Loading story…
The US Federal Trade Commission reached settlements with Cox Media Group Local Solutions and marketing firms MindSift LLC and 1010 Digital Works LLC over claims that an ad product marketed as "Active Listening" or "Voice Data" could use AI and microphone data from phones, smart TVs, and other smart devices to target ads based on consumers’ conversations. The companies promoted the service in 2023 and 2024 as if consumers had opted into voice-data collection and as if advertisers could use captured speech to improve localized ad placement, raising concerns that devices were secretly listening to users.
The FTC said those claims were false: the service did not listen to conversations, did not collect voice data, and did not deliver the advertised location-based targeting. Instead, Cox Media Group allegedly resold email lists obtained from other data brokers at a markup. Under the settlements, Cox Media Group will pay $880,000, while MindSift and 1010 Digital Works will each pay $25,000, for a total of $930,000; the money is intended to refund affected customers misled by the marketing.
See the reporting duties and controls this puts on the clock.
5 events from the most recent confirmed update back to the earliest known activity.
Internal materials about the purported voice-listening advertising service were later exposed by 404 Media, helping prompt scrutiny of the companies' claims. The disclosures contributed to examination of whether the service actually captured conversations from consumer devices.
Between 2023 and 2024, Cox Media Group and partners MindSift and 1010 Digital Works continued marketing the service as collecting voice data and claimed consumers had opted into such collection. According to the FTC, the companies were instead reselling email lists obtained from other data brokers.
The FTC took enforcement action against Cox Media Group, MindSift, and 1010 Digital Works after finding the advertised service did not collect voice data or listen to conversations and misrepresented ad-placement capabilities. Cox agreed to pay $880,000 and MindSift and 1010 Digital Works agreed to pay $25,000 each, with funds intended to refund affected customers.
Cox Media Group later acknowledged that its service did not listen to consumers' conversations and said it used only third-party aggregated, anonymized, encrypted data for ad placement. This contradicted earlier marketing claims about Active Listening.
In 2023, Cox Media Group Local Solutions promoted an advertising service called Active Listening or Voice Data, claiming it used AI-powered voice processing and data from consumers' smart devices to improve ad targeting. The marketing triggered concern that phones, smart TVs, and other devices were secretly listening to conversations.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See what this changes for your reporting obligations and which controls it puts on the clock.
2 references tracked. Mallory keeps watching after this page renders.
malwarebytes.com
Open sourcearstechnica.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The U.S. Federal Trade Commission reached a proposed settlement with data broker **Kochava** and its subsidiary **Collective Data Solutions** that would prohibit them from selling, sharing, or disclosing sensitive location data without consumers’ **affirmative express consent**. The FTC said Kochava sold precise geolocation data tied to hundreds of millions of mobile devices, along with related information such as mobile device IDs, app usage data, and demographic details, in ways that could expose visits to sensitive locations including **health care facilities** and **places of worship**. The proposed order, approved by the FTC in a 2-0 vote and filed in federal court in Idaho, requires Kochava to limit sensitive location data use to consumer-requested services, verify suppliers’ consent practices, notify the FTC about certain improper third-party disclosures, tell consumers who purchased their precise location data, allow consent to be withdrawn, and follow a retention and deletion schedule. The case stems from an FTC lawsuit first filed in 2022, and while the settlement does not impose a fine, it formalizes restrictions that overlap with commitments Kochava had already made in a separate class-action settlement to stop monetizing sensitive location data collected through app SDKs.
Jul 2, 2026
Comcast agreed to pay **$117.5M** to settle a class action tied to a large-scale breach disclosed in late 2023 that potentially affected **31M+** people. Comcast attributed the intrusion to **CitrixBleed** (Citrix NetScaler ADC/Gateway), a vulnerability that can enable **session hijacking** and credential theft; researchers warned stolen session tokens could remain valid even after patching, extending attacker access. The proposed settlement (preliminarily approved) provides reimbursement for documented losses (up to **$10,000** per person) and compensation for time spent responding, while Comcast denies wrongdoing. Separately, Google agreed to pay **$135M** to settle Android users’ claims that devices transmitted data to Google servers over **cellular networks** in the background without meaningful consent, with individual payouts capped (reported up to **$100**) and additional **injunctive relief** requiring clearer disclosures and express consent during setup. Two dermatology practices also reached settlements over cybersecurity incidents exposing patient data; one New Jersey practice reported unauthorized network access spanning **Dec 2023–Mar 2024** and exposure of **PHI/PII** (including SSNs and treatment/insurance data) affecting **373,630** individuals, offering cash benefits plus credit monitoring/identity protection while denying liability.
Jun 29, 2026
A new class-action lawsuit filed in the U.S. District Court for the Northern District of California alleges **Meta** misled WhatsApp users by marketing “unbreakable” end-to-end encryption while allegedly retaining and analyzing message content and enabling employee access via internal tools. The complaint—brought by plaintiffs from multiple countries and seeking global class certification—cites unnamed whistleblowers but reportedly provides no technical proof (e.g., logs or code) to substantiate claims that Meta can decrypt or read message contents; Meta spokesperson Andy Stone denied the allegations as “categorically false,” reiterating WhatsApp’s use of the **Signal Protocol** for end-to-end encryption. Separately, **Google** agreed to pay **$68 million** to settle a class-action lawsuit alleging **Google Assistant** unlawfully recorded users’ private conversations when inadvertently triggered (e.g., via “Hey Google” misfires) and shared recordings with third parties for advertising-related purposes. The preliminary settlement, also filed in Northern California federal court, still requires judicial approval and applies to purchasers of Google devices dating back to May 2016; Google reportedly settled without admitting wrongdoing. Together, the cases underscore ongoing legal and regulatory exposure tied to consumer privacy representations, data handling, and the gap between product claims and alleged internal access/collection practices.
Jun 29, 2026