The Proton Blog

Does sharenting put kids at risk?

Kate Menzies — Fri, 05 Jun 2026 15:42:07 GMT

Children face all kinds of threats online, from harassment or blackmail on social media to education tools that surveil them. These harms are caused by bullies, criminals, and Big Tech companies, but one of the biggest threats comes from the unlikeliest source: their parents.

“Sharenting” describes the intersection of our digital and family lives. It’s natural to want to celebrate your children and share updates about them, but once you share a photo, you lose control of who can access it and what they can do with it — especially if you share it on social media.

The potential ramifications of sharenting have grown increasingly dire thanks to advancements in AI and photo generation. Previously, the worst outcomes of sharenting could be strangers seeing your photos or Big Tech using them to target you with ads. But today the risks are much higher: It only takes a few images to create believable deepfakes that could be used for identity theft or worse.

What is sharenting?

Sharenting is a portmanteau of “sharing” and “parenting”. It refers to sharing pictures or videos of your child or other personal information online. When you post a photo or share an update on social media, you’re doing it because you’re proud of them and you want to involve your friends and family in your life. But you’re building a digital footprint for your child before they can consent, which can have real consequences. Sharenting could look like:

Posting pictures of your child and other children at a school event on your Instagram or Snapchat.
Sharing a picture of your child on your personal website or blog.
Writing a blog post about your child’s important milestones, such as moving schools, joining a new club, or becoming a teenager.

These are good intentions, but sharing online comes with inherent risks. When you make these decisions for yourself, you take on the risk. But when you share your children’s data, whether it’s their face or personal stories, you’re making decisions for them that they might not have chosen for themselves and can lead to serious consequences. To understand how sharenting can affect children, we need to understand the risks it poses.

Threats to children online are increasing

Unfortunately, the internet is becoming more hostile to children as unregulated services give bad actors access to powerful AI tools. X’s chatbot Grok has come under fire for allowing users to generate pornographic deepfake images of women and children. A paywall was put in place after image generation spiked, suggesting that X was more interested in monetizing the problem than fixing it.

Backlash surged globally: Malaysia and Indonesia temporarily blocked access to the platform. In the UK, the privacy watchdog Ofcom opened an inquiry into X over the deepfakes. The cybercrime unit in Paris raided X’s French office, summoning Elon Musk for questioning.

Since this backlash began, a class action lawsuit has been launched by four anonymous women against X who allegedly had deepfake nudes generated of them using Grok. xAI has insisted that the plaintiffs be stripped of their anonymity as there is a “public interest in their identities”, despite the very real risks of doxing and harassment. Instead of being protected, the victims of these deepfakes are put on trial.

What can we do about these hostile platforms? Removing children’s access to social media is being touted as a popular solution for combating online exploitation. Australia has already banned children under the age of 16 from accessing social media apps, and the UK is looking to do the same. This may feel like a solution that protects children, but ultimately children are incredibly adept when it comes to illicitly gaining access to websites and apps. It also doesn’t prevent bad actors from seeking out contact with children.

Now that it’s so easy to misuse pictures and personal data, are we taking the risks of sharenting seriously enough?

What are the risks of sharenting?

You can’t control where pictures and information end up after you post them on social media, a blog, or a website. Once you put the data on a third-party platform, a number of bad things can happen:

Data brokers and Big Tech surveillance

The classic risk of online sharing is that anyone can find your data. This is bad enough for adults; it’s worse for children. Because they’re still learning how to make the kind of complex judgments that adults can about technology, children are vulnerable to online exploitation. Making accounts online to talk to their friends or research their interests are innocent actions that can lead to data leaks and targeted ads that follow children around the internet. This can even apply to the ed tech they’re encouraged to use at school.

Things as commonplace as privacy policies and cookies aren’t things that children intuitively understand. They may click ‘agree’ or ‘share’ without understanding the consequences. Just one click can grant hundreds of third parties legitimate interest in their online activity and their data.

Child identity theft

Child identity theft has risen as well-meaning parents, relatives, and friends share information about children online. Even details that feel insignificant can be used over time to build a profile of a child and create accounts in their names, phish for further information, or cyberbully them.

A stranger operating a social media account in your child’s name can be disturbing, but there are more insidious risks when it comes to personal data. If your child’s home address or SSN is compromised, criminals could apply for loans, open bank accounts, and even max out credit cards in their name. Giving your child a good start in life means protecting their personal data until they’re old enough to protect it themselves. As a parent, this means protecting their face, name, address, school, medical information, and any other personal information.

Cyberattacks

Just like adults, children can be targeted by phishing scams, affected by data breaches, and vulnerable to social engineering without the right education. Taking the time to explain what personal data is and who you should share it with is essential when children begin to use the internet.

Deepfakes and CSAM

It only takes a few shared birthday photos to create convincing deepfakes. Deepfakes are manipulated images and videos in which a person’s likeness is used to make it look like they’re saying or doing things that never happened. Once created, deepfakes can be circulated on the internet without your or your child’s consent.The risks of deepfakes range from spreading misinformation to cyberbullying to creating sexually explicit content.

The Internet Watch Foundation has released several reports identifying the rise of AI-generated child sexual abuse material. Creating this material is possible using image generation tools as well as “nudify” apps. These apps take existing pictures of adults or children and use them to digitally create nude images. The legality of nudify apps is questionable, as many countries have intimate abuse image laws in place, but they remain largely accessible online. Many countries and companies are beginning to combat them, with Australia aiming to ban them entirely, and Meta filing a lawsuit against the entity behind a popular nudify app.

As AI models and generative AI tools become more powerful, it’s going to become easier to create even more convincing images and videos of children. According to research from McAfee, 19% of targeted children have faced deepfake and nudify app misuse, with 38% of girls aged 13-15 affected.

Sextortion and blackmail

A knock-on effect of the easy creation of deepfake nudes is the potential for sextortion. As the initial deepfakes have already been generated, children may be scared that their parents will punish the. Children can be blackmailed or extorted using deepfakes, and exploited to engage in further acts or conversations.

It isn’t just children who can be targeted. The Internet Watch Foundation has warned that cybercriminals are contacting schools with deepfaked CSAM of pupils, demanding money to prevent them from being leaked. Schools in the UK have been recommended to blur the faces of pupils wherever possible for safeguarding purposes.

Cyberbullying

Bullying is a phenomena that has evolved significantly as technology has advanced. As children begin to learn about social and physical power, shaped by the people and media around them, they may use technology to target other children. Deepfakes can be used as a form of online harassment amongst students: This particularly affects young girls, but all young children can be targeted and a sense of stigma may prevent them from telling an adult.

Not only can this cause significant distress to young children, it can impact their future lives negatively. If those deepfakes are uploaded to the internet, they may remain attached to that person’s digital identity indefinitely. Nudify apps effectively endorse this behavior, making it seem like a fun trick or a prank for children to play on each other.

How to have a conversation about sharenting

You are the best advocate for your child’s safety, and you are best placed to give your child a healthy relationship with the internet and online sharing. By talking with your children and your friends and/or family, you can help ensure your child avoids having their identity stolen or abused.

Older children can also be their own advocates. They should talk to their parents if they think too much of their information is being shared.

With your kids

The easiest way to respect your children’s wishes is to simply ask them what they’re comfortable with. Until your children are old enough to consent, it’s best to only share photos using encrypted communications services or encrypted drives.

Letting your children know they have agency and autonomy helps them create healthy boundaries in both real life and online. It lets them decide what they’re comfortable letting other people knowing about them — the foundation of privacy. Given that you’ll likely be the one to introduce your child to the internet, it’s up to you to show them exactly how much control they have and what the potential risks are.

The National Crime Agency’s CEOP Education website has activity worksheets aimed to help you start conversations about topics including sharing photos, social media, live streaming, and cybersecurity. The topics they recommend discussing with your children about sharing photos are:

What does your child share online, and what is OK and isn’t OK to share
Who your child shares with, and whether their online accounts public or private
Understanding privacy settings and exploring the privacy settings for their favorite apps together
Helping them understand that if they regret sharing an image, they can get help removing it from services such as Report Remove in the UK or Take It Down (which is available globally). They can also request that the image be removed from platforms such as Google, Facebook, Instagram, or Snapchat.

To help your children learn, you can also play a digital interactive story about online sharing with your child, where you’ll read scenarios and decide which actions the character should take together. When it comes to educating your children as they create their own online accounts, Internet Matters provides extensive parental controls and privacy settings guides for social media accounts. Proton’s YouTube, Tiktok and Instagram channels also post short educational videos about internet privacy, news stories, and more.

With friends and family

Having a conversation about sharing images or information about your children can be complicated. Not all parents feel the same way about their children’s digital lives, and they may be unaware of the risks. If you’ve decided you’d like to ask a friend or a family member not to share information about your child online, you can send a request via text message or email, or you could have a one-on-one conversation with them. Consider using one of the following points as a jumping-off point for your own conversations:

We’ve decided not to upload any pictures showing our child’s face to protect their privacy. We’ll be using emojis to obscure their face until they’re old enough to decide if they’d like to show their face on social media, and we’re asking our friends and family to do the same.
Our child has requested that we ask them before anyone posts a picture of them online. We will be respecting their boundaries and ask that you do the same in the future.
We’re concerned about some of the risks of posting information about our child online, and we think it would be helpful to have a conversation about it so that you can make that decision for your child too.

With your parents

If you’re a child and you’re upset by what your parents post about you online, you have a right to ask them to stop. Whether it’s a picture you don’t like or information you’d prefer remain private, your face and your identity belong solely to you. Your parents are your caretakers, and they may think they’re making harmless decisions.

This is a very common experience for children in today’s online world. Apple Martin, 14-year-old daughter of Gwyneth Paltrow, criticized her mother for not respecting her boundaries after Paltrow posted a photo of them skiing together on her Instagram. Martin replied on the post, “Mom we have discussed this. You may not post anything without my consent.” Any child should have the right to decide how and if they appear on the internet. The UN Convention on the Rights of the Child even specifies children’s right to express themselves, with their views “being given due weight in accordance with the age and maturity of the child”.

If you don’t like the way your parents are sharing information about or pictures of you, you can explain this to them using some of the following points:

I’m worried about the digital footprint you’re creating for me. When I’m an adult, the things you post about me will follow me, and I want to have a choice about what the internet knows about me.
I don’t like that you share information about me without asking me first. Can we have a conversation about what is and isn’t OK to tell people about me?
I find the things you share about me embarrassing, and you need to respect my privacy. My life belongs to me, and I want to decide who knows what about me.

How to share responsibly

Fortunately, there are steps you can take to keep friends and family members updated about your family without putting your kids’ privacy at risk. Here’s a quick recap of how you can protect your child’s privacy and share updates with friends and family.

Ask first. If your child can consent, let them.
Limit public sharing. Use encrypted services over public platforms.
Talk to your circle. Set boundaries with friends and family about what’s OK to post.
Identify the risks. Explain that theft and deepfake exploitation are real threats.
Educate early. Teach kids what personal data is — and how to protect it.

Share safely

Instead of relying on social media to share updates about your children, consider moving to an encrypted drive shared with friends and family whom you trust. You can talk with your children about what you share, and effectively create a secure, digital photo album that your child is happy to be a part of. That way, when it comes time for your child to become an online citizen, they’re starting with the privacy and the education they need to make the most of their digital world. Proton Drive can help you create that secure place for your precious memories without compromising your child’s online safety or their future digital footprint.

As Stacey B. Steinberg, a prominent online voice about the legal and ethical concerns surrounding sharenting, puts it in her article: “By approaching a child’s right to online privacy in a child-centered manner, future generations will be able to enter adulthood unburdened by others’ decisions and free to define themselves on their own terms.” Privacy is for everyone, and that must include children.

This week tells you everything about Europe’s digital sovereignty transition

Ben Wolford — Fri, 05 Jun 2026 14:48:01 GMT

Two decisions from the EU this week illustrate the state of digital sovereignty in Europe.

Facing existential threats from the US and a crippling reliance on foreign tech providers, the European Commission announced an ambitious legislative package on tech sovereignty. The commission wants the EU to compete alongside the US and China on chips, data centers, and AI, building local resilience and infusing the latest IT revolution with European values like data protection. The plan is expected to mobilize hundreds of billions of euros for local industry.

The next day, European Parliament took its own step. They updated the default search engine on their browsers, from Google to Qwant, a privacy-first provider in France.

The gap between the European government’s bold ambitions, through a serious legislative intervention, and its own baby-step implementation within one of its branches shows how difficult this kind of transition can be. They will have to migrate massive amounts of data and retool thousands of employees and departments. And they will need to encourage European businesses to do the same. (European tech companies often simplify migration, with tools like Proton’s Easy Switch.)

By switching to Qwant, the EU is leading by example. Small adjustments can have a large impact — in this case, lawmakers will no longer feed all their search queries into Google’s surveillance machine.

But they will need to go much, much further.

Europe’s dependence on US tech is bigger than search

The EU’s reliance on Big Tech could become an existential threat. Proton research shows businesses in Europe have a crippling dependence on US-based tech, including cloud infrastructure, communications, productivity software, and AI.

EU-US relations are under more strain than they’ve been in decades. New tariffs, NATO escalations, and open threats of retaliation from Washington have been pulling apart once-close allies. Digital infrastructure sits squarely in the middle of that tension.

More than two-thirds of businesses in Spain, France, and the UK run on US tech. The top three cloud providers — AWS, Microsoft Azure, and Google Cloud — are all American and together command an estimated 85% of the European cloud market. The Commission’s own tech sovereignty package puts a number on it: Over 80% of the EU’s key digital products, services, infrastructure, and intellectual property comes from outside the bloc. US leadership knows how to leverage that structural vulnerability.

European leaders are taking note. Belgium’s director of the Centre for Cybersecurity, Miguel De Bruycker, has stated that “Europe has lost the internet” — the continent’s digital infrastructure is so deeply embedded with American platforms that keeping data fully within European borders is, right now, effectively impossible. Finnish MEP Aura Salla put it more starkly: “The US could turn us off in an hour.” France has already announced it will roll out LaSuite, a sovereign digital ecosystem, to replace Zoom and Microsoft Teams across all government departments by 2027.

Consumers feel the reality of this dependence too. More than 8 out of 10 people in the UK, Germany, and France believe their countries have become too reliant on US tech companies, according to a survey of 3,000 people across the three countries. Following Trump’s threats to annex Greenland, signups for privacy-first services from Proton alone surged nearly 80% across Nordic countries — with Denmark alone exceeding 100% growth. The appetite for alternatives is real, and it’s accelerating.

What’s at stake for European businesses

When the US imposed sanctions on the International Criminal Court, the chief prosecutor lost access to his Microsoft inbox overnight and had to migrate to alternative services just to keep working. Other ICC officials similarly lost access to PayPal and Apple services and had US-based assets frozen without warning. US tech companies apparently felt compelled to comply immediately with executive orders against perceived adversaries in Europe.

The question is: Will it stop there?

If you’re a business leader, geopolitical instability is now an operational risk that leaves your email, your files, your communications, and your cloud infrastructure exposed. If they’re running on US platforms, they’re subject to US law, US political decisions, and US corporate obligations to the US government.

Beyond geopolitics, the structural risks are compounding. Because so much of the world’s infrastructure runs on a handful of US platforms, those platforms have become single points of failure.

AWS, Microsoft Azure, and Google Cloud together serve the vast majority of Europe’s cloud market — which means a single outage or configuration error doesn’t just affect one company. It takes down entire ecosystems of businesses at once. This has happened repeatedly: A major AWS outage in late 2025 crashed apps across industries; nine days later, an Azure outage knocked out Outlook, Teams, and dozens of enterprise services for eight hours straight.

Then there’s the problem of your data being exposed. The US demands more data from Big Tech than any other country in the world — more than Germany, France, and the UK. The number of accounts shared by Google, Apple, and Meta with US authorities has increased by over 500% since 2014.

Under the CLOUD Act, US authorities can demand your business data even if you’re based in Europe, potentially putting you in direct conflict with GDPR. In April 2026, the EU fined Google, Meta, and other US tech companies a combined €6 billion for a range of violations. The US government’s response was not to encourage compliance — it was to threaten retaliation.

For European businesses that can’t absorb GDPR fines or afford service disruptions, dependence on US tech is a live compliance risk, a geopolitical exposure, and a structural vulnerability all at once.

How to start de-coupling from Big Tech

To varying degrees, the European Commission’s tech sovereignty package and parliament’s move to Qwant are signs that Europe’s institutions are waking up and trying to act. For businesses, there’s no reason to wait — you can take action to get ahead of the risks right now.

Steps you can take are simple and practical. And most US services have a market-ready European alternative. Here’s where to start:

Audit your stack. List every third-party tool your business uses and flag which are US-headquartered.
Identify your critical dependencies. Which tools, if suddenly unavailable, would stop your business from operating? (This should already be part of business continuity planning.)
Check your data exposure. Understand where your business data is stored, who can access it, and under what legal jurisdiction.
Research European alternatives. For each critical tool, find out whether a privacy-first, non-US equivalent exists and start testing it.
Start migrating where it matters most. You don’t need to replace everything at once — prioritize the tools that carry the highest risk and move.

Europe hasn’t lost the internet. But it might if the only thing that changes are search defaults.

Proton Drive uploads are up to 4x faster with our new cryptographic update

Jonathan Villemaire-Krajden — Thu, 04 Jun 2026 11:53:30 GMT

End-to-end encryption is at the core of Proton Drive. It’s what keeps your files private, so only you and the people you choose can access them — not even us. Because every file operation is protected this way in our cloud storage apps, cryptographic performance has a direct impact on how fast uploads and downloads feel.

After our previous SDK performance improvements across uploads and downloads, this latest update builds on that work by making Proton Drive’s core encryption layer even more efficient.

Proton Drive uses the OpenPGP standard to encrypt file contents, and we’ve now adopted a cryptographic advance introduced in an update to the standard. A big part of building the SDK throughout this year has been moving Drive’s file operations onto a shared foundation, making the apps faster and smoother across all platforms. The result is an up to 4x boost in performance for file uploads. It also lays the groundwork for the next generation of Drive features.

Performance impact

Encryption has a major impact on how smooth the app feels during everyday use, so cutting that cost by up to 4x makes file uploads feel much faster, especially on the devices where performance matters most:

On mobile, our benchmarks show encryption of a 4MB file that used to take 97ms now takes 32ms.
On more powerful processors, the same operation that used to take 12ms now takes 3ms.

Encrypting an HD movie or 1,000 high-resolution photos used to take your phone about a minute and a half, or a fast desktop around 12 seconds. With this update, the same work finishes in about 30 seconds on mobile and around 3 seconds on a desktop.

How Proton Drive become faster

The structure that Proton Drive uses is a file node, which can have many revisions, each representing a version of the file. The contents are then chunked into blocks. The node contains cryptographic material which is used to encrypt the blocks. This cryptographic material on the file node consists of the node key (a locked PGP secret key) and a content key packet (a PKESK encrypted with the node key).

The PGP messages that Proton Drive uses for file contents consist of two packets:

A public key encrypted session key (PKESK): This is the node’s content key packet, shared for all blocks.
A symmetrically encrypted integrity protected data packet (SEIPD): This is the encrypted block contents.

The new encryption scheme

Before this cryptography update, uploaded files used a v3 PKESK and a v1 SEIPD. Now, the encryption algorithm requires a v6 PKESK and a v2 SEIPD. The symmetric encryption used for content is AES-GCM, which makes full use of hardware encryption on most modern devices.

Because the session key is shared between revisions when files are updated, all revisions on a file must match the encryption scheme used by the first one. This means clients must be updated to take the PKESK version into account when making a change to a file and uploading a new revision. Clients built on the Proton Drive SDK will handle this automatically, as the information is carried in the session key. The key is generated here and used when encrypting the blocks.

To avoid issues with decryption later, revisions submitted with the wrong version will be rejected. This means that clients which don’t support the feature will not be able to update files uploaded after this change comes into effect. Make sure to update your Proton Drive clients to get all the performance benefits.

What’s next

This is an big step in evolving Proton Drive’s shared core model toward more performant, more capable cloud storage protected by end-to-end encryption. The SDK gives every Drive client a shared cryptographic core, making changes of this scope possible — and helping us move faster on what comes next. Stay tuned for more improvements this year.

Thank you for your continued support,

The Proton Drive engineering team

We rebuilt Proton Drive’s engine. Now it’s up to 3x faster on all platforms.

Anant Vijay Singh — Thu, 04 Jun 2026 11:52:49 GMT

We’ve been focused on making end-to-end encrypted cloud storage faster, smoother, and more consistent everywhere you use it. To get there, we rebuilt Proton Drive around a stronger technical foundation: a single, shared engine that unifies all our cloud storage apps across platforms and powers all uploading, downloading, encryption, and more.

These behind-the-scenes developments have an enormous impact that you can see and feel today. It means better, more consistent performance and vastly improved speeds. And it enables us to power more Drive integrations with every other Proton app: You’ll start seeing deeper integrations with the rest of the Proton ecosystem and support for more clients — and yes, including Linux.

Here’s what’s changed for you:

Quicker uploads and downloads

Moving files in and out of Proton Drive is now much snappier across platforms, with uploads up to 3x faster. This means common actions, like Android photo backup and macOS file sync, complete more quickly, letting you get on with your day. And you can access your files with less waiting, whenever you need, even on the go: Downloads are up to 2x faster.

A faster, smoother app experience

Your files and photos now load faster in Proton Drive. And because photos often hold the memories that matter most, such as family moments, travels, milestones, and everyday life, we’ve made the Photos experience smoother too. Enjoy accelerated timeline scrolling and swifter loading of albums and photos, even in large batches.

A stronger foundation for Drive and beyond

This transformation of Drive was made possible by combining knowledge from our Mac, Windows, iOS, Android and Web teams into a single, better engine: the Drive SDK (software development kit).

An SDK is a package of building blocks of code that developers can use to create applications for different operating systems (like macOS, Linux, or Android). Switching to the Proton Drive SDK was like swapping out a car engine for a jet engine. It gives us the power to create faster Drive apps and makes it much easier to develop new features and integrations for every platform.

With the SDK we were able to improve the cryptographic model that protects your data in Proton Drive, ensuring your new files will be end-to-end encrypted up to 4x faster while slashing battery drain and heat on iOS and Android. We’re always looking to make things better, but one thing hasn’t changed: No one but you and the people you share with can access your data, not even us. See the Proton Drive cryptography update for more details.

The SDK is bringing Proton Drive closer to the rest of your Proton apps and, over time, will make it easier for external tools to use Proton Drive for secure file storage and sharing. For example, Proton Drive integration in Lumo (our privacy-first AI assistant) is powered by the SDK. It lets you use your documents productively in Lumo while keeping them protected by Proton Drive’s end-to-end encryption.

For developers and the wider privacy community, a preview of the SDK is available on GitHub, making it easier to understand and build on the shared engine that powers all Proton Drive.

What’s next

Our work on the SDK continues. As it continues to power new features, Proton Drive will become harmonized across platforms, more deeply integrated across the Proton ecosystem, and easier for the community to build on — all while keeping your files end-to-end encrypted. We’re also now actively building one of the community’s most-requested features: the Proton Drive client for Linux, built from the ground up to leverage the SDK.

Whether you’re new to Proton Drive or have been with us from the beginning, now is a great time to try it, share your feedback on UserVoice, Reddit, or X, and help shape what comes next.

Use Proton Drive now

Not on Drive yet? Create a free Proton Drive account and get 5 GB of free storage.

Many of these improvements were made possible by the Proton community: Your testing, feedback, and support help us build a better private cloud for everyone. Thank you!

How to turn off Google AI on Search

Risa Tang — Wed, 03 Jun 2026 20:10:42 GMT

From Google Chrome to Google Workspace, Google has been aggressively integrating AI into its apps and platforms — and Google Search is no exception. As long as you’ve looked anything up on Google since 2024, you’re already familiar with AI Overviews: the AI-generated summary that appears at the top of your results before any actual links.

The idea is to help you get answers more efficiently. But in practice, AI Overviews have been criticized for being inaccurate or confusing, for pushing real results further down the page, and for taking away traffic from the original sources.

What’s more, if you’re signed into a Google account — which most people are — your searches and browsing activity, along with associated data like your location and device details, are tracked by default. That means this so-called convenience also comes at a cost to your privacy.

There isn’t a simple built-in off switch to disable AI Overviews on Google. But the good news is that there are a few effective workarounds with no external plugins or complicated setups required.

Use the Web filter

This is the quickest way to strip AI Overview from your results without changing any settings, though you’ll have to perform the same steps below for every new search.

Run a Google Search as usual.
Underneath the search bar, look for the tabs: All, Products, Images, News, Videos, etc. Select Web. If you don’t see it among the tabs, select More → Web.

Your results will reload without AI Overview.

Add -AI to your search

This method relies on Google’s minus (NOT) operator to exclude a certain term from the results. Simply add -ai to the end of your query, like price of eggs -ai. Your search results should appear without AI Overviews, but this isn’t always guaranteed.

Append &udm=14 to URLs

Adding this parameter forces Google to automatically show web-only results. There are two ways to implement this:

Manually (one-off)

Search something on Google, and on the result page, add &udm=14 to the end of the URL in your browser’s address bar and hit Enter.

The new page will load without AI Overview, and you can bookmark this modified URL for future searches.

Save as a custom search engine on Chrome

This enables you to permanently add the &udm=14 parameter to every search on the Google Chrome browser, effectively bypassing AI Overview each time without having to do so manually. Note that this only applies to desktop devices.

1. On Google Chrome, click the vertical ellipsis ⋮ on the top-right and open Settings.

2. Go to Search engine and click Manage search engines and site search.

3. Under Site search, click Add.

4. Fill in the following details:

Name: Google Web
Shortcut: @web
URL with %s in place of query: https://www.google.com/search?q=%s&udm=14

5. Click Add.

6. Click the vertical ellipsis ⋮ next to Google Web and select Make default.

Every default search you run from Chrome’s address bar now bypasses AI Overview and returns clean web results.

Your privacy deserves more than a workaround

Gemini, Google’s own AI, is deeply embedded in the Google ecosystem, including Gmail, Android, Google Docs, and Google Drive. This gives the company broad access to your data and raises suspicions about how that data can be used to fuel Google’s business model, including for targeted ads and AI training. For many, the lack of clear transparency and meaningful consent makes this integration feels more like surveillance.

AI Overviews are just another way for Google to push AI into your life by changing the default search experience itself. Not everyone is on board with this AI takeover, especially when it is built into services people use every day. If you agree, turning off AI Overviews is a start.

But if you’re serious about keeping your data out of Google’s AI systems, the most effective step is to reduce how much you rely on Google in the first place.

Next, you can switch to an encrypted ecosystem that believes privacy should be the default on the internet, not something you have to fight for. AI can be useful, but it should be optional, transparent, and built around consent. Our own AI assistant never logs or trains on your data. When it comes to search, you can choose a European search engine with opt-in AI features, or no AI at all.

Google is not the only company whose AI tools have implications for your privacy. Whether you’re using AI for work or in your daily life, it’s worth understanding exactly how your data is being handled — because the defaults of Big Tech rarely have your best interests in mind.

How to delete your ChatGPT account

Risa Tang — Tue, 02 Jun 2026 18:30:43 GMT

ChatGPT is one of the most popular AI assistants, but growing concerns about AI privacy, data security, and OpenAI as a company have spurred people to look up how to delete ChatGPT.

If you’ve decided it’s time to move on from ChatGPT — whether for privacy or moral reasons, to reduce your digital footprint, or simply because you’ve found a better ChatGPT alternative — this guide will walk you through exactly how to delete your ChatGPT account, cancel your subscription, and export your data before you go.

How to delete your ChatGPT account
What to do before deleting your ChatGPT account
What happens after your ChatGPT account is deleted?
Why delete your ChatGPT account?
Choose an AI that respects your privacy

How to delete your ChatGPT account

Deleting your ChatGPT account is permanent and cannot be undone. Before you proceed, ensure that you’re ready to delete your ChatGPT account.

ChatGPT offers several methods for account deletion:

Delete your account directly in ChatGPT on web

Go to chatgpt.com and log in.
Click on your profile icon in the bottom-left corner.
Select Settings → Account → Delete account → Delete. If you haven’t logged in within the last ten minutes, you’ll be prompted to log in again.
In the confirmation screen, type your account email address and the word DELETE into the input fields.

Click Permanently delete my account to complete the deletion.

Delete your account through OpenAI’s Privacy Portal

Go to privacy.openai.com.
Click Make a Privacy Request in the top-right corner.

Select I have a consumer ChatGPT account.

Click Delete my ChatGPT account and follow the prompts to request your account deletion.

Delete your account on iOS

Open the ChatGPT app on your iOS device.
Tap the two horizontal lines in the top-left corner to open the menu.

Tap your user icon in the top-right corner.

Scroll down and select Data controls.

Select Delete account.

In the confirmation modal that appears, tap Delete account.

Delete your account on Android

Open the ChatGPT app on your Android device.
Tap the two horizontal lines in the top-left corner to open the menu.

Tap your user icon in the top-right corner.

Scroll down and select Data controls.

Select Delete OpenAI account.

In the confirmation modal that appears, tap Delete OpenAI account.

OpenAI will delete your data within 30 days, with certain exceptions. According to OpenAI’s privacy policy, even if your account is deleted, they may retain certain information for legal compliance, fraud prevention, or safety purposes. The exact retention period and what data is kept isn’t always immediately obvious, which is one reason many privacy-conscious users are switching to alternatives.

What to do before deleting your ChatGPT account

Before deleting your account, you should first export any conversations or information you’d like to keep. If you have a paid ChatGPT subscription, it’s best to cancel it before deleting your account to prevent future charges.

Export your ChatGPT data

You can export your ChatGPT data through a web browser. This applies even for the ChatGPT app on iOS and Android, which redirects you to export your data through web. Here’s how:

Go to chatgpt.com and log in.
Click your profile icon in the bottom-left corner.
Select Settings → Data controls.
Look for the Export data section, then click Export.
Click Confirm export in the pop-up window.

You’ll receive an email notifying you when your export is complete and ready to download. This process can take a few hours to several days, depending on how much data you have.

Note: Your data will be exported as a ZIP file containing JSON files and an HTML file with your conversations, account information, uploaded or created images, and other data associated with your account. The download link in this email will expire after 24 hours, after which you’ll have to repeat the process if you don’t export by then.

Cancel your ChatGPT subscription

If you have a ChatGPT subscription, you should cancel it before deleting your account. Otherwise, you may continue to be charged even after your account is deleted.

If you subscribed through the ChatGPT website:

Go to chatgpt.com and log in.
Click your profile icon in the bottom-left corner.
Select Settings → Billing → Cancel subscription.
Click Cancel subscription in the popup.

You’ll receive an email confirmation of your cancellation. Your subscription will remain active until the end of your current billing period, but you won’t be charged again.

If you subscribed through the iOS App Store:

Open the Settings app on your iOS device (not the ChatGPT app).
Tap your name at the top of the screen.
Select Subscriptions, then find and tap ChatGPT in your list of active subscriptions.
Tap Cancel subscription and follow the prompts to confirm your cancellation.

If you subscribed through Google Play Store:

Open the Google Play Store app.
Tap your profile icon in the top-right corner.
Select Payments & subscriptions → Subscriptions, then find and tap ChatGPT in your subscription list.
Tap Cancel Subscription and follow the prompts to confirm your cancellation.

Once you’ve canceled your subscription, you can safely move on to deleting your ChatGPT account.

What happens after your ChatGPT account is deleted?

Once you delete your account:

You’ll lose access to all conversation history, unless it’s already exported.
Your ChatGPT subscription will be canceled (if you haven’t already done so through the website).
You won’t be able to log in or use ChatGPT with that email address for 30 days.
Any API keys associated with your account will be deactivated.
Custom instructions and preferences will be permanently deleted.
Your data will be deleted within 30 days, unless OpenAI chooses to retain information for legal, fraud prevention, or safety reasons.

Why delete your ChatGPT account?

There are several reasons to stop using ChatGPT, including its implications for personal privacy and OpenAI’s controversial track record.

Privacy concerns and data collection

OpenAI collects your conversations, account information, and usage patterns every time you interact with their platforms. And because ChatGPT doesn’t offer zero-access encryption, your personal data may be exposed in data breaches. This has already happened: In 2023, a ChatGPT bug briefly allowed some users to see titles from other people’s chat histories, and in 2025, attackers breached an OpenAI vendor and gained access to sensitive information of ChatGPT business users.

AI model training

By default, your conversations are used to train and improve OpenAI’s models. Even if you opt out of having your data used for training or use ChatGPT in Temporary Mode, your conversations are still stored on OpenAI’s servers — at least temporarily. This creates a permanent record of potentially sensitive information, from confidential work discussions to personal questions, that can be at risk of being leaked.

Third-party access and legal compliance

As a US-based company, OpenAI is subject to government data requests and surveillance laws that may conflict with international privacy standards. Your ChatGPT conversations can be accessed by US authorities without your knowledge, regardless of where you live. OpenAI also shares data with third-party service providers for business operations. For people in privacy-conscious regions like the EU, this creates jurisdiction concerns, as your data crosses borders into legal frameworks that may offer less protection than your home country.

OpenAI controversies

OpenAI has faced mounting backlash that extend beyond technical privacy issues. The company’s partnership with the Pentagon in using AI for military applications, including autonomous warfare systems, has raised serious ethical concerns and directly contradicts its stated mission of ensuring AI benefits all of humanity. OpenAI has also been criticized for messy internal governance, conflicts between its stated nonprofit mission and for-profit practices, lack of transparency around safety protocols, and enabling the creation of misleading content.

Choose an AI that doesn’t compromise on privacy and values

If privacy and ethical concerns are driving your departure from ChatGPT, you don’t need to give up AI assistance entirely. There are alternatives built around your rights, not corporate profit or surveillance.

Proton’s Lumo is built with the same privacy principles as the rest of the Proton ecosystem. Your conversations are encrypted, your data is never stored or used for training, and you maintain full control. Built and hosted in Europe, away from US jurisdiction and under some of the world’s strictest privacy laws, your private data stays in the safest possible hands: yours.

Ready to explore AI that respects your privacy? Try Lumo, Proton’s AI assistant, for free today.

Try Lumo free

Is DuckDuckGo safe? A look at privacy and how it compares to other search engines

Jessica Bernard — Mon, 01 Jun 2026 11:55:07 GMT

If you’re trying to avoid Google in an effort to protect your privacy, you may well have considered using DuckDuckGo instead. It’s one of the better-known private search engines, but is it really private, and is DuckDuckGo safe to use? We look at how it works, what its data practices are, and how it stacks up against Google and other private search engines.

Who owns DuckDuckGo? Understanding the business model
How DuckDuckGo functions: The mechanics of private search
What data does DuckDuckGo collect?
DuckDuckGo vs. Google
DuckDuckGo vs. other private search engines
Is DuckDuckGo right for you?
Frequently asked questions

Who owns DuckDuckGo? Understanding the business model

DuckDuckGo is majority-owned by its founder, Gabriel Weinberg, and other DDG team members, and has remained an independent company since its founding in 2008. Although it’s a for-profit company, DuckDuckGo does not make its money by selling personal information or tracking users.

How does DuckDuckGo make money without tracking you?

DuckDuckGo has two income streams: advertising and subscriptions.

Advertising

The majority of DuckDuckGo’s income comes from private ads on the search engine. Google also shows ads in search results; however, these ads are based on user profiles that come from tracking your search, browsing, and purchase history. Because DuckDuckGo doesn’t collect information on its users, the ads you see are based on the search term you enter.

Subscriptions

Users can pay to access a DuckDuckGo subscription service, which bundles privacy-related tools for a monthly or annual fee.

2022 tracking revelations

In May 2022, a security researcher asserted that DuckDuckGo browsers allowed Microsoft trackers on third-party sites, despite claiming to block all third-party trackers. In response, Weinberg explained that this exemption was due to a search agreement with Microsoft, and that plans were underway to “do more.” In August 2022, DuckDuckGo began blocking most Microsoft trackers in the same way it already blocked Google and Meta, with the exception of advertising clicks.

Because DuckDuckGo uses Microsoft Advertising, clicking on an ad will result in limited data being sent to Microsoft, which DuckDuckGo says is done solely so that advertisers can track conversions from their ads, and not to build a profile on you. To avoid this, don’t click on ads, or disable them entirely.

How DuckDuckGo functions: The mechanics of private search

DuckDuckGo isn’t a secret search engine in the sense that it has its own unique index. Rather, it’s a privacy layer that sits on top of existing search data from established sources like Bing, Yahoo, and its own smaller crawler, DuckDuckBot.

Instead of building a massive proprietary database like Google, DuckDuckGo aggregates results from these public sources while stripping away the tracking, profiling, and personalization that typically accompany searches on Google, Bing, and Yahoo. This system means that every user sees the same results for the same query, regardless of their location, search history, or browsing habits.

What data does DuckDuckGo collect?

DuckDuckGo collects only what’s technically necessary for functionality and security. Your device sends basic information such as browser type, operating system, and language; DuckDuckGo uses this information temporarily to deliver content and verify that you’re not a malicious bot.

Cookies and IP address logging

DuckDuckGo doesn’t save your IP address or any unique identifiers alongside your searches. Neither does it track you through cookies or any other storage methods — it uses anonymous cookies for search settings and local storage for anonymous display settings only.

Search analytics

For search analytics, DuckDuckGo may save anonymous queries, completely disconnected from unique identifiers, to analyze search trends and improve its indexes. For local search results, it sends a random location near your actual position, which is never logged to disk. As a result, when you use their services, they have no way to create a history of your search queries or the sites you browse, so viewing search results on DuckDuckGo is anonymous.

Third-party sharing

DuckDuckGo shares some information with hosting and content providers, but with strict anonymity safeguards. It calls for content (such as images) from DuckDuckGo servers on your behalf and securely delivers content over an end-to-end encrypted connection. DuckDuckGo shares anonymous information, such as browser and device types, with these providers, but never shares any information that could personally identify your searches or website visits.

DuckDuckGo uses Microsoft’s ad network to manage ad clicks, and according to their privacy policy, Microsoft has committed not to associate your ad-click behavior with a user profile. Note that your ISP ca see that you’ve visited DuckDuckGo, but the encrypted HTTPS connection prevents them from seeing your search queries. To hide your browsing behavior completely from your ISP, use a VPN.

Get Proton VPN Plus

Of course, when you visit other websites by clicking external links or using bang shortcuts, the privacy policies of those other websites apply. For example, if you browse Facebook, Facebook will know what you do on its site.

Data sovereignty

DuckDuckGo is a US company, so despite its privacy-focused positioning, it remains subject to US jurisdiction. This creates a vulnerability to legal mechanisms like National Security Letters (NSLs) from the FBI, or under foreign intelligence laws such as FISA’s Section 702.

While Section 702 is legally intended for collecting foreign intelligence, its implementation allows for the “incidental collection” of communications involving Americans. Because DuckDuckGo is a US entity, search queries and metadata passing through its servers or U.S. internet infrastructure can be swept up by upstream collection, regardless of the company’s internal no-log policies. Similarly, while NSLs are typically targeted rather than bulk, they can compel a company to hand over any data it does possess (such as security logs or error reports) without a traditional warrant.

DuckDuckGo’s privacy practices reduce the amount of stored data available for disclosure, but the company’s US incorporation is a factor worth considering. For most users concerned primarily with commercial tracking, this is a secondary concern. For users who are actively trying to avoid US government surveillance, a private search engine in a jurisdiction with stronger privacy laws, such as the EU, might be a better option.

DuckDuckGo vs. Google

Google and DuckDuckGo represent two fundamentally different approaches to search. Google monetizes its search results by tracking and profiling you, and markets this privacy violation back to you as personalization and ecosystem integration. DuckDuckGo emphasizes privacy and neutrality. Here’s how they stack up:

Data collection and tracking

Google builds a detailed profile of each user by collecting location, search history, device type, and browsing preferences. It monetizes user information in two major ways: targeted advertising and real-time bidding (RTB). Both involve sharing your data with advertisers. However, RTB is the more egregious privacy violation. This data also feeds into their ranking algorithms to deliver highly personalized results tailored to individual users.

DuckDuckGo deliberately avoids collecting any personal data. Every user receives the same search results for a given query, regardless of their location, past searches, or browsing habits.

Search quality and personalization

Google’s personalization creates what’s known as the “filter bubble” effect, where Google tailors results to keep you engaged and reinforce your existing beliefs and preferences based on your profile.

DuckDuckGo delivers neutral results that remain consistent across all users. So, no personalization, but no tracking either.

Google’s approach can increase relevance for known preferences, while DuckDuckGo’s neutrality protects privacy but may sacrifice some contextual precision.

Ecosystem integration

Google benefits from a deeply integrated ecosystem, including Maps, Gmail, and Android, which provides additional data points for refining search results.

DuckDuckGo takes a standalone approach.

The seamlessness of the Google ecosystem helps explain why some stick with Google despite privacy concerns. Its convenience and comprehensiveness can outweigh privacy considerations for many people.

How these differences affect you

Google typically delivers more comprehensive, contextually relevant results due to its personalization and larger index, but at the cost of privacy. DuckDuckGo provides consistent, privacy-protected results that can be surprisingly comparable across many queries, though they may lack the precision that comes from knowing the user’s context.

However, according to PCMag’s comparison testing, Google didn’t show a significant advantage over DuckDuckGo in the quality of raw search results.

DuckDuckGo vs. other private search engines

While DuckDuckGo is one of the most recognizable privacy-focused search engines, several others compete in this space, each with distinct approaches to balancing privacy, result quality, and usability.

DuckDuckGo vs. Startpage

Both DuckDuckGo and Startpage prioritize user privacy, but they do so in different ways. Startpage sources its results directly from Google, giving users access to Google’s comprehensive index, but without Google’s tracking.

DuckDuckGo, by contrast, aggregates results primarily from Bing and Yahoo, supplemented by its own crawler. Startpage users may find more familiar, Google-style results, while DuckDuckGo users get a different result set that avoids Google’s ecosystem entirely.

DuckDuckGo vs. Brave Search

Brave Search uses an independent search index built by its own web crawler, rather than relying on third-party providers like DuckDuckGo. As a result, Brave has more control over ranking and potentially more unique results.

However, their index is smaller than Google’s, so Brave Search gives you the option to let your browser anonymously check Google when their own index lacks coverage. Brave claims that these results are mixed client-side in your browser, and this has no impact on your privacy. It should be noted, though, that this claim has not been independently audited in way Proton VPN’s no logs claims are.

Brave and DuckDuckGo both offer integrated search experiences, but Brave’s tight integration with the Brave browser provides a more seamless experience for users already in that ecosystem.

DuckDuckGo maintains broader platform availability with dedicated apps and extensions across all major browsers, making it more accessible to users who aren’t committed to a single browser.

DuckDuckGo vs. Searx/MetaGer

Searx and MetaGer represent the open-source approach to private search, allowing users to self-host instances or choose from community-run servers. This approach offers maximum transparency and control but requires more technical knowledge to set up and maintain.

DuckDuckGo, as a proprietary service, prioritizes ease of use with a polished interface and reliable uptime that appeals to average users. While Searx and MetaGer can aggregate results from multiple engines simultaneously, DuckDuckGo’s curated approach ensures consistent performance without requiring users to configure their own result sources.

For most users seeking privacy without technical overhead, DuckDuckGo offers a more straightforward experience, while Searx and MetaGer appeal to those who value open-source principles and self-hosting capabilities.

Feature	Google	DuckDuckGo	Startpage	Brave Search	MetaGer
Data collection	Extensive	Minimal	Minimal	Minimal	None
Result sources	Own proprietary index	Over 400 sources and their own crawler	Google (via proxy)	Independent crawler + other sources	Multiple engines aggregated
Personalization	High	Minimal	Minimal	Moderate	Minimal
Privacy philosophy	Ad-driven business model	Privacy-first, no tracking	“Google without tracking”	Privacy-focused browser ecosystem	Open-source, community-driven
Ecosystem integration	Extensive (Maps, Gmail, etc.)	Standalone	Standalone	Limited (Brave browser integration)	Standalone
Ease of use	Very high	High	High	High	Medium
Open source	No	Some products	Some products	Some products	Yes
Best For	Users who value ease-of-use and aren’t concerned about privacy	Privacy-conscious general users	Users wanting Google results privately	Brave browser users	Tech-savvy privacy advocates

Is DuckDuckGo right for you?

If you’re committed to shoring up your digital privacy, using DuckDuckGo is a good choice for privacy-focused users. While no tool is perfect, DuckDuckGo offers a robust, transparent alternative to traditional search engines. It works best as part of a broader privacy strategy; combining DuckDuckGo or another private search engine with a private browser, a VPN, and a password manager is an effective way to improve your privacy while online.

Frequently asked questions

If it’s free, what’s the catch?

Unlike traditional engines that build detailed user profiles to target ads, DuckDuckGo displays ads based solely on the search terms you type at that moment, in what’s known as contextual advertising. This revenue stream allows the company to remain independent and privacy-focused without needing to harvest or sell personal data. You may see fewer relevant ads than in a personalized feed, but your privacy remains intact.

Do you still need Google?

No, there’s nothing that makes it essential, but despite its privacy disadvantages, there are scenarios where Google remains the more practical choice. If you’re deeply integrated into the Google ecosystem (relying on Google Workspace, Android-specific features, or Google Maps’ granular local data), you may find the transition difficult.

Additionally, for highly specialized queries where personalization significantly improves results, Google’s data advantage can be useful. You gain convenience and contextual precision with Google. Still, you pay for it with your personal data and the potential for a “filter bubble” that limits your exposure to diverse viewpoints.

OTP bots: How to stay one step ahead

Alanna Alexander — Fri, 29 May 2026 16:48:19 GMT

One-time passcodes (OTPs) are a core part of traditional two-factor authentication (2FA) and multi-factor authentication (MFA).

If you log in to an account or verify a transaction, you’ll receive them by email, SMS, or authenticator apps to confirm your identity.

Now, cybercriminals have found a way to bypass these protections using OTP bots.

What is an OTP bot?

An OTP bot is an automated software program that intercepts or steals one-time passcodes used to verify your identity. The goal is to gain control of your account in what’s known as an account takeover attack (or ATO).

Cybercriminals can buy OTP bot attacks on underground marketplaces, often via Telegram, for as little as $10 per attack. This low-cost, scalable approach lets attackers target many people at once with minimal effort.

How OTP bots work

OTP bots are designed to exploit the time between when you receive a one-time password and when you enter it into the app or website. This window is often less than a minute.

Cybercriminals typically intercept the code in three ways:

OTP bot account takeover via social engineering

The attacker uses stolen or leaked credentials to trigger the OTP step on a legitimate site. A bot then contacts you by SMS or phone call, using a script designed to create urgency — for example, by impersonating a bank’s fraud team. If you share the OTP, the bot passes it to the attacker in real time, giving them access to your account. The attacker can then change the login credentials and lock you out.

OTP bot account takeover via interception

Using stolen credentials to trigger the OTP, the bot attempts to intercept the code before it reaches you. Common methods include:

SIM swap attack: The attacker convinces a mobile carrier to transfer your phone number to a SIM card they control, so SMS codes are delivered directly to them.
API exploitation: The bot targets poorly secured authentication APIs to capture OTPs as they’re generated.
Brute force: The attacker tries all possible combinations of short numeric OTPs, which is possible when the website or app you’re using has not set a limit for repeated requests.

OTP bot account takeover via relay attack

This variation does not rely on stolen credentials. Instead, it tricks you into giving an attacker both your login details and your OTP. You land on a fake website that looks like the real one and enter your credentials. The bot immediately uses those credentials to log in to the real website, which triggers an OTP sent to your phone. The fake website then asks you to enter the code, which the bot relays to the real website in real time. This lets the attacker complete the login before the code expires.

As with the other variations, the attacker can then change the credentials and lock you out of your account.

How an OTP bot can affect your business

The ease of obtaining OTP bot services is likely to increase attacks on businesses. While banking and ecommerce are common targets, any industry can be affected. Small and medium-sized businesses (SMBs) are often targeted more frequently.

Financial losses can be significant, but they are not the only risk you should consider.

As damaging as financial losses can be to an organization, that’s not the only loss that should concern business owners.

Loss of customer trust

Customer trust often drops after a data breach. A 2024 study by Vercara found that 58% of consumers consider affected brands untrustworthy, and 70% would stop shopping with a brand after a security incident.

Regulatory compliance risks

Even if no funds are stolen, your business may face fines for failing to meet data protection requirements. For example, the General Data Protection Regulation (GDPR) applies to any organization that processes the personal data of EU residents, regardless of location or company size. Penalties for non-compliance can be substantial.

How to protect your business from OTP bots

Given that human error is the hardest thing to protect against, businesses should implement as many technical safeguards as possible. These might include:

Rate limiting and throttling

Limit how many one-time passcode (OTP) requests can be made from a single IP address, phone number, or account within a set timeframe. This prevents attackers from flooding your systems with automated requests.

CAPTCHA and behavioral analysis

Use CAPTCHA challenges when suspicious activity appears, and apply behavioral analysis to detect non-human patterns such as rapid form submissions or unrealistic mouse movements.

Device fingerprinting

Track device characteristics to identify repeat offenders and flag devices making multiple OTP requests across different accounts.

Multi-factor authentication beyond OTP

Add stronger authentication methods, such as hardware security keys, biometric verification, or push notifications, to reduce reliance on OTP alone.

API security hardening

Protect your OTP APIs by requiring authentication, signing requests, validating inputs, and using secure communication channels to prevent interception or manipulation.

Monitoring and detection

Monitor usage patterns to identify unusual behavior that may indicate bot activity. Use real-time alerts to catch spikes in OTP requests or unexpected geographic access. Review logs regularly to detect threats early.

How to protect yourself from OTP bots

OTP bots can be dangerous, but you can take simple steps to protect your accounts.

Use strong, unique passwords or passkeys

Use a business password manager to generate and store unique credentials for each account. If possible, use passkeys, which remove the need for one-time passwords (OTPs).

Use a hardware security key

Physical security keys, such as YubiKey, provide strong protection against automated attacks because they require physical access to your device.

Watch for phishing attempts

Be cautious of unsolicited messages that ask for verification codes. An OTP is meant to be entered into a website or app, not shared with anyone.

Monitor your account activity

Check login history and account settings regularly for unusual activity.

Use an authenticator app instead of SMS

Time-based one-time passwords (TOTP) — codes generated by an authenticator app — are more secure than SMS-based OTPs, which can be intercepted through SIM-swapping attacks.

Good password hygiene is your first line of defense

Combining strong technical safeguards with good credential hygiene goes a long way toward keeping attackers out.

A business password manager is one of the simplest and most effective tools you can use — it ensures employees aren’t reusing weak passwords across accounts, which is exactly the kind of vulnerability OTP bots are designed to exploit.

Pair it with phishing-resistant authentication methods and a culture of security awareness, and you make your business a much harder target.

Secure video conferencing for businesses: What to know

Alanna Alexander — Fri, 29 May 2026 16:09:52 GMT

Video conferencing is used by 58% of companies as part of their regular operations. It has allowed businesses to cut travel costs, hire talent from anywhere in the world, and keep teams connected even when they are miles apart.

But every new tool comes with a trade-off. When you move sensitive conversations — like contract negotiations, financial planning, or client strategy — onto the internet, you are also opening a door for potential risks.

Let’s look at how businesses actually use this technology, the hidden risks you need to watch for, and how to choose a tool that protects your reputation.

What is video conferencing?

You’ve likely heard the term “video conferencing” everywhere lately. If you’re a business owner who has traditionally relied on phone calls or in-person meetings, you might be wondering: “Do I really need this?” or “How do I do it without exposing my business to risk?”.

Video conferencing is a real-time technology to host meetings via live video and audio over the internet. Instead of driving across town or booking a flight, you use a computer or smartphone to see and hear your colleagues or clients in real-time.

How do businesses use video conferencing in their daily operations?

Video calls have replaced many traditional in-person interactions. Here is how they help your business run smoother:

Keeping teams aligned

Whether your team is in the next office or on the other side of the globe, video calls prevent the “out of sight, out of mind” problem. Seeing faces helps catch misunderstandings early — something that often gets lost in long email chains. This keeps projects on track and prevents costly rework.

Building trust with clients

Waiting weeks to schedule an in-person meeting can kill momentum. Video conferencing lets you connect with a client immediately. You can read their body language, share your screen to walk them through a proposal, and build the personal rapport that closes deals. It feels professional and personal, without the travel expense.

Hiring the best talent, faster

You don’t have to limit your hiring to people who live within commuting distance. Video interviews let you conduct thorough, face-to-face assessments with candidates anywhere in the world. This speeds up your hiring process, ensuring you don’t lose top talent to competitors who move faster.

Making decisions when it matters

When a crisis hits or a market opportunity opens up, you can’t wait for your leadership team to gather in a boardroom. Video calls allow you to bring key decision-makers together instantly, so you can act decisively and protect your business interests.

The hidden security risks of video conferencing services

While video conferencing offers huge benefits, it introduces new challenges that many business owners overlook.

Because these conversations travel across the internet, they can be intercepted if not properly secured.

The “open door” problem

Most mainstream video platforms encrypt your call while it travels, but they decrypt it on their servers. This means the company hosting the call — and anyone who hacks their server — could technically access your conversation. If you work with confidential client data or proprietary strategies, this is a significant risk.

Data collection and privacy

Some free or ad-supported platforms collect data from your calls to train their AI or serve you targeted ads. This means your sensitive business discussions could be stored, analyzed, or shared without your explicit knowledge.

Compliance and legal risks

If you operate in a regulated industry (like finance, healthcare, or law), using an insecure platform can lead to serious trouble. Violating data protection laws like GDPR or HIPAA can result in heavy fines, legal liability, and damage to your professional reputation.

The “third-party” trap

Many tools integrate with other apps (like calendars or project management software). While convenient, these third-party connections often operate under their own privacy policies, creating blind spots where your data could be exposed.

How to choose the right video conferencing tool for your business

You don’t need to be a tech expert to make a smart choice. When evaluating video conferencing tools, answer these six questions:

Does it meet your basic needs?

Strike the right balance between overpaying for features you won’t use and settling for a tool that crashes during a client pitch.

Is it easy to use?

If your team can join a call in seconds, and where your clients can join without needing to download complex software or create an account, it will become their go-to way to communicate.

How are your calls secured?

Calls that are end-to-end encrypted means no one in the middle — not even the provider — can see or hear it.

Where is your data stored?

Data laws vary by country. Providers based in countries with strong privacy laws (like Switzerland) offer better legal protection against government overreach and weak data regulations.

Is the provider trustworthy?

If a service is free, you might be the product. Check the provider’s reputation. Do they have a history of prioritizing privacy? Are their security claims independently audited?

Does it integrate safely?

If you need integrations, ensure they don’t create unnecessary security gaps. Sometimes, a standalone secure tool is safer than a “suite” that shares data across many apps.

Protect your business with secure video conferencing software

The “easy” solution is to grab the most popular free tool. But the path of least resistance can come with hidden costs to your security and reputation.

If you treat your client data and business conversations with the same care you treat your physical office, you need a tool built for that level of trust.

Proton Meet was built by the team behind Proton Mail with this exact philosophy. It is designed for businesses that cannot afford to compromise on privacy.

Encryption by default: Every call is protected with end-to-end encryption. No one — not even Proton — can access your conversations.
Zero data collection: Your calls are not used to train AI or serve ads.
Swiss privacy laws: Hosted in Switzerland, your data enjoys some of the strongest legal protections in the world.
Open source: Our code is open-source for independent experts to audit, proving our security claims.

You can host sensitive business discussions, onboard new hires, or close deals with clients knowing that your conversations remain strictly between you and them.

Frequently asked questions

What is the difference between video conferencing and video calling?

People often use the terms interchangeably. Generally, “video calling” refers to a one-on-one chat, while “video conferencing” implies a group meeting with features like screen sharing and participant controls. However, most modern tools handle both seamlessly.

Is video conferencing secure?

It depends entirely on the tool you choose. Many popular platforms are not secure for sensitive business data. Tools like Proton Meet use end-to-end encryption to ensure that only you and your participants can access the call, making it a secure choice for business.

Which platform is best for video conferencing?

For businesses that prioritize security and privacy, Proton Meet is the top choice. It offers the familiar features you expect — screen sharing, high-quality video, and ease of use — but with a privacy-first design that ensures your data is never sold, shared, or accessed by third parties.

AI compliance tools: What small businesses need to know

Alanna Alexander — Fri, 29 May 2026 15:26:37 GMT

AI compliance is still emerging as a topic, but regulations like the EU AI Act make compliance compulsory.

However, many AI tools weren’t built to be compliance-ready. They log conversations, use your data for training, and provide little transparency about where your data ends up. That creates significant compliance risks for businesses adopting new AI technologies.

This guide explains what AI compliance is, how to choose the right tools, and how to stay compliant over time.

What is AI compliance?

AI compliance means using business AI assistants and other tools responsibly while meeting legal and ethical requirements. It differs from traditional data security compliance.

AI systems don’t just store your data; they also process it and learn from it, which creates new risks for businesses. Your business data could be used to train models, shape their outputs, or even appear in responses for other users.

According to McKinsey’s 2026 AI Trust Maturity Survey, awareness is outpacing action. Across every risk category, mitigation lags behind awareness. For example, 54% of respondents identify personal privacy as a relevant AI security risk, but only 44% are actively working to mitigate it.

AI compliance addresses these risks by focusing on:

Protecting personal data and privacy
Securing data against unauthorized access
Ensuring transparency in AI decision-making
Preventing discrimination and bias

Why AI compliance matters

The regulatory landscape for AI is evolving quickly, alongside the technology itself. In 2024, the EU AI Act came into effect as the first comprehensive AI regulatory framework.

It bans certain uses of AI and places strict requirements on others. For example, some systems must clearly disclose that people are interacting with AI.

While most countries do not yet have comprehensive AI laws, existing regulations may still apply at national or regional levels. Frameworks like GDPR and HIPAA already restrict how you can use personal data, including in AI systems.

AI compliance is not just about avoiding fines. It also helps you maintain trust and reduce legal risk. If AI systems produce biased or incorrect outcomes, you risk losing customer trust, facing regulatory scrutiny, or opening yourself up to legal action.

How to choose the right AI tools for small businesses

Choosing compliant AI tools isn’t fundamentally different from choosing a tool that handles sensitive data. As we covered earlier, AI systems don’t just store data; they learn from it and can expose it in unexpected ways.

Here’s what to focus on:

Data protection and privacy

Choose tools that encrypt your data and comply with regulations such as GDPR. Vendors should be transparent about where your data is stored, who can access it, and whether it is used to train AI models. Make sure you can delete your data when needed.

Transparency and control

Choose tools that explain how decisions are made and allow for human oversight. This helps you justify outcomes to customers or regulators and ensures you retain control when needed.

Fairness and ethical use

Choose tools that include safeguards to reduce bias and discrimination, especially for sensitive use cases like hiring or customer support. Vendors should also be able to explain how they test for fairness and address issues when they arise.

Compliance support

Choose tools that align with your industry regulatory requirements and provide documentation for audits. This makes it easier to demonstrate compliance, especially in regulated sectors like healthcare.

Best practices for maintaining AI compliance

Choosing the right tools is just one part of the equation. The other half is staying compliant, which requires ongoing effort.

Establish AI guidelines

The infamous 2023 Samsung-ChatGPT leak occurred when employees accidentally shared confidential trade secrets by pasting them into ChatGPT. It’s an incident that could have been prevented with established AI guidelines.

AI guidelines let your team know what’s acceptable and what isn’t when it comes to AI use. Your AI policy should cover which tools are approved, what they can be used for, and what data can and cannot be shared with them. Also, assign someone to maintain and update these guidelines as regulations and technology evolve.

Keep records of AI usage

If you can’t show how AI is being used in your business, you’ll struggle to respond when regulators or auditors ask questions. Track which tools are in use, what decisions they’re influencing, and any significant outputs. Where possible, ask vendors for usage logs and model update reports to simplify documentation.

Minimize and anonymize data

The less personal data you feed into AI systems, the lower your risk. Only share what’s necessary for the task, and strip out identifying details like names and addresses where possible. And make sure you have explicit permission before using customer or employee data with AI tools — don’t assume consent.

Monitor for unfair treatment

AI systems can develop biases from historical data, even when those biases are unintended. You should regularly review output for discriminatory patterns that disadvantage people by age, gender, race, sexuality, or other characteristics.

Amazon scrapped an AI recruiting tool in 2018 after discovering it downgraded resumes from women. The system had been trained on a decade of historical resumes — most from men — and learned to treat male candidates as the standard for success, penalizing resumes that deviated from that pattern.

How Proton helps businesses achieve strong AI compliance

AI may be a new frontier, but the fundamentals of compliance remain the same — strong data management, clear access control, and visibility over how your information is used.

Proton for Business is a suite of team collaboration tools built on these principles and extends them to AI with Lumo, our privacy-first AI assistant.

Keep full control of your data with Lumo

Need to summarize a confidential contract, brainstorm a sensitive business strategy, or analyze financial documents? With most AI tools, that’s risky — your inputs could be logged, used for training, or accessed by third parties.

Lumo is a business AI assistant that lets you work with sensitive information freely. No logs, no training on your data, and everything encrypted so only you can read it.

Manage credentials with Proton Pass

When employees share passwords over email or keep them in spreadsheets, you lose visibility over who has access to what — and that’s a compliance liability.

Our business password manager, Proton Pass, gives you a secure way to manage and share credentials, with clear oversight over access. When someone leaves, revoking their access only takes seconds.

Keep your files private with Proton Drive

Enjoy the productivity benefits of AI without the compliance challenges.

Proton Drive is a business cloud storage solution that integrates directly with Lumo, so your files stay within an end-to-end encrypted environment, allowing you to use AI with client documents or financial records without exposing them to third parties.

Protect your network with Proton VPN

When your team accesses AI tools or business systems from outside the office, unsecured networks create gaps in your data protection.

A business VPN encrypts their connections, keeping sensitive information protected in transit. And with a strict no-logs policy, there’s no record of your team’s activity that could be exposed or subpoenaed.

Backed by Swiss privacy laws

As a Swiss company, Proton operates under strong privacy protections. This limits external access to your data and helps safeguard your business.

Protect your business and ensure AI compliance with a secure business suite

With Proton Workspace, your business gets access to secure email, cloud storage, a password manager, VPN protection, and a private AI assistant. Proton’s entire ecosystem works together to keep your business private and compliant.