GUARDIANA

CASES AND SOURCES

Real cases and sources

Those who promised to protect you sold your data. Those who sold you the device were listening.

Regulator rulings, court settlements and government decisions from several countries, with date and source. That is why we do not ask you to trust us: we publish the code, the hash and the signature of every version. Where a company denied the facts, we say so.

$16.5MAntivirus · 2024

Avast · sold the browsing of the people it protected

The FTC found that Avast, while promising to block tracking, sold detailed, re-identifiable browsing data to more than 100 third parties through its subsidiary Jumpshot between 2014 and 2020. It is banned from selling browsing data for advertising. Avast disagrees with the characterisation of the facts.

FTC · FEB 22, 2024

See the file →

$95MApple · 2025

Siri · recordings without "Hey Siri"

Court-approved settlement in Lopez v. Apple: the plaintiffs alleged that Siri recorded conversations without intentional activation and that human contractors reviewed them. Apple paid without admitting wrongdoing.

US DISTRICT COURT N.D. CAL. · 2025

See the file →

8.5MSecurity · 2024

CrowdStrike · a faulty update took down millions of PCs

On July 19, 2024 an update to the CrowdStrike Falcon security software caused blue screens on about 8.5 million Windows devices, according to Microsoft. Airports, hospitals and banks ground to a halt. It was not an attack: it was the guardian itself.

MICROSOFT · JUL 20, 2024

See the file →

Amounts in the currency of the original ruling. A settlement does not imply admission of guilt: Apple and Avast denied the allegations. We include them because the pattern — privacy promised, something else delivered — is what GUARDIANA avoids by design: nothing leaves your home towards us. Case files are shown in Spanish; every link goes to the original document.

Sources

Every figure on this site that is not a reading from your own browser or a labelled mock-up comes from one of these sources. Consulted in September 2026.

  1. The Verge — National Public Data confirms the 2.9 billion-record breach (Aug 16, 2024)
  2. Citizen Lab — CatalanGate: Pegasus and Candiru against 65 people in Spain (Apr 18, 2022)
  3. FBI + CISA — Joint statement on the Chinese intrusion into US carriers (Nov 13, 2024)
  4. Reuters — Google to destroy Incognito browsing data to settle the lawsuit (Apr 1, 2024)
  5. GeekWire — T-Mobile: $350M settlement over the breach of 76M people (Jul 22, 2022)
  6. Journal of IT Teaching Cases — The Vastaamo case (2024)
  7. OAIC — Enforcement action against Medibank over 9.7M Australians (Jun 5, 2024)
  8. elDiario.es — Spain's AEPD fines LaLiga €250,000 over its app's microphone (Jun 11, 2019)
  9. INCIBE — The AEPD fines Vodafone €8.15M (Mar 2021)
  10. The New York Times — ToTok, the messaging app used as a spying tool (Dec 22, 2019)
  11. Google Security Blog — Unauthorised CNNIC/MCS Holdings certificates (Mar 23, 2015)
  12. Apple Newsroom — Apple sues NSO Group (Nov 23, 2021)
  13. FTC — Google and YouTube to pay $170M over children's privacy (Sep 4, 2019)
  14. DPC Ireland — WhatsApp decision: €225M (Sep 2, 2021)
  15. Autoriteit Persoonsgegevens — €290M to Uber over driver data transfers (Aug 26, 2024)
  16. OCC — $80M to Capital One over the 2019 breach (Aug 6, 2020)
  17. FTC — Avast: ban on selling browsing data and $16.5M (Feb 22, 2024)
  18. TechRadar — 8 PB of data amassed by Jumpshot (2024)
  19. US Dept. of Commerce — Final determination against Kaspersky (Jun 20, 2024), via National Law Review
  20. Microsoft — CrowdStrike incident: 8.5M devices (Jul 20, 2024)
  21. US Dept. of Commerce — NSO Group added to the Entity List (Nov 3, 2021)
  22. The Guardian — PRISM (Jun 6, 2013)
  23. DPC Ireland — €1.2B to Meta (May 22, 2023), via Hunton
  24. DPC Ireland — €390M to Meta over personalised advertising (Jan 4, 2023)
  25. FTC — $5B to Facebook (Jul 24, 2019)
  26. New Jersey Attorney General — $391.5M from Google over location tracking (Nov 14, 2022)
  27. CNIL — €50M to Google (Jan 21, 2019)
  28. European Commission — €4.34B to Google over Android (Jul 18, 2018)
  29. Courthouse News — Approval of the $95M settlement in Lopez v. Apple (2025)
  30. European Commission — €1.8B to Apple over music streaming (Mar 4, 2024)
  31. FTC — Ring $5.8M and Alexa $25M (May 31, 2023)
  32. BDO — Context: €746M to Amazon (2021)
  33. DPC Ireland — €310M to LinkedIn (Oct 24, 2024)
  34. DPC Ireland — €345M to TikTok (Sep 15, 2023)
  35. FTC — $150M to Twitter (May 25, 2022)
  36. FTC — $520M to Epic Games (Dec 19, 2022)
  37. Autoriteit Persoonsgegevens — €30.5M to Clearview AI (Sep 3, 2024)
  38. FTC — Equifax settlement (Jul 22, 2019)
  39. FTC — Expanded settlement with Uber (Apr 12, 2018)
  40. SEC — $35M to Altaba/Yahoo (Apr 24, 2018)
  41. Hunton — ICO fines Marriott International £18.4m (Oct 30, 2020)
  42. CNBC — ICO fines British Airways £20m (Oct 16, 2020)
  43. IBM — Cost of a Data Breach Report 2025
  44. Help Net Security — Summary of the IBM 2025 report