CDP Institute

The company notified users via its privacy policy that it was changing to include that permission.

Two California class actions are challenging OpenAI and its ChatGPT, and are being watched as harbingers of what may be possible legally in taking on AI. One claims OpenAI violated privacy by scraping intellectual property, and the other alleges copyright violation by abusing open-source licenses.

While the goal of protecting children from sexually abusive material would seem like an easy “yes,” concerns over encryption-busting have resulted in unlikely bedfellows, with Big Tech, security & privacy experts joining in opposition. At issue is the UK Online Safety Bill, soon to become law, which would allow the UK government to compel backdoor access to any end-to-end encryption system.

The Nigeria Data Protection Act (NDPA) has been signed into law, including establishment of the Nigeria Data Protection Commission (NDPC), which will oversee enforcement. It requires fair, lawful and transparent processing of data and specifies requirements in event of a breach.

Common Sense Media’s 2023 State of Kids Privacy Report found that more than 60% of companies with products and apps used by families and children may be non-compliant with the changes in the California Privacy Rights Act (CPRA) that have now come into effect, . This is because third-party tracking is now considered “selling” or “sharing data,” so must be disclosed.

The Canadian government said it’s still in discussion with Google.

Criteo, which specializes in tracking internet users for retargeting with display ads, allegedly failed to obtain proof of consumer consent for processing their data, according to French regulator, CNIL. Under European law, a third-party data companies like Criteo are required to take steps to verify that consumers have consented to have their data used. CNIL appealed to and got agreement from the other EU regulators.

Privacy and human rights activists were surprised and alarmed by Ireland’s proposed amendment to Ireland’s Data Protection act that would effectively silence critics of Big Tech and of the Irish Data Protection Commission (DPC) itself. The amendment Section 26A would “prohibit the disclosure of confidential information” revealed during a complainant’s interaction with the DPC.

The Oregon Consumer Privacy Act has passed the House and Senate and goes to the governor to sign. Four years in the making, the bill imposes specific obligations over businesses and nonprofits, and would grant consumers protections including rights to correct, delete, and opt out. It also would protect sensitive data and youth data.

A lawsuit that may evolve into a class action accuses Google of encouraging Android app developers to miscategorize apps, labeling them for all or mixed ages, to allow for data collection without privacy controls for minors. The suit was brought by six minors and their adult guardians in California, Florida, and New York and makes its claims under various state privacy and consumer protection laws.

Banks are also in talks with British law enforcement and government agencies to be able to share related intelligence.

In response to public concerns over the volume of data employers collect on their workers, including about hours and earnings, and that can be shared with and third parties without consent.