Everalbum trains facial recognition on user photos and sells to law enforcement
Date: 2021-01
Affected: Everalbum users
Attack vector: data-exfiltration
Category: real-world
Severity: High

FTC found that cloud-photo app Everalbum used users' photos by default to train a facial-recognition system that was then sold to private companies, law enforcement and the US military, without informing users. Settlement required deletion of models and embeddings.


Mitigations:

Architectural layers (MAESTRO):