Poke your head into just about any online social network—or any general conversations about internet culture—and you’ll likely find a boogieman: the algorithm. Since at least the moment Facebook introduced (and apologized for) its News Feed, “the algorithm” has been shorthand for the ways the tech giants control what we see and when we see it. In the age of enshittification, there is a push to reclaim our feeds and networks. Good news: there’s a tool that’s been around for decades that can help wrangle many of your feeds into something manageable: Really Simple Syndication, more commonly known as RSS.

What’s RSS and How Do I Use It?

RSS has been around since 1999, but its real publicity glow-up came from Google Reader, a newsreader service that Google offered between 2005 and 2013. Despite the alarm bells people rang at the time, the death of Google Reader wasn’t the death of RSS, and many replacements have come and gone over the years.

RSS may seem complicated, but it boils down to one general concept: when websites publish new content, like news articles, blog entries, webcomics, videos, or podcasts, that content gets added to an RSS feed, where your RSS reader (aka newsreader, feed reader, or aggregator) will show you that content in chronological order. If you’ve ever used a podcast player like Apple Podcasts or Spotify to follow different podcasts, you’ve used RSS. You can think of it like an internet-wide “follow” button, where you can track the contents of websites, users, and more.

People talk about RSS like it’s a power user’s secret trick to making the internet more usable, but the real secret is that it’s not that hard to set up and use. Here’s what you need to do:

• Find an RSS reader: RSS readers come in many forms. Feedly, NewsBlur, or The Old Reader, are web-based, but have their own apps (though they also support third-party apps). Others, like NetNewsWire, are app-based, and support either using a web-based RSS reader like Feedly, or a local file. Some live in browsers or web extensions. There’s an abundance of choice in RSS readers, and part of the fun is finding one that best accomplishes what you want to do. But don’t worry about finding the right RSS reader right away. One of the many magic tricks of RSS is that it is platform agnostic, and nearly every RSS reader—whether it's a website or an app, supports importing and exporting a list of the sites you subscribe to. This means you can change RSS readers in a couple minutes. If you need some help finding an RSS reader, Wired, The Verge, and Privacy Guides all have useful roundups. 
• Collect your feeds: As for adding websites to your feeds, the process is straightforward. Most RSS readers are designed to help find the feed for a site for you, so you don’t need to go hunting down a special link. Just drop the URL of what you want to follow in your reader, and if an RSS feed exists, it should be able to find it. If not, some sites, including ours (and our current podcast, EFFector as well as our last series, How to Fix the Internet), provide direct links to our RSS feeds.
• Sort, filter, and build your feed: Adding a bunch of new feeds can be overwhelming, particularly for news sites. RSS readers typically include folders, which let you group similar feeds together and can be great for lifting up low-traffic updates you don’t want to miss. Your reader may also have different filters, like the option to block any article that contains “sponsored post.” 

RSS Is the Best Way to Follow the News

It can be very difficult to follow the news, whether that means politics, tech policy, or your hobbies. Solutions like Google News or Apple News have tried to make this simpler, but many find that their algorithmic feeds are as often a source of frustration and annoyance as they are genuinely useful. And no matter how often you tap on news stories that matter to you from publications you respect, there may always be stories that refuse to bubble up.

RSS can make reading the news much easier, reliable, and more private. The vast majority of news sites have RSS feeds you can subscribe to, and many, including CNN, The New York Times, BBC, Wired, Politico, and many others, offer RSS for specific sections or special feeds that include the full text of articles for subscribers, so you aren’t just pummeled with a firehose of news all day long (we’ll get to a tip below in the next section that tackles this problem if they don’t have separate feeds, though). In many cases, you can read articles right in your RSS reader, never being forced to engage with wonky comments sections or poor design choices on websites.

Of course, the news isn’t just general news sites, it also includes hobbyist or more niche sites, local news offerings, and blogs. Most of these sorts of websites also offer RSS feeds, as do newsletter platforms like Substack or Ghost. 

RSS Offers One Way to Fix Some Social Feeds

Decentralized social media like Mastodon, Bluesky, and Threads, use RSS for user feeds, so you can follow your friend’s posts on Bluesky or Mastodon without actually having an account on either. This can be especially helpful for news sources, too—where you likely wouldn’t want to subscribe to a feed of everything a national news organization publishes because that would include dozens if not hundreds of stories a day, you can instead subscribe to their social media posts, which often get you the most breaking or important news.

The internet is more than just Facebook.

Some legacy social media works with RSS, too, including YouTube, Reddit (though that is currently at risk), and Tumblr. But others, like Facebook, LinkedIn, and Instagram, wall off posts behind account requirements that seem to pop up if you simply look at an account page for too long, let alone come in from an RSS feed. These walled gardens prevent information from getting out there, which ranges from annoying, like when your favorite local brewery only posts their food truck schedule on Instagram, to dangerous, like when local public services only post to a Facebook page.

The internet is more than just Facebook. It’s more than Mastodon or Bluesky, too. It’s a decentralized smorgasbord of websites, tools, feeds, newsletters, social profiles, and more, and treating it as such will help us wrangle the information we want and trust. 

Other Surprising Places You’ll Find RSS Feeds

When in doubt, try copying and pasting the URL for a site into your RSS reader of choice, you might be surprised to find a feed that proves useful to you. Many places on the internet may offer RSS feeds without you even realizing it. For example, if you want to keep an eye on an artist’s prints that you like, but they don’t have Instagram where they usually post, you might be able to subscribe to their webstore, as some shopping platforms, like Big Cartel, create an RSS feed automatically. And for something even more tweakable, even Google Alerts can be turned into RSS feeds.

RSS is one of the best examples we have of the open web, where we can design and customize how we experience the internet, not the other way around.

If you prefer to track policy over products, then you’ll be happy to know that government sites often support RSS, including most U.S. government sites, many of which break them into different sections like the U.S. Department of State’s various feeds. Many local governments or other public services, like fire departments may offer the same. Some universities (and university newspapers) also sometimes offer some RSS feeds. 

And even if a website doesn’t have an RSS feed, there are workarounds from tools like RSSHub, RSS-Bridge, and RSS.app that require varying levels of technical expertise or a willingness to pay subscription fees.

RSS is one of the best examples we have of the open web, where we can design and customize how we experience the internet, not the other way around. RSS has come in and out of fashion, been declared dead, and has come back, every time. Open systems are the best way forward to a free, equitable internet, and the resilience and continued reinvention of RSS has shown just how creative the web community can be with open protocols.

This is not science fiction. It’s not premature. If towns, cities, states, or the federal government want to act to reign in the emergence of armed police drones and robots, we have precious little time. In the absence of substantial regulation around when and how domestic law enforcement in the United States can deploy force using drones, the companies that markets technology to law enforcement have been moving. It’s past time concerned people take notice. Cities should not procure weaponized drones or robots, and multi-purpose drones and robots should be restricted from causing harm. 

Since 2021, EFF has been advocating against the use of armed robots or drones by law enforcement. This call has become more urgent as companies are moving in to take advantage of the lax regulatory landscape.

This month, two disturbing developments raised concerns that we might be on the verge of a larger trend of drone militarization. The first is that the CEO of Skydio, one of the most prolific vendors of police drones in the United States, signaled that the company has a more permissive attitude toward arming their drones in some contexts than many people expected. When asked on a podcast about the public perception that the company had restrictions around letting the military arm their drones, CEO Adam Bry said, “This is an area where I’ve gotten some things wrong. We said some things previously that led folks externally and internally to believe that, for example, we would prevent the military from putting weapons on our drones […] It’s very easy to sit back in a Silicon Valley office and think that we’re very smart, that we know the technology, and the idea of using it for X, Y, or Z thing seems evil or bad, so we’re going to write a policy or ban people from doing it. I think that’s ultimately misguided.”

Simply put: he is signaling that Skydio will not implement restrictions on their customers’ use of their devices. 

Bry was specifically asked about the military arming drones but the question reveals a disturbing truth: whether police arm drones domestically is currently based more on the internal ethical commitments of companies than it is any laws created by elected officials. Combining Skydio’s huge amount of police contracts, including supplying entire fleets for Drone as First Responders (DFR) programs, and the tendency of military technologies like surveillance aerostats to get redeployed on U.S. soil, creates a real recipe for the emergence of armed police drones. 

The other piece on the chess board to keep our eye on is the introduction of weaponized drones as a tool of school safety. A company called Campus Guardian Angel will run pilot programs in schools in Georgia and Florida in Fall 2026 to introduce drones that are designed to swarm, distract, crash into, and even shoot irritants at potential school shooters. This comes just years after a large national backlash that got the large police tech company Axon to pause its development of drones armed with tasers as a solution to school shootings. 

Although it may be obvious to some people, it’s worth saying again: antagonizing an active shooter with a small drone is a dangerous idea. In chaotic situations, deploying physical harm via drone is likely to get bystanders or good samaritans hurt by accident. It is also unproven that this technology will work to distract or deter an actual school shooter–especially when the demonstrations we see online revolve around crashing drones into stationary mannequins in pristine, controlled conditions. Another important question: What would happen if a potential shooter shoots at the small moving drone and endangers the people fleeing behind it? After all, in the demonstrations we’ve seen it is unclear if these drones have the ability to see what is behind them.  This is an unproven and potentially dangerous method of combating the very serious problem of gun violence in schools, and it’s one that helps to normalize armed drones as a solution to other policing problems as well. 

These developments also mean It’s not enough to follow San Francisco’s lead, which became the first city to change its policy regarding how robots could be used in order to ban police from using deadly force via robots in 2022. A robust and effective policy must include both drones and robots (not one or the other), and it has to explicitly prevent drones and robots from deploying any body harm — including deadly force and less-lethal measures like kinetic strikes, pepper spray, rubber bullets, or tasers. In addition, cities and states should not procure weaponized drones and robots. 

Since 2021, EFF has been advocating against the use of armed robots or drones by law enforcement. This call has become more urgent as companies are moving in to take advantage of the lax regulatory landscape. We cannot continue to rely solely on the good will of companies that make their money selling technology to police departments to protect us from dangerous police technology. Lawmakers need to act now. 

Ignoring EFF’s warnings about the dangers and impossibility of implementing a new mandate for 3D print surveillance software, the California State Assembly has signed off on legislation to do just that. In the process, legislators amended the bill to make it even more confusing, while failing to address the risks to privacy, speech, and consumer rights. We must renew our call on legislators to drop this bill as it heads to the state senate, and protect the tools of creators in the state.

Take action

Tell CA Senators to stand with creators

What’s changed about the bill?

Since we first wrote about AB  2047, a bill targeting 3D printers for the rare, impractical, and already outlawed practice of manufacturing firearms without a license, it has picked up several amendments. Some are welcome changes, but most have only highlighted the technocratic absurdity of the proposed scheme. Our core concerns—that this mandate censors lawful speech, builds out corporate surveillance, and criminalizes open source experimentation—have not been remedied. 

Removes criminalization of resale

Starting with one silver lining, the current bill includes a carveout for the private resale of devices. The original bill would have made it a criminal offense for an individual to resell 3D printers purchased before this mandated censorship and surveillance software. This is a clear win for the 3D-printing community, but it is unfortunately not enough.

Ineffective carveouts for open source

One of the most dangerous aspects of the bill is that it criminalizes individual users for common practices, like creating and using alternative open source programs with their 3D printer. New amendments provide a carveout for the use of an open source tool, but only if it includes compliant censorship software. The bill burdens open source developers with ambiguous and unrealistic standards for print blocking, and continues to create a chilling effect for open source users.

Removes any actual requirement to work

To reiterate—there is no world where the mandated technology actually works as intended. It will both block lawful use of 3D printers, and allow firearms to be printed by anyone determined to do so. There is no amendment that can change this reality.

Instead, the current bill simply drops the pretense that this mandate is expected to work. The performance standard of algorithms changed from “effectively prevent[ing] a technically skilled user from evading [the algorithm]” to “substantially reduce the likelihood of foreseeable circumvention attempts…” The bill will still require all prints to be surveilled, but instead of testing efficacy against a skilled user, it just plays whack-a-mole with the (literally) infinite number of circumventions that any user can employ. 

Further, the bill now leaves us with an unclear process that relies on non-governmental third parties to define standards, and now relies on manufacturers and resellers to self-police.

Hollywood gets a cut

The bill includes yet another carve out for commercial users. This time for the entertainment industry, which makes extensive use of 3D printers for props and costumes. 

That’s fine for big studios, but it leaves out indie filmmakers, cosplayers, and many other small creators. 

This is simply a defensive edit to limit corporate opposition. There isn’t a clear division in 3D-printing between consumer and commercial tools. These are general purpose tools which might be picked up by a prop department of a big studio, or an artist getting ready for Comic Con. Indeed consumer level products are not only used by amateur artists and engineers developing their skills. Commercial 3D printers, like their traditional 2D equivalents, are frequently used in workplaces, as well as by professionals honing their skills or just trying to get some work done at home. 

Commercial carveouts hands printer manufacturers the ability to sell a more expensive tier of printers, locking-in and up-charging their commercial customers. Some of those customers will choose to buy general retail versions, but that carries its own price: increased risk of IP theft as all printed files are surveilled the same way they are for hobbyists. That means a real risk of businesses leaking any prototypes or new designs to not only the printer manufacturer, but potentially snooping governments and/or the general public through data breaches.

Demand  your senator oppose AB 2047

This updated version of AB 2047 downgrades performance standards and removes oversight while still threatening privacy and choice for users of 3D printers. A printer surveillance system won’t work for its intended purpose, and will only harm law abiding users. 

Act now to demand your senators to vote no on this ineffective and invasive bill.

Take action

Tell CA Senators to stand with creators

Time and time again, researchers have found numerous compromised Android devices for sale at large online retailers like Amazon. When these devices get individually reported, we have seen some noted efforts to take them down. But this is a systemic problem and Amazon and other major online retailers must make a corresponding systemic and intentional effort to stop these devices from entering people’s homes and ultimately their networks.

As a refresher: Last year, Google wrote that one major campaign, deemed BADBOX, affected 10 million uncertified devices that were running Android’s open-source software (Android Open Source Project or AOSP). These devices span from TVs and streaming devices to digital picture frames. Even now, someone can go on Amazon and Walmart and buy one of these devices. Not all of them come from Amazon and Walmart, but it’s fair to assume since they have the lion’s share of the market.

Most well-known Android-based devices don’t come with just “stock Android.” The operating system is usually Android plus additional features that the manufacturer wanted. These custom versions of Android often come with pre-installed applications that range from useful to innocuous bloatware to actual malware. Many Android OEMs (original equipment manufacturers) pre-install apps that may not be visibly represented by an icon in your list of installed apps. This obscurity makes the issue particularly hard for users to identify any potential threats.

Since the initial BADBOX analysis, there have been more reports of large campaigns and clusters of different devices participating in malicious activities that utilize people’s home networks to engage in illegal activity. Task forces in the private sector have made an effort to take down these existing Command and Control structures, but these actors may pivot and evolve to flood the market with more devices. 

Online retailers can stop this cycle. A multi-billion dollar company like Amazon should offer more resources, like their anti-fraud efforts, given that these products may have facilitated conditions for large scale attacks and illegal activity. It would also be helpful if they communicated malware-related take downs in a more visible way to consumers who are seeking very similar devices with shared characteristics.

Identifying these devices can be tricky, but it’s not impossible because they tend to follow a pattern. For example, the FBI warned consumers this year to avoid TV streaming devices that claim to provide free sports, tv shows, and movies, a common tactic used by the makers of these malware-filled Android devices that leverages people’s exhaustion from spending money on countless streaming services. We detailed what sorts of indicators to look for on a device you’ve purchased.

But it’s not just the storefronts. There are other parts of this ecosystem that need to improve too, like increased engagement in firmware transparency and the actual manufacturers of the devices themselves being held accountable for these malware laced products.

On Prime Day, we urge retailers like Amazon to better empower users with information they need to make safe and smart decisions.

Seeking transparency and accountability in Paraguay’s use of facial recognition, EFF, the Association of Technology, Education, Development, Research, Communication (TEDIC), and the Centre for Justice and International Law (CEJIL) filed a complaint with the Inter-American Commission on Human Rights against the state for arbitrarily denying access to information about its implementation and use of the technology as a tool for mass surveillance that erodes people’s privacy rights. 

The case involves the Ministry of the Interior and National Police’s installation in 2019 of surveillance cameras with facial recognition technology in Asunción. Maricarmen Sequera, a lawyer and executive director of TEDIC, filed an information request with the ministry seeking details and protocols about the implementation and use of facial recognition systems and the personal data processing involved. 

The request sought information about, among other things, whether the state had conducted human rights or data protection impact assessments, as well as if it had developed measures and protocols for avoiding abuses, illicit uses of personal data, and other risks in the deployment of the facial recognition system.

The state denied most of the information requested, arguing that implementation details, protocols, and the processing of individuals' personal data were confidential security information. TEDIC contested the secrecy in courts, but the analyses lagged and ultimately sustained the denial of information. 

The petition filed last Friday (19) cites Inter-American standards upholding the public’s right to access information, particularly in relation to national security, that the Paraguayan authorities disregarded in denying TEDIC’s information request. The petition also argues that the refusal of information violated privacy and the right to informational self-determination.

The petition asks the Commission to recognize a violation of those rights and require the state to deliver the information requested. Further, the petition seeks an order compelling the state to adopt mandatory permanent mechanisms of active transparency regarding the acquisition, contracting, implementation, financing, functioning, and use of surveillance technologies by public bodies, especially those that incorporate processing of biometric data or artificial intelligence systems. 

It also asks the Commission to order the state to mandatory procedures for human rights impact assessments prior to acquiring and using surveillance technologies, particularly those that collect biometric data or use artificial intelligence.

The state’s lack of transparency in this case is not an isolated incident, both in Paraguay and in Latin America, where opacity in matters of security and surveillance is the unsettling rule. The situation gets worse with the increasing normalization of intrusive surveillance technologies by states in the region.

The Special Rapporteur for Freedom of Expression of the Inter-American Commission emphasized that states should disclose surveillance capabilities and contracts, and acknowledge state use of surveillance technologies at a meaningful level of detail, to facilitate essential public debate on the necessary limitations of surveillance in democratic societies and ensure compliance with international human rights law.

We hope that the Inter-American Commission upholds the robust safeguards in the Inter-American System and advances access to information and privacy rights in a case that can set a crucial precedent for the region.

This week marks four years since Dobbs v. Jackson Women’s Health Organization overturned Roe v. Wade’s constitutional protections for people seeking abortion care. Anniversaries are a moment to take stock, and over the last four years, EFF has seen firsthand how digital rights and reproductive rights have become increasingly intertwined. One major way this has happened: the fight over abortion has also become a fight over online speech and government censorship as a steady stream of proposed laws, cease-and-desist letters, lawsuits, and government investigations have targeted the websites and online resources that help people find and learn about reproductive healthcare.

This is an effort by anti-abortion government officials to mold the information ecosystem, restrict what people can read, and cut off the ways people communicate with one another. We’ve watched this build for years, and the encouraging news is that many of these efforts have failed. The worrying news is that they keep coming. And if they’re allowed to succeed, this could have repercussions for freedom of expression online beyond reproductive rights.

Targeting Sites That Just Share Information

The clearest tell that this is also a war on speech is that officials have aimed their efforts not just at abortion providers or the entities that prescribe and sell medication abortion, but also at websites that do nothing more than tell people what their options are, how to find a doctor, and where abortion remains legal.

Cease-and-Desists & Takedown Demands

State attorneys general have been hitting these online information hubs with cease-and-desist letters and takedown demands. Just this month, for example, Alabama Attorney General Steve Marshall sent cease-and-desist letters to multiple groups with abortion-related websites, including Plan C, a public health campaign that provides educational resources and research on abortion access. Plan C doesn’t sell or ship abortion pills. It simply provides information. Marshall’s office nonetheless claimed Plan C’s website “facilitates, aids, and abets” illegal abortion. The Arkansas attorney general similarly sent out cease-and-desists to several organizations regarding their websites, including Mayday Health, which, like Plan C, provides only information and does not directly prescribe or mail pills.

What’s especially concerning is that the state doesn’t have to win, or even file, a lawsuit to get what it wants.

In another example from earlier this year, North Dakota Attorney General Drew Wrigley threatened legal action and ordered the Prairie Abortion Fund to scrub information off of its website, not because the fund sold pills, but because its site linked to several outside informational resources. The Attorney General primarily focused on the fund’s link to Plan C, meaning the biggest alleged issue was a link to a website that links to other websites where pills can be accessed.

What’s especially concerning is that the state doesn’t have to win, or even file, a lawsuit to get what it wants. Especially for smaller organizations and funds, a letter threatening legal action can be enough to chill their speech, causing them to remove important content and go quiet.

Censorship Mandates

Legislators in multiple states have also attempted to make it illegal to share resources on how to obtain an abortion, including on purely informational websites with a national or global audience. South Dakota recently passed a law making it a felony to “advertise” anything “described in a manner calculated to lead another to use or apply it for producing an abortion.” Language this broad can easily apply to websites that simply engage in First Amendment-protected advocacy or provide educational resources. Mayday Health, which operates one such website, has since sued the state in federal court to block the law. The lawsuit argues the law could reach something as small as wearing a sweatshirt that carries Mayday’s web address.

Other state legislatures have made similar efforts. Last year, for example, Texas introduced a bill that would have made it illegal to “provide information” on how to obtain an abortion-inducing drug. If you exchanged emails, had an online chat, or created a website that shared information about legal abortion services in other states, you could have violated this bill. Luckily this particular bill did not pass, but Texas has attempted to pass similar laws for several years now.

Dressing Censorship Up as Consumer Protection

A major way anti-abortion officials are targeting online speech is by weaponizing consumer protection and deceptive advertising laws, claiming that providing information about abortion violates them. This tactic is a threat to free speech rights. The First Amendment protects publishing truthful information on a public issue, and the Supreme Court has expressly said that includes providing information about legal abortion in a state where it is illegal.

Yet states like South Dakota have continued to use deceptive advertising claims to go after abortion speech. Last year, South Dakota sent a cease-and-desist and then filed a lawsuit against Mayday Health for running ads that simply read: “Pregnant? Don’t want to be?” with a link to Mayday’s website. The state claimed the ads were “deceptive.” Mayday then counter-sued in federal court, challenging South Dakota’s actions under the First Amendment. Though the federal judge ultimately declined to step in while the parallel state case was pending, she made a point of saying she believed Mayday’s website constitutes “speech subject to protection under the First Amendment.”

Other states have attempted to run the same play. Missouri sued Planned Parenthood in 2025 under its consumer-protection statute, calling a webpage that says abortion pills are safe an “unfair and deceptive” trade practice. Florida went even further, invoking its RICO law—a law typically used for organized crime—over the same kind of statement. Florida leaned heavily on a single study funded by an anti-abortion think tank, even as major medical organizations and decades of research put the serious-complication rate below half a percent. States should not be able to cherry-pick studies in order to erase online speech.

Going After Intermediaries & Erasing Whole Websites

Some officials aren’t content to restrict only certain abortion-related content—they want the websites gone entirely.

Take, for example, the cease-and-desist letters sent by the Arkansas attorney general last year. Letters were sent directly to internet intermediaries (entities that facilitate use of the internet, such as internet service providers, web-hosting providers, or things like search engines and social media platforms). The letters demanded that both a domain registry company and a web host stop supporting a site that discusses abortion drugs. But as we know, if we cut off the host or the domain, the speech disappears for everyone—not just for people in Arkansas.

Likewise, Texas’s 2025 bill would have required intermediaries to take down abortion-related content. It’s worth remembering that the imposition of civil and criminal liability on intermediaries also conflicts with a federal law that protects online intermediaries’ ability to host user-generated speech, 47 U.S.C. § 230 (“Section 230”), including speech about abortion medication.

The push has gone federal, too. In March 2026, Senator Bill Cassidy and colleagues on the Senate Health, Education, Labor and Pensions Committee pressed the FDA to use every tool it has against online sellers, including leaning on the domain registrars that keep these sites online.

Why This Should Worry Everyone

It’s tempting to see this as limited to the fight over reproductive rights. That would be a mistake. For people seeking care, the immediate harm is obvious: the internet is often the only place to find accurate, potentially life-saving information, and every letter, lawsuit, and takedown threat makes that information harder to find and riskier to share.

But the damage doesn’t stop there. We’re witnessing a live experiment in how to use consumer-protection laws, criminal statutes, and pressure on intermediaries to suppress a disfavored viewpoint, pull information offline, and make websites disappear. To think these tactics can only be used against abortion speech would be naïve. 

We hope courts and legislatures will continue to protect free speech online. But the continued drumbeat of threatening letters, lawsuits, and investigations is its own kind of harm. Here at EFF, we’ll keep defending the right to share and read information online—about abortion, and about everything else.

The Federal Communications Commission wants to require telecommunications providers to collect vast amounts of personal information from every person who wants a phone number in the name of combatting scam and spam calls. This plan will fail to combat the deluge of unwanted calls people in the United States receive every day while giving untrustworthy companies a gold mine of information that would harm everyday consumer’s privacy, access to communications, and ability to speak freely. 

The requirement to provide ID and an address would completely cut off the ability to have an anonymous phone line, which would mean many people in the most precarious situations imaginable: domestic violence and human trafficking survivors, unhoused people, and children without stable homes, would not be able to gain access to a crucial lifeline. EFF, along with ACLU, has submitted comments advising the FCC to abandon this proposal entirely. 

This Rule Will Not Decrease Spam Calls 

Requiring phone providers to collect consumers’ information will not appreciably decrease or eliminate unwanted calls. The FCC knows this because it confesses in its own rulemaking that “the most effective way to prevent unwanted calls from reaching American consumers is by ensuring they never enter the network.” Further, the Federal Trade Commission found that “a significant proportion, if not the majority, of unwanted robocalls originate from overseas.” Collecting the personal information of everyone who wants to make a phone call will not put a dent in fraudulent calls. 

What will address unwanted calls is the FCC’s STIR/SHAKEN technical standards, which already exist. While STIR/SHAKEN is not perfect, it is actually a technical solution to the problem of spam calls. And where less than 50% of American telecommunication providers have fully implemented the protocol, the FCC should put its energy toward 100% compliance to reduce the scale of unwanted calls, instead of collecting consumer’s private information. 

The FCC gives away the true reason for this proposal in their own comments: this is a move to shut down the very existence of anonymous phones, aka burner phones. FCC says in their comments: 

“Enhanced KYC information can assist law enforcement to more easily identify callers that use the network to perpetuate crimes by ensuring that voice providers have accurate and complete customer information. The KYC information gathered and verified would help ensure that law enforcement gets accurate information in response to subpoenas when investigating crimes. For example, can enhanced KYC rules assist law enforcement in investigating organized criminal groups that use the network to facilitate illegal activities? Can they be used to deter or detect trafficking operations that use communication networks to buy and sell illicit goods?”

Anonymous phones are not just used by people to break the law, they are also used by activists who wish to remain anonymous, privacy conscious consumers, people escaping domestic violence, people escaping human trafficking, journalists who need to reach out to confidential sources, and other people in desperate situations. Anonymous phone lines are a lifeline to many, one which this proposal would cut off without any alternative. 

Mass Data Collection Makes Us All Less Safe

Mass data collection of individuals does not address unwanted calls, but it does 

make us all less safe online. The telecommunications industry has proven time and again that they’re poor stewards of personal information. They’ve been at the center of several large-scale data breaches in recent years and their data practices leave much to be desired.

In 2024, AT&T disclosed two large data breaches. One in which 7.6 million existing account holders and more than 65 million former customers had their information leaked onto the dark web, and another in which more than 100 million customer account call and text logs were downloaded. Another large provider, Comcast, suffered a data breach in 2023 where nearly 36 million account holder’s information was stolen, including the last four digits of their Social Security Number and date of birth. 

In 2024, the nation’s CALEA infrastructure, which law enforcement uses to tap and trace calls, was breached in the Salt Typhoon attacks. Experts maintain that U.S. communications networks remain vulnerable, and even this administration acknowledges these attacks as an ongoing threat. 

If telecoms can’t even protect the most sensitive communications infrastructure in the nation how can we expect that they will protect our identities?

In addition to their poor cybersecurity practice, these providers themselves abuse the information in their possession. In Scott v AT&T, AT&T, among others, made consumer information available to hundreds of third parties without the consumer’s express consent. Though the case was dismissed because AT&T forces its consumers to sign arbitration agreements, it shows the complete lack of care for their consumers' privacy. 

A Lack of Anonymity Silences People 

Mass data collection of individuals just to have a phone number will also harm and silence people. Anonymity in calls provides people the safety they may require to organize themselves, speak freely, and seek services. Anonymous phone calls give people the courage to participate in politics, organize themselves, reach out to a suicide or sexual-assault hotline, an addiction-recovery sponsor, seek medical care, seek escape from a violent and coercive situation, and do much more. Without this anonymity, people may otherwise not do any of these things. 

It will prevent many from obtaining phone numbers at all. 

Not everyone has all the information the FCC wants to require. The FCC wants people’s physical addresses, defined so narrowly that it’s essentially a home address. Not everyone has a stable home address, so those individuals would be not able to get phone service. 

FCC suggests that a government-issued identification should be required for any phone service. About 15 million adult U.S. citizens do not have a driver’s license, while about 2.6 million do not have any form of government-issued photo ID. Others don’t have access to their identifying documents, they may be controlled by an abusive spouse or parent, human trafficker, cult, or someone else from whom a secondary phone line could help a person escape. Estimates show another 21 million adult U.S. citizens do not have a non-expired driver’s license, and over 34.5 million adult citizens have neither a driver’s license nor a state ID card with their current name or address. 

These numbers do not include non-U.S. citizens who do not have current government-issued identification, including undocumented immigrants who cannot obtain a state ID or driver’s license. Black American and Hispanic Americans are disproportionately less likely to have current drivers’ licenses, and Americans with disabilities and Americans with lower annual incomes are also less likely to have current driver’s licenses. 

The FCC’s proposal will not decrease the amount of unwanted calls. All it will do is set up a data collection regime that harms everyday, law abiding Americans. This proposal makes us less secure online, strips away our right to anonymous speech in calls, and actively disconnects those Americans who are already at the margins. EFF recommends the FCC discard this proposal in its entirety. 

The window for reply comments can still be filed until July 26th. Express comments, which are appropriate for most individuals, can be filed on the FCC website. See the suggested language below to help you get started. 

When a car passes an automated license plate reader (ALPR), its plate is captured and instantly compared against a list of vehicles that police are actively looking for or that police have identified for real-time surveillance. These are called “hotlists,” and EFF has learned that one used by agencies across the country targets immigrants on behalf of Immigration and Customs Enforcement (ICE). 

Agencies using Flock Safety ALPR systems commonly allow the plates their cameras collect to be compared against the FBI's National Crime Information Center (NCIC) hotlists. These hotlists are broken into "topics," such as "Gang or Suspected Terrorist," "Stolen Vehicle," and "Missing Person." 

Flock Safety told EFF via email: "Local agencies add/remove license plates from the NCIC list. The FBI curates the NCIC list, and pushes it out to local agencies. Once the list leaves the FBI, they do not see any agency alerts. They only see when a local agency adds or removes plates from the list."

But one list is different: The "Immigration Violator" hotlist is populated exclusively by ICE, and it is the only agency authorized to enter or maintain records in this system, according to the NCIC operator manual. It includes license plates associated with administrative warrants, which are issued by ICE agents without judicial review. The manual further describes the data:

The Immigration Violator File contains records on criminal aliens who have been deported for drug trafficking, firearms trafficking, or serious violent crimes and on foreign-born individuals who have violated some section of the Immigration and Nationality Act.

And: 

If the ICE has reasonable grounds to believe that the subject may be operating a particular vehicle or a vehicle bearing a particular license plate, the vehicle and/or license data may be included in the record.

Buried in the Flock Safety administrative interface, there is a drop-down menu where agencies select which NCIC topics to subscribe to. If Immigration Violator is selected, the local agency will receive an alert that a vehicle ICE is looking for has been sighted. According to Flock Safety, ICE itself does not get an alert, although the local agency may contact ICE to let them know. Many agencies also participate or collaborate with immigration enforcement (through, for example, 287(g) agreements) and may take steps to stop a vehicle based on one of these alerts. 

In many places, using ALPRs for immigration enforcement is against city or state law–or at minimum, against agency policy. But using this hotlist is immigration enforcement. 

For example, Sparks Police Department's ALPR transparency portal lists immigration enforcement among the "prohibited uses." Yet, records show Sparks utilizes ICE's Immigration Violator hotlist.

Many agencies publicly acknowledge using NCIC hotlists, but don't publish which ones. So, EFF filed public records requests with agencies around the country to figure how to identify at least which agencies may be using the Immigration Violator hotlist. Here are links to the documents from the 13 agencies that have responded so far. 

Agencies with the Immigration Violators Hotlist Enabled

• Blue Island Police Department, IL
• Sparks Police Department, NV

Agencies Using NCIC Hotslists, But Immigration Violators Is Disabled

• Baraboo Police Department, WI
• Boonsboro Police Department, MD
• Elmira Police Department, NY
• Franklin Township Police Department, NJ
• Medford Police Department, OR
• New Braunfels Police Department, TX
• Oro Valley Police Department, AZ
• Quincy Police Department, MA
• Reno Police Department, NV
• Roselle Police Department, IL
• Sterling Police Department, IL

Knowing whether your agency has this box checked isn't just useful information—it's the kind of evidence that can change how officials vote when a contract comes up for renewal. So, how can you find out if your local agency is using the Immigration Violator list? It takes some digging, and you may not be successful. But here's what has worked for us in some instances. 

STEP 1: Conduct background research. 

The first questions you want to try to answer are: 

• Does your local agency use Flock Safety ALPRs, and if so, 
• Are they using NCIC hotlists? 

To answer the first question, here are two sites to try: 

• AtlasofSurveillance.org - This is an EFF project to catalog the technologies law enforcement agencies use. You can search for your agency to see if they use ALPR.

• EyesonFlock.com  - This site includes an index of every agency that maintains a Flock Safety "Transparency Portal." These portals often disclose what hotlists an agency uses. You'll want to look for your agency, then click the outbound link to their transparency portal, if they have one. 

Once you're on the transparency portal, you'll want to look for two things. 

• Is "immigration enforcement" a prohibited use? If it is, you might find that the agency is violating its own policies. 

• Does the agency list "NCIC" as one of its hot lists? 

Not all agencies disclose this information, so even if you don't find anything, you can move on to these next steps. 

STEP 2: File a public records request. 

Every state has a law that allows the public to request information from the government. This can often be done by emailing the police department or sheriff’s office, using the agency's online public records portal. You can usually find these emails or portals quickly online by searching for the agency's website and contact information. You can also subscribe to a service like MuckRock, which is how we filed these requests. 

We have developed language to request the hotlist topics. It doesn't always work, due to differences in how agencies interpret public records laws, but it is still worth a shot. 

Note: This is template language. A Google doc version is available here (Google's Privacy Policy applies). 

To Whom It May Concern:

Pursuant to the [INSERT LOCAL PUBLIC RECORDS LAW - FIND THAT HERE], I hereby request the following information:

- The NCIC topics that the agency has selected.

Within the Flock Safety ALPR administrative controls for hotlists, there is an NCIC drop-down menu to allow an agency to choose which NCIC "Topics" it will alert on. For example, "Gang or Suspected Terrorist" or "Missing Person." 

You may provide this as a print out or a screen grab, or simply copy-paste the selected items. If you'd prefer to do a full CSV export, that is also acceptable but may take more effort.

I leave the format at your discretion, but I would prefer to use as little of your agency's resources as possible for this request. You can see an example here: https://www.documentcloud.org/documents/28277589-20260414084201725/

The requested documents will be made available to the general public, and this request is not being made for commercial purposes.

In the event that there are fees, I would be grateful if you would inform me of the total charges in advance of fulfilling my request. I would prefer the request filled electronically, by e-mail attachment if available or CD-ROM if not.

Thank you in advance for your anticipated cooperation in this matter. Please do not hesitate to contact me with any questions at [CONTACT DETAILS].

Sincerely,

[Your Name]

STEP 3: Wait for a response.

Depending on the agency and the state law, it may take anywhere from days to weeks to receive a response. 

If the agency provides the records, they might look something like this: 

If "Immigration Violator" is checked, then yes–police are scanning vehicles for immigration enforcement. 

You can then put this information to work, sharing it with local reporters or bringing it directly to city officials who have the authority to modify, restrict, or cancel your agency's Flock contract. This is especially important if the agency has the box checked but also claims ALPR data is not used for immigration enforcement. Government officials like easy fixes, and "uncheck the box" is about as easy as it gets. But remember: If that's where it stops, the infrastructure for immigration surveillance stays fully intact, and the system is one policy, personnel change, or error away from being switched back on.

In many cases, you will not receive records. The agency may claim it's protected under legal exemptions or that it is not actually a public record under state law. For example, we received rejections from the Abington Police Department in Massachusetts and the Akron Police Department in Ohio.

If that happens, push back politely. You can explain that many other agencies across the country have produced this information and that it would greatly help inform the public. You can try contacting the police department's public information officer. Another option is alerting local press that the agency is refusing to disclose basic information about a public surveillance system, shutting residents out of decisions about how that system is being used. If you have the resources and time, you may also consider litigating a denial or lack of response.

You can also email your city council or board of supervisors member. Explain why this matters: The law enforcement agency may be facilitating immigration enforcement in secret, potentially in violation of its own policies. Ask them to use their oversight authority to demand answers from the agency, including pressing the vendor directly. Elected officials hold real leverage here: In most cities, either the council or the city manager controls the contract, and both are accountable to the public. If your agency's contract is up for renewal—or if a new pilot program is on the horizon—this is exactly the kind of information that should be part of that public debate before officials sign anything.

While we have filed dozens of these requests, we need locals to help gather even more. Drop us a line with the records you receive (or don't) at aos@eff.org.