.svg){kind=small}
.svg){kind=small}
.svg){kind=small}
.svg){kind=small}
.svg){kind=small}
.webp?width=1220&height=1090&name=Osano-guarantee-seal%20(1).webp)
Most of us think of targeted ads as a privacy problem: they know a little too much and follow you around the internet. A new report shows they’re a cybersecurity concern too.
In a recent report, researchers describe how Discover-Tech, an Israeli company that presented itself as an ad firm, connected real-time ad auctions to mercenary spyware vendors. Its customers could target a specific advertising ID, browser ID, or IP address, win the ad slot on that person’s screen, and serve code that could run on the device. According to the report, simply displaying the ad could be enough. Citizen Lab links the operation with high confidence to Candiru infections at Al Jazeera, where at least 45 devices were targeted. The researchers call it the first public confirmation of zero-click mercenary spyware delivered through targeted ads.
Discover-Tech was also on Google’s and IAB Europe’s lists of certified or approved vendors from 2020 until this month. The report says it used IAB Europe’s Transparency and Consent Framework (TCF) to appear GDPR compliant. Both organizations have since pulled it from their registries.
Whether you’re an Osano user or use a similar consent management platform (CMP), if you have Discover-Tech (or its MyDSP platform) in your tag or vendor stack, take the following steps:
- Remove or block the Discover-Tech tag and audit your tag managers and CMP rules for related domains (e.g., mtrtb[.]com, controlium[.]net, powerium[.]net, myweb3id[.]io).
- If you use the TCF, check that Discover-Tech no longer shows up in your vendor list.
- Check with your ad ops or security teams whether Discover-Tech or its MyDSP platform bought ads on your site. The report names Google, Yandex, Vungle (Liftoff), Sunteng, Beeswax, and Eskimi as platforms it bought through.
A good reminder that data privacy and data security go hand in hand!
Best,
Arlo
New From Osano
Blog: 7 Takeaways from PSR 2026 (and What They Mean for Your Privacy Program)
The Osano team recaps their experience at the IAPP PSR conference in Seattle, covering seven themes from AI agents and consent gaps to tracking lawsuits and California audits.
In Case You Missed It...
Blog: Outfox Software’s Sunk-Cost Fallacy: How to Spot It and Escape
Feel like you just can’t get out from under that one software solution? You thought it was the safe choice when you first picked it, but now it’s causing more problems than its worth. If leaving still feels tough, we can look to psychology to show us how to back off of failing commitments–including commitments to overly complicated, expensive, and frustrating software solutions.
Blog: 5 Questions to Ask AI Vendors Before You Connect Them to Customer Data
Whether you’ve sought out AI-powered tools or your software vendor has added AI into an existing product, you can’t manage the risks they pose until you’ve asked what they are. If digging through pages of AI risk frameworks feels a little overwhelming, these 5 questions (grounded in those same frameworks) is a great starting point.
Tool: OneTrust Migration Calculator
If you’re looking to migrate from OneTrust to Osano, you might be feeling a little traumatized by OneTrust’s lengthy, complicated implementation. But getting started on Osano is straightforward, and with 40% of Osano customers coming from OneTrust, the Osano team has migrated hundreds of companies’ privacy programs before. Use our calculator to estimate what your migration timeline could take based on a few simple details of your privacy program.
Top Privacy Stories of the Week
Citizen Lab Traces Zero-Click Spyware to Targeted Ads
Citizen Lab says Discover-Tech, an Israeli company that presented itself as an ad firm, bridged real-time ad auctions and mercenary spyware vendors. Citizen Lab says its report is the first-ever public confirmation of zero-click mercenary spyware delivered via targeted ads and shows how this technique was used to infect devices at Al Jazeera with Candiru’s spyware. It also uncovers how the company helps mercenary surveillance vendors track and hack devices around the world.
AI Wearables Run into Decades-Old Wiretap Laws
Always-listening AI wearables are colliding with wiretap statutes written in the 1960s and ’70s. Twelve states, including California, Florida, and Illinois, require every party’s consent before a conversation is recorded, and California’s law allows civil damages of $5,000 per violation. Amazon’s Bee relies on small indicator lights that critics say are easy to miss, while Apple is reportedly building consent prompts into upcoming wearables. California’s privacy agency is also reportedly examining whether always-on AI devices violate state consumer privacy law.
States Take OpenAI to Court, One State at a Time
Rather than join one multistate suit, a bipartisan group of attorneys general is going after OpenAI in their own state courts under their own consumer protection laws. Iowa filed on October 14. Arkansas, Arizona, Idaho, and Montana are suing in their own courts, and Kansas, Nebraska, and West Virginia announced plans to follow. The states allege OpenAI failed to give proper warnings or restrictions on ChatGPT use, especially by minors, and several say it misled the public about the product’s safety.
WhatsApp’s Help Pages Hid Instructions for Its AI Chatbot
Redact, a data-deletion company, found 102 hidden text blocks across 80 of the 545 WhatsApp help pages it checked, all written for the company’s AI support chatbot. One told the bot not to point users who couldn’t delete their accounts to a data protection authority. Another told it to steer clear of privacy laws such as the GDPR once a user mentioned lawyers or courts, even if the user raised the law first. WhatsApp told WIRED the notes were meant for the chatbot and surfaced through a bug, and Redact confirmed they were gone by October 18.
Meta Ordered to Pay New Mexico $25 Billion
A New Mexico judge ordered Meta to pay $25 billion after a jury found in September that 26 of 29 statements by the company and its leadership were misleading, including statements about who had access to users’ data. The state’s case, filed in 2021, grew out of the Cambridge Analytica scandal. Counting each person who heard a misleading statement, jurors found more than 43 million violations, and state law allows up to $5,000 for each one. Judge Francis Mathew found that a penalty above $219 billion was warranted before reducing it, while Meta has argued it doesn’t sell user data and that the state never proved any consumer was misled.
Like What You See in the Privacy Insider newsletter?
There's more to explore:
🛠️ The Osano Engineering Blog
Learn what we're building, why, and how! New posts released monthly here.
📱 The Osano Subreddit
Join our official subreddit to stay up to date on the latest news, analysis, guidance, and content from Osano!
📖 The Privacy Insider: How to Embrace Data Privacy and Join the Next Wave of Trusted Brands
The book inspired by this newsletter: Osano CEO, Arlo Gilbert, covers the history of data privacy and how companies can start building a privacy program from the ground up. More details here.
If you’re interested in working at Osano, check out our Careers page!
