privacy vulnerability