CDP Institute

Double Meta trouble. First, an EU court backed Max Schrems’ complaint accusing it of violating privacy regarding sexual orientation, so now the company must restrict data it uses for targeted ads in the EU. Secondly, two Harvard students revealed Meta’s Ray Ban smart glasses can, in combination with facial image search technology, be used to identify people on sight, potentially for doxing or for scamming.

In what may become a telecom industry model, the Federal Communications Commission (FCC) has settled a cybersecurity breach case with T-Mobile agreeing the company will pay a $15.75 million civil settlement and invest $15.75 million more in increased cybersecurity. This resolves T-Mobile breach cases from 2021, 2022 and 2023 and will require it to add zero-trust architecture and multi-factor identification to its networks.

California’s governor signed a car data privacy law to help protect domestic violence survivors. This, which is one of several new privacy and domestic violence related laws in California, could set a precedent for other states. It states drivers must be able to easily turn off location access and requires automakers to respond promptly to customer requests that are sent with a restraining order that request that another driver’s remote access be turned off.

The state attorney general sued TikTok claiming the app violates Texas’ Securing Children Online through Parental Empowerment (SCOPE) Act, which came into effect last month. The law restricts social media companies from sharing or selling children’s personal information without parental consent. The suit’s premise, which TikTok refutes, claims a search for a TikTok account reveals a lot of personal data.

In fact, data reviewed by Wired shows the AI-powered car and truck cameras are capturing images of not just license plates, but also election campaign signs, t-shirt slogans and bumper stickers – often with no license plate in the picture. Why be concerned? Because it can pair that with precise location data and has the potential to be used to infringe on or deter free speech.

It’s similar to Google’s Timeline and to a “Friends Map” feature Instagram is working on.

Ireland’s Data Protection Commission fined Meta €91 million (US$102 million) for failure to protect users’ passwords that were exposed in a January 2019 breach – and for its two-month delay in notifying the Commission. The breach impacted 36 million Facebook and Instagram users in the European Economic Area.

Telegram has changed its privacy policy and will now provide judicial authorities with user ID data upon request. The company, which touts strict privacy control, had previously limited cooperation with law enforcement to cases involving suspected terrorists.

California passed an amendment to the California Consumer Privacy Act (CCPA) to add neural data protection under the category of sensitive data. Users can now request, delete, correct, and ask to limit what brain activity data a company collects on them.

In a major kid privacy change, Instagram announced all teen accounts in the US, UK, Canada and Australia are getting new protective settings that limit the types of content young people ages 18 and younger can see and restrict who can contact them. Teens under 16 will be required to get parental permission to change the default settings. This privacy plan will roll out to more countries beginning early 2025.

The third annual report from the cybersecurity research team at Comparitech found less Google Play App compliance with the US Children’s Online Privacy Protection Act (COPPA) than in previous years. More than two in five apps of the 500 surveyed may violate COPPA as compared with 1 in 5 apps in 2022, and 1 in 4 apps in 2023.

The law had been instituted during the pandemic to help restaurants recover from the business downturn. It was challenged by delivery companies on the grounds of the First Amendment for violating customer privacy.