Welcome to the latest edition of Privacy Matters, your trusted source for updates on KYC, AML, fraud prevention, and privacy-enhancing technologies. Here’s what’s been happening recently:
Sedicii Insights: Identity Without Friction – Verified Credentials Are the Future of Digital Identity
In our latest article, we explore the rise of verified credentials, cryptographically provable digital statements issued by trusted entities, that deliver frictionless user experiences, privacy by design, and scalable, secure trust across services. We spotlight mobile driver’s licenses (mDLs), tackle the classic adoption dilemma, and demonstrate how Sedicii’s zero-knowledge proofs enable verification without revealing raw data, ushering in a seamless, secure identity ecosystem.
4chan & Porn Site Face Ofcom Investigation
Ofcom is probing 4chan for failing to submit a risk assessment under the Online Safety Act after complaints of illegal content, and is also investigating First Time Videos for inadequate age-verification checks, along with seven file-sharing services over potential child sexual abuse material. Non-compliance could incur fines up to 10% of global revenue (or £18 million).The Illusion of Thinking: Reasoning Models Reach Their Limits
Recent research examines frontier Large Reasoning Models (LRMs) using controlled puzzle environments to probe their internal “thinking” processes. Despite impressive benchmark performance, LRMs suffer a complete accuracy collapse beyond moderate problem complexity and exhibit a counter-intuitive scaling limit their reasoning effort peaks then declines even with sufficient token budgets. They also fail to apply explicit algorithms and reason inconsistently across tasks, raising critical questions about their true reasoning capabilities compared to standard LLMs.
ChatGPT Logs Are No Longer Private
A federal judge has ordered OpenAI to preserve all ChatGPT user logs indefinitely, including deleted chats, affecting Free, Plus, Pro, Team and standard API users, while Enterprise and Zero Data Retention agreements remain exempt. OpenAI will keep preserved logs separately under legal hold, accessible only to a small audited legal team and not used for model training. The order has sparked widespread privacy panic, prompting OpenAI and CEO Sam Altman to decry it as a “sweeping overreach” and call for “AI privilege” akin to doctor–patient confidentiality.
PSC Biometric Database Declared Unlawful
The Data Protection Commission has ruled that collecting facial (biometric) data from 70% of Ireland’s population over 15 years for the Public Services Card was unlawful, citing failures to identify a valid lawful basis, to provide transparent information to individuals, and to conduct a proper Data Protection Impact Assessment. The Department of Employment and Social Protection was fined €550,000 and must cease processing this biometric data within nine months if no lawful basis is established. The ICCL insists on the immediate deletion of 3 million illegal facial records and decries the PSC project as a stealth national biometric ID system.
Infostealer Mega-Leak: 16 Billion Credentials Exposed
In our latest roundup, we examine the record-breaking leak of 16 billion login credentials, spread across 30 distinct datasets and harvested by infostealer malware that include fresh, uncycled data for platforms from social media and corporate tools to government portals. Exposed briefly via unsecured Elasticsearch and object storage instances, this cache provides cybercriminals with a blueprint for mass exploitation – enabling account takeovers, identity theft, and highly targeted phishing. The scale and recency of the leak underscore the urgent need for strong, unique passwords and multi-factor authentication.
Sedicii Insights: Google’s Age Verification Isn’t Private
Google’s ZKP-based age checks may hide birthdates from third parties, but Google controls issuance, storage, and verification, creating a closed-loop identity system where credential data, verification metadata, and behavioural telemetry all remain visible to one company. This demands full trust in a single private entity whose core business relies on data collection, profiling, and monetization. By contrast, Sedicii’s approach uses patented zero-knowledge proofs with no credential storage, no user tracking, and no data monetization, delivering true privacy by design.
Stay compliant, stay secure, and have a great week!