A new report from ad evaluation firm Adalytics finds that some of YouTube’s targeted ads are still slipping through the cracks, and potentially violating federal child privacy law. The revelation has prompted two US Senators to write a letter to the FTC.
Data Protection
Certain types of personal data are very valuable to criminals, and can be very damaging to an individual or business if it falls into the wrong hands. As the world becomes more digital and more connected, more of this sort of data is generated and passed between various sources on a regular basis.
Government regulations and supervisory authorities aren’t just about keeping irresponsible parties in line. They also provide vital security guidance to every type of organization that handles sensitive personal, business or government information.
Data protection regulations also ensure that the end user has a transparent view of and a say in the processing of personal data. These safeguards play a significant role in everything from the preservation of civil rights to ensuring that democratic institutions function properly.
Some types of personal data are clear candidates for regulation: medical records, banking information, national ID numbers and so on. But some of these regulations also cover items that might seem relatively innocuous at first glance: home addresses, email addresses, website profile information and so on. For example, the European Union General Data Protection Regulation (GDPR) has stipulations about anything that is unique to an individual to include phone numbers and social media accounts. People have varying levels of privacy preference with these items, but they are often protected by regulation because they can be used for targeted scams and attempts at identity theft.
Given that regulations often take the size and customer count of businesses into consideration in terms of penalties and the scope of protection of personal data, compliance is particularly important for enterprise-scale organizations. You do not necessarily have to have an active business presence in a country or region; simply storing data on or moving it through servers there may subject you to their data protection rules.
US consumer finance watchdog appears to have data brokers in its crosshairs, announcing that it is developing a new rules proposal for the industry. CFPB specifically noted a focus on the impact of AI and announced that an outline of proposals will be released sometime in September.
Copying of protected works is generally a no-no. But, training of AI tools such as ChatGPT requires copying enormous amounts of data. The two positions appear potentially irreconcilable. This is where the “text and data mining” (TDM) exception to copyright and database rights comes in.
Google's bid to get rid of a class action lawsuit involving its "Incognito Mode" took a serious blow in a California court, as a judge denied the company's request for a summary judgment and said that the consumer privacy concerns raised by the company's data handling were fit for trial.
A recent airport ban seems to have prompted a Weibo post by the company offering reassurances on its data security. The post reiterated that Tesla staff cannot access customer video remotely.
Any business in China with more than one million records of personal data, or those with just 10,000 records of sensitive personal data, are looking at new annual compliance audit requirements by the Cyberspace Administration of China (CAC).
With fines and penalties (such as potential shutdown of company operations) looming in November of this year, some companies are opting to bail out of China rather than even attempt to comply with the slew of new data regulations.
China’s new rules for facial recognition technology require companies to protect personal information, and to demonstrate a "specific purpose" and "sufficient necessity" when collecting biometric data of this nature.
Since the GDPR went into effect in 2018, Meta has done nearly everything possible to claim legitimate interest to avoid user consent for collecting personal information for targeted ads. The company appears to have finally reached the end of its rope in this area, though a recently announced changeover to a consent basis.
Under the new terms of the California Privacy Rights Act (CPRA), the California Privacy Protection Agency (CPPA) will be examining a broad range of data collected by car manufacturers, including what the vehicle cameras capture and what is passing through their apps.