This article contains a video which is a procedurally generated render of privacy relevant events in the web browser across the top 100 english language content web sites globally based on Tranco lists.
Over 500 000 privacy events which require consent (and were not consented to) captured in less than 5 minutes across 100 sites.
I wanted to find a way to make the data from my forensic audits more visual and accessible to non-experts.
So I created a Blender render pipeline which procedurally generates these scenes based on the audit's evidence bundles.
The entire renders (the full version of this one is 8 minutes long) will be made available along with the audit reports on November 17th when I release the research - this is just a small clip to share the concept.
So, I have been a privacy advocate and activist for 20 years and have achieved a great deal in that time including massive changes to EU law (such as ePrivacy and the GDPR) which have had ripple effects globally.
AI has allowed me to take my activism to the next level. I am creating a live action show called "WSI: Web Site Investigators" in the genre of CSI/NCIS as a means to raise awareness about web site tracking and profiling.
The show is based on real forensic audits of real web sites that are named and shamed in the show. the entire show is created with local, open weights AI models on my M1 Ultra Mac Studio with 128GB unified memory.
So far I have released a single (the theme song for the show) called "Leave my Data Alone" which is available on all the major streaming platforms; and today I released the first introductory video for the cast.
This is all new to me (I have never done video production before) and I learnt how to do all of this in just a couple of hours.
All the cases (each episode is based on a new case file) are real, the evidence in each episode is real and the web site is called out in each episode directly.
For all the bad things we can say about AI - here is a positive use case - making activism more affordable.
At least this is not widespread yet, in my recent forensic audit of the top 100 english language content sites globally, this was not present (audits conducted 1-3 October 2026) in any of the sites.
What we did find however, is that a number of big websites are now using Google Chrome's AI API to track and fingerprint people.
Despite being a big supporter of Apple and having worked closely with them on a number of privacy issues - I have a problem with the fact that it is impossible for users to audit what apps are doing on the majority of Apple's devices and as such I am calling for Apple to be held liable when apps they control (they do the review and prevent us from auditing directly) which then break the law (which would include 97% of apps in the EU).
In this article I discuss how I use Claude Code to replace app store mobile apps with local PWAs that have the same functionality without the privacy abuses and explain that if mobile app developers don't start to obey the law, others will eventually do the same and they will go out of business.
No matter how many laws the US States pass for online provacy, none of them are fit for purpose because they are all based on Notice and Choice (OPT-OUT) which then hits the Same Origin Policy in the browser.
I have put up a list of all the MEPs who voted for the urgency procedure yesterday (in breach of EU rules) as well as their voting history on fundamental rights issues and who has been lobbying them:
OK it should be fixed now - there was a rate limit which doesn't normally land but due to multiple Tor users coming through the same exit node, it was triggering the limit.
Nothing to do with the certs just told me a cert error because it never finished the handshake.
I tested through Tor on multiple machines now and multiple circuits and is working clean - thanks for the heads up.
I cannot see what is causing the issue, the certificate's full chain is sent, the clock is synced, the cert is showing zero errors in OpenSSL - so this is very confusing.
The irony is, you don't actually need Tor on my site because there is no logging, no third parties, no adtech etc. it is just static HTML files - so whereas I would normally recommend Tor I designed the site specifically to be privacy first.
I will try to figure out what is going on though because obviously I am fully supportive of people protecting their privacy with Tor.
Not sure why, it is working fine everywhere else - I see in Tor it gives an invalid certificate error, but the Lets Encrypt certificate is working fine in other browsers, so seems to be a Tor thing specifically.
Over 500 000 privacy events which require consent (and were not consented to) captured in less than 5 minutes across 100 sites.