Get tomorrow's brief in your inbox
Today: Ireland's Data Protection Commission fined Google €403 million ($462 million) for illegal location data processing spanning 2018-2020. Federal courts approved a $275 million antitrust settlement against Sandoz and Fougera for generic drug price-fixing and a $2.8 million data breach settlement for FinWise Bank. President Trump banned CNN, MS NOW (MSNBC), and Politico from the White House, prompting First Amendment challenges based on precedent from his first term.
Ireland DPC Fines Google €403 Million for Location Data Violations
Ireland's Data Protection Commission concluded a six-year GDPR investigation into Google's location data processing practices, imposing a €403 million ($462 million) fine. The inquiry examined Google's handling of location data in Web and App Activity, Location History, and Location Accuracy features from May 2018 through February 2020. DPC Deputy Commissioner Graham Doyle emphasized that location data "can reveal a significant amount of information about an individual, including information that is inherently private." The Commission found Google violated GDPR transparency, accountability, and lawfulness requirements, preventing users from understanding how their location data influenced advertising and interest profiling. Google must bring its processing into compliance within six months.
Trump Administration Bans Three News Organizations from White House
President Trump announced via Truth Social that CNN, MS NOW (formerly MSNBC), and Politico are banned from White House grounds, effective immediately. The ban was confirmed when reporters from all three organizations were denied access on Saturday. Trump cited "constant reporting FAKE NEWS" as justification and claimed Politico received $8 million in federal subscriptions under the Biden administration. The ban violates established First Amendment precedent from Trump's first term, when courts ruled against similar press exclusions. Legal challenges are expected.
$275 Million Sandoz and Fougera Antitrust Settlement Approved
Sandoz Inc. and Fougera Pharmaceuticals Inc. agreed to a $275 million class action settlement resolving claims they conspired to raise and fix generic drug prices. The settlement covers purchasers of affected generic pharmaceuticals during the class period. The settlement agreement has been finalized by the court.
$2.8 Million FinWise Bank Data Breach Settlement
FinWise Bank agreed to a $2.8 million class action settlement over a data breach. Class members must submit claims by October 29, 2026, to receive payments for documented losses. The settlement covers individuals whose personal information was compromised in the breach.
LinkedIn Wins Injunction Against Mass Data Scraping
A California federal court finalized an agreement between LinkedIn, ProAPIs, and Netswift requiring the firms to cease scraping LinkedIn user data, stop selling scraped data, delete existing scraped data, and abandon the use of fake accounts for scraping. LinkedIn's October 2025 complaint alleged the companies created millions of bogus accounts that scraped member, company, and school information plus user reactions and posts. ProAPIs posted a statement confirming it "does not offer tools to scrape LinkedIn" and will never scrape the platform in the future.
LA Fitness Faces TCPA Class Action Over Unwanted Marketing Texts
A new class action lawsuit alleges LA Fitness sent unwanted marketing text messages to consumers who had opted out of receiving them, violating the Telephone Consumer Protection Act. The lawsuit seeks damages and injunctive relief.
FAA Drone Flight Restriction Challenged on First Amendment Grounds (Levine v. FAA)
The D.C. Circuit is reviewing a challenge to an FAA drone flight restriction that effectively criminalized recording DHS officers, including ICE and CBP agents, even from half a mile away. The FAA rescinded the restriction in April after a March lawsuit, but the petitioner argues the court should still evaluate its legality because drone pilots could be punished for past violations and the FAA could reinstate the restriction at any time. An amicus brief from EFF, ACLU, National Press Photographers Association, and others argues that using drones to record law enforcement is First Amendment-protected information-gathering activity. The restriction appeared to be a content-based speech restriction subject to strict scrutiny, issued specifically to prevent accountability for immigration enforcement actions.
Amazon Ring Introduces "Throw Away the Key Encryption" (TAKE) - Privacy Concerns Remain
Amazon launched TAKE for Ring cameras, a new encryption approach where user devices hold keys temporarily, Ring's cloud receives keys for 24 hours to process features like smart alerts and video search, then deletes the key. The system improves on Ring's current default (where Ring always has access to footage) but falls short of true end-to-end encryption. Ring retains access to unencrypted video for 24-hour windows, video descriptions remain available to the company, and account recovery keys stored in cameras combined with searchable video indices mean law enforcement could still request mass searches across cameras, then seize specific cameras to decrypt footage. EFF analysis concludes TAKE provides minimal privacy improvement over encryption-at-rest with server-held keys.
Flock ALPR Camera Analysis Reveals Person Detection Capabilities
Security researchers who captured and analyzed a Flock automatic license plate reader camera discovered the software explicitly detects people, vehicles, license plates, and bicycles - not just vehicles. The camera generated more than a million images over several weeks of logs and isolated bumper stickers and graphics. Researchers found disk encryption keys stored unencrypted on a separate partition, indicating poor security engineering.
EU Proposes Kids Act with Age Gates and Mandatory Age Verification
The European Commission drafted legislation restricting youth access to social media, video games, and AI systems through phased age-based access controls: no accounts under 13, restricted accounts with parental supervision ages 13-15, and safe-by-design autonomous accounts ages 15-18. The proposal relies on EU age verification schemes and requires parents to prove their parental relationship, adding verification layers. EFF warns the law will undermine civil liberties, reduce safety, create barriers to internet entry for marginalized groups, and entrench big tech power. The law covers virtually all mainstream social media and video-sharing platforms. Small and medium enterprises receive no exemptions, favoring large companies with resources for compliance. A French court declared blanket social media bans unconstitutional in August.
California AG Settles Paramount-Larry Ellison Merger Antitrust Case
California Attorney General Rob Bonta settled the 12-state antitrust lawsuit against the $111 billion Paramount-Larry Ellison merger after pressure from Governor Gavin Newsom and threats from Paramount owner David Ellison to move the studio out of California. The settlement includes a board to oversee CNN editorial independence and language requiring 30 traditional studio releases annually. The settlement does not require asset sales or labor protections. Bonta previously demanded structural remedies but capitulated to behavioral conditions that watchdog groups like Free Press called "largely unenforceable" and providing less than the standalone companies already do. Consumer advocates warn the deal will lead to mass layoffs, higher prices, and lower quality content as Paramount forces labor and consumers to pay down the debt load.
GDPR Location Data Review: Audit mobile app location data collection for GDPR compliance. Ensure transparency disclosures explain how location data is used for advertising or profiling. Implement retention limits. Google's €403 million fine demonstrates regulators will penalize opacity in location tracking.
Data Breach Settlement Claims: FinWise Bank customers must file claims by October 29, 2026. Gather documentation of losses including credit monitoring costs, fraudulent charges, and remediation time.
TCPA Compliance for Marketing Texts: Review opt-out mechanisms for SMS marketing campaigns. Ensure automated systems honor opt-out requests immediately. LA Fitness lawsuit highlights enforcement risk for continued texting after opt-outs.
Scraping and CFAA Compliance: Data aggregation firms should cease scraping operations that use fake accounts or violate platform terms of service. LinkedIn's court victory establishes precedent for injunctive relief against mass scraping.
EU Age Verification Preparation: Social media and gaming platforms serving EU users should begin compliance planning for proposed age gates, parental consent flows, and age verification integration. Final legislation expected within 12 months.