Law professor and privacy law scholar Dan Solove has made two short essays available to everyone: The AI Inference Problem in Privacy Law AI inferences undermine privacy laws. Whether they recognize inferences or not, privacy laws are in a bind. Rethinking Privacy of the Mind:  Why Protecting Neural Data Is Insufficient Is protecting neural data...

A breach involving a public figure prompted this press release from Italy’s data protection authority: Regarding the dissemination of personal data on the dark web relating to Vice President Antonio Tajani and his family members, the Italian Data Protection Authority warns media outlets, newspapers, websites, and platforms that the acquisition, dissemination, and republishing, by any...

Victor Tangermann reports: After decades of establishing itself as one of the worst guardians of personal data, Meta raised eyebrows this year by encouraging users to hand over their email logins and credit card information to its new AI agent, Muse. The tool, a privacy nightmare anthropomorphized by a furry apparition, can crawl through years...

Olivia DeRicco reports: Woodley, et al. v. Google LLC, et al. Filed: October 9, 2026 ◆ § 5:26-cv-11715 Read Complaint A class action lawsuit alleges Google and UPS wrongfully disclose users’ private data to third parties by way of the Google Search tracking widget. A proposed class action lawsuit alleges that the Google Search-based “Track...

Zach Weissmueller reports: The war against anonymity is raging in Europe. “The witch hunters work like a mob, and if enough of them phone the police, the police are going to come,” says Bernie Spofforth, a political activist who was detained by U.K. police for a social media post. It’s coming to the United States,...

From the “sounded-like-extortion-to-us department,” T. Keung Hui reports: Triangle school districts are trying to get more information about how they’ll be impacted by Google’s plan to change access to Google Search in schools. Google set off a firestorm this week when it initially announced that it would turn off access to Google Search for schools...

We missed posting this during Digital Parenting Week, but it is still excellent advice. On October 29, Paige Collins of EFF wrote: In today’s digital world, the internet is an essential resource for young people to access information, explore community, and find themselves. But we know that this often comes alongside fears of experiencing online...

ABC News reports: NT Health has issued a ban on smart glasses at all of its clinical sites, as part of an internal department review into its privacy policies prompted by a breach at Royal Darwin Hospital earlier this month. The breach involved a medical observer, Dr Neda Mogharehabed, who was visiting Royal Darwin Hospital...

Scott Hall and Meaghan Henderson of Coblentz Patch Duffy & Bass write: States continued to adopt more targeted privacy requirements in 2026, including new restrictions on precise geolocation and sensitive personal data and expanded requirements for data brokers. These laws are important even for businesses that have already determined whether they are subject to each...

Bruce Armon, Evan Foster, and Jazmine B. King of Saul Ewing LLP write: On September 2, 2026, HB 381 was signed into law and amends Delaware’s data breach notification statute effective immediately. The new Delaware breach law includes a 60-day notice provision to the Delaware Attorney General, narrows the safe harbor for institutions covered by...

Jesse Jacobs reports: K-12 school district administrators now have the ability to restrict artificial intelligence features directly within Google Search across student devices. Digital safety company Lightspeed Systems introduced Google Search AI Controls within its web-filtering platform, enabling schools to block Google AI Overview summaries and its conversational AI Mode. […] Under the new tool,...

October 26, 2026 In the context of an investigation initiated by Privacy Commissioner of Canada Philippe Dufresne, Loblaw Companies Ltd. has committed to take actions aimed at strengthening its security measures following a cyberattack that impacted approximately two million Canadians. The breach occurred in February 2026 when Loblaw experienced a cybersecurity incident in which a...

October 26, 2026 In the context of an investigation initiated by Privacy Commissioner of Canada Philippe Dufresne, Loblaw Companies Ltd. has committed to take actions aimed at strengthening its security measures following a cyberattack that impacted approximately two million Canadians. The breach occurred in February 2026 when Loblaw experienced a cybersecurity incident in which a...

California Attorney General Rob Bonta today announced a settlement with Lyft, resolving allegations that the company violated the California Consumer Privacy Act (CCPA) and California’s Unfair Competition Law by failing to offer consumers the ability to opt out of the sale of their personal information within Lyft’s mobile app. The settlement includes $1.8 million in...

Rowan Sterling reports: On 20 August 2026 an employee of RIZAP Inc., the Japanese fitness and health-guidance group, was pulling records out of the health-guidance management system it operates for insurers when the data went into a generative AI service on a personal account the company had never approved. The records covered 726 members of...

Elysse Gorney and Brett Owens of Fisher Phillips write: An employee walks into an exam room wearing AI glasses and asks the device to summarize the visit. Before the encounter ends, the patient’s description of symptoms, medical history, and treatment discussion could be transmitted to an outside AI platform. Without robust policies and procedures in...

Oregon will receive more than $10.4 million, and GM must now get drivers’ clear permission before collecting or sharing their driving and location data Attorney General Dan Rayfield today announced that General Motors will pay $220 million to settle allegations that it sold drivers’ private driving behavior and location data to data brokers, who then...

From the Information Commissioner’s Office: We have reprimanded Staffordshire Police after the force unlawfully disclosed a domestic abuse victim’s home address to their alleged abuser. The incident occurred in March 2024 when Staffordshire Police issued a Domestic Violence Protection Notice (DVPN), an emergency measure intended to protect a victim from violence or threats of violence....

Kelly Sandberg of Troutman Amin, LLP writes: In Shirley Vanasch et al. v. GoFundMe Inc., Plaintiffs Sal Munoz and Shirley Vanasch brought an action against Defendant GoFundMe for violations of the California Invasion of Privacy Act (“CIPA”), Cal. Penal Code §§ 631 and 638.51, and common law fraud, deceit and/or misrepresentation for the use of...

Justin Caffier writes: It’s been hard to keep track of all the ways in which America has been speedrunning toward a full-blown fascist surveillance state over the first two years of the second Trump administration. That’s partially due to the disorienting, shock-and-awe nature of each fresh injustice. But it’s mostly because of just how many...