Latest Worldwide Developments on Personal Data

CNIL launches public consult on advertiser GDPR compliance.

France's data protection authority, the Commission Nationale de l'Informatique et des Libertés, opened a public consultation on advertising and marketing compliance requirements under the EU General Data Protection Regulation. The consultation will specifically cover how advertisers approach GDPR user consent requirements and aims to "identify existing practices, difficulties encountered and formulate operational guidelines adapted to the realities of the sector."

Click on the link for the full story.

Data Privacy Day: 2026 Predictions.

Join the IAPP 26 Jan. for its annual LinkedIn Live celebrating Data Privacy Day 2026. IAPP President and CEO J. Trevor Hughes, CIPP, will host a 2026 predictions roundtable with A&O Shearman Partner Anna Gamvros, CIPP/A, CIPT, FIP, General Motors Chief Privacy and Trust Officer Christina Montgomery, AIGP, and Prosus Group Head of Privacy Monika Tomczak Gorlikowska, AIGP, CIPP/E, CIPT. They will unpack what could be on the horizon for AI governance, privacy and digital responsibility in the year ahead.

Click on the link for the full story.

Data protection officer requirements by country.

Data protection officers navigate complex legal requirements that vary based on global data protection laws. To better understand the variance, the IAPP produced a country-by-country overview of DPO requirements, detailing how DPOs should be positioned within an organization and how responsibilities are structured. The chart also covers necessary qualifications and obligations for reporting DPO appointment and contact information to data protection authorities.

Click on the link for the full story.

US court dismisses privacy class-action lawsuit against Apple.

The U.S. District Court for the Northern District of California dismissed a class-action lawsuit against Apple claiming the company's analytics settings violated users privacy by acting as a "pen register," Courthouse News Service reports. Judge Edward Davila noted Apple's analytics tools are not considered a pen register because the term "applies only to a device or process separate from the source of the transmitted communications."

Click on the link for the full story.

CNIL fines company for improper use of loyalty program data.

France's data protection authority, the Commission nationale de l'informatique et des libertés, fined an undisclosed company 3.5 million euros for allegedly transmitting email addresses and telephone numbers of loyalty program customers to a social media network without consent. The information was then used to display targeted ads. The agency found the targeted advertising did not meet the need for legal basis for data collection requirements under the EU General Data Protection Regulation and France's Data Protection Act.

Click on the link for the full story.

DLA Piper's annual GDPR survey shows increased enforcement, penalties.

DLA Piper's annual EU General Data Protection Regulation Fines and Data Breach Survey found a 22% increase in data breach notifications and EU enforcement, leading to data protection authorities issuing a total of 1.2 billion euros in penalties. DLA Piper U.K. Data, Privacy and Cybersecurity Practice Chair Ross McKean said the report "underscores the urgency and need for organisations to optimise cyber defences and operational resilience."

Click on the link for the full story.

China establishes new children's online safety rules.

The Cyberspace Administration of China announced new rules related to online information that may affect the physical and mental health of minors. With regard to data protection, the rules cover nonconsensual or forced disclosure of minors' data, including information around "the studies and daily life of minors under the age of fourteen." The CAC issued an FAQ document outlining specifics around the rules.

Click on the link for the full story.

OpenAI rolls out age prediction for ChatGPT.

Euronews reports OpenAI will use age prediction technology in ChatGPT to attempt to prevent younger users from being exposed to violent and sexual content. The system will rely on information such as how long the account has existed, when they use the chatbot and how they use it. Those who might be falsely identified as under age 18 can take a live picture of themselves or a government ID to get restrictions lifted.

Click on the link for the full story.

Spain's AEPD updates FAQ detailing common data protection questions.

Spain's data protection authority, the Agencia Española de Protección de Datos, updated its frequently-asked-questions resource, providing consumers, small to medium-sized enterprises and data protection professionals with answers to more than 200 commonly asked questions. The FAQ also detailed information on SME data controller obligations and compliance. The AEPD's update contains activity log templates, consent forms, and information clauses.

Click on the link for the full story.

Massachusetts' governor proposes social media safety, age verification measures.

Gov. Maura Healey, D-Mass., will file legislation to the Massachusetts Legislature proposing social media restrictions for users under age 18. The proposals will include "mandatory age verification systems, required parental consent and disabling addictive features like continuous scrolling and notifications between certain hours." The requirements will align with recommendations set out by the state attorney general's office last year. In a statement, Healey said the proposed measures aim to "prevent social media companies from targeting kids for profit."

Click on the link for the full story.

IAPP Weekly News 19.01.2026 - 23.01.2026