What it can do. A tag the size of a coin reports its position to any phone that passes within range, so its owner can watch where the bag, coat, pram or car goes. It never pairs with your phone and asks you nothing.

How you would know. An iPhone warns you about an unknown tag travelling with you, and Android has “Unknown tracker alerts”. A Bluetooth scanner app will show a tag that keeps reappearing in the same place. In a car they are usually taped under a bumper, behind a boot panel or under a seat.

Consent. None. The tag is designed to be unnoticed, and nothing is asked of you at any point.

What helps

• If your phone warns you, use the alert to play a sound and photograph the tag and its serial number before you touch anything else.
• Keep a tag you find, note the time and place, and report it — the serial number is the only route back to an owner.
• Do a thirty-second check of coat lining, pram, bike, wheelchair and car boot after any journey you did not plan.
• Do not bin a tag you have found; it keeps reporting from the bin lorry.

Claim check. Real The one overstated version is the story that they can listen through it — these are locator beacons, not microphones.

What it can do. A few seconds of audio — a voicemail, a podcast, a wedding video — is enough to produce a convincing fake of someone you trust asking for money, a code, or a password reset.

How you would know. The tell is rarely the audio. It is urgency, secrecy, a changed bank account, a request to keep it quiet, or a push to move to a different channel mid-conversation.

Consent. None, and none needed: the sample is already public.

What helps

• Agree a family code word now, for a call that claims to be an emergency.
• Hang up and call back on a number you already have — never one they give you.
• Treat “don’t tell anyone” as the scam itself; a real emergency survives a second call.
• Never move money on the strength of one channel, however good the voice.

Claim check. Real The defence is old-fashioned: two channels and a callback beat any AI-voice detector.

What it can do. A cheap app turns an ordinary photograph into sexual imagery of a real person who never agreed to any of it, and the output spreads on the platforms people already use every day.

How you would know. Reverse image search, a sudden wave of strange accounts, or someone telling you. There is no reliable detector; the platforms’ own reporting tools are the practical route.

Consent. None. This is the clearest crime on the list.

What helps

• Preserve first: screenshot the post, the account, the URL and the time before you report — a takedown removes the evidence you need.
• Use the platform’s non-consensual intimate imagery form, then the UK routes: Report Remove for under-18s, the Revenge Porn Helpline for adults.
• Report it to the police (101 or online). Sharing an intimate image without consent is an offence in the UK, and 2025 legislation added offences for creating sexually explicit deepfakes — commencement and scope have moved more than once, so check current guidance.
• Tell one person you trust. The shame is the attacker’s leverage, not yours.

Claim check. Real “It’s only pictures, nobody gets hurt” is the claim to reject — the harm is the distribution and the permanence.

What it can do. Your agreement is not required. A second cousin’s upload is enough for matching to find relatives, and a distant match is what lets police build a family tree towards a suspect.

How you would know. You cannot detect it. The only signal is a relative mentioning a test, or a match notification you were not expecting.

Consent. Not yours to give. This is the clearest case on the list of consent being applied to somebody else.

What helps

• Before testing, tell close relatives what a match could reveal about them as well as you.
• Use a pseudonym and a separate email address; a kit does not need your legal name.
• Check the law-enforcement matching setting, which differs by service and can usually be changed after the fact.
• If you find an unexpected match, do not confront anyone from the dashboard — a genetic counsellor first.

Claim check. Real Underrated: people worry about their own data leaking, when the mechanism that actually identifies people is other people’s kits.

What it can do. A camera at an entrance compares your face against a watchlist — often people banned from the venue, sometimes “known offenders”. Some systems also estimate age or mood.

How you would know. Cameras at eye height on the door, signage, staff with a tablet. Ask in writing whether the venue uses live facial recognition, and against which list.

Consent. Notice at best. You cannot practically refuse and still go in.

What helps

• Ask the venue for its legal basis and its data protection impact assessment — it should have one, and asking is free.
• If you think you are on a list wrongly, complain to the venue first, then to the ICO; keep the date, time and which door.
• Ask for the person who can override the system. A match is a human decision at the door, not a verdict.

Claim check. Contested “They store everyone’s face” is usually wrong — most systems match against a list and discard non-matches. “It doesn’t make mistakes” is equally wrong, and the error rate is not spread evenly across faces.

What it can do. Software scores voice stress on a call, facial movement on a video interview, or the rhythm of your typing, and calls the output engagement, honesty or leadership potential.

How you would know. An interview or assessment that asks for recorded video answers, or a call platform with a “sentiment” tile. Ask which vendor it is and what the score is used for.

Consent. Buried, and effectively coerced when it is a condition of a job or a course.

What helps

• Ask, in writing, for the assessment’s purpose, the vendor, and the data protection impact assessment.
• Ask whether a human makes the decision or the score does. A score alone is not a decision you can appeal.
• In the EU, inferring emotions at work or in education is banned outright from February 2025 under the AI Act. In the UK it is a fairness and accuracy question under UK GDPR.

Claim check. Contested The software runs, but reading emotion from a face or a voice is not reliable, and the research consensus has been against it since 2019. Treat a score as an opinion about you, not a measurement.

What it can do. Employer software logs keystrokes, screenshots, application use and location, and sometimes webcam stills. Some of it is set out in a policy; some is covert and justified afterwards.

How you would know. A device-management profile on your phone, a “productivity” score in a dashboard, IT asking you to install an agent, or a policy update nobody read.

Consent. Buried, and consent at work is rarely freely given — the lawful basis is usually the employer’s interest, not your agreement.

What helps

• Ask HR in writing what is monitored, how, and where the policy and its impact assessment are kept.
• Make a subject access request for your own monitoring data: one month, usually free, and the reply often ends the argument about what is collected.
• Keep personal things on a personal device. A phone with the employer’s management profile on it is not personal any more.
• In the UK, the ICO’s 2023 guidance says covert monitoring is rarely justified. A union or ACAS can raise it without your name attached.

Claim check. Contested “They can read your personal WhatsApp on a work phone” is true only where the policy says so and it survives a necessity test. Read the policy before believing either side.

What it can do. A modern car records location history, speed and braking, syncs contacts and messages from your phone, and shares data with the manufacturer’s partners. Insurance dongles and dashcams add another layer.

How you would know. The car’s own privacy menu, the companion app’s data-sharing switches, and any dongle plugged into the diagnostic port.

Consent. Buried. The terms are usually accepted at the dealership rather than by you.

What helps

• Go through the in-car privacy settings and the app’s sharing options; turn off “share with partners” and “improve our products”.
• Unpair phones you have sold or borrowed, and delete the car’s stored contacts.
• Ask the dealer for a copy of the data the car holds about you; it is your data under UK GDPR.
• If you use an insurance dongle, find out what it records and how long it is kept before you plug it in.

Claim check. Real Mozilla’s Privacy Not Included review of car brands found every one it tested failed its minimum privacy standard. What it does not support is the claim that the car is listening to your conversations — unless it has a microphone and you have seen it in the settings.

What it can do. Remote exam software films you, scans your room, watches where you look and listens for voices. A school-issued laptop can be managed down to the applications and the camera.

How you would know. The pre-exam room scan, a locked browser, an administrator profile on a school device, or a monitoring clause in the acceptable-use policy.

Consent. Coerced: the alternative is not sitting the exam. Adjustments exist, but you have to ask for them.

What helps

• Ask what is recorded, who reviews it, how long it is kept, and what happens to the recording after marking.
• Ask for an alternative arrangement if you have a disability, a shared bedroom, or a caring or religious obligation — schools have a duty to make reasonable adjustments.
• On a school device, keep personal accounts off it and assume the school can see what the device sees.

Claim check. Contested A flag is not proof. Gaze and audio alerts are reviewed by a human and are wrong often enough that several universities dropped the software after complaints.

What it can do. Companies merge public records, loyalty schemes and old breach data into a profile: address history, phone numbers, relatives, inferred income, sometimes a “risk score”.

How you would know. Search your own name and postcode in a private window, then the same with your phone number. The profiles surface quickly.

Consent. None. Most of the information was never yours to withhold once a council or a retailer published it.

What helps

• Make removal requests to the biggest brokers, log the dates, and repeat them — opt-outs expire and records are re-ingested.
• Use the search engines’ own “results about you” tools for pages that expose your address or phone number.
• Use a different email address per service, so a breach tells you which one leaked.
• In the UK, an ICO complaint is worth making when a broker ignores an erasure request; keep the correspondence.

Claim check. Overstated Understated one way and overstated the other — brokers rarely hold your bank details, but they nearly always hold your old addresses and your family.

What it can do. Speakers and doorbells keep a short audio buffer in memory to catch their wake word, then send the request away to be transcribed. Misactivations happen: the device thought it heard its name.

How you would know. Every major assistant keeps a voice history you can open in its app, and a hardware mute button cuts the microphone at the circuit rather than in software.

Consent. Buried. The terms say it; almost nobody reads them.

What helps

• Open the voice history, listen to the clips, delete them, and turn off the setting that lets recordings be reviewed to improve the product.
• Use the physical mute switch when the conversation matters, not just the app toggle.
• Audit the third-party “skills” or “actions” you have enabled — each is a separate company with its own retention.

Claim check. Overstated “It records everything you say” is not how it works — it buffers locally and uploads only after a wake word, though false wakes do send short clips.

What it can do. A meter reading every half hour says more than what you owe: when the house is occupied, when you sleep, when you are away. Research can pull appliance-level signals out of the load curve; that last step is not a consumer product yet.

How you would know. Your supplier’s app or data page shows what is collected and how often. Look for the half-hourly or monthly setting and the list of third parties receiving it.

Consent. Effectively installed with the property. You can refuse a smart meter, and you can change how often it reports.

What helps

• Ask the supplier for monthly reads if half-hourly is not needed for your tariff, and ask who else receives the data.
• Make a subject access request if you want the exact data set rather than a summary.
• Treat the occupancy signal as real and the appliance-by-appliance story as mostly research.

Claim check. Overstated The appliance-by-appliance version describes a capability that exists in papers, not on a bill. Occupancy inference, though, is real.

What it can do. Sensors in a shop or station listen for Wi-Fi and Bluetooth signals to estimate footfall, dwell time and repeat visits, without anyone connecting to anything.

How you would know. You cannot, and that is the point — it is passive. Small signs at the entrance are the usual notice, and they are often out of date.

Consent. Notice at the door; no practical opt-out beyond turning the radios off.

What helps

• Mostly nothing: phones randomise their hardware address by default now, which breaks the link between visits.
• If a venue’s signage worries you, ask what it collects and how long it keeps it — the honest answer is usually counts, not identities.

Claim check. Overstated This was a genuine privacy story in 2014, and hardware-address randomisation has removed most of the bite. It stays on the list because the signage has not caught up.