Technology

One day you'll leave this earth, but your data will live on in a messy future

Published

8 months ago

May 11, 2024

One day you'll leave this earth, but your data will live on in a messy future

So much of how we live and interact with the world happens online. From engaging with people professionally and personally, to posting photos, storing files and accessing our bank account information, this all represents what’s known as our “digital legacy.”

What happens to all of this after we pass away? Unlike physical items that we may pass on after we die, such as photos, jewelry, an heirloom, a home, an inheritance, etc., how to handle your digital estate is a totally new conversation.

According to a recent study by the cybersecurity company TrendMicro, only 3% of respondents who were 65 and older had a digital estate plan. What happens to the other 97% of respondents’ digital assets? Who is responsible after someone passes on? Where does the information go?

CLICK TO GET KURT’S FREE CYBERGUY NEWSLETTER WITH SECURITY ALERTS, QUICK VIDEO TIPS, TECH REVIEWS AND EASY HOW-TO’S TO MAKE YOU SMARTER

A man typing on his laptop. (Kurt “CyberGuy” Knutsson)

What are “digital assets” and what is “digital legacy”?

Digital assets are any content or resources that exist in digital form, including files like photos, videos, emails and social media accounts, as well as online properties such as websites or cryptocurrency. On the other hand, a digital legacy encompasses all the digital assets an individual leaves behind after death.

This legacy can include personal, financial and creative digital properties that may need to be managed or transferred according to the deceased’s wishes or legal directives. Managing a digital legacy is becoming an increasingly important aspect of estate planning, as it ensures that digital assets are handled appropriately, respecting both legal requirements and the personal preferences of the deceased.

With over 20-plus years of experience, cybersecurity and education expert Lynette Owens, VP of Global Consumer Education & Marketing of Trend Micro — Digital Estate Planning — helps us answer these questions.

A couple looking at their laptop. (Kurt “CyberGuy” Knutsson)

MORE: DON’T FALL FOR THAT ‘LOOK WHO DIED’ FACEBOOK MESSAGE TRAP

What happens to our vast and intangible footprint — our digital assets — when we pass on?

Digital assets, such as emails, digital photos, online accounts and subscriptions, digital currencies and documents, remain as they are when we pass on, so it is vital to consider who should take care of them and what should happen to them.

Depending on the company’s privacy policies, there are several possibilities for what can happen to our private and sensitive information when we die. While these scenarios are not always clear and can be very nuanced, examples include data sometimes being deleted after a certain period and the worst-case scenario, which is your data ending up in the wrong hands.

However, creating a digital estate plan — and ensuring you have someone to take care of your digital assets and information when you pass — allows you to decide where information will go and how your accounts will be managed.

A family viewing material on a laptop. (Kurt “CyberGuy” Knutsson)

MORE: HOW SCAMMERS HAVE SUNK TO A NEW LOW WITH AN AI OBITUARY SCAM TARGETING THE GRIEVING

What does a person stand to lose if they don’t protect their digital assets?

Preserving and taking precautions when it comes to your digital legacy is essential for several reasons:

1. Legal and financial considerations: Online digital assets such as online bank accounts have financial value that should be managed by the executor of your estate or the trustee of your trust. However, they may not have the information to access accounts that are purely online. There’s a need to ensure these assets are managed correctly.

2. Genealogy and family lineage: Organizing this can provide insights into family history and genealogy for later generations. This information lets you track down family relationships, relatives and connections.

3. Personal and emotional security: Unmanaged, dormant online accounts are susceptible to hacking and misuse and can be used to commit identity theft and fraud.

4. Preserving memories: An online archive of treasured moments like pictures, videos and messages shared on different social media platforms allows family members to access and preserve memories easily. Some online accounts can also be memorialized, so users know someone has passed. Memorialized accounts are a place for friends and family to gather and share memories after a person has passed away. Memorializing an account also helps keep it secure by preventing anyone from logging into it.

A man on his laptop. (Kurt “CyberGuy” Knutsson)

Who is responsible for this information after someone passes on?

After someone passes away, each company will follow its privacy policy regarding handling inactive or deceased persons’ accounts. You can appoint a digital executor to manage your digital assets as part of your estate plan. This individual, who does not necessarily have to be the executor of your estate or trustee of your trust, should be trustworthy, digitally knowledgeable and capable of handling detailed administrative tasks.

They should be designated as your digital executor in your will and trust. It is advisable to inform them of their role and the location of your digital estate plan or include these details in your broader estate plan.

A woman who is estate planning. (Kurt “CyberGuy” Knutsson)

Should I provide my digital executor with passwords?

Your digital executor should not require your passwords to delete, close or memorialize your accounts. But they will need to contact each account service and show proof of your death through a death certificate to receive access and permission to carry out your wishes. Be aware that the exact protocols vary by state and company.

While sharing passwords and two-factor authentication credentials with a designated person would make login and online account management easy and convenient for a loved one who is the designated digital executor, we cannot officially recommend this action as it encourages a breach of companies’ terms of use and privacy policies with their account holders.

Instead, we recommend the often laborious and time-consuming process of going through official channels and presenting ID, death certificates, etc., to companies to gain access to account data and management on behalf of a deceased or incapacitated person.

MORE: HOW TO ENSURE YOUR PASSWORDS DON’T DIE WITH YOU

One hand on top of another. (Kurt “CyberGuy” Knutsson)

How can we ensure our digital assets are protected when we die?

To ensure our digital assets are protected when we die, consider the following:

Create an inventory of digital assets: Make a list of your digital accounts and assets and the associated email or username. Do not include passwords in the list, as this is unnecessary.

Use password managers: Password managers securely store an up-to-date list of your online accounts and usernames. You can designate one person to access your password manager, which could be your digital executor. When completing your digital estate plan, you can reference your account list in your password manager.

FACEBOOK OVERSIGHT BOARD TO CONSIDER WHETHER ANTI-ISRAEL RALLYING CRY IS ‘HATE SPEECH’

Create a digital estate plan: Provide your fiduciaries (Digital Executor) with instructions on managing your digital assets. For example, you may want the account closed or deleted or pictures, videos or other digital assets saved or distributed to family and friends. Perhaps you want an account to be memorialized. Keep in mind that different businesses provide users with different options for what can be done with accounts if someone is incapacitated or passes away. You’ll need to check the policies of the companies you have accounts with to see what options are available, as this could influence the instructions you leave in your digital estate plan.

Keep your digital estate plan in a safe location: Because it contains sensitive information, you may not want to list the details in your estate planning documents. However, you should reference it in your will or trust, including instructions on how to find it and who your digital executor will be. Work with your lawyer to ensure your digital estate plan fully integrates into your other legally binding documents.

These measures can help better protect your digital assets and ensure they are managed accordingly after you pass, providing peace of mind to you and your loved ones.

A close-up of an elderly person’s hands. (Kurt “CyberGuy” Knutsson)

What are some digital estate planning best practices?

In addition to completing the steps outlined above, you can do a few additional things now to protect your data and accounts.

1. Consider using an identity protection solution: Identity Theft companies can monitor personal information like your Social Security Number (SSN), phone number and email address and alert you if it is being sold on the dark web or used to open an account. They can also assist you in freezing your bank and credit card accounts to prevent further unauthorized use by criminals.

One of the best parts of using identity theft protection is that they might include identity theft insurance of up to $1 million to cover losses and legal fees and a white glove fraud resolution team where a U.S.-based case manager helps you recover any losses. See my tips and best picks on how to protect yourself from identity theft.

2. Set up legacy contacts. Many popular online companies, including Google, Apple (for iPhone users), Facebook and Microsoft, allow users to configure their online accounts to ensure that they will be deleted or passed on to trusted individuals who can handle their personal information responsibly. See more on this below:

How do specific online platforms prepare my digital legacy?

Google (Gmail, Drive, and more)

Go to your Google Account settings.
Click the profile picture in the upper right of the screen.
Tap Manage your Google Account.
Look for “Data & Privacy.”
Scroll down, and under “More Options,” click on “Make a plan for your digital legacy.”
Under the section “Choose who to notify & what to share,” click ADD PERSON. You can choose up to 10 people for us to notify if your Google Account becomes inactive. You can also give them access to some of your data.

Apple (for iPhone users)

Navigate to your iPhone’s settings.
Tap on your Apple ID.
Tap on “Sign-In & Security.”
Scroll down and click “Legacy Contact,“
Tap on “Add Legacy Contact” and follow the instructions to select a contact from your address book.
Apple introduced the legacy contacts system in 2021. This allows a user to nominate one or more trusted persons to control the user’s account for three years after their death. The process involves generating a shared access key with this trusted individual, who shares it with Apple after the user’s death (along with the death certificate). Once the legacy contact has completed these steps, they will gain access to the account (photos, messages, files, apps and other sensitive data). The legacy contact will also have the power to decide what happens to the data.

Facebook

On your computer, click your profile photo in the top right of Facebook.
Select Settings & Privacy, then click Settings.
Click Accounts Center, then click Personal Details.
Click Account Ownership and Control, then click Memorialization.
Click Memorialize account.
Now, you must select a legacy contact to manage your account.
Click Next to confirm.

Microsoft

Microsoft does not provide a direct feature for setting up legacy contacts or specifying posthumous account management preferences within the account settings. However, Microsoft has a process for handling the accounts of deceased or incapacitated users. If you have the account credentials, you can close the account yourself. If not, the account will be closed automatically after two years of inactivity.

In cases where access to the account is needed, legal representatives or family members must seek legal guidance and may need to provide Microsoft with a valid subpoena or court order.

X

X (formally known as Twitter) does not have anything in place — neither to memorialize an account nor to provide a legacy contact’s details. It also does not provide account access to the loved ones of a deceased user. At the same time, an authorized person can contact X to have a deceased person’s account deactivated after providing relevant information (ID, death certificate, etc.) For more detailed information, you can visit X’s Help Center or their policy on media depicting deceased individuals.

Instagram

Being owned by Facebook, Instagram has memorial and deactivation features similar to the above. There is no specific legacy contact, but family members and other authorized persons can contact Instagram to inform them the person has died. At this point, the profile can be memorialized or deleted. For further assistance or to request these actions, one would need to contact Instagram directly through their Help Center.

LinkedIn will not disclose data or grant any access to anyone, including family members. Family members and other authorized persons can report a user’s death. If you aren’t authorized to act on behalf of a deceased member, you can report them as deceased, and LinkedIn will memorialize the profile.

Kurt’s key takeaways

Each new generation will spend more time in the digital world. However, due to the rapid pace at which this technology has been embedded into our lives, society still has not entirely caught up with what to do with all of that. But our digital assets are just as important as our non-digital ones. So, when you begin to take an inventory of your physical assets, spend some time focusing on your digital ones, too. After all, these are the ones that the next generation will remember you by.

What role do you believe technology companies should play in helping individuals manage their digital legacy? Let us know by writing us at Cyberguy.com/Contact

For more of my tech tips and security alerts, subscribe to my free CyberGuy Report Newsletter by heading to Cyberguy.com/Newsletter

Ask Kurt a question or let us know what stories you’d like us to cover.

Answers to the most-asked CyberGuy questions:

Kurt “CyberGuy” Knutsson is an award-winning tech journalist who has a deep love of technology, gear and gadgets that make life better with his contributions for Fox News & FOX Business beginning mornings on “FOX & Friends.” Got a tech question? Get Kurt’s free CyberGuy Newsletter, share your voice, a story idea or comment at CyberGuy.com.

Technology

What does Mark Zuckerberg want from Donald Trump?

Published

10 hours ago

January 12, 2025

Press Room

What does Mark Zuckerberg want from Donald Trump?

At this point, it’s pretty clear what Donald Trump wants from Mark Zuckerberg. But what does Zuckerberg, who has now gone to Mar-a-Lago twice since the November election, want from the President-elect?

That’s the question I’ve been asking sources in and around Meta over the last several days. They all described Meta’s relationship with the outgoing Biden administration as incredibly hostile. It’s safe to assume that Zuckerberg wants a reset for the MAGA regime, especially since Trump threatened not that long ago to imprison him for life.

In Trump’s America, removing tampons from the mens’ restrooms on Meta’s campuses, — a real thing that just happened — is as much a business decision as a political one. Destroying ‘woke’ ideology is a key pillar of Trump’s stated mandate. Others who know they need to play the game, like Amazon, are also starting to fall in line. Even still, Zuckerberg is transforming Meta for this new political reality at a speed that’s unusual for a company of its size and influence. Founder mode.

In his conversation with Joe Rogan and his video on Instagram, Zuckerberg shares a laundry list of issues that Trump could help him with: fighting other countries that are ratcheting up their policing of his platforms, stopping Apple from dictating how he builds mobile apps and smart glasses (the latter is increasingly important to Meta’s future), and, perhaps most importantly, keeping domestic AI regulation from slowing his efforts to crush OpenAI. Elon Musk has bought Trump’s ear. But the more time Zuckerberg spends in Mar-a-Lago, the more Sam Altman and Tim Cook should be worried.

Then there’s the US government’s case to break up Meta that’s set to go to trial in a few months. After the blur that was the last four years, it’s easy to forget that this lawsuit was filed at the end of Trump’s first term by a Republican FTC chair, not Lina Khan…

Most of the headline reactions from the past week have focused on Zuckerberg’s decision to end Meta’s third-party fact check program. It was a convenient scapegoat for company executives that, frankly, never lived up to the goal of bringing more neutrality to Facebook and Instagram. The Community Notes alternative Meta is cribbing from X was not on the product roadmap before this week, so it will probably be awhile before everyone sees it in the wild.

The announcement that US moderators would be moved from California to Texas is perhaps the most cynical of them all; talk to anyone who knows and they’ll tell you the vast majority of moderators are already based in Austin.

Do you work at Meta? I’d love to chat. You can reach me me securely on Signal and I’ll keep you anonymous.

The hateful speech that is now allowed on Meta’s is eye-popping on its face and will be deserving of more scrutiny in the coming weeks. The decision to start recommending political content again is a 180-degree turn for Zuckerberg. But insiders believe that the most impactful change for users of Meta’s apps will be the softening of its systems that remove content for potential policy violations.

Out of all the announcements Meta made last week, this is the one I believe is the least connected to Trump. Meta execs have been signaling for a while that they know they are mistakenly removing too much content that doesn’t actually break the rules; I’m told it’s one of, if not the, biggest complaint in user surveys. If done correctly, dialing back on moderation mistakes may be the only thing Zuckerberg announced that makes everyone happy.

Elsewhere

CES is for dealmaking now: Each year, the official CES show — the sprawling show floor and flashy keynotes — feels more like an advertising exercise and no longer a place to launch real products. Most of the energy has moved to private meeting rooms and happy hours at the Wynn, Aria, and Cosmopolitan, where tech execs are schmoozing CMOs and getting deals done with partners all week. At this shadow CES, everyone seems to agree that the show is more alive than ever. Booths on the show floor have become marketing tools to show clients before you take them to a steak dinner. The challenge for the organizers of CES will be figuring out how to bridge the growing influence of this part of the show with their current business model of charging people to walk around booths filled with smart toasters and concept cars.
TikTok may just get banned: Imagine an alternate world in which the Chinese government is about to ban Instagram from operating in the country and Mark Zuckerberg is in hiding. That’s the situation with ByteDance and its founder Zhang Yiming, who stepped down from the CEO role after the last US ban attempt but still controls the company. He let TikTok be banned in India and seemingly has no interest in the app surviving this time, so why wouldn’t he let the same thing happen again?
Google and OpenAI flick at what’s next: Google’s DeepMind unit is starting “an ambitious project to build generative models that simulate the physical world,” which it believes “is on the critical path to artificial general intelligence.” Meanwhile, OpenAI is returning to its early roots by starting a “general-purpose robotics” team that will build hardware and push “towards AGI-level intelligence in dynamic, real-world settings.” We may have hit a scaling wall on text data but the big labs clearly see an opportunity in 3D. (See also what Nvidia announced last week.)
Other headlines you may have missed: Tencent (a large investor in Epic Games, Snap, and US tech companies) was put on the Pentagon’s blacklist for being allegedly under the influence of the Chinese military. Tim Cook’s total compensation rose 18 percent last year to $74.6 million. Elon Musk is hosting an inauguration party for Trump in DC with Uber and The Free Press. Sam Altman’s sister filed a sexual abuse lawsuit against him.

Job board

Some recent, noteworthy job changes in the tech world:

A bunch of changes at Meta: UFC CEO Dana White, Exor CEO John Elkann, and Charlie Songhurst joined the board. Joel Kaplan is running policy and comms now. After a stint at Google, I’m told Michael Levinson is coming back as VP of product for the Integrity org. (Good luck!) Head of civil rights, Roy Austin, is leaving. And former DEI chief Maxine Williams is now head of “accessibility and engagement.”
Elon Musk’s X named a couple of new leaders: Romina Khananisho is the new head of government affairs and John Nitti is head of “ad innovation.”
Calista Redmon joined Nvidia as VP of “global AI initiatives,” where she’ll “drive adoption of the NVIDIA platform for national and regional AI initiatives.”
Sophia Dominguez, Snap’s director of AR platform, is leaving.

Technology

PowerSchool data breach exposes millions of student and teacher records

Published

10 hours ago

January 12, 2025

Press Room

PowerSchool data breach exposes millions of student and teacher records

Cybercriminals spare no industry, targeting sectors like health care, insurance, automotive and education. Health care has been a frequent target, with attacks like the Ascension breach last year and the CVR incident in late 2024.

Now, education technology giant PowerSchool has become the latest target, with records of millions of students and teachers stolen.

While the exact number of affected individuals remains unknown, the scale of the breach is alarming.

PowerSchool serves 18,000 customers worldwide, including schools in the U.S. and Canada, managing grading, attendance and personal information for over 60 million K-12 students and teachers.

I’M GIVING AWAY THE LATEST & GREATEST AIRPODS PRO 2

Kids working on their laptops (Kurt “CyberGuy” Knutsson)

How did hackers target PowerSchool

PowerSchool revealed a cybersecurity breach to its customers Jan. 7, as reported by BleepingComputer. The company said it discovered the breach Dec. 28, after customer data from its PowerSchool SIS platform was stolen through the PowerSource support portal.

PowerSchool SIS is a student information system used for managing grades, attendance, enrollment and other student records. Hackers accessed the PowerSource portal using stolen credentials and used an “export data manager” tool to steal information.

The company said this wasn’t a ransomware attack or a result of software flaws, but rather a straightforward network break-in. The company has hired a third-party cybersecurity firm to investigate the breach, figure out what happened and determine who was affected.

Illustration of a hacker at work (Kurt “CyberGuy” Knutsson)

UNDERSTANDING BRUSHING SCAMS AND HOW TO PROTECT YOURSELF

What data got stolen

The PowerSource portal includes a feature that allows PowerSchool engineers to access customer systems for support and troubleshooting. The attacker exploited this feature to export the PowerSchool SIS “students” and “teachers” database tables to a CSV file, which was then stolen.

PowerSchool confirmed the stolen data primarily includes contact details like names and addresses. However, for some districts, the data may also include sensitive information such as Social Security numbers, personally identifiable information, medical records and grades.

WHAT IS ARTIFICIAL INTELLIGENCE (AI)?

The company said customer support tickets, credentials and forum data were not accessed or stolen during the breach. PowerSchool also emphasized that not all SIS customers were affected and expects only a subset of customers will need to notify those affected.

“We do not anticipate the data being shared or made public, and we believe it has been deleted without any further replication or dissemination,” the developer told customers in a notice.

“We have also deactivated the compromised credential and restricted all access to the affected portal. Lastly, we have conducted a full password reset and further tightened password and access control for all PowerSource customer support portal accounts.”

PowerSchool said affected adults will be offered free credit monitoring, while minors will receive subscriptions to an unspecified identity protection service.

Illustration of a hacker at work (Kurt “CyberGuy” Knutsson)

MASSIVE DATA BREACH EXPOSES 3 MILLION AMERICANS’ PERSONAL INFORMATION TO CYBERCRIMINALS

5 ways you can stay safe from PowerSchool data breach

The PowerSchool data breach has highlighted the importance of staying vigilant about your personal information. Here are five steps you can take to protect yourself:

1. Monitor your accounts regularly: Keep a close eye on your bank accounts, credit cards and any online services linked to your personal information. Watch for unauthorized transactions or changes to your accounts that could signal misuse of your data.

2. Freeze your credit: If your Social Security number or other sensitive details were compromised, consider placing a credit freeze with major credit bureaus like Equifax, Experian and TransUnion. This prevents potential identity thieves from opening new accounts in your name.

3. Use identity theft protection services: Take advantage of any identity protection services offered by PowerSchool as part of its breach response. These services can alert you to suspicious activity and provide support if your identity is stolen.

One of the best parts of some identity protection services is that they have identity theft insurance of up to $1 million to cover losses and legal fees and a white glove fraud resolution team where a U.S.-based case manager helps you recover any losses. See my tips and best picks on how to protect yourself from identity theft.

4. Enable two-factor authentication (2FA): Wherever possible, enable 2FA for your online accounts. This adds an extra layer of security by requiring a second form of verification, such as a text code or app-generated token, to access your accounts.

5. Be aware of phishing links and use strong antivirus software: Cybercriminals often use phishing scams to exploit data breaches. Avoid clicking on suspicious links in emails or text messages, especially those claiming to be from PowerSchool or your school district.

The best way to safeguard yourself from malicious links is to have antivirus software installed on all your devices. This protection can also alert you to phishing emails and ransomware scams, keeping your personal information and digital assets safe. Get my picks for the best 2025 antivirus protection winners for your Windows, Mac, Android and iOS devices.

WINDOWS FLAW LETS HACKERS SNEAK INTO YOUR PC OVER WI-FI

Kurt’s key takeaway

You can blame hackers for this breach, but PowerSchool shares the responsibility for failing to adequately protect sensitive data. The company may also be in violation of data privacy agreements it signed with school districts, as well as federal and state laws designed to safeguard student privacy. What’s more concerning is that PowerSchool took nearly two weeks to notify its customers about the breach. Schools are now left scrambling to assess the full extent of the intrusion. This delay is not just irresponsible; it puts students, parents and teachers at heightened risk of cyberattacks and identity theft.

Do you think companies like PowerSchool should face stricter regulations for handling sensitive data? Let us know by writing us at Cyberguy.com/Contact

For more of my tech tips and security alerts, subscribe to my free CyberGuy Report Newsletter by heading to Cyberguy.com/Newsletter

Ask Kurt a question or let us know what stories you’d like us to cover

Follow Kurt on his social channels

Answers to the most asked CyberGuy questions:

New from Kurt:

Technology

L’Oréal’s new skincare gadget told me I should try retinol

Published

21 hours ago

January 12, 2025

Press Room

L’Oréal’s new skincare gadget told me I should try retinol

Las Vegas is punishingly dry. The arid winter air means I woke up on Day 3 of CES 2025 with a nosebleed, chapped lips, and ashy legs. This in spite of the fact I slathered myself with two pumps of a fermented bean essence, eye cream, moisturizer, and a lip mask. Staring at my face in the hotel mirror, I wonder if any of those products were doing what they’re supposed to — and if maybe, I should try something different.

This is why I was so eager to try L’Oréal’s Cell BioPrint.

For anyone who’s struggled with their complexion, the Cell BioPrint feels like a holy grail gadget. The device is a mini-lab setup that analyzes a skin sample to generate a report about your skin’s current condition. It’ll also “grade” your skin with regard to oiliness, wrinkles, skin barrier function, pore size, and uneven skin tone. Based on the proteins in your skin, you’ll also see whether you’re more likely to be susceptible to those issues down the line — even if they aren’t issues now. The test also determines whether you’re responsive to retinol, a popular and well-studied skincare ingredient that nevertheless causes a ton of confusion online.

My results. I’m happy to say my skin’s biological and chronological age were aligned.

Photo by Victoria Song / The Verge

In my demo, using the Cell BioPrint was simple. Mainly because I didn’t have to do a thing. While L’Oréal hopes to one day make Cell BioPrint an at-home device, it’ll first be aimed at retail, dermatology offices, and skincare clinics. As in, the actual test will be done by a professional to ensure accuracy. A L’Oréal staffer collected a sample from both my cheeks using a special kind of sticker. I watched as he then dissolved it in a buffer liquid, placed the resulting solution into a cartridge, and fed that cartridge into a machine. I also had my cheeks and forehead scanned with an imaging wand before answering two questions about my age and demographic data.

After a few minutes, I got to see my results. Apparently, I’m doing something right because the report said that my chronological and biological age were aligned. But it also said that while my skin barrier function is currently good, I’m biologically prone to have issues with that as I get older. My report also said that I don’t have to be concerned with pore size — either now or in the future, and that I am highly responsive to retinol, meaning my skin is likely to tolerate it well.

There were several other insights I won’t bore you with, but after going over my results, I have a better sense of what I need to focus on. For instance, I should continue using moisturizers with ceramides, button up my sun care habits outside of sunscreen, add a vitamin C to help with my skin tone, and add a retinol. I also know what I don’t need or can remove from my routine. For example, I don’t need to buy products targeted toward shrinking pores.

Most of this wasn’t surprising. My results aligned with the concerns I’ve noticed and where I tend to concentrate my skincare routine. For example, the few times I’ve tried retinol, I’ve never had an hint of the sensitivities other people seem to experience.

Of course, this kind of personalized recommendation is only as good as the science behind it. After all, lots of health and beauty tech companies promise the moon, but are intentionally coy when it comes to explaining why you should trust them. Barring regulatory certification (which isn’t generally required for wellness and beauty tech), it’s left up to the individual to try to discern whether an explanation passes the smell test.

With that in mind, I asked L’Oréal to dive deep into the science — which Guive Balooch, global vice president of L’Oréal’s Technology Incubator, happily obliged.

Balooch says the company had 800 biologists working (and publishing clinical studies) to discover whether there are specific proteins expressed in skin cells that could determine your risk factors for certain skin conditions. The challenge, he says, is that there are a lot of proteins produced by the body. Finding the few out of the thousands that can give actionable skincare insights is like finding a handful of needles in a giant haystack. It required L’Oréal’s researchers to sequence all of them and then find the relevant biomarkers.

This particular branch of research, Balooch says, is called proteomics — or the study of how proteins are expressed in the body. “It’s understanding that our cells every day are making proteins. Depending on our lifestyle, our geography, and our genes, they will make more or less of these proteins. It changes over time and habits can change it as well.”

Balooch says L’Oréal tested 4,000 people over 10 years across the US, Europe, South America and Asia, and found five proteins related to skin health, including two that are related to how well a person’s skin will respond to retinol. And while the Cell BioPrint can only currently analyze responsiveness to retinol, other ingredients like niacinamide and hyaluronic acid are also in the works.

“In some ways, it’s meant to tell people what not to buy.”

Cynically speaking, a device like this could also be viewed as a pseudoscientific way to sell more products to a group of people already prone to reach for their wallets. But Balooch argues the Cell BioPrint isn’t meant to encourage people to buy more.

“In some ways, it’s meant to tell people what not to buy,” he says. “Of course, we would love to sell more products, but not by overconsumption. That’s not actually good for your skin. It’s about helping people find the right products based on science.”

To that end, Balooch has a point. The skincare market right now is rife with misinformation and influencers pushing expensive 10-step routines that sometimes do more harm than good. I know better, and yet I’m as guilty as the next skincare nerd. (I’m still haunted by the full bottle of snail mucin influencers claimed would fix all my problems. It broke me out instead.) Even now, I know that I’ll probably get influenced again. The difference is at least I can choose to be influenced towards a retinol cream or vitamin C serum — things that have a higher chance of helping me — rather than throwing my money to the wind.