CDP Institute

Questions are being raised about how much data would be collected and the extent to which location tracking would be involved.

Luxembourg’s data protection authority has charged Amazon €746 million ($888 million) for violating EU GDPR data protection rules. Amazon, which is also under scrutiny in Europe for antitrust, claims this is ‘without merit,’ and plans to appeal.

Despite denying wrongdoing, Zoom has agreed to pay $86 million to settle a US class action alleging it violated privacy by sharing personal data of millions of its users with Facebook, Google and LinkedIn. It was also blamed for misrepresenting its security encryption and not stopping hackers from “zoombombing.”

Protecting the Information of our Vulnerable Children and Youth (PRIVCY) Act has been introduced in the U.S. House. It looks to expand the decades-old COPPA law that governs children’s privacy online, and incorporates key elements of the UK’s Age-Appropriate Design Code, including expansion of coverage to sites likely to be accessed by children and teenagers.

Google announced privacy and security guidelines for its safety section, including that developers must be ready by April with a privacy policy, including 3rd party and 1st party apps. The company also seems to be moving ahead with Privacy Sandbox plans, despite its unpopularity, and has outlined five phases with wind down on support for 3rd party cookies planned to finish “late 2023.”

A new Pew survey has found the pandemic has increased patient willingness to have their data shared among providers, as long as privacy is protected. This included use of biometrics or unique identifiers.

Spain’s DPA fines Spanish supermarket chain Mercadona €2,520,000 ($2,991,000) for unlawful use of a facial recognition system. The chain was using a system to detect people who had criminal convictions or restraining orders. France’s CNIL fined agribusiness Montsanto €400,000 for GDPR violation for not informing people it was recording their information in a lobbying file.

Under pressure from youth advocacy groups and 40+ states attorneys general, Facebook announced a series of changes, including limits on ad targeting minors on Facebook, Messenger and Instagram. Facebook does however plan to continue with plans for Instagram for tweens, despite AGs’ requests not to do so. Plans include more transparency and improving age identification.

Children’s Advertising Review Unit (CARU), part of the U.S. Better Business Bureau, just released revised guidelines, including a section on in-app and in-game advertising.

The group claims the mandate will confuse consumers and businesses.

IAB published the results of a massive project in which 150 lawyers from across the globe compared privacy laws of Australia, Brazil, Canada, China, India, Israel, Japan, Mexico, Nigeria, Singapore, and South Korea to show what digital ad companies must know to comply. The Cross-Jurisdiction Privacy Project (CJPP) compendium also includes the CJPP Legal Specifications chart, for ease of use on what ad companies need to demonstrate for compliance.

Austria has accepted Max Schrems’ objections to the grounds on which Facebook collects user data and has awarded Schrems symbolic damages. They have also referred a set of questions to the EU court, including whether Facebook’s statement of intent to process user data undermines higher protections of GDPR.