Apple's Declared Age Range API returns an age range, a declaration type and parental-control flags to an iPhone app, inside the app process. Apple keeps the birthday. Apple has applied it to new Texas accounts since June 4, 2026; California deems a developer to know the range from January 1, 2027.
Google Play's Age Signals API gives an Android app the user's age range and how it was established, never the birthdate. It returns signals in Brazil and Texas; Google announced a global expansion on July 29, 2026. The call, the four tiers, spoofing, SDK access, and what a scan and a capture show.
Since October 1, 2026, Connecticut SB 4 (Public Act 26-64) provides: "No controller shall sell any consumer's precise geolocation data" and "No third party shall sell any consumer's precise geolocation data." The ban has no consent clause. The Attorney General enforces it under CUTPA.
California SB 690, Chapter 976, makes § 638.51 pen register claims over websites, online applications and mobile applications an Attorney General action from 2027-01-01, and applies to pending claims filed in the prior two years. Sections 631 and 632 keep their private right of action.
In Frasco v. Flo Health, No. 3:21-cv-00757-JD, plaintiffs moved on 2026-09-14 for a $1,110,575,000 judgment against Meta for 222,115 California Flo users they say they have identified, $5,000 each under CIPA. Meta opposed on 2026-09-28. Hearing 2026-10-29.
On September 10, 2026, California enacted SB 1119 (Chapter 190). From July 1, 2027, a companion chatbot open to users under 18 must ship with parent-only default settings, may not show children cross-context behavioral ads or sell a child's chatbot data. Penalties reach $15,000 per affected child.
On September 10, 2026, California signed AB 1856, AB 1709 and AB 2246. From January 1, 2027, a developer that requests and receives the age bracket signal is deemed to know the user's age range. A state table, the Apple and Google APIs, and what a binary and a traffic capture can show.
On September 9, 2026, the FTC rescinded its 2021 policy statement on breaches by health apps, stating that the 2024 amendments to the Health Breach Notification Rule, 16 CFR Part 318, superseded it. The amended rule text names mobile apps and counts an unauthorized disclosure as a breach.
On 2026-08-28 the court denied Google's Rule 50(b) motion in Rodriguez v. Google, No. 3:20-cv-04688-RS, leaving the $425,651,947 verdict over app data collected through the Firebase and Google Mobile Ads SDKs from users with Web & App Activity off. Google appealed on 2026-09-21.
On August 4, 2026, EFF named four Android ad SDKs that share location by default once an app has location permission. EFF's published capture shows precise coordinates sent to api.bidmachine.io from QR Scanner and GPS Speedometer; on Oct. 2, neither app's Play Data safety section listed location.
Since August 1, 2026, California Civil Code § 1798.99.86(c) requires every data broker to access the Delete Request and Opt-out Platform (DROP) at least once every 45 days and process deletion requests within 45 days. The fine is $200 per deletion request per day.
On July 29, 2026, the FTC, Utah and Los Angeles County sued Hims & Hers Health, Inc., No. 3:26-cv-07871 (N.D. Cal.). The complaint alleges Hims shared customers' health information with Meta and Snap through uploaded email lists and Meta Pixel and Conversions API events until at least May 2024.
On July 22, 2026, Korea's PIPC fined Tiktok Pte. Ltd. KRW 10,306,000,000 with corrective and publication orders, finding that TikTok collected third-party behavioral data through TikTok Pixel, the Events SDK and the Events API from 9.45 million Korean users without a lawful basis.
On July 15, 2026, Meta moved to dismiss the amended complaint in In re Meta Android Privacy Litigation, No. 3:25-cv-04674-RFL, the class action over the Pixel sending the _fbp cookie to localhost ports opened by the Facebook and Instagram Android apps. Google answered the same day.
On June 25, 2026, a federal court entered the Kochava FTC settlement. Kochava and its subsidiary CDS may sell or disclose sensitive location data only with a direct relationship with the consumer, affirmative express consent, and a service the consumer requested. The order contains no money payment.
From April 22, 2026, operators must comply with the FTC's amended COPPA Rule (16 CFR Part 312). It adds separate parental consent for disclosures to third parties, biometric and government-issued identifiers, a mixed audience definition, and written security and retention programs.
On April 9, 2026, Microsoft detailed an intent redirection flaw in the EngageLab Android SDK: the exported MTCommonActivity let another app on the same phone obtain read and write access to the host app's private files. Wallet apps with the SDK had over 30 million installs. Version 5.2.1 fixes it.