The takeaway: Samsung Health now asks users to consent to their health data — including prescriptions, diagnoses and cycle-tracking — being used to train AI, and an in-app pop-up warns that opting out will get your synced data deleted. But Samsung's own consent page says withdrawal merely stops the AI training, so it's unclear whether consent is genuinely bundled with cloud backup or just catastrophically worded — and Samsung hasn't said which. Also today: xAI finally responds to the Grok CLI data-exfiltration findings (we've updated our piece); the Fable free-access cliff is five days out; and Waze gets a Gemini makeover.

The lead: consent, or your data gets deleted

A notice on Samsung Health, dated 13 July, asks US users to consent to their health data being used "for AI training and modelling, including human review". The categories are unusually intimate: body measurements, sleep and nutrition; medication data "including prescriptions and dosages"; health records "diagnoses, prognoses, test results, past records and treatments"; and cycle tracking. Consent, the page notes, propagates to Samsung Health on every device signed into the same account.

The controversy is what happens if you decline. As first documented by How-To Geek and corroborated across outlets, toggling the AI-training consent off triggers a pop-up: "Withdraw from this agreement? You will not be able to sync health data with your Samsung account and your health data will be deleted unless retained pursuant to applicable law." Consent to train AI on your medical history, in other words, appears welded to the ability to back your data up at all.

Here's the part every breathless headline is skipping: Samsung's own consent page contradicts the pop-up. The page says withdrawal simply "stop[s] using your data for AI training and modelling" — no mention of deletion. So one of two things is true, and they're very different. Either AI-training consent really is bundled with cloud sync — a genuine "pay with your medical data or lose the backup" design that regulators built the GDPR's "freely given" consent standard precisely to forbid — or the deletion pop-up is disastrously mis-worded boilerplate lifted from the general sync-consent flow. Samsung has made no statement, and no outlet has confirmed which. The documented sourcing is US-only; "deleted" almost certainly means the cloud copy, not your phone; and there is no deadline in any source, whatever you may have read. We'll update when Samsung clarifies — but the question it needs to answer is simple: can I opt out of the AI training and keep my backup, yes or no?

xAI breaks its silence on the Grok CLI uploads

Two days after a wire-level teardown alleged Grok's coding CLI uploads users' entire repositories — git history and unread .env secrets included — xAI has responded on X: "We care deeply about your privacy and respect customer choice. For teams using zero data retention, no trace and code data is ever retained. All API key use of Grok Build also respects ZDR." It points users to a /privacy command in the CLI to disable retention.

What the statement doesn't fully address: the scope of what's uploaded for everyone not on zero-data-retention, whether data already sent is deleted, and why unread files leave the machine at all. Meanwhile the technical case against the tool has hardened — there is now a public reproduction harness using an intercepting proxy and a canary repository, plus independent confirmation from a second researcher. We've added a dated update to our original piece; the short version is that the finding is now reproducible by anyone, and the fix xAI points to only fully works if you were never uploading in the first place.

The rest of the wire

The Fable cliff is five days out. Anthropic's support page still reads "ends July 19, 2026 at 11:59:59 PM PT" — that's Sunday night US time, early Monday for UK users. On the pattern of the last two Sundays, watch for a late move; we'll be checking.

Waze gets Gemini. Google is expanding Waze's Gemini features: conversational search and hazard reporting (the latter already Gemini-powered), a "less chatty" voice, and a dedicated motorcycle mode rolling out first across Latin America, Malaysia and the Philippines. It's the most tangible "AI you'll actually touch this week" release — and a reminder that most people meet AI not through a chatbot but through a feature quietly swapped into an app they already use.

On the watch list: the World AI Conference opens in Shanghai on Friday with Xi Jinping keynoting; DeepSeek retires its legacy deepseek-chat and deepseek-reasoner endpoints on the 24th, folding them into V4; and the OpenAI 516 bug reaches day 18 with still not one reply from OpenAI.