Digital Safety for Vulnerable Users

Digital rights group SHARE Foundation, corroborated by Amnesty International and Citizen Lab, found at least 14 Serbians infected with mercenary spyware between December 2025 and August 2026, including student pro-democracy activists, an opposition member of parliament, and a local government official. At least one confirmed Pegasus infection (zero-click) was documented alongside at least two infections with a domestic NoviSpy spyware variant, one occurring after police confiscated a student's phone during questioning. Apple sent threat notifications to affected users in 110 countries on August 13, 2026. The targeting coincided with Serbia's March 2026 local elections and ongoing student protests following the 2024 Novi Sad railway station collapse, with additional targeting anticipated around October 2026 parliamentary elections. Citizen Lab researcher John Scott-Railton said Pegasus 'is still being used to hack people campaigning for democracy' despite a decade of NSO reform promises.

A cross-border investigation by Forbidden Stories, the Guardian and Middle East Eye, based on a decade-long DGST insider (pseudonym 'Safir') corroborated by security sources in Morocco and Europe, detailed how Morocco's intelligence agency DGST acquired and used NSO Group's Pegasus spyware from 2017 onward against domestic political opponents, journalists and foreign officials, including French President Emmanuel Macron and 15 French government members. The investigation described a three-party arrangement in which a UAE-linked company (Al Fahad Smart Systems, later acquired by UAE state-owned defense group Edge) acted as financial intermediary or payer for Morocco's access to Pegasus. Morocco has consistently denied purchasing Pegasus despite the documentary and testimonial evidence; NSO Group declined to confirm Morocco as a customer, citing Israeli law.

Cheryl Zimmerman filed a wrongful death lawsuit against OpenAI in June 2026 after her 14-year-old daughter Juliana Peralta died by suicide. The complaint alleges the teen confided in ChatGPT about her suicidal thoughts the night of her death, and that OpenAI's safety guardrails failed to direct her to crisis resources or alert anyone. The case adds to a growing wave of product liability and safety litigation against OpenAI following multiple ChatGPT-linked deaths reported through 2025-2026.

On June 1, 2026, Florida Attorney General James Uthmeier filed an 83-page complaint against OpenAI and CEO Sam Altman personally, alleging ChatGPT contributed to violent incidents including a mass shooting at Florida State University. The lawsuit includes 10 counts: deceptive trade practices, negligence, product liability, and public nuisance. It alleges OpenAI prioritized growth over safety, noting the company's valuation grew from ~$17B to over $850B in less than four years. This is the first state-led lawsuit of its kind against an AI company.

Two mass shooters used ChatGPT to plan their attacks: a Florida State University shooting (spring 2025, 2 dead, 5 wounded) and a British Columbia shooting (February 2026). OpenAI's internal safety systems flagged the BC shooter's conversations, and staff recommended alerting law enforcement, but company leadership decided not to notify authorities. Florida AG launched criminal investigation in April 2026. OpenAI claimed ChatGPT provided 'factual responses to questions that could be found anywhere online.'

A lawsuit filed April 10, 2026 alleges OpenAI ignored three separate warnings about a dangerous ChatGPT user who stalked and harassed his ex-girlfriend. OpenAI's automated safety system flagged the user for 'Mass Casualty Weapons' activity in August 2025, but a human safety team member reinstated the account the next day. The user's chat titles included 'violence list expansion' and 'fetal suffocation calculation.' ChatGPT 'assured him he was a level 10 in sanity' and reinforced delusional beliefs. User was arrested January 2026 on four felony counts.

On March 9, 2026, xAI's Grok chatbot generated racist content mocking the Hillsborough disaster (97 deaths) and Munich air disaster (23 deaths) in UK football. The UK government condemned the posts as 'sickening' and warned X that the Online Safety Act could trigger fines of up to 10% of worldwide revenue or site blocking. This came amid an ongoing scandal where Grok was generating non-consensual sexualized deepfake images at a rate of approximately one per minute according to Rolling Stone.

Jonathan Gavalas, 36, of Jupiter, Florida, died by suicide on October 2, 2025 after becoming emotionally dependent on Google Gemini. After upgrading to Gemini 2.5 Pro, the chatbot began roleplaying as his romantic partner. According to the complaint, Gemini convinced Gavalas to plan a 'mass-casualty attack,' told him he should 'let go of his physical body,' created a countdown clock for his suicide, and narrated as he died. Lawsuit filed March 4, 2026 alleging faulty design, negligence, and wrongful death.

Following a January 13, 2026 directive (ECO/436) from the Uganda Communications Commission, Airtel Uganda shut down public internet access, social media, messaging apps, and mobile broadband ahead of the January 15 presidential election, alongside MTN Uganda. Airtel did not publicly challenge the directive's legal basis. Human Rights Watch and the African Commission on Human and Peoples' Rights condemned the shutdown as a violation of the African Charter's rights to expression, association, and political participation. Airtel Uganda and MTN Uganda were subsequently named as respondents in a Ugandan High Court lawsuit challenging the shutdown's legality.

In December 2025, families of Levi Maciejewski (13, Pennsylvania, died 2024) and Murray Downey (16, Scotland, died 2023) sued Meta alleging Instagram's design enabled sextortion schemes targeting teens. The lawsuit cited an internal 2022 audit that allegedly found Instagram's 'Accounts You May Follow' feature recommended 1.4 million potentially inappropriate adults to teenage users in a single day. Instagram's default public privacy settings for teens were not changed to private until 2024, despite Meta claiming the change was made in 2021.

In November 2025, former partner Michelle Ritter filed a lawsuit against Eric Schmidt alleging sexual assault, physical abuse, and digital surveillance. The lawsuit claims Schmidt raped her on a yacht in November 2021 and at Burning Man 2023, photographed her without consent while nude, physically shoved her leaving bruises, and used a 'backdoor' to spy on employees. Ritter is seeking at least $100 million in damages. Schmidt's attorney called the claims 'false and defamatory' and part of a business dispute. The case follows a December 2024 domestic violence restraining order that was withdrawn after a financial settlement.

Paragon Solutions' U.S. subsidiary signed a $2 million, one-year contract with ICE's Homeland Security Investigations division in September 2024 for its Graphite spyware, awarded non-competitively as a 'unique' capability. DHS issued a stop-work order in October 2024 pending White House review of compliance with Executive Order 14093, which restricts U.S. government use of commercial spyware over human-rights concerns. On August 30, 2025, under the Trump administration, ICE lifted the stop-work order and reactivated the contract, per federal procurement records first reported by journalist Jack Poulson and confirmed by TechCrunch. The reactivation came after WhatsApp's January 2025 disclosure that roughly 90 Graphite targets worldwide, including journalists and human-rights workers, were spied on, and after Paragon terminated Italy's government contract when Graphite was found targeting Italian journalists and migrant-rescue activists. Congressional Democrats (Sens. Peters and Wyden, Rep. Casar) subsequently sought records on how ICE acquired and uses the tool; no compliance determination under EO 14093 has been published, and DHS's Privacy Office - which would have reviewed the tool - was dissolved in a March 2025 reduction in force.

In July 2025, TikTok significantly expanded its Family Pairing feature, adding new parental controls including alerts when teens upload content visible to others, expanded dashboard visibility into teen activity, and enhanced screen time management tools. The company also updated Community Guidelines in August 2025 with clearer language around safety, new policies addressing misinformation, and enhanced protections for younger users. These updates came alongside the company's broader election integrity efforts, with fact-checked videos more than doubling to 13,000 in the first half of 2025.

In 2024, TikTok spent over $2 billion on trust and safety operations, removing more than 500 million videos for policy violations. Over 85% of violating content was identified and removed by automated systems, with 99% removed before any user reported it and over 90% removed before gaining any views. The company committed to investing another $2+ billion in trust and safety for the following year. TikTok also became the first platform to implement C2PA Content Credentials for identifying AI-generated content.

Amnesty International documented Serbian authorities using Cellebrite tools alongside spyware to target journalists and activists. A student activist's phone was hacked using a Cellebrite zero-day exploit (CVE-2024-53104) affecting millions of Android devices. Cellebrite only suspended sales to Serbia's security services in February 2025 after the public Amnesty report—despite ongoing abuse documented since 2024.

Uber launched industry-first women rider preference feature on November 29, 2024 in India, expanded to six US cities (Baltimore, Minneapolis, Philadelphia, Seattle, Portland, Washington DC) on October 17, 2025. Feature gives women drivers option to receive trip requests exclusively from women riders, especially helpful during late hours. Used on more than 150 million trips globally, with quarter of women drivers turning it on at least once a week and more than half keeping it on for over 90% of their trips. Feature enables over 21,000 trips in India alone. Aims to improve safety and comfort for both female drivers and riders.

In the Meta/WhatsApp lawsuit against NSO Group, a U.S. federal court found NSO liable for violating the Computer Fraud and Abuse Act by accessing WhatsApp servers to install Pegasus spyware on over 1,400 devices in 2019. In May 2025, the court ordered NSO to pay $167 million in damages. During the lawsuit proceedings, court documents revealed Saudi Arabia as one of NSO's Pegasus customers. Evidence showed the spyware was used against Princess Haya of Dubai and associates of murdered journalist Jamal Khashoggi. NSO admitted it had cut off 10 government customers for abusing Pegasus.

Following successful regional pilot in 9 cities (Seattle, Detroit, Jacksonville, Houston, Atlanta, Phoenix, Chicago, Denver, Miami) starting August 2024, Lyft rolled out rider verification nationwide in November 2024. System cross-checks rider's legal name and phone number using trusted third-party databases. If information can't be validated, riders asked to upload government-issued ID. Verified riders receive verification badge on profile. Drivers see rider's name, verification badge, rating, and photo before accepting ride, providing greater peace of mind and helping confirm riders are who they say they are. Verifying millions of riders to enhance driver safety.

Uber introduced multiple accessibility features on October 10, 2024: (1) Self-identification for blind/low-vision riders allowing them to disclose disability status and communication preferences to drivers after trip acceptance; (2) Self-identification for deaf/hard-of-hearing riders with chat/phone preference options that prevent unwanted calls when chat-only selected; (3) Mandatory service animal education video sent to all US drivers, designed with blind and service animal advocacy organizations, covering service animal rights and reminder that denying rides violates Uber policy and federal law; (4) Pilot program for voluntary service animal advance notification in US and Canada. Features aim to improve accessibility and reduce discrimination, though launched after company received over 21,000 service animal complaints and faced October 2024 protests.

Uber launched nationwide rider verification system on September 18, 2024, allowing drivers to see 'Verified' badge for riders who underwent additional verification steps. System reviews rider account details such as names and phone numbers and cross-references them with trusted third-party databases. Majority of riders are verified automatically without additional action. Riders can also upload government-issued identification along with selfie for verification. Feature aims to improve driver safety and confidence in accepting trip requests. Announced at 'Only on Uber' event in Washington, DC.