The privacy switch

Research brief, The Morporkian Civil Liberties Union (MCLU). Open file.

Turn off the location and the people you shared with are told the sharing stopped. Leave the group and the group is told you left. Change the security details and a notice goes out. Replace the device and a new device is announced. Every one of those is the system working properly.

So the mechanism that exists to let you withdraw is also the mechanism that reports the withdrawal. The service can let you hide. It cannot let you hide the hiding.

European law does the same thing to itself. Erase your data and the controller has to pass the erasure on to everyone it gave the data to, because otherwise the erasure is not worth much. Get abusive material taken down and the person it was taken from has to be told why, because otherwise they cannot contest it. Both duties are there to protect somebody. Both of them announce.

Hearth is the settled version of this, where the law has already spoken. This file is the general one, where the setting works exactly as documented and the act of using it is the disclosure.

  • Can a right be exercised meaningfully if exercising it announces that you exercised it?

  • Who decided that a change of setting is an event other people are entitled to hear about?

What a setting may announce

  • Apple’s own Personal Safety guide on what the other party may notice when sharing stops. Their wording, not a summary of it.

  • What Safety Check actually does and does not solve, from Apple rather than from commentary.

  • Life360’s status label on a paused share, taken off their own support pages. Somebody will have to open them and read it.

  • Google’s family supervision: what is notified, to whom, and whether it can be declined.

  • Article 19 of the General Data Protection Regulation, which makes a controller pass an erasure or a restriction on “to each recipient to whom the personal data have been disclosed”. Read it twice and ask who else learns.

  • Article 7(3) of the same regulation, and whether “as easy to withdraw as to give consent” was ever meant to carry the cost of being seen to withdraw.

  • The European Data Protection Board’s consent guidelines on withdrawal without detriment, and whether detriment there has ever meant anything beyond a fee or a downgraded service.

  • The EU gender-based violence survey, published by the Fundamental Rights Agency and the European Institute for Gender Equality in March 2026, where 10.2 per cent of women report being pressured into saying where they go, or having their location monitored. Note where the Union filed it: Table 9, psychological violence, between being forbidden to see friends and being expected to ask permission to leave the house. Not under privacy anywhere.

  • Article 23(5) of the directive on violence against women, where a takedown has to be explained to the person it was taken from. Due process requires the notice. The notice is also the signal.

Tell us what it announced

Last updated: 17 September 2026