Latest Worldwide Developments on Personal Data

Google, women's health care app settle federal privacy lawsuit for $56M.

Google and women's reproductive health care app Flo agreed to a combined settlement totaling USD56 million to resolve a U.S. class-action lawsuit that alleged the companies violated Flo users' privacy by harvesting their personal data to serve them with targeted advertising, Reuters reports. Per the terms of the settlement that the presiding judge must approve, Google will pay USD48 million, and Flo will pay the remaining USD8 million.

Click on the link for the full story.

Hamburg's DPA fines financial company for improper credit card denials.

The Hamburg Commissioner for Data Protection and Freedom of Information fined a financial company 490,000 euros for allegedly denying several credit card applications using automated decision-making technology without human oversight. The company accepted the fine, according to the HmbBfDI, and took steps to come into compliance under the EU General Data Protection Regulation.

Click on the link for the full story.

Lawsuit aims to prevent US government from merging citizens' personal data.

A class-action lawsuit filed by the League of Women Voters, the Electronic Privacy Information Center, and five individuals is aiming to prevent the U.S. Department of Homeland Security and the Department of Government Efficiency from accessing and merging citizens' personal data collected by federal agencies, NPR reports. The lawsuit claimed the White House's attempt to obtain citizens' data violates the Privacy Act of 1974 and could compromise Americans' sensitive data.

Click on the link for the full story.

Garante issues temporary restriction against AI app that generates explicit images, videos.

Italy's data protection authority, the Garante, issued a temporary restriction on processing Italian citizens' personal data to a British Virgin Islands-based company that operates the Stop Clothoff app. The app allows users, including minors, to create sexually explicit photos and videos of individuals without consent.

Click on the link for the full story.

Switzerland to vote on proposed digital IDs.

Switzerland citizens will vote on whether to implement digital identification cards after previously denying a similar proposal in 2021, BBC News reports. The ID system aims to be privacy protective with user data stored on individuals' devices, and limited government access to user information. Last week, U.K. Prime Minister Keir Starmer also introduced a digital ID scheme.

Click on the link for the full story.

UK increases efforts to obtain Apple users' cloud data.

The U.K. Home Office issued a new order to Apple requesting backdoor access into U.K. Apple users' cloud data, the Financial Times reports. The U.K. previously issued a similar order but received pushback after Apple said it "never built a back door or master key to any of our products or services and we never will." In response to the earlier order in February, Apple removed its Advanced Data Protection cloud storage service for U.K. users. "We are gravely disappointed that the (ADP) protections ... are not available" to U.K. customers "given the continuing rise of data breaches and other threats to consumer privacy," Apple said. Editor's note: The IAPP recently looked back at the encryption debates as part of its 25 leaders, 25 moments at 25 years series.

Click on the link for the full story.

Norway's DPA comments on consultation for social media age limits.

Norway's data protection authority, Datatilsynet, said it supports the intention behind a proposal from the Ministry of Children and Family Affairs to limit social media accounts to children 15 years or older, which it is seeking public consultation on. The agency said it is concerned about the balance between privacy and speech protections with mitigating exposure to harmful content. It said the concept of age verification poses challenges that should be investigated further.

Click on the link for the full story.

Dutch court orders Meta to change its timeline practices for Facebook, Instagram.

Reuters reports a Netherlands court is requiring Meta to provide Facebook and Instagram users with a way to opt out of a timeline view that uses profiling and to keep it that way when an app is closed. The practice was not aligned with the EU Digital Services Act, according to the court. Meta said it would appeal the decision.

Click on the link for the full story.

California Privacy Protection Agency fines retailer $1.35M for CCPA violations.

In its largest fine to date, the California Privacy Protection Agency Board issued a decision requiring Tractor Supply Company to change its business practices and pay USD1.35M for alleged violations of the California Consumer Privacy Act. The CPPA said "the decision is the first to address the importance of CCPA privacy notices and privacy rights of job applicants." According to the CPPA, the retailer did not notify consumers and job applicants of their privacy rights, provide consumers with "an effective mechanism" to opt out of sale of their data, among others. The company must implement broad remedial measures and "require a corporate officer or director to certify compliance annually for the next four years."

Click on the link for the full story.

FAA's changes to drone regulations raise concerns about surveillance.

The U.S. Federal Aviation Administration is expected to loosen regulations on drones, raising concerns that drones could be used for surveillance purposes, MIT Technology Review reports. The FAA's current regulations prevent drones from being flown out of sight from the user, however, plans to cut these requirements could allow the drones to be flown further and potentially used as monitoring devices.

Click on the link for the full story.

IAPP Weekly News 29.09.2025 - 03.10.2025