Lenovo was lambasted in the press after security researchers revealed that the PC-maker was selling computers secretly preinstalled with “nefarious” adware that not only collected information about users’ online activity but also made encrypted web sessions vulnerable to attacks. The adware, from a company called Superfish, posed a sufficiently serious threat that the Department of Homeland Security warned Lenovo customers to remove it immediately. Lenovo’s actions not only damaged its reputation, but also exposed it to a class action lawsuit for “compromising user security and privacy.”

The FTC sued Flo Health—a once-popular women’s health app used for tracking reproductive health information such as menstrual cycles and pregnancies—for lying to users about its privacy policies and claiming to keep health information private while actually selling the information to third parties. Flo Health misrepresented its compliance with international privacy laws that require notice, consent, and protection of personal information transferred to third parties and Flo agreed to settle these charges in 2021. Flo was required to obtain consent prior to sharing a consumer’s health information with a third party, undergo a compliance review conducted by a third party expert, notify users of the app that Flo shared information about their periods and pregnancies with third parties in violation of its privacy policies, and post a similar notice on its website.

Meta ended up in hot water with international regulators, faced big daily fines, and was forced to pause its release of Generative AI products in the EU and Brazil after data protection authorities raised serious privacy concerns with the company’s use of personal information for its AI service. The Irish Data Protection Commission requested the pause after “uncertainty over how Meta would train its new AI systems using Meta users’ personal data from photos, comments and other content on public posts.” The Brazilian National Data Protection Authority demanded Meta suspend its practice of using personal information published on its platform to train AI, calling the practice an imminent risk of serious harm, and threatened to fine the company almost $9,000 per day if it failed to comply.

LinkedIn became noisy with angry posts when the company was not fully transparent with users and tried to silently opt people into use of their information for AI. LinkedIn automatically “opted accounts into training generative AI models” prior to updating its terms of service and privacy policies. It forced users to dig into their settings and find a toggle switch to turn it off  and any information collected while people were automatically opted-in may be impossible to claw back.  User backlash was swift, with people writing publicly, “Thought you couldn't hate LinkedIn more? You were wrong” and “LinkedIn sucks… it’s about to suck even harder with the help of AI.” LinkedIn eventually updated its privacy policy and provided notice to users. But just like “what’s done is done” in terms of the information already collected, it will also be hard for the company to reverse the loss of user trust for opting people in rather than being transparent and giving its professional user base a real choice.