Latest Worldwide Developments on Personal Data

California attorney general sues rebranded genetic testing company after 2023 data breach.

California Attorney General Rob Bonta announced a lawsuit against Chrome Holding Co., previously known as 23andMe, over its alleged failure to protect customers' sensitive genetic data following a 2023 data breach. The breach impacted nearly 7 million U.S. customers, including 855,541 California residents. In the complaint, Bonta alleges the California Department of Justice and a multistate coalition found 23andMe pre-data breach security practices were not up to industry standards, which reportedly led to a threat actor operating within the company's systems undetected for five months.

Click on the link for the full story.

US state attorneys general oppose proposed KIDS Act.

A bipartisan coalition of 44 U.S. state attorneys general wrote a letter to Congress raising concerns that the proposed Kids Internet and Digital Safety Act could preempt states' online safety regulations and prevent efforts to issue enforcement actions against companies. The attorneys general noted though they oppose the KIDS Act, federal legislation that could coexist alongside states' efforts would likely strengthen protections for children online. The letter said, "state law legal developments, through both legislation and enforcement, are the surest route to legal innovation that can approach the speed of technological innovation.

Click on the link for the full story.

US Supreme Court dismisses Meta's efforts to block lawsuit by Vermont's attorney general.

The U.S. Supreme Court has rejected efforts by Meta to block a lawsuit from Vermont Attorney General Charity Clark over claims the company's algorithm is addictive for underage users, MediaPost reports. Meta previously urged the court to appeal a previous ruling that could require the company to face the lawsuit, noting if a "state court may exercise specific jurisdiction over a defendant based on its 'business model,' nearly every large national business ... is at risk of being haled into the courts of all 50 states.

Click on the link for the full story.

NIST's Computer Security Resource Center publishes annual privacy, cybersecurity report.

The U.S. National Institute for Standards and Technology's Computer Security Resource Center issued its fiscal year 2025 Cybersecurity and Privacy Annual Report. The report contains information on the agency's Information Technology Laboratory Cybersecurity and Privacy Program's research activities, which included participating in developing international standards and improved software and supply chain cybersecurity.

Click on the link for the full story.

UN releases children's online safety guidance.

The U.N. released guidance on strengthening children's safety online as U.N. High Commissioner for Human Rights Volker Türk urged regulators and technology companies to continue to advance safeguards to protect children. Türk noted, though regulators have worked to limit online risks by introducing social media bans for children, "we need much wider action — by Governments and companies — to ensure that the platforms themselves are made safer by design, that data is protected, that those responsible for harm can (be) held to account, and that children’s rights and needs are fully respected throughout.

Click on the link for the full story.

CNIL releases guidance on cloud computing responsibilities.

France's data protection authority, the Commission nationale de l'informatique et des libertés, released information on the responsibilities and qualifications for professionals in the cloud computing sector. The guidance detailed expectations for data controllers and processors' cloud security management and effective personal data processing under the EU General Data Protection Regulation.

Click on the link for the full story.

UK Ofcom fines adult website operator for alleged OSA age check violations.

The U.K. Office of Communications fined the operator of four adult websites 500,000 GBP for allegedly not implementing adequate age assurance checks as required under the Online Safety Act. Youngtek Solutions allegedly did not deploy age assurance means between 25 July-22 Sept. 2025, according to Ofcom. Additionally, while under investigation by the agency, the company reportedly did not respond to a formal Ofcom request for information and was assessed an additional fine of 100,000 GBP.

Click on the link for the full story.

ANPD launches consultation on preliminary age verification technology guidelines.

Brazil's data protection authority, the Agência Nacional de Proteção de Dados, opened a public consultation on its initial draft guidelines for age verification mechanisms. The guidelines seek to offer general instructions for the application of reliable age verification mechanisms by technology vendors or services directed at children and adolescents. The consultation closes 9 July.

Click on the link for the full story.

Healthcare providers' privacy notices raise consent concerns.

Many healthcare organizations are asking patients to sign consent forms acknowledging privacy notices that are not actually provided, raising concerns about consent and the security of individuals' sensitive health data, CalMatters reports. A lack of opt-out standards and alleged use of dark patterns could make it difficult for consumers to obtain documents they consented to and know what sensitive health data has been collected and shared.

Click on the link for the full story.

Debate picks up over UK police's live facial recognition technology use.

In the U.K., a debate is raging over the expanded use of live facial recognition technology by London's Metropolitan Police, Reuters reports. Police claim the technology has assisted in arresting 2,500 wanted suspects since 2024. Civil liberties advocates claim the technology allows the police to screen large volumes of people who otherwise are not suspected of having committed a crime.

Click on the link for the full story.

IAPP Weekly News 25.05.2026-29.05.2026