For people who already use Firefox on their iPhone, this is a welcome upgrade. It offers a quick way to see fewer ads without adding another app or changing browsers. Still, the feature only takes you so far. Search ads, ads served directly by the sites you visit, and Firefox’s own sponsored content will remain, and you get little say over what is blocked. How helpful this built-in blocker is really comes down to what you expect from it — and how many ads you're willing to ignore.

That also points to a wider iOS problem: the browser you choose largely decides which blocking tools you can use. We’ll come back to Apple’s role in that. First, let’s look at how Firefox’s blocker works and where it stops.

What Firefox's new blocker actually does

Firefox uses the content-blocking tools built into WebKit, Apple’s browser engine, together with rules from EasyList.

EasyList is a community-made filter list used by well-known blockers such as uBlock Origin and Adblock Plus.

A bit of history: AdGuard’s Base filter has always included most EasyList rules, but it has never been just EasyList: we’ve been developing and expanding it ourselves from the start.

Using the same list doesn’t guarantee the same results, though. These also depend on the other filters and filtering methods each blocker supports, how often its rules are updated, and what the operating system allows.

Mozilla says its built-in blocker stops many third-party ads — ads loaded from advertising networks separate from the site you’re visiting. Firefox blocks web addresses that match its filtering rules. It also stops some ad trackers and works alongside Enhanced Tracking Protection.

The blocker is free and turned off by default. To enable it, go to Settings → Browsing → Ad Blocker. According to Mozilla, the feature is rolling out gradually, so the option may not be available to everyone yet. It also requires the remote improvements setting to be enabled.

Because the blocker is baked into Firefox, it only filters content you open in that browser. If you switch to Safari, open the YouTube app, or play a game with ads, it won’t affect the advertising you see there. Its protection stops at Firefox, rather than covering your iPhone as a whole.

So, which ads still slip through?

Firefox’s built-in blocker won’t block these three main types of ads:

• First-party ads delivered directly by the website you’re visiting

• Ads in search results, such as sponsored results shown by Google, Bing, or other search engines

• Firefox’s own sponsored content, such as sponsored shortcuts on the new tab page

Why leave them in? First-party ads can be harder to block cleanly because their requests often come from the same website as the content. Blocking the website’s requests too broadly could also break the article, video, or other content you came for.

Search ads are a different case. Leaving them untouched makes sense for Mozilla’s wallet. Search partnerships are a major source of its income. In 2024, Mozilla received $498 million in royalties — around 73% of its $680 million in total revenue and support. The same logic applies to Firefox’s own sponsored content: these placements benefit Mozilla directly. But you can disable sponsored shortcuts separately in Firefox’s Homepage settings.

Customization is also pretty limited: you basically get an on/off switch. You can’t add more filter lists, write your own blocking rules, or tap an annoying element on a page to hide it. That keeps the feature easy to use, but it also leaves Firefox deciding what stays and what goes. If your goal is simply to see fewer ads in Firefox, turning on its blocker may be enough. But if you want to choose your filters, allow ads on specific sites, or decide whether search ads stay, Apple effectively pushes you towards Safari — the only browser on iOS where dedicated blockers get this level of access.

What free AdGuard for iOS offers

If Safari is your main browser, AdGuard for iOS offers more control even in its free version. You can choose filters for ads, trackers, websites in different languages, and annoyances such as cookie banners and social media widgets. You can also add favorite websites to your allowlist, so their ads remain visible while ads elsewhere are blocked.

In AdGuard for iOS, search ads are blocked under the default filter setup. If you want to see them, you can enable the optional Filter unblocking search ads and self-promotion. Here’s how the filter works.

There is one clear limit: in the free version of AdGuard for iOS, ad blocking is limited to Safari. Installing the app won’t block ads in Firefox or other apps. If you want to stay with Firefox and use a free blocker, Mozilla’s built-in feature is your best bet. If Safari is your main browser and you want more control, free AdGuard for iOS is the better fit.

That’s the free-to-free comparison. With AdGuard Premium, the picture changes: Safari gets stronger filtering, plus a separate DNS protection layer that works across browsers and apps on your iPhone.

What Premium adds to AdGuard for iOS

With Premium enabled, AdGuard for iOS goes further in two ways: it strengthens filtering in Safari and extends protection beyond the browser.

Advanced Protection helps with harder-to-block ads in Safari, including ads on YouTube. With it enabled, you can watch YouTube in Safari and have ads filtered automatically. For a more convenient option, you can find a video directly in the YouTube app, tap Share → More → Block YouTube Ads (by AdGuard), and it will open in AdGuard’s ad-free player.

The biggest difference from the free version is DNS protection. Once enabled, it can block connections to known advertising and tracking domains across all browsers and apps — including Firefox, Chrome, games, and shopping or news apps. Premium also unlocks custom filter lists and security filters. You can see the full comparison of free and paid features.

DNS protection still has its limits, though. Because it blocks whole domains, it can’t remove an ad served from the same domain as useful content without blocking that content too. It also can’t clean up the empty space a blocked ad leaves behind.

If Firefox is your main browser, the two blockers can work side by side. Firefox’s built-in blocker filters pages inside Firefox, while DNS protection in AdGuard for iOS blocks known ad and tracking domains across Firefox and other apps. They tackle different parts of the problem, so one doesn’t make the other redundant.

Why ad blocking on iOS is harder than it should be

Mozilla says the new Firefox blocker “illustrates a wider policy problem.” On desktop and Android, Firefox users can install independent add-ons, including ad blockers. On iOS, they don’t get the same choice. Apple’s App Review Guidelines generally require apps to remain self-contained and restrict them from downloading code that changes how they work. Mozilla says these rules, together with Apple’s browser policies, prevent it from bringing Firefox’s full add-on ecosystem to the iPhone. Instead, Mozilla has had to build ad blocking directly into Firefox.

That said, Apple does provide an official route for independent blockers on iOS — through Safari, and within limits it sets. Each content blocker can hold up to 150,000 filtering rules, and some rules that work on other platforms are not supported in Safari on iOS. To work around these limits, we split AdGuard’s filters across six content blockers and use a Safari web extension for Advanced Protection, which handles more complex ads.

Even with those workarounds, AdGuard’s page-level filtering remains tied to Safari and cannot simply be carried over to Firefox. DNS protection can block known advertising and tracking domains in Firefox, but it cannot inspect the page and remove individual elements in the same way. A dedicated iOS blocker can therefore add another layer of protection to Firefox, but it cannot work there as a full browser extension.

In our view, this gives Safari an anticompetitive advantage. Apple controls iOS, runs the main channel for distributing iPhone apps, and develops Safari. Its own browser supports independent blocking extensions, while competing browsers cannot give users the same freedom to choose their blocker. If getting the filtering tools you want means moving to Safari, Apple’s rules are already influencing your choice of browser.

Firefox’s new blocker is a useful response to these limits, but it doesn’t make dedicated blockers unnecessary. Building an effective blocker is not simply a matter of plugging in EasyList and calling it done. EasyList is a common foundation used across different blockers. Popular dedicated blockers build on it with a whole stack of additional filters, and those filters have to be constantly maintained as websites and advertising techniques change.

The real difference is focus. Ad blocking is one of many features a browser developer has to maintain. For us, a dedicated blocker, it is the main job. Firefox can keep improving its own tool, but users shouldn’t be limited to whatever their browser chooses to build. Only Apple can give Firefox users the same choice of independent blockers that Safari users already have. The ball is in Apple’s court.

A smarter Recent activity screen

Keeping track of network activity is about to get much easier. In v4.14, the Recent activity screen gains new filtering options that help you quickly find the information you’re looking for.

You’ll be able to filter network requests by criteria such as apps, companies, event types, and statuses. Whether you’re investigating a specific connection or simply exploring your device’s network activity, these filters make navigating large logs faster and more convenient.

Better compatibility for browser extensions

We’ve also improved how AdGuard filters traffic from browser proxy and VPN extensions.

In previous versions, traffic from these extensions had to be downgraded to HTTP/1 before it could be filtered. With v4.14, AdGuard now supports filtering over HTTP/2 and HTTP/3 as well. This means better compatibility with modern web technologies, more reliable protection, and a smoother browsing experience — all without compromising performance.

Stay in touch

We’re always looking for ways to make AdGuard for Android better, and your feedback plays an important role in shaping future updates. You can share your feedback through the Support section in the app or on our GitHub page.

To stay up to date with the latest AdGuard news and releases, follow us on X (formerly Twitter) and Instagram and join our Telegram and Reddit communities.

AdGuard is not alone in reaching this point. Chrome has now removed all remaining Manifest V2 extensions from the Chrome Web Store, closing the MV2 era for the entire ecosystem.

Manifest V2, or MV2, powered Chrome extensions, including some of the most capable ad blockers, for many years. But this final step is neither surprising nor sudden: we have seen it coming for the better part of a decade.

What AdGuard users need to do right now

For most existing AdGuard users in Chrome, the answer is simple: nothing.
Chrome has replaced MV2 with Manifest V3, or MV3 — the platform that Chrome extensions must now use. We rebuilt AdGuard Ad Blocker to work on MV3, and in September 2024, it became our primary Chrome extension. If you installed AdGuard from our Chrome Web Store page and allowed Chrome to update extensions normally, you have already been moved to the MV3 version automatically.

One exception applies to users who installed the separately listed AdGuard Ad Blocker MV2, which we continued to maintain alongside MV3. Because it has a different Chrome Web Store ID, Chrome treats it as a separate extension and cannot automatically replace it with the current MV3 version. If you installed this separate MV2 extension, you now need to install the current AdGuard Ad Blocker manually.

How we got here

Google introduced Manifest V3 in 2018, saying it would make browser extensions safer, more private, and more efficient. The Chrome Web Store did have a real problem with malicious extensions. But from the start, we doubted that MV3 was the right way to solve it.

We never said that Google set out to kill ad blockers. Our point was simpler: restricting every extension does not automatically make users safer, but it does take useful tools away from legitimate privacy extensions. Scam extensions did not disappear after the Chrome Web Store stopped accepting new MV2 submissions. We believed that stricter store moderation and closer cooperation with security experts would protect users more effectively.

Years of criticism and feedback made MV3 much more workable than the original proposal. Chrome added new APIs, raised its rule limits, and paused the phaseout before restarting it. This prevented the worst-case outcome, but it did not make MV3 equal to MV2. Delivering similar protection now takes much more work, and some MV2 capabilities still cannot be reproduced.

MV3 versus MV2: what actually changed?

Under MV2, an ad blocker could inspect each browser request as it happened and decide whether to allow or block it. Under MV3, the extension gives Chrome a list of blocking rules in advance, and Chrome makes most of those decisions itself.

This means the extension needs access to less browsing data, which is one of MV3’s intended privacy benefits. But it also limits what ad blockers can do — something we first warned about in January 2019, when MV3 was still only a proposal.

Under MV3, Chrome limits how many rules and groups of rules can be active at once. Some traditional rules cannot be converted into MV3’s format without losing functionality. Many built-in filtering rules have to be shipped as part of the extension, making urgent updates more difficult. Extension developers also have less freedom to introduce new blocking methods unless the browser’s APIs support them.

Adapting AdGuard required much more than changing a manifest file. We built tools to convert traditional filters into MV3 rules and kept our own engine for hiding ads and other unwanted elements on webpages. We also developed ways to deliver urgent fixes within MV3’s allowance for dynamic rules. More recently, custom filters in MV3 regained the ability to update independently of the extension itself.

For most users, AdGuard should work much as it did before. But MV3 is still a compromise. Providing a level of protection close to what was available under MV2 requires considerably more engineering, and there are still edge cases in which the old extension could do more.

Want to avoid Chrome’s MV3 limits?

Chrome is not the only option. If you want to keep using a full MV2 ad-blocking extension, Firefox continues to support MV2 and the powerful request-blocking mechanism Chrome removed.

Brave also supports a small selection of MV2 extensions, including AdGuard Ad Blocker and uBlock Origin, through its own backend. However, Brave describes this support as best-effort rather than a permanent guarantee.

Even MV2 extensions protect only your browser. For protection that does not depend on any browser’s extension rules, use a system-wide AdGuard app for Windows, Mac, Android, or Linux. It filters traffic across browsers and other applications.

On August 26, Vivaldi announced extension support in its latest Android Snapshot — a public, work-in-progress build used to test new features before they reach the stable version. Extensions can be installed from the Chrome Web Store, which Vivaldi automatically opens in desktop mode. However, not every extension will be compatible with the mobile browser, according to Vivaldi.

What is a Vivaldi Snapshot?

As Vivaldi explains, Snapshot users get early access to new features in exchange for testing them while they are still being refined. Extension support therefore remains experimental and may come with bugs. In fact, Vivaldi has already released another Snapshot containing several extension-related fixes and improvements.

How to install AdGuard in Vivaldi for Android

Vivaldi is based on Chromium, so many extensions developed for Chrome can also work in Vivaldi without a separate version. Mobile compatibility is not guaranteed for every extension listed in the store, but AdGuard Ad Blocker is one of the extensions that already works.

The installation process is not particularly mobile-native yet, but it only takes a few steps:

1. Install the latest Vivaldi Browser Snapshot on your Android device.
2. In Vivaldi, open the AdGuard Ad Blocker page in the Chrome Web Store. Vivaldi should switch the store to desktop mode automatically.
3. Tap the extension installation button and confirm that you want to add AdGuard.
4. Once it is installed, tap the puzzle-piece icon to the right of the address bar and select AdGuard Ad Blocker. Its settings will open in a regular Vivaldi tab.

Vivaldi already includes its own ad and tracker blocker, but extension support gives users more choice and lets existing AdGuard users access the filters and controls they are familiar with.

Not the first, but still good news

Vivaldi is not the first Chromium-based browser to support extensions on Android. Microsoft Edge, for example, already offers mobile extensions, including two made by AdGuard: AdGuard VPN and AdGuard Ad Blocker.

Still, Chromium-based browsers that support extensions on Android remain the exception rather than the rule. Vivaldi’s decision gives Android users another privacy-focused, customizable option and brings more of the desktop extension ecosystem to mobile devices.

For now, remember that the feature is experimental and some extensions may not work correctly. But if you are keen to try AdGuard in Vivaldi today, the route is simple: install Vivaldi Browser Snapshot, open the Chrome Web Store, and add AdGuard Ad Blocker.

But making AI work for you comes with a catch: once you share something with an AI service, you may not be able to fully take it back. A single study prompt, screenshot, or document can reveal your identity, private conversations, unpublished research, and sometimes other people’s sensitive data too. These seven habits will help you use AI without sharing more than you intended.

Jump to:
1. Files and screenshots · 2. Work and research data · 3. Group chats · 4. Personal essays · 5. Managed and shared devices · 6. AI data settings · 7. Sharing AI chats

1. Send the relevant excerpt, not the whole file or screen

The situation: You ask an AI assistant to review an assignment and upload the file with your name, email, class, and your tutor’s comments. For statistics homework, you send it the spreadsheet your group has been working in, complete with your classmates’ names, email addresses, and study year. Or you take a quick screenshot of something on your learning platform, forgetting that the browser window also shows your pinned tabs, open chats, account name, and notifications.

What are the risks: Once those details are uploaded, they are no longer sitting only on your device. They may be saved alongside the conversation and become part of AI training material. And if someone gets into your account or the AI service suffers a data breach, a quick request for study help could expose your personal information, your classmates’ details, or both. It is surprisingly easy to share too much. One university official wrote on Reddit that they had uploaded photos of sign-up sheets to Gemini, only to realize to their horror afterward that the images contained around 200 students’ email addresses. In Australia, a government employee uploaded a spreadsheet to ChatGPT containing names, contact details, addresses, dates of birth, sensitive health information, and financial commentary. The incident was classified as a data breach affecting over 2,000 people.

What to do: Give AI only what it needs, not everything you have. Paste the relevant passage and take a few seconds to check files and screenshots for names, email addresses, IDs, notifications, or anything else you did not mean to share.

2. Check which AI tools are approved before using work or research data

The situation: Many of us juggle work and study, so material from one easily finds its way into the other. Sometimes that is not carelessness: real company data may be part of the learning process. While working on an assignment in your personal AI account, you might ask the AI assistant about code from work, upload a company spreadsheet for data-analysis practice, or request feedback on an unpublished dissertation chapter.

What are the risks: A personal AI account may not have the protections or defaults required by your employer or university. Uploading confidential material could break an NDA or internal policy — and if the account or service is compromised, that information could be exposed. This has already caught people out. Samsung restricted generative AI after employees reportedly shared confidential source code and meeting information with ChatGPT. A PhD student also claimed on Reddit that findings from uploaded dissertation chapters later appeared in answers generated for a friend.

What to do: Use an AI service approved by your employer or university and remove details the tool does not need. If there is no approved service, keep company files, client information, unpublished findings, and anything covered by an NDA out of AI. You can still describe the problem in general terms without pasting the confidential material itself.

3. Summarize group chats yourself — or remove every name first

The situation: Your class or project chat has hundreds of messages, so you ask AI to summarize the decisions, deadlines, and tasks. But the screenshots or exported chat may also bring along people’s names, phone numbers, profile photos, personal comments, and arguments that have nothing to do with the assignment.

What are the risks: A group chat can reveal much more than expected: who people are, how to contact them, and what they discuss. Once sent to an AI service, those details may be stored with the conversation. If your account or the service is compromised, they could be exposed and help scammers create much more convincing phishing messages.

What to do: If possible, write a quick summary yourself and ask AI to turn it into a task list, meeting notes, or a study plan. That way, the assistant gets the information it needs without seeing the original conversation. If you do need to paste messages, remove names, usernames, phone numbers, profile photos, and other identifying details. Where the speakers matter, replace their names with labels such as Student A and Student B.

4. Remove identifying details from personal essays

The situation: You ask AI to edit a course application, scholarship form, résumé, cover letter, or a piece about your personal experience. Because more context often produces a better answer, it may be tempting to share a lot about your work, location, finances, health, or family.

What are the risks: A prompt does not need to contain your name to identify you. A distinctive combination of places, dates, institutions, and life events may be enough — and once the conversation has been stored, shared, or exposed, those details are difficult to take back.

What to do: Keep the context AI genuinely needs, but remove names, contact details, student numbers, exact dates and locations, and unnecessary references to a specific school or employer. A good rule of thumb is to write sensitive prompts as though the conversation could eventually become public.

5. Keep personal searches off managed and shared devices

The situation: You open an AI assistant on a school or work laptop, or on a shared computer in a library. You start with a study question, but because the conversation feels private, you gradually drift into personal topics.

What are the risks: The device or account other than your own or created by you may be monitored — and if you forget to log out of a shared computer, someone else could read your chats. Monitoring tools can scan messages, documents, and searches for signs of violence, self-harm, or other concerning behavior. They do not always understand context. In one case reported by the Associated Press, software flagged a joke written by a 13-year-old in a monitored school chat. She was arrested, interrogated, strip-searched, spent a night in jail, and was later placed under house arrest. That case is extreme, but the same privacy risk applies to shared computers in libraries, coworking spaces, and other public places too.

What to do: Assume that activity on a managed device or account may be visible to the institution. Keep personal conversations, private writing, and sensitive searches on your own device and account. Incognito mode may hide local browser history, but it does not stop monitoring built into the device or school system.

6. Turn off model training and use temporary chats for one-off questions

The situation: You use AI to summarize notes, check an assignment, or turn course materials into practice questions.

What are the risks: Depending on the service and settings, your prompts, replies, and uploaded files may remain in your chat history; details may carry into future chats; human reviewers may read some exchanges; and your content may be used to train AI models. Turning off memory does not necessarily stop training or delete past chats. In ChatGPT, regular chats remain in your history even if you turn off model training. Temporary chats are not saved to history and not used for training, but OpenAI may still retain them for up to 30 days, during which they may be reviewed. With regular Claude chats, content allowed for training may remain in de-identified training systems for up to five years, while deleted chats are normally removed from the back end within 30 days. Gemini warns that human reviewers may read some of the data it collects.

What to do: Check the service’s Privacy, Data Controls, Activity, or Model Improvement settings. Turn off optional training and use a temporary or incognito chat when you do not need to keep the conversation. Still, leave sensitive information out: the service has to process anything you send and may keep a copy for some time.

7. Move the answer to a clean chat before sharing it

The situation: You ask AI to help with an assignment, gradually adding notes, files, and personal context. Once the useful answer is ready, you create a link to send it to a classmate or someone else.

What are the risks: A share link may reveal the whole conversation, not just the answer you meant to send. Anyone who opens it could also see earlier prompts, then forward or save them. Some public links may also appear in search results, either directly or after being posted elsewhere. This has already happened on a large scale: one researcher collected nearly 100,000 publicly shared ChatGPT conversations, while more than 370,000 Grok chats reportedly appeared in search results, some containing personal information, business files, and a password. Public Claude links reportedly exposed health records, internal documents, and children’s contact details too.

What to do: Avoid sharing the original study chat. The safest option is to copy only the answer you need into a separate document and share that. But if you want others to see that it came from AI, ask the same question again in a clean chat, and check the full sharing preview. Open the link in a private browser window to see what others will see. Delete the shared link when it is no longer needed but remember that this cannot erase copies someone has already saved.

Desktop applications — music players, messengers, game launchers, and PDF readers — also connect to the Internet constantly. And just like websites, many of them send data about your actions. The difference is that you cannot see this traffic without filtering your entire system.

This is why system-wide filtering is enabled by default in AdGuard for Windows v8.0. It provides the only reliable way to protect your privacy across all applications without breaking their functionality.

To see the actual scope of tracking happening on PC and how just browser protection is not enough, we conducted research.

A note on methodology

This was a single run on one machine with one user. The duration and usage scenarios varied slightly between apps, so we cannot directly compare one app to another. We also anonymized the names of the companies to keep the focus on the technical patterns rather than specific brands. The goal was to identify how tracking works in desktop environments, not to create a ranking.

What we found

Across 18 applications, our testing revealed 1,965 unique server endpoints generating 4,945 individual web requests.

AdGuard intercepted and cleaned requests to 1,780 of these endpoints, removing invasive headers rather than blocking the connections completely. Additionally, AdGuard blocked outbound calls outright when their sole purpose was tracking or ad delivery — entire request batches to known telemetry endpoints were rejected before they ever reached the network, not just stripped of headers.

While functional requests make up a substantial part of the total traffic volume, AdGuard’s Stealth mode still had to clean invasive headers on almost 90% of all endpoints — including plenty of ordinary, purely functional requests, not just tracking ones. What’s genuinely striking: 15 of the 18 apps we tested (83%) made at least one request we classified as tracking or advertising. Small telemetry payloads fire rapidly in the background, building a detailed profile of your behavior over time.

What desktop tracking looks like in practice

Abstract statistics can feel distant. In practice, desktop applications translate your everyday actions into detailed network requests. An online game store tracks cursor movement and your account ID when you hover over a game card. A gaming console app sends your gamertag and device ID every 29 seconds, while a short-video platform’s browser engine sends a diagnostic beacon to its own servers every 60 seconds, tagged with a persistent device identifier — regardless of what’s on the screen.

Even a standard PDF reader logs button clicks, sending a separate request when you cancel a sign-in. A music streaming service uploads playback events every four seconds, including the exact track position, laptop model, and audio output details. A video platform’s request reveals your viewer profile in plain, unobfuscated query parameters — including membership status and region — visible once the connection is inspected locally.

You might think: “So what if an app logs a button click or my laptop model?”

Individually, these data points seem harmless. But together, they build a detailed profile of your behavior. Companies use this profile to track you across apps, adjust prices based on your device, and target you with ads. It also means your history is permanently tied to your identity and is at risk if the vendor’s servers are ever compromised.

The same receivers everywhere

We expected different companies to use different tracking tools. Instead, we found the same receivers appearing across unrelated applications.

A single Microsoft client ID appeared in four completely different apps: a messenger, a gaming console app, a music player, and a torrent client. This happens because many desktop apps are built using a web-view technology that includes browser telemetry by default.

We also found standard web analytics tools like Google Analytics and Google Tag Manager running inside desktop processes, not just in browsers.

Most importantly, the majority of tracking traffic did not go to third parties. It went directly to the servers of the app developer. This is not necessarily worse than third-party tracking, but it makes it harder to block. You cannot simply cut off the developer without losing access to the app itself.

Silent background chatter

One of the most surprising findings was the frequency of background activity. Desktop apps do not wait for you to click buttons to start sending data.

Over 20% of the apps we tested send telemetry on automated timers without any user interaction. You can open an application, step away from your desk, and return to find dozens of outbound pings logged while your PC sat completely idle.

These background pings range from high-frequency performance logs uploaded every single second to periodic system state reports sent on fixed background timers.

Why blocking domains is not enough

If tracking is this prevalent, the obvious question is: why not just block the domains that serve tracking purposes?

The problem is that desktop tracking rarely lives on separate “bad” domains. Instead, it usually resides on the same servers that power the app itself. In our tests, nearly 1 in 6 applications (17%) sent tracking or advertising data from the exact same hosts used for core functionality.

Imagine a music streaming service. It might use a single server domain to handle your account login, the music stream, and the telemetry data. If you block that domain to stop the tracking, you also stop the music.

This is why simple domain blocking fails. To stop this tracking without breaking your apps, we need a more precise tool that can distinguish between a functional request and a tracking request on the same server.

Our solution: system-wide filtering with HTTPS inspection

AdGuard for Windows solves this using path-level filtering.
Standard network filters can only see the destination server, but modern apps encrypt the rest of the connection. By decrypting traffic locally on your device, we can inspect the full URL path and request headers. This visibility allows us to clean invasive data and block specific tracking paths while letting functional requests pass through.

Domain blocking disables entire servers. Path-level HTTPS filtering inspects individual URLs to remove telemetry while keeping core app features running

We balance protection and stability with a smart system. We enable full HTTPS filtering for trusted apps like browsers. We exclude sensitive apps, such as banking apps, to keep your data secure. For other apps, we filter basic traffic but leave HTTPS filtering off. You can turn it on manually in App management if you want deeper protection. This lets you stop hidden tracking without breaking your apps.

Why it’s safe
All processing happens on your computer. Filtering with HTTPS inspection happens entirely on your device — the local component briefly decrypts a request to check its path and headers, the same way it does to clean invasive data.

What it does not do: store that content, or send it anywhere.

Every check is a local comparison against the blocklist, and the decrypted data is discarded immediately after the filtering decision. Your traffic never leaves your device for this purpose. The process is fast, designed not to impact your CPU or Internet speed.

Comparison of tracking protection methods

Conclusion

Desktop applications are no longer isolated from the web. They rely on complex networks of servers to function. These networks often carry hidden tracking data along with your work files. Traditional tools struggle to stop this tracking because they cannot see inside the encrypted connections of desktop apps.

AdGuard for Windows provides a better solution. By using path-level filtering, we can clean specific tracking requests while keeping your apps fully functional. This means your privacy stays in your hands without breaking the software you depend on.

Want to see it yourself?

Download AdGuard for Windows v8.0 and open the Filtering log. You can watch us block tracking requests from your desktop apps in real time.

The new version is currently in the early stages of rollout and we expect it to reach all existing users in the coming weeks.

A brand-new version, a new major number, a fresh design — and, most importantly, truly system-wide protection. AdGuard for Windows v8.0 doesn’t just look different: it gives you clearer control over the traffic on your computer and makes the most important settings easier to reach.

Ready to check it out? Just update your current app. If you’ve never tried AdGuard for Windows before, get the app by clicking the button below.

If you’d rather read first — here’s why this release is big enough to deserve a new number. There’s something here for power users, and something for those who simply want the clean, safe Internet without having to think about it.

Truly system-wide protection: why we filter all apps

Alongside the DNS filtering you already have, AdGuard offers full-fledged network-level filtering. This means stronger protection and more control: you can filter all Internet traffic on your device, so your protection is system-wide.

You might ask: why does system-wide filtering even matter? Isn’t blocking ads in browsers enough? On desktops, browsers still generate about 55–60% of total traffic — but that still leaves a huge share for other apps. Tracking inside apps is often even more invasive than on websites. Apps can access more personal data, interact directly with device resources, and use persistent identifiers that websites simply can’t. That’s why filtering all device traffic is so important.

Also, our research on popular Windows software showed that a significant share of telemetry and advertising requests comes from desktop apps — messengers, game launchers, media players, PDF readers and others — not just from websites. Many of these apps use the same domains for core functionality and for tracking, so simple domain blocking would break them.

To solve this, v8.0 uses path‑level HTTPS filtering and app‑specific rules that remove tracking requests while keeping the app’s main features intact. Filtering all apps by default ensures that you’re protected everywhere on your system, not only in the browser.

More about how desktop apps track you and why system‑wide filtering matters

Of course, DNS protection is still there — you can choose a DNS server and filter content that way. But DNS filtering is less flexible, and some tracking requests can still get through.

This is where HTTPS filtering becomes essential. With it enabled, AdGuard can inspect traffic within Windows apps. This allows us to distinguish between legitimate content and tracking requests, even when they come from the same domain.

For example, you open the Facebook app and just mind your own business. What you can’t see are the tracking requests immediately appearing in the background. The catch is that Facebook serves both legitimate content and tracking requests (like https://graph.facebook.com/network_ads) from the exact same domain. If you try to stop this tracking via DNS, you only have one choice: block the domain entirely. But doing that would break the app completely, meaning you couldn’t even log in or load your feed.

Network filtering lets us be much more precise here. By decrypting the traffic, AdGuard can identify the full URL and block only the tracking requests while leaving the rest of the app working just fine.

While HTTPS filtering is enabled for browsers by default, it is disabled for most other apps to ensure better compatibility. You can always enable it for extra protection: just select the application you want to filter in App management and toggle on Filter HTTPS traffic.

Speaking of App management: this new section, along with Statistics, gives you full control and transparency over what apps are doing on your PC.

See what your apps are doing and take control

To make managing traffic easier and give you a clear picture of what’s happening on your device, we’ve added two new sections: App management and Statistics.

What you can do in App management

App management lets you control how each app accesses the Internet. By default, AdGuard filters everything. As soon as an app goes online, it appears in App management, and its traffic is routed through AdGuard. From there, you can configure what to do with the app and how to filter it:

• Decide which apps have their traffic routed through AdGuard
• Choose to block ads and trackers in specific apps
• Enable HTTPS filtering in apps of your choice

We’ve also introduced Filter unknown apps, a new setting for handling apps that are not yet in the compatibility or exclusion lists. It’s on by default — new apps get regular filtering, while HTTPS interception stays off to avoid affecting app behavior. Read our Knowledge Base article for more details.

What you can see in Statistics

Statistics show detailed network activity. The Companies section provides a perspective on all the companies that your device has sent requests to, while in Apps and Domains you see the stats specific traffic data for every app routed through AdGuard.

Wondering which company’s requests are blocked most often? Which apps are trying to share your data and with whom? You can quickly identify and block anything suspicious.

Not only inside updates: A complete redesign

AdGuard for Windows has come a long way since its debut in 2009. Over the past 16 years, its interface has shifted alongside the changing web, evolving through versions 5, 6, and 7. For those who have been with us from the start, these might bring back some memories:

With version 8.0, we are opening a whole new chapter. The app has been completely redesigned from scratch. Our focus was on simplicity and ease of use. The most important tools are now front and center, while advanced settings are still available — just tucked away so they don’t overwhelm new users.

Let’s start with the basics and dive deeper the further we go.

Key settings in plain sight

The app is designed to let you enable everything you need straight from the first screen. Just click the symbols you see — they stand for blocking ads and trackers, handling cookie notices and similar annoyances, and DNS protection. Everything you need for smooth and secure browsing.

If you want to fine-tune your protection, head to the Protection section, where settings are clearly categorized and explained in simple terms and enabled by one toggle.

If you prefer a more personalized experience, adjust the settings further.

Tracking protection allows you to choose a level of protection — from a simple, comfortable experience to a more advanced one, which includes deleting cookies for enhanced privacy. There is also a custom level where you can freely fine-tune everything to suit your preferences: like blocking notifications from websites or enabling anti-DPI protection.

Prefer a more hands-on approach to filtering? You can find low-level and network settings in Settings → App settings.

Extensive testing and how we handle compatibility issues

Before releasing 8.0 we ran extensive internal testing on hundreds of applications, and the public beta program lasted more than six months. Our goal was to make sure that popular apps work correctly with the new filtering logic out of the box, without manual configuration.

In most cases, widely used applications should work normally after the upgrade. However, the Windows ecosystem is huge, and some apps or specific configurations can still cause edge cases.

If you encounter a broken app or unexpected behavior after upgrading to v8.0, please report it immediately via our GitHub repo or through support in the app. We treat such reports as high priority and will react quickly with hotfixes. Your feedback directly improves the compatibility lists that control how each app is filtered and routed.

RulesEditor: Easier rule management

The User rules section used to be little more than a plain text field. Now it’s built on RulesEditor, our own editor that comes with two ways of working: List view and Editor view.

In List view, you get checkboxes to enable or disable individual rules, a search bar, and an overflow menu with quick access to Rule syntax help, Import, Export, and Delete all options. There is also the Editor view for direct manual editing, and the Allowlist section now also runs on RulesEditor and has an improved overflow menu.

Have you already mastered the old editor? There’s no need to relearn anything. RulesEditor is designed to make editing and reviewing rules easier, without disrupting the workflow you’re used to.

Mail Tracking Protection: Take control of who tracks your emails

Ads and trackers aren’t limited to websites. Many marketing emails contain a tiny, invisible 1x1 image known as a tracking pixel. The moment you open the email, that pixel quietly reports back to the sender, often revealing when, where, and how you read it.

The tricky part is you can’t just block these pixels by their domain. Most major email service providers proxy all images in an email through their own servers before displaying them, so blocking the tracking pixel domain could break your entire inbox.

That’s why we built a Mail Tracking Protection filter, which recognizes and blocks tracking pixels without breaking the images you actually want to see.

Keep track of filter updates

Previously, the Filters tab in MV3 settings showed the extension update date for all filters. That wasn’t always accurate, since filter and extension updates often run on different schedules. We updated the filter metadata handling, so the Last updated field now shows each filter’s actual update date.

New modifier for advanced users

For advanced filter makers, v5.5 adds support for the $urltransform modifier, which lets a rule rewrite parts of a URL — such as its path or query string — before the request goes out, including redirects handled through Chrome’s MV3 declarativeNetRequest API.

This makes it possible to handle tracking parameters and other unwanted bits of a URL with precision, without blocking the request outright. Here’s an example:

||example.com^$urltransform=/regex/replacement/

This tells the extension to transform matching URLs according to the specified pattern rather than simply allowing or blocking them.

Your feedback matters

Your feedback shapes our future improvements and fixes. Update your extension to see what changed and let us know what you think on Github and social media.

Microsoft’s announcement has prompted the same kind of alarming headlines that accompanied Chrome’s own transition to Manifest V3. They warn that Edge is about to “lock out older ad blockers” or “neuter adblockers.” The reality is less apocalyptic, but it is not quite as painless as Microsoft itself might suggest.

Ad blockers will survive in Edge. But Manifest V3 gives extensions less control over network requests, restricts how many filtering rules they can use, and makes rapid filter updates more difficult. Preserving almost the same level of protection is possible, but it takes considerably more engineering work.

When will Edge disable Manifest V2 extensions?

Warnings begin appearing in August 2026, first in Edge Canary, Dev, and Beta. Microsoft will then gradually extend the phaseout to Stable Edge — the version used by ordinary users — with the consumer transition expected to finish by the end of 2026. Managed enterprise installations will have additional time, into early 2027. Microsoft has not announced a single cutoff date or Edge version for everyone.

Microsoft says 95% of extensions are ready — but what about the rest?

According to Microsoft, more than 95% of actively used Edge extensions have already moved to Manifest V3. Only 58 extensions with “meaningful usage” still rely on MV2, and three reportedly have no public MV3 alternative ready.

The number may sound small, but ad blockers and similar privacy extensions are likely overrepresented among the remaining 58. MV3 particularly affects extensions that inspect and modify web requests, which is central to how advanced content blocking traditionally worked.
Microsoft has not named the three extensions, and public Edge Store data cannot settle the question: it shows which manifest an extension uses, but not which MV3 product Microsoft considers its replacement.

Two strong candidates we found are AdNauseam, whose developers have said they lack the resources to produce a restricted MV3 version, and ClearURLs, whose proposed MV3 migration was closed as “not planned”. uBlock Origin is another ambiguous case. Its Edge version uses MV2, but a simpler extension, uBlock Origin Lite, is available under MV3. Whether Microsoft considers it a replacement is unclear. For what it is worth, uBO developer Raymond Hill explicitly said that there was “no Manifest v3 version of uBO.” He also explained that “uBOL was too different from uBO for it to silently replace uBO.”

uBOL can still be a good lightweight blocker, but it sacrifices advanced features that MV3 cannot support. As we explained in our article about uBlock Origin’s removal from Chrome, it is a pared-down alternative, not a true one-for-one replacement.

How Manifest V2 differs from Manifest V3

The difference between uBO and uBOL illustrates the broader trade-off imposed by MV3. Ad blockers must either give up certain features or invest years of work in rebuilding them within a more restrictive framework. The key change is who makes the blocking decision. Under MV2, an ad blocker could examine each request and respond in real time. Under MV3, it generally has to provide a predefined set of rules and let the browser apply them.

Google presented this as a way to make extensions safer, more private, and more efficient. That sounds reassuring, but our co-founder and CTO Andrey Meshkov has argued that limiting extensions does not automatically make their users safer. Scam extensions remained a problem even after the Chrome Web Store stopped accepting new MV2 extensions. In his view, stronger store moderation and closer cooperation with security experts would do more to protect users than simply giving legitimate extensions fewer tools.

For ad blockers, the practical consequences are specific and rather debilitating:

• Fewer rules and less flexibility. Browsers limit how many filters can be active, and some traditional filtering rules cannot be converted into MV3’s format without losing functionality.
• Slower filter updates. Many filters are now built into the extension, unlike it was with MV2, and normally update only when a new version passes store review. This makes reacting to newly introduced ads or broken websites more difficult.
• Slower innovation. Because the browser controls more of the filtering process, extensions cannot freely introduce new ways of handling requests. The feature must fit the browser’s existing rule system; otherwise, developers must build a workaround or wait for the browser to add the necessary capability.

Years of discussion and feedback from extension developers made MV3 considerably more workable. It became a lesser evil rather than the disaster many initially expected, but matching an MV2 extension’s capabilities still demands significantly more engineering resources. As Meshkov put it, the transition required “a huge effort from all parties involved.” Therefore, smaller and volunteer-run projects may be unable to keep up, or may survive only in a more limited form.

How AdGuard survived Manifest V3

For our part, we started preparing already in mid-2021 and released the world’s first working MV3 ad blocker prototype in 2022. After two more years of development, the release version became our main extension for Chrome in September 2024.

This required considerably more than changing a manifest file. We built tools to convert traditional filters into MV3 rules and continued handling cosmetic filtering — the removal of banners, placeholders, and other unwanted page elements — with our own engine.

We also introduced the AdGuard Quick Fixes filter. MV3 does not normally allow built-in filters to update independently of the extension, but Quick Fixes uses the limited allowance for dynamic rules to respond to urgent problems without waiting for a complete extension update to pass store review.

Some restrictions remain. Rule counts are limited, certain filtering techniques cannot be reproduced exactly, and most filter updates must still be delivered with the extension itself. Maintaining functionality close to our MV2 version therefore takes more work, while some improvements may take longer to reach users.

Still, most people should see little difference in everyday filtering. In his latest assessment, Meshkov noted: “We were never thrilled about the move to MV3, but the predicted apocalypse never arrived.”

What will happen to AdGuard Ad Blocker in Edge?

The AdGuard Ad Blocker currently available from Edge Add-ons still uses Manifest V2. Edge users can continue using it while the browser supports MV2 — there is no need to replace or reinstall it immediately.

We will bring our MV3 extension to the Edge store by the time Microsoft’s phaseout reaches regular Edge users. We cannot provide an exact date yet because we are still clarifying how Edge will review updates containing new filter versions. Under MV3, this process is especially important because most filters are packaged inside the extension.

Users who specifically want to move to MV3 on Edge now can install our Chrome Web Store version in Edge. Since Edge is based on Chromium — the same foundation as Chrome — the extension should work and receive updates in much the same way, although we have not exhaustively tested every Edge-specific scenario.

Users who want to retain the full capabilities of the AdGuard ad blocking extension can also consider Firefox, which continues to support the blocking functionality that MV3 removed from Chromium browsers.
The most durable option, however, is protection that does not depend on any browser’s extension platform. System-wide AdGuard apps for Windows, Mac, and Android protect browsers and other applications at the device level. Therefore any changes to Edge, Chrome, or any other individual browser therefore cannot take that protection away.

Report alias issues from the app

Ever had a website refuse to accept an alias? Previously, you had to describe the issue from scratch to send it to support. Now you can report alias issues straight from the app. Here’s how:

1. Go to the Aliases section.
2. Click the exclamation mark icon in the top-right corner.
   
3. If a website or service won’t accept your alias, choose Address not accepted by the website, then Continue. You will be taken straight to our feedback form.
   
4. For anything else, click Other, then Continue to describe the issue in detail and send it to support.

Keep track of all the changes

You can now access our full update history via the AdGuard Mail app. Go to Settings → About → Version history to see every fix and improvement, all in one place.

Smoother logs and better review flow

We’ve cleaned up the process for saving the app logs on mobile devices. Go to Support → Export logs and system info and tap Save. You’ll get an in-app confirmation that your logs were saved successfully, so you won’t have to wonder if it worked. Besides, you’ll be able to share the logs via email or any other preferred method.

We’ve also slightly refined our in-app review flow. As with the other changes in this update, the goal is the same: to make it easier for you to reach us and for us to act on what you tell us.

Never enough feedback

As always, if you have any suggestions, ideas, bug reports, or if you just want to share your experience, please send us your feedback via the
AdGuard Mail form.

For more information about AdGuard Mail, visit our website.

This is the way of life, this is how we as humanity believe things should be. You write a will, and when you are no more, everything you leave after yourself goes where you intended. But what was clear and relatively straightforward throughout most of human history gets a little blurred when we start talking about digital legacy.

Over our lives, we accumulate an insane number of digital assets, things that hold either tangible or sentimental value. From those that are easier to evaluate like cryptocurrencies, domain names, online businesses, and various libraries like Netflix and Steam, to more ephemeral ones like photos and videos in cloud storage, social media and email accounts. Yes, you don’t have to do anything with any of these or think about it at all. But if you care about your physical legacy, why wouldn’t you treat the digital one the same way?

Imagine that you have two houses, but only leave to your kids the keys to one of them, and the other one you don’t as much as mention in your will. The house will stand there growing moss, all the while the rent keeps running the same way your accounts will keep getting charged for subscriptions if left unattended. And with the huge scale of our online presence, this analogy is not as outrageous as it may sound at first. In fact, it might be even messier than that — because unlike that second house, your digital assets don’t just sit still. They can be stolen, cloned, mined for data, or turned into an AI version of you without anyone asking for permission.

We trust that you can sort out the physical side of your will without our help. But how do you actually make sure that everything will be in order with the digital part of your life after you pass away? Before we start giving actionable advice, let’s go over what requires our attention and why.

• Tangible assets. Cryptocurrencies, domain names, subscription libraries. This is the category that is the closest to the traditional, physical inheritance. You want to ensure that your intended heirs will be able to benefit from your digital assets, but figuring out the best way to ensure it may not be so clear-cut.
• Things that hold sentimental value. This is where things start to get blurry. You can’t put a price tag on the photos you store in your cloud storage, but your friends and family members still probably wouldn’t want them to get lost forever.
• Your image and identity. How will people remember you? What will they think about you, if at all? Even the most cynical of us probably wouldn’t want someone to hijack their persona to carry out scams and other shady schemes.

Sometimes, a certain thing doesn’t fall firmly into this or that bucket. For example, your Google account can be key to access your crypto wallet backup, contain photos of your children, and also store years and years of emails with your unique voice and opinions — you can make an argument for it to belong to any of the categories we outlined, or to all three at once. Whenever this happens, we will try to be as clear and precise in wording as possible to avoid any confusion. We also included a separate actionable ‘cheat sheet’ at the end of the article, so if you decide to clean up your digital life, you can refer to it instead of scrolling back and forth, trying to tie together several different pieces of advice.

Chapter 1: Tangible things

When it comes to the post-mortem management of your digital assets, there are two major risks: that they fall into the wrong hands and that the intended recipients can’t access them. Luckily, both of these problems usually can be solved simultaneously by the same precautions.

The most obvious asset from this category is, of course, cryptocurrency. Its defining feature is that because of how seed phrases work, crypto is one of the few assets that can be permanently lost and instantly stolen. If you have any, and nowadays many do, the tricky part is making sure the intended person gets access to it after your passing, but not creating a vulnerability in the process. There are a few ways to do that.

You could create a multi-signature wallet that requires 2 or 3 keys to authorize a transaction. You hold one key, another one can be stored somewhere safe like a bank safe deposit box, the third one can be placed with someone trusted, for example. This way, no single person can feasibly steal your funds while you are alive, but it is relatively easy for your heirs to combine the keys after your death. Another similar method is called the Shamir’s secret sharing scheme, in which a seed phrase is divided into several fragments that are distributed among trusted people. A certain threshold of fragments is required to reconstruct the phrase, so this scheme greatly reduces the risk of losing your funds while making it easy for the future heirs to obtain them. There are other ways, but most of them involve splitting the seed phrase into parts one way or another, or otherwise ensuring that no single person or entity holds keys to your crypto. Whatever you do, do not put everything in one place and never put your private keys and seed phrases directly in your will — wills can become public documents, and crypto and publicity do not go very well together.

Besides security issues, there is also a legal angle. While you should never include your seed phrases, PINs, or passwords into your will, you should identify the assets and name beneficiaries there. Use a separate, non-public letter with instructions on how to access the keys. Remember that the person or persons who you leave your crypto assets to may not be technically fluent and may need a plain-language document that explains everything there is to know in an easy-to-understand way.

You may ask, why couldn’t you just skip a step, omit the crypto assets from your will, and do everything ‘quietly.’ You could, and many people do just that, but this is technically illegal. The blockchain doesn’t care who the person doing the transactions is, as long as they have the necessary keys. But sidestepping all the legal processes is potentially fraught with many problems for the beneficiary if there is any debt involved or if there are relatives who want to dispute the will, not to mention that this is straight-up tax fraud. In practice, if the amount of crypto that you leave is small, the ‘quiet’ way may work (which doesn’t make it any more legal), but by omitting any substantial crypto funds from the will you are likely only doing a disservice to the future heir, who will be the one dealing with all the potential aftermath.

We dedicated a lot to cryptocurrency because it is, perhaps, the most common digital asset to inherit. Let’s now move on to other types of tangible assets, and let’s pick up the pace a little. We will start with subscription libraries.

When it comes to things like Netflix or Steam, the biggest problem is, you almost never actually own your account, you license it instead. Imagine you buy GTA 6 on Steam — you are not acquiring any property. You're entering a personal license agreement with the company who lets you play the game. With streaming services like Hulu or Amazon Prime, they operate on non-transferable licenses — the subscription is tied specifically to you and is not an inheritable asset. Netflix’s ToS prohibit transferring your account to anyone else — which effectively rules out passing it on by will. Steam’s ToS more or less say the same. So case closed?

Not quite. The reality of the situation depends on where you live. In the US, depending on the state, some legal commentators claim that the state inheritance laws might actually override Steam's ToS. In practice, however, such a case has never reached the court. On the other hand, in Germany, the Federal Court of Justice (BGH) ruled in 2018 that digital accounts are inheritable like physical property. And in December 2024, an appeals court went further, ruling that heirs can actively continue using an Instagram account after the owner's death.

Summing it all up, despite the varying and often vague legal status of passing on your music, video, and gaming libraries, people do it all the time. Platforms very rarely enforce it, and there has not been a legal case that would result in any prosecution. At most, the account will be closed if a company detects unauthorized use. There is a kind of status quo — people very rarely include any account credentials in their wills and just leave the passwords to their heirs on a piece of paper, and the companies do not bother with any legal action if it ever comes up.

Let’s quickly go over other tangible assets that you may want to bequeath:

• Online-only banks. This is just money, the online nature doesn’t meaningfully change anything about the inheritance process. You may include it in your will like any other money asset.
• Payment apps (PayPal, Venmo, etc). The money is inheritable, the account is not. Details depend on the app, but generally the executor of the will should close the account upon the deceased’s death and transfer the funds to the linked bank account.
• Domain names. As you can fully own domain names, they are 100% an inheritable property and you should list any valuable domain names in your will. It is also a good idea to keep them on auto-renew, so they don’t expire and get snatched by digital squatters.
• Online businesses. They are inheritable, but heavily platform-dependent. Some can be inherited directly, some can have multiple administrators, some (like YouTube) may require explicitly authorized succession. You will have to check the terms of every online business you run separately and act accordingly.
• Your mobile phone. While this is not a digital asset and very much a physical one, it is the key to two-factor authentication for countless apps and services, so securing it in your will should be a priority. And make sure to leave instructions as to how to unlock it if you don’t want your heir to go to court over it!

Bequeathing your tangible digital assets may be complicated in the sense that you often need to follow very specific legal procedures and generally be very precise with how you plan to pass them on. But looking at it from a different angle, it is the most straightforward part of your will, as it deals with very concrete things like money or domain names. With things whose value is not monetary, it may not be as simple.

Chapter 2: All things sentimental

Making sure your heirs benefit monetarily is important, but — at least we hope so — your friends and relatives don’t love you for your money, but instead for the person you are and for the memories you have had together. In that sense, securing things that hold sentimental value, like photos and videos, is even more of a priority. And the fact that they are not literally worth money doesn’t mean that there are no potential malefactors looking to steal them for nefarious purposes. And cloud storage is not your grandma’s photo stash that could sit in the attic for years until you finally get to it — inactive accounts often get deleted within a year or two, so you need to plan for it properly.

Before you do anything else, mentally divide your digital life into two piles — one that you want your family to receive after your passing, and one that you want to vanish with you. It may not be much fun to churn through tens of thousands of photos and piles of digital documents, but if you don’t do it, your heirs will have to, and this may become more of a chore and a burden than an occasion for a somber moment of remembrance. Not to mention that some of the things you may not want to leave behind. Not necessarily because they are incriminating or anything like that, but because not everything that at some point was valuable to you will be valuable to others. Not every DM you had with your electrician needs to be saved, not every photo of a random cat you saw on the street has to go into the family album.

For the shareable pile, the tools already exist. Google’s Inactive Account Manager lets you name up to ten trusted contacts and choose exactly which data each one receives after a period of inactivity. Apple’s Legacy Contact gives a trusted person access to your photos, messages, and files after death — but deliberately not your passwords or purchased content. Facebook’s memorialization is built in a way that allows your profile to live on as a tribute — your legacy contact can pin a post and accept friend requests — but importantly no one can log into it and read your DMs. Not every major platform does it, though. Instagram, for example, offers no legacy contact option. A family member can either memorialize or delete the account, with nothing in between.

It’s worth noting that while memorialization is supposed to be a security feature, not a vulnerability, it is not foolproof. It is possible for malicious agents to hack the account of the ‘caretaker,’ to hijack the associated email account, or just to act before the relatives memorialize your account — it is usually not the first thing on the mind after a person passes away. It’s also important to understand that memorialized accounts’ public content stays public, meaning they can still be scraped for AI training data or for impersonation purposes: roughly a quarter of all identities stolen every year belong to the deceased. Not to mention that if the account is not deleted altogether, its data may get leaked in a breach incident.

It may be a better alternative to set your accounts to be deleted rather than memorialized. On Facebook you can choose this in your Memorialization Settings while you are alive, and note the same wish in your will. However, platform settings often outrank wills, and your executor will still need to act on it. This means that you will need to do some work manually curating and maintaining the folder with photos and videos you want to be shared with your family rather than rely on the ready-made mechanisms. But it will also allow you to avoid oversharing: you can store everything you deem not suited for others’ eyes to see in a separate private archive or an encrypted container and simply not give anyone the key. You should also put a heavy emphasis on securing your email account first, because it often serves as a master key for all your social media. But this is something we will touch upon in the next chapter.

One grim thing to remember is that dead people have close to zero rights to privacy. GDPR explicitly excludes the deceased persons, the US has no federal post-mortem privacy law either. So unlike with tangible assets, here you should not rely on legal procedures but rather on specific tools, and you should choose those tools wisely.

Chapter 3: Your legacy and image

When it comes to your digital legacy, your direct heirs will care about tangible things like cryptocurrencies. Your friends and other family members will surely want to have something to remember you by, like photos or your voice recordings. But, somewhat ironically, it is probably you who is the most concerned about your reputation and how you will be remembered. So it falls on you to set up the defenses against those who may try to abuse your image after your passing.

As we mentioned earlier, there is no shortage of less-than-honest people who are preying on deceased people’s identities for all imaginable purposes. Your social security number, other IDs, your address and birth date — they all sit in databases even after you die and are vulnerable to breaches and data leaks. Criminals abuse them to file fake tax returns or take out loans in your name. So what can you do?

First of all, keep a clear inventory of your accounts and documents. If you don’t know what is important, you won’t know how to protect it. The article is about digital legacy, but keeping physical IDs like passports safe is equally important and tightly linked to the safety of your digital records. Tell your family where these documents are, or at least keep them in a place where only a trusted person could find them. Make sure that your executor notifies the credit bureaus so your file gets flagged as deceased — in the US, notifying any one of the big three (Equifax, Experian, or TransUnion) is enough.

Now to the more disturbing part of the issue. There is something unsettling about the thought that you may not be ‘you’ anymore after you die, that others will remember someone you never were. Up until recently, this was just a figure of speech, a way to acknowledge that memories fade and stories get retold, sometimes beyond recognition. But technology has made it frighteningly literal. Artificial intelligence can now study everything you ever typed, said, or posted, and build a version of you that keeps talking long after you’re gone. And some companies already offer AI chatbots trained on a deceased person’s texts, emails, voice recordings, social media. Some people even commission their own ‘AI ghost’ while they are alive, and if you find that appealing, no judgement from us. But the problem is, if you don’t want that fate for yourself, there is nothing you can do about it once you’re gone. Dead people can’t consent. So state your wishes explicitly in the digital instructions you leave to your family. They may not be legally binding, but they will give your will’s executors a clear directive.

But perhaps an even better way to prevent the creation of your digital avatar is to starve it of training data. And that data comes from a lifetime of posts, preferences, voice and video recordings, and photos you leave behind. AI companies have been scraping public content into training sets for years, and will no doubt continue to do so going forward. But this is, surprisingly, not bad, but rather good news: this is exactly what you can affect while you are alive! Minimize your digital trail during your life: delete your unused accounts, tighten privacy on public content, request removal from data broker sites. By the way, this advice loops back to the second chapter: the less information you store publicly, the less you will need to worry about preserving it for the family. The photos of you playing with your children back when they were little will bring them just as much happiness (if not more) if you pass them on privately, compared to just leaving them on Facebook for everyone to see.

And above all, secure your email account. We keep repeating this advice, and for a good reason. Similar to your phone, your inbox is the master key to your digital life. Almost every password reset and account recovery flows through it. Store the password and recovery codes with your estate documents (never in the will — it may become public), and enable your password manager’s emergency access for a trusted person.

Bonus chapter: Cheat sheet

This was a lot of words to get through! It wouldn’t be fair to leave you without something more actionable than a wall of text, so here is a promised cheat sheet that you can go over much more easily if you ever decide to sort out your digital life.

1. Inventory. Make a complete list of your accounts (email, social media, cloud, crypto, banking, subscriptions, domains, online businesses, etc.) with usernames and purposes; store it in a password manager, tell a trusted person where it lives, update it regularly, and keep physical IDs (passport, etc.) in a known safe place.

2. Crypto. Split access using one of the tried and trusted methods. Never put seed phrases, keys, or passwords in your will (it may become public); name beneficiaries in the will, keep access instructions in a separate non-public letter with a plain-language guide for non-technical heirs. Don’t quietly omit crypto from the estate — that’s tax fraud and invites disputes.

3. Other money-related assets. For funds stored in online-only banks, include them in your will like any other money, there is little difference. For domain names, list valuable ones in the will and keep them on auto-renew. For payment apps (PayPal, Venmo), check the app’s specifics; usually the executor closes the account and transfers funds. Same for online businesses: check each platform’s specific inheritance rules.

4. Subscriptions. For most subscription services like Netflix and Steam, accounts are licensed, not owned, and ToS prohibit their transfer. In practice heirs use them informally, which may result in account closure but almost never in legal trouble. Leave credentials with your other passwords.

5. Memories. Split your digital life into two piles — what family should get vs. what should vanish with you. Curate a shareable folder of photos and videos, and put everything private in an encrypted archive and don’t give anyone the key.

6. Social media and cloud storage. Many platforms (Google, Apple, Facebook) offer various legacy contact options, but not all do (Instagram). Keep in mind that memorialized content stays public and can still be scraped, hacked, or leaked in breaches — if you don’t want that, store your photos and videos in a different place and choose account deletion instead.

7. Identity. Protect your post-mortem identity from being stolen and abused. Make sure the executor notifies credit bureaus promptly (US: one of Equifax, Experian, or TransUnion is enough; check your country’s equivalent). While alive, delete unused accounts, tighten privacy on public content, and request removal from data broker sites to minimize digital footprint that can be used to impersonate you and even to create your digital avatar. State explicitly in your digital instructions if you do not consent to being recreated as an AI, avatar, or griefbot.

8. Email. Email is the master key to your numerous accounts. Store the password and recovery codes with your estate documents (never in the will). Set up your password manager’s emergency access for a trusted person and make sure your 2FA won’t lock your heirs out. Ensure your heirs receive your phone and know how to unlock it. It plays a similar role to email as a master key as it is required for many 2FAs.

In AdGuard Mini for Mac v2.3, we’ve added setup checks and new warnings. The app can now detect common problems, explain what needs attention, and suggest what to do next.

Recommendations that point you to the problem

Sometimes filtering breaks for reasons that aren’t obvious. After a macOS update or system migration, a required permission may be lost, a Safari extension may be disabled, or filter lists may fail to update. From the user’s side, it may simply look like AdGuard Mini stopped blocking ads.

Now the app can detect these issues and explain what needs attention. Each recommendation explains what happened and offers the next step.

There are two types of alerts:

Critical recommendations are highlighted in orange. They point to issues that may prevent protection from working properly, such as disabled Safari extensions, missing background permission, Safari extension errors, or rules that can’t be applied because Safari’s rule limit has been reached.

Standard recommendations are shown in grey. They are less urgent, but still affect protection quality, such as outdated filter lists, disabled ad blocking, or disabled annoyance blocking.

This means you don’t have to search through settings or guess what changed. AdGuard Mini shows what needs attention and helps you get filtering back to normal faster.

Better diagnostics for less obvious problems

Not every problem starts with one obvious setting. Sometimes users notice higher CPU or memory usage. Sometimes filtering changes after migrating to a new Mac, restoring from a backup, or adjusting the app configuration.

We’ve improved diagnostics for these cases too. When users need help, the app can now provide our support team with clearer information about what’s happening. This makes harder-to-catch issues easier to investigate.

Tell us what you think

Your feedback helps us make AdGuard Mini for Mac better. If you have requests or suggestions, share them on GitHub, on social media, or through the Support section inside the app.

AdGuard for Android v4.13 introduces differential filter updates and presents notable improvements, such as secured integration with AdGuard VPN, CRLite and post-quantum cryptography support. Plus, we expanded the list of in-app instructions for installing HTTPS certificates. Let us elaborate further below.

Differential filter updates

Until now, filter updates could take a long time to reach the app. That created two problems: users had to wait too long for changes to arrive, and full filter downloads consumed a lot of mobile data.

We’ve solved this by integrating AdGuardTeam/FilterListManager into AdGuard for Android. Instead of downloading entire filters every time, the app can now get only what has changed. That makes updates much faster and much easier on traffic.

This also changes the product logic around filter update intervals. The idea of “updating filters every X hours” is becoming less important, because filters will now update automatically as soon as possible.

CRLite support for a faster and more secure browsing

We have implemented the CRLite technology by Mozilla in CoreLibs, our filtering engine. It is designed to verify revoked security certificates for websites. Compared to the more outdated Online Certificate Status Protocol (OCSP), or checking each certificate against the CRL (Certificate Revocation List), CRLite not only speeds up website loading, but also increases your privacy and safety while browsing. Instead of connecting to a third-party server to check a website’s certificate across an extensive and data-heavy list, the newer approach allows the app to do security checks locally on your device, making the process faster and keeping it entirely private.

A secured integration with AdGuard VPN

To improve security in Integration mode with AdGuard VPN, we changed the connection protocol, introducing the use of credentials. With the release of AdGuard for Android v4.13, our ad blocker and VPN cooperate seamlessly and securely, with no additional action required on the user’s part for them to synchronize. No third-party apps will be able to spy on your activities, as an added bonus.

More instructions for HTTPS certificates

In previous versions of AdGuard for Android, we added in-app instructions for installing HTTPS certificates, as the process could differ in regards to your device’s make and model. We try to keep up with the growing range of devices: with this release we added instructions for ColorOS, an Android-powered OS by Oppo.

In conclusion

We added post-quantum cryptography support to our DNS filtering engine, DnsLibs. Now AdGuard for Android, like our other full ad-blocking products, keeps your DNS requests protected against future threats.

Naturally, the release includes the usual round of bug fixes and internal improvements. These changes may not be evident, but they help make filtering more stable and reliable overall.

We’d love to hear your thoughts on this latest release. Do not hesitate to share them on social media and send your ideas via GitHub.

During that time, you may just sit there watching the activity log as the agent reads files, runs commands, and attempts to finish the task. Or you may step away and return later to check whether it has finally succeeded. Either way, you see the small status message displayed while the coding assistant is working again and again. It gets a surprising amount of your attention. So, one startup decided to monetize it.

Kickbacks.ai replaces or supplements that little “thinking” line with an advertisement. Advertisers pay for the views, Kickbacks takes its share, and the developer whose computer displayed the ad receives the rest. At first glance, this sounds like a fairer version of the familiar data economy. Instead of quietly profiting from your data, the company puts a price on it and gives you a cut.

The idea is not entirely new. Evidation has offered points — redeemable at 10,000 points for a $10 cash payment — in exchange for health and activity data. Nielsen has paid people to install monitoring software that collects demographic, behavioural, and preference information. Honeygain pays users for sharing their internet traffic, while UpVoice rewarded users for allowing an extension to observe the ads shown to them on major platforms. Kickbacks is part of the same family, but the stakes of installing it may be way higher.

Once you get past the promise of a 50/50 split and start reading the fine print, it begins to look far less like compensation and far more like a very small payment for taking on a very large risk.

Kickbacks.ai: what it is and how it works

Kickbacks appeared in June 2026 as a project by developer Andrew McCalip. Its slogan is “Get paid for waiting.” When Claude Code or Codex is processing a request, the extension replaces or supplements the usual spinner message with a sponsored line.

The product is aimed squarely at developers. It works inside Visual Studio Code, or VS Code — a popular desktop app where developers write and manage code — and can also be installed in VS Code-based editors such as Cursor and VSCodium. VS Code has its own extension system, similar in concept to browser add-ons, but the extensions run inside the code editor rather than inside Chrome, Firefox, or another browser. Kickbacks supports terminal versions of Claude Code and OpenAI Codex too, but with a catch: terminal ads do not earn anything on their own. The VS Code extension still has to be installed because it is the part that reports qualifying impressions. So, in a nutshell, this is not something that a regular ChatGPT or Gemini user can earn from. You need a developer setup for the extension simply to work.

Source

To get paid, the developer must be signed in, the Kickbacks extension must be installed and running, and the ad must stay visible for at least five seconds during a real coding request started by the developer. The editor also has to be open and not minimized, and Kickbacks says it checks whether the user has shown real activity within the previous few minutes. Automated prompts, repetitive requests designed to farm ads, or activity rejected by the company’s anti-fraud systems do not qualify.

There are two advertising modes. Private Mode turns on automatically when the user signs in. Boosted Mode requires a separate opt-in and uses information from the user’s conversations to target ads more precisely at them.

The difference is substantial. But even “Private Mode” is not what most people would probably expect from a truly private solution (if true privacy is even possible in a system built to track and attribute ads).

Is ‘Private Mode’ really private?

Private Mode is private in roughly the same way that replacing your name with a customer number makes a database anonymous: better than printing everything in plain text, but hardly makes you invisible.

Kickbacks says Private Mode does not send advertising partners your prompts, AI responses, source code, file contents, file names, paths, or repository identity. That protects the most sensitive part of your work. But it still falls well short of what most people would probably understand by “private.”

To serve an ad in Private Mode, Kickbacks says it shares the following with the advertising partner:

• a pseudonymous user or session identifier;
• a transformed or truncated version of the IP address;
• the operating system;
• the user-agent/editor version;
• an approximate city- or region-level location;
• confirmation of impressions and clicks.

Kickbacks itself collects more. Its telemetry can include which ad appeared, which campaign it belonged to, where it appeared on the screen, what percentage of it was visible, how long it remained visible, timestamps, extension and host versions, account and installation identifiers, click activity, request timing, request frequency, relationships between accounts and devices, and behavioural signals used for fraud detection. Most of these data points sound like nothing much in isolation. Together, over time, they create a persistent behavioural record of how a person uses an AI coding assistant: when they work, how often they make requests, how long sessions last, which editor and operating system they use, approximately where they are, and which ads they interact with.

And that “pseudonymous identifier” deserves more attention than it usually gets. It may not contain your name, but it still gives your device or account a recurring label, so companies can recognize that the same person came back, connect their activity across sessions, and keep adding new details to the same profile.

NIST, the US National Institute of Standards and Technology, warns that pseudonymous identifiers do not make people anonymous. The more information that gathers around one identifier — location, device details, timestamps, habits, and activity patterns — the easier it can become to match that profile with other data and work out who is behind it. In other words, “pseudonymous” means “your name is not written on the front.” It does not mean “nobody can work out who you are.”

Kickbacks goes further than simply admitting that data is shared. Its Privacy Policy explicitly says that, under California privacy laws, the program amounts to a sale or sharing of personal data. That wording may be there for legal reasons, but it is still worth taking at face value: your data is part of the product being sold.

Unusually, Kickbacks even puts a price tag on it. The company estimates that one participating user’s data is worth about $75 per year to Kickbacks, after the costs of running the program.

Boosted Mode: the privacy disaster upgrade

Private Mode is already hard to defend, but Boosted Mode makes the tradeoff almost impossible to justify.

When enabled, Kickbacks processes a portion of the developer’s recent AI-assistant conversation on its own servers. According to its Privacy Policy, this can include a capped tail of recent prompts and AI responses, open-file extensions, and a repository-name hint. The system then attempts to remove credentials and personal information and rewrites what remains into an advertising-interest profile: programming languages, technologies, professional topics, problem domains, region, role, or industry.

The policy says source files and file contents are not directly collected. But code, logs, customer information, internal architecture, credentials, financial details, or proprietary material may already be present inside a prompt or the model’s answer. Developers regularly paste exactly those things into coding assistants because that is how the assistant receives enough context to solve a problem.

Kickbacks says sensitive content — keys, tokens, and secrets — is stripped on the device before it is sent off. Its servers then apply more automated filters. If cleaning fails or appears uncertain, the company says the material is supposed to be discarded. But it also says, repeatedly, that this process is best effort and not guaranteed.

You have probably heard this warning before. OpenAI tells users not to enter sensitive information they would not want reviewed or used. Google similarly warns Gemini users not to enter confidential information they would not want a reviewer to see or Google to use to improve its services.

Kickbacks says advertising partners receive only the cleaned, derived profile, not the raw prompts or replies. But sensitive content that slips through filtering can still be processed by Kickbacks and may influence the profile before anybody notices. The terms explicitly say the company does not promise to find or remove undetected material afterwards.

Kickbacks may also enrich the profile with information from data brokers, such as your likely role or industry. So the ad is not simply matched to a word like “Python.” It may draw on a much broader picture of your work, including the technologies you use, the problems you solve, your location and device, and information gathered from outside sources.

The advertising partners that receive it are treated as independent controllers, not as contractors simply following Kickbacks’ instructions. With Kickbacks, users can at least read its Privacy Policy; once the data moves on, they may not even know which companies received it, let alone what those companies do with it.

The risk does not end when the user changes their mind. Switching from Boosted Mode back to Private Mode stops new profile data from being shared, but it does not automatically erase what partners have already received. That is not much of an undo button.

A 50/50 split — or not?

Kickbacks’ landing page paints an appealingly simple picture: the advertiser pays a dollar, Kickbacks gets 50 cents, and the developer gets 50 cents. It even calls the arrangement a “real 50/50 split,” explicitly promising no fuzzy math and no “up to” language.

Yet Kickbacks’ own GitHub page describes the offer differently: developers receive “up to 50% of ad revenue.” That tiny “up to” directly contradicts the landing-page pitch.

And the Terms of Service introduce even more fuzz.

The user is not contractually promised half of every dollar an advertiser pays. The terms describe the reward as an estimated 50% of net advertising revenue after operational expenses. “Net revenue” means Kickbacks deducts operating costs before splitting the money, without clearly explaining what those costs include. And developers do not receive half of an advertiser’s entire payment: each person gets only the share Kickbacks attributes to qualifying ads shown on their own device.

So this is not a dollar neatly cut in half. It is an estimated share of the net revenue Kickbacks attributes to qualifying impressions shown on a user’s device, after operating costs and subject to fraud checks, eligibility rules, and usage limits. Those limits can apply daily, monthly, by region, by account, or even to individual users — and Kickbacks can change them without notice. It can also revise the revenue split, rates, and payout schedule with little more than a website or in-app notice.

Then comes the payout itself. Users cannot withdraw their money until they cross the current $10 threshold, which may also change. Stripe Connect Express is the only payout method. Most strikingly, the terms say users have no property interest in pending or accrued earnings until those earnings are actually disbursed. So the money displayed beside your account may look like your money, but they are legally not.

Underwhelming at best, a means to get you fired at worst

The most dangerous place to use Kickbacks is also the place where it is most likely to be used: at work.

The extension is designed for developers using AI tools to interact with real software projects. Those projects may involve unreleased products, customer records, internal services, confidential repositories, security vulnerabilities, financial systems, infrastructure credentials, or information covered by contracts and regulation. Kickbacks’ answer is essentially: make sure you have permission.

The company also makes clear that it is not affiliated with or endorsed by Microsoft, OpenAI, Anthropic, or GitHub. The software works by modifying, intercepting, or patching elements of third-party coding tools. Kickbacks does not guarantee that this is permitted by those platforms’ terms. It warns that a provider could block the extension, break it through an update, or take enforcement action against an account — including suspension or termination.

Suppose the filtering fails and an internal client name, access token, or fragment of proprietary information reaches Kickbacks’ servers. Suppose the AI provider decides that patching its interface violates its terms and closes the account. None of the above will be Kickback’s fault, according to its terms of service. Meanwhile, Kickbacks’ own total liability is capped at the greater of $100 or the amount the user paid Kickbacks during the previous 12 months. Since an earning user will normally have paid Kickbacks nothing — the whole point is that Kickbacks is supposed to pay them — the practical cap is likely to be just $100.

Your job, client relationship, professional reputation, AI account, confidential information are therefore being placed on one side of the scale. On the other side: an estimated share of net ad revenue, subject to deductions, undisclosed caps, fraud screening, a changeable threshold, Stripe availability, and forfeiture clauses. And perhaps $100 if something goes badly enough for Kickbacks itself to be legally liable.

Kickbacks is built around a genuinely attractive idea. If companies are going to profit from our attention and information anyway, why should users not receive part of that value? But a fair exchange requires both sides to understand what they are giving and to have meaningful control over what happens next. Kickbacks offers neither a simple half of every advertiser dollar nor a genuinely private mode of participation.

Kickbacks controls the calculations, the caps, the qualification rules, and the payment schedule. Its partners may retain data already received. The AI or editor provider may decide the extension is unwelcome. The developer’s unpaid balance is not legally theirs until it reaches their account.

For somebody using an AI coding assistant purely for personal experiments, with no confidential projects, no employer rules, no valuable data, and no concern about behavioural profiling, Kickbacks may be an amusing way to turn a spinner into pocket money.

For a professional developer whose livelihood depends on access to their tools, the trust of their employer and clients, and the confidentiality of their work, the equation is different.

Risk your data, your account, your reputation, and potentially your job, while the company promising to split the proceeds limits its own liability to around $100. That is not Robin Hood. It is a very small kickback for a very large risk.

Why am I getting so much spam?

It can feel like a losing battle, but you are not alone. The constant flood of unwanted emails is a widespread problem. Your email address can end up in spammers’ hands through several common channels:

• Email harvesting (scraping): spammers use automated tools to scan the Internet for email addresses written in plain text on forums, social media, websites, and public profiles

• Data breaches: when a company’s database is hacked, your email and other personal information can be exposed and sold on the dark web. Major breaches at companies like Adobe, LinkedIn, and Yahoo! have provided spammers with millions of active email accounts

• Subscription lists & opt-ins: you might unknowingly agree to receive promotional emails when you sign up for a service. Some companies also sell your email address to third parties

• Buying and trading lists: spammers often buy lists of email addresses from other spammers or unscrupulous companies

• Dictionary harvest attacks: attackers use tools to guess common email addresses (like admin@domain.com or info@domain.com)

• Malware: if your computer or device is infected with malware, it can harvest your email contacts and send spam without your knowledge

How did spammers get my email address?

Spammers have a vast arsenal of methods for obtaining email addresses, ranging from simple automated techniques to sophisticated attacks. Understanding how they operate is your first step toward protecting your inbox.

Data breaches

One of the most common sources is data breaches. When a website or company you’ve subscribed to is compromised, user databases containing email addresses — and sometimes passwords — are stolen and sold on the dark web. These lists are repeatedly bought and sold among spammers. Major breaches at companies like LinkedIn, Adobe, and others have exposed millions of active email addresses this way.

Email harvesting (scraping)

Spammers use automated bots to scour the Internet for email addresses. These web crawlers scan websites, forums, blog comments, social media profiles, and even PDF files, looking for the “@” symbol to collect anything that looks like an email address.

Dictionary attacks

In this technique, spammers use software to guess valid email addresses. They combine common names, dictionary words, and popular number sequences with well-known domain names (e.g., john.doe@gmail.com, info@company.com). This method is especially effective against large organizations with predictable email formats and can result in a sudden surge of spam targeting common addresses.

Purchased and traded lists

Spammers often buy and sell email lists amongst themselves. These lists can be obtained through data breaches, stolen from other sites, or built through other harvesting methods. Some less reputable companies also sell the email addresses of their users to third parties.

Social media and public exposure

Any public source of information is a target. If you’ve ever posted your email address in your bio, a comment, or a public resume, it can be harvested. Business platforms like LinkedIn are particularly attractive to attackers who scrape profiles to build corporate email lists.

Social engineering and fake websites

Scammers create fake websites, contests, and giveaways to trick people into voluntarily providing their email addresses. Once you enter your information, it’s added to a database for future spam campaigns. Similarly, a malicious actor might impersonate a colleague or support staff to ask you to confirm your email address.

Malware

If your device is infected with malware, it can harvest contacts and email addresses stored on your computer, sending them back to the attacker without your knowledge.

Are spam emails dangerous?

Simply opening a spam email is generally low-risk on most modern email clients. However, spam emails can be extremely dangerous, as they have become one of the most common vectors for cyberattacks. The danger comes from what you do after you open the email.

• Phishing attacks: these deceptive emails are designed to trick you into revealing sensitive information like passwords, credit card numbers, or account details by impersonating a trusted source

• Malware infections: clicking a link or downloading an attachment from a spam email can install harmful software like ransomware, keyloggers, or trojans on your device

• Identity theft and financial fraud: by interacting with a phishing scam, you risk giving a cybercriminal the information they need to steal your identity or access your bank accounts

Modern spam is frequently a delivery mechanism for serious cyber threats. Cybercriminals are increasingly using social engineering to craft realistic-looking messages that are difficult to distinguish from legitimate ones.

How to recognize a spam email

Learning to spot a spam email is your first line of defense. Here are common red flags to watch for:

• Unfamiliar or suspicious sender: the email address contains misspellings or comes from a free service like Gmail when it claims to be from a major corporation

• Generic greetings: the email uses impersonal salutations like “Dear customer” or “Dear user” instead of your actual name

• Typos and poor grammar: while this is a common sign, remember that AI is making it easier for scammers to write grammatically correct emails

• Sense of urgency or threats: the email attempts to rush you into action by claiming your email account will be suspended or you owe a payment

• Requests for sensitive information: legitimate organizations will never ask you for your password, social security number, or banking details over email

• Suspicious links or attachments: hover your mouse over a link to see the true URL. Be wary of links that have slight misspellings or don’t match the company’s official domain. Do not open unexpected attachments, especially .exe, .zip, or .docm files

• Too-good-to-be-true offers: emails promising unrealistically high rewards, inheritances, or prizes are almost always scams

If you receive a suspicious email, do not click on any links or attachments. Report it as spam and block the sender. If you accidentally click something, disconnect from the Internet immediately and run a security scan on your device.

How to stop spam emails: 10 ways

Dealing with relentless spam can feel like a losing battle, especially since modern spam is often generated by bots that constantly change addresses to bypass simple blocks. However, there are proven ways to fight back. Here are 10 strategies that actually work.

1. Train your email filters

When you receive a spam email, mark it as junk or report it as spam instead of simply deleting it. This teaches your email provider’s artificial intelligence to recognize and block similar messages in the future. In Gmail, use the Report spam button; in Outlook, right-click and select Mark as junk.

2. Block senders and domains, not just individual addresses

Blocking a specific email address is often ineffective because spammers constantly create new ones. Instead, block entire domains that you consistently see in spam emails (e.g., @spamdomain.com). This is a more reliable way to stop repeated spam from the same source. In most email clients, you can add domains to a blocked senders list in your settings.

3. Create smart inbox rules

Custom rules can automatically delete or move emails based on specific conditions. Here are three powerful examples that can stop spam from ever reaching your inbox:

• Delete messages with

  — this catches many phishing emails that use HTML forms

• Delete messages from risky domains — add common spam domains like .site, .cam, .rest, .work, .xyz, .shop, .click, and .live to a rule

• Delete messages from random “info.” senders — many spam emails use addresses starting with info

• To create a rule in Outlook, go to settings → mail → rules, add a new rule, set a condition (e.g., “Sender address includes” or “Body includes”), choose the action delete, and save

4. Clear out old rules and blocked senders

Having hundreds or thousands of accumulated rules and blocked senders can actually make your email client slow and less effective at filtering spam. If you’ve been fighting spam for years, consider clearing out this clutter. After removing old rules, you can replace them with a few, simple, well-crafted rules that target patterns rather than specific senders.

5. Adjust your junk email filter level

Most email services allow you to adjust the sensitivity of their spam filter. Setting the filter to High or Exclusive (or a similar option) will catch more spam. Be aware that this may also increase the chance of legitimate emails being sent to your junk folder, so you’ll need to check it occasionally.

6. Report spam wisely

While reporting spam is helpful, avoid reporting spam that is already in your junk folder — this can add clutter and may not be as effective. Focus on reporting spam that actually reaches your inbox. In Gmail, you can also use the report spam & unsubscribe option to both train the filter and remove yourself from a mailing list.

7. Unsubscribe from legitimate newsletters

If you’re receiving emails from a company you no longer wish to hear from, use the Unsubscribe link at the bottom of the email. This is a legitimate way to reduce clutter from marketing emails. However, never click Unsubscribe on suspicious or obviously spammy emails — this confirms your address is active to spammers and can lead to even more spam.

8. Use a secondary email address for sign-ups

Create a separate email address specifically for online registrations, newsletters, and less important services. This keeps your primary email clean and reduces the chances of it being harvested by spammers.

9. Be cautious with exposing your email

Avoid posting your main email address publicly on forums, social media, or websites. Spammers use automated tools to “scrape” the Internet for addresses. If you must post it, consider using a different format (e.g., “name [at] domain [dot] com”).

10. Block emails by language or region

In some email clients, like Outlook, you can filter out messages written in specific character sets or originating from certain country-level domains. This can be very effective against foreign-language spam or spam from a particular region.

Important note: delete, don’t report

If you are using a new set of filtering rules, do not report spam that lands in your junk folder. Simply delete it. Reporting it at this stage can interfere with your new rules. Allow the system 24–72 hours to settle in with the new configuration before evaluating its effectiveness.

How to mark an email as spam

Marking an email as spam, rather than just deleting it, is essential for training your email provider’s filters to recognize and block similar unwanted messages in the future. Here’s how to report spam on the most popular email platforms.
If you’ve just set up new custom filtering rules, avoid reporting spam that already lands in your junk folder — this can interfere with your rules. Instead, simply delete it and allow 24–72 hours for your new configuration to settle.

Reporting spam in Gmail

On the web version (Gmail.com):

• Select or open the suspicious email

• Click the Report spam button in the toolbar above the email list (it looks like a stop sign with an exclamation mark)

• For phishing emails, click the three dots next to Reply and select Report phishing

In the Gmail mobile app:

• Open the email

• Tap the three dots menu (top-right corner)

• Select Report spam

Reporting spam in Outlook

On the web version (Outlook.com or Outlook 365):

• Select the suspicious email

• Click the Junk dropdown in the toolbar

• Choose Junk (to move it to the Junk folder) or Block (to block the sender)

• For phishing attempts, click the dropdown arrow next to Junk and select Phishing scam.

In the Outlook desktop app:

• Right-click on the email

• Hover over Junk and select Block Sender or Junk (or Report Junk depending on your version)

In the Outlook mobile app:

• Open the email

• Tap the three dots menu

• Select Move to Junk or Report Junk

Reporting spam in Apple Mail on iPhone

In the Apple Mail app on iPhone or iPad:

• Swipe left on the message in your inbox

• Tap More

• Tap Move to Junk

Alternatively, you can open the email, tap the flag icon, then select Mark followed by Move to Junk.

Reporting spam in Yahoo Mail

On the web version (Yahoo Mail):

• Select the suspicious email by checking the box next to it

• Click the Spam button in the toolbar above your inbox

In the Yahoo Mail mobile app:

• Open the email

• Tap the three dots menu

• Select Mark as spam

When you mark an email as spam in Yahoo, future emails from that sender will be automatically diverted to the Spam folder.

How to block spam senders

Blocking a sender is one of the fastest ways to stop unwanted emails from cluttering your inbox. When you block someone, future messages from that sender are automatically diverted to your Spam or Junk folder — or in some cases, directly to Trash. Here’s how to do it on the most popular email platforms.

Block a spam sender in Gmail

In the web version (Gmail.com):

• Open the message from the sender you want to block

• In the top-right corner of the message, click More (the three-dot button)

• Select Block [sender name]

• Confirm your choice. All future messages from this sender will go directly to your Spam folder

In the Gmail mobile app (Android/iPhone):

• Open the message from the sender

• In the top-right corner, tap the More button (three dots)

• Tap Block [sender name]

Block a spam sender in Outlook

In the Outlook desktop app:

• Right-click on the message from the sender you want to block

• Select Block → Block Sender

• Future messages from this address will be moved to the Junk Email folder

In the web version (Outlook.com or Outlook 365):

• At the top of the page, select Settings

• Go to Mail → Junk email

• Under Blocked senders and domains, select Add blocked sender

• Enter the email address or domain you want to block, then select OK and Save

Block a spam sender in Apple Mail

• Open the Mail app on your Mac

• Select an email message from the sender you want to block

• Click the sender’s name at the top of the email

• Select Block this Contact from the dropdown menu

Block a spam sender in Yahoo Mail

• Open an email from the sender you want to block or select it from your mailbox

• Click More (the three-dot button)

• Select Block Senders

• Optionally, select to also delete emails you’ve received from the sender, then click Ok

The most reliable fix: stop exposing your real address

The most effective way to stop spam is not to filter it once it arrives, but to prevent spammers from getting your email address in the first place. The most reliable fix is to stop using your real email address for anything other than trusted, essential contacts. Instead, use email aliases — unique, disposable addresses that forward messages to your main inbox without revealing it.

How email aliases work

When you sign up for a service or share your contact information with someone you don't fully trust, you provide an alias instead of your real address. All emails sent to that alias are automatically forwarded to your primary inbox, keeping your personal address private.

The key advantage is control: if a specific alias starts receiving spam, you can simply disable or delete it. Since the alias is unique to that service or sender, this instantly stops the spam without affecting your real inbox.

AdGuard Mail: aliases and temporary emails combined

AdGuard Mail offers a comprehensive email protection solution that combines both permanent aliases and temporary email addresses. With over 17 years of experience in online privacy, AdGuard provides apps for Windows, Mac, Android, and iOS, as well as a web-based solution.

The service gives you two powerful tools in one ecosystem:

• Aliases are forwarding addresses that you create and link to your real email. Use them for ongoing communication with services you trust — emails sent to an alias are forwarded to your main inbox, and you can disable any alias with one click if it starts receiving spam.

• Temporary emails are disposable addresses for one-off interactions. They appear right inside the AdGuard Mail app, and you don’t need to link them to your personal inbox — they work as standalone mailboxes for receiving confirmation codes, download links, or promo codes.

The free plan includes:

• 10 aliases

• 1 recipient

• 2,000 forwarded messages per month

• 1 alias domain and 1 temp mail domain

• 1 temp mail inbox

• Forwarding from temp mail inbox to recipients

The full version offers:

• 1,000 aliases

• 50 recipients

• Unlimited forwarded messages

• Anonymous replies from aliases

• Multiple alias and temp mail domains

• 5 temp mail inboxes

AdGuard Temp Mail: web-based temporary email service

For situations where you need an email address only once — such as signing up for a trial, downloading a resource, or receiving a promo code — AdGuard Temp Mail provides a free disposable email address instantly, through its website, without requiring an account or app installation.

How it works:

1. A temporary email address is automatically generated for you

2. Copy the address and use it on any online registration or verification form

3. Check the temporary inbox for confirmation messages

Key benefits:

• Privacy protection: your real email address stays hidden, even if the untrusted service sells your data

• Spam avoidance: since the address is disposable, spam never reaches your real inbox

• Free, ad-free, and tracker-free: no ads, no trackers, completely free, and your IP address is also hidden from senders

Important notes:

• Temporary email addresses can only receive emails, not send them

• They don’t accept attachments

• Inboxes are automatically deleted after 7 days of inactivity or immediately when you generate a new address

• Deleted messages cannot be recovered

Other popular alias services

Several reputable services offer email alias protection, each with its own strengths:

• Apple Hide My Email is integrated into iCloud+ and generates random addresses via settings or Sign in with Apple. Addresses use the @privaterelay.appleid.com domain and work seamlessly across iOS, macOS, and the web

• Firefox Relay offers a browser extension for Firefox and Chrome. The free plan includes five aliases, while the premium version provides unlimited aliases and custom domains

• SimpleLogin, now part of Proton, is an open-source solution with a generous free plan. It allows you to reply to forwarded emails while keeping your real address completely hidden

Critical principle: treat aliases as disposable

The core principle is to create a unique alias for each service or context. If you use the same alias everywhere, you lose the protective benefit. A single unique alias per service ensures you can trace the source of spam back to a specific entity and eliminate it cleanly.

FAQ

Why am I suddenly getting so much spam?

A sudden spike in spam usually means your email address was recently exposed. This commonly happens through a data breach at a company you use, or because you signed up for a service that sold your address to third parties. Sometimes, spammers also use automated tools to guess common email addresses or scrape them from public websites and forums.

Is it safe to click Unsubscribe on spam emails?

It depends. Unsubscribing from legitimate newsletters is safe and effective. However, clicking Unsubscribe on suspicious or obviously spammy emails confirms to spammers that your address is active and monitored by a real person. This often leads to even more spam, as your address gets added to other spammers’ lists. In these cases, mark the email as spam instead.

Should I reply to spam to tell them to stop?

Never reply to spam emails. Replying confirms your email address is active, which invites more spam. Additionally, many spam emails are sent from automated systems or malicious actors — replying will not stop them and may expose you to further risks, including phishing attempts.

Can spammers tell if I open their email?

Many modern spam emails contain hidden tracking pixels (small images) that load when you open the message. This can notify the sender that you’ve opened the email and even reveal your location and device information. Most email clients now block images by default for this reason — keep this setting enabled to protect your privacy.

What’s the difference between spam and phishing?

Spam is unsolicited and unwanted email, often commercial in nature — it’s annoying but not necessarily malicious. Phishing, on the other hand, is a cybercrime. Phishing emails are designed to trick you into revealing sensitive information like passwords, credit card numbers, or account details by impersonating a trusted source. While spam is a nuisance, phishing is a serious security threat.

Will changing my email address stop spam?

A new email address will give you a clean slate, but it’s not a long-term solution. Your new address may eventually be exposed through data breaches, public posts, or sign-ups. For a more permanent fix, consider using email aliases (see the Most reliable fix section above). If one alias starts receiving spam, you can simply disable or delete it without affecting your primary address.

Last July, Meta CEO Mark Zuckerberg said that within five to ten years, people who did not wear AI glasses could find themselves at a “pretty significant cognitive disadvantage” compared with those who did. Zuckerberg has also promoted smart glasses as a device that could ultimately replace the smartphone, putting instant knowledge not merely at your fingertips, but literally at your eyelids.

For a while, the glasses appeared to be building real momentum. Meta and its manufacturing partner EssilorLuxottica reportedly sold around 7 to 7.5 million pairs in 2025 alone, after reaching a cumulative two million sales across 2023 and 2024. On paper, it looked like Meta had finally turned smart glasses from a failed futuristic experiment into a mass-market product.

But commercial success has come with a growing privacy pushback. Despite Meta’s efforts to present the glasses as a universally desirable, cutting-edge gadget, they have increasingly become a liability. Some owners are reportedly now reluctant to wear what critics have branded “pervert glasses” outside their homes.

What went wrong? Almost everything. And much of it was predictable.

In search of an LED light

Meta’s latest smart glasses are the product of its collaboration with EssilorLuxottica, the eyewear conglomerate that owns Ray-Ban. EssilorLuxottica contributes its expertise in frames, lenses, manufacturing, fit, and prescription optimization, while Meta supplies the cameras, microphones, internal hardware, software, and Meta AI.

On June 23, 2026, the partnership launched a new self-branded line simply called Meta Glasses, including a frame style designed with Kylie Jenner whose built-in Meta AI assistant spoke in her voice. By ditching the familiar Ray Ban branding, Meta appeared ready to stop piggybacking on someone else’s reputation and establish itself as a respectable eyewear brand.

That would always be difficult if not impossible, though. By the time the self-branded line arrived, the glasses had already generated a storm of controversy, much of it driven by reports of women being secretly filmed during seemingly genuine interactions. Many later discovered the footage was posted online without their consent. Some videos attracted millions of views, led to recognition by strangers, and were uploaded despite explicit objections, while the women involved said they had not noticed the recording light. Some victims reported that the videos revealed where they lived and made them afraid to go out.

What makes these cases so disturbing is that only one person knows the interaction is being recorded. The wearer is creating content; the person in front of him thinks they are simply having a conversation. That hidden imbalance deprives them of any real choice over whether their image, voice, and personal interaction are captured and shared.

Existing laws do not give smart-glasses users a blanket right to record others: in the US, consent requirements vary by state, and some require everyone in a private conversation to consent. Whether a recording is illegal depends on the circumstances, but legal uncertainty does not equal consent.

Meta’s primary answer to this problem is a small white capture LED on the front of the frames. It flashes when a user takes a photograph or records video, supposedly warning bystanders that the camera is active.

But the light is not a meaningful privacy safeguard. At best, it is a notification — and an easy one to miss. A person must know that the glasses contain a camera, know where the indicator is located, be close enough to see it, and happen to look directly at the wearer while it is flashing.

Predictably, almost as soon as the glasses became popular, people began searching for ways around even that limited warning. Stickers were sold to obscure the LED, while modification services offered more permanent ways to alter or destroy it.

On July 7, 2026, Meta began rolling out a mandatory update that disables the camera if the glasses detect that the LED has been physically tampered with or destroyed. The company said: “No photos or videos can be taken until we detect that the light is unblocked.” Meta also said it would remove advertisements and Marketplace listings for LED-modification services and could take legal action against those offering them.

Closing that loophole is welcome. It is also revealing that the loophole existed, and that Meta had to redesign its protections in response. More importantly, the update cannot fix the underlying flaw of the system: a functioning light is still useless when the people being recorded do not recognize it or notice it.

And the privacy risk does not end once the recording has been made. Meta relied on data annotators employed by Sama, an outsourcing company in Nairobi, to label footage and help train the glasses’ AI to understand what it was seeing. Workers told Swedish reporters that the material they reviewed included people undressing, using toilets, having sex, and exposing bank-card details, while automatic face blurring did not always work. Meta’s response was to sever its seven-year contract with Sama, leaving more than 1,100 workers unemployed, saying only that “they don’t meet our standards.”

The public, meanwhile, has begun developing its own form of enforcement: social ostracism. An X user shared that their friend group started referring to a Meta-glasses owner as “the pervert” until he eventually got rid of them.

The backlash has reached celebrity culture too: Kylie Jenner’s campaign for the glasses was met with criticism, while pop star Lorde bluntly told a festival audience, “Don’t get the glasses. Not sexy.”.

That is not a software bug Meta can patch. It is a social verdict on a product whose appeal to the wearer partly depends on everyone else accepting that an ordinary-looking pair of glasses may also be a camera pointed directly at them.

The history of privacy failure: from Glassholes to Snap Specs and back

Anyone who has followed consumer technology long enough probably remembers the disaster that was Google Glass. The futuristic headset began reaching early users in 2013 and drew excitement from a small group of tech enthusiasts — it even featured in Vogue.

Almost everyone else, though, seemed to hate it.

Some criticism focused on the device itself. Google Glass initially cost $1,500, looked strange, had limited battery life, and simply offered too little to entice a regular person into wearing them. But its biggest flaw was arguably social rather than technical: people could never be sure whether the person looking at them was also recording them.

The backlash became so intense that bars, restaurants, casinos, and cinemas began banning the glasses. Wearers were soon labelled “Glassholes” — a term for Google Glass users who behaved obnoxiously. The word became Urban Dictionary’s word of the day in March 2013, and quickly entered the popular vocabulary.

Google Glass did not fail because of privacy concerns alone. Its steep price, awkward design, immature technology all played a role. But the term “Glasshole” captured the deeper problem better than any product review could: society had rejected not only the device, but also the behaviour it enabled.

Snap tried to learn from that failure when it launched its first Spectacles in 2016. Instead of making them look like a device from a sci-fi movie, the company made them look as unserious as possible. It also placed a conspicuous ring of LEDs around the camera that lit up while the glasses were recording.

The message was clear: these were a toy, not a surveillance device, and people around the wearer would always know when the camera was active. That did not entirely work. The light was only helpful when bystanders knew what it meant, were standing close enough to see it, and happened to be looking directly at the wearer. A 2016 YouGov survey found that nearly half of US adults would feel uncomfortable around a stranger wearing Spectacles. Just a year after launch, Snap’s first foray into hardware was officially deemed a failure.

Meta appears to have studied both failures carefully — but drawn a troubling conclusion from them. Google Glass looked too strange. Snap Spectacles looked too much like a toy. Ray-Ban Meta glasses, by contrast, look almost exactly like ordinary eyewear.

That may have helped Meta achieve what Google and Snap could not: sell face-worn cameras at a mass-market scale. But it did not resolve the original privacy problem. It merely made the device — and the fact that someone may be recording you — much harder to notice.

Pushback in action, not words

In a way, the growing popularity of this new wave of smart glasses, now enhanced with AI, has pushed authorities back toward their familiar way of dealing with face-worn cameras: banning them. Recording-enabled glasses have already been prohibited or restricted in courtrooms in New York and Wisconsin. In California, a judge even ordered members of Meta CEO Mark Zuckerberg’s team to dispose of their smart glasses during a no-recording session and warned that if they did not do so they could be held in contempt.

It may only be a matter of time before more privacy-sensitive spaces follow. Google Glass was easy to identify and ban because it looked like a gadget out of this world. Meta’s glasses are harder to police precisely because they are designed to pass as ordinary eyewear.

The same old Meta pattern: convenience without consent

The problem is bigger than one pair of glasses. What connects Meta’s eyewear to many of its other products is a familiar approach: introduce a convenient new way to collect information, place the responsibility for managing the consequences on users and bystanders, and treat consent as something that can be buried in settings, terms of service, or a tiny blinking light.

We saw the same willingness to push past privacy boundaries in 2025, when researchers found that Meta Pixel had exploited Android’s localhost functionality to connect mobile browsing activity — including activity in private browsing mode — with identities logged into Facebook and Instagram apps. Meta paused the practice after it was exposed. The mechanism was very different, but the underlying approach was the same: use whatever access the technology allows first, and deal with objections later.

There is another recurring pattern too. From the metaverse to AI glasses, Meta has repeatedly presented its preferred technological future as inevitable, assuming that public enthusiasm will eventually catch up. Zuckerberg’s warning that people without AI glasses may face a “cognitive disadvantage” takes this logic even further: reluctance is framed not as a reasonable response to a company with a long privacy record, but as a failure to embrace progress.

Yet trust cannot be forged through celebrity campaigns or software updates. It is earned by giving people meaningful control — including people who never bought the product but happen to stand in front of it. That absence of consent is not a minor flaw waiting for a better LED. It is the product’s central privacy problem.

Unlike some other sports, football has traditionally offered very few natural windows for commercial breaks. For decades, there was really only one: the 15-minute halftime slot. But this World Cup has changed that by introducing mandatory hydration breaks, effectively splitting each half into two parts with a three-minute pause. FIFA, which sold the rights to show the tournament, left it up to individual broadcasters to decide whether to turn that time into more advertising inventory. Quite a few, including Fox in the United States, as well as broadcasters in Mexico, Canada, France, Germany, Italy, Spain, China, Japan, India, Australia, and Turkey — didn’t hesitate to take the hint.

Why mandatory hydration breaks receive so much backlash

Hydration breaks themselves are not new in football. They were first introduced more than a decade ago during the 2014 World Cup in Brazil, when extreme heat and humidity made conditions legitimately dangerous for players. A game between the USA and Portugal in Manaus, Brazil, was in fact the first ever match to have them at the World Cup level. At the time the interruption was praised by commentators as “common sense.”

Importantly, though, in that tournament, breaks were only used when temperatures reached 32 degrees Celsius (or 89.6 Fahrenheit). The idea was simple: protect players when conditions are genuinely extreme, but avoid interrupting the game when they are not. 2026 has seen FIFA abandoning this seemingly common sense logic and making a complete U-turn.

Instead of being used only in extreme heat, FIFA decided in December 2025 that hydration breaks should become mandatory in every match. FIFA has justified this blanket approach by saying that this was to ensure “equal conditions for all teams,” regardless of stadium, climate, or infrastructure — even in venues with roofs, shade, or air conditioning. In other words, FIFA mandated that the game be divided into four periods, making it a new normal, not an exception.

This approach did not strike a chord with those whom it was supposed to benefit — football players. The Netherlands and Liverpool FC captain Virgil van Dijk, speaking during the tournament, described the breaks as often unnecessary stops that ruin the flow of the game for players and spectators alike:

“If it’s really hot, obviously it would be good to put them in. But I think you have to look at it in every game separately.”

Fans have also reacted strongly, with clips circulating online of spectators booing when play is paused for hydration breaks. One group, however, has remained notably silent: broadcasters and advertisers, who stand out to benefit the most from the new rule.

The economy of hydration breaks: how much does Messi’s sip cost

But how much money can you really make from a couple of extra minutes a match? Six extra minutes in a 90-minute football match hardly seem like enough to change the economics of sports broadcasting. But scale those six minutes across the entire World Cup, and they suddenly become extraordinarily valuable.

There are certain rules governing how ads can run during the breaks. Ads can start 20 seconds after the whistle and must end 30 seconds before play resumes. Per match, this adds up to around 4 minutes and 20 seconds of additional advertising. Over the tournament, that becomes roughly 7 hours, 30 minutes and 40 seconds of extra TV ad time. That translates to eight 30-second ad slots per match, per broadcaster, or around 832 total ad slots throughout the entire tournament.

While viewers in some countries, like the UK, may see more analysis and no ads at all during those breaks, many others are shown full-fledged commercials instead, with broadcasters exploiting every second of allotted time to earn an extra buck.

Reports suggest that a 30-second World Cup ad slot on Fox Sports costs between $200,000 and $300,000, rising to as much as $750,000 during key matches. Based on these numbers, advertising during hydration breaks in the US alone could generate over $250 million. That makes one sip a player takes on the pitch quite expensive, literally. Let’s break it down.

If we take the $250 million estimate for US hydration-break advertising revenue and divide it by 104 matches, we get roughly $2.4 million per match. Split that across two hydration breaks per match, and it comes to about $1.2 million per break. Divide that again among 22 outfield players, and you arrive at roughly $54,500 per player per break.

Now translate that into drinking water. If we assume each player drinks about 0.3 litres during a break, and that an average sip is around 20 ml, that works out to roughly 15 sips per player per break. So $54,500 per player per break divided by 15 sips comes to roughly $3,600 per sip.

A single sip of water is therefore worth thousands of dollars in advertising inventory, and this is if we take the US only. It’s estimated that the global value of hydration-break advertising could approach as much as $1 billion.

So let’s recalculate.

Starting from the $1 billion global estimate:

• Divide by 104 matches → about $9.6 million per match
• Divide by 2 hydration breaks per match → about $4.8 million per break
• Divide by 22 outfield players → about $218,000 per player per break
• Divide by 15 sips per player → about $14,500 per sip

In other words, depending on whether you look at the US market alone or the global broadcast ecosystem, a single sip of water at the 2026 World Cup may be worth somewhere between $3,600 and $14,500 in advertising inventory.

Of course, this is still just an illustrative calculation. Not every player drinks the same amount, not every broadcaster monetizes every second equally, and real-world broadcast conditions are more complex than clean equations suggest. But even with all those caveats, the scale is hard to ignore.

Americanization of sports or the rise of the ad-supported world?

Everything we’ve described so far can be seen as the symptom of the Americanization of football. After all, American sports have long embraced commercial interruptions. The Super Bowl is as famous for its ads as it is for the game itself, with many international viewers watching primarily for music performances and commercials. The NBA Finals have drawn criticism for years over halftime shows where commercials often take up more than half of the break, leaving just a few minutes for actual analysis. In other words, stopping the action to sell advertising is nothing new in the US.

But framing this purely as a regional factor would be an oversimplification. Fox does run commercials during hydration breaks, but broadcasters in many other countries do the same. This isn’t one country’s television culture spreading globally; it’s the ad-supported model quietly becoming the default everywhere.

Over the past few years, we’ve seen streaming services roll out ad-supported tiers while making ad-free subscriptions increasingly expensive. Ads are now appearing across every corner of smart TV interfaces, even on idle screens and when connected via HDMI inputs. Football has simply become the latest frontier.

We wouldn’t be surprised if hydration breaks become a permanent feature at FIFA events. The next World Cups are scheduled for Spain, Portugal, and Morocco in 2030, followed by Saudi Arabia in 2034. All of them are host nations where players will likely contend with extreme summer heat. If broadcasters discover that these breaks generate hundreds of millions in revenue, it’s hard to imagine there will be much enthusiasm for giving them up. Even if monetization was never FIFA’s original intention, the organization is unlikely to ignore the fact that mandatory breaks increase the commercial value of broadcast rights. The next broadcasting deal could simply cost more because of them.

If this strategy proves successful, why stop at hydration breaks? By 2050, we might see snack breaks sponsored by McDonald's, restroom breaks sponsored by Charmin, or recovery breaks sponsored by Gatorade. These are probably the most obvious guesses, not necessarily the most imaginative ones, but even they sound absurd. Then again, so did mandatory commercial breaks during football matches just a few years ago.

If you are reading this article, you are probably already much more privacy-conscious than an average web user. That means you know that in the eyes of many corporations and tech giants your data is a product, and they go out of their way to get to it. And the methods they employ are endless: some are well-known, some are less obvious. What many of these methods have in common is how easy it is to overlook them and spill your data. You do something mundane, like installing an app or scanning a QR code, and already your privacy is at risk. In today’s TechTok we answer this question:

What are the most common privacy traps? What things are you doing nearly every day that can endanger your personal information?

When you post personal details on a public platform or fill in an online form with your real name or address, it’s pretty obvious that your privacy is taking a hit. These are scenarios where common sense will get you through: don’t feed your credentials to shady websites or tweet your social security number for everyone to see. But what about other, less clear cases? We collected nine scenarios that you might easily find yourself in, where you risk leaking your personal information without even realizing.

1. Scanning a QR code

QR codes are a staple of everyday life, they are the links between the physical and digital worlds. We scan them to pay for things, to download a menu at a restaurant, to share contact details. The more we do it, the less we think about what actually happens behind the camera pointed at the checkered pattern. And what happens is usually your phone opens a URL, either in a browser or in an in-app web view. The moment that page loads, your device sends a request to the server hosting it. That request automatically includes some information, and the page can also collect more through scripts running on it, depending on how it is built and what protections you use. Here’s the kind of information that can be collected:

• Your IP address. This indirectly leads to knowing your rough location, internet provider, whether you are on Wi-Fi or on mobile.
• Your browser and device information. Device type, operating system, language preferences, sometimes even browser version and device model.
• Language and region hints. If the website isn’t sure about your location or language judging from other data, it may get some additional hints here.

And these are only those things that the server gets automatically. After the page loads, it can run some JavaScript in the browser to get more:

• Screen size and display characteristics. Screen resolution, device orientation, pixel ratio, color depth — all these little details help fingerprint your device and contribute to your profile.
• Time of access. Pretty obvious, but the website can learn about your local time and time zone, it can also record how long you stayed on the page.
• Interaction signals. If the website wants, it can track which buttons you clicked, whether you copied something, how long you spent reading, and so on.

So, basically, treat QR codes as if they were links. We don’t click just any link we see in spam emails, so we should be similarly selective about which QR codes we scan. Only scan those that you see in legitimate places; thus scanning a random QR code on a sticker stamped onto a street light is a bad idea.

Also keep in mind that, after all, QR codes are physical objects linked to physical spaces. Once you scan one, you’re potentially revealing that you were in a specific place at a specific time. It can help link your offline behavior to online tracking or profiling.

2. Allowing push notifications

Another prime example of something so deeply ingrained in our lives that we often use it without any second thought. Push notifications are convenient because it’s the easiest way for an app to reach you and notify you about something important, but that’s exactly why they are dangerous. They give an app a direct, persistent channel to your device — one that can reveal a lot about your behavior, interests, and habits over time.

Over-the-shoulder onlookers. Level zero of why push notifications may be a threat to your privacy is that they may expose sensitive content on your lock screen. No invisible ‘tracking magic,’ it’s simply about someone else glancing at your screen at an inopportune moment and seeing your message previews, banking details, order alerts.

And remember that these notifications can arrive quite literally at any time, that’s their whole point, so be very picky about which apps you allow to send push notifications. Once you give the permission, it’s very easy to forget about it, so it’s best to prevent the potential disaster at the earliest stage possible.

Profiling your daily schedule. Every time an app reaches your phone with a push, it learns that your device is online. By studying when you engage with which pushes it’s relatively easy to learn your daily patterns: when you sleep, when you commute or take breaks, when you’re most accessible. All of this may not feel as privacy-threatening as leaking your email or phone number, but it does help build your digital profile and manipulate your behavior.

Not always good for your mental. It’s not about privacy per se, but feels right to mention it here — push notifications can easily mess with your daily rhythm and your routines. Getting constantly bombarded with pushes disturbs your peace of mind and elevates anxiety. Take a look at which apps on your phone have push notification permissions — we bet if you disable half of them, you wouldn’t miss anything of real importance, but would save yourself some nerves.

3. Handing out unnecessary permissions

Piggybacking on the previous point, in general, do not give apps on your phone more permissions than they need to function properly. When your maps app asks for location permission, it’s a legitimate request. When a sudoku app does the same, you can probably deny it without losing any functionality.

Most people can use common sense to judge whether an app really needs a certain permission. The problem lies elsewhere. So many of us are in a constant hurry: a friend shows you a cool app, and you rush to the store to download it. Once the download is complete, you tap the icon, and instead of the main screen you see an annoying permission popup. If you’ve never been in this situation, impatiently tapping ‘Allow’ without stopping for a second and giving it a read, you are a much more patient person than most.

Make it a habit to slow down every time you install a new app and to think for a moment about which permissions the app actually needs. If you want to take things a step further, consider reading the privacy policy. It may not be easy, though, as many unscrupulous developers make the privacy policies for their apps and browser extensions intentionally obscure or hard to find. But this is the next level — shutting down any attempts of getting unnecessary permissions is a good starting point for anyone looking to up their privacy game.

4. Installing free apps and extensions

This one is with an obvious caveat. Not all free services and apps are bad, claiming that would be taking it too far. But the simple truth is, people rarely give anything out for free. When you are about to install a free app on your device, ask yourself: why is it free? Sometimes there is a legitimate reason for that, like when a free version of an app also offers a paid pro plan, or it’s a freemium game that hopes you will later purchase in-game objects, or perhaps it’s someone’s passion project.

But in many cases, a free app comes at the cost of extensive tracking. Smaller developers often include analytics and ad SDKs (Software Developer Kits) into their apps for monetization purposes, and these SDKs collect stuff like your behavioral data, device info, and usage patterns. And in the worst cases, free apps serve as gateways for viruses and various phishing scams. It doesn’t mean that you should stop using any and all free apps right this moment, but think twice every time you’re installing a free app. Ask yourself if you really need it, and if the answer is ‘yes,’ arm yourself with your trusty ad blocker and stay alert to signs of phishing and other foul play: missing or rudimentary privacy policy, unknown developer, lack of reviews, low installation count.

5. Clicking through cookie consent popups

Cookies have earned themselves a bad reputation among privacy experts and users who care about the safety of their data. And for a reason — they can be easily abused to track you across websites, build your digital dossier, and in many countries, especially in the EU, websites are required to ask for your consent before storing any information about you inside cookies. You know what we mean — those ‘We value your privacy’ banners that pop up when you navigate through a link to read an article or browse an online shop. They usually have a highlighted Accept All button that begs to be pressed, while other buttons like Customize or Reject All take a back seat, trying to be as invisible as possible.

A typical example of a cookie consent popup with the ‘Accept All’ button highlighted. Source: Webtoffee

This is all by design, of course. Websites need to abide by the law, but they also want to track you if they can get away with it. So they present the choice in such a way that pushes you towards making the choice you otherwise wouldn’t. When you really want to read that article, you are much more likely to click on the first thing that draws your attention to make the banner go away. Instead, take a second to find a more appropriate option than ‘Accept All.’ Even in the most severe cases it doesn’t take longer than half a minute to avoid consenting to something you don’t want to, and usually all it takes is literally a second or two to avoid the initial impulse and click the less flashy button next to it.

6. Signing in with Google/Apple/etc.

On the list of things that feel way more annoying than they really are, signing up for a new service has to be close to the top. Typing in your email address and password, opening your inbox, maybe waiting for a minute or so and clicking the confirmation link — if we’re being honest, it’s not too hard or too long, but given the option, we’d rather not do it. And how convenient is it that there’s a “Sign in with Google” button right next to the Sign Up one! Why wouldn’t you select this option and bypass all that fuss?

An example of social login buttons designed by @nelsonic

But when you start thinking about it, the drawbacks become apparent. Every time you use a social login, the app or website may receive a stable account identifier from Google/Apple/Facebook that makes it easier to link your activity across services. Think of it as if you’re using the same master key to enter many different buildings — which is convenient, except you are letting a company like Google or Apple hold that master key for you. This company now knows where you go, and if the key is lost or stolen, your access to a lot of places will be affected at once.

This isn’t just about convenience or even about access. Once the website has that stable identifier, it can start treating you as the same person every time you come back, even if you’re using a different browser or device. That makes it much easier to tie together what you do on that one service: what pages you visit, what you buy, what you click, how often you return, and how long you stay. In other words, the site may not know your whole life story, but it can still build a pretty detailed one inside its own database. But from the website’s point of view, that’s not very different from the case where you sign in ‘the regular way’ by creating an account.

The real difference is that now there’s the company holding the ‘master key.’ Whether it is Google, Apple, or Facebook, it can see that the same account is being used to sign into different services, which means your activity can be linked across the web at a much larger scale. So now it’s not just one website knowing you’re a repeat visitor — it’s one big company potentially seeing that you show up at many different doors, over and over again. That’s where privacy starts to shrink: not because every site suddenly learns everything about you, but because one identity layer makes it much easier to connect the dots.

The solution is pretty simple — try avoiding using the social login feature. Creating an account doesn’t take that much effort or time, and, as a bonus, you can use an alias or a temporary mail service like AdGuard Mail to further strengthen your privacy.

7. Using Google and other non-private search engines

We use search constantly, dozens of times a day. It comes so naturally that we don’t even think about it — your mind is still thinking, but the fingers have already started typing the query. It feels quick, and it feels private: it’s just you and the search bar. If we feel like we are searching for something sensitive, we might switch to incognito mode (which hardly offers any privacy, by the way), but usually that’s about it.

And when we google something, most of us use, well, Google. It hasn’t become the synonym to online search by accident — it still holds over 90% of the search engine market share. And whenever you use Google or another non-private search engine, like Bing, Baidu, Yahoo, or Yandex, it may store your queries, tie them to your account or device, and later use this information for personalization and advertising. Fortunately, it is easy to avoid this issue — just switch to a privacy-oriented search engine like DuckDuckGo or Brave Search. They are designed not to associate your searches with you personally in the same way mainstream search engines do.

Another, maybe less obvious privacy issue tied to search engines is shoulder surfing. Even if you are aware that someone is standing next to you and cognizant of what you type, autofill makes it easy to display something that you wouldn’t want to become public. Start typing ‘how many…’ into the search bar, and it will automatically suggest you something like ‘how many countries are there in the world.’ This is a very innocent example, but in reality suggestions are based on your location, language, and past searches, and it’s very easy to conjure a scenario where autofill could leak something private about you. It is another example of the compromise between convenience and privacy, and you can make this choice for yourself, just be aware that there is a choice.

8. Talking to AI chatbots

In the previous TechTok issue we already talked about how AI chatbots can or can’t use your data for training and other purposes. Long story short — it depends on which AI you are using, but the rule of thumb is that if you say something to a chatbot, more often than not it can be used for whatever purpose the company behind it sees fit. You can opt for models that collect less information about you and look for settings that disable or restrict tracking.

Key takeaways from the last TechTok article:

• Among the popular conversational AI models, Claude is the only one that doesn’t collect your data for AI training by default
• Perplexity and Gemini have options to disable future data retention, but turning it off will not affect past interactions
• ChatGPT has an opt-out option in settings, but some data retention will continue in any case
• Ad blockers can stop third-party trackers that may run on chatbot websites. However, most major platforms rely heavily on first-party tracking that can’t be easily dealt with
• Best privacy protection when talking to chatbots is caution: choose your AI carefully and do not share personal details without a good reason

9. Using a public Wi-Fi

We will finish the list off with, possibly, the biggest privacy no-no that you can commit: connecting to an unprotected Wi-Fi network without a VPN and other digital protection tools. Everyone knows that it’s dangerous, everyone knows that you shouldn’t do it, and yet some people do it anyway. A quick reminder why exactly it’s dangerous:

• It gives anyone with technical knowledge and an ill intent an attack angle. They can potentially see which websites you visit, which requests your browser sends — this can include sensitive info like payment details.
• Public Wi-Fi can be used for man-in-the-middle attacks. A malicious actor may position themselves between your device and the internet connection so they can monitor, modify, or redirect traffic. That can be used to steal login details or push you to fake websites.
• It’s easy to trick someone with a fake hotspot. Attackers can set up a Wi‑Fi network with a name that looks legitimate, like “CoffeeShop_Free_WiFi,” and lure people into connecting to it. Once you’re on the wrong network, they may be able to intercept your data or redirect you to malicious pages.

These are just some of the reasons. There are plenty more, but the point remains: do not connect to public, unprotected networks, unless you are protected by a VPN. It doesn’t mean that the second you connect to the airport hotspot all your credit card information will be stolen, but every time you do that, you are tempting fate for no good reason at all.

The list is, of course, non-exhaustive, and there are more threats to your privacy out there. It should, however, help you shore up some of the weaknesses in your digital habits that you might have, and also set your mind on the right course. If there is one underlying thought to all of these nine examples, it’s “treat your privacy with respect.” Don’t choose a slightly more convenient option automatically just because it might save you a couple of seconds; stay vigilant, stay critical, and good things will happen to you — or, at least, less bad things will.

Some of you might notice something different about the title of this post.

You’re not imagining it: we’re bringing back the original name. What started in 2018 as the Ad Blocker Developer Summit later became the Ad-Filtering Dev Summit — but this year, we’re going back to our roots. Old-new name, same community.

And speaking of coming back: Ad Blocker Dev Summit 2026 is officially happening!

This year we're bringing it somewhere new: Copenhagen, Denmark, on November 3–4. ABDS 2026 is once again co-organized by AdGuard and eyeo, and it's free to attend.

Zoku Hotel, Copenhagen

Have something to share?

The call for speakers is open! If you’re working on something relevant to ad blocking or privacy protection, we want to hear from you.

Talk submission deadline: August 16, 2026.

After reviewing all submissions, we’ll get back to you in late August with decisions.

Just want to attend as a guest?

Join us in Copenhagen for two days of insightful talks and engaging conversations. Attending ABDS is free — just be sure to register in advance:
Register as a guest

What is the Ad Blocker Dev Summit?

If you’re new here: ABDS (formerly Ad-Filtering Dev Summit) is the annual gathering for everyone who works on making the web a less intrusive, more private place — developers, filter list maintainers, browser engineers, privacy researchers and advocates, and everyone in between. Last year’s edition in Limassol brought together speakers from AdGuard, Brave, eyeo, Ghostery, Google, Malwarebytes, Mozilla, Opera, and more.

Watch the trailer from 2025:

And here is the full playlist of talks from last year’s summit.

If you have any questions, please reach the org team at contact@adblockerdevsummit.com.

We hope to see you in Copenhagen this November ;)