All Articles
1 / 4
Japan’s APPI Surcharge Rules: Proceeds and Voluntary Reporting
Japan’s PPC is developing APPI surcharge calculations, a 50% reduction for qualifying voluntary reports, and stronger verification for personal data transactions.
EDPB Smart Glasses Statement: Responsibilities of Users and Providers
The EDPB explains how users, manufacturers and AI providers share data protection responsibilities, including obligations towards bystanders.
Emirates Fined EUR 180,000 over Health Data Notices and Retention
Italy fined Emirates for inadequate MEDIF privacy information and seven-year health data retention. The decision requires clearer notices and revised retention periods.
OAIC Opens Investigation into the HeyCyan Smart Glasses App
Australia’s privacy regulator is investigating HeyCyan. This article explains how device, app and cloud data flows affect duties to wearers and bystanders.
AI Gateway Privacy: Your Prompts Can Reach China and Train Models
On OpenRouter, DeepSeek's China endpoint, labeled 'Prompt training: Yes,' served 13% to 15% of a model's tokens in one-day counts. We map who trains on prompts.
AI Agent Privacy: The Nine Data Channels Beyond the Prompt
One agent task opens nine data channels beyond the prompt: screenshots, sign-ins, local files, memory, MCP. We trace a Claude Cowork task and compare 23 agents.
AI Coding Agent Privacy: Don't Trust the Toggle
Grok Build uploaded whole repos, ZCode shipped workspace snapshots, Trae kept telemetry on after opt-out. Each checked against its policy; 15 agents compared.
EU Kids Act: Proposed Age-Based Restrictions on Minors’ Social Media Use
The EU Kids Act draft sets out age-based access rules, safer design, AI safeguards and audits. We examine the proposed changes and their implications for products.
LLM API Privacy Due Diligence: 3+ of 13 Train or Improve on Your Data
13 LLM APIs from OpenAI to DeepSeek: who trains on or improves with your data by default, who offers ZDR, where inference runs, and who lacks a public DPA.
AI Data Compliance Map: The 10 Places a Prompt Gets Stored
A prompt can land in 10 kinds of storage. Six major model APIs keep it 30 to 55 days; trace stores keep it until deleted. How to check each hop.
South Korea’s Robot Vacuum Privacy Inspection: Findings and Fixes
South Korea’s PIPC found no particular privacy infringement risk in inspected robot vacuums, but identified five areas requiring improvements.
California Child Online Safety Laws: Design and Product Requirements
AB 2246 and AB 1709: changes to age-appropriate design, differences from COPPA, and implications for age signals, recommendations, autoplay, and privacy defaults.
Australia Releases Draft Digital Duty of Care
Australia’s draft digital duty of care covers product design, child protection, recommendation choices and ongoing risk assessments. We explain the proposed requirements.
Indonesia’s PDPL Implementing Regulation: Key GDPR Differences
How Indonesia’s PP 33/2026 and PDPL differ from the GDPR on contracts, individual rights, processing records, breach notices and international transfers.
Ofcom Fines Xgroovy £730,000 for Age-Check and Information Failures
Ofcom has fined Xgroovy for age assurance and information request failures. The case raises questions about age-check implementation and investigation duties.
ChatGPT Is Now a VLOSE Under the DSA: What Changes?
The European Commission has designated ChatGPT as a very large online search engine. We explain the DSA threshold and six additional duties that follow.
Brazil Fines TikTok Over Minors’ Data Processing
Brazil’s ANPD fined ByteDance BRL 153.7 million over TikTok’s handling of minors’ data, citing weak legal bases, age controls, and safeguard evidence.
Uber Fined Nearly €825 Million Over Automated Driver Deactivations
Dutch regulator fines Uber nearly €825 million over automated driver deactivations. We examine the facts, legal grounds and effective human review.
When Does Public Audio Training Become Voiceprint Collection?
Google’s motion to dismiss puts a core BIPA question in focus: when does using public audio to train an AI model amount to collecting a voiceprint?
EU AI Content Transparency Code: What Claude's Plan Shows
Anthropic has detailed Claude's text watermarking and C2PA metadata. We compare the plan with the EU code's marking and detection requirements.
FTC Sues Hims & Hers Over Health Data Sharing
The FTC alleges that Hims & Hers shared sensitive health information with ad platforms despite its privacy claims and without clear disclosure.
California DROP Starts August 1 with Ongoing Deletion Duties
California data brokers must process DROP requests from August 1, 2026. The rules cover 45-day cycles, ongoing deletion, matching, and vendor instructions.
EU AI Act Article 50: Product Changes to Make
Article 50 of the EU AI Act applies from 2 August 2026. See how providers and deployers should adapt AI products for five transparency duties.
KIDS Act Passes House: Rules for Platforms, Games, and AI
H.R. 7757 has passed the House and moved to a Senate committee. This brief covers proposed rules for platforms, gaming, AI chatbots, and COPPA 2.0.
