United Kingdom
TikTok drops appeals and accepts £12.7m ICO fine over children’s privacy action
- TikTok has withdrawn its appeal against a £12.7m fine issued by the ICO in 2023, making the penalty final, after the Upper Tribunal rejected TikTok’s argument in August that its data processing was for artistic purposes.
- The 2023 penalty related to multiple data protection breaches, including TikTok’s failure to prevent an estimated 1.75 million UK children under 13 from using its platform in 2020, inadequate checks to identify and remove underage users, failure to provide clear information about data collection and use, and failure to obtain parental consent despite awareness that under 13s were accessing the service.
- TikTok has also dropped its separate appeal against an ICO information notice relating to an ongoing investigation into how the platform uses children’s personal data in its recommender systems.
- The outcome represents a significant enforcement milestone for the ICO, which estimates its work on children’s data protection has helped protect close to five million child users.
UK Crown dependencies’ regulators warn about smart glasses’ risks
- The data protection authorities of the Isle of Man, Jersey and Guernsey have issued a joint warning about the significant privacy risks posed by smart glasses, highlighting that the technology’s discreet, wearable nature makes it capable of capturing conversations and personal information without the knowledge or consent of those being recorded.
- The regulators emphasise that users must be transparent about their use of the technology and consider carefully when recording is appropriate, and that individuals have statutory rights under data protection law to challenge users who fail to be upfront about recording activity.
- A particular safeguarding concern is raised around gender: the Isle of Man Information Commissioner explicitly highlighted that women and girls are disproportionately the victims of non-consensual filming, warning that smart glasses make secret recording easy and that footage can rapidly be shared with entities beyond local jurisdiction.
Debenhams scrutinised by the ICO over unlawful email marketing and unsubscribe process
- The ICO has received multiple complaints about Debenhams’ inability to respect unsubscribe requests, with consumers reporting that opting out of its mailing lists requires unchecking up to 94 separate boxes across 15 brands, and that emails continue to arrive even after completing that process.
- The complaints focus on Debenhams’ transition to an e-commerce platform model following its 2021 acquisition by Boohoo, with consumers expressing concern that its web of third-party sellers makes it difficult to understand how their personal data is being shared and used.
- The ICO has the power to impose fines or order changes in practice where GDPR breaches are established, and has confirmed it is monitoring complaint trends to identify areas of concern, but Debenhams has stated it has not been directly contacted by the regulator and believes it adheres to data protection requirements.
United States
Meta releases new Muse AI charm despite growing privacy concerns over smart accessories
- Meta has released a Muse Charm, which is a small, wearable Tamagotchi-style device with a mini screen and built-in 5G designed to give users constant, hands-free access to its Muse AI agent.
- The device raises significant data protection concerns: Muse is designed to autonomously manage appointments, write emails, file taxes and make purchases on users’ behalf, meaning a persistent, always-on connection to deeply personal data is central to its core proposition. The 5G modem further enables data transmission independent of home networks and without unlocking a phone.
- Meta is targeting younger consumers, particularly Gen Z, who are more likely to treat AI agents as companions rather than tools. That said, it remains uncertain whether the device can achieve mainstream adoption: similar AI gadgets such as the Rabbit R1 failed after overpromising on functionality, and analysts warn that the Muse Charm risks becoming a niche product for early adopters unless it can offer capabilities that smartphones, smartwatches and smart glasses cannot already provide.
FBI staff data breach claimed by ShinyHunters group
- The FBI is investigating a claim by hacking group ShinyHunters that it has stolen personal data on approximately 38,000 staff including names, roles, badge numbers, home addresses, phone numbers and spousal information, as well as details of sensitive operations targeting Chinese, Russian and drug cartel targets.
- The breach allegedly exploited a vulnerability in Oracle cloud storage infrastructure, compromising multiple FBI systems including its jobs portal, employee background check system, medical records platform and investigation information database.
- ShinyHunters has orchestrated the attack as retaliation for an FBI advisory characterising the group as extortionists, demanding the FBI retract the statement within one week or face publication of the full stolen databases.
- Cybersecurity experts have described the incident as potentially one of the most serious law enforcement data breaches on record, with the personal details of thousands of agents, creating high physical safety risks and long-term counterintelligence vulnerabilities.
Europe
Google fined €403m by Irish data protection authority for unlawful location data processing
- Ireland’s Data Protection Commission has fined Google €403m following a six-year inquiry into its handling of location data across three features (web & app activity, location history and location accuracy), after finding that Google processed personal data in a manner that was neither lawful, fair nor transparent, in breach of GDPR requirements.
- The investigation focused on a period between May 2018 and February 2020, during which users may have been unaware that their location data was being used to target them with advertising or infer their interests. The DPC also further discovered that Google retained location data for longer than necessary.
- Beyond the financial penalty, Google has been ordered to bring its data processing practices into compliance within six months, which may require structural changes to how location data is collected, used and retained across its products, with ongoing regulatory scrutiny likely to follow.
- Google has pointed to changes made since 2019, including auto-delete controls, simplified ads management and improved transparency around location data practices, but the ruling demonstrates that historical non-compliance carries significant financial and reputational consequences under GDPR, regardless of subsequent improvements.
European Commission formally proposes EU KIDS Act
- The European Commission has formally proposed the EU KIDS Act, introducing a blanket ban on under 13s creating social media accounts, supervised-only access for 13 to 14 year olds through parental accounts, and full account access from age 15.
- The regulation shifts the burden of proof onto Very Large Online Platforms, requiring them to demonstrate safety-by-design principles, submit compliance plans, undergo independent audits and eliminate features including addictive design, profiling-based recommendation feeds, infinite scrolling, push notifications during sleeping hours and unsolicited contact by strangers; with penalties of up to 6% of global annual revenue for violations.
- Privacy-preserving age assurance is central to the proposal, with platforms able to integrate with the Commission’s upcoming EU Age Verification Solution, although privacy advocates and industry groups have raised serious concerns that collecting age and identity data at scale, and linking children to parental accounts, would itself create significant data protection risks and an attractive target for cybercriminals.
- Critics also point to evidence from Australia that hard age bans may be less effective in practice than intended, with teenagers finding workarounds relatively easily.
International
Google and Meta to report child abuse material directly to Indian authorities
- Google has agreed to report child sexual abuse material directly to Indian authorities, following a similar commitment by Meta the previous week, marking a significant departure from the established global practice of routing such reports through the US-based National Center for Missing and Exploited Children before they reach domestic law enforcement.
- The shift follows direct pressure from the Indian government, which argued that the intermediary model causes dangerous delays in cases where a child may be in active danger.
- The change raises important questions about the fragmentation of child protection reporting frameworks: while the existing centralised model through the US non-profit provides consistency and a global clearing house, direct national reporting arrangements risk creating an inconsistent patchwork of obligations that may be harder to monitor and audit across jurisdictions.
Rogue OpenAI agent breaches Australian government website
- A rogue OpenAI agent autonomously infiltrated an Australian government statistics portal in June containing Medicare data, with OpenAI only discovering the breach in August during a review of “misaligned model activity”, and not notifying Australian authorities until 10 September.
- The breach affected the Medicare Statistics Reporting Service portal, with three additional government systems potentially also compromised, though no personal data is currently believed to have been accessed. That said, the significance of this incident lies in an AI agent taking unauthorised actions against government infrastructure on its own without human instruction.
- OpenAI’s delayed disclosure has drawn particular criticism, with Australian Prime Minister warning of legal consequences and experts highlighting that the incident exposes a critical gap in AI governance frameworks around mandatory breach notification obligations for AI developers.
For the latest updates on TikTok ICO fine over children’s privacy action, smart glasses privacy risks, other major data privacy news, visit out Data Protection News Hub.
