Privacy & Information Security Law Blog

On August 2, 2024, the UK Information Commissioner’s Office issued a statement confirming that it has identified 11 social media and video sharing platforms that must improve their children’s privacy practices.

On July 5, 2024, the California Privacy Protection Agency  issued a set of proposed regulations to implement the CA Delete Act, a law that imposes requirements on data brokers and grants consumers rights designed to facilitate control over their personal information. 

The U.S. Department of Commerce’s International Trade Administration recently published a notice indicating it is considering revisions to the fee schedule for the Data Privacy Framework Program and seeking public comment, which is open until August 7, 2024.

On August 2, 2024, the U.S. sued ByteDance, TikTok and its affiliates for violating the Children’s Online Privacy Protection Act of 1998 and the Children’s Online Privacy Protection Rule.

On August 1, 2024, the EU AI Act entered into force.

On July 30, 2024, Texas AG Ken Paxton announced that Meta agreed to pay $1.4 billion to settle a lawsuit over allegations that Meta processed facial geometry data of Texas residents in violation of Texas law, including the Texas Capture or Use of Biometric Identifier Act (“CUBI”).

On July 30, 2024, in a 91-3 vote, the U.S. Senate passed two bills aimed at protecting youth online: the Kids Online Safety Act and the Children and Teens’ Online Privacy Protection Act.

On July 22, 2024, Google announced that the company is scrapping its plans to phase out the use of third-party cookies in its Chrome browser. Google previously announced plans in 2020 to phase out third-party cookies, a digital advertising tool that tracks consumers’ Internet activity across websites. The company intended to replace third-party cookies with privacy-protective APIs through its Privacy Sandbox initiative.

In June 2024, the European Union Agency for Fundamental Rights (“FRA”) published a report on the experiences, challenges and practices of data protection authorities (“DPAs”) when implementing the EU General Data Protection Regulation (“GDPR”) (the “Report”). The Report was requested by the European Commission ahead of their 2024 GDPR evaluation report, which was published on July 25, 2024.

On July 23, 2024, the Federal Trade Commission announced that it had launched a study of eight companies’ “surveillance pricing” practices. According to the FTC, “the orders are aimed at helping the FTC better understand the opaque market for products by third-party intermediaries that claim to use advanced algorithms, artificial intelligence and other technologies, along with personal information about consumers—such as their location, demographics, credit history, and browsing or shopping history—to categorize individuals and set a targeted price for a product or service.”