Suzanne Smiley reports: Cybercriminals are infecting devices on a large scale with spyware, increasingly compromising systems belonging to average people, according to a new report from the threat hunting firm iVerify. The company found a rate of 1.07 spyware infections per 1,000 consumer scans of the startup’s free online checks. The security firm reported a...

Victor Tangermann reports: After decades of establishing itself as one of the worst guardians of personal data, Meta raised eyebrows this year by encouraging users to hand over their email logins and credit card information to its new AI agent, Muse. The tool, a privacy nightmare anthropomorphized by a furry apparition, can crawl through years...

Scott Hall and Meaghan Henderson of Coblentz Patch Duffy & Bass write: States continued to adopt more targeted privacy requirements in 2026, including new restrictions on precise geolocation and sensitive personal data and expanded requirements for data brokers. These laws are important even for businesses that have already determined whether they are subject to each...

California Attorney General Rob Bonta today announced a settlement with Lyft, resolving allegations that the company violated the California Consumer Privacy Act (CCPA) and California’s Unfair Competition Law by failing to offer consumers the ability to opt out of the sale of their personal information within Lyft’s mobile app. The settlement includes $1.8 million in...

Oregon will receive more than $10.4 million, and GM must now get drivers’ clear permission before collecting or sharing their driving and location data Attorney General Dan Rayfield today announced that General Motors will pay $220 million to settle allegations that it sold drivers’ private driving behavior and location data to data brokers, who then...

Kelly Sandberg of Troutman Amin, LLP writes: In Shirley Vanasch et al. v. GoFundMe Inc., Plaintiffs Sal Munoz and Shirley Vanasch brought an action against Defendant GoFundMe for violations of the California Invasion of Privacy Act (“CIPA”), Cal. Penal Code §§ 631 and 638.51, and common law fraud, deceit and/or misrepresentation for the use of...

California Attorney General Rob Bonta today announced a settlement with Lyft, resolving allegations that the company violated the California Consumer Privacy Act (CCPA) and California’s Unfair Competition Law by failing to offer consumers the ability to opt out of the sale of their personal information within Lyft’s mobile app. The settlement includes $1.8 million in...

Oregon will receive more than $10.4 million, and GM must now get drivers’ clear permission before collecting or sharing their driving and location data Attorney General Dan Rayfield today announced that General Motors will pay $220 million to settle allegations that it sold drivers’ private driving behavior and location data to data brokers, who then...

Kelly Sandberg of Troutman Amin, LLP writes: In Shirley Vanasch et al. v. GoFundMe Inc., Plaintiffs Sal Munoz and Shirley Vanasch brought an action against Defendant GoFundMe for violations of the California Invasion of Privacy Act (“CIPA”), Cal. Penal Code §§ 631 and 638.51, and common law fraud, deceit and/or misrepresentation for the use of...

Jim Vorel reports: This has been one hell of a year, especially when it comes to social media giant Meta getting its digital ass handed to it in the courtroom. It’s only been a few months, after all, since Mark Zuckerberg’s goliath reached a landmark settlement with 47 different states, and agreed to pay a...

From Datatilsynet, Norway’s data protection authority: The Norwegian Data Protection Authority has now issued an administrative fine of 92 million Norwegian kroner, equivalent to €8.6 million, which is the highest fine it has issued to date. –  We issued such a high fine in this case because the breaches we identified were very serious. Thousands...

Frank Landymore reports: Would you like a rude, and perhaps slightly humorous, reminder of how much data surveillance Amazon conducts on its customers? Have we got the thing for you! On Tuesday, one customer shared how she accidentally stumbled on an obscure section on the Amazon website that most of us overlook. It contained, to...

Margaret Attridge reports: Customers who purchased Samsung Smart TVs sued over claims the technology company collects users’ real-time viewing habits without their permission for commercial purposes. Named plaintiffs Danielle Tillery, Michael Walsh and David Rosenberg, who each bought a Samsung Smart TV between 2014 and 2021, accuse Samsung of violating their data privacy by harvesting...

Source

Odia Kagan of FoxRothschild writes: On September 30, 2026, California Governor Gavin Newsom signed Senate Bill 690, significantly narrowing one of the theories driving California website-tracking litigation. The law limits private lawsuits alleging that tracking technologies used on websites and applications violate the pen register and trap-and-trace provisions of the California Invasion of Privacy Act,...

Source

Steve Alder reports: … Fairchild Medical Center has agreed to pay attorneys’ fees and expenses, settlement administration costs, a service award to the class representative, and benefits to the class members. The class consists of all California citizens whose information was disclosed to third parties – approximately 1,000 individuals. Those individuals are eligible to enroll...

Source

Brian Krebs reports: The consumer data broker Radaris.com has long had a reputation for ignoring requests to remove personal information from its vast empire of people-search services online. That reputation caught up with the company recently in a lawsuit alleging Radaris violated a New Jersey privacy law that provides for hefty fines against data brokers...

Source

The AP and Mikella Schuettler of Report for America report: A New Mexico jury on Friday found Facebook liable for deceiving users about privacy protections on the platform in the latest legal setback against the social media giant that has already cost it billions of dollars. The jury found over 43 million violations of state...

Source

Suzanne Smalley reports: Privacy Commissioner of Canada Philippe Dufresne has launched a probe of IDScan.net in the wake of reports that a bad actor penetrated company databases to steal personal data and scans of 153 million people’s drivers’ licenses. IDScan.net’s technology is widely used by industry — particularly in the retail and hospitality sectors —...

Source

Brian O’Donovan reports: Tech giant Google has been fined €403m by the Data Protection Commission (DPC) over the processing of location data. Under data protection rules, such information must be processed in a lawful, fair and transparent manner. The DPC said that its investigation into Google found failures in this regard meaning that people could...

Source

Derek Kravitz reports: Nearly every time you buy something online or sign up for a loyalty program, you leave behind personal information that can be collected, shared, and sold among companies including advertisers, retailers, and data brokers. This kind of information is sometimes used to charge consumers more for a range of products and services,...

Source