Latest Worldwide Developments on Personal Data

Garante issues guidance on the use of tracking pixels in emails.

Italy's data protection authority, the Garante, issued guidance detailing organizational transparency when using tracking pixels in emails. Companies that use tracking pixels must obtain consumer consent before collecting their information and "provide users with clear and transparent information and guarantee simple methods for withdrawing consent, even selectively."

Click on the link for the full story.

Unauthorized actors allegedly obtain access to Anthropic's Claude Mythos.

Unauthorized users allegedly gained access to Anthropic's Claude Mythos AI model that previously raised concerns due to the model's ability to identify and exploit cybersecurity vulnerabilities, Bloomberg reports. Anthropic said it is "investigating a report claiming unauthorized access to Claude Mythos Preview through one of our third-party vendor environments." Editor's note: IAPP Staff Writer Lexie White reported on the global reactions to the release of Mythos.

Click on the link for the full story.

Third-party audit shows organizational noncompliance with CCPA's opt-out requirements.

The Markup reports compliance technology provider webXray found many organizations are allegedly not complying with the California Consumer Privacy Act's Global Privacy Control obligations. The audit claimed technology companies, including Google, Meta and Microsoft, often collected consumer data regardless of their opt-out signal. Microsoft Spokesperson Courtney Ramirez said the company opts consumers out of personal data collection when it detects an opt-out signal; however, certain Microsoft cookies are "necessary for operational purposes, and may therefore be placed and read even when a GPC signal is detected."

Click on the link for the full story.

Garante fines e-commerce, financial services companies a combined 12.5M euros.

Italy's data protection authority, the Garante, issued a 6.6 million euro fine against e-commerce company Postepay and a 5.8 million euro fine against financial services organization BancoPosta after the companies allegedly required consumers to accept data monitoring to access services. The Garante's investigation into the companies' policies found they did not conduct adequate data protection impact assessments nor maintain necessary data security standards.

Click on the link for the full story.

Alabama's attorney general secures children's online safety settlement with Roblox.

Alabama Attorney General Steve Marshall announced a USD12.2 million settlement with gaming platform Roblox over children's online safety claims. As part of the settlement, Roblox will roll out age verification based on government-issued ID and facial scans to ensure age-appropriate access to content. Marshall's office confirmed the new age verification is privacy-preserving. The funds from the settlement will go toward funding school resource officers statewide.

Click on the link for the full story.

500K UK citizens' medical data found for sale online in China

BBC News reports 500,000 participants in the UK Biobank project had their sensitive medical information posted for sale on the Chinese e-commerce marketplace Alibaba. The compromised data up for sale included gender, age, month and year of birth, socioeconomic status, lifestyle habits, and measures from biological samples. UK Biobank CEO Rory Collins acknowledged concerns around impacts while noting "all the data are de-identified; they do not contain any personally identifying information.”

Click on the link for the full story.

Germany's BSI releases guide on cybersecurity in the health care sector

Germany's Federal Office for Information Security released its Cybersecurity in Healthcare 2025 brochure detailing cybersecurity threats and information security management system standards to ensure technology within the health care sector is secure. The guide highlighted ongoing concerns with electronic prescriptions and outlined how organizations can bolster their security practices.

Click on the link for the full story.

South Korea's PIPC issues fines against companies for data breach.

South Korea's Personal Information Protection Commission issued nearly KRW4.8 billion in administrative fines and KRW17.4 million in penalties against KS Korea Employment Information, DUO Info and Geumneung Park Cemetery Foundation after the companies alleged lack of data protection standards led to the breach of sensitive consumer personal data. The PIPC ordered the companies to bolster their data protection standards, noting the authority plans to "evaluate and improve the appropriateness of the collection and use of personal information and the level of protection of data subjects' rights through personal information processing policy evaluations and planned inspections targeting processors that collect large amounts of sensitive information from data subjects."

Click on the link for the full story.

OAIC releases privacy notice template for organizations under the AML/CTF Act.

The Office of the Australian Information Commissioner released a privacy collection notice template to help organizations that collect consumer personal information comply with the Anti-Money Laundering and Counter-Terrorism Financing Act. The template allows reporting entities to provide information on organizational transparency, including what information the organization collects, how it collects personal data and what data could be shared with third parties.

Click on the link for the full story.

OpenAI releases PETs-focused model.

OpenAI launched Privacy Filter, which it describes as "a small model with frontier personal data detection capability." The model, which the company claims it uses in its own "privacy-preserving workflows," is capable of redacting personal information in unstructured text. Developers can now integrate the model into "their own environments, fine tune it to their own use cases, and build stronger privacy protections into training, indexing, logging, and review pipelines."

Click on the link for the full story.

IAPP Weekly News 20.04.2026 - 24.04.2026