data privacy

Ireland's Data Protection Commission has fined Google €403 million for breaching the EU's General Data Protection Regulation, according to the Irish Times. The penalty from Google's lead European regulator ranks among the larger GDPR fines issued to a major technology company, and the ruling is likely to fuel ongoing debate about how EU watchdogs police the data practices of large US platforms.

Ireland's Data Protection Commission has fined Google €403 million following an inquiry into how the company processes users' location data. The regulator concluded that Google's handling of location information breached EU data protection rules, with concerns centring on how users were informed and asked to consent. It is one of the largest privacy fines issued under the GDPR to date.

A coalition of 44 state attorneys general has reached a settlement over a data breach, according to GovTech. The agreement marks one of the broader multistate actions on cybersecurity and data protection, though details on the company involved, the size of the settlement, and the terms for affected consumers have not been released. Such settlements typically include payments and commitments to strengthen data security practices.

The Make America Healthy Again movement is pushing to give Americans far easier access to their personal health data, according to reporting by STAT. The push would let patients obtain and share their medical records more freely, a goal that has drawn attention from both patient advocates and privacy critics as the Trump administration's health agenda advances.

A new research paper analyzes how web and mobile conversational AI agents handle user privacy, finding that popular chatbots may collect and transmit more personal data than users expect. The analysis examines tracking practices, data sharing, and prompts across widely used AI assistants, raising questions about how much information these services gather in everyday conversations.

Fintech firm Revolut is testing 'Pay with Smile', a biometric payment method that lets customers pay in shops using facial recognition. The system links customers' existing KYC identity data, runs on Revolut's own point-of-sale hardware, and deducts money directly from a Revolut account, bypassing cards or smartphones. Commentators note this creates a nearly closed payment ecosystem around the company, raising both convenience and privacy questions as the trial draws attention in banking and fintech circles.

The Federal Trade Commission is weighing a proposal on personalized pricing, and reaction is divided. Industry groups are pushing back against potential restrictions, arguing individualized pricing practices can be legitimate, while consumer advocates support greater scrutiny of practices that charge different customers different prices based on their data. The debate touches on privacy, fairness, and how far regulators should go.

Privacy advocates are renewing calls for privacy protections to be enabled by default for everyone, arguing they should apply even to people who believe they have nothing to hide or who are indifferent to surveillance. The argument frames privacy as a fundamental human right rather than an optional setting, insisting that opting out should be unnecessary because safeguards must protect all users regardless of their personal stance on data collection.

A commentary piece argues that the United States may be losing access to critical intelligence data needed to stop future terrorist attacks, raising questions about whether privacy restrictions, policy changes, or intelligence-sharing limits are weakening counterterrorism capabilities. The debate touches on the balance between civil liberties and national security, a recurring tension in US security policy.

Financial technology firm Finastra has reached a $3.13 million settlement in a lawsuit over a data breach, agreeing to compensate affected customers. The deal, subject to court approval, resolves claims tied to the company's handling of sensitive customer data. Privacy advocates are citing the case as another example of mounting legal and financial consequences for financial firms that suffer security failures.

California has signed SB 923 into law, extending the CCPA's right to delete personal data so that businesses must also instruct third parties, such as service providers and contractors, to delete shared consumer data. The change aims to close a long-standing gap that allowed consumer deletion requests to stop at the company that received them. Privacy professionals are now assessing how the obligation flows through data-sharing chains.

Consumer Reports is examining whether smart home devices, including cameras, speakers and connected appliances, may be collecting and sharing data about their users. The report looks at privacy risks inside connected homes and how much personal information devices gather, raising questions about consent, data sharing with third parties, and what consumers can do to protect themselves.

Walmart says it does not use customers' personal information to set prices, pushing back on privacy concerns as it rolls out digital shelf labels across more of its US stores. The retailer says the electronic tags allow faster price updates and clearer labelling, but the expansion has raised questions about whether dynamic, personalised pricing could follow. Walmart maintains prices will not vary based on individual shopper data.

An opinion piece in the Albuquerque Journal argues that age verification requirements in video gaming raise significant privacy concerns for players. The commentary adds to a wider debate over identity checks required by gaming and online platforms, which critics say collect sensitive personal data and create risks of breaches or misuse.

A software developer explains why they are shifting toward building local-first applications, arguing that modern apps too often depend on the same cloud-based patterns. The piece touches on open-source development, Android, and the role of AI, and frames local-first design as better for users and communities. It has sparked discussion in open-source and development circles about whether more software should work offline and keep data on the device.

California has signed SB 923 into law, broadening the right to delete personal data under the CCPA. The move expands consumers' ability to have their information removed by businesses covered by the state's privacy regime. Discussion is focused on what the new obligations will mean for companies handling California residents' data.

More than 44,000 people have lodged legal requests asking NHS England to remove their data from the health service's data platform operated under contract by Palantir. The campaign against the US software firm's role in handling NHS patient data is growing, with supporters now preparing for potential court battles over how patient information is used.

Peter Thiel, co-founder of data-analytics firm Palantir, has bought a large tract of forest land in Sweden, according to a report circulating in online discussion. Commenters are debating the motivations behind the purchase, ranging from conservation and timber investment to privacy-driven land ownership by wealthy tech figures. Details about the size, location and price of the acquisition remain limited.

Adtech company 33Across has rebranded as WealthStage, shifting to an advertising platform aimed at banks, trading apps, lenders, brokers and insurers. The platform uses an AI engine to score household wealth, positioning itself for an estimated $124 trillion in wealth changing hands by 2048. Industry observers are questioning which data sources feed the system and what parts of the 33Across business remain.

A widely shared reply to Nextcloud on Mastodon argues that rooting an Android device is the basic starting point for de-Googling a phone. The steps suggested: download a browser from the Google Play store, allow software installation in settings, then get apps from F-Droid, the independent open-source app repository, instead of relying on Google services.