Good morning! For a brief moment, there was a glimmer of hope that the U.S. might be on a path to a real data privacy law. But as my old pal Dell Cameron reported on Thursday, it still ain't happening for the foreseeable future. So the onus for your kid's privacy still falls largely on you.

Spoiler alert: I'm going to recommend a product, or at least I'm going to endorse the Consumer Reports endorsement of one: the Eufy E110 baby monitor. As a reminder, this newsletter/blog is a free project I'm undertaking for my paternity leave. I've received no compensation whatsoever from any manufacturer, but my best judgment and discussions with experts leads me to conclude they've made the right call.

Here’s how I got there, why pretty much any local baby monitor is probably fine, and why you shouldn’t use any model that connects to the internet.

I'm one of those guys who knew practically nothing about how to prepare for a baby besides frantically reading books and Reddit threads the months before my son's due date. It didn't occur to me that we would need a passive camera living in our house until my wife was in her second trimester and we started our registry.

As a cybersecurity reporter, I was more than familiar with the scores of parents who have shared nightmare stories of cybercriminals hacking baby monitors to spy on, harass, and threaten families. A hacker who gets access to your baby camera might make you part of their botnet, or sell access to a live feed of your sleeping child to pedophiles? No thank you.

Once I realized that becoming a parent means being bombarded with decisions like how to pick a safe monitor — the impulse that led me to start this newsletter — I called a few experts who I knew had kids, including Cooper Quintin, a cybersecurity researcher at the Electronic Frontier Foundation, to ask how he dealt with it. I reached out again for this week’s post.

"My advice to new parents would be, definitely don't get something that connects to the internet," he said. 

"Anytime you have a cloud service, this represents a potential attack surface that people can possibly hack into,” Cooper said. “I don't want anybody who gains access to the baby monitor cloud — which is a ridiculous combination of words — to be able to see a live video of my baby or my house." 

This is the same sentiment I've heard again and again in conversations with privacy and security experts. Nobody could name a type of baby monitor that they were confident was completely secure. But "nothing is perfect; therefore, you have no options" is not practical advice. Nor is it in the spirit of this newsletter, so here's where I landed: For most people, the most secure type of baby monitor is any one that generally fits your needs and has no option to connect to the internet.

Let me lay out why internet-connected monitors are dangerous.

The argument is simple. As I wrote earlier, a privacy-minded parent should prioritize preventing bad folks from accessing images of their kid. Pedophiles want them, and AI companies want to gobble up your family's photographs and videos to train their models. 

And you simply cannot trust any baby monitor to be unhackable. There's an enormous difference, however, between a camera that connects to the entire internet and one that only uses a signal that reaches just a few hundred feet at most. If you have reason to suspect your closest neighbors might be criminal hackers or pedophiles who might have the ability and motive to break into your local monitor's video signal, that's absolutely a concern. If not, you're probably safe with any model that isn't connected to the internet.

I realize that for some parents, an internet-connected monitor sounds useful because it provides you with more options. But turn it around — what is the scenario where your kid is asleep in another room and you need to be able to tend to him at a moment's notice but a range of hundreds of feet isn't enough?

Cheaply made Internet of Things products, or products that don't have a dedicated team working on their security, get hacked all the time. Products that do have dedicated security teams get hacked all the time. Cybersecurity is an extraordinarily unsolved problem and will continue to be for years.

Cybercriminals looking to get access to a live feed or recorded video of your child sleeping have options. They may break into the company that makes the camera to gain master access to livestreams, or to view all customers' internet cloud storage of recorded video, or they may get your account login information and sign in to stare at your kid or sell access to creeps. Most anecdotes I've seen seem to be the hacker getting access to an individual's account, a perpetual bugbear for the entire cybersecurity industry. I'm also reminded of three years ago, when my friend Will Turton broke the news that a hacker group had breached Verkada, a major cloud security camera company, and got access to some 150,000 customers' feeds in real time.

Some of these cameras have some security measures, but none are foolproof, so I'm reluctant to rank internet-connected cameras by which ones have decent cybersecurity features versus which have practically none.

I called Allen St. John, the senior privacy editor at Consumer Reports, which does exhaustive testing of baby monitors, including for privacy. All internet-connected baby monitors had potential vulnerabilities, though some were more egregious than others, he told me. You can check out their entire rundown, but their highest rated monitor, which of course has no internet connection, is the Eufy’s local internet monitor, which currently is the E110.

As it happens, Wired also has a baby monitor guide. Their best overall monitor is wifi-enabled, and I obviously can’t get behind that, but they also choose the Eufy as the best local one they tested.

So there you have it. The Eufy E110, or whatever they call their local monitor by the time you read this. Or any of the other half dozen or so well-reviewed local baby monitors. Just avoid the internet.

Ps: I still want to hear your parental privacy etiquette questions or stories. Did a conversation where you asked somebody to take down a photo of your kid go better or more poorly than expected? Please let me know at kevin@cyberdad.info. I'll obscure any personal information in your anecdote unless you explicitly tell me that isn't necessary.

I can’t tell you how many times this week that I whipped out my phone and took photos and videos of my infant son without a second thought. I want my friends and family spread across the country to see every smile.

He’s astoundingly cute and sweet. And you’re just going to have to take my word for it.

Last week, I detailed all the horrible potential repercussions of posting photos of your child to the open internet, which includes and this blog/newsletter. So today I want to go over the ways you can share them with friends and family without inadvertently cc'ing predators, bullies, data brokers, and companies that want to exploit your kid for AI training.

This also gives me a chance to address something specific that several friends have asked me since they learned I was doing this project: can I post photos of my kid to Instagram Reels?

One question for you before we get started: I've been thinking a lot about etiquette. What's the best way to politely tell a friend or uncle or cousin that it's ok to take a picture with your kid, but they need to follow certain rules if they want to post it? How do you bring it up with daycare or school or camp or a youth sports league that routinely posts photos of kids? If you have an experience that went well or poorly or have a related question, please email me: kevin@cyberdad.info. I'll anonymize anything you tell me unless you explicitly tell me that isn't necessary.

Trying to tackle privacy broadly can be so overwhelming, so to answer this question I'm tapping into a key concept from my day job as a cybersecurity reporter: threat modeling. That means we first identify what exactly we're worried about, then come up with solutions to address those concerns specifically. Fortunately, we have that first part already from last week's post. As a reminder, the four big risks of posting your kid’s face to the open internet are:

*Predators search social media for pictures of children.

*AI companies are gobbling up pictures and videos, including of kids, to use as training data and to do whatever they want with in the future.

*Creeps find photos of kids and use AI to create CSAM (Child Sexual Abuse Material) from them.

*You don't have any young child's consent — yours or anyone else's — to share their likeness with the broader world.

After speaking with a few experts, some on the record and some off (you know who you are — thank you!), I've identified four tiers of ways to share photos and videos of your kid while steering clear of those four threats. Personally, I'm sticking almost exclusively with the first one. But I want you to be able to make an educated decision.

Tier one (most private): Use good old fashioned text messaging, directly or in a small group.

Surprised? I was, but the logic is sound.

For one thing, this way there's no doubt who you're sending photos of your kid to. Their names are at the top of the group chat. No access for internet creeps, bullies, or bots trawling to feed to AI companies. But a tightly curated group chat of people you know and who understand they aren't allowed to share those photos without explicit permission, please. Not some WhatsApp group with 1,024 members.

The photos live on your phone, your trusted recipients' phones, and maybe on your or their cloud backup accounts. That's it.

And while that doesn't preclude somebody getting access to those accounts — and if you want to go the extra mile, encrypt and password-protect your backups! — really, this addresses most scenarios that would violate any of our four concerns.

Also, a big bonus to text messages: they're some of the very rare data that get a special protection under U.S. law. The Electronic Communications Privacy Act of 1986 makes it fairly easy for government agencies to get information about your emails and texts, called metadata, but it also protects messages content unless there’s a warrant or court order involved. That’s a huge concern for some threat models, but not what we’re worried about as regular parents.

To be clear, while you can use traditional SMS/MMS messaging, I'm really talking about the four major apps that have effectively taken their place: WhatsApp, Signal, Apple iMessage, or Google Messages. (Using those services for texting but with extra features like encryption, live video chat, and high quality photos and videos is called OTT, or Over the Top messaging. That will not be on the quiz, and sorry if that fact pushed out something important in your brain.)

Signal is the most secure messaging app for everyday use. Its encryption protocol is open-source, meaning anyone can inspect it for flaws, and it's so respected by cryptographers that the other three companies openly advertise it's what they use to power their messaging apps. Signal has a couple additional bells and whistles that make you even safer from two big-league hackers or subpoenas from law enforcement, which is why it's a must when I'm talking to sensitive sources for my day job.

If neither of those things are in your threat model, though, you're probably also safe with one of the other three options. Personally, I convinced my family to download WhatsApp for photos of my kid. It wasn't a hard sell and it’s easy for everyone to use.

The other two, Google Messages and Apple iMessage, are also pretty much the same thing. But with both apps, you only get the full features if everyone in your group chat uses an Android or everyone uses an iPhone.

If at least one person in your Messages or iMessage group doesn't have the right phone type, it will default to traditional SMS/MMS protocol, something you may remember from pre-smartphone days. That smushes pictures into a smaller format and degrades videos to the point they're borderline unwatchable, making it less than ideal for our purpose.

My wife's family all uses the same type of phone, so they never even had to have this discussion when sharing pictures of our son. If that's you and your family or friend group, great. If not, push for them to use Signal or WhatsApp.

Tier two: Curate photos and videos in Apple or Google albums.

Maybe you want to be a little more formal than interspersing photos and videos in a chat. You can spend some time picking your favorite pictures, maybe make it a theme, and you can send it to multiple trusted people.

Calli Schroeder⁩, who’s both a parent and senior counsel at the Electronic Privacy Information Center, a leading digital privacy nonprofit, told me that the privacy policies for Google and Apple's respective photo album platforms are surprisingly robust and should suit most parents’ needs, at least as they're written at the moment.

"With tech companies, there's always a possibility they're going to change their policies in the future," Calli said. "But it's also kind of a matter of practicality."

Most parents I know back up their phone's pictures automatically to their Google or Apple storage accounts. As things stand now, that’s a pretty safe practice.

Tier three: Post photos of your kid on social media apps, but either do it through a private account or obscure kids' faces.

I'm a big, big believer of drawing a firm line between your public online life and general private life, and strongly recommend it for everyone. If you set up clear boundaries for yourself, most privacy decisions become much easier. (Another great option is to simply have no public online life, though I think that's increasingly hard: Are you going to maintain your career without a LinkedIn account, for example?)

My job requires me to make some aspects of my life public. I'm on camera from time to time, so it's pretty easy to ID me as an elder millennial white American man. I'm open about a few basic biographical things: I live in Brooklyn; I'm from Huntington, West Virginia; I have a bachelor's degree; I'm married to a woman and we have a son. That information is out there and I'm never reeling it back in. But there's a lot more I'm never going to deliberately make public, especially more specific information about my family.

With that line clear in my head, I don't see much need to post public photos of my adorable son, though yes, I did include him in the profile picture I use for this newsletter. The rare times I do post a photo of him, I'm going to hide his face, either by camera angle or emoji.

You similarly can post photos of your kid to a locked or private Instagram, Twitter, Bluesky, or YouTube account, or adjust your Facebook settings to only share with people you know and keep that list very small. If you know that you've successfully limited your followers, you probably don't have creeps or potential bullies mining what you post, though this method to me seems like more trouble than it's worth.

You also don't have a guarantee that the company won't change their terms of service to allow it to use your kid for AI training data in the future. Meta's terms of service says it's fair game for the company to use your public Facebook and Instagram posts to train its AI models, which makes sense considering that other companies are also already doing that. For now, at least, they don't train on private accounts.

I didn't mention TikTok here because of the ongoing questions about the relationship with its parent company, ByteDance. Chinese law holds that data held by its companies is effectively the property of the Chinese Communist Party, and we know that China's intelligence services have a vast, ongoing project to steal information about Americans in bulk. Whether the U.S.-Silicon Valley tech data complex does the same thing is more of a digression than I can handle in this post, but at least the U.S. government generally requires court orders to get Americans’ personal information from tech companies. Anyway, I particularly distrust TikTok when it comes to worrying that the video you post to your private account might end up in AI training databases or used by China in the future.

The cost-benefit of taking an existing account and pruning out most followers seems not worth it to me. But if you’re going to post your young kid on Twitter or Facebook or even TikTok, definitely make it a private account. 

Tier four: Post to public social media that automatically disappears, like Instagram Stories or Snapchat.

Disappearing messages is a fantastic privacy tool for texting. For social media, it's more of a mixed bag.

I think that unless you're constantly posting photos of your kid in compromising situations, it's unlikely that perverts or scraping tools are going to lurk on your account and rapidly screengrab whenever your kid shows up.

This is one of those scenarios where for now, I think you don't have to be faster than the bear, you just have to be faster than the other hiker. But who knows what our technology landscape will look like in a few years? 

That's it for today. Tell me if this strategy works for you. And don't forget to email me at kevin@cyberdad.info with your questions and experiences in privacy etiquette! I think that one's going to have to be a group effort.

Happy Father’s Day! I’m going to celebrate my first one as a dad, and my first real post with this newsletter, by throwing a bomb: four reasons why you shouldn’t publicly post any photos of your child.

My intention today is service journalism. A lot of parents I know innately shy away from posting photos of their kids online. Plenty of others see no real harm in it. Both camps, however, seemed generally guided by vibes. So I sought out reasons why it is or isn’t a good idea. (Spoiler: I couldn’t really find any good argument for sharing a kid’s image with everybody on the planet.)

Some housekeeping: You can subscribe to the Cyber Dad newsletter here. The RSS feed is here. If you don’t subscribe already, this newsletter is free.

We all have a high-resolution camera with us at all times, and adoring your baby and wanting to capture every moment is the most natural thing in the world. So it's a given that we're going to want to take and share a lot of pictures.

But I'm here to argue — and privacy and cybercrime experts resoundingly agree with me here — that you should make a significant effort to not post any photos or videos of your young child's face to the public internet. Period.

To some people, I'm preaching to the choir, and you may find this post useful to send to friends and family members who might not think twice about posting a photo they snapped of your kid.

To others, this will sound extreme. But note that I said public internet. I'm going to follow this post with one about safer ways to share photos of your kids: in group chats with friends and family, to private social media channels, or with kids' faces covered.

Once you post a child's face to a public social media channel — like to an Instagram, Twitter, or TikTok account with default public settings, or even potentially to a large Facebook or WhatsApp group — you are instantly and effectively permanently ceding that photo, and your child's likeness, to the whole world. Even if you don’t have many followers, there likely are more bad actors watching than you might think. I find that generally unsettling, but I've got four specific reasons why it's crucial to avoid.

• Online predators lurk even on what might seem to be innocuous channels where parents post seemingly innocuous photos of their children.

• We are currently in the middle of an unprecedented gold rush of new artificial intelligence companies scooping up photos wherever they can for training data. There is very little regulation on these companies and we have no idea what will happen with the images they grab, save that you probably can't stop them once they have your kid's pictures.

• Speaking of AI, an alarming trend is surging where AI apps makes it easy for creeps — whether they're adult pedophiles or your kid's classmates being awful — generate nude images from a normal picture of a clothed young person. Being teased or bribed with even fake nude photos can cause a child untold emotional turmoil, and has even led to deaths by suicide.

• No young child can give consent to their photo being shared forever on the internet, by definition. If you think a child should have some agency over their own image — and I do — it simply isn't your call to make.

I realize that some people who read this will have already posted photos of their kids or grandkids or nieces or nephews to a public channel. You're not a terrible person and it's not the end of the world. But it does mean you should take them down or lock the accounts that share them if you can (again, I'll explain that more in depth soon), and avoid doing so in the future.

In other words, the best time to vow to not post pictures of your kid online is the first time you take one. The second-best time is today. Here's why.

1: Predators stalk photos of kids posted to social media.

There are more predators searching for photos of children than you can account for.

A profoundly disturbing New York Times investigation earlier this year found that among parents who devote public Instagram accounts to their young girls, posts that were more suggestive were more likely to receive likes and comments.

In some cases, Instagram will remove accounts that are repeatedly flagged as inappropriate. But accounts that are less overtly exploitative generally survive, often with pedophiles brazenly commenting about the girls' bodies.

The predators aren't always so obvious, though. Take the viral saga of Jacquelyn Eleanor on TikTok. An influencer mother who tirelessly documented her young daughter on the platform, Eleanor’s posts showing her child doing things like eating a corndog or drinking from a straw garnered more likes and saves.

Will the creeps descend on your child even if you aren't a popular influencer? They might. A report published earlier this year by the Australian Institute of Criminology found that among surveyed Australian parents who posted pictures or other information about children online, 4.8% have been contacted by online predators asking them sexualized questions about the child and/or for CSAM depicting them.

[Style note: Most American newsroom style guides no longer use the term "child pornography," and instead use the term Child Sexual Abuse Material, or CSAM, a convention I will use in this newsletter.]

It seems likely that if you don't have many followers and you aren't posting suggestive photos of your child, it will attract fewer predators. But the only way to definitively halt them en masse is to not give them access to pictures of your kid in the first place.

2: AI companies are currently scouring the internet for whatever videos and photos of people they can get. Do you want them to have your kid's likeness?

Right now, we're smack dab in the middle of a generative AI gold rush. Companies funded with untold investor riches are racing to put out programs to imitate human faces, speech, and bodies.

No one can predict where this is headed. But as I write this, that industry is relentlessly gobbling up online words and images to use as training data. They'll take anything that isn't explicitly prohibited — companies like Reddit and Slack have recently changed their terms of service to tell their users that their accounts are now fair game to be mined unless they opt out — and it's probably safe to assume some AI companies are scraping stuff they legally aren't supposed to.

A few weeks before I launched this newsletter, I spoke with Zach Edwards, a senior threat analyst at Silent Push and an advisor at the nonprofit Internet Safety Labs, about what I should tell privacy-minded parents.

"The thing that most parents need to not do is upload unedited photos of their children to major social networks, especially with a public tag on it," he told me.

"Basically all of the platforms — if you 'make your content public' — all of them are ingesting them. OpenAI ingests content that's public. Facebook, Twitter, any of the social networks, if you make a piece of content public, terms of service basically allows them to parse it for their own means," he said.

When I spoke with Zach, that was a theoretical concern. In a sign that shows just how quickly this stuff is moving, this week Human Rights Watch put out a first-of-its kind report that found a major company that sells AI training data sets, LAION, included at least 170 pictures of Brazilian children in one of its packages. The kids had no knowledge and couldn't give consent to be used for AI training, the report found.

I was curious, by the way, whether the rapid rise of facial recognition technology meant the technology will soon be able to identify an adult's baby photos, as that would be yet another reason to hold off. So I asked Kashmir Hill, author of the best current book on the subject, Your Face Belongs To Us. (Also, she's a parent too.)

"These algorithms aren't that good yet at linking our five-year-old selves, our 13-year-old selves, to our 30-year-old selves. But I just don't know what's going to happen over time as the algorithms are going to get better," she said.

3: Predators can use AI to generate fake nude images from normal photos, which can have devastating effects on minors.

One of the darkest uses of AI so far is the rise of nonconsensual deepfake porn: programs that take a photo of a fully-clothed person, usually a woman, and spit out a synthetic but convincing image of what they might look like naked. There's already a glut of programs to do this, only a web search away.

As you might imagine, these are also already being used against minors. Another recent, horrifying New York Times investigation found high school boys sharing deepfaked nude pictures of their female classmates. While AI didn't invent that sort of sexualized bullying, it makes it far easier.

A 2017 Canadian Center for Child Protection survey of CSAM surivors found that more two-thirds of them worried that once abusive images of them were circulated, their exploitation would never end, and that they worry "constantly" about being recognized.

In fact, cybercriminals bullying victims — often underage ones — with deepfaked nude images is the basis of one of the most insidious scams active today. In some cases, the underage victim then died by suicide.

4: You don't have your young child's consent to share their likeness with the whole world.

This one is simple and straightforward, but it often doesn't occur to people who were teenagers or adults when they first started putting their own photos online.

A baby or a young child obviously cannot give consent to having their image irrevocably shared to the public internet. They don't know what it means, so it simply isn't your call to make. You don't know that image will one day be weaponized against them, distorted, used to bully them, embarrass them, or take away an important part of their agency.

Maybe once they're older they'll tell you they wouldn't have minded. At that point they are free to upload the photos you were so careful with.

In addition to this being, in my opinion, a clear moral call, it may prove to be a legal one too. One state, Illinois, has already cleared the way for children of influencers to sue their parents for exploiting their likeness as children, and several other states are considering similar legislation.

Here's something I don't know: when you should let a child make the choice to upload their own image to the internet. According to a Pew poll last year, the overwhelming majority of teenagers use social media.

Do those older kids fully understand the risks? That's beyond what I'm capable of addressing today, or perhaps ever. But I do know no young child cannot give consent to post their pictures online, and that means nobody has it.

Hi! I'm Kevin Collier. I've been a professional cybersecurity and privacy reporter for more than a decade, a career I'm blessed to have. A few months ago, I welcomed my first child into the world.

While my job has always been fascinating, having a kid gives a new urgency to the stuff I cover. Even before he was born, there were people I don't know, working at companies I can't name, gathering information about my son. They bundle it up, compare notes, make inferences that may or may not be accurate, and sell it to each other. They have little incentive to keep that data safe, and are liable to get hacked and leak my kid's information about my kid into the cybercriminal underworld. Most of what these companies do is legal — or at least, it usually isn't explicitly illegal and therefore isn’t going to be prosecuted.

This is the simple reality of practically every child in America. That bothers the hell out of me.

There are so many resources out there for parents, but precious few specifically and thoughtfully aimed at helping parents keep their kids' information safe online. Fortunately, I talk to privacy and cybersecurity experts for a living.

For weeks now, I've been chatting with them, particularly ones I know have kids of their own, asking for advice. Most people don't get to do this, and it feels selfish to not share what I've learned. Hence, this newsletter. In the coming weeks, I want to share with you some tips and insight on topics like:

• Who gets custody of your kid's image?

• How to reduce what data brokers know about your child — or at least muddy the waters.

• Picking a baby monitor that minimizes the chance that creeps can stare at them while they sleep.

• How you can lead by example as a privacy-conscious parent.

• Should you use apps that track your baby's feeding and poop cycles?

A few notes on my outlook here:

Sometimes a privacy or security issue has what appears to me to be a definitive solution. In those cases, I'm going to come out and say it and why I think that’s true. But far more often, these things are very muddy. In those cases, I'll do my best to lay out pros and cons, or to game out multiple options, with the hope that it eases your decision-making process as a parent.

I have become a big believer that children should be able to consent to what gets posted about them online. Obviously every parent makes a lot of decisions for their child. But when possible, I want to err on the side of letting the kid have custody of their faces and personal information online. If they want to showcase themselves when they're older, they're welcome to on their own terms.

But advice is useless if it's too impractical. I personally know some privacy maximalists who go to extreme lengths: They either don't own a smartphone or have a phone plan, or they refrain from all social media. Or they run their own email services from home. Or buy their home through a shell company to hide from marketers. If that's you, great! But I also want to meet everyday parents halfway, and I realize that either financial constraints or simply engaging in modern life requires us to make some privacy compromises. I'm interested in advice that most people can take.

Something I've learned in my years covering cybersecurity is that one of the best ways to think about online dangers is something called "threat modeling." That means that rather than trying to take absolutely every possible step to protect yourself, you take a deep breath and try to imagine what your biggest dangers are. You then craft a plan to counter them specifically. Whenever possible, I want to game out why you might want to take a step to protect your kid's privacy — or why one might not be worth the effort.

Say that your threat is pedophiles or AI finding and downloading pictures of your kid — that's a very real worry. But to stop them, you don't need to throw your phone in the ocean or move to an isolated cabin with no wifi. A more tailored solution involves thinking hard about who you send photos to, what websites you post them to, the sharing permissions you set on those websites, and to obscure the faces of any kid you post. 

A little housekeeping: My employer has a generous parental leave policy, at least by American standards, which is the only way I have the time to do this (in-between naps). This is purely a personal project, and it doesn't represent the company I work for. I am an American, and for practical purposes I'm coming at this from a US-centric approach, especially when it comes to privacy laws (or the lack thereof in this country). There is no paywall, and I'm not asking for or accepting any money or other compensation for this. I'm just putting it out there in hopes it helps a few parents with an issue I worry about. 

Finally, I want this to be a two-way street. If you have a parental privacy issue I might be able to help illuminate or solve, let me know at kevin@cyberdad.info.