Latest Worldwide Developments on Personal Data

Ireland's media regulator probes TikTok, LinkedIn for potential DSA violations.

Ireland's media regulator, the Coimisiún na Meán, is investigating TikTok and LinkedIn under the EU Digital Services Act after a review showed the platforms are allegedly using deceptive interfaces or dark patterns with their mechanisms for reporting illegal content, making it more difficult to do so. The companies said they are committed to keeping users safe and would cooperate with investigators, The Irish Times reports.

Click on the link for the full story.

CNIL fines credit card company for alleged cookie consent violations.

France's data protection authority, the Commission nationale de l'informatique et des libertés, fined American Express Carte France 1.5 million euros for alleged third-party cookie consent violations under the country's Data Protection Act. Following "several checks on this site and within the company's premises," the CNIL found the company placed cookie trackers without consent and continued to track users after consent was withdrawn. American Express Carte France brought itself into compliance during the probe, resulting in a reduced fine.

Click on the link for the full story.

ICO to probe mobile games' treatment of children's data.

The U.K. Information Commissioner's Office said it will investigate how 10 popular mobile games collect and use children's data. Information Commissioner John Edwards said the ICO's early reviews found the games' design features "can be especially intrusive" and raises U.K. Children's Code compliance questions. The extended probe will look at the games' compliance with default privacy settings, geolocation controls and targeted advertising practices.

Click on the link for the full story.

European Commission fines X 120M euros for DSA violations.

The European Commission announced its first Digital Services Act noncompliance fine of 120 million euros against the social platform X for allegedly violating three components of the regulation related to platform transparency requirements. Meanwhile, the Commission also announced TikTok accepted binding conditions to align its advertising repository transparency with DSA requirements without assessing a financial penalty. IAPP Staff Writer Alex LaCasse reports on the Commission's decisions and their potential geopolitical implications.

Click on the link for the full story.

EDPB, EDPS to issue joint statement on digital omnibus.

During its latest plenary meeting, the European Data Protection Board held a preliminary discussion on the European Commission's proposed Digital Omnibus Regulatory Proposal. According to the EDPB, the board and the European Data Protection Supervisor will issue a subsequent joint opinion on the package. The EDPB said the statement will focus on how the Commission's proposal impacts EU citizens' fundamental rights and if it will meet its goal of providing more legal certainty to organizations.

Click on the link for the full story.

Edtech company agrees to FTC settlement over 2021 data breach case.

The U.S. Federal Trade Commission reached a settlement with education technology provider Illuminate Education to resolve claims the company's lax security data security practices led to a 2021 data breach that affected more than 10 million students. According to the settlement, the company must commit to implementing a robust data security program and delete all unnecessary data or face fines of up to USD51,744 per subsequent violation of the order. In November, Illuminate agreed to a USD5.1 million settlement with state attorneys general.

Click on the link for the full story.

CJEU clarifies application of GDPR to accuracy of online store advertisements.

The Court of Justice of the European Union ruled online marketplaces qualify as data controllers of personal data contained in advertisements published on their platforms under the EU General Data Protection Regulation. The case emanated in Romania in 2018 when online marketplace Russmedia Digital published a false advertisement that contained personal information of a woman reportedly offering prostitution services. The CJEU's clarifying decision stated the marketplace operator must verify if an ad on its platform contains personal information and that the user posting the information is the specific data subject.

Click on the link for the full story.

European Commissioner McGrath says digital omnibus' GDPR reform will not expand.

In an interview with Politico, European Commissioner for Democracy, Justice, the Rule of Law and Consumer Protection Michael McGrath said the Commission has gone as far as it can to make pro-business reforms to the EU General Data Protection Regulation as part of the wider digital omnibus package. "We are close to, or at the point, where significant further changes could put at risk those high standards of data protection that I think we hold dearly in the European Union," McGrath said. Editor's note: The IAPP will host a LinkedIn Live exploring some of the key changes proposed in the European Commission's digital omnibus package 4 Dec.

Click on the link for the full story.

The problems publishers see with the EU Digital Omnibus proposal.

Digiday reports European publishers expect the European Commission's draft Digital Omnibus would do little to fix challenges around securing user consent to track for advertising if passed as is. Publishers are particularly concerned about a provision requiring a single opt-in mechanism in browsers, which could affect their revenue streams. Meanwhile, IAB Europe published guidelines on how to comply with Article 26 of the EU Digital Services Act, which deals with transparency around ads online platform users are shown.

Click on the link for the full story.

Canada's OPC to examine data protection in online gaming through 2026-2027 Contributions Program.

The Office of the Privacy Commissioner of Canada's 2026-2027 Contributions Program will focus on data protection themes in the online gaming industry. The initiative, "Achievement Unlocked: Protecting Privacy While Online Gaming," seeks research proposals that "advance knowledge related to the collection and use of personal data in the online gaming sphere." Proposals are due by 20 Feb. 2026.

Click on the link for the full story.

IAPP Weekly News 01.12.2025 - 05.12.2025