Enforcement & Fines
Japan’s APPI Surcharge Rules: Proceeds and Voluntary Reporting
Japan’s PPC is developing APPI surcharge calculations, a 50% reduction for qualifying voluntary reports, and stronger verification for personal data transactions.
Emirates Fined EUR 180,000 over Health Data Notices and Retention
Italy fined Emirates for inadequate MEDIF privacy information and seven-year health data retention. The decision requires clearer notices and revised retention periods.
OAIC Opens Investigation into the HeyCyan Smart Glasses App
Australia’s privacy regulator is investigating HeyCyan. This article explains how device, app and cloud data flows affect duties to wearers and bystanders.
Ofcom Fines Xgroovy £730,000 for Age-Check and Information Failures
Ofcom has fined Xgroovy for age assurance and information request failures. The case raises questions about age-check implementation and investigation duties.
Brazil Fines TikTok Over Minors’ Data Processing
Brazil’s ANPD fined ByteDance BRL 153.7 million over TikTok’s handling of minors’ data, citing weak legal bases, age controls, and safeguard evidence.
Uber Fined Nearly €825 Million Over Automated Driver Deactivations
Dutch regulator fines Uber nearly €825 million over automated driver deactivations. We examine the facts, legal grounds and effective human review.
FTC Sues Hims & Hers Over Health Data Sharing
The FTC alleges that Hims & Hers shared sensitive health information with ad platforms despite its privacy claims and without clear disclosure.
Privacy Bulletin: SHEIN SMS Violates Do-Not-Call Directive, Faces Class Action Lawsuit
On July 12, 2025, a class action lawsuit was filed against SHEIN for allegedly violating the Telephone Consumer Protection Act (TCPA) by sending marketing text messages to numbers listed on the National Do-Not-Call Registry without prior consent. The plaintiff, whose number was registered in April 2025, continued receiving promotional texts in June, well past the required 31-day buffer. The case emphasizes that TCPA rules apply not only to calls but also to automated SMS marketing, requiring companies to prove consent, honor opt-outs, and now comply within 10 business days following an FCC order in April 2025. This lawsuit highlights stricter enforcement of consumer privacy protections against unsolicited marketing communications.
South Korea Fines Meta for Violating Personal Data Laws
South Korea's Personal Information Protection Commission fined Meta 21.6232 billion KRW for improperly collecting and processing sensitive user information, denying access requests, and causing a data leak. The Commission ordered Meta to implement stronger data protections and ensure lawful handling of sensitive data.
Oracle Reaches $115 Million Settlement Over Data Privacy Lawsuit, Commits to Stricter Data Protection Measures
Oracle has proposed a $115 million settlement to resolve a class action lawsuit accusing the company of unlawfully collecting and selling users' data without consent.
FTC Settles with Verkada Over Data Breach and CAN-SPAM Violations for $2.95 Million
On August 30, the U.S. Federal Trade Commission (FTC) settled with security company Verkada, which will pay a $2.95 million penalty and implement stronger security measures following a lawsuit from the Department of Justice (DOJ).
Dutch Data Protection Authority Fines Uber €290 Million for Illegal EU Data Transfers to the U.S.
The Dutch Data Protection Authority (AP) has imposed a record €290 million fine on Uber for illegally transferring the personal data of EU drivers to the United States without adequate safeguards. This marks the third penalty against Uber by the AP, following an investigation triggered by complaints from French drivers.
Texas Sues General Motors for Illegally Collecting and Selling Driver Data
The Texas Attorney General has filed a lawsuit against General Motors for allegedly collecting and selling the private driving data of over 1.5 million Texas residents without their consent, in violation of state law. The case highlights the need for automakers to comply with privacy laws, ensuring transparency and informed consent in data collection and usage practices.
TikTok Agrees to Withdraw TikTok Lite Rewards Program in the EU Following DSA Investigation
The European Commission announced that TikTok has committed to permanently withdrawing its TikTok Lite rewards program from the EU market after concerns that the program violated the EU's Digital Services Act (DSA). The investigation highlighted TikTok's failure to conduct the required risk assessments before launching new features, marking the first case concluded by the European Commission under the DSA.
Alibaba Fined $1.43 Million by South Korea for Violating Personal Data Transfer Laws
South Korea's Personal Information Protection Commission fined Alibaba.com Singapore E-Commerce Private Limited approximately $1.43 million for violating the country's Personal Information Protection Act by improperly transferring user data across borders.
WhatsApp Faces 1.7 Billion Real Lawsuit in Brazil Over Privacy Policy Changes
Brazil's Federal Public Ministry and the Brazilian Institute of Consumer Protection filed a lawsuit against WhatsApp, seeking 1.7 billion reais in damages for collective mental anguish caused by alleged violations of privacy regulations.
AGCM Imposes €3.5 Million Fine on Meta for Data Privacy Violations
The Italian Antitrust Authority (AGCM) has fined Meta 3.5 million euros for data privacy violations on its social platforms, Facebook and Instagram. The AGCM found that Meta engaged in illegal collection of user data, violating consumer protection laws.
South Korea's Personal Information Protection Commission (PIPC) Fines Kakao
The Personal Information Protection Commission (PIPC) of South Korea has fined Kakao Corporation 15.14 billion KRW for violating the Personal Information Protection Act (PIPA).
AT&T fined US$57 million for illegally disclosing customer location data
AT&T has been fined $57 million by the Federal Communications Commission (FCC) for illegally disclosing customer location data. The FCC found that AT&T leaked customer proprietary network information (CPNI) without consent, violating regulations.
DoorDash Settles for Privacy Violation in California
DoorDash settled for selling personal information of California customers without notification or opt-out mechanisms, breaching CCPA and CalOPPA regulations.
The European Union Officially Launches TikTok DSA Investigation
The European Union has launched an official investigation into TikTok under the Digital Services Act (DSA) to assess its compliance with child protection measures and online content regulations.
Uber Fined €10 Million by Dutch Authority for Privacy Infringements
Uber has been fined €10 million by the Dutch Data Protection Authority (AP) for not fully disclosing their data retention policies and obstructing drivers' rights to access their own data.
Amazon France Fined €32 Million for Monitoring Staff
CNIL found that Amazon's tracking system, which measures employee activities and performance, violated GDPR principles such as data minimization, lawful processing, notification and transparency obligations, and data security.
A Recap of Recent Direct Marketing Enforcements
Recent global enforcement actions underscore the significance of compliance in direct marketing in the digital age.
