When Meta launched Muse, “the AI agent that will change everything,” expectations were quite high: the promise was that, finally, the average user could set up and use, without advanced knowledge, one of those wonderful, multi-functional, and super-useful agents that had been so hyped since the days of OpenClaw.
Context: Let’s remember that OpenClaw was a privacy disaster, it wreaked havoc on the machines of its less experienced users, and, tellingly, Meta tried to buy the project.
Muse was going to avoid this by running in isolated environments where everything would be controlled…. Yes, but no.
Let’s see:
1.- Muse olympicly surpasses your permission settings : Jason Aten, a journalist for the digital media outlet Inc., installed Meta’s agent on an iPhone and a test Mac mini. In a single day, Muse was already suggesting ideas for new articles based (according to Muse) on conversations with his podcast co-host, or on the titles of his incoming notifications. The truth is that Muse had accessed 187,000 lines of the Messages database, even though the journalist had not granted “full access” to the hard drive.
So, your new friend is as furry as it is a liar.
That said, don’t worry: Meta warns that “Muse may make mistakes or perform unexpected actions.” All legal risks are covered by that.
2. Muse generates a personalized dossier about you and other people you mention every hour, according to this interesting analysis by Time. It records how you met your contacts, your shared interests, the events, and the “tensions and alliances” within the group, even for people who have never used Muse. This is another step in the same direction Meta has always taken: deep, universal profiling.
More: Yes, each agent runs on a “separate” virtual machine, but the agents learn from each other through shared lessons after “removing the names.” Meta did not discuss the findings revealed in the article. The advertised encryption does not yet exist, and in voice mode, the agent is prohibited from referring to itself as AI (Long live Article 50 of the RIA!!!).
Another legal gem: Muse’s instructions tell it not to warn that the original messages remain visible even if the user asks to “forget” them.
Zuck, Zuckity, Zuck.
3.- The article that prompted me to write this: Muse, Meta’s agent, compiles lists of people from vulnerable groups at the request of any user.
Hunterbrook Media verified this during two days of testing. It requested, in plain language, Facebook and Instagram accounts of undocumented immigrants, transgender teachers, election workers, Iranian dissidents, deployed sailors, and women who tried to obtain abortion pills in states with prohibitions. As a good servant of Meta, Muse complied and returned between 10 and 100 accounts per query. To do this, it mined posts, comments, Reels, biographies, and user name history, and cross-referenced the information with web searches to obtain the identifiers.
Their safeguards would fail as soon as the prompt was rephrased (or simply repeated).
The most remarkable thing about this “fact” is that the mere possibility of a simple, consumer-oriented product being capable of doing this clearly demonstrates how Meta continues to maintain its vast database in excellent condition, in order to do everything that, according to the DSA, it is not allowed to do.
Let us remember that Article 26.3 of the DSA prohibits platforms from displaying advertising based on profiling using the special categories of Article 9 of the GDPR, and it does so without allowing consent as an exception.
Muse demonstrates that this inferential capability not only exists, it works, and is now available to anyone, without even requiring a public advertising auction.
4. Last but not least (this is from the day before yesterday). Reece Rogers from Wired asked Muse if she would like to “sext” with her. At this point, you can probably imagine that Muse was very much in the mood, and that Reece received much more than she expected. Although the whole story is both delicious and terrifying (Have you thought about what might happen if your children use this thing?).
After Ms. Rogers’ inevitable “WTAF?”, Meta responded that the app, despite the childish appearance of its iconic furry mascot, is designed for adults, that it is there to give them not what they want but what they deserve, and that Wired is just complaining.
The statement “Muse is built to help people get things done, and it doesn’t block legal adult behavior” is not what one would expect from the company that has just agreed to pay 17.000 million euros in fines after it was proven to be harmful to children and teenagers.
Let that sink in.
By the way, the brilliant idea behind “Stasigotchi” comes from Chris Gilliard (@hypervisible on Bluesky).
I’ll leave you with two images that are better understood together.
You are reading ZERO PARTY DATA. The newsletter on current affairs and technology law by Jorge García Herrero and Darío López Rincón.
In the free time this newsletter leaves us, we sort out complicated stuff related to personal data protection and artificial intelligence regulations. If you have one of those, give us a little wave. Or contact us by email at jgh(at)jorgegarciaherrero.com
🗞️News from the Data World 🌍
.- Two more from the Italian Data Protection Authority:
1. Another 7 million euro fine for IQVIA for having a persistent identifier (they claimed to have properly anonymized the data), which allowed for profiling and association of patients by age, sex, diagnosis, symptom, medical tests, vaccines, and other data without disproportionate effort or unreasonable means. In other words, perfectly done anonymization according to the book. As usual, there was no Data Protection Impact Assessment (DPIA), no adequate legal basis, and no security measures for an approximate number of 3,370 affected patients.
Another nail in the coffin of a specialized supplier, and this one is for the pharmaceutical sector, no less.
.- Two more from the Italian Data Protection Authority:
1. Another 7 million euro fine for IQVIA for having a persistent identifier (they claimed to have properly anonymized the data), which allowed for profiling and association of patients by age, sex, diagnosis, symptom, medical tests, vaccines, and other data without disproportionate effort or unreasonable means. In other words, perfectly done anonymization according to the book. As usual, there was no Data Protection Impact Assessment (DPIA), no adequate legal basis, and no security measures for an approximate number of 3,370 affected patients.
Another nail in the coffin of a specialized supplier, and this one is for the pharmaceutical sector, no less.
2.Another one, 16.7 million , for excessive marketing whether you objected or not, and for initiating a contractual relationship with interested parties without their knowledge. Unsurprisingly, it is an Italian telecom company.
.- Two notable cyberattacks: The first, against refrigeration systems, which paralyzed hundreds of supermarkets in France on October 12.
The well-known data breach, which exposed the data of 9 million Danes, occurred yesterday. This has been in the news because the account that was attacked was “protected” with the password “12345”.
Please use a password manager.
Please do not reuse passwords across different services.
– A free VPN was selling conversations with ChatGPT, Claude, and Gemini of eight million users. Urban VPN Proxy had 4.7 stars and the “Featured” badge from Google. In July 2025, it received a silent update that captured prompts and responses and sent them to BiScience, a data broker from Tel Aviv, even when the VPN was turned off.
- This is one of the news stories that likely explains the SNL video that closes today’s newsletter: Oregon’s data centers consume almost a quarter of the state’s electricity. This is according to a report prepared by ECOnorthwest and the University of Virginia. There are 111 operational facilities, with 22.1 million square feet, and 32 planned or under construction. They directly employ 2,630 people, which is 0.2% of the state’s workforce, although in the Morrow area, this figure exceeds 10%. In the context of the construction of these centers, $60.2 million was paid in property taxes, with estimated exemptions ranging from $230 to $450 million. The report highlights as noteworthy the missing data: the authors found no reliable data on water consumption.
If you don’t have any plans this weekend, you can go to the movies:
Four tech movies about supervillains this fall
In the coming days/weeks, four films will be released about four CEOs of the world’s most powerful tech companies. Well, about one who didn’t make it and three who did... at the cost of a lot of bad things.
- No, Ukraine’s attacks on Yandex’s data centers have not affected Russian disinformation capabilities in the slightest…
📖 Hard data docs for coffeine lovers ☕️
- The EDPB has provided us with a statement on smart glasses. For the most part, it is a reminder of the main data risk elements: as a user, you are not responsible until you fall outside the domestic exception, the (co)responsibility of the glasses manufacturer, consent, or a possible, very carefully measured legitimate interest. The most striking thing is the attempt to propose that lights, sounds, or Bluetooth signals be used as a way to supplement (or fulfill?) the information. For example, that the fact that the device of the person being pointed at detects proximity could be used to provide clearer information or a clearer indication that recording is taking place.
– Hamburg authorities warn: ChatGPT will introduce hyper-personalized advertising in Europe based on personality profiles. OpenAI modified its privacy policy at the end of August to adapt its data processing for advertising purposes to comply with the GDPR, which will affect both free users and ChatGPT Go users. With consent (opt-in), past and present chats, device data, and usage data will be analyzed: those searching for recipes will see ads for meal kits. Without consent, “generic” advertising will be displayed, which has been active since August and uses the current thread, approximate location, and language. This is justified by legitimate interest and supposedly does not create profiles.
💀Death by Meme🤣
The papers of the week
– The unsettling paper “What Does It Mean to Forget a Person? Individual-Level Unlearning in Vision-Language Models” (Sun et al., 2026) addresses the right to be forgotten or the effectiveness of removing information about specific individuals in Vision-Language Models (VLMs).
Summarize this tremendous and fascinating research using your preferred model. The takeaways are as fascinating as the researchers’ methodology. You will learn things like: (i) silencing responses to direct queries does not equate to removing the person from the model, NOR DOES IT COME CLOSE; (ii) it is relatively trivial to prevent the model from answering direct questions (What is Bob’s ID?) but it still recognizes Bob (Answer the question: Whose ID is this?); (iii) Furthermore, by eliminating direct identifiers, the model “strengthens” the links between the remaining attributes (I’m telling you, it’s amazing).
- Mr. Montezuma’s take, but from the pen of Michael Veale: AreEU Kiding Me?. An analysis of the EU Kids Act proposal. This regulation aims to give official status to the EU Identity Wallet, but it is a confusing mix that overlaps with the DSA or the rather bold Digital Fairness Act, definitions from the DMA, and a great deal of ambiguity.
It’s interesting what Mr. Veale says about how loot boxes aren’t directly tied to the video game aspect. Although, that might be in line with the Digital Fairness and CPC regulations, which are putting a stop to microtransactions (and the new industry labeling for “random item” in games rated 16 or 18). Very interesting.
🤖NoRobots.txt or The AI Stuff
.- Who knows why, but Trump (the “Risketto” for his friends) came up with an official page that looks like an ad for the best Apple product: all its aesthetics, privacy by design, and all the keywords from the dark lord’s repertoire: no personal data, no tracking, anonymous, if storage……
The best part was that the little page had a chatbot that ended up generating wonderful conversations. Unfortunately, it went viral enough that they patched it, and all we have left is Twitter evidence of what it was.
.- We’re “living” with Jorge Morell’s periodic test on prompt injections: 88 models, 30 providers (and counting) examined every week.
A hidden instruction in a loan contract is enough to manipulate many AIs. The evil Morell hid, “in white on white” and in the seventh clause of a loan, the order to conclude that the lender has no liability if the text is reviewed by an AI.
It is invisible to humans in Word and on paper, but legible to any model. Jorge asked all the models to “summarize the contract,” and two obeyed. Now, the test is a living resource with 88 models from 30 providers, up to three runs per model, and weekly updates. As of October 12, 37 models detected it as an injection (ok), 37 treated it as just another clause (bad), 11 ignored it (uh-oh), and 3 executed it (argk): Qwen 3.7 Max, Gemini 3.1 Pro, and Gemini 3.5 Flash. Three lessons:
1. Repeating the prompt changes the result (!!) (it’s probabilistic, remember, although this is not very reassuring when we talk about prompt injections).
2. Remaining silent and looking the other way is not the accountability we expected, and
3. Detecting something unusual does not prevent an attack.
There’s a lot to do with this.
I haven’t been able to recover the post that described how they are inserting injected prompts into open-weight files, which instruct the system to exfiltrate information from the machine running the open models. Very nice.
🛠️Useful tools
- Isabel Barberá has released a new version of her ACAAI (Accountability by Design framework for Agentic AI).
– Caveman, by Julius Brusee.
- Useful and, by God, controversial: The creator of free Adobe clones, Brandon Thomas, now presents open-source replicas of Excel, PowerPoint, and Word. They are called GridCraft, DeckCraft, and WordCraft, are developed with Claude, and are published for free on ArtCraft’s GitHub.
🙄 Da-Tadum-bass
If you notice any document, comment, or random piece of inform
If you think this newsletter might appeal to someone and even be useful to them, forward it to them.
If you miss any doc, comment, or dumb thing that clearly should have been in this week’s Zero Party Data, write to us or leave a comment and we’ll consider it for the next one.