Data Privacy

In November 2025, Mixpanel suffered a sophisticated SMS phishing attack that exposed customer data across hundreds of organizations including OpenAI, SoundCloud, and cryptocurrency platforms. Stolen data included names, email addresses, approximate locations, and device identifiers. OpenAI terminated its Mixpanel relationship following the breach. CEO Jen Taylor did not respond to TechCrunch's detailed questions about the incident, including whether hackers made ransom demands or whether employees used MFA. A California class action lawsuit was filed December 1, 2025.

Attentive maintains TCPA, CTIA, CCPA, GDPR, CASL, and ADA compliance through a dedicated in-house legal team. The platform uses patented two-tap technology and double opt-in to obtain prior express written consent for marketing texts. Attentive proactively updated its platform for Texas SB 140 (effective September 2025) expanding text message marketing regulations. The company works with mobile carriers to inform guidelines and best practices, reducing risks of STOP failures and quiet hours violations.

On January 16, 2025, Insight Partners detected a ransomware attack that compromised the personal data of over 12,000 people including employees, limited partners, and portfolio company information. Attackers had gained access on October 25, 2024 via social engineering, operating undetected for 83 days. Stolen data included names, Social Security numbers, bank account numbers, and tax information. Insight Partners manages $90B+ in assets and has invested in security firms like SentinelOne and Wiz.

Settled a class action lawsuit for $95 million in January 2025 over claims that Siri secretly recorded private conversations — even without activation — and shared them with third-party advertisers for over a decade (2014–2024). Users received up to $20 per qualifying device. Court granted final approval; payments distributed January 2026.

X automatically enabled a setting allowing xAI to train Grok on users' posts without consent, affecting 60+ million EU users. Ireland's DPC opened a formal inquiry in April 2025. X agreed to delete EU user data collected between May 7–August 1, 2024, after regulators in eight countries took formal action. X's January 2026 terms expanded "Content" to include Grok prompts and outputs.

Mercury closed accounts of customers in Ukraine, Belarus, Croatia, and Nicaragua in 2024 without warning, citing compliance review. Affected founders criticized lack of due process.

Wired investigation found Perplexity ignores robots.txt and scrapes content from blocked domains using stealth crawlers, contradicting public statements about respecting publisher preferences.

An Illinois Circuit Court approved an $870,000 settlement after a class action lawsuit alleged Apollo.io "collected personal information of individuals employed by companies contained in the database without their knowledge or awareness" to advertise paid subscriptions, violating the Illinois Right of Publicity Act. The May 2023 lawsuit covered 20,730 Illinois residents whose profiles were added to free user accounts between May 2022 and October 2023. Apollo.io agreed not to display Illinois class members' names in solicitations for five years.

BeReal minimal data collection. Privacy-focused social app design.

Mixpanel privacy-focused analytics. GDPR compliant.

Segment customer data platform. Privacy controls but extensive tracking capabilities.

Gong records sales calls. Privacy concerns about call recording and AI analysis.

Apollo sales data platform. Uses extensive contact data scraping.

Moderna mRNA technology leader. COVID vaccine developer.

Whoop collects extensive health data. Privacy policies questioned.

Oura ring health tracking. Subscription model changed. Data collection concerns.

1Password employs a zero-knowledge security model with dual-key encryption: a master password combined with a 128-bit Secret Key created locally on the user's device. The company uses AES-GCM-256 encryption and states it "never receives copies of unencrypted Secure Data." 1Password maintains SOC 2 Type 2 certification, publishes results from independent security audits, and complies with GDPR. Telemetry is optional and the company states it does not sell user data.

23andMe massive data breach exposed 6.9M users. Genetic data privacy concerns.

In September 2022, Revolut confirmed a targeted cyberattack exposed the personal data of 50,150 customers (0.16% of its user base). Attackers used social engineering to gain access to Revolut's database, accessing names, email addresses, phone numbers, and partial payment card data. No PINs or passwords were exposed. The breach raised concerns about database security practices at one of Europe's fastest-growing neobanks, which had 20 million customers at the time.

Plaid agreed to a $58M class-action settlement in 2022 over claims it collected more user banking data than necessary. Company denied wrongdoing but reformed disclosures.

A February 2021 Stanford Internet Observatory report found Clubhouse transmitted users' unique ID numbers and chatroom IDs in plaintext, and that audio passed through servers of Shanghai-based Agora Inc., whose data "may be subject to China's cybersecurity law." Researchers found users could eavesdrop on conversations without appearing in the room by accessing Agora's infrastructure directly. Clubhouse stated it was reviewing its data protection practices but the security gaps raised concerns about Chinese government access to user data.

Cambridge Analytica harvested 87M users' data without consent for political targeting. $5B FTC fine (largest ever). $725M class action settlement. Zuckerberg testified to Congress. Data shared with 6,000+ developers without user knowledge.