• 66% of UK AI users have discussed highly sensitive topics with a chatbot
• Yet, 64% of respondents are worried that chats will be used to profile them
• Proton's privacy-first chatbot, Lumo, aims to fix this trust gap

Late at night, when you need to vent about a relationship, ask for career advice, or check a worrying health symptom, who do you turn to? For a rapidly growing number of people, it isn't a friend, family member, or doctor; it's a chatbot.

A new piece of research published today by Proton, the Swiss tech firm behind some of the best VPN services on the market, reveals that a staggering 66% of British AI users have discussed at least one sensitive topic with an artificial intelligence assistant.

However, there is a massive contradiction at the heart of this new digital relationship: we are pouring our hearts out to these chatbots, but we do not actually trust them. According to the survey, 42% of UK users have little or no trust in AI companies to protect their private information, and 11% don't trust them at all.

Despite these glaring privacy reservations, 55% of Brits admit that AI has fundamentally changed their everyday decision-making.

The ultimate judgment-free zone

So, why are we sharing our most intimate thoughts with machines we don't trust? The answer is simple: freedom from judgment.

While friends and family remain the preferred choice for most sensitive discussions, AI offers a 24/7 digital confidant that won't react with surprise or embarrassment.

Proton's data shows personal finance is the most commonly discussed sensitive topic (33%), followed closely by work or career problems (32%), mental health struggles (27%), and relationship issues (20%).

"AI is learning far more about us than a search engine ever could," said Eamonn Maguire, Director of AI Engineering at Proton. "We’re not just asking questions. We’re sharing deeply personal context about our health, finances and relationships. And when technology knows that much about us, privacy can't be an afterthought."

The primary worry isn't just about the AI remembering a single chat, or even the risk of human reviewers reading your logs. Users are increasingly terrified of the bigger picture.

In the UK, 64% of respondents are concerned that their vulnerable conversations are being weaponized to build detailed advertising or marketing profiles. Meanwhile, 52% are worried their secrets are being fed back into the machine to train future AI models.

NEW: Leave No Trace — A weekly newsletter on digital privacy and online surveillance.

Leave No Trace investigates the companies and governments putting our digital freedom at risk — and the people fighting back.

📩 Subscribe now to get every edition delivered to your inbox every Friday, launching this September.

How Lumo promises a private alternative

Despite these valid fears, Brits are highly receptive to a more secure way forward. A massive 82% of users said they would be more likely to use an AI chatbot specifically designed around privacy, and 44% would be far more willing to share sensitive information if they were given a cast-iron guarantee that their chats wouldn't be used for AI training.

This is exactly where Proton hopes to fill the gap with Lumo. Built with the same end-to-end encryption ethos as the company's famous email client, Lumo is an open-source, privacy-first ChatGPT alternative.

To help users understand the scale of their digital footprint, Proton recently launched AI Paper Trail, a tool from Lumo that visually demonstrates exactly how much personal information an average AI conversation leaks about a user's inner life.

"People have already decided that AI is useful enough to hear their money worries, doubts and everyday concerns. They are handing AI companies their inner lives and biggest secrets on the assumption that they will protect them when it's actually the opposite. AI's business model depends on learning from them" Maguire added.

• A new US proposed law would force internet providers and VPN services to block "foreign piracy sites" via expedited court orders
• The legislation would apply to ISPs, DNS resolvers, and any VPN provider with at least 100,000 monthly US subscribers
• Digital rights groups warn the fast-track legal process risks massive overreach, citing similar policies in Europe

A newly introduced bill in the US House of Representatives is threatening to fundamentally change how virtual private networks operate within the country. If passed, the legislation would force VPN providers to actively block access to piracy websites, turning vital privacy tunnels into heavily filtered exit ramps.

The American Copyright Protection Act (ACPA), formally numbered H.R. 10364, was introduced by Representative Darrell Issa (R-CA) on September 16, 2026. The bill aims to give copyright holders a fast-track judicial process to obtain blocking orders against platforms accused of copyright infringement.

Crucially, the ACPA explicitly names VPN services alongside traditional broadband providers and DNS resolvers as entities that must enforce these blocklists. For users who rely on the best VPN software to ensure unrestricted, unmonitored internet access, this legislation poses a direct threat to the core promise of the technology.

The blocking obligations would apply to any VPN service with at least 100,000 monthly US subscribers. This threshold catches almost all major consumer VPN brands, effectively forcing the industry's biggest players to implement nationwide web filters or risk severe legal consequences.

Laura Tyrylyte, privacy advocate at NordVPN, told TechRadar that there are thousands of VPN solutions available for users worldwide; however, "these blocking measures primarily target reputable, paid VPN providers, leaving free VPN services largely untouched."

"Free VPNs are often harder to regulate, and since users who seek to avoid paying for content are unlikely to pay for a VPN either, these services will continue to operate without any impact," she added.

NEW: Leave No Trace — A weekly newsletter on digital privacy and online surveillance.

Leave No Trace investigates the companies and governments putting our digital freedom at risk — and the people fighting back.

📩 Subscribe now to get every edition delivered to your inbox every Friday, launching this September.

Fast-track censorship "at the speed of light"

Under the ACPA, a copyright holder can petition a designated federal judge to declare a website a "foreign piracy site." The evidentiary bar for this is surprisingly low, requiring only a "preponderance of the evidence." Once approved, covered providers are given 14 days to object before the blocking order takes effect, though crackdowns on live sports and other time-sensitive material could be executed even faster.

Rep. Issa has made no secret of his desire for aggressive enforcement. Speaking at a June hearing, he framed his goal bluntly: “Can we do it at the speed of sound? Can we do it at the speed of light?”

Digital rights organizations have heavily criticized the proposal. Meredith Rose of Public Knowledge warned that the bill would force any service provider "to disrupt traffic from targeted websites simply accused of copyright infringement."

Meanwhile, Brandon Butler of Re:Create argued the legislation codifies "a one-sided legal process modeled on European site-blocking laws" and "violates American due process, First Amendment rights, and American ingenuity."

To mitigate the risks of false positives, the bill includes an error provision allowing companies wrongly blocked to claim up to $250,000 in damages, though critics argue this offers little financial comfort to innocent small businesses taken offline.

A growing global threat to unfiltered internet

This isn't the first time US lawmakers have targeted VPNs in 2026. The ACPA arrives on the heels of Utah's SB 73, a controversial state law that attempted to regulate VPN use for age verification before facing an enforcement freeze. The ACPA also joins other pending federal proposals, such as the Block BEARD Act and the Foreign Anti-Digital Piracy Act.

However, the real warning signs come from overseas. As Butler noted, the ACPA heavily mirrors aggressive European anti-piracy campaigns, which have already put VPNs in the crosshairs. In countries like Spain and France, court-ordered VPN blocking is already a reality.

These systems have already shown their potential for collateral damage. An analysis by Re:Create found that in Italy, innocent websites remained blocked for an average of 320 days due to overzealous filters. In Spain, over 500,000 websites were wrongly blocked during LaLiga matches, temporarily restricting access to 5.8% of the popular internet.

If the ACPA advances, a VPN's legal jurisdiction will become more vital than ever. US courts cannot automatically enforce orders against providers incorporated in privacy havens like Panama or the British Virgin Islands. Until then, the battle for the open internet continues on Capitol Hill.