The analog hole: where corporate data protection ends at the phone camera

Imagine a clerk who has to summarise a long contract for their boss in three sentences. The company bans the use of ChatGPT. The clerk takes out their own phone, photographs the monitor and asks the chatbot for a summary. Twenty seconds later the answer is there. The company’s systems hold no trace of the whole operation.

Screens could always be photographed. For a long time, though, a photo was just a picture: anyone who wanted to use the text on it had to zoom in, type it out and make sense of it. Between spring and autumn 2025 that extra work all but disappeared, because the major platforms built in image-understanding features. ChatGPT can analyse photographed documents even on the free plan (OpenAI Help Center). Claude accepts images of up to 8000 × 8000 pixels and recommends a separate “high-resolution mode” for text-dense documents (Claude documentation). Since April 2025, Google Search has also answered questions about content photographed with the phone camera (Business Today, 9 April 2025). In iOS 26, the “Ask” button that appears below a screenshot sends the image to ChatGPT with a single tap (9to5Mac, 15 July 2025).

On a 2025 phone, two taps can be enough to get from photographing the screen to a finished answer. The technical possibility is proven. There is, however, no measurement of how often employees actually use chatbots this way. We return to the reason in section 4.

The analog hole is the point at which digitally protected information becomes perceptible to our eyes or ears: it appears on a screen, is printed or is read aloud. From that moment on, digital protection can no longer follow it. Encryption, access permissions and data-leak monitoring software protect data for as long as it is handled as a digital file. Once it appears on the screen, it can be carried out of that environment with a phone camera, a printout or by reading it aloud.

Three everyday examples help explain the phenomenon:

• The safe read aloud. A document is secure inside a safe. But if someone who is entitled to open it reads it aloud, the lock no longer protects its contents: anyone can write down what they hear.
• The photographed envelope. A company letter is sent in a closed, sealed envelope, and its journey is strictly controlled. The sender, however, could have photographed the letter before sealing it. No postal check will ever notice that.
• The glass wall of the bank branch. The clerk has legitimate access to the customer’s account on the monitor. The bank logs what they print, send and save. What it cannot see is the clerk taking their phone out of their pocket.

The term comes not from IT but from Hollywood. In spring 2002, the Motion Picture Association of America approached the US Senate with a legislative request titled “Plugging the Analog Hole”. Encrypting DVDs had been to no avail: anyone could record a film projected onto a screen with a camera (contemporary report, May 2002). A bill followed in 2005 (H.R. 4569), and a Senate hearing was held on it in 2006 (S. Hrg. 109-539). The proposal never became law. The film industry eventually did away with the analog outputs of players (EFF, 2009), but it could not do away with the camera placed in front of the screen.

In corporate data protection the concept began to appear from 2019. First, a maker of data-leak monitoring software used a camera-detection module (Zecurion, 2019); then a US patent granted at the end of 2025 adopted the Hollywood term word for word (US 12,511,376 B2). We had not come across the term in Hungarian anywhere else; the Hungarian edition of this article introduces it as “analóg rés”.

Today the name “analog hole” is used mainly by companies selling watermarking technology and security solutions. Independent professional sources and standards describe the phenomenon itself, but do not use this name for it. The term is therefore closer to marketing language in origin. The problem it describes is real nonetheless.

Companies typically protect their data with three kinds of tool. The protection of all three ends where the employee’s own phone begins.

A data loss prevention (DLP) system tracks the movement of data: emails, USB copying, cloud uploads and printing. The employee’s own phone, however, is not a company device. A photo taken with it does not pass through the corporate network and leaves no trace on the work computer. Microsoft’s documentation is explicit: rights management cannot prevent “a digital photograph or screen capture” being taken of protected content (Microsoft Support).

Taking screenshots can be blocked on the company computer. Windows 365 and Azure Virtual Desktop, for instance, can block the Print Screen function and screen sharing. Microsoft also warns, however, that this “isn’t a substitute for DRM solutions”, and recommends watermarking against physical cameras (Microsoft Learn, 2026). A watermark does not prevent the photo from being taken: at most it can help identify the source afterwards, if the image surfaces at all.

Systems that monitor so-called shadow AI use (CASB, browser DLP) see the prompts typed into the company browser. They do not detect a photo uploaded from a private phone over a mobile network. Vendors do not claim otherwise: protection that runs in the browser tracks activity in the browser.

In Hungary there is a legal limit on top of all this. Under the Labour Code, an employer may monitor an employee only in connection with the employment relationship. It may use technical monitoring tools after prior written notice, and it may not monitor private life (Labour Code, Section 11/A; summary: Adózóna, 2021). The company may not go through the images stored on the employee’s own phone. The photo therefore stays outside the company’s field of view for both technical and legal reasons.

The supervisory recommendations for banks show this gap clearly, too. Recommendation No. 1/2025 (13 January) of the MNB, Hungary’s central bank, expects centrally managed DLP, monitoring of printing and cloud services, and control of personal devices. It does not, however, mention photographing the screen or generative AI (MNB, 13 January 2025). The “clear desk, clear screen” principle of ISO 27001 is likewise aimed primarily at stopping others from looking, not at photos taken by the authorised user with their own phone. No Hungarian regulation names the camera as a separate data-leak channel; how to defend against it is therefore left to the company’s own policy.

Research tells us how many employees use AI in breach of company rules. None of the surveys, however, says how many of them get there by photographing the screen first. It is important not to conflate the two phenomena.

What we know: employees use AI despite bans. According to a study by KPMG and the University of Melbourne across 47 countries with more than 48,000 participants, 44% of US workers and 39% of UK workers have used AI in ways that contravene company policy. 57% of respondents hide their use of AI or present AI-generated material as their own work (University of Melbourne, May 2025). Of the study’s Hungarian respondents, 57% knowingly use AI in their work, and 38% have presented AI-generated content as their own (KPMG Hungary, May 2025). Only 19% of Hungarian employees have received AI training: the lowest rate in the region (KPMG Hungary, February 2026).

Measurements by security vendors paint a similar picture, but they should be treated with caution: the companies doing the research also sell protection products. Among Netskope’s customers, the share of users on personal AI accounts fell from 78% to 47% in a year. Over the same period, an average organisation recorded 223 AI-related data policy violations a month (Netskope, January 2026). According to LayerX’s browser-collected data, 67% of enterprise AI use takes place in unmanaged personal accounts (LayerX, October 2025). For the share of use that involves sensitive data, different sources give figures between 4% and 40%. Part of the difference comes from the fact that one study measures prompts, another conversations and a third user interactions. These figures should therefore only ever be quoted together with what was measured.

Where there is no data: circumvention by screen photo. None of the 2025–2026 surveys or software traffic measurements examined how many employees photograph their work monitor with their own phone and then upload the image to an external AI. The possibility is mentioned on one software vendor’s blog, without concrete figures, and in a handful of online comments. That is not enough to claim that more and more people get around bans this way. This article does not claim it either.

The lack of data has a simple reason: corporate measurement systems monitor the company network and browser, not the data traffic of a private phone. In other words, the absence of data does not mean the phenomenon does not exist. We simply cannot see it with the tools available. We know of one indirect data point: according to Verizon’s 2026 data breach report, images are the second most common data type among content uploaded to AI tools. The report does not say, however, how many of these were screen photos (summary, May 2026).

Four documented cases show how data can get out through a photographed screen. It is also worth being clear about what these cases are not evidence of.

Singapore, 2025. Fraudsters posing as Chinese police persuaded an employee in a bank’s mortgage department to collect customer data in an Excel spreadsheet. The employee photographed the spreadsheet with their own phone, sent it via WhatsApp and then deleted the images. Data on more than a thousand customers got out. In October 2025 the court found the employee guilty on 27 charges (Fintech News Singapore, October 2025). The bank’s data-leak monitoring system could not have detected the photo, because it was taken on the employee’s own phone.

CrowdStrike, 2025. An employee of the cybersecurity company photographed internal dashboards and login screens displayed on their own screen. The images were later published by a hacker group, which claimed to have broken into the company’s systems. According to CrowdStrike, there was no breach. The employee was fired, and the case was handed over to the authorities (TechCrunch, November 2025). The lesson of the story is precisely this: by the company’s own account its systems remained intact, and yet the photos of the screen still got out.

A US National Guardsman, 2022–2023. Jack Teixeira at first posted typed-up excerpts from classified documents on a chat platform. Later, afraid that the note-taking would lead to discovery, Teixeira took printed documents home, photographed them and shared hundreds of images. The sentence was fifteen years in prison (US Department of Justice, November 2024). In this case it was precisely the fear of being caught that led to the switch from typing to photographing.

A German radiology practice, 2015. An assistant used a phone to photograph the on-screen data of a patient they knew, and sent it via WhatsApp to their daughter. The employer dismissed the assistant with immediate effect. The regional labour court found the dismissal lawful even without a prior warning, because trust had been irreparably damaged (LAG Baden-Württemberg 12 Sa 22/16). The situation closely resembles an employee uploading a photographed screen to an external AI.

An important difference is that AI was not used in any of the four cases. And in the documented cases where company data really did end up in an external AI system — Samsung’s engineers in 2023, a Dutch general practice in 2024 and the acting head of the US cybersecurity agency in 2026 — the data was copied or uploaded as a file, not photographed. The research found no documented incident in which AI processed a photographed company screen. It may be that no such case has happened, or it may be that none has come to light. Given the technical limits described in section 3, the latter seems more likely, but neither possibility can be proven. No case has surfaced from Hungary either in which an employee photographed a monitor. The closest Hungarian example is that of an executive who forwarded hundreds of emails containing trade secrets to their own address. It is covered in section 6.

If an employee sends a photo of the screen to an external chatbot, the data ends up with a third party with which the company has no contractual relationship. This situation has six distinct legal and regulatory dimensions.

Data protection. In August 2024 the Dutch data protection authority stated that if an employee, in breach of internal rules, enters personal data into an AI chatbot, this counts as a personal data breach. In many cases both the authority and the people affected must then be notified (Autoriteit Persoonsgegevens). By the end of 2025 the Dutch authority had received dozens of such notifications (NL Times, December 2025). Under the GDPR it makes no difference whether the data was photographed, typed in or dictated. The 72-hour notification deadline runs from when the breach is detected. Hungary’s data protection authority, NAIH, has not issued a position specifically on this. In its report for 2025, writing about a data leak at a hospital, it said it had been unable to establish whether an employee was behind it (NAIH, February 2026). If no trace remains, the authority’s options are limited too.

Banking secrecy. The Hungarian Credit Institutions Act treats as bank secrets the facts, information, solutions and data about individual customers that are available to the financial institution (Credit Institutions Act, Section 160). Bank employees are bound by secrecy without any time limit. Bank secrets may be passed to a third party only under the exceptions listed in the act; an external chatbot is not among them. Penalties have been imposed before over bank secrets leaked by analog means: in 2011 PSZÁF, Hungary’s financial supervisor at the time, fined a bank 600,000 forints for sending a termination notice by telegram, because postal workers could also see the contents of the telegram (PSZÁF decision).

Trade secrets. The 2018 Trade Secrets Act also treats acquisition “by making an unauthorised copy” as unlawful. The wording is not tied to any one technology, so it also covers photography (Act LIV of 2018, Section 6). Legal protection, however, comes with a condition: the company itself must take the steps “generally expected” to keep the secret. Hungarian courts have accepted as adequate measures, for example, a confidentiality clause, access controlled by password and by job role, and an IT policy prohibiting saving work documents to private devices. A general confidentiality sentence on its own, however, did not prove sufficient (CMS case-law guide). If the company does not regulate recording on private devices, the protected status of the trade secret may itself become open to dispute in a lawsuit.

Regulatory compliance. Neither DORA, nor NIS2, nor the EU AI Act mentions photography or private devices by name. DORA requires limiting “physical or logical access” and protection against human error, while NIS2 also requires protection of the physical environment and training. Article 4 of the AI Act has required AI literacy among staff since February 2025; national authorities can impose sanctions from 2 August 2026 (CMS, May 2025). If AI use can be shown at a company, the lack of documented training is a supervisory risk from that date onwards.

Insurance. From 1 January 2026, Verisk/ISO in the US introduced three generative-AI exclusion clauses for general liability insurance, which several insurers have adopted (actuary.info, April 2026). According to the insurance broker Marsh, the existing exclusions for “access and disclosure” and for “intentional fraud” may also apply to AI-related risks (Marsh, February 2025). We know of no documented case in which an insurer rejected a claim because of an employee’s AI use. Internal, analog data leakage, however, is not a network intrusion: the information is passed on by an authorised user. It is therefore not certain that the usual “security event” conditions of cyber insurance are met. It is worth checking whether the policy treats unauthorised disclosure of data by an authorised employee as an insured event.

The employee’s personal liability. In the German case described earlier, the court found summary dismissal without warning lawful. In Hungary in 2025, a court annulled a mutual termination agreement and awarded the company damages equal to twelve months’ absentee pay, because the executive concerned had forwarded hundreds of emails containing trade secrets to their own address the day before signing the agreement (Economx, February 2025). The difference from a screen photo is that the email forwarding left a trace. Under criminal law, violating trade secrets (Criminal Code, Section 418) and bank secrets (Criminal Code, Section 413) both require a specific intent — to gain an unlawful advantage or to cause financial harm. This makes criminal proceedings harder against someone who argues they “only asked the chatbot for help”. The act can, however, have employment-law and civil-law consequences even without such intent: according to a 2025 decision of a regional court of appeal, unauthorised access and copying are unlawful even if no damage occurred (ÍH 2025.61).

The law regulates in detail what consequences an employee’s breach of the rules can have, but it limits the means of uncovering it. The Hungarian Labour Code (Act I of 2012, as in force on 1 October 2026, njt.hu) imposes obligations on employees even without a separate agreement, and gives employers four kinds of legal tool. At the same time, the employer may not look into the employee’s own phone. This is exactly why evidence usually does not come from the device itself.

What obligations does an employee have without a separate agreement? Section 8(4) states that “employees shall maintain confidentiality in relation to business secrets obtained in the course of their work”. No separate confidentiality declaration is needed for this. Section 8(1) prohibits conduct that jeopardises the employer’s legitimate economic interests, and Section 52(1)(d) requires conduct consistent with the trust that the position involves. An internal policy still matters, for two reasons. First, in trade secret lawsuits the court also examines whether the company took the precautions that could be expected of it; a general contractual clause on its own was not accepted (CMS case-law guide, Pf.20.785/2021/8). Second, the policy is how employees learn unambiguously that photographing the company screen with a private phone is prohibited, and that they can be held liable for it.

The employer can choose from four tools.

• Termination with immediate effect (Section 78). This can happen on two grounds: if the employee wilfully or with gross negligence commits a material breach of an essential obligation arising from the employment relationship, or if the employee otherwise engages in conduct that “would render the continuation of the employment relationship impossible” (Kúria, BH 2020.1.21). In that case there is no notice period and no severance pay. The employer may exercise this right within fifteen days of learning of the grounds, but no later than one year after the event; in the case of a criminal offence, until the limitation period for prosecution expires (Adózóna, July 2025). In practice the fifteen-day deadline is especially important. If the company learns that an employee has taken a photo and puts off the decision for two weeks, it may lose the option of immediate termination. The employer must prove that the reason for termination is real and well founded (Section 64(2)). We know of no Hungarian judgment specifically about a screen photo. The German case (section 5) and the 2025 Hungarian email-forwarding case (section 6), however, show that courts typically place taking customer data or trade secrets out of the company under the first ground.
• Ordinary dismissal (Section 66). If the fifteen days available for immediate termination have passed, or the breach does not count as “material”, the employer can dismiss with notice. Under Section 66(2), the reason for this can also be the employee’s conduct. Here, too, the burden of proof lies with the employer.
• Disciplinary sanction (Section 56). A measure more severe than a warning — such as withdrawing a bonus or temporarily changing the employee’s role — can only be applied if the collective agreement or the employment contract provides for it in advance. A financial penalty may not exceed one month of the employee’s base wage. The sanction must be put in writing and justified. And for the same breach, the employer cannot both apply a sanction and dismiss (Section 56(4)). For an SME this means that if the employment contract contains no such clause, there is no sanction of this kind available beyond dismissal.
• Damages (Section 179). The employee is liable for damage caused by a culpable breach of their obligations. For negligence, compensation is capped at four months’ absentee pay; a collective agreement can raise this to eight months. For intentional or grossly negligent damage, full compensation can be claimed (Adózóna, 2014 — the rule has not changed since). The difficulty is proving the damage: the consequences of a photo sent to a chatbot often cannot be expressed in money. In such cases the Trade Secrets Act can offer another route. According to a 2025 decision of a regional court of appeal, unauthorised copying is unlawful even without damage, and the court ordered destruction and publication of the judgment (ÍH 2025.61). According to the Kúria, Hungary’s supreme court, these claims must be pursued together with the Labour Code’s rules on damages, before a labour court (BH 2023.234).

The law also restricts how evidence can be gathered. Under Section 9(2), an employee’s personality rights may only be restricted for a reason directly related to the employment relationship, to a necessary and proportionate extent, and with prior notice. Under Section 11/A, an employee “may be monitored in respect of their conduct related to the employment relationship”, and employees must be informed in advance, in writing, about the technical tools used for monitoring. By default, a company IT device “may be used solely for the purpose of performing the employment relationship”; the employer may inspect the work-related data stored on it. The law makes no specific provision for the employee’s own phone. According to professional material from NAIH, logging keystrokes, recording screenshots and taking webcam recordings may conflict with the principles of necessity and proportionality, and covert monitoring is, as a rule, unfair (NAIH presentation, Dr Ernő Kiss). The employer therefore cannot ask for an employee’s phone in order to go through the photos on it.

Evidence can therefore usually be obtained from three sources: if the document turns up somewhere outside the company, as in the CrowdStrike case; if someone gives a witness account of what happened; or if the employee admits the act. Suspicion alone is not enough. In the case of a Scottish care home, for example, a dismissal over photocopying was ruled unlawful because it rested on mere assumption (Scottish Legal News, 2015). And in 2026 the Debrecen Regional Court of Appeal rejected a damages claim of 36.55 million forints, because there was no evidence that the person concerned had “forwarded, disclosed, photographed or copied” the documents (ÍH 2026.30).

What should go into company documents? Based on the rules above, it is justified to expressly prohibit, in the employment contract or the internal policy, recording the screen and documents with a private device, as well as uploading company data to external AI. It is worth defining precisely what counts as a trade secret, setting out the applicable disciplinary sanctions in the employment contract (otherwise Section 56 cannot be applied), and giving prior written notice of monitoring. These measures do not prevent photography. If an image does surface, however, the company can rely on unambiguous rules within the fifteen-day deadline. In a specific case, it is advisable to ask an employment lawyer for help before deciding. This section summarises the rules; it is not a substitute for legal advice.

Over the next three years, more and more devices with cameras and the ability to read screens are expected to appear in workplaces. The change is coming from three directions.

The camera moves to eye level. EssilorLuxottica sold more than seven million Meta AI glasses in 2025, against around two million in the previous two years combined (Vision Monday, July 2026). IDC expects 13.6 million smart glasses without a display to be sold in 2026, and 27 million in 2030. Other analysts forecast 20 and 75 million units for the same two years (IDC, June 2026; Smart Analytics Global, January 2026). Meta’s model with a display arrived in Europe in autumn 2026. Samsung’s and Google’s smart glasses launch at the same time, and Apple’s device is expected by the end of 2027. Within two years, every major platform may have glasses that work with a camera and AI.

The indicator light is the most important technical safeguard, but according to the regulators it is not enough on its own. From July 2026, Meta switches the camera off if someone covers or tampers with the LED that signals recording. This applies only to second-generation glasses, however, not to the millions of older devices already in circulation (Meta, July 2026). France’s CNIL called the device “particularly intrusive” (Next, May 2026), and the head of the UK’s ICO takes the view that a visual signal does not provide enough protection (ICO, September 2026). In summer 2026 restrictions followed one after another: in New York State courts, for staff of the US immigration authority, in British hospitality and theatre chains, and in casinos. Norway is preparing a ban for public spaces (444, October 2026). There is no data on bans specifically covering corporate offices. The solution used in courts and public authorities — handing in the glasses at the entrance — can, however, be applied in offices too.

A new gap can also open on the company computer. Since June 2026, Microsoft 365 Copilot Vision has processed shared screen and camera images in the cloud. It stores audio and video data temporarily for 48 hours, and by default the feature is available to every Copilot user (Microsoft Support, June 2026). According to one administrator’s analysis, the options for disabling it do not even appear in the interface (topedia, July 2026). Windows Recall, by contrast, works locally and is switched off by default on enterprise machines. If it is switched on, however, the entire screen history is collected in one place, which can make a valuable target for attackers. Screen content can therefore now leave not only through the employee’s phone, but also through the computer’s own assistant.

An AI agent that watches the screen can access the same data, and send the same data to the cloud, as an employee taking photos with a phone. Agents that read the screen and click with the mouse start switched off by default in enterprise environments, but data leaks caused by attacks hidden in instructions — prompt injection — have already been documented (NeuralTrust, October 2026 — a vendor summary, but one backed by sources). The practical danger arises when such an agent runs on a company machine but under a personal account: in that case the company’s control does not extend to it.

For business leaders, two conclusions follow from all this. Since Meta’s market share is between 70% and 84%, corporate rules on smart glasses over the next year or two will in practice apply mainly to Meta’s devices. From 2027, however, a policy will be needed that applies regardless of manufacturer. The cases of smart-glasses users caught in exams reveal another difficulty: it is easier to prove that someone was wearing glasses than that they transmitted data with them. That is why it is simpler to ban wearing the device than to sanction its use after the fact.

According to surveys, 44–66% of employees use AI despite bans, and their own phone is still in their pocket. The analog hole cannot be closed completely. It is worth acting in three directions: reducing the reasons for employees to get around the rules; attaching a clear consequence to misuse; and introducing physical barriers in the most sensitive places. The order below is a recommendation, not a general obligation. Every company can decide for itself how far to go.

Step one: have an approved AI tool in the company. This matters regardless of company size. If employees can use a company AI for their everyday tasks, they do not need to turn to their own accounts. Microsoft 365 Copilot Business costs $18 per user per month with annual billing (microsoft.com), and Claude Team $20 per user per month, also with annual billing (claude.com). Gemini is part of Google Workspace Business Standard at $14 a month (TechRepublic, January 2025). OpenAI does not publish the price of ChatGPT’s business plan. On these business plans, the providers do not use company data to train their models by default. For a hundred employees, the monthly cost is in the order of $1,800–2,500. An approved tool does not prevent deliberate photography with a private phone, but it removes one of the main reasons for getting around the rules out of convenience.

Step two: policy, training and amnesty. In the AI usage policy, it is worth separately prohibiting recording company data on private devices and uploading it to external AI systems. This matters in two ways. First, it provides the basis for enforcing the consequences of a breach; second, in a trade secret lawsuit it can prove that the company took the precautions expected of it. Under the AI Act, AI training is an enforceable obligation from August 2026. A “shadow AI amnesty” is a thirty-day period during which employees can report, without consequences, which AI tools they use. The company can then draw up a list of the solutions already in use and rank them by risk (EPC Group, July 2026). There are no statistics on how effective the procedure is. A policy on its own does not prevent photography, but it lays the foundation for consequences.

Step three: physical barriers in sensitive areas. A phone-free room prevents photography, dictation and audio recording at the same time — at least for as long as there really is no phone in the room. This is already a familiar practice in call centres: in an industry poll with 592 participants, 75% were against having phones in the call centre workspace (Call Centre Helper, 2015). In banks, the main candidates are treasury, the mortgage department and customer service. In SMEs, the rooms where customer data or pricing information is handled. The method cannot be used for remote work, and it must be discussed with employees before it is introduced.

What can technology do, and what can’t it? A dynamic watermark — offered built in by Windows 365 and Citrix — shows the user’s identifier even on a photographed image. It can deter photography and help with identification afterwards, but it does not prevent the image from being taken. According to Citrix’s documentation, moreover, the watermark “is not a security feature” (Citrix, September 2025). A privacy screen filter costs 37,000–51,000 forints per monitor (ÁrGép, October 2026). It makes it harder for someone to read the screen over the employee’s shoulder, but it does not protect against an employee photographing their own monitor. Vendors of webcam-based phone-detection software claim they can intervene at the very moment a photo is taken. There is no independent accuracy data on them, and continuous webcam monitoring cannot be introduced in the EU without a data protection impact assessment. None of the technical solutions protects against an employee simply reading the screen aloud to their phone’s AI assistant.

Banks may need to take further steps. The MNB’s Recommendation 1/2025 already expects central DLP and control of printing and personal devices, but it does not separately name taking data out by camera. How to handle it therefore still depends on each institution’s own interpretation. For banks, it is therefore worth supplementing the three steps above with a house rule on the use of smart glasses, and with administrator-level disabling of screen-sharing features such as Copilot Vision. Whether the block works must also be checked afterwards, because the rule itself is not necessarily visible in the interface.

The analog hole cannot be closed for good. Twenty years ago, a critic in the debate on copy protection put it like this: objects made of copper are subject to gravity, “but we don’t call that fact the ‘copper hole’”. Copyability is not an exception, but a basic property of information (Ed Felten, 2005). What has changed since 2025 is the effort that copying takes: today, two taps on a phone are enough. Company rules and controls need to be adjusted to that.