Olivia DeRicco reports: Woodley, et al. v. Google LLC, et al. Filed: October 9, 2026 ◆ § 5:26-cv-11715 Read Complaint A class action lawsuit alleges Google and UPS wrongfully disclose users’ private data to third parties by way of the Google Search tracking widget. A proposed class action lawsuit alleges that the Google Search-based “Track...

ABC News reports: NT Health has issued a ban on smart glasses at all of its clinical sites, as part of an internal department review into its privacy policies prompted by a breach at Royal Darwin Hospital earlier this month. The breach involved a medical observer, Dr Neda Mogharehabed, who was visiting Royal Darwin Hospital...

Bruce Armon, Evan Foster, and Jazmine B. King of Saul Ewing LLP write: On September 2, 2026, HB 381 was signed into law and amends Delaware’s data breach notification statute effective immediately. The new Delaware breach law includes a 60-day notice provision to the Delaware Attorney General, narrows the safe harbor for institutions covered by...

California Attorney General Rob Bonta today announced a settlement with Lyft, resolving allegations that the company violated the California Consumer Privacy Act (CCPA) and California’s Unfair Competition Law by failing to offer consumers the ability to opt out of the sale of their personal information within Lyft’s mobile app. The settlement includes $1.8 million in...

Oregon will receive more than $10.4 million, and GM must now get drivers’ clear permission before collecting or sharing their driving and location data Attorney General Dan Rayfield today announced that General Motors will pay $220 million to settle allegations that it sold drivers’ private driving behavior and location data to data brokers, who then...

From the Information Commissioner’s Office: We have reprimanded Staffordshire Police after the force unlawfully disclosed a domestic abuse victim’s home address to their alleged abuser. The incident occurred in March 2024 when Staffordshire Police issued a Domestic Violence Protection Notice (DVPN), an emergency measure intended to protect a victim from violence or threats of violence....

Mario Trujillo writes: In a victory for data privacy, a federal court in New York definitively ruled that the Office of Personnel Management (OPM) violated the law when it disclosed millions of federal employee records to DOGE agents. In a summary judgment ruling issued on October 20, 2026, the court found that OPM violated two...

California Attorney General Rob Bonta today announced a settlement with Lyft, resolving allegations that the company violated the California Consumer Privacy Act (CCPA) and California’s Unfair Competition Law by failing to offer consumers the ability to opt out of the sale of their personal information within Lyft’s mobile app. The settlement includes $1.8 million in...

Oregon will receive more than $10.4 million, and GM must now get drivers’ clear permission before collecting or sharing their driving and location data Attorney General Dan Rayfield today announced that General Motors will pay $220 million to settle allegations that it sold drivers’ private driving behavior and location data to data brokers, who then...

From the Information Commissioner’s Office: We have reprimanded Staffordshire Police after the force unlawfully disclosed a domestic abuse victim’s home address to their alleged abuser. The incident occurred in March 2024 when Staffordshire Police issued a Domestic Violence Protection Notice (DVPN), an emergency measure intended to protect a victim from violence or threats of violence....

Mario Trujillo writes: In a victory for data privacy, a federal court in New York definitively ruled that the Office of Personnel Management (OPM) violated the law when it disclosed millions of federal employee records to DOGE agents. In a summary judgment ruling issued on October 20, 2026, the court found that OPM violated two...

From Datatilsynet, Norway’s data protection authority: The Norwegian Data Protection Authority has now issued an administrative fine of 92 million Norwegian kroner, equivalent to €8.6 million, which is the highest fine it has issued to date. –  We issued such a high fine in this case because the breaches we identified were very serious. Thousands...

Victor Tangermann reports: It was only a matter of time until AI agents, bots that are being advertised as a way to stay on top of tedious tasks, started spilling their human overlords’ secrets. With the advent of tools like Meta’s Muse or OpenAI’s Dots, consumers are encouraged to hand over some highly sensitive information,...

Source

Steve Alder reports: … Fairchild Medical Center has agreed to pay attorneys’ fees and expenses, settlement administration costs, a service award to the class representative, and benefits to the class members. The class consists of all California citizens whose information was disclosed to third parties – approximately 1,000 individuals. Those individuals are eligible to enroll...

Source

Suzanne Smalley reports: Privacy Commissioner of Canada Philippe Dufresne has launched a probe of IDScan.net in the wake of reports that a bad actor penetrated company databases to steal personal data and scans of 153 million people’s drivers’ licenses. IDScan.net’s technology is widely used by industry — particularly in the retail and hospitality sectors —...

Source

Brian O’Donovan reports: Tech giant Google has been fined €403m by the Data Protection Commission (DPC) over the processing of location data. Under data protection rules, such information must be processed in a lawful, fair and transparent manner. The DPC said that its investigation into Google found failures in this regard meaning that people could...

Source

Derek Kravitz reports: Nearly every time you buy something online or sign up for a loyalty program, you leave behind personal information that can be collected, shared, and sold among companies including advertisers, retailers, and data brokers. This kind of information is sometimes used to charge consumers more for a range of products and services,...

Source

Ashley Belanger reports: On Tuesday, two survivors of child sex abuse accused the Justice Department of failing to notify dozens of victims found in Jeffrey Epstein’s massive collection of child sex images. In a proposed class action, survivors explained that Epstein apparently started collecting child sex images in the 1990s, many of which the DOJ...

Source

September 14, 2026 Marks Largest Known Seizure of AI-Generated Celebrity Deepfake Websites To Date Manhattan District Attorney Alvin L. Bragg, Jr., today announced the Office’s seizure of 12 domain names of illegal websites used for unlawfully disseminating, publishing, and selling non-consensual celebrity “deepfake” videos. Individuals under investigation allegedly used artificial-intelligence (“AI”) image and video creation...

Source

Roxanne Libatique reports: A data breach affecting more than one million students, parents, and teachers across Australia and New Zealand has produced one of the clearest test cases the Australian cyber insurance market has seen for how patch-management obligations in policy wordings translate into real claims consequences. Online mathematics platform Mathspace confirmed on September 6,...

Source