You Are [Not] a Movie Star
“I’m not a movie star.”
This phrase (or variations) I hear when I discuss data privacy with other people. I understand this argument. Most people do not have enough money, valuable secrets or political influence to justify elaborate exfiltration schemes (like $6B Binance scheme).
Why would anyone care about our holiday photos, shopping history, or old accounts? There is a reasonable intuition behind that. Targeting someone takes resources. The potential reward has to justify the effort, the uncertainty, and the risk. But that calculation can change without you becoming richer or more famous. It changes when targeting you gets cheaper.
Targeting people is getting cheaper
Imagine you’re on vacation abroad. You post a photo, tag the city, and go back to sightseeing. Later, your parents get a call. They hear your voice. It says you’re in trouble and urgently need money. Those details make the story sound believable.
A few years ago this would require a large amount of manual work. Someone has to find your posts, connect you to your parents, and prepare the call. Imitating a voice is even harder.
Now imagine a system that automates more of those steps. It finds people traveling abroad, identifies their relatives, and tries the same kind of scam with one family after another. A human doesn’t need to read your posts or personally choose you. Software does that work.
You haven’t changed. Your life hasn’t changed. The cost went down.
An attacker impersonating you is not the only danger. Your personal profile can be used against you too: what you read, what you watch, and what you are interested in. Facebook and Google use this kind of information to target ads. A new wave of scammers can use it to target you directly. AI can help them choose a story you are likely to believe, someone you are likely to trust, or a way to pressure you into acting.
The data we give to companies
You also don’t have to post your data publicly. You give it to companies yourself. Your appliances help. We live in a digital world and it’s impossible to avoid this. In many cases companies store your data indefinitely. And sometimes this data leaks.
The longer your data sits in one company the higher the chance it will leak. A company that may take security seriously now may be restructured and become more susceptible to attacks. Or the company may already have weak security.
It can get worse. In 2020, thousands of people in Finland received threats to publish their private therapy notes unless they paid a ransom. An attacker had stolen patient records from the psychotherapy provider Vastaamo. These people had shared intimate details because they needed help.
Many people today use ChatGPT as a therapist, accountant, tax adviser, or legal adviser. They share relationship problems, health concerns, income, debts, and details of legal disputes. Like the Vastaamo patients, they share these things because they need help. Over time, those conversations can become a detailed record of their private lives. If someone else gets access, the damage could be even greater.
The balance is shifting
AI can also help attackers look for security weaknesses, write code, and automate parts of an attack. That can reduce the work needed to get access to data in the first place.
Getting the data, finding useful details, and using those details against someone all take resources. AI can reduce the work at each step.
That doesn’t mean everyone will be scammed or every company will be hacked. Defenders use AI too. The balance changes over time, and it won’t change in the same way everywhere. But we should not assume that an attack that is too expensive today will stay too expensive.
With AI, the tools for using information can change even when the information itself stays the same. That matters when we decide what to share from now on. We are making a decision today, but its consequences may last much longer.
What I can do now
For me, the response has two parts: what I can do myself, and what I want from the services I use.
For some things, I prefer self-hosting. I have a home server where I choose what software runs and check it before installing it. I keep services isolated and limit what they can access. This gives me a better understanding of where my data is and what can happen to it.
That doesn’t make the system perfectly safe. I still need to maintain it. But it gives me more control over the risks I take.
I also try not to store sensitive information in online services unless I need to, and I avoid posting personal details that reveal more about me or my family than I intend.
I can’t avoid sharing information completely. A clinic needs medical information. A travel service needs details for a booking. But I can question whether every service needs everything it asks for.
These are my choices. Self-hosting won’t be practical for everyone. People should be able to protect their privacy without having to run their own servers.
Choosing better privacy
We need more services that work with less personal data. Apple’s Declared Age Range feature is one example: an app can request an age range without receiving your full birth date. More services could follow this approach, asking only for what they need, limiting who can access it, and deleting it when it is no longer needed. Where possible, they could process information on our own devices and share only the result.
We already compare services by price, features, and convenience. How they handle our data should be part of that decision too. A service that collects less, keeps information for less time, or lets me keep it on my own devices has value to me. I want that to influence what I use and what I pay for. When enough customers make those choices, companies have a reason to offer better privacy.
You don’t have to become a movie star for your data to be worth using against you. The cost only has to fall far enough.