Latest Worldwide Developments on Personal Data

Google to add targeted advertising into Gemini interactions.

Google announced it will launch advertising tools for its AI chatbot, Gemini, that aims to allow advertisers to serve personalized ads to users based on their chat conversations, the Financial Times reports. The advertising tool's pilot program will continue to "expand to support the creation of offers with other attributes that help shoppers prioritise value over price alone," Google Ads and Commerce Vice President Vidhya Srinivasan said.

Click on the link for the full story.

CNIL discusses cross-device cookie consent.

France's data protection authority, the Commission nationale de l'informatique et des libertés, issued recommendations for businesses and consumers around third-party cookie consent collection across multiple devices. The CNIL covered the need for clear and explicit consent, ensuring preferences across devices and user action when consent decisions are not respected.

Click on the link for the full story.

UK drafting framework for social media ban.

The Financial Times reports U.K. ministers are considering various options for a potential social media ban. The proposals being considered range from a framework similar to Australia's social media ban for children under age 16 to a platform-by-platform ratings system for determining age access. U.K. Prime Minister Keir Starmer is weighing his options on the matter, recently noting his concerns with the social impacts excessive smartphone use is having on children.

Click on the link for the full story.

TikTok plans new age-check system for Europe.

Reuters reports TikTok plans to introduce age verification tools for European users following a year-long pilot program. The detection software reviews profile information, posted videos and behavioral signals to predict a user's age before flagging a potential underage account for a human review. For potential appeals, the platform will employ verification provider Yoti's software along with credit card details and government-issued ID.

Click on the link for the full story.

ICO updates data transfer guidance.

The U.K. Information Commissioner's Office released updated versions of its international data transfer guides, including a three-step test to determine if a transfer should be restricted and clearer details on the roles and responsibilities for controllers and processors. The ICO said it is planning further updates looking at how it approaches transfer risk assessments and new case studies. A 10 March webinar will explain the guidance changes.

Click on the link for the full story.

Children's privacy class-action lawsuit against Google advances.

MediaPost reports Google settled a class-action lawsuit over its alleged collection of data from children's devices. The complaint, filed by a group of parents, accused Google's AdMob of collecting data from apps that it should have known were used by children. Meanwhile, the U.S. District Court for the Northern District of California sided with Meta by dismissing a class-action lawsuit alleging the company wrongly collected data from Facebook app users.

Click on the link for the full story.

EU-US DPF, Digital Omnibus opinion among EDPB plenary items.

The European Data Protection Board published the agenda for its upcoming plenary meeting 15 Jan. Key items include discussion about the board's adoption of unspecified documents regarding the EU-U.S. Data Privacy Framework. Also, there will be policy debate around the EDPB's joint opinion with the European Data Protection Supervisor on the European Commission's Digital Omnibus.

Click on the link for the full story.

CNIL fines telecoms 42M euros for alleged GDPR violations.

France's data protection authority, the Commission nationale de l'informatique et des libertés, issued a 27 million euro fine against Free Mobile and a 15 million euro fine to its parent company Free after a cyberattack on the companies revealed their alleged lack of safeguards and EU General Data Protection Regulation compliance issues. A CNIL inspection of the company after more than 2,500 complaints found it did not have effective data deletion standards and "retained millions of subscribers' data records, without justification, for an excessive period."

Click on the link for the full story.

New Jersey passes bill requiring sensitive data sharing limits.

The New Jersey Legislature gave final passage to Assembly Bill 6309, which provides for targeted protections and requirements for the use of certain sensitive personal data by health care facilities and government entities. The proposed New Jersey Privacy Protection Act limits data collection practices to ensure individuals do not have to share sensitive information, such as immigration status, with health care organizations. Most provisions are applicable with governor enactment while some obligations on health care facilities apply a year after enactment.

Click on the link for the full story.

US court dismisses DOJ's request for California voter details.

The U.S. District Court for the Central Division of California dismissed the Department of Justice's lawsuit seeking an unredacted California voter registration list, Reuters reports. The list would reveal names, birthdates, driver's license information and partial Social Security numbers. Judge David Carter indicated centralizing such data would have a "chilling effect" on voter registration.

Click on the link for the full story.

IAPP Weekly News 12.01.2026 - 16.01.2026