[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fird0WMdWhMsvKmvDoh3S6arIDaFXCQceDZnpqpAFtJg":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":23,"status":24,"created_at":25,"published_at":26,"article":27,"tags":31,"podcasts":50,"controls":57},"3c4eac8b-8453-43a6-a159-0159c95bad41","ai-service-collects-face-scans-and-mood-data-under-legitimate-interests-loophole","092a6938-7470-4ec4-9952-1f1ae42b9aed","AI Service Collects Face Scans and Mood Data Under 'Legitimate Interests' Loophole","The 'Talking Tilly' AI service required users to submit to biometric face scanning for age verification and real-time mood analysis without obtaining explicit consent, instead relying on the weaker 'legitimate interests' legal basis. This is particularly concerning because biometric and emotional data are among the most sensitive categories of personal information, warranting the highest level of protection. The service also recorded and transcribed all calls via Google's Gemini, creating additional data exposure risks through a third-party provider. This case illustrates how AI-driven consumer services can obscure the true scope of data collection behind novel or entertaining interfaces, leaving users unaware of what they are surrendering. When services are shut down without a clear data deletion policy, the residual risk to users' biometric data persists indefinitely.","**Immediate actions:**\n- Audit all third-party integrations to identify where biometric or sensitive personal data is being collected, processed, or stored.\n- Require explicit, informed opt-in consent for any biometric data collection, separate from general terms of service.\n\n**Long-term improvements:**\n- Implement a Data Protection Impact Assessment (DPIA) before deploying any AI service that processes biometric or emotional data.\n- Establish a formal data retention and deletion policy, including contractual obligations for third-party processors to delete user data upon service termination.\n- Conduct regular privacy-by-design reviews for all AI-powered consumer-facing products.\n\n**Detection & Compliance measures:**\n- Monitor third-party AI and biometric vendors for compliance with agreed data handling standards using continuous vendor risk assessments.\n- Train product and legal teams to correctly classify biometric data as a special category requiring explicit consent under GDPR Article 9.\n- Establish a user-accessible mechanism to request deletion of biometric data at any time, in line with GDPR Article 17 (Right to Erasure).",[12,13,14,15,16,17,18,19,20,21,22],"GDPR Article 6 (Lawful Basis for Processing)","GDPR Article 9 (Special Categories of Personal Data)","GDPR Article 13 (Transparency & Right to Information)","GDPR Article 17 (Right to Erasure)","GDPR Article 35 (Data Protection Impact Assessment)","NIST Privacy Framework PR.DS-1 (Data at Rest)","NIST SP 800-188 (De-Identification of Government Datasets)","CIS Control 3 (Data Protection)","CIS Control 15 (Service Provider Management)","ITIL Service Design – Information Security Management","ISO\u002FIEC 27701 (Privacy Information Management)",{},"published","2026-09-19T12:20:18.203652+00:00","2026-09-19T12:20:18.091+00:00",{"id":7,"url":28,"slug":29,"title":30},"https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Fcalling-viral-ai-actress-tilly-norwood-agree-to-a-face-scan-first\u002F","calling-viral-ai-actress-tilly-norwood-agree-to-a-face-scan-first-770903","Calling viral AI actress Tilly Norwood? Agree to a face scan first",[32,38,44],{"id":33,"name":34,"slug":35,"description":36,"color":37},"7261eb8f-acd4-4d93-a489-7fdd652ec0ea","Security Awareness","security-awareness","Phishing, social engineering, human error","#22c55e",{"id":39,"name":40,"slug":41,"description":42,"color":43},"c0dcc566-3654-4d70-8ede-262a198e732f","Regulatory Compliance","regulatory-compliance","GDPR, NIS2, DORA, sector-specific violations","#ec4899",{"id":45,"name":46,"slug":47,"description":48,"color":49},"c8b843a5-d5a7-41d1-8d3b-cabded09d2ef","Data Protection","data-protection","Unencrypted data, missing DLP, poor classification","#3b82f6",[51],{"id":52,"date":53,"edition":54,"title":55,"audio_url":56},"74e568f4-38a0-4b8f-a128-3d071d92d7bd","2026-09-19","afternoon","ThreatNoir Weekend Brief — September 19","https:\u002F\u002Fcdn.threatnoir.com\u002Fpodcasts\u002F2026-09-19\u002Fthreatnoir-afternoon-brief-2026-09-19.mp3",[58,62],{"slug":59,"name":60,"problem":61},"data-loss-prevention","Data loss prevention (DLP)","Sensitive data cannot quietly leave by email, upload, USB stick or AI tool.",{"slug":63,"name":64,"problem":65},"encryption-key-management","Encryption and key management","Stolen data stays unreadable, and the keys stay under your control."]