Week in Review: Cameras, Classifiers, and What Happens to Your Data When the Company Dies
Facial recognition on the Tube. A four-year-unpatched criminal records portal. An airline's emails and 30 million recorded calls sold for $10 million....
enforcement
19 articles on enforcement.
Washington's Attorney General Counted, and 83% of People Said They Have No Control
Washington released its first-ever Data Privacy Report on 14 August. In 2025 the state logged 209 breaches affecting more than 8 million residents — a...
Seven Months Inside the UK Criminal Records Office, on Software Last Patched in 2019
The ICO has reprimanded ACRO Criminal Records Office after attackers spent seven months inside its website and content management system. The portal w...
Fortnight in Review: A Delete Button That Works, an Age Gate That Won't, and Seams Coming Apart
Two weeks that produced the best privacy mechanism America has ever shipped and the worst architecture Congress has advanced, in the same news cycle. ...
Privacy Claims Doubled in Six Months — and State Attorneys General Are Why
Pennsylvania sued TikTok over its age rating and youth safeguards. Utah joined a federal suit against Hims & Hers over data privacy. Insurers report t...
California's Delete Button Went Live Today — 600 Data Brokers, 300,000 Requests, $200 a Day
As of August 1, every data broker registered in California must check the state's DROP platform at least once every 45 days and delete the personal in...
Enforcement Arrives, Data Keeps Leaking: The Privacy Week of July 19–26, 2026
In eight days: California opened its first proactive privacy audit, nine states lost their grace periods, an AI agent breached Hugging Face, 55 millio...
The Grace Period Is Over: Nine States Can Now Fine You for a First Privacy Violation
Twenty state privacy laws are in effect, and as of July 2026 nine of their cure periods have lapsed — a first violation now means enforcement, not a w...
California's Privacy Regulator Just Opened Its First Audit — and It Picked the Gig Economy
CalPrivacy announced its first formal CCPA compliance audit on July 21, targeting app-based transportation, delivery, and task platforms. It will exam...
The 'Your Phone Is Listening' Ad Tool Was a Scam — and the FTC Just Proved It
Cox Media Group marketed 'Active Listening' — an AI service it claimed could target ads based on conversations overheard by smart devices. The FTC fou...
California Just Fined GM $12.75M for Collecting Too Much Data — Not for Leaking It
California's $12.75 million settlement with General Motors is the largest CCPA penalty in state history — and the first built on the data-minimization...
The EFF Says the SECURE Data Act Is Privacy Theater — Are They Right?
We covered the SECURE Data Act when it passed committee, calling it a meaningful step toward federal privacy law. The Electronic Frontier Foundation j...
The FTC Just Banned a Data Broker From Selling Sensitive Location Data. Here's Why That Matters.
The FTC secured a settlement banning Kochava's subsidiary from selling sensitive location data linked to millions of mobile devices — including data r...
Canada Found OpenAI Broke Privacy Law Training GPT-4. The Fix Doesn't Apply to the Models That Broke It.
A joint investigation by Canadian privacy commissioners found that OpenAI's collection of personal data to train GPT-3.5 and GPT-4 was 'overbroad and ...
GDPR Breach Notifications Hit 443 Per Day — What Eight Years of Data Tells Us
European data protection authorities are now receiving 443 personal data breach notifications every single day — a 22% increase over last year and the...
GM Sold Your Location to Data Brokers While Claiming It Didn't. California Just Fined Them $12.75 Million.
General Motors earned $20 million selling OnStar driver location and behaviour data to Verisk Analytics and LexisNexis while its privacy policy told c...
Cox Media Group Sold 'Active Listening' AI Ads — It Was a Lie, and the FTC Just Fined Them $930K
Cox Media Group pitched advertisers on an AI service that supposedly listened to consumers through their smart devices and used those overheard conver...
The Take It Down Act Is Law — Now the FTC Is Telling Big Tech to Actually Comply
The Take It Down Act requires platforms to remove non-consensual deepfake intimate imagery within 48 hours of a victim's request. A year after Preside...
When Your Privacy Policy Is a Lie: The OkCupid–Clarifai Data Scandal Explained
When Your Privacy Policy Is a Lie: The OkCupid–Clarifai Data Scandal Explained...