The security post (order 24) of the Sandbox Series. Compliance requirements for regulated industries (finance, healthcare) using sandboxes — SOC 2, HIPAA, GDPR, ISO 27001, EU AI Act — audit process, data sovereignty, and cross-border restrictions.
Northeastern tested 17,260 Android apps and found zero activating the microphone. In May 2026 the FTC ruled that Cox Media Group — the company that claimed to be listening — collected no voice data at all and was reselling data-broker email lists, settling for $930,000. The real pipelines are off-site event feedback, lookalike spillover, contact-graph uploads, and location brokers.