Latest Worldwide Developments on Personal Data

Google to face lawsuits over alleged data collection practices.

A U.S. District Court for the Northern District of California judge ruled Google must face claims it violated the Wiretap Act and the California Comprehensive Computer Data Access and Fraud Act after it allegedly collected users' personal data without consent, Courthouse News Service reports. Judge Yvonne Gonzalez Rogers denied Google's efforts to dismiss the claims after the company argued it obtained consumer data in the "ordinary (course) of business," ruling the company must provide answers regarding its data collection and consent practices.

Click on the link for the full story.

Florida sues OpenAI over ChatGPT's alleged dangers to children, public.

Florida Attorney General James Uthmeier filed a lawsuit against OpenAI in state court alleging the company's ChatGPT poses a danger to children and that it does not warn the public about the chatbot's risks, The New York Times reports. The complaint alleges OpenAI built "a dangerous online product where harmful information such as tips on eating disorders, self-harm and mass murder are readily available, including to young children."

Click on the link for the full story.

CJEU annuls decision designating Meta's Marketplace as a gatekeeper under the DMA.

The Court of Justice of the European Union annulled a decision by the European Commission that designated Meta's Marketplace feature as a gatekeeper under the EU Digital Markets Act. The court found Meta's Marketplace feature did not meet specific criteria to match its gatekeeper designation and claimed the Commission "erred in law since it had considered that it could rely solely on data concerning the last three years preceding designation, without taking account of changes made at the end of July 2023." Overall, the court upheld Meta's gatekeeper status for Messenger.

Click on the link for the full story.

NOYB, Norway's Consumer Council file complaint against media company over pay-or-consent system.

Norway's Consumer Council and nonprofit NOYB filed a complaint against media company Schibsted after the company implemented a pay-or-consent system that required consumers to pay a fee to opt out of data collection. The complaint argued pay-or-consent models could force consumers to provide companies with personal data for targeted advertising purposes without meaningful consent. NOYB Data Protection Lawyer Joakim Söderberg said, "profiteering from fundamental rights is not a legitimate business model in Europe. We're hoping that the Norwegian (data protection authority) sees things our way, and that Schibsted abandons this unpopular and unlawful scheme."

Click on the link for the full story.

Amazon's Ring camera faces lawsuit over claims its data collection practices violate privacy.

A Virginia resident filed a lawsuit against Amazon over claims the company's Ring doorbell camera's "Familiar Faces" facial recognition feature allegedly collected and stored individuals' personal data without consent, Reuters reports. The company's use of AI facial recognition features has previously raised concerns it could surveil nonusers without consent. The lawsuit pushed for class-action status, claiming millions "of other Americans passed by a Ring security camera and unknowingly had their facial recognition information collected."

Click on the link for the full story.

US SECURE Data Act faces criticism during first hearing in Congress.

U.S. House Republicans presented their Securing and Establishing Consumer Uniform Rights and Enforcement over Data Act, or SECURE Data Act, in a House Committee on Energy and Commerce Subcommittee on Commerce, Manufacturing, and Trade 3 June. Democrats on the subcommittee took the opportunity to criticize the bill that is neither bipartisan, nor bicameral, as drafted, due to its strong preemption language and lack of a data minimization standard, in addition to other provisions. Witnesses speaking in support of the bill said it is necessary to set a single federal data privacy standard.

Click on the link for the full story.

Louisiana becomes 22nd US state to pass a consumer privacy law.

Future of Privacy Forum Senior Policy Counsel Jordan Francis, CIPP/E, CIPP/US, CIPM, FIP, breaks down key components of the newly passed Louisiana Data Privacy Act. Francis said the law largely follows the framework established under the Washington Privacy Act. He said the applicability threshold more closely resembles the California Consumer Privacy Act and applies to businesses with gross revenues exceeding USD25 million, that annually buy the personal information of more than75,000 consumers or that derive more than 50% of its revenue from selling personal data. The law enters into force 1 Jan. 2027.

Click on the link for the full story.

Malaysia's social media restrictions raise concerns over potential privacy implications.

Malaysia's social media ban for individuals under age 16 went into effect 1 June, "though the restrictions have raised concerns about age-verification mechanisms and potential enforcement challenges, DW reports. Universiti Sains Malaysia Cybersecurity Research Center Director Selvakumar Manickam noted that, while the ban will not completely reduce online harms for underage users, it "could reduce exposure among younger users and sharpen platform accountability. Provided it is backed by digital literacy education, parental engagement, and tighter regulation of platform design."

Click on the link for the full story.

How Africa's data protection frameworks are impacting the delivery of global health aid?

Data protection laws across Africa are complicating multibillion dollar health aid agreements with the U.S., Carnegie Endowment for International Peace's Africa Program Fellow Jane Munga writes in Lawfare. Munga said while some countries have agreed to the requirements set out in a number of African nations' data protection frameworks, they "should now be used not just to block agreements that fall short but also to condition access to data on African governments' own terms

Click on the link for the full story.

Japan, Philippines' DPAs sign pact to increase data protection cooperation.

Representatives from Japan's Personal Information Protection Commission and the Philippines' National Privacy Commission signed a memorandum of cooperation on personal data protection and privacy enforcement, Newsbytes reports. Specifically, the PIPC and NPC will increase their information sharing, collaboration on privacy investigations and sharing best practices on data protection policies and privacy-enhancing technologies.

Click on the link for the full story.

IAPP Weekly News 01.06.2026-05.06.2026