CDP Institute

A US federal judge granted tens of millions of Amazon users the right to sue as part of a nationwide class action. The suit alleges Alexa AI deceptively collected and recorded private conversations of users, which violates Washington state privacy law. This allows plaintiffs to sue as a group for larger sums.

Olivia, a third-party AI chatbot McDonald’s – and many other companies use to pre-screen, schedule, and communicate with potential employees was found in McDonalds’ case to have a security hole that exposed ~64 million chat logs of sensitive data. The breach was discovered by two researchers who randomly typed in “123456” as a password and found they had access to many years’ worth of applicant data. Olivia’s parent company, Paradox.ai which has had previous complaints about sloppiness in the system, said they fixed this.

The UK Data (Use and Access) Act’s new 164B framework makes it mandatory for data controllers, including in marketing technology, ad tech and e-commerce, to track and report their complaint volume to the Information Commissioner’s Office (ICO) or risk being in violation of UK data protection law.

Sites presenting material considered obscene or harmful to young people will have to show proof of being over 18 via a commercial photo ID or business transaction such as a mortgage payment or paycheck. Opponents are concerned that determining appropriateness of content is very subjective and a process was not clearly laid out.

They join countries including Italy and Germany that have blocked use of DeepSeek due to concern about private data being shared with China.

This is thought to include personal addresses, tax ID numbers and license plates.