CDP Institute

After a 12-month grace period, the UK’s children’s design code requires compliance to protect by design and default if a user is, or is suspected to be a child (defined here as users under age 18). This applies to connected toys, games, and edtech as well as to online retail and other online services, including social and video sharing platforms.

The fraud-prevention, privacy and compliance company, which now has a total of $22.7 million investment. plans, in part, to use the new investments to focus on emerging international regulatory obligations.

Data shows 40% allow tracking in US, and 47% do globally on average across all apps. On social media apps the rate of opt-in was slightly lower.

The UK government is overhauling its privacy rules and is weighing changes, including ending cookie popups and online consent requests. If so, it will have to balance loosening its rules in comparison with those of the EU while considering implications for adequacy for compliance to allow data transfers under GDPR.

An Illinois judge refused to dismiss the biometric data privacy suit brought by the American Civil Liberties Union (ACLU) and other advocacy groups against Clearview AI. The groups, citing Illinois’ BIPA biometrics law, want Clearview to delete all face biometrics collected from Illinois residents without consent.

Rwanda has adopted a new privacy law. It defines grounds for collecting and processing personal data, protects the right of the data subject, and specifies punishment for failure to comply.

A new report from DoControl shows significant risks in the form of insider and external threats to organizations, just as Gartner recently projected global SaaS revenue to grow by19.3% this year. Using a 1,000-person company with between 500K- 10M files as a benchmark, DoControl identified major threats often underestimated by CIOs and CISOs.

A year-long survey conducted by anti-piracy company White Bullet and the Digital Citizens Alliance web-safety coalition found major brands alone, including Amazon, Facebook and Google, paid pirate operators roughly $100M in the past year to advertise on their platforms. This puts brand users at risk of exposure to malware and other ad risks.

New Mexico’s Attorney General Hector Balderas has filed papers in federal district court alleging Angry Birds developer Rovio Entertainment has been collecting and selling personal data of kids under age of thirteen. The state reached a settlement with Google mid-August, which had alleged Google ad platform AdMob allowed collection of children’s data.

A hacker group that has stolen in the past from Microsoft, Mashable and others, claims it is selling data from more than 70 million AT&T customers on the dark web. AT&T, which has seen samples, says they don’t think the data came from their systems.

A UK citizen living in England sued American ad tech company PubMatic under GDPR. It was the first time such a suit was brought in a U.S. court and, though it was dismissed, it came as some plaintiff attorneys have wanted to explore the viability of bringing class action suits in the U.S., since that is less common in Europe.

China passed a strict new privacy law, effective November 1. It specifies collection of personal data must have clear purpose, be minimal in scope, and be obtained by consent. It also includes guidelines on international data transfer.