France’s Commission Nationale de l’Informatique et des Libertes (CNIL) found Microsoft Ireland in violation of its privacy laws because the Bing search engine deployed ad cookies on user browsers without consent. The €60 million fine was based on ad profits Microsoft was determined to have generated from the data collection.
In one of the highest privacy suit settlements anywhere, Meta has agreed to settle the famed Cambridge Analytica suit which in 2018 revealed Facebook was allowing third parties to access user data – and the Cambridge Analytica consulting firm had helped itself to up to 87 million user records. Now, Meta, in agreeing to $725 million to settle the class action, will have the dubious honor of being #1 for a US privacy payout – and one of the top (see below) globally for GDPR.
On January 1, California added niche privacy protections for groups identified as needing special protections. These include: 1) The Student Test Taker Privacy Act which prohibits collecting and using student information unless it can be proven strictly necessary; 2) Assembly Bill 2089 which specifies information collected by mental health apps must be used only if necessary for health care; and 3) Senate Bill 1228 to protect sexual assault victims from having their DNA information available, except when there is an active police investigation.
Procrastinators of the world can throw a party whenever they get around to it: Google has once more pushed back complete third-party cookie deprecation. The new target is “early next year.” Reasons for the delay include concerns expressed by U.K. data regulator Information Commissioner’s Office, an ongoing inquiry by the U.K. Competition and Markets Authority, and widespread discontent in the advertising ecosystem.