CDP Institute

Colorado’s Attorney General is reminding online ad companies that by July, companies will be expected to honor universal opt-out requests from Colorado residents. This goes along with approval by state officials of the Global Privacy Control tool, which is a mechanism to allow users to quickly and easily, universally opt out.

The province of Ontario announced fines for healthcare providers who violate its Personal Health Information Protection Act (PHIPA). Individuals could be fined up to $50,000, and organizations could pay a maximum of $500,000 for violations. This will be enforced against entities that look to contravene the law, but not in cases of breach or when errors are unintentional.

All those headlines about multi-million privacy fines for Google, Amazon, Apple, Meta and Microsoft imply they should have an impact, but to companies whose annual revenues far exceed many countries’ GDPs, they’re not much. Even worse, Big Tech isn’t obligated to pay on time – unlike what’s expected from their own customers – us.

A report from 404 media found that between November 2023-January 2024, Telus paid Canadian parents $50 for rights to videos of their children. Telus plans to use the kid videos to train facial recognition for age verification. In explanation (and defense of the project), Telus and Google respectively said the videos will be used to “improve authentication, “offer more secure tools for end users;” and make Google technology “more transparent and accountable.” Wonder if any Google or Telus family kids participated?

Questionable in terms of customer relations but expedient for deflecting blame, genetics company 23andMe is trying to mitigate reputational damage from its 30 data breach lawsuits by looking for ways to blame its own users.

A settlement has been reached in the $5 billion Google privacy lawsuit, which is now pending approval by a US federal judge. The amount of the settlement has not as yet been announced. This class action claimed the company misled users into believing Google wouldn’t track their activities when they used Google’s incognito mode, when allegedly, the company did.

Pharmacy chain Rite Aid faces a groundbreaking ruling from the Federal Trade Commission (FTC), which will prohibit the company using facial recognition technology. This follows FTC findings that determined Rite Aid recklessly employed biometric technology to surveil customers resulting in people, particularly women and people of color, being falsely tagged as shoplifters.

The three governing bodies of the EU have reached initial agreement on the Artificial Intelligence Act (AI Act), which it is hoped will set a global standard for AI controls in the same way GDPR has done for privacy legislation. However there are concerns that because the current draft is a compromise between stricter, consumer-focused versions favored by the European Parliament and European Commission and the more lenient, industry-friendly terms favored by the European Council, that exemptions included have rendered it less effective.

More than 280 million email accounts have been breached since 2020, according to a report from Surfshark, which analyzed them by country, and this is thought to have caused many consumers to change their email addresses. The US was affected most by breaches, followed by India, Russia and Indonesia.

The Children’s Online Privacy Protection Act (COPPA) may soon get changed if the US Federal Trade Commission (FTC) has its way. It’s been a decade since COPPA was last changed, and now the FTC is soliciting public comments about their proposed changes which include stricter parental consent, guardrails around ed tech engagement, and limiting data retention.

Stolen data included customer names, encrypted passwords and parts of social security numbers.

This comes as the majority of physical attendants of parked cars, meters and parking attendants, are being replaced by automated ones.