identify and geolocate users even when they're using a VPN — finding the mandates "likely to violate the United States Constitution."
The judge's reasoning is technical and constitutional simultaneously: perfect geolocation doesn't exist, and demanding platforms bypass encrypted traffic to determine a user's physical location isn't just unreliable; it creates free speech and privacy problems that the age verification goal doesn't justify. The law also banned websites from explaining how VPNs work — a direct restriction on communicating lawful information. The ruling is preliminary, and Utah may appeal, but it creates a judicial record other states drafting similar provisions will need to reckon with.
Pennsylvania's Age Verification Bill Would Expose Adults to ID Theft and Blackmail
Pennsylvania's Senate Judiciary Committee advanced SB 603 on September 28th, requiring state ID verification before accessing any website where at least one-third of content is adult material — without specifying how that data must be secured or protected from misuse. The bill uses private right of action enforcement rather than state attorney general oversight, meaning any website arguably in scope faces lawsuit risk and will over-gate content to avoid it.
Sen. Maria Collett voted against it after naming the specific risk: age verification for adult content creates a linkage between an identity document and a record of access — exactly the data that enables targeted blackmail. A third senator voted yes while acknowledging the privacy concerns and calling for future amendments, saying "I suspect this will not be the last word on this."
Russia Struck Ukraine's Largest Mobile Provider
According to Reuters, Russia struck the Kyiv headquarters of Kyivstar — Ukraine's largest mobile service provider — with a jet drone on September 27th, the same day Russia's defense ministry claimed a strike on a Vodafone Ukraine data center. Over the preceding week, attacks on Ukrainian internet provider infrastructure caused outages for around 100,000 households in Kyiv and the region.
Ukraine's foreign minister said missile alert systems depend on the communications infrastructure Russia is bombing — the alerts that tell people to take shelter run on the same networks being struck. We wrote this week that cutting connectivity has become a deliberate weapon of war rather than a side effect of fighting. The Kyivstar strike is what we were describing.
Malaysia Wants a Freedom of Information Law. It's Not Enough
For the International Day for Universal Access to Information, Malaysia's parliament is currently considering its first federal FOI bill. The Center for Law and Democracy assessed it at 47 out of 150 points under its Right to Information Rating methodology — reflecting gaps including no independent oversight body, no requirement for proactive disclosure, and no protection against existing secrecy laws like the Official Secrets Act overriding it.
The same culture of secrecy is on live display in the Najib Razak pardon case, where the Pardons Board minutes, the AG's submission, and the conditions governing a politically sensitive house arrest arrangement haven't been published. Civil society organizations are calling for the bill to be substantially strengthened before it passes.
A Right to Information Assumes It Still Exists
Access to information laws grant the right to request records. They say very little about whether those records must be preserved and remain reachable. The Internet Archive's Vanishing Culture project documents how much web content published a decade ago is no longer accessible — through link rot, platform shutdowns, and institutional churn.
The material most likely to vanish is the material nobody was resourced to maintain: local government pages, small publications, the working documentation of bodies that have since been restructured. The closest thing the public has to a systematic record of the web is maintained by nonprofits and volunteers operating without a public mandate or stable funding. A right to request something that no longer exists isn't a meaningful right.
The One-Language Internet Is a Form of Censorship
Most of the world's languages are functionally absent from the internet, and the effect on speakers resembles censorship even though nobody issued a ban. AI tools perform well in languages with large training data sets and considerably worse elsewhere — while sounding equally confident in both, making the gap invisible to users.
The Gates Foundation's coalition of 60 organizations, including Anthropic, Google, and the OpenAI Foundation, represents a genuine shift: treating language coverage as infrastructure rather than a localization step applied after a product already works. How that data gets collected matters as much as whether it exists — communities are asking who controls translations of their languages and whether consent was given.
Reddit Is Closing Off the Open Web, One Restriction at a Time
Reddit announced that it’ll limit Old Reddit access to logged-in users who've visited within the previous six months — building on a July login requirement — and will discontinue RSS feed support entirely on November 13, with no replacement for non-moderator users. Reddit frames both changes as anti-scraping measures, and scraping is a real problem.
But the mechanism applies equally to bots and to anyone who reads Reddit through an RSS reader or visits infrequently. Each restriction moves Reddit further from a place you can access without identifying yourself and closer to a fully authenticated, fully tracked platform. "RSS has been a beloved part of the open web for a long time," Reddit's announcement said — in the same post ending its support.
Every New Verification Wall Excludes Someone
The internet has been getting steadily harder to use, and each added verification step — identity checks, biometric scans, app-only access, two-factor codes — quietly removes people who can't complete it. Older adults are the group most affected and also the group most likely to depend on the services now sitting behind those layers.
Age verification has expanded from adult sites into social media, app stores, and operating systems, and the debate focuses almost entirely on whether it keeps minors out — not on whether it locks an eighty-year-old out of their pharmacy portal. The same identity data being collected also turns up in breaches, transferring risk onto the people least equipped to detect or respond to identity fraud.
London Scanned 500,000 Faces in Six Months. Made Zero Arrests
According to a freedom of information document obtained by Liberty Investigates and The Guardian, the British Transport Police's six-month live facial recognition trial at London railway stations scanned more than 500,000 faces, produced one alert — a false match — and led to zero arrests from LFR alerts. The trial cost more than £320,000 and consumed almost 100 hours of police officers' time.
BTP said officers made "associated arrests" for other offenses during the period, but noted those aren't counted in LFR performance data — which recorded nothing. We weren't surprised: when BTP expanded the trial to the London Underground in September, we wrote that the technology being expanded had produced no arrests. Parliament's joint committee on human rights called the rollout a "particularly clear example of risk." The trial is being extended anyway.
Apple and Google Are Lobbying for Child Safety Laws That Can't Touch Them
Apple and Google lobbyists have been quietly pushing state lawmakers in Arizona, Georgia, and Kansas to adopt age verification bills that bar private lawsuits — leaving enforcement only to state attorneys general. The bills they're trying to block, versions of the App Store Accountability Act, would let individual families sue app stores when age checks fail. That's the same mechanism that cost Meta tens of billions in settlements.
Apple and Google want age verification on paper and no individual accountability in practice. Child safety advocates call their proposals "phantom legislation with no real teeth" — partly because they rely on teenagers self-declaring their age. Meta is supporting the ASAA, not out of altruism, but because it shifts the verification liability from platforms to app stores. Everyone in this story claims to want to protect children. The fight is entirely about which company gets sued when a child is harmed.
People Are Using ChatGPT to Decide How to Vote
Voters are using AI chatbots to research their midterm ballots — comparing candidates, fact-checking viral claims, and working through their values with a tool that's always available and never impatient. The behavior makes sense: local journalism is gone, and down-ballot information barely exists. The problem is what these tools actually do. Chatbots are sycophantic by design — they reinforce whatever you already think, leaving you more confident without necessarily more informed.
A Johns Hopkins researcher told NPR that awareness of this isn't enough to protect you from it. One voter described ChatGPT as "a people pleaser" that "will speak positively about whatever you lean towards." He used it for hours to research his ballot anyway. AI companies don't disclose their training data or how their outputs are shaped. Democracy has an information dependency. This isn't fulfilling it.
Denmark's National ID System Was Breached
Unauthorized parties accessed Denmark's Central Person Register in September 2026, exposing names, addresses, and CPR numbers for approximately 8.8 million people — around 80% of all records in the system. They didn't break in: they exploited a legitimate access pathway held by a Danish company, using authorized credentials to extract data at scale. CPR numbers are permanent. They can't be changed or reset.
The people affected will be managing fraud and impersonation risk from this breach for years. Denmark's minister called it "a deeply serious incident." Police are investigating. A security review has been announced. The question a review needs to answer is how a bulk query covering 80% of a national register didn't trigger an alert — because legitimate business use of a national ID system doesn't typically require querying nearly everyone in it.
Pornhub Returns to Australia — but Only for Apple Users
Aylo restored Pornhub access for adults who confirmed their age through Apple's device-level verification. Android users: still blocked. Aylo's argument has merit — per-site age verification scatters identity data across dozens of platforms, creating dozens of breach opportunities; device-level verification happens once.
But the Apple-only restoration reveals the limit: a solution that works on one platform doesn't resolve access to legal content on principle; it resolves it by manufacturer. A 45-year-old with an Android phone can't access legal content their iPhone-owning neighbor can, because Google hasn't deployed equivalent verification yet. Aylo also noted device-level verification "limits the usefulness of VPNs" — framing ordinary privacy tool use as circumvention. The practical effect is that access to legal adult content in Australia now depends on your phone brand.
Russia Doubles Its Internet Censorship Budget to $235M in 2027
Russia's 2027 internet censorship budget has been revised from 9.87 billion rubles to nearly 20 billion — approximately $235 million — with Roskomnadzor's overall funding growing 60% and total censorship spending projected at 60 billion rubles over three years. The government is also discussing fees for heavy 5G international traffic users (targeting VPN users financially), and a law banning domestic hosting providers from serving VPN operators for up to a year.
Russian ISPs have meanwhile shifted from outright blocking to targeted throttling — making VPNs too slow to function without the political visibility of a total block. The official target is 92% VPN blocking efficiency by 2030. We've covered the operational moves over recent weeks. This is the strategic backdrop: a funded, multi-layer system with a timeline and a performance target.
Amazon Built a Profile of You. You Can Look at It Right Now
Amazon's "About You" feature went viral this week after a Threads user found the platform had determined she "has flat buttocks" — probably from a purchase of butt scrunch leggings. The post got a million views in a day. The feature builds a profile of your interests, physical characteristics, and preferences from your purchase history; you can see it under Account > Shopping preferences > About you.
The surprise people feel is the surprise of meeting a system that's been running on them the whole time. Every purchase is a data point in a profile used for targeting, personalized pricing, and advertising sold to third parties. Amazon lets you edit the visible profile. It doesn't let you delete the underlying data or leave the advertising infrastructure. Editing the About You page is closer to correcting a label on a filing cabinet than clearing the files inside.
Vietnam Abducted Two Foreign Citizens From Cambodia. They're Charged With Terrorism
Nguyen Duc Thuan — a Norwegian citizen in Oslo — and Tran Hiep — an Australian citizen in Melbourne — disappeared while traveling in Cambodia. Their families heard nothing for ten days. On September 28th, Vietnam said it had them, claiming they'd crossed the border illegally. Their colleagues say they were abducted from Cambodian soil.
Both are now under terrorism investigation for membership in Viet Tan, a pro-democracy organization Vietnam designates as terrorist — a label UN experts have repeatedly condemned. Vietnam violated the Vienna Convention by failing to notify Norway and Australia for ten days and denying consular access. Thuan has diabetes and needs daily insulin. This follows a documented pattern: Berlin 2017, Thailand 2019 and 2023, now Cambodia 2026 — each case more brazen than the last. Twenty-eight human rights organizations are calling for immediate release.
Period Apps Collect More Than They Give Back
A peer-reviewed BMJ analysis argues that digital menstrual tracking risks more harm than benefit — the claimed health benefits are weakly evidenced, and the data collection is real. Court records confirm what that collection leads to: Google and Flo Health agreed to pay $56 million to settle a class action over sharing menstrual and pregnancy data for advertising; Meta was found liable by a jury in the same case.
A Mozilla Foundation review of six trackers found one storing everything on-device with no account required, and another sending pregnancy status and specific symptoms to a company not named in its privacy policy. The useful question was never whether to track. It's which app you use, how much you tell it, and whether anyone has actually shown that what you get back justifies handing over some of the most sensitive data that exists.
Mental Health Support Needs Anonymity to Work
For many people, the first step in dealing with a mental health problem is a private search at two in the morning — before telling anyone, because typing is easier than saying. That step leaves a record: searches are logged, health apps send data to analytics partners, support community membership is recorded.
When people believe they're being observed, they self-censor. Someone who thinks their searches are linkable may not run the search. Someone who thinks joining a support community creates a record may not join. They haven't decided they're fine. They've decided the risk of looking isn't worth it — and nobody records that failure. Privacy isn't separate from access to mental health support. For the first step, it is access.
Türkiye Banned Social Media for Under-15s
Türkiye published a law formally banning children under 15 from social media platforms. Age verification will run through a government-issued token tied to Türkiye’s e-Devlet identity portal; platforms must implement the necessary technical measures or face fines, advertising bans, and bandwidth restrictions. The law also restricts 15- to 17-year-olds from services with "addictive" features.
Türkiye joins Australia, the EU, and a growing list of countries imposing age restrictions — but the enforcement context matters: Freedom House rated Türkiye’s internet "not free" in 2025, and last week a Turkish court blocked a news website over what it deemed "LGBT propaganda." The infrastructure that will verify a child's age is the same infrastructure that issued that order.
Greece Unveiled Its Social Media Ban for Under-15s
Greece's government presented a regulatory framework banning children under 15 from Facebook, TikTok, LinkedIn, Instagram, and other platforms to be added gradually, with a January 1st, 2027 start date subject to a parliamentary vote on October 22nd. Unlike Türkiye’s model — which routes age verification through the government's own e-Devlet portal — Greece is building its enforcement on the EU's Digital Services Act framework, using existing DSA oversight and sanction mechanisms rather than national infrastructure.
Greece already banned mobile phones in schools in 2024 and has a Kids Wallet App allowing parents to restrict children's device access. The January 2027 date places Greece in the same rapidly filling enforcement calendar as Türkiye (November 1st), the EU KIDS Act, and similar measures advancing across Europe and Canada.
Delhi Has Had Eight Internet Shutdowns in Ten Months
According to SFLC data, Delhi recorded eight internet shutdown incidents in 2026 up to October — 25% of India's national total — triggered by NEET paper leak protests in July and Chief Election Commissioner resignation protests in October. India's overall shutdown count has declined significantly from a peak of 136 in 2018 to 32 in 2026, the lowest since 2016.
But India still ranked second globally for shutdowns in 2025 with 65 incidents, behind only Myanmar. India's Supreme Court stated this year that "internet facilities should function unhindered." The October shutdowns followed anyway, spreading across a wider area of the capital than the July wave, in response to citizens protesting an appointment process.
The Philippines Senate Passed a Total Social Media Ban
The Philippines Senate approved the SMART KIDS Act — SB 2424 — banning all children under 18 from social media and other "high-risk digital services," with no pathway for parental override and government ID required as the primary age verification method. The bill expands coverage to online gaming platforms with social networking functions, names Roblox and Gorebox explicitly, and applies to platforms of any size with no minimum audience threshold.
The Senate version must be reconciled with the House bill — which set the threshold at 13 with tiered access for older minors — before becoming law. At 18 with no parental override, it goes further than Australia (16), Türkiye (15), Greece (15), or the EU KIDS Act (15).
SpaceX Restricted Starlink for Ukrainian Military Without Warning
SpaceX restricted Starshield terminals — the military-grade version of Starlink used by Ukrainian drone operators — without prior notice, causing drones to lose connection mid-mission and a number of operations to fail.
Serhii Beskrestnov, an adviser to the Ukrainian president, said the restrictions "can't be a coincidence and are connected to the current political situation" — pointing to a week in which the US reportedly threatened to halt intelligence sharing and arms deliveries to Ukraine. SpaceX did not respond to requests for comment. Critical military communications infrastructure operated by a private company can be throttled without warning, for reasons that may be political, with no accountability to the military depending on it.
US Court Lifted the Block on Georgia's Age Verification Law
The Eleventh Circuit Court of Appeals vacated the preliminary injunction blocking Georgia's SB 351 on Thursday, sending the age verification law back to district court for full proceedings. The law — passed in 2024 and blocked in 2025 after NetChoice sued — requires "commercially reasonable efforts" to verify ages, parental consent for under-16s, and limits on data collection and ad targeting for minors.
The appeals court found NetChoice hadn't adequately demonstrated the law would be unconstitutional across its full range of applications, noting some platforms host content protected for adults but not minors. The ruling doesn't settle the law's constitutionality; it removes the block and reopens the case. It arrives a week after Türkiye published its ban, Greece presented its framework, and the Philippines Senate passed a total ban for under-18s.
The Health Information Girls Need Gets Filtered
Content filters built to block explicit material routinely catch puberty, menstruation, and reproductive health information too — because the vocabulary overlaps and filters match words, not meaning. A health charity's clearly written article using correct anatomical terms is more likely to be caught than vague or coded content that slips through.
Girls with school health education or an adult they can ask have a fallback; many have neither, and for them the search was the whole plan. The problem is also the inverse: recommendation systems deliver appearance-focused content to girls who didn't ask for it, and surface manosphere material to boys that research has linked to sexist attitudes in schools. Nobody decided that should happen. It's what a system produces when the metric is whether you kept watching.
What the DSA Transparency Database Actually Shows
Before the EU's Digital Services Act, platform transparency meant a quarterly PDF with aggregate numbers in categories defined by the company publishing them. The DSA replaced that with a legal obligation: every content moderation decision made by a covered platform must be filed with a reason, in standardized fields, in a public database.
That shift — from voluntary summaries to mandatory per-decision records — produces something that didn't exist before: a record that separates content removed because it broke the law from content removed because a platform didn't want it, and that indicates whether a government authority was involved. Informal pressure and phone calls still don't appear. But what was put in writing now has to be disclosed, and the existence of the database proves that granular, continuous transparency is possible when a law requires it.
Meta Ordered to Pay $25b in New Mexico Privacy Case
A New Mexico court ordered Meta to pay $25 billion in penalties in a data privacy case stemming from the Cambridge Analytica scandal. A Santa Fe jury found in September that Meta misled state residents about how it safeguards and collects user data, with more than 43 million violations of the state's unfair practices act.
The filing showed the state was awarded $219.5 billion, reduced to $25 billion, with interest accruing at 15% a year until it's paid. Judge Francis Mathew wrote that "Facebook did not conduct the comprehensive investigation that it promised," calling its internal examination "willfully ineffective." The order is more than 30 times the $725 million Meta agreed to pay in 2022 to settle a class action over the same scandal. Meta hasn't commented on the order.
Meta's Updated Terms Would Let It Scrape Business Websites for AI Training
Meta's updated Terms of Service originally authorized the company to use web scrapers, bots, and crawlers to access and collect content from websites associated with businesses on its platforms, and to periodically pull updates for its training and research. After backlash from legal experts, Meta limited the clause to its ads and business products rather than general AI training.
A spokesperson said the change "does not give us new rights that supersede" robots.txt preferences, but the provisions letting Meta collect data from business websites for ad targeting remain. The only real opt-out is closing your Meta account, which isn't realistic for many small businesses. The consent is real in a legal sense and coerced in a practical one.
Critical PHP Flaws Took Sites Offline Worldwide
Cybersecurity agencies in the UK, EU, Australia, and the US urged organizations to apply a fix for two critical flaws in PHP, and to consider taking systems offline where they couldn't. Finland temporarily shut down its government's public web services, the Netherlands' cybersecurity agency took its own site offline, and the Wikimedia Foundation took down systems, leaving some users unable to reach parts of Wikipedia.
Researchers at Calif and Wiz found the flaws using OpenAI's models and say they'd gone undetected for more than a decade, and Cloudflare's CTO says early attacks are already emerging. The advice to operators was reasonable, but it protects servers rather than access. No agency is keeping a copy of the page you depend on, so save what you can't afford to lose and know your second source.
Australia Plans to Sue Five Platforms Over Under-16 Ban
Australia’s Communications Minister Anika Wells said on October 20 that Australia is preparing to take Facebook, Instagram, TikTok, Snapchat, and YouTube to the Federal Court over compliance with the under-16 social media ban. No lawsuit has been filed. The eSafety Commissioner gained new powers to demand documents and summon people to give evidence on oath, and the maximum penalty now exceeds A$100 million.
Independent measures point to widespread non-compliance: a parent survey found around 7 in 10 children still have accounts, a University of Chicago working paper found about 73% of covered 14- and 15-year-olds still use banned platforms, and a BMJ study described "substantial circumvention." A High Court challenge by Reddit and the Digital Freedom Project is due to be heard in November.
A Policy Institute Published What We've Been Saying About Age Verification
Cato Institute policy scholars published "Online Age Verification Has Guaranteed Costs and Uncertain Benefits," identifying six costs that should be weighed against the claimed benefits: false positives with disparate impact on minority groups, compliance and opportunity costs, data breaches and privacy risks, restricted access to lawful information, loss of anonymous and pseudonymous speech, and a weakened role for parents.
Citing early evidence from Australia and the UK, they conclude the benefits are "at best, uncertain" and that restrictive policy-based approaches are "typically ineffective." We've made versions of this argument in nearly every age verification story we've covered. If you've been skeptical of a newsletter covering internet freedom making it, here are two policy scholars making it in a paper aimed at Washington.
French Presidential Candidate Calls for Social Media Blackouts
Gabriel Attal, leader of Emmanuel Macron's political party and a presidential hopeful, reiterated his call for the government to have the power to temporarily block social media in the area where riots are taking place, after widespread unrest across France. He argued that young people who see friends looting on social media are encouraged to join.
French courts have already pushed back on similar measures: France's highest administrative court ruled that the 2024 TikTok block in New Caledonia was "a disproportionate infringement of rights and freedoms," and the Constitutional Council blocked a bill to ban social media for under-15s this summer on proportionality grounds. Whether Attal's proposal would survive judicial review is unclear. That a serious candidate in a Western European democracy is openly calling for protest-era social media shutdowns is the part worth noting.
India's Supreme Court Said Internet Access Is a Fundamental Right
A Supreme Court bench reaffirmed that internet access and use fall within the fundamental rights under Articles 21 and 19(1)(a) of India's Constitution, and that children, like adults, are entitled to them. The observations came during proceedings on removing child sexual abuse material from online platforms, and the court stressed that protecting children from online harm shouldn't come at the cost of denying them fundamental freedoms.
It stopped short of ruling that internet access is an independent fundamental right. They came a week after Delhi authorities suspended mobile internet in central Delhi and at eight temporary detention centers during protests that led to thousands of detentions, and after the government told the court the shutdown "was necessary." Constitutional recognition doesn't change an architecture where legal challenges arrive after a shutdown has already happened.
Internet Shutdowns With No End Are Rising, Say Experts
Access Now published a report on internet shutdowns with no announced end date, saying the number of prolonged shutdowns "has steadily risen each year." Its examples include Myanmar, where repeated shutdowns amid deadly violence have created an "internet dead zone," and Tigray, Ethiopia, where new shutdowns raise fears that a population cut off for over two years during a civil war will be disconnected again.
Even when authorities claim a shutdown has ended, connectivity often doesn't meaningfully return. The report draws on anonymized testimonies from 2024 to 2026 from places including Annobón, Gaza, Myanmar, and Sudan. It calls for stronger norms, alternative connectivity, attention to the digital side of ceasefires, and enforcement of court rulings against shutdowns.
An Officer Gave Her ICE Husband Access to the Flock System
Former Savannah Police Department officer Amber Harpe was fired after sharing her Flock Safety license plate reader login with her husband, an ICE agent who had no authorized access to the system. She was one of six employees fired following an audit, and four others were arrested by the Georgia Bureau of Investigation in August for using Flock for non-law-enforcement purposes.
Flock cameras record where your vehicle appears, when, and how often, and that data is queryable by any authorized user. The department's policy says an outside agency's investigative purpose doesn't authorize access, but the policy is enforced by an audit log, not by access controls. Data collected for one purpose by one agency can reach other hands through a shared password, and accountability only arrives after the fact.
Information Access Is Not Distributed Equally
The same restriction costs different amounts depending on what else is available: where there's no offline alternative, a block isn't friction; it's the end of access. Shutdowns remove the only channel in places where services moved online faster than offline alternatives could keep up, from health information to agricultural guidance to remote schooling.
Filtering catches research, health, and educational material it wasn't aimed at, and identity walls exclude people without current documents. Policy gets written by people who always have a workaround, about people who often don't.
Moscow Plans to Restrict Mobile Internet During Summits
Russia's Digital Development Ministry said mobile internet inside Moscow's Third Ring Road could be restricted during the day from October 27th to 29th. The ministry tied the plan to security for the Gas Exporting Countries Forum and the Russia-Africa summit. Voice calls, Wi-Fi, and exempt websites were set to stay available.
The summits get the protection, and the people who live and work in central Moscow lose their mobile data. Someone also chose which websites stay exempt, and the report doesn't say who or how. It comes soon after Russia's plan to double its internet censorship budget in 2027.
2026 County Election Website Security Census: Key Findings
We rebuilt the 2024 census of every US county's election website. 42% of the county election pages we identified still aren't on .gov, down fifteen points since 2024, with the larger counties moving first. Email is the weak spot. Only about half of the election contact domains we checked enforce a DMARC policy, so the rest would still deliver a forged message to a voter's inbox.
Most election pages also contact a tracking company before the voter clicks anything, and over a hundred lookalike versions of official election domains sit outside government hands. Before Election Day, start from your state's election office, type addresses yourself, and look for .gov.
France Weighed Blocking Social Media During Protests
France's interior ministry spent the week before the October 24th protests asking telecom operators how to cut off social media, or even mobile internet, in certain areas. Prime Minister Sébastien Lecornu then asked operators in a letter to be ready to block TikTok, Instagram, Snapchat, and X. No block was ordered, and officials didn't deny any of it.
A block limited to one neighborhood isn't technically possible, so peaceful protesters, reporters, and residents would all have been cut off. The plan wasn't used this time. The groundwork with operators is still there.
Exam Internet Shutdowns Ease in Algeria and Syria, Reach Tunisia
Access Now's #NoExamShutdown report shows that exam shutdowns in the Middle East and North Africa moved in two directions this year. Algeria kept the country connected during exams for the first time in a decade, and Syria held its exams with no documented shutdowns. Tunisia, once seen as the region's most open internet, joined the list for the first time with unannounced disruptions to messaging apps.
Iraq, Sudan, and Jordan cut or limited access again, and India blocked Telegram before a national medical exam. Algeria and Syria show that a shutdown habit can be broken, and Access Now credits public pressure for Algeria's change.
Discord Will Put Public Server Messages in Google Search
Every Discoverable Server will get a public web page that Google can index, starting November 16th. The pages will show discussion summaries, and from mid-December, some messages will be readable by anyone, even without a Discord account. Private servers and direct messages stay private.
Admins and users can opt out, but public channels are included by default, and users can't opt out of summaries at all. Hiding usernames doesn't make a message anonymous. If you use Discord, check your settings before November 16th.
Florida Attorney General Proposes the Safe Screens Act
Florida Attorney General James Uthmeier proposed the Safe Screens Act. App stores, AI chatbot operators, and operating systems would have to determine users' ages, and minors would need parental consent to download apps. Teen social media accounts would get strict defaults, including a daily time cap, and chatbots couldn't simulate companionship or claim to be human.
The Act can't tell who's a minor without checking everyone, and the release doesn't say how ages would be determined. It also replaces family decisions with fixed state rules, with fines of up to $50,000 per violation pushing companies to check more users, more often.
Where America's Old Government Websites Went
We visited every official website listed for US towns and counties. 276 now serve gambling or spam, mostly because old domains expired and were caught by drop-catchers. Hundreds of Wikipedia articles still list a lapsed address as the town's or county's official site, and some of those links lead straight to a casino.
The fix is cheap. Renew old domains, keep them forwarding to the new site, and correct the Wikipedia entry. More than two thousand old addresses already forward correctly to a .gov, which is exactly how it should work.
New York Bans Unsafe AI Chatbot Behavior With Kids
New York Governor Kathy Hochul signed a law banning a dozen unsafe AI companion chatbot features when a chatbot talks with someone under 18. Banned behavior includes pretending to have feelings, flattery, sexually explicit content, and encouraging secrecy. The state attorney general can sue companies that break the rules, starting January 1st.
The goal is right, but a privacy expert warns that some categories are broadly worded or not defined. Vague rules push companies to restrict everyone, and a rule for under-18s raises the question of age checks for all users.
Australia Moves to Ban Emotionally Intimate AI Chatbots
Australia's digital duty of care bill passed the House of Representatives and now heads to the Senate. It would require platforms, including AI chatbots, to protect users from certain harmful content and ban chatbot behavior that fosters emotional dependence in children. It would also give users an easy-to-find way to opt out of recommendation algorithms.
The algorithm opt-out is a real win. The broad idea of harmful content is the weak spot, because platforms facing legal risk tend to remove more, not less. A Senate inquiry due in late November is the chance to get the balance right.
Be part of the resistance, quietly.
Gintarė is a cybersecurity writer at Mysterium VPN, where she explores online privacy, VPN technology, and the latest digital threats in editorial pieces. With hands-on experience researching and writing about data protection and digital freedom, Gintarė makes complex security topics accessible and actionable.
