Joseph Cox reports: A series of issues in Apple’s web browser engine — the tech underlying all browsers on iOS — means that Apple’s iCloud Private Relay tool, which is supposed to hide a user’s IP address, in many cases doesn’t actually work. Instead, the issues mean a malicious attacker can set up a website...

Carly Nairn reports: A federal judge has mostly tossed a privacy case brought against LinkedIn over the company’s Insight Tag. Users said the feature — which links actions on third-party advertiser websites to specific LinkedIn profiles — collected sensitive medical data without their permission. But Senior U.S. District Judge Edward Davila mostly granted the company’s...

The Federal Trade Commission, joined by Utah and California, by and through Los Angeles County Counsel, today sued Hims & Hers alleging that the telehealth provider shared consumers’ sensitive health information about medical conditions with third-party advertising platforms despite claiming its services maintain consumers’ privacy and deceives users about its billing and cancellation practices. In...

I think I missed this one, but you shouldn’t miss it, too. Thorin Klosowski of EFF writes: Oura Rings, Garmin GPS fitness watches, Apple Watches, Whoop bands—every year, more and more tech devices are promising to monitor our health and fitness, guide us toward healthier living, and provide useful health metrics to take to our...

Emery Glover reports: Iowa is now among 42 states that have reached a settlement with the genetics and biotech company, 23andMe. A lawsuit against 23andMe was filed in 2023 after a massive data breach that impacted nearly 7 million people, according to the Iowa Attorney General’s office. The breach reportedly exposed customers’ genetic ancestry information, personal information...

“License plate numbers themselves generally are not understood to be “personal information from a motor vehicle record” subject to the DPPA, but private companies using ALPR data may match license plates with DMV records to identify vehicle owners for parking, tolling, collection or enforcement-related notices, creating another use case in which DPPA risk may arise.”...

Jessica Murray reports: Facial recognition technology in shops will soon alert police in real time to the presence of serious offenders, with civil liberties groups warning of a “dangerous escalation” towards surveillance and criminalisation in the retail sector. Facewatch, a facial recognition system used by more than 100 businesses including Sainsbury’s, B&M and Spar to...

Caroline Petrow-Cohen reports: Robotaxis could be turning into robocops. A self-driving Waymo reported two teens to San Mateo, Calif., police on Monday after they were found drinking alcohol and shooting toy guns in the back of the vehicle. According to a social media post from the San Mateo Police Department, officers detained two 15-year-olds after the Waymo they were...

Christopher Brown reports: Healthline Media LLP must face two claims of a proposed class action alleging it shared consumers’ health information with TikTok Inc. and Microsoft Corp. without consent in violation of the California Invasion of Privacy Act. Lead plaintiff Daniel Gliksman established that he had standing to sue in federal court, and adequately pleaded...

Bill Budington writes: X Corp. should not be able to escape privacy compliance because it changed its name. On May 15, X Corp. filed a petition before the Federal Trade Commission (FTC) to set aside or modify an order issued in 2022 requiring the company to report regularly to the FTC for its violations of user data. The order...

Seen on FourthAmendment.com: Yahoo and NCMEC didn’t act as government agents when they scanned defendant’s email account for hash values of CSAM. They were not required to do so, but did so and warned customers they would. NCMEC passed on the information to the local police who got a search warrant. United States v. Williamson, 2026...

Sergiu Gatlan reports: WhatsApp is finally allowing users to reserve usernames, a privacy feature that lets them hide their phone numbers from people not in their contact list. Meta says that more than 3 billion people in over 180 countries use WhatsApp’s instant messaging and video-calling platform, which started as an alternative to the Short...

Konstancija Gasaitytė reports: “Walmart is not content with using facial recognition. They have a patent for emotional recognition,” Dr. Jon Padfield said on his YouTube channel, Business Reform. “Because it’s not enough to know who you are, it’s not enough to know what you’re looking at, but they need to know what you think about it...

Zack Whittaker reports: Apple’s plan to change a privacy feature that lets paying customers hide their real email addresses when creating online accounts could make it easier for apps and websites to block anonymous sign-ups. Apple’s Hide My Email is an iCloud+ feature that generates anonymous email addresses under the @icloud.com domain, which then forward messages to...

Jon Brodkin reports: AT&T and Verizon lost an attempt to overturn fines for selling users’ real-time location data without consent, as the Supreme Court ruled today that the Federal Communications Commission process for issuing financial penalties did not violate the right to a jury trial. AT&T convinced the US Court of Appeals for the 5th...

Greg Bensinger reports: Amazon was sued on Monday by a Virginia resident over what he said were privacy violations after the company’s Ring doorbell cameras at friends and ​family members’ homes collected and stored images of his face using facial recognition ‌software. The plaintiff, Charles Sigwalt, who is seeking class-action status, sued Amazon in federal...

A May 21, 2026 press release from Texas Attorney General Ken Paxton: Attorney General Ken Paxton filed suit against Meta Platforms Inc. and WhatsApp LLC (collectively “WhatsApp”) after the company misled consumers regarding the strength and scope of its privacy protections for its messaging app, WhatsApp. WhatsApp is widely marketed as a secure messaging service...

Sandra Matz, Columbia University “You have zero privacy … Get over it,” Scott McNealy, then CEO of Sun Microsystems, declared in 1999. What might have sounded like a bold claim at the turn of the millennium has turned into a self-fulfilling prophecy in today’s era of big data and artificial intelligence. Computer algorithms – step-by-step...

Zack Whittaker reports: The Dutch government has blocked American IT giant Kyndryl from acquiring Solvinity, a Dutch cloud provider that hosts the Netherlands’ online identity platform. The government in The Hague said the deal poses a possible “risk to the public interest.” Dutch minister for the digital economy Willemijn Aerdts said in a machine-translated letter published Monday...

Tech companies like Google, Facebook and Microsoft are ignoring data controls mandated under California law, researchers say. By: Colin Lecher A new audit has found that websites across the internet may be failing to abide by California privacy law, ignoring a requirement to not track visitors who set a privacy control. The report, from researchers...