CDP Institute

A pretty penny to pay given Marriott’s not sure it’s liable, but $52 million is the cost to satisfy the US Federal Trade Commission (FTC) and attorneys general of 49 states (and District of Columbia) for breaches that affected more than 300 million Marriott customers worldwide. The breaches were also investigated by the FBI who suspected hackers were working on behalf of the Chinese government.

If you think you already know that, you may be surprised reading the Center for Digital Democracy (CDD) report, which found unprecedented tracking techniques that enable streaming services to know and share information about your health, kids, race and political persuasion. One can even slip product images dynamically into TV episodes. Yikes!

Meet the Montana Consumer Data Privacy Act. Taking effect this month, it provides MT citizens protections, including requirements to limit processing of data, requiring disclosure when data is processed or sold, obtaining consent and incorporating an opt-out mechanism. What it does not provide, however, is a private right of action to sue. So, lacking some teeth.

Let’s be honest, what’s more enticing than getting kids hooked on your product? TikTok has it down to a science – right down to the number of times it takes a user to reach their “habit moment,” which is apparently 260 or more videos watched in the first week of having an account. This according to leaked information revealed in unredacted lawsuit documents that also show TikTok’s algorithm can protect against seeing too many unattractive people.

Florida data broker, National Public Data, which was spectacularly hacked resulting in the loss of hundreds of millions of Social Security numbers and more sensitive personal data, has filed for Chapter 11 bankruptcy. Sadly, as it told the court, it will be unlikely to pay debtors or those who brought class-action suits against them.

While not foul-mouthed by manufacture (we’re told), robot vacuums made by ECOVACS, a Chinese company with offices worldwide, recently started screaming obscenities. This unusual behavior reported by homeowners across the US, resulted from a hacker getting access, which can of course happen to IOT devices when proper security measures are not built in.

Double Meta trouble. First, an EU court backed Max Schrems’ complaint accusing it of violating privacy regarding sexual orientation, so now the company must restrict data it uses for targeted ads in the EU. Secondly, two Harvard students revealed Meta’s Ray Ban smart glasses can, in combination with facial image search technology, be used to identify people on sight, potentially for doxing or for scamming.

In what may become a telecom industry model, the Federal Communications Commission (FCC) has settled a cybersecurity breach case with T-Mobile agreeing the company will pay a $15.75 million civil settlement and invest $15.75 million more in increased cybersecurity. This resolves T-Mobile breach cases from 2021, 2022 and 2023 and will require it to add zero-trust architecture and multi-factor identification to its networks.

California’s governor signed a car data privacy law to help protect domestic violence survivors. This, which is one of several new privacy and domestic violence related laws in California, could set a precedent for other states. It states drivers must be able to easily turn off location access and requires automakers to respond promptly to customer requests that are sent with a restraining order that request that another driver’s remote access be turned off.

The state attorney general sued TikTok claiming the app violates Texas’ Securing Children Online through Parental Empowerment (SCOPE) Act, which came into effect last month. The law restricts social media companies from sharing or selling children’s personal information without parental consent. The suit’s premise, which TikTok refutes, claims a search for a TikTok account reveals a lot of personal data.

In fact, data reviewed by Wired shows the AI-powered car and truck cameras are capturing images of not just license plates, but also election campaign signs, t-shirt slogans and bumper stickers – often with no license plate in the picture. Why be concerned? Because it can pair that with precise location data and has the potential to be used to infringe on or deter free speech.

It’s similar to Google’s Timeline and to a “Friends Map” feature Instagram is working on.