Latest Worldwide Developments on Personal Data

Preliminary probe alleges TikTok violated DSA's children's safety provisions.

The European Commission's preliminary findings in a Digital Services Act probe of TikTok found violations stemming from insufficient security for minors' accounts by default. TikTok allegedly allows minor users to list their profiles as "public," which enables any individual with or without a TikTok account to view the content. Also, teens ages 16 to 17 can have their content recommended to any other user. TikTok has the opportunity to review the findings, which could result in a fine up to 6% of its global revenue.

Click on the link for the full story.

Singapore's CSA updates critical infrastructure cybersecurity code of practice.

The Cyber Security Agency of Singapore revised its Cybersecurity Code of Practice for Critical Information Infrastructure to address cybersecurity developments stemming from advanced persistent threats and AI-enabled harms. The CSA's updates aim to address "governance, visibility, detection and readiness, and broader enterprise networks that are interconnected with the CIIs.” Infrastructure operators are now required to develop “a comprehensive cybersecurity exercise plan” and "have robust management measures to maintain network architecture.”

Click on the link for the full story.

France becomes first EU member state to approve children's social media ban.

France has become the first EU member state to pass legislation banning individuals under age 15 from accessing social media platforms. Pending final approval, the law would be implemented in phases, with new underage accounts blocked beginning 1 Sept. and existing accounts removed by 1 Jan. 2027. IAPP Staff Writer Lexie White reports on details of the bill, including age verification requirements and how it fits into the broader EU efforts to strengthen children's online safety obligations.

Click on the link for the full story.

Google fined 890M euros over DMA violations.

The European Commission issued an 890 million euro fine to Google following alleged Digital Markets Act violations. The penalty comes after a Commission investigation claimed Google was "self-preferencing its own services on Google Search, and for putting in place restrictions on businesses to direct consumers to alternative, often cheaper, purchase channels on Google Play." Editor's note: The IAPP carries a Digital Markets Act 101 page in its Resource Center.

Click on the link for the full story.

South Korea's PIPC fines TikTok KRW10.3B.

South Korea's Personal Information Protection Commission announced a KRW10.3 billion fine against TikTok for alleged nonconsensual collection and transfer of third-party behavioral data. According to the PIPC, TikTok did not obtain consent in a way users "could clearly recognize it at the time of sign-up" while its transfer of third-party data had insufficient transparency. The agency also fined two Apple affiliates a combined KRW252 million over alleged Personal Information Protection Act violations related to unlawful collection of Siri voice data.

Click on the link for the full story.

Lawsuit over Meta's alleged addictive features dropped.

A 15-year-old social media user's lawsuit claiming Meta's platforms are harmful and potentially addictive was dropped after agreeing to settlement terms with the company, The New York Times reports. The case was part of nine major children's online safety lawsuits against social media platforms. Meanwhile, U.S. Sen. Chuck Grassley, R-Iowa, wrote a letter to Meta urging the company to respond to concerns about its alleged retaliation against whistleblowers after the company allegedly fired two individuals who communicated with the Senate Committee on the Judiciary about whether Meta used targeted advertisements for underage users.

Click on the link for the full story.

Lawsuit claims ChatGPT's advice spurred individual's health issues.

The New York Times reports a lawsuit filed to the San Francisco County Superior Court alleged medical consultations with OpenAI's ChatGPT led to a man's deteriorating health and a near-death experience. The lawsuit is one of the first instances of AI chatbot liability claims in the healthcare context. OpenAI and CEO Sam Altman are accused of negligence in the complaint, which alleges ChatGPT's safety features malfunctioned and did not detect clear signs of a medical issue.

Click on the link for the full story.

Garante issues fines totaling 7.7M euros for alleged GDPR violations.

Italy's data protection authority, the Garante, fined Hera Comm 5.8 million euros and EstEnergy 1.4 million euros after the companies allegedly violated the EU General Data Protection Regulation by using an automated system to score consumers based on their data to determine if the company should provide them services. The Garante said the companies violated the GDPR by not informing consumers how their data was processed or remaining transparent about why they were given specific scores. The DPA also issued a 400,000 euro fine to Cerved and a 120,000 euro fine to Experian after an inquiry found the companies data request processes and minimization standards did not comply with the GDPR.

Click on the link for the full story.

CNIL releases FAQ detailing its recommendations for tracking pixels.

France's data protection authority, the Commission nationale de l'informatique et des libertés, released a questions-and-answers resource detailing organizations' use of tracking pixels in emails and the consent obligations they must establish before collecting and processing consumer data. The guidance advises organizations to ensure individuals know why their data is being collected and delete consumers' data if consent is withdrawn.

Click on the link for the full story.

Spain's AEPD issues report on AI systems' personal data processing.

Spain's data protection authority, the Agencia Española de Protección de Datos, published a technical note detailing its analysis of AI systems' personal data processing standards and how companies can ensure systems are compliant with the EU General Data Protection Regulation's data quality and minimization standards. The AEPD said the GDPR's data quality obligations apply to all processed data, noting organizations must "define data quality requirements objectively and based on the purpose of the processing, avoiding both insufficient and excessive requirements.

Click on the link for the full story.

IAPP Weekly News 20.07.2026-24.07.2026