Topic
Enforcement, guidance and court decisions on personal data — and what they mean in practice.
Internal research projects need no prior CNIL formalities, but the regulator says they remain subject to GDPR records, impact assessments, patient information and the right to object.
A law-firm analysis of the Commission's 17 September proposal sets out age tiers, a six-month review of existing accounts and GDPR questions for age assurance, as the text enters the legislative procedure.
The Commission says TikTok did not adequately assess how its feed pulls users into repeated content on sadness, isolation or body image, and that its safeguards do not work. A confirmed breach could bring a fine of up to 6% of worldwide turnover.
In the vendor-commissioned survey of 400 US and UK security leaders, 77% of those reporting an incident said an approved AI tool was involved, and 56% said autonomous agents fall outside existing controls.
The French regulator's guidance covers tool providers and site or app publishers, and asks for masking of irrelevant data, limits on sessions recorded and masking of chatbot conversations.
Sweden's data protection authority will examine lawfulness, necessity, which personal data are needed, how jobseekers are informed and whether automated decision-making occurs.
The AEPD and the Hellenic DPA say providers of secure processing environments must keep real, effective control even when third parties run the infrastructure; contracts and certifications alone are not enough.
The draft would also bar certain browser features from blocking opt-out signals and extend annual metrics reporting to businesses subject to cybersecurity audits or risk assessments. The Board was due to consider it on 5–6 November.
IAPP analysis says Democrats' midterm wins in Congress and the states could revive federal privacy and AI bills, tighten FTC scrutiny and restart stalled state legislation.
Sweden's data protection authority says Lexbase, Krimfup, MrKoll and Upplysning must follow GDPR rules on criminal-offence data and erasure, despite holding voluntary publishing certificates.
The regulator's largest fine ever finds the ad-tech firm was a joint controller with Grindr and could not rely on the app to secure explicit consent for real-time bidding.
A federal judge in Washington granted a preliminary injunction and stayed the agencies' 'Voter Data Transmission Policy' on the eve of the midterms, after evidence the matched lists misidentified US citizens.
In comments on the EDPB's draft Guidelines 03/2026 on web scraping for generative AI, EPIC argues that most such scraping cannot meet the GDPR. It proposes a public registry of scrapers and an opt-in default for AI training.
The FTC's draft enforcement statement says undisclosed use of personal data to set prices could breach the FTC Act, while four states and Seattle already apply differing bans and disclosure rules.
Oregon's stipulated judgment, one of the parallel multistate settlements, details what GM must build from 30 November 2026, including a disclosure inventory and a strict test for deidentified data.
Auditors traced the oversharing to weak data loss prevention management, including outdated search terms, OCR left switched off and an unnoticed 15 MB file-size limit.
According to WIRED's anonymous sources, the agent ran for two months with the contractor's admin credentials and appears to have sent credentials and a network map to a high-risk site. Accenture says the allegations lack merit.
The DOJ's bankruptcy trustee office calls Character.AI's privacy policy 'ambiguous' and says the court should examine whether users' chats, including minors' data, can lawfully be sold.
The tracker sent browsing data to a third-party domain to personalise product recommendations and train a recommendation algorithm. Fnac must prove its new consent tool works within a month or face daily penalties.
A survey of 29 registered Dutch collection agencies found algorithmic tools in core processes, weak transparency and a narrow view of personal data. The AP says profiling such as file enrichment should stop.
The Autoriteit Persoonsgegevens sets out its enforcement principles, how its procedure runs and how it cooperates with other supervisors, after receiving 12 responses to an April 2026 draft.
The settlement requires affirmative express consent before GM collects or discloses driving and location data, plus data minimisation and a privacy programme subject to internal and external assessments.
The fine traces back to a 2023 noyb complaint. The CNIL found the Fnac app sent browsing data to a third party without consent, both to show product recommendations and to train the recommendation algorithm.
The Investigatory Powers Commissioner says oversight is working but criticises GCHQ, the NCA, the prison service and the MoD, and records four serious errors linked to communications data.
Section 6(b) orders to Delta, Uber, Walmart and six others ask for the inputs, tools and procedures behind individualised prices and gig-worker compensation. Recipients have 45 days to respond.
Garante president Pasquale Stanzione told an Italian parliamentary committee that age verification and parental controls must respect minors' privacy and autonomy.
The law bans companion chatbot features in 12 unsafe categories for minors, requires multiple age assurance methods and takes effect on 1 January 2027, leaving providers little time to prepare.
The Norwegian data protection authority urges organisations to map their AI agents and give each one a defined identity, access limits and a clear owner before automations escape oversight.
The 4th Circuit found the provision a content-based speech restriction that fails strict scrutiny, mainly because it lacks the notice-and-removal step other states' versions require.
The two US carriers told Reuters they are increasing security investment as AI takes on network tasks. AT&T is checking whether third-party AI agents seeking account access act for real customers.
After five banks moved to block third-party AI agents from customer accounts, Forrester argues for agent identities, scoped and revocable permissions, and continuous monitoring rather than outright bans.
Following a complaint, the Swedish regulator found that signs did not clearly tell people, including those arriving by train, that they were entering a monitored area.
Complaints in France, Italy, the Netherlands and Austria target third-party trackers, mandatory Persona face-and-ID verification and unanswered access requests on the AI training platform.
The decalogue asks users five questions before delegating, from what an agent can see to where it sends data, and says providers must also supply permissions, activity logs and a way to stop agents.
The agency used internal records and State Department and DHS data to fill gaps, but an advocacy group warns that errors in the DHS SAVE service could be copied into SSA files.
Member state ambassadors set the Council's position on rewriting GDPR, Data Act and other digital rules. noyb says the new Article 88bis would treat AI-related processing as lawful by default; Parliament has yet to take its position.
A jury found almost 44 million violations of the state's Unfair Practices Act, covering Meta's statements and practices on third-party data access, user privacy and harmful content.
According to noyb, the authority found the CDU, SPD, Greens and Die LINKE had no legal basis, such as consent, for targeting users by their political interests. A complaint against the AfD remains pending.
The privacy group's scoring, published on a new website, says the EPP tabled the most amendments weakening protections, while S&D, the Left and the Greens score positively overall.
An amicus brief backs a flight attendants' union objection, arguing the $10 million deal protects consumer data but not decades of payroll, discipline and internal communications records.
