Is Privacy Dead? AI, Surveillance and Your Data

Is privacy dead? The evidence says no, though the default has flipped. Data about you is now collected unless you take steps to limit it, AI makes combining and interpreting that data far cheaper, and the rules that push back vary a great deal from country to country. What is left is a mix of settings, laws and habits that still change outcomes, and this post lays out the evidence for both sides. I am a final-year Computer Science student and a web developer, not a privacy lawyer or a security researcher. Everything below is general information, not legal advice, and every figure comes with its source and date so you can check it.

What does "privacy is dead" actually claim?

The phrase usually bundles three separate claims. The first is that companies and governments collect so much that you cannot avoid being counted. The second is that once data leaves your hands you cannot get it back. The third is that laws exist on paper but do little in practice. Each can be tested on its own, which is more useful than arguing about the slogan. Public mood leans toward the pessimistic reading. In a Pew Research Center survey of 5,119 US adults taken on 17 to 23 February 2026, 71% said more use of AI will make their personal information less secure, 10% expected little difference, 16% were not sure and 3% expected it to be more secure. That measures a feeling about risk, not actual harm. An earlier Pew survey from May 2023 found that 67% of US adults understood little or nothing about what companies do with their data, and 73% felt they had little or no control over it. Those numbers describe confusion and a sense of helplessness, gathered in one country. They say little about whether protection is actually possible.

How is your data collected today?

Most collection happens through ordinary things. Apps and websites embed third-party code that reports what you do, and ad networks use that information to decide which ad you see. Phones can reveal where you go. A smartphone with location access switched on all day is a very detailed diary. Data brokers buy and resell this material. In January 2025 the US Federal Trade Commission finalised an order barring Gravy Analytics and its subsidiary Venntel from selling sensitive location data, after alleging they had sold lists of people who visited places such as healthcare facilities and places of worship. The order has exceptions for national security and law enforcement. It shows that this trade existed at scale and that at least one regulator treated it as unlawful. Cameras and devices add more. According to the same Pew report, 37% of US adults own a smartwatch, 35% a smart speaker and 18% a smart doorbell. Facial recognition adds a further layer: the company Clearview AI built a database by scraping images from the web, and the Dutch data protection authority fined it 30.5 million euros in September 2024, according to press coverage of the decision. The newest source is the AI chat window. Pew found that 49% of US adults have used an AI chatbot, and its list of uses includes medical advice (20%) and emotional support (10%). People type things into a chatbot that they would never post publicly. What happens to those conversations? A Stanford HAI study published in October 2025 reviewed 28 privacy documents from Amazon, Anthropic, Google, Meta, Microsoft and OpenAI. It found that all six use chat data to train their models by default. Some keep it indefinitely, some allow humans to review transcripts, and the multiproduct companies can combine chats with other data such as search queries. A court case showed another limit. In May 2025 a US judge ordered OpenAI to preserve output logs that would normally be deleted, including temporary chats, in a copyright lawsuit brought by the New York Times. One later update on a developer's blog said OpenAI was released from that duty, with some exceptions, on 9 October 2025. The lesson is that "delete" in a chat app is a company setting and can be overridden by legal process.

What does AI change about surveillance and data?

Most of these data sources predate AI. What changes is what can be done with them, and four shifts matter. The first is inference. A 2023 preprint by Robin Staab and colleagues (arXiv:2310.07298) tested language models on real Reddit profiles and found they could infer attributes such as location, income and sex from ordinary posts. The best model reached up to 85% top-1 accuracy, and the authors estimated the approach to be about 100 times cheaper and 240 times faster than human labellers. It is a preprint, and it tested models that are now several generations old. Even so, it shows that you can reveal things about yourself without ever stating them. The second is cloned voices and faces. On 15 May 2025 the FBI's Internet Crime Complaint Center warned that, since April 2025, people had been impersonating senior US officials with text messages and AI-generated voice messages to gain access to accounts. Its advice applies to anyone: do not assume a message is authentic, verify using contact details you look up yourself, do not click links before confirming the sender, never share two-factor codes and consider a family code word. Any public recording of your voice is raw material for this. The third is training on scraped data. In December 2024 Italy's data protection authority fined OpenAI 15 million euros, finding that it had trained ChatGPT on personal data without an adequate legal basis and had breached transparency duties. OpenAI called the decision disproportionate and said it would appeal. I could not confirm how the appeal ended. The fourth is scale. Matching faces, voices and habits across millions of people used to need teams of analysts. A model can do a first pass on all of them at once, which is one reason regulators now write rules about biometrics specifically.

What do breach statistics say about your data?

Collection becomes a problem when it leaks. Three annual reports measure different things, so they are worth keeping apart. IBM's Cost of a Data Breach report, released on 29 July 2026, put the global average cost of a breach at 4.99 million dollars. IBM also said one in four malicious breaches was AI-enabled, a 56% rise over the previous year, and that such breaches averaged about 6 million dollars. That figure is the cost to an organisation that was breached. It does not count how often breaches happen or what they cost the people whose data was exposed. The Verizon Data Breach Investigations Report 2026 looks at how attackers get in. As summarised by Help Net Security, it analysed more than 31,000 incidents and over 22,000 confirmed breaches across 145 countries. Exploiting software vulnerabilities was the most common first step, in 31% of breaches, ahead of stolen credentials at 13%. The human element was involved in 62% of breaches, and the report found that 67% of employees using AI services on corporate devices did so with non-corporate accounts. DLA Piper's annual GDPR survey counts breach notifications sent to European regulators. In the year to 27 January 2026 it recorded an average of 443 per day, up 22% from 363. That rise partly reflects reporting duties, so do not read it as a pure measure of how many breaches occur. What do these reports have in common? A large share of breaches start with unpatched software, stolen credentials or a third party. Those are things individuals and developers can influence, which matters for the question of whether privacy is dead.

Which laws protect your data, and do they work?

The answer depends on where you live, so here is the status in the places a reader of this blog is most likely to care about. EU: the GDPR is the best-tested example. DLA Piper's January 2026 survey counted about 7.1 billion euros in fines from May 2018 to 10 January 2026, with about 1.2 billion in 2025. A large single case was the Irish regulator's 2 May 2025 decision against TikTok, a 530 million euro fine, made up of 485 million for transferring EU user data to China without demonstrated equivalent protection and 45 million for transparency failures. The EU AI Act adds AI-specific rules. According to the European Commission's AI Act page, prohibitions covering untargeted scraping of internet or CCTV material to build face databases, emotion recognition in workplaces and schools, and real-time remote biometric identification by police in public spaces have applied since 2 February 2025. The same page lists obligations for high-risk systems in areas such as biometrics and employment from 2 December 2027, later than first planned, after a 2026 amendment. US: there is no single federal privacy law as far as I could verify. Instead there is a patchwork of state laws. Trackers in 2026 put the number of states with comprehensive laws at around twenty, though counts differ depending on whether laws that have not yet taken effect are included. The FTC action above is one of the main federal tools. India: the Digital Personal Data Protection Rules were notified on 13 November 2025 in phases. The Data Protection Board was set up immediately, consent-manager registration follows after 12 months (so around now), and the main duties on notice, consent, security safeguards, breach reporting and children's data apply after 18 months, on 13 May 2027. Pakistan: as of March 2026, a Legal 500 market intelligence article described Pakistan as still having no enacted comprehensive data protection law. The Personal Data Protection Bill 2023 has been through several versions. Critics say provisions on data localisation and state access could favour state control, while business groups worry localisation could deter investment. Other 2026 sources I found disagreed about whether a revised draft had cleared cabinet or parliament, and none confirmed that it became law, so check the National Assembly and Senate sites for the current position. In practice, many Pakistani users depend on the settings and policies of the platforms they use rather than on a general statutory right to see or delete their data.

Is privacy dead, or is it changing shape?

Here is the strongest case for "dead". Collection is the default and the controls are hard to find. Most people say they do not understand what happens to their data. Breaches are routine, and AI lowers the cost of inference, impersonation and matching. Laws are national while data is global, and some countries, including Pakistan, lack a general law at all. If privacy means that nobody can learn things about you without your knowledge, that world is largely gone. Here is the strongest case for "alive". Regulators issue large fines and some orders have bite, as the TikTok decision and the FTC's location-data orders show. The EU has banned certain practices outright, and India is phasing in a new regime. Many routes into your accounts are ordinary and controllable: unpatched software, reused passwords and phished codes. Privacy as control over who knows what, within limits, still responds to effort and rules. The two views disagree mostly about the definition. If privacy means total invisibility, it is dead and probably was never fully possible. If it means having real choices and legal recourse, it is alive but unevenly distributed. People in the EU have more levers than people where no general law exists yet, and people with time to adjust settings have more than people who do not.

What can you still protect, and how?

Most of the effective steps are dull, and none of them requires evading anyone. They reduce what is collected, limit damage when something leaks and make impersonation harder. Here is a checklist you can work through in an afternoon.

Text

ACCOUNTS
[ ] Use a password manager; one unique password per account
[ ] Turn on passkeys where offered, else an authenticator app
    (SMS codes are better than nothing)
[ ] Never read a two-factor code out to anyone, even "support"
[ ] Secure your email first: it resets every other account

DEVICES AND UPDATES
[ ] Turn on automatic updates for phone, laptop, browser, apps
    (exploited vulnerabilities were the top breach entry in 2026)
[ ] Set a screen lock and enable device encryption
[ ] Delete apps you no longer use

APP PERMISSIONS
[ ] Location: "while using" or off; never "always" unless needed
[ ] Microphone, camera, contacts: allow only for apps that need them
[ ] Review permissions every few months
[ ] Reset or limit your advertising ID in phone settings

AI CHATS
[ ] Do not paste passwords, API keys, ID numbers or bank details
[ ] Do not paste other people's private data or client files
[ ] Check training settings and opt out where the option exists
[ ] Use a temporary or no-history mode for sensitive questions
[ ] Use work-approved accounts for work material

SHARING LESS
[ ] Give the minimum a form really needs; skip optional fields
[ ] Use a separate email for sign-ups and newsletters
[ ] Turn off location tagging on photos you post publicly
[ ] Agree a code word with family to check urgent voice calls

BACKUPS AND RIGHTS
[ ] Keep encrypted backups: one local copy, one off-site
[ ] Test restoring one file
[ ] Where a law gives you access or deletion rights, use them

A few items deserve comment. The AI chat items follow from the Stanford finding that training on chats is the default across the major providers, and from the Verizon figure that two thirds of workplace AI users on corporate devices used personal accounts. The code word comes from the FBI's advice on voice impersonation. None of this is a guarantee. It simply moves you from the easy-target group toward the harder-target group.

What should developers change?

If you build software, you are on the collecting side. The simplest principle is to collect less, keep it for a shorter time and log it carefully. A field you never store cannot leak, and data you deleted last year cannot appear in this year's breach. Some concrete habits. Ask whether each field in a form is needed for the feature, and drop it if not. Set retention periods and delete old records on a schedule. Keep secrets, tokens, passwords and full request bodies out of logs and error trackers. Hash passwords properly, as I explain in the post on JWT authentication with bcrypt in Express. Limit who can see what with role-based access control in Next.js and Prisma. Run the security items in the website launch checklist before going live, and keep dependencies updated, since vulnerability exploitation led the 2026 Verizon findings. AI features need extra care. Before sending user text to a third-party model API, check that provider's retention and training terms, tell users what is sent and avoid including identifiers when the feature does not need them. A multi-vendor store such as GoCart, my final-year project, holds names, addresses and order histories, which is exactly the kind of data this applies to. For broader context on benefits and risks, see my post on the future of AI.

What do I make of all this?

My view comes from a student developer who reads about this topic, without legal or security expertise, so weigh it accordingly. I think "dead" overstates the case. The evidence supports a narrower claim: the assumption that you are unobserved unless you act has gone, and settings, tools and habits now take active choices. The fines, bans and phased laws suggest the rules are real, though enforcement is slow and aimed mostly at large companies. What stays uncertain is how fast AI inference and impersonation will outrun those protections. The 2023 inference preprint is one study on one dataset, so newer replication would help before treating its numbers as general. For Pakistan the open question is whether a general law passes and what it says about state access, because a law with broad exemptions for government could protect less than its name suggests. Two things would change my mind. If large fines turn out to have no effect on how companies behave, or if breach and impersonation rates keep climbing despite stricter rules, the pessimists win the argument. If enforcement spreads to more countries and default privacy settings improve, the other side does. For now the practical conclusion is modest: do the dull checklist items, share less and ask any service you build or use what it keeps.

Want to talk about this?

I am a full stack developer based in Rahim Yar Khan, Pakistan, a final-year Computer Science student, and I work in web development at Hadi Dev Lab. If you have a question about this post or want to talk about data handling in a web project, you can message me on WhatsApp or email. You can also see my work or read more about me. Cover photo from Unsplash.