Tracking Opt-Outs Are Useless, Cal.com's Closed Source Chaos, Both Good & Bad Political News, and More!

Our top stories this week:

  • Google, Microsoft, Meta All Tracking You Even When You Opt Out, According to an Independent Audit
  • Mastodon receives Sovereign Tech Agency funding
  • Cal.com is going closed source. Discourse is not.
  • Republican Mutiny Sinks Trump’s Push to Extend Warrantless Surveillance
  • Netgear Scores the First Exemption From the FCC’s Foreign-Made Router Ban
  • Federal Government Announces Bipartisan “Parents Decide Act” to Protect Kids Online

TWIP Live 🔴


Updates from the Team

New Interview: Carissa Véliz on AI

Time for another heavy-hitting interview! Recently Nate got to spend a little bit of time with Carissa Véliz, professor of ethics at Oxford and author of Privacy is Power, which we highly recommend. Our conversation centered primarily on AI but with a focus on privacy, ethics, and what we can do retake our societal destiny back from the AI companies. Her new book, Prophecy, comes out on April 21st. In the meantime the interview will be available on the 19th on YouTube and PeerTube. (We'll try to update these links when we have a direct link available.)

Privacy Guides
Massive organizations are monitoring your online activities. Privacy Guides is your central privacy and security resource to protect yourself online. Privacy Guides is a socially motivated website that provides information for protecting your data security and privacy. We are a non-profit project operated by our team members and hundreds of volunteer contributors. “Privacy Guides” and the “Privacy Guides” logo are trademarks of the MAGIC Privacy Guides Fund, part of MAGIC Grants, a 501(c)(3) charity.
Privacy Guides
Neat.Tube - PeerTube hosting from Neat.Computer

News

This week's news briefs talk about HackerOne pausing their Bug Bounty program due to the rise of AI bug reports, India abandoning biometric ID app requirements (for now), a Fiverr data breach, Mastodon's announcement that end-to-end encrypted DMs are coming soon, Chrome adding defenses against cookie-stealing malware, and privacy concerns from librarians in Canada.

News Briefs - Privacy Guides

Sources

Google, Microsoft, Meta All Tracking You Even When You Opt Out, According to an Independent Audit

According to an audit from a company called webXray, 55% of sites it checked set an ad cookie in a user's browser even when the user opted out via Global Privacy Control (GPC). Needless to say, the companies disputed these findings. GPC is meant to be the more enforceable replacement to Do Not Track requests, which were a huge failure and ironically often made users easier to track.

Google, Microsoft, Meta All Tracking You Even When You Opt Out, According to an Independent Audit
“This is the Strait of Hormuz in the data economy. If you want to make a change, this is where you cut it off. Anything short of that is theatrical political posture.”

Mastodon: Sovereign Tech Agency funding

Mastodon has been awarded €614,000 fromthe Sovereign Tech Fund, which they will use for a wide range of improvements to Mastodon specifically and the wider Fediverse. These include blocklist synchronization, remote media storage, automatic content detection (primarily for spam and illegal content), end-to-end encrypted DMS, and more. €90,000 will be set aside to donate to other Fediverse projects who wish to implement these protocols.

Sovereign Tech Agency funding
Announcing a service agreement for new work to improve Mastodon and the broader ecosystem.

Cal.com is going closed source (& Discourse Response)

Cal.com - a popular, self-hostable appointment scheduling tool - has declared their intention to stop being open source. They claim this is due to the increased risks posed by AI cybersecurity tools. Many in the community, however, are not buying this claim. Discourse issued a tongue-in-cheek response summing up many of these arguments, mainly that it won't work anyways. Cal.com will leave a community version available but warn against using it seriously.

Cal.com Goes Closed Source: Why AI Security Is Forcing Our Decision | Cal.com - Scheduling Software for Online Bookings
Cal.com goes closed source after 5 years. Here’s why rising AI-driven security risks and vulnerability discovery are forcing us to protect customer data.
Discourse is Not Going Closed Source
Cal.com just closed their source code, arguing AI has made open source too dangerous. After 13 years of building Discourse in public, we’re staying open. Here’s why.

Republican Mutiny Sinks Trump’s Push to Extend Warrantless Surveillance

Section 702 of the Foreign Intelligence Surveillance Act (FISA) has failed to be renewed, but the fight is not over yet. It received a 10-day extension til the end of April, and even if it doesn't get full renewal some kind of loophole from the FISA Court will allow it to run until Marhc 2027 regardless. Still, there's potential this may be the beginning of the end for warrantless data collection on American citizens.

Republican Mutiny Sinks Trump’s Push to Extend Warrantless Surveillance
A post-midnight revolt in the House sank the White House’s efforts to extend Section 702—a spy program the FBI has used to look into members of Congress, protesters, and political donors.

‘No more excuses’: Von der Leyen says EU age checking app is ready

The EU's age verification app was unveiled this week. It can verify using passport, national ID, or "trusted providers such as banks or schools." While this does appear to be a standalone app, it also appears designed to be something that other countries can plug into as a framework for their own localized apps. The app is open source and available on GitHub. Already one of our community regulars has written about his experience using it and a user on X claims to have found some vulnerabilities. At this time we have no information on the validity of these claims, but time will tell.

‘No more excuses’: Von der Leyen says EU age checking app is ready
Age verification app is central to EU effort to keep kids safe online.

Gottheimer Announces Bipartisan “Parents Decide Act” to Protect Kids Online

This is a brand new story hot off the presses, so we're unfortunately a bit limited on more neutral sources covering it. As a result this comes from a congressman's press release. A federal "Parents Decide Act" has been put forward - a bipartisan effort - which would require operating-system level age verification. Now is a great time to contact your politicians and let them know why this is a terrible idea.

RELEASE: Gottheimer Announces Bipartisan “Parents Decide Act” to Protect Kids Online
Above: Gottheimer announces new legislation to protect kids online. RIDGEWOOD, NJ — Today, April 2, 2026, U.S. Congressman Josh Gottheimer (NJ-5) announced the Parents Decide Act, bipartisan, commonsense legislation to strengthen online protections for children and give parents greater control over what their kids can access on phones, tablets, and other devices. Watch Gottheimer’s announcement here. Gottheimer’s […]

Forum Updates

VISA card vulnerability
Another banger from Veritasium channel on online security , check it out and share any other vulnerability that you know about credit cards. TLDR , iphone users need to turn off travel mode in their settings specially if they have visa card connected in their phones. I don’t think apple is really at fault here , as visa could simply use the method that mastercard uses to prevents this theft
Airplane Mode isn’t what you think on Graphene OS
I think people should be aware that Airplane Mode on Graphene OS doesn’t completely turn off the SIM, as you still can receive and make calls over WiFi, a technology known as Vo WiFi. I am not certain about it, but I think this means your ISP can know your location, at least when you stay home (Vo Wifi might only work on router from the same ISP as your mobile). You can disable it in your SIM settings.