Impact

Research that changes platforms, policies, and protections for billions of users.

IoT vendors patched

Browser/OS mitigations

Countries with lawsuits

Media outlets

AI Assistant Tracking

Structural privacy risks in AI assistant platforms (ChatGPT, Claude, Grok, Perplexity) — third-party trackers leak conversation data to Meta, Google, TikTok, and others.

PoPETs 2027 Prompt like a Butterfly, Sting like a Tracker: A Privacy Analysis of Web and Mobile Conversational AI Agents

Regulatory & Policy

The Spanish DPA (AEPD) forwarded our findings to the EDPB for coordinated evaluation at the June 2026 plenary.

Recognition

Received the Andreas Pfitzmann Best Student Paper Award at PETS 2027.

Press Coverage 1 outlet

El PaísHay chats privados de IA en abierto por internet: los crecientes riesgos para la privacidad de los principales chatbots

Android AI Agents

Security and privacy analysis of Android AppFunctions — the interface that lets AI agents invoke app functionality on the user's behalf.

PoPETs 2027 The Agent in the Middle: A Security and Privacy Analysis of Android AppFunctions

Recognition

Runner-up for the Andreas Pfitzmann Best Student Paper Award at PETS 2027.

Localhost Tracking

Silent web-to-app tracking on mobile via localhost — exposing how Meta and Yandex covertly tracked Android users' browsing across apps.

USENIX Security 2026 Bridges to Self: Silent Web-to-App Tracking on Mobile via Localhost

Regulatory & Policy

The Spanish Prime Minister cited the research to announce a parliamentary investigation into Meta. Our team testified before the Spanish Congress commission.
Members of the U.S. House of Representatives cited the research in a formal inquiry to Meta leadership.
Class actions filed in the U.S. (Rose v. Meta, Carroll, Zaveeri), Quebec, British Columbia, and Germany (SOMI Foundation).
Disclosures to CNIL, EDPS, AEPD, EDPB, UK CMA, and the European Commission.
Presented at CNIL Privacy Research Day 2026 and received the CNIL-Inria Privacy Protection Prize 2026 (24 June, Paris) for outstanding societal impact.
Received the USENIX Security 2026 Distinguished Paper Award and the USENIX Internet Defense Prize 2026.
Civil society response from EFF and Privacy International.

Platform & Technical

Google introduced a localhost permission in Android 17 to prevent platform-wide abuse.
Chrome 137 and Firefox deployed localhost access restrictions. WebKit engaged with findings.
Advanced the W3C Local Network Access (LNA) standard. Disclosed bypass vectors.
Invited to present at IETF PEARG 123 and the Ad-Filtering Dev Summit 2025.
Research highlighted at the IEEE Milestone Award Ceremony honoring the selection of Rijndael as AES.
uBlock Origin, AdGuard, and DuckDuckGo adopted tracking protections based on our findings.

Industry Response

Meta and Yandex terminated the abuse on the day of public disclosure.
VPN vulnerability and cross-profile tracking vectors disclosed to Google.

Press Coverage & Commentary 15+ outlets

Washington PostMeta found a new way to violate your privacy Ars TechnicaMeta and Yandex are de-anonymizing Android users El PaísThe hidden method Meta uses to track mobile browsing Schneier on SecurityNew Way to Covertly Track Android Users Daring FireballMeta and Yandex's LocalMess exploit on Android De MorgenHet sluwe achterpoortje waarmee u online gevolgd wordt Deutschlandfunk Forscher decken Privacy-Verstoß von Meta auf TechdirtMeta busted spying on Android users in creepy new way TweakersMeta had inzage in surfgedrag van Android-gebruikers Security BoulevardMeta's LocalMess tracking technique CPO MagazineMeta and Yandex accused of using Android loophole Knack Data NewsFacebook en Yandex apps weten welke sites je bezoekt ABCMeta y Yandex consiguen datos concretos sobre tus hábitos Daily KosGetting off Facebook is NOT enough Sky NewsMeta found 'covertly tracking' Android users through Instagram and Facebook The RegisterMeta pauses mobile port tracking tech on Android after researchers cry foul MediaPostMeta Must Face Suit For Allegedly Tracking Android Users' Web Browsing

Commentary

Enrique DansIt's time to shut down Meta Zero Party DataLocalhost tracking — est. €32B in fines PodcastIn-depth discussion (40 min) VideoVideo coverage

Wireless SDKs

Empirical privacy analysis of wireless-scanning SDKs in Android — revealing how apps exploit Wi-Fi, Bluetooth, and other wireless signals for covert location tracking.

PoPETs 2025 Your Signal, Their Data: An Empirical Privacy Analysis of Wireless-Scanning SDKs in Android

Regulatory & Policy

Findings shared with CNIL, EDPS, and AEPD to inform enforcement discussions.

Press Coverage 2 outlets

El PaísHow does your phone know so many private details? How thousands of apps are exploiting mysterious indoor location tracking La Sexta Noticias ¿Alguna vez has pensado que el móvil te espía? Confirmado, apps te siguen usando WIFI, Bluetooth y datos aunque no actives el GPS

Smart Home / IoT

Exposing how local network protocols in smart homes violate platform access control assumptions — apps bypass Android's permission model to harvest device metadata.

IMC 2023 In the Room Where It Happens: Characterizing Local Communication and Threats in Smart Homes

Platform & Technical

Google introduced a dedicated local network permission in Android 16.
Dozens of privacy-invasive apps and SDKs removed from the Google Play Store.
20+ IoT vendors (Philips, Google, TP-Link, Apple) redesigned identifier schemes.

Regulatory & Policy

Presented at CNIL Privacy Research Day 2024, RIPE 89 Plenary (Prague), and RediMadrid Conference.
Findings shared with EDPS, AEPD, and CNIL.

Industry Response

Google publicly recognized the real-world impact of our findings, awarded a $2,000 bug bounty (donated to Médecins Sans Frontières), and engaged with us to explore mitigations via Android OS, app review processes, and IoT standardization efforts.

Press Coverage 5+ outlets

El PaísHow smart devices spy on us and reveal information about our homes WiredLos dispositivos de tu hogar inteligente te espían CBS NewsAre your home's smart devices leaking private data?