Founder at CanITrustThat. I reverse engineer apps and compare what they declare with what their code does, then publish the file and line behind every finding.
Apple's Declared Age Range API returns an age range, a declaration type and parental-control flags to an iPhone app, inside the app process. Apple keeps the birthday. Apple has applied it to new Texas accounts since June 4, 2026; California deems a developer to know the range from January 1, 2027.
Google Play's Age Signals API gives an Android app the user's age range and how it was established, never the birthdate. It returns signals in Brazil and Texas; Google announced a global expansion on July 29, 2026. The call, the four tiers, spoofing, SDK access, and what a scan and a capture show.
Since October 1, 2026, Maryland HB 895 (Chapter 154 of 2026) bars food retailers of 15,000+ square feet and third-party delivery service providers from using a consumer's personal data to set a higher price for tax-exempt food. The Consumer Protection Division enforces it after a 45-day cure.
Since October 1, 2026, Connecticut SB 4 (Public Act 26-64) provides: "No controller shall sell any consumer's precise geolocation data" and "No third party shall sell any consumer's precise geolocation data." The ban has no consent clause. The Attorney General enforces it under CUTPA.
California SB 690, Chapter 976, makes § 638.51 pen register claims over websites, online applications and mobile applications an Attorney General action from 2027-01-01, and applies to pending claims filed in the prior two years. Sections 631 and 632 keep their private right of action.
On September 30, 2026, Android developer verification began in Brazil, Indonesia, Singapore and Thailand. Apps installed from seven participating stores on certified devices must be registered to a developer whose identity Google has verified. Google plans a global rollout in 2027.
In Frasco v. Flo Health, No. 3:21-cv-00757-JD, plaintiffs moved on 2026-09-14 for a $1,110,575,000 judgment against Meta for 222,115 California Flo users they say they have identified, $5,000 each under CIPA. Meta opposed on 2026-09-28. Hearing 2026-10-29.
California AB 2561, Chapter 478 of 2026, bars an operating system or app from undoing a user's affirmative configuration of a privacy setting without the user's consent, from January 1, 2027. The text names no penalty or enforcer; the rule requiring the most protective default was cut in April.
On September 24, 2026, UpGuard reported 16,326 Supabase databases exposing readable tables, among about 300,000 websites with Supabase indicators in their JavaScript. Over half had indicators of personal data. The sample is websites; Supabase mobile apps contain the same kind of URL and key.
On September 24, 2026, Judge George H. Wu denied TikTok and ByteDance's motion to dismiss the under-13 privacy class action (MDL No. 3144) up to August 22, 2022. The pleadings do not show the plaintiffs were members of the 2019 T.K. or 2020 Privacy MDL settlement classes.
On September 21, 2026 Ireland's Data Protection Commission fined Google Ireland €403 million under GDPR Articles 5, 6, 12 and 13 over location data in Web & App Activity, Location History and Location Accuracy from May 25, 2018 to February 4, 2020, and ordered compliance within six months.
The $400 million TikTok COPPA settlement ties its last $100 million to vacating the 2019 Musical.ly consent order. On September 21, 2026, Judge George H. Wu denied the government's motion to vacate without prejudice, so the 2019 order and its records duties through 2029 remain in force.
On September 16, 2026 Apple announced an alternative App Tracking Transparency prompt for the EU from iOS 27.2: a full-page sheet, Markdown text, an Additional Information button and a re-prompt after one year. It is the only prompt for apps in Germany, France, Italy, Poland and Romania.
Apple's iOS 27 security notes, released September 14, 2026, list 126 CVE IDs. Fourteen entries describe an app obtaining persistent identifiers, fingerprinting signals, the list of installed apps, location from system logs, cross-app tracking or Privacy preferences. iOS 26.7 fixes seven of them.
Italy's Garante fined Banco Bilbao Vizcaya Argentaria's Italian branch €5,508,000 in a decision of September 3, 2026, announced September 11. The customer had switched off commercial notifications in the BBVA app; at least ten more arrived between October 2025 and May 2026.
On September 10, 2026, California enacted SB 1119 (Chapter 190). From July 1, 2027, a companion chatbot open to users under 18 must ship with parent-only default settings, may not show children cross-context behavioral ads or sell a child's chatbot data. Penalties reach $15,000 per affected child.
On September 10, 2026, California signed AB 1856, AB 1709 and AB 2246. From January 1, 2027, a developer that requests and receives the age bracket signal is deemed to know the user's age range. A state table, the Apple and Google APIs, and what a binary and a traffic capture can show.
On September 9, 2026, the FTC rescinded its 2021 policy statement on breaches by health apps, stating that the 2024 amendments to the Health Breach Notification Rule, 16 CFR Part 318, superseded it. The amended rule text names mobile apps and counts an unauthorized disclosure as a breach.
On September 8, 2026, Connecticut Attorney General William Tong announced an investigation into MediaLab.AI Inc., owner of Kik, under the CTDPA and CUTPA. It follows a July 2025 notice of violation that, per the AG, cited sensitive data, including precise geolocation, processed without consent.
On September 2, 2026, Delaware Governor Matt Meyer signed HB 380, amending the Delaware Personal Data Privacy Act from January 1, 2027. The law will apply at 10,000 consumers, and a sale of sensitive data must be "strictly necessary" to a product or service the consumer requested.
On 2026-08-28 the court denied Google's Rule 50(b) motion in Rodriguez v. Google, No. 3:20-cv-04688-RS, leaving the $425,651,947 verdict over app data collected through the Firebase and Google Mobile Ads SDKs from users with Web & App Activity off. Google appealed on 2026-09-21.
On August 27, 2026, the FTC announced final orders against Cox Media Group, MindSift and 1010 Digital Works over the "Active Listening" ad service. The complaints allege the service used no voice data and resold email lists. The three firms pay $930,000 in total.
Brazil's data protection authority, the ANPD, fined ByteDance Brasil Tecnologia Ltda. BRL 153,769,671.33 for five conducts involving children's and teenagers' data in TikTok's logged-out and logged-in feeds, in Despacho Decisório nº 27/2026/CGS/SFI, signed August 24 and published August 25, 2026.
Governor Mikie Sherrill signed the New Jersey Kids Code Act (A4015/S3413) on August 11, 2026, as P.L.2026, c.73. It takes effect September 1, 2027. A covered child or minor, a parent or the Attorney General can sue, and a court may award $5,000 per violation or treble damages, whichever is greater.
On August 4, 2026, EFF named four Android ad SDKs that share location by default once an app has location permission. EFF's published capture shows precise coordinates sent to api.bidmachine.io from QR Scanner and GPS Speedometer; on Oct. 2, neither app's Play Data safety section listed location.
I monitored device setup flow, scanning the room, the map, AI features, voice commands on both the vacuum cleaner and on the iOS app. The product respects user privacy better than most but it could have been better. Default dangerous features are off with a consent screen for each.
EU AI Act Article 50 applies from August 2, 2026. A chatbot, AI companion or AI agent in the EU must tell each user at the first interaction that it is an AI unless that is obvious, and generative AI outputs must carry a machine-readable mark. Commission guidelines of July 20 set out what counts.
Since August 1, 2026, California Civil Code § 1798.99.86(c) requires every data broker to access the Delete Request and Opt-out Platform (DROP) at least once every 45 days and process deletion requests within 45 days. The fine is $200 per deletion request per day.
On July 29, 2026, the FTC, Utah and Los Angeles County sued Hims & Hers Health, Inc., No. 3:26-cv-07871 (N.D. Cal.). The complaint alleges Hims shared customers' health information with Meta and Snap through uploaded email lists and Meta Pixel and Conversions API events until at least May 2024.
I decompiled the Google Play “Trump Accounts” app, listed under U.S. Department of the Treasury. It's a Robinhood wrapper compiled as an internal “Golden Eagle” flavor.
I decompiled the Temu app on both platforms. On Android it erases all ten of its own native libraries from the file security scanners read, rewrites its own Java methods under a server flag, and seals its telemetry with a home-grown cipher that has no extractable key.
On July 24, 2026, the Fifth Circuit (No. 24-50721) affirmed the injunction against the Texas SCOPE Act's monitoring and filtering duty on Section 230 grounds and vacated the injunction on the targeted ads, unlawful ads and age-verification duties for lack of standing or as foreclosed.
On July 22, 2026, Korea's PIPC fined Tiktok Pte. Ltd. KRW 10,306,000,000 with corrective and publication orders, finding that TikTok collected third-party behavioral data through TikTok Pixel, the Events SDK and the Events API from 9.45 million Korean users without a lawful basis.
On July 15, 2026, Meta moved to dismiss the amended complaint in In re Meta Android Privacy Litigation, No. 3:25-cv-04674-RFL, the class action over the Pixel sending the _fbp cookie to localhost ports opened by the Facebook and Instagram Android apps. Google answered the same day.
Italy's Garante fined Character Technologies, Inc. €158,000 in a decision of July 3, 2026, announced July 9. It found five GDPR infringements, including age verification failures from April 2024 to April 2025, and ordered fixes to the age gate, cooling-off period and minors' default profiles.
On June 25, 2026, a federal court entered the Kochava FTC settlement. Kochava and its subsidiary CDS may sell or disclose sensitive location data only with a direct relationship with the consumer, affirmative express consent, and a service the consumer requested. The order contains no money payment.
From April 22, 2026, operators must comply with the FTC's amended COPPA Rule (16 CFR Part 312). It adds separate parental consent for disclosures to third parties, biometric and government-issued identifiers, a mixed audience definition, and written security and retention programs.
On April 9, 2026, Microsoft detailed an intent redirection flaw in the EngageLab Android SDK: the exported MTCommonActivity let another app on the same phone obtain read and write access to the host app's private files. Wallet apps with the SDK had over 30 million installs. Version 5.2.1 fixes it.