CDP Institute

A dark web hacking forum offered 2.6 million Duolingo user records for $1,500. The data, which includes user names and email addresses was accessed via an exposed API, which the company has known about since earlier this year.

Meta has confirmed that EU users will have the option to switch off AI for Facebook and Instagram, which will give them use of non-personalized content feeds. This is to meet the August 25 deadline imposed via the EU Digital Services Act (DSA).

China is taking the lead in regulating generative artificial intelligence (AI) with new “Generative AI Measures.” These are meant to balance control by the state with endorsement of emerging technology.

A survey conducted by Predibase of enterprise executives across 29 countries found one-third reported being uncomfortable using Large Language Models (LLMs) in production. Concern centered around sharing sensitive or proprietary data, particularly with commercial LLM vendors.

A report from Adlytics, backed up by separate research conducted by Fairplay, indicates that Google’s YouTube platform may still be collecting data from children and targeting ads at them. If that is true, the company may be looking at tens of billions in future fines for what would be a violation of the Children’s Online Privacy Protection Act (COPPA) and the consent decree Google has with the Federal Trade Commission (FTC).

This would put cost to business at more than $1 billion.

These are members of the Global Privacy Assembly’s international enforcement working group and the action ties in the ongoing concern about generative AI.

The Consumer Financial Protection Bureau (CFPB) wants to regulate how data brokers handle sensitive consumer data. Prompted by concerns about data use to power AI, the bureau is drafting a set of restrictions it plans to share in September.

The New York Times changed its terms of service to protect against use of its content for AI training. The change prohibits use of “robots, spiders, scripts, service, software or any manual or automatic device, tool, or process designed to data mine or scrape” its content.  This follows a similar move last week by Microsoft.

The US Security and Exchange Commission (SEC) introduces new cybersecurity rules for public companies. To safeguard data and ensure third-party compliance, the SEC is mandating that companies disclose cybersecurity events in a transparent, prompt, and comprehensive manner. A primary reason is to ensure investors are kept apprised of incidents to enable them to make informed decisions and to safeguard financial interests.

The UK children’s charity, the National Society for the Prevention of Cruelty to Children (NSPCC) has found an 82% rise in online grooming against children over the last five years, with 73% coming through Snapchat and Meta. One in four incidents were against primary school children and, where gender was known, 83% of the actions were against girls.

The company joins the ranks of companies trying to find ways to enable individuals to monetize their own data. In this case the company is looking to provide people with the ability to fine-tune which data they share with third parties and to opt-in with companies they trust.