From TIDA takedown obligations and FTC disclosure guidelines to South Korea's watermark mandate—three new red lines are turning platform content governance from voluntary best practice into enforceable regulatory obligation.
Vietnam’s Personal Data Protection Law (PDPL), enacted in June 2025 and effective from January 1, 2026, establishes a comprehensive national framework for personal data protection, replacing the 2023 Decree No. 13/2023/NĐ-CP. Applicable to both domestic and foreign entities processing Vietnamese citizens’ or residents’ data, the PDPL introduces strict penalties (up to 10 times illegal proceeds for data trading or 5% of annual revenue for cross-border violations), a narrow “legitimate rights and interests” processing basis, and exemptions for micro-enterprises. It mandates explicit consent, data processing and transfer impact assessments (DPIA and TIA), and robust data subject rights, including access, correction, and deletion. Enterprises must implement consent mechanisms, data security measures, and compliance with data localization under the Cybersecurity Law, with specific rules for sensitive data like children’s or health information, and a 72-hour breach reporting requirement.
The Mirror’s cookie banner, which charges £1.99/month to reject non-essential cookies, violates GDPR’s requirement for freely given consent, risking fines and reputational damage. GDPR mandates transparent, opt-in cookie policies with easy withdrawal, and tools like Kaamel’s Risk Management solution help enterprises ensure compliance through automated audits and developer-friendly workflows. Enterprises must prioritize user-friendly consent mechanisms to avoid legal and trust issues.
Brazil’s ANPD fined ByteDance BRL 153.7 million over TikTok’s handling of minors’ data, citing weak legal bases, age controls, and safeguard evidence.
Dutch regulator fines Uber nearly €825 million over automated driver deactivations. We examine the facts, legal grounds and effective human review.
Google’s motion to dismiss puts a core BIPA question in focus: when does using public audio to train an AI model amount to collecting a voiceprint?
Anthropic has detailed Claude's text watermarking and C2PA metadata. We compare the plan with the EU code's marking and detection requirements.
The FTC alleges that Hims & Hers shared sensitive health information with ad platforms despite its privacy claims and without clear disclosure.
California data brokers must process DROP requests from August 1, 2026. The rules cover 45-day cycles, ongoing deletion, matching, and vendor instructions.
Brazil’s ANPD fined ByteDance BRL 153.7 million over TikTok’s handling of minors’ data, citing weak legal bases, age controls, and safeguard evidence.
Dutch regulator fines Uber nearly €825 million over automated driver deactivations. We examine the facts, legal grounds and effective human review.
On July 12, 2025, a class action lawsuit was filed against SHEIN for allegedly violating the Telephone Consumer Protection Act (TCPA) by sending marketing text messages to numbers listed on the National Do-Not-Call Registry without prior consent. The plaintiff, whose number was registered in April 2025, continued receiving promotional texts in June, well past the required 31-day buffer. The case emphasizes that TCPA rules apply not only to calls but also to automated SMS marketing, requiring companies to prove consent, honor opt-outs, and now comply within 10 business days following an FCC order in April 2025. This lawsuit highlights stricter enforcement of consumer privacy protections against unsolicited marketing communications.
Google’s motion to dismiss puts a core BIPA question in focus: when does using public audio to train an AI model amount to collecting a voiceprint?
Anthropic has detailed Claude's text watermarking and C2PA metadata. We compare the plan with the EU code's marking and detection requirements.
Article 50 of the EU AI Act applies from 2 August 2026. See how providers and deployers should adapt AI products for five transparency duties.
The FTC alleges that Hims & Hers shared sensitive health information with ad platforms despite its privacy claims and without clear disclosure.
California data brokers must process DROP requests from August 1, 2026. The rules cover 45-day cycles, ongoing deletion, matching, and vendor instructions.
CRA reporting duties apply from 11 September 2026. This guide covers key terms, operator duties, conformity assessment, enforcement, fines, and annexes.
Vietnam’s Personal Data Protection Law (PDPL), enacted in June 2025 and effective from January 1, 2026, establishes a comprehensive national framework for personal data protection, replacing the 2023 Decree No. 13/2023/NĐ-CP. Applicable to both domestic and foreign entities processing Vietnamese citizens’ or residents’ data, the PDPL introduces strict penalties (up to 10 times illegal proceeds for data trading or 5% of annual revenue for cross-border violations), a narrow “legitimate rights and interests” processing basis, and exemptions for micro-enterprises. It mandates explicit consent, data processing and transfer impact assessments (DPIA and TIA), and robust data subject rights, including access, correction, and deletion. Enterprises must implement consent mechanisms, data security measures, and compliance with data localization under the Cybersecurity Law, with specific rules for sensitive data like children’s or health information, and a 72-hour breach reporting requirement.
On September 6, the EU published a FAQ on the Data Act, explaining its relationship with the GDPR and addressing issues related to IoT data access and business-to-business data sharing.
The European Commission announced that TikTok has committed to permanently withdrawing its TikTok Lite rewards program from the EU market after concerns that the program violated the EU's Digital Services Act (DSA). The investigation highlighted TikTok's failure to conduct the required risk assessments before launching new features, marking the first case concluded by the European Commission under the DSA.
The Mirror’s cookie banner, which charges £1.99/month to reject non-essential cookies, violates GDPR’s requirement for freely given consent, risking fines and reputational damage. GDPR mandates transparent, opt-in cookie policies with easy withdrawal, and tools like Kaamel’s Risk Management solution help enterprises ensure compliance through automated audits and developer-friendly workflows. Enterprises must prioritize user-friendly consent mechanisms to avoid legal and trust issues.
This study looked at the cookie consent practices of 64 Fortune 500 companies that directly engage with European customers. By simulating customers interacting with the website, the research scrutinizes how these global companies adhere to regulation. A staggering 70% of the evaluated websites do not comply with GDPR cookie consent requirements, indicating a substantial gap in adherence to privacy laws among even the biggest companies.
Recently, NOYB has filed numerous complaints against companies using questionable consent banners. This report categorizes and critiques eight types of cookie banner designs prevalent in non-compliant practices
On August 2, Illinois amended the Biometric Information Privacy Act (BIPA), reducing the number of violations counted for repeated biometric data collection from the same individual and allowing electronic signatures as a method for obtaining consent. This amendment significantly lowers potential damages in BIPA lawsuits and offers businesses more flexibility in compliance.
Summary In February 2022, Texas Attorney General Ken Paxton sued Meta formerly known as Facebook , alleging that Meta unlawfully captured the biometric identifi
Zellmer sued Facebook (now Meta) under the Illinois Biometric Information Privacy Act (BIPA) for privacy violations, similar to the "In re Facebook Biometric Information Privacy Litigation" case, which resulted in a $650 million settlement.
The U.S. Federal Trade Commission (FTC) has filed a lawsuit against TikTok and its parent company ByteDance, accusing them of violating the Children’s Online Privacy Protection Act (COPPA) and a 2019 settlement agreement. The lawsuit alleges that TikTok failed to delete underage users' personal data, improperly collected data from minors without parental consent, and created obstacles for parents attempting to delete their children's data.
The Governor of Florida signed Bill HB 3, which regulates minors' use of social media and access to harmful content.
Recently, Pornhub blocked access for users in Texas due to new regulations requiring "reasonable age verification" for accessing sexually harmful materials. The regulations faced opposition and lawsuits but retained the core provision of age verification.
