CDP Institute

Criteo, which specializes in tracking internet users for retargeting with display ads, allegedly failed to obtain proof of consumer consent for processing their data, according to French regulator, CNIL. Under European law, a third-party data companies like Criteo are required to take steps to verify that consumers have consented to have their data used. CNIL appealed to and got agreement from the other EU regulators.

Privacy and human rights activists were surprised and alarmed by Ireland’s proposed amendment to Ireland’s Data Protection act that would effectively silence critics of Big Tech and of the Irish Data Protection Commission (DPC) itself. The amendment Section 26A would “prohibit the disclosure of confidential information” revealed during a complainant’s interaction with the DPC.

The Oregon Consumer Privacy Act has passed the House and Senate and goes to the governor to sign. Four years in the making, the bill imposes specific obligations over businesses and nonprofits, and would grant consumers protections including rights to correct, delete, and opt out. It also would protect sensitive data and youth data.

A lawsuit that may evolve into a class action accuses Google of encouraging Android app developers to miscategorize apps, labeling them for all or mixed ages, to allow for data collection without privacy controls for minors. The suit was brought by six minors and their adult guardians in California, Florida, and New York and makes its claims under various state privacy and consumer protection laws.

Banks are also in talks with British law enforcement and government agencies to be able to share related intelligence.

In response to public concerns over the volume of data employers collect on their workers, including about hours and earnings, and that can be shared with and third parties without consent.

The Swedish Data Protection Authority (IMY) has issued a fine of 58M Swedish Crown (≈ €5M) to Spotify, for not fully complying with the EU’s General Data Protection Regulation (GDPR). The complaint lay dormant for several years until activist group noyb filed litigation against IMY over the lack of a decision.

The complexity of regulating AI is a challenge everywhere, but the European Parliament has adopted its negotiating position on the Artificial Intelligence (AI) Act and is prepared to move ahead with rules to shape the law. Plans range from requiring disclosure of content (for generative systems, like ChatGPT) to full bans on biometric surveillance, emotion recognition and predictive policing.

Google delayed its EU launch of its AI chatbot, Bard as a result of not having provided the Irish Data Protection Commission (DPC) with adequate information ahead of its release date.

Forget about it?? Massachusetts’ new Right to Repair (automobiles) law is being challenged by US President Biden’s administration, which has surprisingly stepped in to tell independent car manufacturers and auto shops that the federal Data Safety Act supersedes the local state law, thus ensuring more protection against hacking.

The company is appealing to regulators to let them lower the age from 13 to 10 for its Quest headset. This despite growing concern around the world about how virtual reality and AI overall could be harmful to young children without first understanding its impact on mental health and privacy.

Denmark’s Ministry of Business just announced the government will raise the minimum age, from 13 to 16, at which companies can lawfully obtain children’s data.