Andrew Crocker of EFF writes: Today, along with the ACLU, EFF filed an amicus brief in the Sixth Circuit court of appeals in United States v. Sturdivant, a case where police warrantlessly tracked a suspect’s movements using Automated License Plate Reader (ALPR) data. Our brief details the vast, interconnected network of ALPRs that constantly track...

Suzanne Smiley reports: Cybercriminals are infecting devices on a large scale with spyware, increasingly compromising systems belonging to average people, according to a new report from the threat hunting firm iVerify. The company found a rate of 1.07 spyware infections per 1,000 consumer scans of the startup’s free online checks. The security firm reported a...

Laura Kim, Jayne Ponder, and Marissa Uri of Covington and Burling write: On October 22, 2026, the Governor of Pennsylvania signed the Artificial Intelligence Deceptive Advertising Act (Senate Bill 806) (“Act”) into law. The Act joins a growing number of state laws focused on the use of AI in advertising. However, unlike the laws in...

NEW YORK—The AFT and the United Federation of Teachers today announced a legally binding agreement with Anthropic that makes AI safety, privacy and transparency standards enforceable in thousands of U.S. K-12 schools. The national AI Safety and Privacy Standard for Schools automatically applies to Anthropic’s existing agreements with school districts using Claude for Teachers and...

A breach involving a public figure prompted this press release from Italy’s data protection authority: Regarding the dissemination of personal data on the dark web relating to Vice President Antonio Tajani and his family members, the Italian Data Protection Authority warns media outlets, newspapers, websites, and platforms that the acquisition, dissemination, and republishing, by any...

Victor Tangermann reports: After decades of establishing itself as one of the worst guardians of personal data, Meta raised eyebrows this year by encouraging users to hand over their email logins and credit card information to its new AI agent, Muse. The tool, a privacy nightmare anthropomorphized by a furry apparition, can crawl through years...

Olivia DeRicco reports: Woodley, et al. v. Google LLC, et al. Filed: October 9, 2026 ◆ § 5:26-cv-11715 Read Complaint A class action lawsuit alleges Google and UPS wrongfully disclose users’ private data to third parties by way of the Google Search tracking widget. A proposed class action lawsuit alleges that the Google Search-based “Track...

Zach Weissmueller reports: The war against anonymity is raging in Europe. “The witch hunters work like a mob, and if enough of them phone the police, the police are going to come,” says Bernie Spofforth, a political activist who was detained by U.K. police for a social media post. It’s coming to the United States,...

From the “sounded-like-extortion-to-us department,” T. Keung Hui reports: Triangle school districts are trying to get more information about how they’ll be impacted by Google’s plan to change access to Google Search in schools. Google set off a firestorm this week when it initially announced that it would turn off access to Google Search for schools...

ABC News reports: NT Health has issued a ban on smart glasses at all of its clinical sites, as part of an internal department review into its privacy policies prompted by a breach at Royal Darwin Hospital earlier this month. The breach involved a medical observer, Dr Neda Mogharehabed, who was visiting Royal Darwin Hospital...

Scott Hall and Meaghan Henderson of Coblentz Patch Duffy & Bass write: States continued to adopt more targeted privacy requirements in 2026, including new restrictions on precise geolocation and sensitive personal data and expanded requirements for data brokers. These laws are important even for businesses that have already determined whether they are subject to each...

Bruce Armon, Evan Foster, and Jazmine B. King of Saul Ewing LLP write: On September 2, 2026, HB 381 was signed into law and amends Delaware’s data breach notification statute effective immediately. The new Delaware breach law includes a 60-day notice provision to the Delaware Attorney General, narrows the safe harbor for institutions covered by...

Jesse Jacobs reports: K-12 school district administrators now have the ability to restrict artificial intelligence features directly within Google Search across student devices. Digital safety company Lightspeed Systems introduced Google Search AI Controls within its web-filtering platform, enabling schools to block Google AI Overview summaries and its conversational AI Mode. […] Under the new tool,...

October 26, 2026 In the context of an investigation initiated by Privacy Commissioner of Canada Philippe Dufresne, Loblaw Companies Ltd. has committed to take actions aimed at strengthening its security measures following a cyberattack that impacted approximately two million Canadians. The breach occurred in February 2026 when Loblaw experienced a cybersecurity incident in which a...

October 26, 2026 In the context of an investigation initiated by Privacy Commissioner of Canada Philippe Dufresne, Loblaw Companies Ltd. has committed to take actions aimed at strengthening its security measures following a cyberattack that impacted approximately two million Canadians. The breach occurred in February 2026 when Loblaw experienced a cybersecurity incident in which a...

California Attorney General Rob Bonta today announced a settlement with Lyft, resolving allegations that the company violated the California Consumer Privacy Act (CCPA) and California’s Unfair Competition Law by failing to offer consumers the ability to opt out of the sale of their personal information within Lyft’s mobile app. The settlement includes $1.8 million in...

Rowan Sterling reports: On 20 August 2026 an employee of RIZAP Inc., the Japanese fitness and health-guidance group, was pulling records out of the health-guidance management system it operates for insurers when the data went into a generative AI service on a personal account the company had never approved. The records covered 726 members of...

From the Information Commissioner’s Office: We have reprimanded Staffordshire Police after the force unlawfully disclosed a domestic abuse victim’s home address to their alleged abuser. The incident occurred in March 2024 when Staffordshire Police issued a Domestic Violence Protection Notice (DVPN), an emergency measure intended to protect a victim from violence or threats of violence....

Justin Caffier writes: It’s been hard to keep track of all the ways in which America has been speedrunning toward a full-blown fascist surveillance state over the first two years of the second Trump administration. That’s partially due to the disorienting, shock-and-awe nature of each fresh injustice. But it’s mostly because of just how many...

Mario Trujillo writes: In a victory for data privacy, a federal court in New York definitively ruled that the Office of Personnel Management (OPM) violated the law when it disclosed millions of federal employee records to DOGE agents. In a summary judgment ruling issued on October 20, 2026, the court found that OPM violated two...