I'm not paranoid. I'm early.

The look

The look you get

You already got the letter. It said they take your security seriously, one line above the part where they lost your Social Security number. A year of free credit monitoring. You skimmed it, maybe clicked the link, and went back to your day. Then the settlement e-mail: a few bucks for a decade of your data. You took it, or you didn't bother.

That's the shrug. Not stupid, not lazy. It's what everyone does, because nothing visibly broke. Your phone still unlocked. Your money was still there. Nothing happened. Except it did. You just haven't been billed yet.

Free credit monitoring. From the people who lost your credit file. Chef's kiss.

I'm the one who didn't shrug. You know the look I get for it. This is the receipt.

What I'm doing has a boring name in security. It's called threat modeling: write down what you're protecting, who would want it, how they'd get it, and what it costs to stop them. Banks do it. Hospitals do it. I did it for my own life, and the answers only look extreme because the defaults are that bad.

Exhibit A · identity

Your account belongs to whoever can recover it

Every platform says the account is yours. Technically, it belongs to whoever can finish the recovery flow: forgot password, code to the phone, code to the e-mail, done. It doesn't check who you are. It checks what you're holding.

For almost everyone, every one of those roads ends at the same object. The e-mail lives on the phone. The texts land on the phone. The password manager opens with the phone. The passkeys sync through the phone's cloud account. Four roads, one device, one PIN.

And the PIN is your birthday. Don't lie to me.

The standards people have known this for years. NIST's digital identity guideline flagged codes sent by text or phone call as a restricted authenticator back in 2017, because a phone number isn't something you have. It's something your carrier lets you borrow. Criminals proved the point: the FBI logged 320 SIM-swap complaints from 2018 through 2020, then 1,611 in 2021 alone, with more than $68 million lost. The FCC didn't adopt rules making carriers verify you before moving your number to a new SIM until November 2023.

Exhibit B · the tattoo

Don't tattoo the password on me

The industry's answer is to prove it's you with your body. Face unlock, fingerprint, voice ID, a selfie video. It's low friction, which is the whole point.

Here's what every engineer knows and every growth team ignores: a credential has to be revocable. When a password leaks, you change it. When a key leaks, you rotate it. You can't rotate your face. You can't issue yourself new fingerprints after a breach. A biometric isn't a secret; it's an identifier you leave on every glass and in every tagged photo. Making it the master key is tattooing your password on your skin and calling it convenience.

Leaked password? Change it. Leaked face? Grow a new one, champ.

The law noticed once. Illinois passed its Biometric Information Privacy Act in 2008: consent before collecting, a deadline for deleting, and the right to sue. Texas and Washington have biometric laws too, but only the state can enforce them. Most of the country has nothing like it, and there is still no single federal privacy law covering everyone the way Europe's GDPR does. What exists is a state-by-state patchwork, and in most states the rules for your face are whatever the terms of service say.

Exhibit C · the incentive

Friction is a business decision

Every security step is a place a user can quit, and every quit is a lost sign-up, a lost session, lost ad inventory. So the defaults on almost every app are set by growth, not safety: stay signed in forever, sync everything, back it up to our cloud, tap to agree. Security that costs a conversion doesn't ship.

That isn't a conspiracy. It's an incentive. The money is in your data and your time, the fines land years after the breach, and the person who pays for a bad default is never the person who chose it. I wrote up how much one ordinary account export holds in The Ghost in the Export. Short version: more than you'd tell your lawyer.

Exhibit D · the clock

AI just shortened the fuse

Everything above was already true. What changed is the price.

In February 2023 a reporter got into his own bank account over the phone with a voice cloned from his own recordings. A year later, on 8 February 2024, the FCC ruled that AI-generated voices in robocalls count as "artificial" under the 1991 robocall law, because voice-clone scams were already hitting families. Voice was supposed to be proof. My bet: faces are next in line, and the selfie check is the only wall in front of them.

Now the assistants want the keys. The pitch for agentic AI is that it signs in, clicks and types for you, which hands something that folds when you push it (I counted: Gemini owes me 163 apologies) the same access you have. The attack used to need a person on the phone. Now it needs a prompt.

That's why I keep saying there isn't much time. Not because the world ends. Because the gap between "possible" and "cheap" is closing faster than any law gets written.

Exhibit E · the shrug

It already happened to you

You've never been hacked. You'd know. Nothing bad ever happened, except that breach e-mail you skimmed once and went back to scrolling. That's the shrug. I've done it too. Here's the part I can't shake: most of the worst things on this page aren't coming. They're done. They happened to most of you, by name, and nobody sent you the bill.

Tick what probably applies. Nobody's watching. On this page that's actually true.

Every company on that list that settled with the FTC settled without admitting a thing. That's not me being fair. That's the receipt.

What you got for the first one: Equifax put up to $425 million in a fund for the 147 million. Only $31 million of it was set aside for the cash option. The FTC said you could skip the credit monitoring and take cash, up to $125, depending on how many people filed. In December 2022 the money landed and some people got $5.21. Frame it. They did pay twice, a second round on prepaid cards in November 2024. Check your junk drawer.

So when somebody asks why I'd rather hold my own copy than trust the cloud, that's the answer. Not because something might happen. Because it already did, and you got five bucks and a shrug. Hell of a deal.

$5.21. Don't spend it all in one breach.

Exhibit F · the referees

Nobody is coming to fix it

People tell me to relax. There are laws now.

I read the receipts. The biggest privacy penalty the FTC has ever levied: $5 billion, Facebook, 2019. A settlement, no admission of wrongdoing. They booked $2 billion of it in one quarter and still cleared $2.6 billion in profit. The fine was a line item.

A fine you can pay out of one quarter isn't a punishment. It's a subscription.

Equifax lost 147 million people's data. The settlement offered "up to $125" cash from a $31 million pool; more than 4.5 million people filed, and the FTC warned you'd get "nowhere near" that. One Krebs on Security reader's first check was $6.97. Kids' data? Musical.ly, now TikTok, settled for $5.7 million. Google and YouTube, $170 million.

None of this is a scandal to them. It's the model: the ads are the revenue and the ads need the data. Meta spent $24.4 million on federal lobbying in 2024, more than four times what TikTok paid for the kids.

And "delete"? In 2014 the FTC studied nine data brokers. Seven traded data with each other; tracing where yours came from was "virtually impossible". California built a one-form delete this year. By late August: more than 500,000 sign-ups, 654 registered brokers, and about a quarter of them reporting any deletions 24 days after their start date. Early days. I'll check back.

So no, nobody is coming. The referee's fines are the home team's pocket change. That's arithmetic, and it's why I stopped waiting.

Will we notice?

We'll be used to it the day it arrives

Scientists have a name for this. In 1995 the fisheries scientist Daniel Pauly described the shifting baseline: each generation judges what's been lost against whatever was normal when they started, so the ocean empties and nobody alive remembers it full. Bruce Schneier and Barath Raghavan applied it to us in 2024: "Shifting baselines are at the heart of our collective loss of privacy."

You can watch it happen. In 2015, 58% of Americans said they were resigned to companies using their data. By 2023 it was 74%. Privacy scholars have pointed out that the law tends to draw the line wherever people stop complaining. Meanwhile Stanford's AI Index counted 362 documented AI incidents in 2025, up from 233.

So no, I don't think there's a day it becomes obvious. There's a day you realize your kid has never known it any other way.

What doing nothing costs

Nothing to hide. Plenty to lose.

Tuesday, 2028. Your mom's phone rings. It's your voice, crying: you hit someone, and a calm man who says he's your lawyer needs fifteen grand in cash by five. She goes to the bank. A retired Florida woman did, July 2025: savings in a box, handed to a driver. "There is nobody that could convince me that it wasn't her." Her family thinks the voice came from Facebook videos.

Your mom would wire it. She still forwards chain e-mails.

Wednesday, the ID photo you uploaded to prove you're over eighteen leaks through a help-desk contractor. Discord told about 70,000 people that may have happened, October 2025. Change a password, sure. Good luck changing that face.

Your assistant has your logins now. It reads a page with instructions hidden in a comment and quietly hands over your email and a login code. Brave's researchers did that to a rival AI browser in August 2025. A demo, so far.

Thursday, a clip of you saying something you never said hits the work chat. A principal lived that in 2024; police patrolled his house. The man police say made it took a plea: four months.

And your insurer? UnitedHealth's Change Healthcare hack touched 192.7 million people at last count, data believed to include diagnoses, Social Security numbers and billing codes. Somebody has it. They're patient.

1. Jan 2024 A fake recording of a Maryland high-school principal spreads on social media. Threats follow; police patrol his home. In April 2025 the man police say made it enters an Alford plea to one misdemeanor: four months in jail.
2. Feb 2024 Ransomware hits UnitedHealth's Change Healthcare. Latest count on the federal breach list: 192.7 million people. Data believed to include diagnoses, Social Security numbers and billing codes.
3. Jul 2025 A retired Florida mother hears what she is sure is her daughter, withdraws $15,000 in cash and hands it to a driver. The callers then ask for $30,000 more. Her family believes the voice was cloned from social-media videos.
4. Aug 2025 Brave's security team shows an AI browser reading hidden text in a Reddit comment and leaking the user's email and a one-time login code back to the attacker. Brave later says the hole still isn't fully closed.
5. Oct 2025 Discord says about 70,000 people may have had government-ID photos exposed through a customer-support vendor.
6. 2028 Gartner predicts one in four job-candidate profiles worldwide will be fake. In its survey of 3,000 candidates, 6% already admitted to interview fraud.
7. 2028 You, if nothing changes.

And you'll say you had nothing to hide.

The builders

The people who built it, in their own words

If I sound alarmed, I'm in good company. Some of the people who built this quit their jobs so they could say so. Including people from the company that makes the AI I use most.

• May 2023Geoffrey Hinton leaves Google.One of the fathers of deep learning (and a 2024 Nobel winner) left so he could talk about the risks freely: "As long as I'm paid by Google, I can't do that."Built it, warned you, got a Nobel. You got a chatbot that writes limericks.
• Apr 2024Daniel Kokotajlo quits OpenAI.He refused to sign a non-disparagement agreement that put about $1.7 million of his equity at risk, then went on to co-write the AI 2027 forecast.Put $1.7 million on the line to keep talking. You won't even decline cookies.
• May 2024Jan Leike resigns from OpenAI.He co-led the team meant to keep smarter-than-human AI under control, and said safety had "taken a backseat to shiny products.""Shiny products." That's you. You're the one buying them.
• Jun 2024"Right to Warn."Thirteen current and former OpenAI and Google DeepMind staff asked for protection to speak up. Six signed anonymously because they feared retaliation.Six of them signed with no name. Sleep tight.
• Oct 2024Miles Brundage leaves OpenAI.Its adviser on readiness for human-level AI, on the way out: "Neither OpenAI nor any other frontier lab is ready."The readiness guy says nobody's ready. Cool. Cool cool cool.
• Jun 2025Yoshua Bengio starts LawZero.The Turing Award winner launched a nonprofit for safe-by-design AI, warning that today's top systems already show signs of self-preservation and deception.
• Feb 2026Two more walk.Zoë Hitzig quit OpenAI over ads coming to ChatGPT, calling people's chat history an "archive of human candor." Mrinank Sharma left Anthropic's safeguards team, citing pressure to set aside what matters most."Archive of human candor" is a fancy way to say your 2 AM questions.
• Sep 2026Jacob Coxon quits.A researcher who had worked at both Anthropic and OpenAI said many of the people building it believe it could be catastrophic within the decade.

That's about twenty people out of more than fifteen thousand at those labs. Most stayed. These are the ones who gave something up to say it.

Twenty walked. Fifteen thousand have a mortgage.

What decides it

Two things decide where this goes

Is it too late? Not while the fix is still a choice. The 2026 International AI Safety Report names the trap: act too early and you might write the wrong rules, wait too long and you're exposed. My guess: in five years the defaults will be set and the baseline will have moved. That's the window. That's why I'm in a hurry.

What I did about it

So I built my own

Eight months, 17 projects and over 2,000 hours in. I'm not publishing the map, because a map is the first thing a threat model tells you not to publish. These are the rules everything I build follows.

And the honest part: owning your stuff means owning the failures. I lost two drives this year, and one took months of code with it. I rebuilt. I'd still rather lose something to my own hardware than have it held hostage by someone else's terms of service.

And I still rent. My business mail and this site's hosting are other people's computers, and the AI I build with runs in someone else's data center and reads whatever I show it. I'm replacing them one at a time.

Two dead drives and she still trusts hardware over a login page. Honestly? Same.

The tail of the tail

"Anybody could do that"

The other look I get: "anybody could do that, it's just AI." So let's measure it.

I know what that sentence pictures. You type a wish, the machine hands you a finished thing, you take the credit. If that worked, everyone with a subscription would have a company by now. Most of them have a chat history.

"It's just AI," says the guy whose AI wrote his out-of-office.

Start with the ocean. In February 2026 Pew found that 49% of American adults use AI chatbots; about a quarter use one daily, and 4% "almost constantly." Among developers, 84% use or plan to use AI tools, and more of them actively distrust the output (46%) than trust it (33%). Only 3% trust it highly. A careful experiment in 2025 found experienced developers took 19% longer with AI on their own code, while believing it had sped them up by 20%.

Then shrink it. The people who don't just use the tools but build tools for the tools, with their own servers, their own rules and their own memory across sessions, are a small crowd. Anthropic counted a little over 10,000 active public MCP servers in December 2025, against hundreds of millions of chatbot users, and by every estimate I could get, most of the people running them are professional engineers. In September 2026 a count of the official public registry found about 18,200 publishers worldwide, companies included. The registry has grown by about three quarters since, and private builders like me aren't in it at all.

So where does that put me? I had the machine run the numbers three separate ways, each one blind to the others, and told one of them to argue I'm nothing special. Here's the ladder, pieced together from them.

Now add the rest: most of a year of it near full time, across a whole life instead of one project, with verification rules that person wrote herself. No degree doesn't even count: about a fifth of people who code don't have one. Nobody surveys the rest. From here down it's arithmetic on guesses, and the three answers don't agree.

• The sceptic: one in 17,000.About 8,000 people in the country, or 0.006% of chatbot users, engineers included. Limit it to outsiders working alone and it says one in 170,000. This is the one whose whole job was to say I'm not special.
• Counting up from the builders: one in 2.5 million.About fifty people. Could be ten, could be 300.
• Counting down from everybody: one in 7 million.About twenty people. Could be five, could be 330.

Take the unflattering one. I do. Its harshest version is one in 3,400, and even that says 99.97% of the people using these tools don't work like this. All three flagged the same weak spot: stack enough traits on anybody and they come out rare. Fair. So mark the number the way I mark everything: estimate. One rung is a survey. The rest is guesses, with the inputs listed at the bottom. That's the tail of the tail: somewhere between rare and very rare, and nobody's counting.

SNAPSHOT, 26 Oct 2026. My logs, my count.

That's more than 2,000 hours in the lab since February. Up to 29 October that's an estimate a script rebuilt from my logs, not my memory. Since then it's counted live, and the running total sits at the bottom of this site.

Go back to that experiment for a second: 19% slower, feeling 20% faster. That's the whole trap in one line. The tool feels like speed, and a feeling isn't a measurement. Most people stop at the feeling. I stopped trusting mine around the first lost drive.

The difference isn't the chatbot. It's the procedure. Everything I build carries one of three labels: VERIFIED means a check was re-run and passed. SNAPSHOT means true as of a stated time. UNVERIFIED means built but never exercised, and treated as broken until proven otherwise. Unknown beats a guess. Cite it or don't claim it.

And the rules catch me too. In August a progress report left my machine marked VERIFIED on six claims. Three days later a check against the disk couldn't find the evidence: the code had come down from a temporary cloud container, and the proof hadn't. By my own rule the report got downgraded. Two hours later a local run showed the claims had been true all along. They just hadn't been provable where I lived. That became a new rule: anything generated from anything carries what it came from, with a hash.

So here's the "that" in "anybody could do that." All of it is free. None of it is fun.

• Write the rules before the first prompt.Every line in my rulebook cost a real debugging round. It's long.
• Never take "done" for an answer.The machine says done the way a teenager says the room is clean. Go look.
• Hash it before you move it, copy it or delete it.A filename is a sticker. Stickers lie.
• Show before move.Nothing gets touched until I've seen the list of what's about to be touched.
• Log every change the day it happens.One place, one line each. Three months later it's the only witness you have.
• When it's wrong, don't argue. Write the rule.Arguing fixes today. The rule fixes every day after.
• Lose something that mattered.Not recommended. It's where the first six came from.

None of that takes a degree. I don't have one. It takes doing the boring step every single time, including the times the machine swears it already did.

That's the tail of the tail. It isn't the place where nobody makes mistakes. It's the place where every mistake becomes a rule. So no, not anybody could do it. Anybody can open the chat window.

Why listen to me

Why listen to me

Fair question. No degree, no staff, no office, no sponsor. One person behind an LLC who reads the terms and builds her own stuff with AI tools. Exactly the profile you'd scroll past.

So don't take my word. Take the procedure. Every post here is dated. Numbers carry a source or the word estimate. When I'm guessing about the future, I say it's a guess. When I'm wrong, it goes on the record. In October I re-checked 51 claims from my own hardware piece. Eight held as written. Ten held in part. Thirty-three were outdated, wrong or impossible to verify, and seven of those were wrong from the start. I filed it. Nobody made me.

Thirty-three of 51 wrong and she published the score. I'd have deleted the folder.

I lost a drive in July and wrote the post-mortem with the cause marked "probable". The August downgrade above was the same rule biting me. The footer counts my hours, refreshed on a schedule. If it stops climbing, I've stopped.

Here's the part that should bother you. Nine percent of US adults say they always read a privacy policy before agreeing. That's Pew, 2019. I'm in the 9%, and the look you'd give me is the look I get. Hell of a club. No jackets.

I'm not selling fear. Fear is free and you've got plenty. I'm selling a procedure, and it catches me too.

Not a diet

This isn't a diet

Every time I say any of this, somebody hears "quit your phone." No. Keep the apps you love. Change what they're allowed to hold.

A diet is abstinence, and abstinence fails by Thursday. This is subtraction. One swap a week, and the swap is never "stop using it." It's "this app doesn't get my face anymore." It's "this login doesn't open everything else." Nobody notices on Monday. You will in a year.

The old habits are already billing you. Cloudflare watched three months of logins to the sites on its free plan in late 2024: 41% of the successful human ones used a password that had already leaked. Not attempts. Successful. Have I Been Pwned lists over 17.8 billion breached addresses. Go type yours in.

Your password is your dog's name and a 1. I can smell it.

And "delete" is a word on a button, not a promise. In 2014 the FTC charged Snapchat over its promise that messages "disappear forever." Snapchat settled. In 2021 it charged Everalbum with keeping photos it had promised to delete and running face recognition on users by default. Everalbum settled, and the order makes it delete the face models too. That's what happens when somebody checks. Mostly nobody checks.

So here's the stop list. Tick what's true. It isn't a grade. It's a map of where the keys to your life are sitting right now.

The way out

Wait for mine, or build your own

Here's what you're doing: renting yourself. Mail from one company, photos from another, login from a third, files from a fourth. Google charges a business from $7 a head a month for the mail-and-files half of that. A person pays in data. In 2023 Pew found 73% of Americans felt little or no control over what companies do with their data; 56% frequently click "agree" without reading. I read it. Not all of it. Enough to stop clicking.

Here's what I'm building toward. The setup I run my own life on, packaged so a shop, a studio or one stubborn person can run it without me. The bet: people reported $20.9 billion in online-crime losses to the FBI in 2025, and IBM puts the average breach it studied at $4.99 million. Not all of that is a stolen login or a leaked file. Enough of it is. Renting isn't the safe option. It just feels like one, and the landlord holds the keys to your mail.

Or build your own. No parts list. Just the test, for anyone selling you this, me included. The shape is called local-first; it was written up in 2019.

Honest status: it's in the lab. Nothing to buy, no date. A promise without a receipt is what I'm against. Join the release updates and you'll hear when it's real. The list is encrypted. Of course it is.

Exhibit G · the levers

What else can be done now

Here's the part the "nothing you can do" crowd skips. The laws already on the books work. Somebody has to pull the handle.

One state did. The Illinois biometric law I mentioned got Facebook to settle for $650 million in 2021. The checks were $397 each. Google settled for $100 million over Google Photos in 2022. Clearview AI, which scraped your face off the internet, agreed to give the people it scanned 23% of the company. An appeals court tossed the deal in July 2026. Nobody's been paid. Then in 2024 Illinois rewrote the law so a violation counts once per person, not once per scan. The lever worked so well they shortened it.

Two dozen states have passed a privacy law. California built a one-form delete button for data brokers this January: more than half a million people had signed up by late August, and 654 brokers have to answer. Europe gives you a month and charges nothing.

And almost nobody files. In all of 2023, 1,193 Californians sent Meta a formal delete request through its privacy channel. Hitting delete in the app isn't in that count, and Meta doesn't publish that one. Still: thirty-nine million people, twelve hundred forms. The right sits there like a gym membership.

A form. That's the whole boss fight. A form.

One more number, Meta's own: worldwide, the average person is worth about $57 a year to them. Americans are worth several times that, and Meta stopped publishing the split after 2023. A paid mailbox runs a few dollars a month. Paying doesn't make you safe. It makes you a customer, and customers get to leave. Then do one of these.

• File one request.Pick the app you trust least and ask for everything it holds on you. Europe: one month, no fee, unless they argue it's complicated. Here: the deadline is in your state's law, if your state has one. Read it.
• In California, use DROP.One profile, every registered data broker, free. Anywhere else, ask your state rep why you can't.
• Ask your doctor for the whole file.Federal rule: 30 days, one extension allowed, and they can only bill you for the copies.
• Ask the school.Student records must be opened to you (or your parents, until you're 18) within 45 days. Ask which software vendors see them too.
• Ask your employer.In California, if the company is big enough to be covered, you've had that right since 2023 and they can't retaliate. Elsewhere, ask anyway. The silence is the answer.
• Pay for one thing.Mail, calendar or storage. If the bill is zero, you're the inventory.
• Answer the settlement notice.It isn't spam. Illinois Facebook users who filed got $397. The ones who didn't got nothing.

I'm not overreacting. I'm reading the terms. Most people run their life on one phone, one face and one password they reused, and the tools to abuse all three just got cheap.

Shrug again if you want. It's free. So was the credit monitoring. Or pick one thing off that list tonight. My bet: in five years you'll call it early.

Receipts

Sources

1. Pew Research Center, "Americans and AI 2026", 17 Jun 2026 (survey of 17-23 Feb 2026): pewresearch.org
2. Stack Overflow 2025 Developer Survey, AI: survey.stackoverflow.co
3. METR, early-2025 AI and experienced open-source developers, 10 Jul 2025: metr.org
4. NIST SP 800-63B, Digital Identity Guidelines (2017), restricted authenticators: pages.nist.gov
5. FBI IC3, "Criminals Increasing SIM Swap Schemes to Steal Millions of Dollars", 8 Feb 2022: ic3.gov
6. FCC 23-95, Protecting Consumers from SIM Swap and Port-Out Fraud, adopted 15 Nov 2023: docs.fcc.gov
7. Illinois Biometric Information Privacy Act, 740 ILCS 14, effective 3 Oct 2008: ilga.gov
8. IAPP, US State Privacy Legislation Tracker: iapp.org
9. Vice, "How I Broke Into a Bank Account With an AI-Generated Voice", 23 Feb 2023: vice.com
10. FCC, "FCC Makes AI-Generated Voices in Robocalls Illegal", 8 Feb 2024: docs.fcc.gov
11. MIT Technology Review on Hinton leaving Google, 2 May 2023: technologyreview.com
12. Kokotajlo and OpenAI insiders (NYT, 4 Jun 2024, via NZ Herald): nzherald.co.nz
13. Fortune on Jan Leike's resignation, 17 May 2024: fortune.com · "A Right to Warn", 4 Jun 2024: righttowarn.ai
14. CNBC on Miles Brundage, 24 Oct 2024: cnbc.com · LawZero launch, 3 Jun 2025: lawzero.org
15. Tech Brew on Hitzig and Sharma, 12 Feb 2026: techbrew.com · CNBC on Jacob Coxon, 9 Sep 2026: cnbc.com
16. Epoch AI, compute capacity, 29 Oct 2026: epoch.ai · hyperscaler share, 14 Apr 2026: epoch.ai
17. AI 2027: ai-2027.com · AI Futures Project, Q1 2026 timelines update: blog.aifutures.org
18. International AI Safety Report 2026, 3 Feb 2026: internationalaisafetyreport.org · Stanford AI Index 2026: hai.stanford.edu
19. FBI IC3 2025 Annual Report: ic3.gov
20. Pauly, shifting baselines (1995): worldfishcenter.org · Raghavan & Schneier, 4 Jun 2024: schneier.com · Hartzog, Selinger & Gunawan, "Privacy Nicks" (2024): par.nsf.gov · Penn Annenberg, 7 Feb 2023: asc.upenn.edu
21. 2026 capital spending: Amazon cnbc.com · Alphabet cnbc.com · Microsoft microsoft.com · Meta investor.atmeta.com
22. Anthropic, MCP and the Agentic AI Foundation, 9 Dec 2025: anthropic.com · Ollama on Docker Hub: hub.docker.com
23. Main inputs to the "one in N" estimates. US Census, Vintage 2025 population by age: census.gov · MCP Registry publishers, counted 10 Sep 2026: dev.to · Stack Overflow Developer Survey 2026, AI: survey.stackoverflow.co · JetBrains survey 2026, as reported 2 Sep 2026: i-programmer.info · BLS, software developers: bls.gov · Zapier, who builds with AI coding tools: zapier.com · Stack Overflow Developer Survey 2025, who codes and how: survey.stackoverflow.co · GitHub Octoverse 2026, US share of developers: github.blog. Every "one in" figure past the first is my estimate, not a survey.
24. EU AI Act timeline and Digital Omnibus: digital-strategy.ec.europa.eu · europarl.europa.eu · US executive order, 11 Dec 2025: whitehouse.gov · IAPP state privacy laws: iapp.org
25. FTC: ftc.gov
26. FTC consumer alert, 22 Jul 2019: consumer.ftc.gov
27. PiunikaWeb, 21 Dec 2022: piunikaweb.com
28. Troy Hunt, 13 Aug 2024: troyhunt.com
29. The Record, 16 Aug 2024: therecord.media
30. Engadget, 28 Mar 2023: engadget.com
31. The Record, 21 Mar 2025: therecord.media
32. Duane Morris Class Action Defense Blog, 14 Jul 2026: blogs.duanemorris.com
33. FTC, 3 Dec 2024: ftc.gov
34. FTC, 9 Jan 2024: ftc.gov
35. FTC case page, FTC v. Kochava: ftc.gov
36. FTC, 16 Jan 2025: ftc.gov
37. TechCrunch, 4 Dec 2023: techcrunch.com
38. Insurance Journal, 9 Jul 2025: insurancejournal.com
39. FTC, 1 Feb 2023: ftc.gov
40. FTC, 2 Mar 2023: ftc.gov
41. Meta Newsroom, 27 Sep 2023: about.fb.com
42. Google blog, 22 Feb 2024: blog.google
43. FTC press release, 24 Jul 2019: ftc.gov
44. Meta investor relations, Q2 2019 results: investor.atmeta.com
45. FTC press release, 22 Jul 2019: ftc.gov
46. FTC consumer alert, 31 Jul 2019 (page since re-dated to Jul 2022): consumer.ftc.gov
47. Fox Business, 9 Dec 2019, citing court filings: foxbusiness.com
48. Krebs on Security, 20 Dec 2022: krebsonsecurity.com
49. FTC press release, 27 Feb 2019: ftc.gov
50. FTC press release, 4 Sep 2019: ftc.gov
51. Statista, calendar year 2024 (updated 10 Feb 2025): statista.com
52. FTC press release, 27 May 2014: ftc.gov
53. FTC, Data Brokers: A Call for Transparency and Accountability, May 2014 (PDF): ftc.gov
54. CalPrivacy (California Privacy Protection Agency), DROP page: privacy.ca.gov
55. CalPrivacy news release, 25 Aug 2026: privacy.ca.gov
56. Malwarebytes Labs, 22 Jul 2025 (reporting WFLA): malwarebytes.com
57. WFLA via Yahoo News, 16 Jul 2025: yahoo.com
58. PEOPLE via Yahoo News, 20 Jul 2025: yahoo.com
59. Discord press release, Oct 2025: discord.com
60. Brave blog, 20 Aug 2025: brave.com
61. Associated Press via Yahoo News, 29 Apr 2025: yahoo.com
62. Reuters via KSL, 14 Aug 2025: ksl.com
63. HR Dive, 8 Aug 2025 (reporting Gartner, 31 Jul 2025): hrdive.com
64. Cloudflare blog, "Password reuse is rampant: nearly half of observed user logins are compromised", 17 Mar 2025: blog.cloudflare.com
65. Have I Been Pwned homepage, opened 3 Nov 2026: haveibeenpwned.com
66. FTC press release, 8 May 2014: ftc.gov
67. FTC press release, 11 Jan 2021: ftc.gov
68. Children's Commissioner for England, "Who knows what about me?", November 2018 (PDF): assets.childrenscommissioner.gov.uk
69. noize-labs.com, The AI Hardware Crisis, six months on (Case file 01-B): noize-labs.com
70. noize-labs.com, The night the dev drive died (27 Oct 2026): noize-labs.com
71. noize-labs.com home page footer: noize-labs.com
72. noize-labs.com Updates page: noize-labs.com
73. noize-labs.com Lab Notes index: noize-labs.com
74. Pew Research Center, Americans and Privacy, 15 Nov 2019: pewresearch.org
75. Google Workspace pricing page: workspace.google.com
76. Pew Research Center, How Americans View Data Privacy, 18 Oct 2023: pewresearch.org
77. IBM newsroom, Cost of a Data Breach Report 2026, 29 Jul 2026: newsroom.ibm.com
78. Ink & Switch, Local-first software, April 2019: inkandswitch.com
79. Robbins Geller Rudman & Dowd (class counsel), 2021: rgrdlaw.com
80. Engadget, 18 May 2022: engadget.com
81. Bursor & Fisher (class counsel): bursor.com
82. Lawyer Monthly, July 2026: lawyer-monthly.com
83. Duane Morris Class Action Defense Blog, 5 Aug 2024: blogs.duanemorris.com
84. Byte Back (Heidi Salow), 29 Jun 2026: bytebacklaw.com
85. California Privacy Protection Agency newsroom, 2 Jun 2026: privacy.ca.gov
86. GDPR text, Article 12: gdpr-info.eu
87. Meta California Privacy Transparency Report (hosted on whatsapp.com): whatsapp.com
88. CapRadio / AP, 30 Apr 2024: capradio.org
89. Meta Platforms Form 10-K for year ended 31 Dec 2025 (SEC EDGAR): sec.gov
90. Cornell LII, 45 CFR 164.524: law.cornell.edu
91. Cornell LII, 34 CFR 99.10: law.cornell.edu
92. UC Berkeley Labor Center: laborcenter.berkeley.edu

Build numbers come from my own repos, worklog and file index, 18 Feb to 26 Oct 2026. Lab hours are live in the footer; the hours before 29 October are an estimate from the same records.