The European Court of Justice has decided that Facebook owner Meta must minimize the amount of personal data it uses for personalized ads, the BBC reports . The decision from the EU’s top court means that only a small part of Meta’s data collection can be used for advertisements.

The ruling stems from a complaint by privacy activist Max Schrems, who said Facebook used data about his sexual orientation for targeted ads — even though Schrems himself had not shared information about his sexual orientation on the platform.

Meta said it does not use so-called specially categorized data linked to sexual orientation, race, ethnicity, state of healt,h or religion for personalized ads. Such data is classified as sensitive and EU data protection legislation has strict requirements for processing it. The company says it takes privacy very seriously and would have further comment after it reviews the ruling.

The concept of data leakage — and all of its privacy, legal, compliance and cybersecurity implications — today has to be fundamentally re-envisioned, thanks to the biggest IT disruptor in decades: generativeAI (genAI).

Data leakage used to be straight-forward. Either an employee/contractor was sloppy (leaving a laptop in an unlocked car, forgetting highly-sensitive printouts on an airplane seat, accidentally sending internal financial projections to the wrong email recipient) or because an attacker stole data either while it was at rest or in transit. 

Those worries now seem delightfully quaint. Enterprise environments are entirely amorphous, with data leakage just as easily coming from a corporate cloud site, a SaaS partner, or from everyone’s new-favorite bugaboo: a partner’s large language model (LLM) environment. 

Your enterprise is responsible for every bit of data your team collects from customers and prospects. What happens when new applications use your old data in new ways? And what then happens when that customer objects? What about when a regulator or a lawyer in a deposition objects?

When the walls are this amorphous, how precisely is IT supposed to be in control? 

Consider this scary tidbit. A group of Harvard University students started playing with digital glasses to leverage real-time data access. The most obvious takeaway from their experiment is it that it can be a highly effective tool for thieves (conmen, really). It allows someone to walk up to a stranger and instantly know quite a bit about them. What a perfect way to kidnap someone or steal their money. 

Imagine a thief using this tool to talk his/her way into a highly-sensitive part of your office? Think about how persuasive it could make a phishing attack.

As bad as that all is, it’s not the worst IT nightmare — that nightmare is when the victim later figures out the misused data came from your enterprise database, courtesy of a detour through a partner’s LLM. 

Let’s step away from the glasses nightmare. What happens when an insurance company uses your data to deny a loan or your HR department uses the data to deny someone a job? Let’s further assume that it was the AI partner’s software that made a mistake. Hallucinations anyone? And that mistake led to a destructive decision. What happens then?

The underlying data came from your confidential database. Your team shared it with genAI partner 1234. Your team hired 1234 and willingly gave them the data. Their software screwed it up. How much of this is your IT department’s fault?

There is a terrible tendency of litigation to split fault into percentages and to give a healthier percentage to the entity with the deepest pocket. (Hello, enterprise IT — your company quite likely has the deepest pocket.) 

There are several ways to deal with these scenarios, but not all of them will be particularly popular.

1. Contractual — put it in writing. Have strict legal terms that put your AI partner on the hook for anything it does with your data or any fallout. This won’t prevent people from seeing the inside of a courtroom, but at least they’ll have company.

2. Don’t share data. This is probably the least popular option. Set strict limits on which business units can play with your LLM partners, and review and approve the level of data they are permitted to share.

When the line-of-business chief complains — virtually guaranteed to happen — tell that boss that this all about protecting that groups’ intellectual property and, in turn, that LOB chief’s bonus. Mention that this preserves their bonus and watch the objections melt away.

3. Impose stiff punishments for Shadow AI violations. In theory, you can control contacts and data access with your key genAI partners. But if your people start feeding data into ChatGPT, Perplexity or their own account on CoPilot, they need to know that they will be discovered and that two violations mean termination.

First, you need to take this request up as high as you can to get in writing that it will happen. Because, trust me, if you say that a second violation will result in termination, and then some top-tier salesperson violates and does not get fired, wave bye-bye to your credibility. And with that, any chance people will take your rules seriously. Don’t threaten to fire someone until you are certain you can.

Maybe something equally effective would be canceling their next two bonus/commission payments. Either way, find something that will get the attention of the workforce.

4. The anti-contract. Lawyers love to generate 200-page terms of service that no one reads. I just need to remind you that such terms will be ignored by courtroom juries. Don’t think you can really right-click your legal exposure away.

This is triply the case when your customers are outside the United States. Canada, Europe, Australia and Japan, among others, focus on meaningful and knowing consent. Sometimes, you are banned from forcing acceptance of the terms if you choose to use the product/service.

5. Compliance. Do you even have legal permission to share all of that data with an LLM partner? Outside the US, most regulators are told that customers own their data, not the enterprise. Data being mis-used — as in the Harvard glasses example — is one thing. But if your genAI partner makes a mistake or hallucinates and sends flawed data out into the world, you can be exposed to pain well beyond simply sharing too much info. 

You can never have too many human-in-the-loop processes in place to watch for data glitches. Yes, it will absolutely dilute genAI efficiency gains. Trust me: for the next couple of years, it will deliver a better ROI than genAI will on its own. 

And now we wait. 

Last week, Google did its best to refute the US Department of Justice’s case that the company has built a series of monopolies in the markets for ad serving, ad exchanges, and ad networks, and the DOJ made its rebuttal. Closing arguments will be heard Nov. 25, after both parties have presented their amended findings of fact.

Judge Leonie Brinkema moved the hearing along briskly: The first phase, which had been expected to take up to two months, wrapped in just three weeks. The first two weeks were mostly devoted to the DOJ’s presentation of its case that Google engaged in a “systematic campaign to seize control” of the “tools used by publishers, advertisers, and brokers to facilitate digital advertising.”

As the trial headed towards its third week, Google called its first witness, Scott Sheffer, the company’s vice president of publisher partnerships,.

As Google Vice President of Regulatory Affairs Lee-Anne Mulholland recounted in a blog post, Sheffer explained that Google offers publishers tools that the DOJ completely ignored in making its case — such as AdSense, used by more publishers than the Ad Manager product at issue in the trial.

But a reporter for the CheckMyAds campaign group attending the trial described how, on cross-examination, DOJ lawyers stripped back the tangled web of advertising products Google presented, removing those that do not allow publishers to monetize display ad inventory on their websites, leaving only “the products that form the basis of the markets in the DOJ’s complaint.”

Last look

Later in the week, Google called economist Paul Milgrom, winner of the 2020 Nobel Prize in Economics for his work on auction theory. According to Mulholland, he testified “every one of the conducts we’ve described — Google’s programs — benefited its own customers, either advertisers or publishers or both,” and said that “Google’s changes to its own auction were improvements at the time in which they occurred relative to what had come before.”

Under the DOJ’s cross-examination, according to the CheckMyAds’ reporter, Milgrom conceded that Google does have an advantage over competitors because of practices such as “Last Look” (in which Google gets a chance to outbid the highest bidder in an ad auction) and Sell-Side Dynamic Revenue Share (in which Google sits on the buy and sell sides of transactions, potentially allowing it to manipulate its margin to win auctions). Milgrom acknowledged he had not analyzed the impact of Last Look on other exchanges or on competition in his research. 

Per Bjorke, product management director of Google’s Ad Traffic Quality team, was called to testify about how Google keeps bad actors out of its ad exchanges (so publishers don’t end up paying them for fake traffic, for example). 

Judith Chevalier, a professor of finance and economics at Yale University, told the court that using Google tools takes a lower share of publishers’ revenue, and that on average it is “less expensive to use Google-to-Google than using third-party-to-third-party” tools for connecting publishers and advertisers, Mulholland wrote.

Only connect

CheckMyAds noted that a chart presented by Chevalier showed that Google Ads was the only buying tool that connected with Google Ad Exchange, a fact DOJ noted in its cross-examination. The integration of Google’s different ad technologies and the lack of openness to competitors is one elements of the DOJ’s case.

Mulholland didn’t namecheck any of the witnesses Google called in its last two days of evidence, but CheckMyAds had plenty to say about Mark Israel, an economics expert who, it came out in questioning, has done paid work for Google in the past. He sought to show that the market for online advertising is a single two-sided market and not the three separate markets (ad servers, ad networks, and ad exchanges) the DOJ says it is.

After Google wrapped up its case, this phase of the hearing concluded with the DOJ calling one last witness in a bid to rebut some of Google’s claims. It asked Matthew Wheatland, chief digital officer of British newspaper The Daily Mail, about some of the alternatives to Google that Israel had suggested publishers might use; according to CheckMyAds’ account of the session, Israel’s and Wheatland’s views did not align.

Brinkema sent Google and the DOJ away with about a month to present their amended findings of fact. After closing arguments, she may issue her opinion before the end of the year. 

That’s not going to be the end of it, though. If things go the DOJ’s way, a separate hearing will be held to determine appropriate remedies. And with its business model at stake, Google will almost certainly appeal any ruling, or part of the ruling, that goes against it.

Via the Digital Services Regulation (DSA), the European Commission has requested information from Youtube, Snapchat and Tiktok about which parameters their algorithms use to recommend social media content to users.

The Commission then wants to evaluate the extent to which these algorithms can amplify risks linked to, for example, democratic elections, mental health and children’s well-being. The authority also wants to look at how the platforms work to reduce the potential impact their recommendation systems have on the spread of illegal content, such as the promotion of drugs and incitement against ethnic groups.

The social media companies have until Nov. 15 to provide the requested information.

Most Apple watchers may have noticed that the company’s iPhone 16 marketing really does put Apple Intelligence front and center, even though its home-baked breed of AaI (Artificial [Apple] Intelligence) isn’t available quite yet. 

All the same, the system, which we explain in great depth here, is on the way. And in the run up to its arrival, we’re learning more about it, and when and how it will be introduced. As we wait on data about the extent to which Apple Intelligence boosts future iPhone sales, read on to learn when Apple Intelligence will come to your nation, what schedule the various tools are shipping on, and other recently revealed details concerning Apple’s hugely hyped service.

When is Apple Intelligence coming?

Apple will introduce the first of its Apple Intelligence services with the release of iOS 18.1. More tools and services will be made available later this year and across 2025, when the company will likely introduce brand new and unannounced features. You will require an iPhone 16 series device, an iPhone 15 Pro series device, or an iPad or Mac running an M1 chip or later to run the system.

What schedule are service releases on?

A Bloomberg report tells us when to expect Apple Intelligence features to appear:

iOS 18.1: 

Due in mid-October, this first set of features will include various Writing tools, phone call recording and transcription, a smart focus mode and Memories movies. Apple tells us the feature list includes:

• Writing Tools.
• Clean Up in Photos.
• Create a Memory movie in Photos.
• Natural language search in Photos.
• Notification summaries.
• Reduce Interruptions Focus.
• Intelligent Breakthrough and Silencing in Focus.
• Priority messages in Mail.
• Smart Reply in Mail and Messages.
• Summaries in Mail and Messages.
• And Siri enhancements, including product knowledge, more resilient request handling, a new look and feel, a more natural voice, the ability to type to Siri, and more.

iOS 18.2: 

In December, we should see Apple make Genmoji and Image Playground services available.

iOS 18.4: 

This is when Siri will be overhauled to become more contextually aware and capable of providing more personally relevant responses. This release is thought to be coming in March and will be preceded by a more minor update (iOS 18.3).

Where will Apple Intelligence be available?

Bad news, good news. The good news is that US iPhone owners will get to use Apple Intelligence as soon as iOS 18.1 ships. The other good news is that any user anywhere willing to set their device language to US English should also be able to run the services; if you want to keep your iPhone running your language, you’ll have to wait a little while.

Apple has promised to introduce localized language support for the following English nationalities in December: Australia, Canada, New Zealand, South Africa, and the United Kingdom.

Throughout 2025, the company has promised to introduce Apple Intelligence support for English (India), English (Singapore), French, German, Italian, Japanese, Korean, Portuguese, Spanish, and Vietnamese. The company also promised support for “other” languages, but hasn’t announced which ones. For the moment, at least, Apple Intelligence will not be available in the EU.

How much storage does the system need?

An Apple document confirms that Apple Intelligence requires 4GB of available iPhone storage to download, install, and use. The company hasn’t disclosed how much space is required on iPads or Macs, but it seems reasonable to expect it’s close to the same. Apple also warns that the amount of required storage could increase as new features are introduced. 

What else to know

Apple now sees AI as a hugely important component to its business moving forward. That means the service will work on all future iPads, Macs, and iPhones (including iPhone SE). It also means the company is plotting a path to support the service on visionOS devices and Homepod and deploy it in future products, including an intelligent home automation and management system it apparently plans, along with the introduction (at last) of a “HomeOS.” There’s more information here.

Please follow me on Mastodon, or join me in the AppleHolic’s bar & grill and Apple Discussions groups on MeWe.