What app code collects, and where a capture shows it is sent.
Since October 1, 2026, Maryland HB 895 (Chapter 154 of 2026) bars food retailers of 15,000+ square feet and third-party delivery service providers from using a consumer's personal data to set a higher price for tax-exempt food. The Consumer Protection Division enforces it after a 45-day cure.
In Frasco v. Flo Health, No. 3:21-cv-00757-JD, plaintiffs moved on 2026-09-14 for a $1,110,575,000 judgment against Meta for 222,115 California Flo users they say they have identified, $5,000 each under CIPA. Meta opposed on 2026-09-28. Hearing 2026-10-29.
California AB 2561, Chapter 478 of 2026, bars an operating system or app from undoing a user's affirmative configuration of a privacy setting without the user's consent, from January 1, 2027. The text names no penalty or enforcer; the rule requiring the most protective default was cut in April.
On September 24, 2026, UpGuard reported 16,326 Supabase databases exposing readable tables, among about 300,000 websites with Supabase indicators in their JavaScript. Over half had indicators of personal data. The sample is websites; Supabase mobile apps contain the same kind of URL and key.
On September 24, 2026, Judge George H. Wu denied TikTok and ByteDance's motion to dismiss the under-13 privacy class action (MDL No. 3144) up to August 22, 2022. The pleadings do not show the plaintiffs were members of the 2019 T.K. or 2020 Privacy MDL settlement classes.
On September 21, 2026 Ireland's Data Protection Commission fined Google Ireland €403 million under GDPR Articles 5, 6, 12 and 13 over location data in Web & App Activity, Location History and Location Accuracy from May 25, 2018 to February 4, 2020, and ordered compliance within six months.
The $400 million TikTok COPPA settlement ties its last $100 million to vacating the 2019 Musical.ly consent order. On September 21, 2026, Judge George H. Wu denied the government's motion to vacate without prejudice, so the 2019 order and its records duties through 2029 remain in force.
Apple's iOS 27 security notes, released September 14, 2026, list 126 CVE IDs. Fourteen entries describe an app obtaining persistent identifiers, fingerprinting signals, the list of installed apps, location from system logs, cross-app tracking or Privacy preferences. iOS 26.7 fixes seven of them.
Italy's Garante fined Banco Bilbao Vizcaya Argentaria's Italian branch €5,508,000 in a decision of September 3, 2026, announced September 11. The customer had switched off commercial notifications in the BBVA app; at least ten more arrived between October 2025 and May 2026.
On September 9, 2026, the FTC rescinded its 2021 policy statement on breaches by health apps, stating that the 2024 amendments to the Health Breach Notification Rule, 16 CFR Part 318, superseded it. The amended rule text names mobile apps and counts an unauthorized disclosure as a breach.
On September 2, 2026, Delaware Governor Matt Meyer signed HB 380, amending the Delaware Personal Data Privacy Act from January 1, 2027. The law will apply at 10,000 consumers, and a sale of sensitive data must be "strictly necessary" to a product or service the consumer requested.
On 2026-08-28 the court denied Google's Rule 50(b) motion in Rodriguez v. Google, No. 3:20-cv-04688-RS, leaving the $425,651,947 verdict over app data collected through the Firebase and Google Mobile Ads SDKs from users with Web & App Activity off. Google appealed on 2026-09-21.
On August 27, 2026, the FTC announced final orders against Cox Media Group, MindSift and 1010 Digital Works over the "Active Listening" ad service. The complaints allege the service used no voice data and resold email lists. The three firms pay $930,000 in total.
Brazil's data protection authority, the ANPD, fined ByteDance Brasil Tecnologia Ltda. BRL 153,769,671.33 for five conducts involving children's and teenagers' data in TikTok's logged-out and logged-in feeds, in Despacho Decisório nº 27/2026/CGS/SFI, signed August 24 and published August 25, 2026.
Governor Mikie Sherrill signed the New Jersey Kids Code Act (A4015/S3413) on August 11, 2026, as P.L.2026, c.73. It takes effect September 1, 2027. A covered child or minor, a parent or the Attorney General can sue, and a court may award $5,000 per violation or treble damages, whichever is greater.
I monitored device setup flow, scanning the room, the map, AI features, voice commands on both the vacuum cleaner and on the iOS app. The product respects user privacy better than most but it could have been better. Default dangerous features are off with a consent screen for each.
EU AI Act Article 50 applies from August 2, 2026. A chatbot, AI companion or AI agent in the EU must tell each user at the first interaction that it is an AI unless that is obvious, and generative AI outputs must carry a machine-readable mark. Commission guidelines of July 20 set out what counts.
Since August 1, 2026, California Civil Code § 1798.99.86(c) requires every data broker to access the Delete Request and Opt-out Platform (DROP) at least once every 45 days and process deletion requests within 45 days. The fine is $200 per deletion request per day.
On July 29, 2026, the FTC, Utah and Los Angeles County sued Hims & Hers Health, Inc., No. 3:26-cv-07871 (N.D. Cal.). The complaint alleges Hims shared customers' health information with Meta and Snap through uploaded email lists and Meta Pixel and Conversions API events until at least May 2024.
I decompiled the Google Play “Trump Accounts” app, listed under U.S. Department of the Treasury. It's a Robinhood wrapper compiled as an internal “Golden Eagle” flavor.
I decompiled the Temu app on both platforms. On Android it erases all ten of its own native libraries from the file security scanners read, rewrites its own Java methods under a server flag, and seals its telemetry with a home-grown cipher that has no extractable key.
On July 24, 2026, the Fifth Circuit (No. 24-50721) affirmed the injunction against the Texas SCOPE Act's monitoring and filtering duty on Section 230 grounds and vacated the injunction on the targeted ads, unlawful ads and age-verification duties for lack of standing or as foreclosed.
On July 22, 2026, Korea's PIPC fined Tiktok Pte. Ltd. KRW 10,306,000,000 with corrective and publication orders, finding that TikTok collected third-party behavioral data through TikTok Pixel, the Events SDK and the Events API from 9.45 million Korean users without a lawful basis.
On July 15, 2026, Meta moved to dismiss the amended complaint in In re Meta Android Privacy Litigation, No. 3:25-cv-04674-RFL, the class action over the Pixel sending the _fbp cookie to localhost ports opened by the Facebook and Instagram Android apps. Google answered the same day.
On June 25, 2026, a federal court entered the Kochava FTC settlement. Kochava and its subsidiary CDS may sell or disclose sensitive location data only with a direct relationship with the consumer, affirmative express consent, and a service the consumer requested. The order contains no money payment.