Whitebridge.ai: your personal data is for sale to you and anyone (noyb.eu)

Lithuania-based Whitebridge.ai markets “reputation reports” that aggregate large amounts of scraped personal data, combine it with AI-generated text (suggested conversation topics, personality traits, “interaction guidelines”) and then sells those dossiers to anyone willing to pay — including the people profiled. Reports claim to surface social posts, photos, hidden profiles and alleged “background” flags (adult, political, religious or criminal content) and even offer ongoing monitoring. noyb has filed a complaint with the Lithuanian Data Protection Authority arguing Whitebridge’s practice is unlawful: the company appears to rely on a dubious “publicly available” claim, refuses free access under GDPR Article 15, demands an unnecessary qualified electronic signature to exercise rights, and produces false labels that constitute sensitive personal data under Article 9. The case matters for AI/ML practitioners and privacy regulators because it combines mass scraping, automated profiling and AI hallucinations to create commercially exploited — and potentially defamatory — outputs. Legally this touches core GDPR issues (lawfulness and purpose limitation under Art. 5, special-category data under Art. 9, transparency under Art. 12, access/rectification under Arts. 15/16) and CJEU precedent that social network content is not automatically “manifestly public” (C‑252/21). Beyond enforcement, the incident highlights technical and ethical risks: unsafe data pipelines, lack of provenance or fact-checking in generative outputs, and how AI-driven products can weaponize privacy gaps — pointing to likely regulatory scrutiny, required data-removal/rectification, and possible fines.