Latest Worldwide Developments on Personal Data

Meta faces $1.4T in fines from US states over children's online safety concerns.

Ahead of its August trial at the U.S. District Court for the Northern District of California, Meta said attorneys general from California, Colorado, Kentucky and New Jersey are seeking USD1.4 trillion from the company for alleged children's online safety concerns, The Straits Times reports. Despite states' claims the company misled consumers by not disclosing potentially harmful and addictive features, the company said it will continue to push back against the allegations and “outlandish” sanctions. Meanwhile, Politico reports children's safety advocates Tamia and Tim Woods, whose son inspired the James T. Woods Act, urged Meta CEO Mark Zuckerberg to appear before the U.S. Senate Committee on the Judiciary instead of sending the company's legal counsel. In a letter to Senate Judiciary Chair Chuck Grassley, R-Iowa, they wrote Zuckerberg “should be answering for the role Meta has played in exposing children to predators and for the countless opportunities the company has had to make its platforms safer.”

Click on the link for the full story.

CNIL releases guidance on mobile apps' geolocation data collection.

France's data protection authority, the Commission nationale de l'informatique et des libertés, released guidance detailing mobile app obligations when collecting users' geolocation information. The guidance said organizations should remain cautious about their data collection and storage standards due to potential data breach concerns and the implications of location data that can collect information about individuals' personal habits. The CNIL noted obtaining "free, specific, informed, and unambiguous consent is necessary to collect and use geolocation data when it is not strictly necessary for the operation of the application/service.”

Click on the link for the full story.

EDPB adopts guidance on anonymization, blockchain and AI web scraping.

The European Data Protection Board approved guidelines for anonymization and AI web scraping, noting it will accept public feedback on the guidance until 30 Oct. The guidance defined organizations' data anonymization processes and aimed to clarify the EU General Data Protection Regulation's position on AI tool data collection and transparency standards. The EDPB also adopted a final version of guidelines on the processing of personal data through blockchain technologies. EDPB Chair Anu Talus said the proposed guidelines "mark a significant milestone in clarifying the notion of anonymous data, establishing clear standards that facilitate the use of data while protecting individuals' fundamental rights.”

Click on the link for the full story.

EU court dismisses Apple's lawsuit against the DMA.

The Court of Justice of the European Union's General Court dismissed Apple's lawsuit that aimed to prevent its app store and iOS system from being designated as a gatekeeper under the Digital Markets Act, Reuters reports. The court claimed Apple's app store fits the criteria to be designated as a gatekeeper under the DMA and noted its designation does not change its legal standing or create unnecessary obligations for the company. An Apple spokesperson said, "we firmly believe the DMA's mandate goes beyond what is lawful and proportionate, threatening to erode decades of privacy and security protections we've built and leaving our users vulnerable to new risks." Editor's note: The IAPP previously published the infographic Digital Markets Act: Mapping the Interplays with the GDPR.

Click on the link for the full story.

European Commission to decide what search data Google will share with competitors under DMA.

The European Commission will notify Google by late July of what search data it must share with competitors to comply with the EU Digital Markets Act, Politico reports. The company, search startups, activists and academics disagree over what data should be shared and whether the DMA's policy goals can be met without hampering Europeans' privacy. Commission Spokesperson Thomas Regnier said the data would not be publicly available and would be shared with limited eligible recipients that process similarly sensitive data.

Click on the link for the full story.

European Commission claims Meta's algorithms violate DSA.

The European Commission found Meta's platforms violate the EU Digital Services Act by containing alleged addictive features that could impact underage users' mental health, The Wall Street Journal reports. While Meta noted it has introduced several safety features aiming to prevent harms for underage users, the Commission said platforms defaulting features such as autoplay “fuel the user's urge to keep scrolling and shift the brain into 'autopilot mode', contributing to unhealthy habits and compulsive use.”

Click on the link for the full story.

European Commission to continue push for proposed social media ban for children.

The European Commission is expected to release a report detailing the benefits of a social media ban for underage users, aiming to persuade skeptical EU member states, Politico reports. The report by European Society for Child and Adolescent Psychiatry President Jörg Fegert and Pierre Louis Institute of Epidemiology and Public Health Deputy Director Maria Melchior will highlight the impact social platforms have on underage users' mental health and provide insights from stakeholders. Commission President Ursula von der Leyen is expected to propose age restrictions for social platforms in September.

Click on the link for the full story.

Canada's privacy commissioner issues guidance on codes of practice when sharing personal data.

The Office of the Privacy Commissioner of Canada released guidance for reporting entities under the Proceeds of Crime (Money Laundering) and Terrorist Financing Act, detailing codes of practice when sharing personal data. Under the act, certain financial organizations can disclose individuals' personal information for security purposes, though they must establish a code of practice compliant with the Personal Information Protection and Electronic Documents Act.

Click on the link for the full story.

Rental screening company to pay $2.25M for alleged FCRA violations.

The U.S. Federal Trade Commission announced rental screening company RentGrow will pay USD2.25 million after it allegedly violated the Fair Credit Reporting Act and the FTC Act. The FTC claimed the company did not comply with the requirements enlisted in the FCRA, did not produce accurate consumer reports and made it difficult for consumers to dispute the reports after the company did not release information about how it obtained data.

Click on the link for the full story.

Garante fines Character.AI over alleged age verification concerns.

Italy's data protection authority, the Garante, issued a 158,000 euro fine to Character.AI over the U.S.-based company's alleged age verification issues and delay in implementing a data protection impact assessment. The Garante also raised concerns about the company's services being easily accessible to minors. Character.AI must ensure its age verification systems are compliant with privacy regulations and automatically set underage users' accounts to private.

Click on the link for the full story.

IAPP Weekly News 06.07.2026-10.07.2026