In Frasco v. Flo Health, No. 3:21-cv-00757-JD, plaintiffs moved on 2026-09-14 for a $1,110,575,000 judgment against Meta for 222,115 California Flo users they say they have identified, $5,000 each under CIPA. Meta opposed on 2026-09-28. Hearing 2026-10-29.
On September 24, 2026, Judge George H. Wu denied TikTok and ByteDance's motion to dismiss the under-13 privacy class action (MDL No. 3144) up to August 22, 2022. The pleadings do not show the plaintiffs were members of the 2019 T.K. or 2020 Privacy MDL settlement classes.
On September 21, 2026 Ireland's Data Protection Commission fined Google Ireland €403 million under GDPR Articles 5, 6, 12 and 13 over location data in Web & App Activity, Location History and Location Accuracy from May 25, 2018 to February 4, 2020, and ordered compliance within six months.
The $400 million TikTok COPPA settlement ties its last $100 million to vacating the 2019 Musical.ly consent order. On September 21, 2026, Judge George H. Wu denied the government's motion to vacate without prejudice, so the 2019 order and its records duties through 2029 remain in force.
Italy's Garante fined Banco Bilbao Vizcaya Argentaria's Italian branch €5,508,000 in a decision of September 3, 2026, announced September 11. The customer had switched off commercial notifications in the BBVA app; at least ten more arrived between October 2025 and May 2026.
On September 9, 2026, the FTC rescinded its 2021 policy statement on breaches by health apps, stating that the 2024 amendments to the Health Breach Notification Rule, 16 CFR Part 318, superseded it. The amended rule text names mobile apps and counts an unauthorized disclosure as a breach.
On September 8, 2026, Connecticut Attorney General William Tong announced an investigation into MediaLab.AI Inc., owner of Kik, under the CTDPA and CUTPA. It follows a July 2025 notice of violation that, per the AG, cited sensitive data, including precise geolocation, processed without consent.
On 2026-08-28 the court denied Google's Rule 50(b) motion in Rodriguez v. Google, No. 3:20-cv-04688-RS, leaving the $425,651,947 verdict over app data collected through the Firebase and Google Mobile Ads SDKs from users with Web & App Activity off. Google appealed on 2026-09-21.
On August 27, 2026, the FTC announced final orders against Cox Media Group, MindSift and 1010 Digital Works over the "Active Listening" ad service. The complaints allege the service used no voice data and resold email lists. The three firms pay $930,000 in total.
Brazil's data protection authority, the ANPD, fined ByteDance Brasil Tecnologia Ltda. BRL 153,769,671.33 for five conducts involving children's and teenagers' data in TikTok's logged-out and logged-in feeds, in Despacho Decisório nº 27/2026/CGS/SFI, signed August 24 and published August 25, 2026.
On July 29, 2026, the FTC, Utah and Los Angeles County sued Hims & Hers Health, Inc., No. 3:26-cv-07871 (N.D. Cal.). The complaint alleges Hims shared customers' health information with Meta and Snap through uploaded email lists and Meta Pixel and Conversions API events until at least May 2024.
On July 24, 2026, the Fifth Circuit (No. 24-50721) affirmed the injunction against the Texas SCOPE Act's monitoring and filtering duty on Section 230 grounds and vacated the injunction on the targeted ads, unlawful ads and age-verification duties for lack of standing or as foreclosed.
On July 22, 2026, Korea's PIPC fined Tiktok Pte. Ltd. KRW 10,306,000,000 with corrective and publication orders, finding that TikTok collected third-party behavioral data through TikTok Pixel, the Events SDK and the Events API from 9.45 million Korean users without a lawful basis.
On July 15, 2026, Meta moved to dismiss the amended complaint in In re Meta Android Privacy Litigation, No. 3:25-cv-04674-RFL, the class action over the Pixel sending the _fbp cookie to localhost ports opened by the Facebook and Instagram Android apps. Google answered the same day.
Italy's Garante fined Character Technologies, Inc. €158,000 in a decision of July 3, 2026, announced July 9. It found five GDPR infringements, including age verification failures from April 2024 to April 2025, and ordered fixes to the age gate, cooling-off period and minors' default profiles.
On June 25, 2026, a federal court entered the Kochava FTC settlement. Kochava and its subsidiary CDS may sell or disclose sensitive location data only with a direct relationship with the consumer, affirmative express consent, and a service the consumer requested. The order contains no money payment.