What happened

Whitebridge AI marketed and sold AI-generated reputation reports that compile data scraped from social media, news, and other online resources about anyone with an online presence. 

These reports contain alleged personality traits, sensitive content flags such as "sexual nudity" or "dangerous political content," and photos, often of low factual quality and containing misinformation.

The company targeted both affected individuals and third parties, selling these reports and denying people free access to their own data, despite legal rights under the European Union's GDPR, leading to anxiety, the exposure of sensitive, potentially inaccurate data, and reputational damage.

Why it happened

Whitebridge AI's business model relies on scraping substantial amounts of personal information and generating reports in order to profit from users seeking to review or correct their own data. 

Critically, Whitebridge AI claims compliance with data protection laws by appealing to "freedom to conduct a business," but was found to disregard multiple GDPR provisions by not having a valid legal basis for this data processing, ignoring data access requests, and requiring arbitrary "qualified electronic signatures" for data corrections, none of which is mandated by law.