The tools used to monitor journalists — once confined to intelligence agencies — are now commercially available, widely deployed, and capable of accessing a phone without the target ever clicking a link. On World Press Freedom Day, May 3, the International Federation of Journalists put that reality at the center of its annual assessment of global press conditions, publishing findings that describe not a gradual erosion of media freedom but an accelerating one.

The IFJ, which represents more than 600,000 media professionals across 148 countries, called the global state of press freedom “deplorable.” UNESCO’s latest World Trends Report on Freedom of Expression and Media Development adds the statistical frame: press freedom has fallen 10% since 2012, a decline the IFJ said is comparable to some of the most unstable periods of the 20th century.

128 deaths, and counting

The human cost in 2025 was 128 journalists killed. The IFJ said additional deaths have already been recorded in 2026. Reporters working in conflict zones face the sharpest risks — in Ukraine, Palestine, Lebanon, and Sudan, journalists have been arrested, displaced, or killed while carrying out their work. Individuals identified as press are increasingly becoming deliberate targets rather than incidental casualties.

IFJ General Secretary Anthony Bellanger described each attack as an act with consequences beyond the individual.

“Every attack on a media professional is an attack aimed at silencing a story intended to inform citizens,” Bellanger said, adding that restrictions on journalism ultimately prevent the public from making informed decisions.

Spyware without borders

In a study published April 28 — “Global Surveillance of Journalists: A Technical Mapping of Tools, Tactics and Threats” — the IFJ documented what it describes as a convergence of state intelligence capabilities, private-sector tools, and weak regulatory frameworks.

The report, which draws on cybersecurity expert interviews and technical investigations conducted between 2021 and 2025, identifies commercial spyware systems including Pegasus, Predator, and Graphite as now widely available beyond their original government-intelligence markets. All three are capable of “zero-click” intrusions — accessing a target’s device with no interaction required from the user.

The IFJ found these technologies are frequently deployed with limited oversight, leaving journalists monitored without accountability and with few legal avenues for redress.

AI as force multiplier

The IFJ study also raises concerns about artificial intelligence extending the reach of existing surveillance infrastructure. Data gathered through digital monitoring — communications, location history, online activity — can be fed into AI systems that analyze it at scale. In conflict environments, the report said, such systems can combine telecommunications data with drone feeds, enabling the identification and tracking of journalists in the field.

Beyond targeted surveillance, the IFJ warned of AI-driven disinformation, identity theft, and automated content systems that bypass editorial standards entirely.

Lead study author Samar Al Halal said the effects compound in ways that damage journalism even when no direct harm occurs.

“When journalists are watched, sources disappear, investigations stop, and self-censorship becomes normal,” Al Halal said. “The public doesn’t just lose information, it loses the ability to hold power accountable.”

What the IFJ is demanding

The organization is calling on governments to enact laws protecting press freedom and regulating surveillance technologies, restrict the export and use of commercial spyware, and strengthen legal safeguards for journalists’ sources. The surveillance report specifically recommends increased investment in digital security training and stronger protections for encryption and anonymity.

The broader context makes those demands urgent. A 10% global decline in press freedom over 13 years, 128 journalists dead in a single year, and surveillance tools that require no mistake from their targets — the infrastructure for silencing reporters has rarely been more capable or more available.

The post Spyware and AI surveillance targeting journalist on the rise, IFJ warns appeared first on The Media Copilot.

A single unreleased AI model has triggered emergency regulatory mobilization on both sides of the Atlantic. UK financial regulators are holding urgent talks with the government’s cybersecurity agency and major banks to assess risks posed by Anthropic’s Claude Mythos Preview — days after US Treasury Secretary Scott Bessent and Federal Reserve Chair Jerome Powell convened an emergency meeting with Wall Street’s top CEOs over the same concerns.

In the UK, officials from the Bank of England, Financial Conduct Authority, and Treasury are in talks with the National Cyber Security Centre. Representatives from major British banks, insurers, and exchanges are expected to be briefed on cybersecurity risks at a meeting with regulators within the next two weeks, according to Reuters. The BoE, FCA, and NCSC all declined to comment.

The US response was more public. White House national economic adviser Kevin Hassett confirmed on Fox News that Bessent and Powell had convened bank chiefs — including the CEOs of Citigroup, Morgan Stanley, Bank of America, Wells Fargo, and Goldman Sachs — to warn of cyber risks from the model. JPMorgan CEO Jamie Dimon was unable to attend. The urgency of the meeting reflected the capabilities Mythos Preview has demonstrated in controlled testing: the ability to identify and exploit weaknesses across every major operating system and every major web browser.

Anthropic has stopped short of a broad release, citing concerns the model could expose previously unknown cybersecurity vulnerabilities at scale. The company has been navigating an increasingly complex relationship with the broader tech and media ecosystem as its models grow more capable.

What Mythos Preview is — and who can use it

Despite not being publicly available, Claude Mythos Preview is already in active use — under strict controls. Under a program Anthropic calls Project Glasswing, select organizations have been granted access to the model for defensive cybersecurity work. Partners include Amazon, Microsoft, Apple, Google, Nvidia, CrowdStrike, and Palo Alto Networks. Access has since been extended to approximately 40 additional organizations responsible for critical software infrastructure.

Anthropic says Mythos Preview has already found “thousands” of major vulnerabilities in operating systems, web browsers, and other software. The company has committed up to $100 million in usage credits and $4 million in donations to open-source security groups as part of the program.

The framing is defensive. But the same capability that finds vulnerabilities can, by definition, be turned toward exploiting them — which is precisely what regulators appear to be stress-testing.

Why regulators are moving fast

The simultaneous and independent responses from UK and US financial regulators signal that Mythos Preview represents a qualitatively different kind of AI risk than those regulators have previously had to assess. Prior AI regulatory concerns have centered on bias, misinformation, and systemic market risks — as seen in ongoing debates around AI copyright policy and AI use certification. A model with demonstrated offensive capability against critical software infrastructure — in active use, even in a restricted form — is a different category of problem.

It is also a compressed timeline problem. The model exists. It is being used. The regulatory frameworks to manage it are still being assembled.

All three UK agencies — the BoE, FCA, and NCSC — declined to comment on the talks. Anthropic had not responded to a request for comment at the time of the Reuters report.

The post UK and US financial regulators hold emergency meetings over Anthropic’s Claude Mythos appeared first on The Media Copilot.

The Internet is undergoing a fundamental shift — and two of its largest infrastructure companies want to be the ones who set the rules for it.

Cloudflare and GoDaddy announced a strategic partnership Tuesday designed to give creators and small businesses more visibility and control over how AI agents access their content. The centerpiece: GoDaddy is integrating Cloudflare’s AI Crawl Control directly into its website hosting platform, letting site owners allow, block, or signal that payment is required before any AI crawler touches their content. The companies are also supporting open standards — specifically GoDaddy’s own Agent Name Service (ANS) and Cloudflare’s Web Bot Auth — that would give AI agents a cryptographically verified identity rather than operating anonymously across the web.

The problem they’re solving is real and growing. AI agents are increasingly browsing, summarizing, and retrieving content on behalf of users — but most operate without identifying themselves, leaving site owners with no record of who scraped what and no mechanism to negotiate terms. “There needs to be a way to ensure that businesses and creators have the tools to easily identify, manage, and trust AI traffic,” the companies said in a joint statement.

ANS, which GoDaddy introduced as a global open standard, uses DNS and public key infrastructure to assign verifiable identities to AI agents — a layer of trust that lets site owners distinguish legitimate agents from impersonators. Cloudflare, which introduced Web Bot Auth in 2025 along with a Signature Agent Card developers can use to share their agent’s stated purpose, is supporting the standard alongside its own tools. The broader goal is a permission-based model for the agentic web — and a technical foundation for a fair value exchange in what both companies call the Answer Engine era. It’s a dynamic that mirrors broader tensions: as AI companies negotiate directly with publishers over content access, the underlying question of who controls and monetizes AI’s use of the web is far from settled.

“The Internet is evolving into a high-velocity, AI-driven ecosystem, and that requires a new kind of transparent infrastructure,” said Stephanie Cohen, Chief Strategy Officer at Cloudflare. “By putting tools like AI Crawl Control and open standards into the hands of website owners, we are providing essential underpinnings for a new Internet business model.”

For publishers and creators watching their search traffic erode as AI answers replace clicks, the partnership is a concrete — if early — signal that the infrastructure layer is beginning to take shape. Whether it scales to the full open web remains an open question. Cloudflare has already been converting web pages to markdown for AI agents, and the battle over how AI crawlers pay for content is accelerating.

“We move at the speed of the Internet,” said GoDaddy Chief Strategy Officer Jared Sine, “and we’re working with the broader industry to ensure the agentic open web does too.”

The post Cloudflare and GoDaddy want to set the rules for the AI agent web appeared first on The Media Copilot.

For editors responsible for covering dozens of communities at once, the appeal of Dataminr is obvious. The platform claims to process vast amounts of public information—from police scanners and traffic cameras to social media posts and power outage sensors—and turn them into early alerts about fires, crashes, protests and other potential stories.

But entrusting a breaking news workflow to an algorithm raises practical and ethical questions. How reliable are the alerts? What kinds of data is the system ingesting? And what responsibilities do newsrooms retain when they rely on a third party to tell them where to look?

Available case studies and implementation guidance offer a partial picture.

Risks identified in Dataminr’s use for newsrooms

Dataminr works by aggregating and analyzing public information, not by providing official confirmation. That distinction matters. The platform flags what it believes may be newsworthy based on patterns across sources, including social media posts that could be incomplete, inaccurate or intentionally misleading.

Editors interviewed about the tool stress that they do not treat alerts as facts. “Dataminr’s job is to raise alarm bells and let me decide what to do with them,” says Patch.com‘s national breaking news editor Anna Schier. “So I don’t necessarily expect that it’s going to be right and I don’t ever trust that it’s right. I always look at the source of where it’s coming from first.”

Relying on Dataminr without robust verification workflows could lead to premature publication of unverified claims—particularly under the pressure to be first on breaking events. Newsrooms using the platform must guard against that temptation.

Another risk is information overload. Even with geographic and topical filters, Dataminr can produce more alerts than small teams can handle. Without clear triage protocols, staff may miss important signals amid lower-priority noise.

Finally, because Dataminr monitors public social media and other open sources, its output may reflect the biases and blind spots of those platforms. Events in communities with less online activity may be underrepresented, while incidents that generate viral posts may be overemphasized.

Controls and practices that mitigate those risks

Dataminr’s documentation and spokespersons describe several technical approaches intended to improve reliability. The company’s Multi-Modal Fusion AI cross-references signals across data types, on the theory that genuine breaking events will generate multiple independent traces—a scanner transmission, social posts, perhaps sensor data—while false alarms may not.

In practice, the most effective safeguards appear to be editorial rather than algorithmic. Newsrooms are advised to:

• Treat alerts as tips rather than publishable information
• Differentiate by source type, publishing faster when alerts come from official accounts and more cautiously when they originate from social chatter
• Build verification checklists for different alert categories, including calls to local officials, cross-checks against other monitoring tools, and on-the-ground confirmation when possible
• Define responsibility for monitoring and response on each shift, so alerts don’t fall into a gap between desks

Dataminr itself does not store journalists’ private source information or reporting, according to available materials. It surfaces activity already visible in public information streams.

Security and privacy considerations

The Dataminr newsroom documentation reviewed focuses more on workflow and use cases than on technical security architecture. Specific details about data storage, encryption, access controls and retention policies are not provided in the source materials.

Given the nature of the platform—continuous monitoring of public information and location-based alerting—newsrooms should:

• Consult their legal teams about how Dataminr collects and processes social media content and other public data
• Clarify whether any newsroom-specific information (such as user configurations or alert histories) is stored and how it is protected
• Ensure that no internal, non-public data is inadvertently fed into the system

Because Dataminr works with public sources, the primary privacy questions revolve around platform design and vendor practices rather than the newsroom’s own audience data. Even so, organizations that have adopted strong privacy positions may wish to understand how Dataminr’s business model and partnerships intersect with their own commitments.

A tool, not a gatekeeper

For all its automation, Dataminr does not absolve newsrooms of responsibility. Its strongest use cases—early warning in unfamiliar markets, backup coverage when local staff are offline—are also the ones where verification is hardest and mistakes can carry the greatest consequences.

Editors who have integrated the platform into their work emphasize that it is most effective when tightly configured and paired with human judgment. “Nothing is going to replace the work that a local reporter has done to be informed about a community, to build relationships,” Schier says. “But Dataminr can be used in tandem with that to get you the story a little bit faster.”

News organizations considering Dataminr should approach it as a powerful but fallible signal generator. The platform can widen a newsroom’s field of vision and buy precious minutes in fast-moving situations. It cannot decide what is newsworthy, what is true, or what is safe to publish.

Those decisions remain, appropriately, in human hands.

Dataminr’s news team can be reached at [email protected] for organizations seeking detailed security and privacy documentation beyond what is available in public case studies.

Frequently Asked Questions

The post Can you trust Dataminr with your breaking news workflow? appeared first on The Media Copilot.

Publishers are collecting more direct visitor data as third-party cookies disappear. Email addresses, phone numbers, geographic information, and behavioral data flow into platforms like Admiral through pop-ups, giveaways, and newsletter signups. This shift from anonymous tracking to direct data collection creates new responsibilities for newsrooms: you need to understand what security controls protect visitor information, how platforms handle privacy compliance, and what risks you’re accepting when you implement these tools.

Admiral positions itself as a privacy-first platform, emphasizing its status as one of the first IAB– and Google-certified Consent Management Platforms. For small newsrooms without dedicated security teams, understanding what these controls actually protect—and what they don’t—matters when evaluating whether Admiral meets your compliance and risk management requirements.

Here’s what you need to know about Admiral’s security posture, the controls the platform has implemented, and what you should verify before trusting Admiral with visitor data. (See also: Why newsrooms choose Admiral for first-party data collection)

What security controls Admiral uses

Admiral builds privacy considerations into product development from the start—what’s called privacy-by-design. The company conducts privacy impact assessments during development cycles to identify potential compliance issues before features launch. This approach aligns with GDPR and CCPA requirements that mandate privacy considerations throughout the data lifecycle.

The platform’s IAB and Google CMP certification means it has passed third-party audits verifying compliance with consent framework standards. This matters for publishers operating in jurisdictions with strict privacy regulations. However, certification doesn’t eliminate all privacy risks—you remain responsible for how you configure and use the platform.

Encryption and access controls

Admiral uses industry-standard encryption protocols for data protection:

• Data in transit: All data transmission over the public internet requires Transport Layer Security (TLS 1.2 or later), which protects visitor data from interception during transfer between browsers and Admiral’s servers.
• Data at rest: Information stored in Admiral’s databases is encrypted even if physical storage media is compromised.
• Access restrictions: Only people and systems with a clear business need can access customer data, following least-privilege principles.
• Data segregation: Your visitor data cannot be accessed by other publishers or shared with third parties.

Admiral’s development process includes code review requirements, with all changes reviewed by at least two developers before deployment. The platform also uses automated security scanning for static analysis and vulnerability detection.

Heavy reliance on Zapier

Admiral’s integration architecture relies heavily on Zapier for connecting with email service providers, CRM platforms, and analytics tools. Each integration point represents a potential vulnerability where data could be exposed if Zapier or connected systems are compromised. If you use Admiral’s Zapier integrations, verify that all connected systems meet your security and compliance requirements.

The data residency question

Admiral doesn’t publicly specify where visitor data is stored geographically or whether you can choose data residency locations. This matters if you’re subject to GDPR, which requires that personal data of EU residents be stored and processed in accordance with strict rules about international data transfers. If you operate in multiple jurisdictions or serve international audiences, ask Admiral directly whether data residency options are available.

What “standard” security means

Admiral’s security controls are standard for cloud-based SaaS platforms handling personal information, but they’re not unusually rigorous compared to enterprise customer data platforms. If you have highly sensitive data, regulatory requirements beyond GDPR and CCPA, or strict security mandates, Admiral’s controls may be insufficient for your needs.

The platform’s privacy-by-design approach and IAB/Google certification provide reassurance, but they don’t eliminate your responsibility for data protection. You remain the data controller under GDPR and must ensure your use of the platform complies with privacy regulations. This includes properly configuring consent mechanisms, providing clear privacy notices to visitors, honoring data subject rights requests, and maintaining records of processing activities.

Security checklist before implementing Admiral

Verify these items before trusting Admiral with visitor data:

• Does your organization require SOC 2 Type II compliance? Confirm Admiral maintains current certification.
• Do you handle data subject to GDPR or CCPA? Verify Admiral can meet your specific regulatory requirements.
• Do you need data residency in specific geographic regions? Confirm whether Admiral offers data location controls.
• Are you subject to industry-specific regulations like HIPAA or FERPA? Verify Admiral supports required compliance frameworks.
• Do you require custom data processing agreements? Confirm Admiral can accommodate your legal requirements.
• Do you integrate Admiral with third-party systems via Zapier? Audit all connected systems for security and compliance.
• Do you have internal requirements for penetration testing or security audits? Confirm Admiral can provide necessary documentation.

What to do next

Contact Admiral directly to request specific compliance certifications relevant to your jurisdiction and industry. Involve your legal and information security teams in the evaluation process. If you have complex regulatory requirements, request custom data processing agreements before implementation.

The post What you need to know about Admiral’s data security appeared first on The Media Copilot.

Any newsroom considering AI-powered comment moderation faces a fundamental question: what happens to the data? Comment sections generate streams of user-generated content, behavioral signals, and potentially identifying information. Handing that to a third-party vendor requires understanding not just what the system does, but how it handles everything flowing through it.

Utopia Analytics operates from Finland and markets itself as a context-aware moderation platform that learns each publisher’s specific standards. The system ingests comment text, conversation history, article metadata, and user behavior patterns to make automated publish/reject decisions. For the platform to work effectively, it must process substantial amounts of user data—and retain enough of it to continuously retrain its models.

The short verdict: Utopia’s GDPR foundation and EU hosting provide a stronger privacy baseline than many US-based alternatives. But publishers with strict compliance requirements will find gaps in publicly available security details that require direct vendor engagement to close.

Where Utopia presents risk

The primary concern stems from the nature of the service itself. Utopia’s AI models require training on historical comment data and ongoing access to new comments for retraining, typically every two weeks. Substantial user content flows through Utopia’s systems continuously.

Publishers must evaluate whether their comment sections contain personally identifiable information, sensitive political speech, or other content that elevates data handling risk. For publications operating in regions with strict data localization requirements, the Finnish hosting location may present compliance considerations—though EU hosting is generally favorable for GDPR purposes.

Technical details about encryption methods, access controls, data retention periods, and incident response procedures aren’t publicly specified. Trust and safety director Santiago Osorio notes that “both security and privacy are very important for the sort of clients we deal with” and describes a “scrutinized process of reviewing these aspects carefully with their legal teams.” Translation: expect these conversations during sales, not before.

Where Utopia delivers

The strongest point in Utopia’s favor is regulatory grounding. The company operates under GDPR, and Osorio states they “followed GDPR practices even before GDPR came into force.” This standard applies regardless of where clients are located, providing a baseline privacy framework for all deployments.

The company also positions itself around ethical AI principles, referencing the United Nations Universal Declaration of Human Rights and describing itself as “ethically sustainable.” That’s corporate values language rather than technical controls—but it signals organizational attention to responsible AI deployment in content moderation contexts.

For publishers comparing options, Utopia’s EU jurisdiction and proactive GDPR stance put it ahead of vendors operating from less privacy-forward regulatory environments.

The bottom line

Utopia Analytics is a reasonable choice for publishers who:

• Need AI moderation and want a GDPR-compliant vendor
• Can accept EU data residency
• Have legal teams prepared to conduct vendor security reviews during procurement

Utopia may not be the right fit if you:

• Require SOC 2 Type II certification or equivalent third-party audits
• Need data residency outside the EU
• Operate under industry-specific regulations requiring detailed security attestations upfront
• Lack legal resources to conduct thorough vendor due diligence

Questions to ask before signing

• What specific data retention periods apply to comment content and user behavioral data?
• What encryption standards protect data at rest and in transit?
• What access controls limit who can view raw comment data?
• Is a Data Processing Agreement available with specific deletion provisions?
• What incident response procedures exist, and what notification timelines apply?

Contact Utopia Analytics at [email protected]. Engage your legal and security teams early—particularly if you operate across multiple jurisdictions or handle sensitive content categories.

Frequently Asked Questions

The post Should publishers trust Utopia Analytics with comment data? It depends appeared first on The Media Copilot.

For news organizations, audience data has become both a strategic asset and a regulatory minefield. Reader behavior, subscription history, and engagement patterns can power personalized experiences that reduce churn and deepen loyalty. But that same data triggers obligations under privacy laws like California’s CCPA, and any misstep can damage the reader’s trust built over decades.

BlueConic positions itself as a customer data platform designed for media organizations, offering tools to consolidate fragmented audience data and trigger personalized engagement. The company also emphasizes built-in consent management features intended to help newsrooms comply with privacy regulations. But how much of the compliance burden does the platform actually shoulder—and how much falls back on each publisher?

[Read more: What it takes to implement BlueConic at a regional newspaper]

Risks identified in BlueConic’s security posture

BlueConic focuses primarily on marketing and operational benefits—such as unified profiles, behavioral triggers, and content recommendations—rather than on detailed security architecture. That emphasis is common among B2B platforms, but it means newsrooms must treat security evaluation as a bespoke process rather than relying on published assurances.

The primary risk is data concentration. By design, BlueConic ingests information from multiple sources—email platforms, subscription systems, website analytics, CRM tools—and consolidates it into unified profiles. That consolidation creates value, but it also means a single platform holds a comprehensive picture of reader behavior. Any breach or misuse would expose not just one data stream but the full aggregated record.

A secondary risk involves implementation complexity. BlueConic requires significant technical work to integrate with existing systems, and the case study notes a six-month timeline. Complex integrations increase the surface area for misconfiguration, and newsrooms without dedicated data engineering expertise may struggle to verify that connections are secure and that data flows comply with internal policies.

[Read more: How The Post and Courier cut subscriber churn 40 percent with unified reader data]

Finally, BlueConic’s consent management tools shift responsibility rather than eliminate it. The platform provides mechanisms to configure different consent rules based on user location and preferences. Still, newsrooms must define those rules, work with legal counsel to ensure they’re correct, and monitor ongoing compliance. The tool enables compliance; it doesn’t guarantee it.

Security controls BlueConic has implemented

The case study on The Post and Courier notes that the newspaper “refined their privacy policy and data use policies when implementing BlueConic, working closely with their legal team to ensure compliance with various state and federal regulations.” This suggests the platform supports compliance workflows but does not automate them.

BlueConic’s consent management tools allow organizations to set up rules governing data collection based on user location and consent status. Staff can configure which “listeners” (data collection mechanisms) are permitted to operate under different conditions, and the platform supports deletion requests in line with regulations like CCPA.

Tyler Hutten, The Post and Courier‘s director of data analytics, noted that “almost all CDPs have something similar to this, where you can put guard rails in place to make sure you’re not collecting data that you’re not supposed to be, and deleting it if you get a request to.” The implication is that BlueConic’s controls are industry-standard rather than exceptional—useful, but not a differentiator.

The paper also implemented geographic restrictions and deletion rules to manage both compliance and costs, focusing data collection on high-value users. This approach—limiting what’s collected in the first place—represents a privacy-by-design principle that newsrooms can configure within BlueConic but must define themselves.

Specific technical controls—encryption at rest and in transit, access logging, incident response procedures, data residency options—are not specified in the documentation reviewed. Publishers will need to obtain that information directly from BlueConic during procurement.

Security checklist for BlueConic users

Before trusting BlueConic with audience data, newsrooms should verify the following with internal stakeholders and the vendor:

• Has your legal team reviewed BlueConic’s data processing agreement and confirmed it aligns with your obligations under CCPA, GDPR, or other applicable laws?
• Have you defined which data collection mechanisms (“listeners”) are permitted under different consent scenarios, and configured BlueConic accordingly?
• Do you have a documented process for responding to user deletion requests, and have you verified that BlueConic supports timely execution?
• Have you obtained details on data encryption, access controls, and storage locations from BlueConic’s security team?
• Have you assessed the risks of consolidating data from multiple sources into a single platform, and do you have breach response plans that account for that concentration?
• Do you have internal technical resources to verify that integrations are configured securely, or will you rely on outside consultants?
• Have you updated your public-facing privacy policy to reflect the data practices enabled by BlueConic?

These questions frame the due diligence process; they do not replace a full security and legal review.

Next steps for evaluating trust

BlueConic offers real operational value for newsrooms struggling with fragmented audience data. The Post and Courier‘s results—40 percent churn reduction, 115 percent lift in content recirculation—demonstrate what’s possible when data consolidation enables personalized engagement.

But the trust question extends beyond functionality. News organizations hold reader data under an implicit social contract: that information shared through subscriptions, newsletter signups, and site visits will be handled responsibly. Outsourcing data management to a third party doesn’t transfer that responsibility; it adds a layer of vendor risk that must be evaluated and managed.

Newsrooms considering BlueConic should plan for a structured review involving data, legal, and editorial stakeholders. That process should include direct conversations with BlueConic’s security and compliance teams, detailed documentation of data flows and retention policies, and internal decisions about what data to collect in the first place.

Only with that groundwork can publishers decide whether the platform’s benefits justify the trust they’re placing in it—and whether they’re prepared to explain that decision to readers if questions arise.

Frequently Asked Questions

The post What newsrooms need to know about BlueConic security before signing a contract appeared first on The Media Copilot.

Google announced Thursday a new “AI Inbox” tab that reads every message in a user’s Gmail and generates to-do lists and topic summaries. The feature replaces the traditional email list with AI-curated action items.

Here’s the catch for newsrooms: AI Inbox is launching for consumer Gmail accounts only. Google Workspace users, including most news organizations, won’t see the feature yet.

The company is rolling out AI Inbox to “trusted testers” in the US through browsers first. In demos, the AI suggests tasks like rescheduling a dentist appointment, replying to a coach, and paying an upcoming fee. Each item links back to the original email for context.

Blake Barnes, Google’s VP of product for Gmail, told The Verge there’s no limit to how many to-dos the system might suggest. The feature prioritizes based on signals like who you email frequently and which messages you respond to quickest. But it can’t track whether you’ve actually completed a task. If you call someone instead of emailing them, Gmail won’t know.

Google is also making several paid AI features free for all consumer Gmail users: suggested replies with personalization, thread summaries, and the “Help Me Write” drafting tool. Subscribers paying $19.99 monthly for Google One AI Pro or $249.99 for Ultra get additional features including AI proofreading and inbox-wide search summaries. The latter lets users ask questions like “Who was the plumber that gave me a quote for the bathroom renovation last year?”

Users can disable Gmail’s AI features, though doing so also turns off other smart features like spell checking. Google says it won’t use Gmail content to train its Gemini models. “We didn’t just bolt AI onto Gmail,” Barnes told WIRED. “We built a secure privacy architecture, specifically for this moment.”

That’s reassuring. But Google’s own interface still displays a disclaimer that Gemini “can make mistakes” when searching inboxes and answering questions. For newsrooms, where accuracy matters and source relationships are built on trust, that caveat deserves attention.

Why journalists should care

When Workspace does get these features, newsrooms will face decisions they should be thinking through now.

Any AI system that processes email content creates a new surface for potential exposure of confidential communications, even if that data isn’t used for training. Sources who email tips expect those messages to stay between them and the reporter, not summarized by an algorithm. A whistleblower contacting an investigative team doesn’t want their message parsed into a to-do item that says “Follow up on financial documents from anonymous source.”

The risk isn’t necessarily that Google will misuse the data. It’s that AI processing adds another layer between source and journalist, another system that touches sensitive information, another potential point of failure in the chain of confidentiality.

There’s also the accuracy problem. WIRED’s Reece Rogers, who has tested Google’s email AI tools since 2023, wrote that he’ll be “confirming the contents of each task or suggestion and seeing what it might overlook.” Journalists can’t afford to miss a deadline or forget a source because an AI summary dropped a crucial detail.

What newsrooms should do now

Media organizations should establish clear policies before these features arrive: which accounts get AI features enabled, which stay manual, and how to communicate those boundaries to sources. Consider whether investigative teams or reporters handling sensitive beats should have AI features disabled by default.

The delay for Workspace accounts is a window to get ahead of this. Use it.

The post Google’s AI Inbox reads every message you receive. Source protection just got more complicated appeared first on The Media Copilot.

Publishers implementing bot monitoring tools face a data paradox. TollBit helps quantify AI scraping by analyzing traffic patterns, visitor identification and access logs—the same information that raises privacy concerns when processed by third-party platforms. Understanding which bots harvest content requires tracking who accesses what, when and how often.

Digital Trends implemented TollBit’s monitoring without major security concerns. The platform operates similarly to Google Analytics—tracking visitor behavior through lightweight JavaScript tags without accessing backend systems. But publishers considering adoption should understand what data gets processed, how TollBit handles that information and what risks remain even with standard security controls.

Risks identified in TollBit’s data processing

The primary risk with any analytics platform involves unintended data exposure through inadequate security controls, unauthorized access or service provider breaches. TollBit processes visitor IP addresses to distinguish bots from humans, access logs revealing which pages get scraped and traffic patterns showing scraping frequency over time.

For most publishers, this data processing parallels existing analytics tools. Google Analytics, Adobe Analytics and similar platforms already track visitor IPs, pageview patterns and referral sources. TollBit adds bot-specific monitoring without expanding the fundamental data collection publishers already conduct.

However, the licensing features introduce additional considerations. When publishers activate bot paywalls, TollBit handles transaction processing—metering content access, processing payments and managing invoicing. This financial layer adds payment data and commercial relationships to the information TollBit processes on publishers’ behalf.

Documentation doesn’t specify data retention periods beyond standard processing needs. Publishers with formal data destruction policies—mandated timelines for purging visitor logs, regulatory requirements around analytics data—need clarity on exactly how long TollBit retains IP addresses, access patterns and transaction records.

The bot detection methodology itself creates potential exposure. Identifying scrapers requires analyzing traffic patterns that might inadvertently capture information about human visitors misclassified as bots or legitimate tools flagged incorrectly. Misconfiguration could block accessibility services, research tools or other authorized access that publishers want to permit.

Security controls TollBit has implemented

TollBit operates as a data processor under a Data Processing Agreement with publishers. The platform processes limited personal data—primarily visitor IPs for bot detection—under publisher instructions rather than for independent purposes. The company states it doesn’t sell or share that personal data and uses subprocessors subject to security and contractual controls.

The monitoring implementation uses JavaScript tags similar to Google Analytics, operating at the application layer without requiring backend system access. This architecture limits exposure to frontend analytics data rather than sensitive backend systems, databases or user accounts.

For Digital Trends’ implementation, security considerations proved minimal. The monitoring tracks publicly visible traffic patterns—which pages get accessed, how frequently, by which identifiable bots. No confidential editorial content, unpublished materials or sensitive business data flows through TollBit’s systems.

Publishers activating monetization features should review TollBit’s Publisher Terms of Service for complete data processing details. The transaction infrastructure introduces payment processing—a regulated activity with specific security and compliance requirements beyond basic analytics.

The platform’s security posture reflects standard analytics practices rather than specialized protections for sensitive materials. Publishers comfortable with Google Analytics’ data handling will find TollBit’s approach comparable. Organizations with stricter requirements than standard analytics tools provide need custom data processing agreements or on-premises alternatives.

Security checklist for TollBit users

Before implementing TollBit’s monitoring or licensing features, verify the following:

• Does your organization’s privacy policy permit third-party traffic analytics processing visitor IPs?
• Are you comfortable with data processing equivalent to Google Analytics (JavaScript tags, visitor tracking, access logging)?
• Do you have formal data retention policies requiring specific purge timelines for visitor logs?
• Would bot misclassification accidentally blocking legitimate accessibility tools or research access violate your editorial principles?
• If activating monetization, does your organization require specific payment processing compliance (PCI-DSS, financial regulations)?
• Do you need custom Data Processing Agreements specifying retention, deletion and breach notification beyond standard terms?
• Are you subject to regional data protection regulations (GDPR, CCPA) requiring specific visitor consent for analytics tracking?

Organizations answering “yes” to formal retention policies, payment compliance requirements or regional data protection regulations should review TollBit’s Publisher Terms of Service and potentially request custom Data Processing Agreements before implementation.

Publishers handling public-facing content without unusual security requirements will find TollBit’s monitoring comparable to existing analytics tools. The platform adds bot-specific visibility without fundamentally changing data processing practices most publishers already conduct.

Organizations can review TollBit’s complete data processing and privacy terms at tollbit.com. For most publishers implementing monitoring only, security considerations parallel standard analytics tools without introducing novel risks.

Frequently Asked Questions

The post What publishers need to know about TollBit’s data handling appeared first on The Media Copilot.

For nonprofit news organizations, donor data is sensitive in ways that go beyond financial compliance. Supporters expect their contributions to be handled securely, and any platform that sits between a newsroom and its readers carries reputational risk.

Givebutter markets itself as a free-tier fundraising solution for nonprofits, including news outlets exploring reader revenue. But “free” comes with conditions, and newsrooms should understand what they’re trading before committing.

Risks identified in Givebutter’s model

The platform’s business model introduces several considerations for organizations that prioritize transparency and data control.

Tip-based revenue. Givebutter’s free tier asks donors to add an optional tip at checkout. If donors decline, the organization pays a 3 percent platform fee on top of standard card processing costs. This model may feel uncomfortable for newsrooms that want to minimize friction or avoid the appearance of asking readers for extra money.

If optional tips are disabled, that processing fee will be assessed. Organizations can ask or even require the donors to cover the fees, or hide the fees and absorb the costs themselves.
For newsrooms testing reader support without committing to monthly software costs, this model lowers the barrier to entry. Organizations can launch a campaign, see whether it gains traction, and upgrade later if the volume justifies it.
The trade-off is that the “free” label depends on donors agreeing to tip. Newsrooms uncomfortable asking readers for extra contributions should budget for the 3% fee as a baseline cost.

Limited transparency on security architecture. The available documentation focuses on setup, features and pricing rather than technical security controls. Details about encryption standards, access controls, data retention policies and incident response procedures are not specified in the source materials reviewed.

Newsrooms handling donor information—including names, email addresses and payment details—should seek this documentation directly from Givebutter before implementation.

Controls and practices that mitigate risk

Givebutter does include some features that support responsible data handling, though they require active configuration.

Dedicated account management. The platform recommends using a work email address for organizational accounts, separating personal and institutional access.

Bank account verification. Payouts require connected bank account information, adding a layer of financial control.

Fee transparency at checkout. Donors see the tip request and can decline, which maintains some transparency about how the platform generates revenue—though organizations must decide whether they’re comfortable with that dynamic.

Security checklist for Givebutter users

Before trusting Givebutter with donor data, newsrooms should verify the following:

• Has your organization reviewed Givebutter’s privacy policy and terms of service with legal counsel?
• Do you have a documented process for responding to donor requests for data access or deletion?
• Have you requested detailed security documentation from Givebutter covering encryption, access controls and data retention?
• Have you updated your public-facing privacy policy to disclose the use of Givebutter and what donor information is collected?
• Do you have a plan for extracting donor data if you decide to switch platforms?

These questions frame due diligence; they do not replace consultation with legal and technical advisors.

A pragmatic entry point with real limitations

Givebutter offers a genuinely low-cost way for nonprofit newsrooms to test reader-funded campaigns. Its free tier, flexible campaign types and simple setup process make it accessible to organizations without dedicated development resources.

For newsrooms running small-scale experiments with reader revenue, Givebutter may be a reasonable starting point. For those building long-term donor relationships or handling larger volumes of sensitive data, a more thorough evaluation—including direct conversations with Givebutter’s team about security practices—is warranted.

Accounts can be created at givebutter.com. Organizations with specific security or compliance requirements should contact the company directly for documentation beyond what is publicly available.

Correction: In a previous version of this post, Givebutter’s capitalization was incorrect. It’s “Givebutter.” Also, fee structure and interoperability with other fundraising platforms was listed incorrectly. The Media Copilot regrets the errors.

The post Nonprofit newsrooms and donor data security appeared first on The Media Copilot.