Introduction

Remember that feeling that your phone is listening to you?

In this series we've shown it's not just listening. It's watching every click, swipe and pause, and turning your life into a digital profile. Here's what we've covered so far:

  • How your data is collected from everyday apps and websites.
  • How companies use that data to target you with ads and content.
  • How AI can now guess what you'll do next before you even do it.
  • How this "personalisation" can sometimes be manipulation, especially for teenagers.

Just as people wake up to these problems and ask for rules to protect us, the big tech companies are fighting back, hard.

👉️ Recently (September 2025), Meta (the company that owns Facebook and Instagram) started a political group with tens of millions of dollars (2nd link here).

Its main goal is to fight new laws that would regulate AI and protect your data, so they can keep operating with as few rules as possible.

On one side, you have people asking for safety and privacy. On the other, you have companies spending huge amounts of money to avoid new regulations.

The good news is that things are changing. Europe has banned the most manipulative AI, and Australia now has a law to keep under-16s off social media. But we can't rely on governments alone. They move slowly, and the tech doesn't.

In this post I'll show you what you can do to protect yourself, what businesses should be doing, and what we should demand from our leaders, including a baseline "Digital Bill of Rights" you can use to start the conversation.

🛡️ The Big Problem: Rules Are Lagging Behind

We have all this powerful technology, but the rules to keep it in check are well behind.

It's like we've built race cars before we've finished building the seatbelts and traffic lights.

Different countries have different laws, so the harm from data misuse crosses borders in seconds while the fixes get stuck at the border.

Here’s what’s starting to change:

  • Europe is drawing lines: The EU's AI Act has banned some of the worst practices, like systems that manipulate people when they're vulnerable or infer your emotions at work or school. That sets an example for the rest of the world.
  • Australia is taking steps: The government has started updating our privacy laws, with more changes to come. From 10 December 2025, social media platforms must take reasonable steps to stop under-16s having accounts. How well age checks work is another question. A $20 "old man" mask can reportedly fool some selfie age checks, so I'm not holding my breath.
  • But there's pushback: Tech companies are spending big on lobbying to soften new rules.

The Big Picture: "Data Colonialism"

Some much smarter people than me call what's happening "data colonialism."

It's the idea that big tech companies are treating our personal lives and experiences as a new type of raw material to be mined—just like historical colonies mined for gold or cotton.

Our personal information is extracted, sent to overseas data centres and turned into profit for shareholders, often with little benefit to us. That's why strong Australian rules matter: it's about keeping control of our own digital lives.

Rules are finally moving, but the push to keep things loose is powerful. Without strong guardrails and regulation, the default is still to collect your data first and ask questions later. "Move fast and break things" has long been the tech industry's motto, and that's exactly what's happened.

🔮 What's Coming Next: The Big Shifts for 2025-2026

So what does catching up look like over the next year or two?

1. Bans with Real Teeth.
Europe is outlawing the worst AI abuses. This is a game-changer. When a market that big says "no" to manipulative AI, it forces global companies to change their products for everyone. We'll likely see other countries, including Australia, copy and paste these rules.

2. Putting Kids' Safety First.
Australia's social media age law is a start. Platforms now have to build "age assurance" tech and default to safer settings for young people, which could reshape social media for kids worldwide.

3. States vs the Feds in the US.
In the US, there was a proposal to stop individual states making their own AI laws for ten years. The Senate removed it 99 to 1. That means a patchwork of state laws, which pushes companies to adopt the strictest rules (often California's) as their global standard, and that can protect users everywhere.

4. "Show Your Work" Becomes Mandatory.
Expect to hear a lot about ISO/IEC 42001 and the NIST AI Risk Management Framework (NIST is the US National Institute of Standards and Technology). These are standards for managing AI. Boards, auditors and insurers will increasingly want companies to prove they're managing AI risk, not just say "trust us".

5. No Pause Button.
Despite calls to slow down, the EU is sticking to its timeline. Businesses need to get ready now.

💡
The new rulebook is taking shape. The priorities? Ban dangerous AI, protect kids, and force companies to prove they're behaving.

But the real question is: does this feel like enough to you? The "protect the kids" laws are a start, but they feel rushed and slow at the same time.

While we're carefully trying not to break any eggshells, the tech itself is already breaking things. Maybe it's time we started moving at the speed of the problem.

🚀 What You Can Actually Do About It

Now for what you, your business and our government can do right now.

A) For You and Your Family (Starting Today)

Think of it like home security. Lock down the basics: use a more private browser like Firefox or Brave, block third-party cookies, and clean up your app permissions every few months. Ask yourself, "Does this game really need my contacts?"

*Next, ask questions.* If an app has AI features, ask what data it was trained on, where your information is stored and how to delete it. You have a right to know.

For families, use phone-level controls to limit screen time and app downloads. Most importantly, talk to your kids about how their feeds work: they're not a neutral window on the world, but an algorithm designed to keep them scrolling.

B) For Businesses (Your To-Do List This Quarter)

*If your business uses or builds AI, vague promises won't cut it any more.* Adopt a proper framework, which is just a structured way to manage your AI. Expect your insurer to start asking for it.

The recognised standards are ISO/IEC 42001 and the NIST AI RMF. Start simple: list the AI tools you use, where your data flows, who your vendors are and what the risks are.

Practise data minimisation: collect only the data you need and don't keep it forever. Before launching any new AI feature, run a privacy impact assessment (a check to spot problems before they happen). This also prepares you for Australia's privacy reforms.

Make safety the default. For teen users, that means no targeted ads and no "emotion inference" features.

Finally, be transparent. People should know when they're dealing with AI and when content is AI-generated, and you should be able to explain simply how your models make decisions.

C) For Our Government (The 2026 Agenda)

The most critical task is to finish the Privacy Act overhaul, strengthening our rights to access and delete our data and adding a direct right to action if it's misused.

*We need clear red lines in law, like the EU has.* Ban manipulative and exploitative AI, rein in biometric categorisation (sorting people by sensitive traits), and restrict emotion inference in schools and workplaces.

The kids' safety law is a start, not the end. It needs funding for youth mental-health research, independent testing of the age-assurance tech, and annual public reports on its actual impact.

👉️ *And given the lobbying we're seeing, we need sunlight.* Require public disclosure of AI-policy lobbying and significant AI incidents. The public has a right to know who's shaping the rules and what's going wrong. Voters elect politicians to serve the public, not the highest bidder.

There are currently 721 registered lobbyists in Australia - see the list HERE

We also need real accountability. Perhaps it's time for a simple principle: "You cause catastrophic harm, you do time."

This means board of directors and C Suite of large companies.

Look at the current maths: a company illegally sacks 289 staff because the profit outweighs the likely fine. A telco responsible for 000 calls has a preventable outage that's linked to deaths.

That's not a cost of doing business, it's gross negligence. Under Work Health and Safety laws, company officers can face big fines and prison for failing their duty of care. Where are the consequences here?

👉️ No real consequences = no meaningful change. When the cost of endangering public safety is a manageable fine, it's a line item, not a deterrent.

The OAIC (Office of the Australian Information Commissioner) needs sharper teeth and the mandate to use them. When the penalty for breaking the law is less than the profit, the law becomes a suggestion.

💡
Summary:
You: Tidy up your app permissions and start asking companies tough questions.

Businesses: Adopt a safety framework (ISO/NIST), collect less data, and design for data security from the start - not after your hacked.

Government: Finish the privacy reforms, ban manipulative AI, and fully fund the new safety laws.

✊ A Digital Bill of Rights: What We All Deserve

So, what does a future where technology serves people actually look like?

Here is what a Digital Bill of Rights should guarantee:
  1. Explicit, Opt-In Permission: The era of assumed consent is over. The default for any data collection must be OFF. Companies cannot collect, use, or share any data—including background telemetry and diagnostics—without first obtaining our explicit, informed, and unambiguous opt-in consent. No more pre-ticked boxes or dark patterns.
  2. The Right to Understand: All terms must be in plain English. Legal documents must be short, readable, and use layered summaries (a simple headline, a short summary, full details) so a reasonable person can understand what they're agreeing to in under a minute. If it’s not understandable, it’s not enforceable.
  3. No More Manipulation: Dark patterns are banned. Consent must be freely given, without deceptive design tricks, nudges, or interfaces that confuse or pressure us into saying yes. Saying ‘no’ must be as easy as saying ‘yes’.

📜 B. The Principles of Transparency and Fairness

  1. Radical Transparency: Companies must clearly disclose all commercial relationships and exactly what data is collected before gaining permission. This includes all background telemetry and data collection, which must be disclosed and turned off by default.
  2. Data Minimisation: Companies can only collect data that is strictly necessary for a clearly stated purpose. They can’t just hoard everything on the chance it might be useful later. If they don’t need it for the core function of their service, they can’t take it.
  3. The User Dividend: If a company profits from our data after we’ve opted in, we get a share. The mechanism for this profit-sharing must be transparently disclosed upfront. Our data creates their wealth; it’s time for a fair share.
  4. No Secret Scraping: Scraping data from non-sanctioned sources is theft, full stop. This is especially critical for sensitive biometric and facial recognition data, which must be off-limits without direct, specific consent.

📜 C. The Principles of Ownership and Agency

  1. You Buy, You Own: When you purchase software, a digital movie, an ebook, or a smart device, you are buying a product, not licensing a temporary, revocable access pass. The "you will own nothing" model is unacceptable. Companies cannot lock essential functionality behind ongoing subscriptions, remotely disable features, or render your property useless. The right to repair, modify, and use what you've purchased indefinitely is fundamental.
  2. Your Data, Your Choice: We must have a real right to access, portability, and deletion. This means the ability to easily download all our data in a usable format, take it to a competitor, and have it completely and verifiably deleted—fast, free, and without hassle.
  3. No Retaliation: Companies cannot punish us for exercising these rights. They cannot degrade service, charge fees, or deny access to core features if we choose to opt out of data sharing or modify the products we own. The choice must be truly free.
  4. The Right to Audit: For high-risk AI and data systems, companies must submit to independent, external audits. We have a right to know how these "black box" systems are making decisions that affect our lives, from loan applications to job recruitment.

📜 D. The Principles of Safety and Accountability

  1. Strict Boundaries: No cross-context tracking without fresh consent. Data collected for one purpose (e.g., your health data in a fitness app) cannot be used for another (e.g., targeted advertising) without asking you all over again in a clear and specific way.
  2. Child-First Design: Services used by children must have stricter defaults and limitations on data use by design, prioritising their well being over profit. Their data deserves the highest level of protection.
  3. Security by Default: Companies must implement strong baseline security controls and are obligated to disclose data breaches promptly and clearly so we can protect ourselves. You can’t collect our data without also being responsible for protecting it.
  4. Pay Your Way: If a company generates substantial revenue from users in a country, it must pay taxes in that country. Profits generated from Australians should contribute to Australian society, helping to fund the services and infrastructure that support our digital lives.
  5. Unavoidable Consequences: Breaches of these rights must result in prohibitive, automatic fines based on a company's global revenue—a significant percentage, not a paltry fee. This makes violation a catastrophic business decision, not a calculated risk. The wrist-slaps are over.

🏁 You Have More Power Than You Think

AI isn't going away, and neither is the incentive for companies to collect our data and nudge our behaviour.

The thing is: we are not powerless.

Big Tech spends huge sums shaping the rules, but the last year has shown lawmakers can be made to listen.

Now, it's our turn to speak.
The most important takeaway from this entire series is this: you have the power to demand change.

👉️ Don't wait for someone else to act. If you're tired of your data being taken and sold back to you, say so. Privacy and AI law is federal, so write to your federal MP and senators, and to the Attorney-General, who is responsible for the Privacy Act. Ask them to support a Digital Bill of Rights. It's never been easier to make your voice heard.

History shows change doesn't need a majority, it needs a committed minority.

Research by Erica Chenoweth suggests that when around 3.5% of people get actively involved, movements rarely fail.

If you don't want a future of surveillance, the time to say something is now.

FAQs

1) Is the EU AI Act relevant to me in Australia?
Absolutely. When a market as big as the EU bans certain AI practices, global companies often apply those stricter rules everywhere. So, the EU's bans on manipulative AI are likely to become a de-facto global standard.

2) What exactly changes with Australia's social media age law?
Starting 10 December 2025, "age-restricted social media platforms" will be legally required to take "reasonable steps" to prevent children under 16 from creating accounts. The eSafety Commissioner has published guidance on what those steps should look like.

3) I heard Big Tech tried to stop regulation in the U.S. What happened?
A proposal was advanced that would have blocked individual U.S. states from making their own AI laws for a decade. However, the U.S. Senate removed this moratorium in a 99-1 vote, meaning states like California and Colorado are free to pioneer their own AI rules.

4) What's the first thing my company should do?
Start by adopting a framework. ISO/IEC 42001 (an AI management system) and the NIST AI RMF are the two most recognized. They help you inventory your AI, understand the risks, and build trust.

5) Do these steps help with Australia's privacy reforms?
Yes, directly. Practices like data minimisation (collecting only what you need), running privacy impact assessments, and being accountable align perfectly with the direction of Australia's upcoming Privacy Act reforms.

6) Does the new teen safety law cover gaming or chat apps?
The law targets "age-restricted social media platforms." The official guidance clarifies the scope, and regulators are focusing on services with messaging and community features, which could include some gaming and chat apps.

7) Is "emotion AI" actually banned anywhere?
Yes. The EU AI Act bans the use of emotion inference systems in workplaces and educational institutions. It also prohibits AI systems that exploit people's vulnerabilities. This sets a powerful legal precedent.

8) How can I personally push for this change?
Share this Digital Bill of Rights with your federal MP and senators. Ask your school to publish its policy on AI use. When a company sells you software, ask whether it follows the NIST or ISO standards.

Emotional AI & Teen Harm: The Cost of PersonalisationAI companions aren’t just chatty — they’re emotionally responsive. That’s helpful, until deep tailoring starts steering how we feel and act. Here’s what the cases, the regulators, and the research say — and how to build (and use) safer tools.You Are the Product: AI, Data and ProfitIn earlier posts we looked at your privacy, bias, and algorithmic nudges. Now, we discuss surveillance capitalism—a system where your behaviour, emotions, even attention become commodities—and reveal how AI deepens this invisible exploitation.AI Profiling Explained: Emotion, Movement & Mood TrackingIn 2025, AI is profiling you as you speak, move—even as you sit there. No surveys required. From your smartwatch to your smart car, everything’s feeding invisible algorithms that build emotional profiles on the fly. And yes—it’s creepy, relentless, and a wake-up call to take your rights back.CA’s Legacy: Emerdata, Auspex & Data PropriaCambridge Analytica collapsed in 2018, but its methods never died. Former staff and investors re-emerged in new firms—Emerdata, Auspex, and Data Propria—still using psychological profiling and micro-targeting to influence politics. Same game, same players, new names - your the target!Cambridge Analytica: How Your Data Became a WeaponCambridge Analytica wasn’t just a scandal, it was a preview of how data could be weaponised. In this first post of our six-part series, we break down how they pulled it off—and why the same tactics still shape what you think, how you vote, and what you see online.

Further Reading + Sources + References

Robot with a bat

Research on Instagram and teens: Summaries from the Facebook Files - Fairplay
FairplayFairplay
ChatGPT encouraged Adam Raine’s suicidal thoughts. His family’s lawyer says OpenAI knew it was broken
Jay Edelson rebukes Sam Altman’s push to put ChatGPT in schools when the CEO knows about its problems
The GuardianJohana Bhuiyan

TikTok knew depth of app’s risks to children, court document alleges - SOURCE

Facebook–Cambridge Analytica data scandal - WikipediaUSA: Families sue Character.AI over alleged role in encouraging violence, self-harm and sexual content - Business & Human Rights Resource CentreCheck out this page via the Business and Human Rights Resource CentrePutting the ‘Capitalism’ in ‘Surveillance Capitalism’In the 21st century, every life experience is a monetizable data point.
How big five personality traits influence information sharing on social media: A meta analysis - PMC
Research interest in information sharing behavior on social media has significantly increased over the past decade. However, empirical studies on the relationship between Big Five personality traits and information sharing behavior have yielded…
NCBI home pageCompeting Interests: NO authors have competing interests. * E-mail: sunny1970-2-9163.com

Update: In July 2025, Meta shareholders settled their lawsuit over the Cambridge Analytica scandal, which had sought about US$8 billion from Mark Zuckerberg, Marc Andreessen, Sheryl Sandberg and other current and former executives. The settlement came just as the trial started, so they didn't have to testify. The terms weren't disclosed. This was on top of the US$5 billion FTC fine in 2019.

Secure Your Data with Cryptomator: Easy NSA-Grade ProtectionDiscover how Cryptomator provides NSA-grade security for your personal data. This user-friendly encryption tool ensures your files are protected from unauthorized access. Learn the importance of data security and how to easily install and use Cryptomator on various devices.BorgBase & Vorta: Secure, Budget-Friendly Data BackupLearn why you need solid data prevention plans—and how BorgBase + Vorta deliver encrypted, cost-effective backups with easy setup across Mac, Linux and more for under about $120 AUD/year (non sponsored post)

✅ Want to learn how to update your privacy settings?

Naomi Brockwell’s NBTV YouTube channel features great explainers that are clear and easy to understand.

Naomi Brockwell TV
Naomi Brockwell TVHow Your ‘Anonymous’ Account Leaks Data

Or, if you’d like to dive a bit deeper into the tech side—without going overboard—check out this channel.