CDP Institute

The European Data Protection Board (EDPB), in response to a request by the Dutch, Norwegian & Hamburg Data Protection Authorities (DPA), issued an opinion against the so called “Pay or Ads” model that Meta and other big online platforms have used. The regulator concern is that by offering consumers only a binary choice, consumers are forced to opt in to services at a level of consent they don’t want and should be offered a free option of providing companies less or no personal data.

Gay dating app Grindr is facing a mass lawsuit from more than 650 UK users who say their highly sensitive data was shared, including HIV status and test results. The allegation is that the company made the information available to third parties for commercial use, a claim that Grindr is denying.

Nebraska is the sixteenth US state to pass a privacy law. It will take effect July 1, 2025 and provides consumers opt-out rights to protect against online ad targeting and grants universal rights for consumers to use opt-out tools on browsers, where companies they are dealing with honor similar signals from other states. The law is already being criticized for not requiring small businesses to comply and for having limited enforcement mechanisms.

The UK Information Commissioner’s Office (ICO) fined TikTok £12.7 million (~US $15.9 million), a penalty the company says it was pleased to accept (in lieu of the £27 million originally planned fine). While the company did express some regret for having been found to allow children under 13 use its site without their parents’ consent, we are still left with the questions: 1) Why didn’t they feel badly for doing this?, and 2) Why make these fines so affordable to them, when the message and penalty have no impact?