Signal
Answered a grand jury subpoena with timestamps and nothing else
The messenger holds no messages, call logs, contacts or group memberships, so a US grand jury request produced almost nothing to hand over.
All case studies
Data Minimisation
5 case studies tagged data minimisation.
DoorDash
Stored four digits of a bank account, so the breach was not a payments breach
The 2019 breach reached names and driving licence numbers, but the account field had been truncated years earlier, which limited what could be done with it.
GitHub
Stopped handing out the list of stargazers
The public stargazer list exposed identities that star-history tools did not need, so GitHub replaced it with an endpoint that returns counts only.
Sentry
Removed advertising cookies from its own site
A developer-tools company turned off advertising and tracking cookies on sentry.io, lost retargeting, and still had not put them back two years later.
Hospital websites / Meta
Sent appointment details through a tracking pixel
Healthcare providers passed appointment details, medical conditions and physician information to Facebook through analytics tags nobody had reviewed.