INTERNATIONAL 

11. AI Safety Law introduced^[11]

California has passed the Transparency in Frontier Artificial Intelligence Act, 2025 (“Act”), establishing the first state-level framework for advanced AI systems. The Act requires major AI developers to publish safety frameworks, report critical incidents such as large-scale data leaks, unauthorized model access, or use of AI in weapon development and safeguard whistle-blowers. Rather than imposing rigid technical controls, it promotes a transparency-based approach, focusing on risk reporting and accountability.  The Act also allows alignment with future U.S. federal AI standards to avoid overlapping compliance burdens, positioning California as a model for state-level AI governance in the absence of national legislation.

The Act positions California as a pioneer in AI governance, creating a blueprint for state-level oversight in the absence of comprehensive federal regulation. By focusing on transparency and incident reporting, the Act sets a precedent for responsible AI development while maintaining flexibility for future alignment with national standards.

12. Build-In Browsers Control for Online Privacy made Mandatory^[12]

California has enacted the Opt Me Out Act (AB 566, Lowenthal) (“Act”), a landmark legislation requiring all web browsers operating in the state to include a built-in privacy control that allows users to automatically signal their preference not to have their personal data sold or shared. This new feature, known as the Opt-Out Preference Signal (OOPS), enables users to communicate their privacy choices to every website they visit eliminating the need for repetitive manual opt-outs and offering a single, seamless way to protect sensitive information such as browsing history and location data.

Set to take effect in January 2027, the Act strengthens Californians’ ability to exercise their rights under the California Consumer Privacy Act, 2018 by turning privacy preference into a default browser setting. It closes long-standing gaps in enforcement where opt-out requests were inconsistently honored, ensuring that privacy rights are automatic, practical, and enforceable. The Act is expected to serve as a national model, empowering individuals to take control of their digital identities while compelling businesses and browsers alike to prioritize user privacy by design.

13. Tractor supplying Company penalized for Ignoring Privacy Opt-Outs for Data Sharing^[13]

CCPA fined Tractor Supply Company (“Company”) USD 1.35 million for violating the California Consumer Privacy Act, 2018 marking its largest penalty to date. The CPPA’s investigation revealed that Tractor Supply failed to post a clear privacy notice, ignored opt-out requests (including via browser signals like Global Privacy Control), and shared personal data with vendors and third parties without contractual safeguards.

Under the enforcement order, the Company must honour all opt-out signals automatically, update its data-tracking inventory, revise third-party contracts, and train staff to handle privacy requests correctly. It must also publish annual privacy metrics for 5 years. The case underscores California’s aggressive stance on privacy compliance confirming that companies must respect user choices across all data-sharing channels, not just direct customer interactions.

14. New York focuses on Stronger Data Security after experiencing Data Breaches by Accounting Firm^[14]

The New York Attorney General has reached a settlement with Wojeski & Company (“Company”), a public accounting firm, over 2 data breaches that exposed personal and financial information of more than 4,700 New Yorkers. The breaches, caused by a ransomware attack in 2023 and unauthorized data access in 2024, involved unencrypted Social Security numbers and delayed disclosure to clients violating state data breach notification laws.  As part of the settlement, the Company will pay a USD 60,000 penalty and adopt strict cybersecurity reforms, including data encryption, access restrictions, multi-factor authentication, employee training, and a formal incident response plan to ensure timely notifications in the future. The Attorney General emphasized that data protection must be a top priority for all businesses, warning that failure to safeguard personal information now brings severe financial, reputational, and legal consequences.

This enforcement action underscores that robust cybersecurity measures are no longer optional but essential for organizations handling sensitive data. With regulators increasingly holding businesses accountable for breaches, proactive steps such as encryption, access controls, and employee awareness are now the need of the hour to protect personal information and maintain consumer trust in the digital era.

15. E-commerce Platform settles with Authority for penalty imposed for Misleading Users using Deceptive Practices^[15]

Amazon.com Inc (“Company”) has been charged by FTC for using deceptive practices to enrol consumers into Prime membership without clear consent and making cancellation deliberately difficult. The FTC found that Company’s interface obscured key terms and employed manipulative design tactics, violating the Restore Online Shoppers’ Confidence Act, 2010.

Under the settlement order, Company will pay USD 1 billion in civil penalties and USD 1.5 billion in consumer refunds, overhaul its subscription interface to include clear disclosures, a visible ‘decline’ option, and a one-click cancellation process, with oversight by an independent monitor. The ruling sets a strong precedent against manipulative digital design, affirming that convenience-driven platforms must uphold transparent and informed consumer choice.

16. District Courts lay down ground rules for Fair Use in AI model training

In recent decisions including Bartz v. Anthropic^[16] and Kadrey v. Meta Platform Inc.^[17], the district courts have drawn key boundaries around copyright fair use in AI training. Courts held that training AI models on lawfully obtained copyrighted material can be transformative and qualify as fair use, provided the AI does not reproduce or harm the market for the originals. However, using pirated or unauthorized data disqualifies developers from this protection.

Both courts applied the standard four-factor fair use test examining the purpose of use (where transformative AI training favored fair use), the nature of the original work (creative works weighed against fair use but not conclusively), the amount used (permitting full copying when essential for model training), and the effect on the market (finding no infringement if AI outputs did not replicate or harm the originals’ market value). However, since the companies involved had used pirated or unauthorized data repositories, the courts held that such conduct fell outside the scope of fair use, exposing them to potential damages and further trial.

These rulings underscore that copyright compliance in AI development requires lawful data sourcing, transparent dataset disclosure, and safeguards against unauthorized reproduction in outputs. The principles laid down could serve as an important reference point for ongoing cases in India, such as OpenAI matter, where similar questions on the legality of training AI models on copyrighted news content are under judicial scrutiny.

17. Software Giant faces Class Action over Alleged Anticompetitive Control of AI^[18]

A class action lawsuit has been proposed and filed against Microsoft Corporation (“Microsoft”) in the District Court of California alleging that Microsoft used its exclusive partnership with OpenAI LLC (“OpenAI”), that operates ‘ChatGPT’, to artificially inflate process and restrict competition in consumer generative AI market.

According to the complaint, Microsoft’s early investment agreements granted it exclusive control over OpenAI’s compute resources via Azure, effectively allowing Microsoft, OpenAI’s horizontal competitor, through its own Co-pilot products to limit OpenAI’s output and dictate pricing. The lawsuit claims this ‘compute chokehold’ inflated ChatGPT prices up to 200 times higher than competitors’, degraded product quality, and prevented timely model improvements. When OpenAI was finally permitted in mid-2025 to procure computing resources from Google, its API prices dropped by nearly 80% overnight, allegedly confirming the anticompetitive impact. The plaintiffs seek damages and injunctive relief to bar Microsoft from maintaining such exclusive control, arguing that the arrangement constitutes an unlawful restraint of trade under the Sherman Act, 1890. Although this case is still at an initial stage, it will be closely watched to understand how competition law will apply to big tech partnerships that control access to essential AI infrastructure.

EUROPEAN UNION

18. Draft Guidelines on Balancing Competition and Privacy related Obligation for Large Online Platforms released^[19]

EDPB and the European Commission have together issued Joint Guidelines on the Interplay between Digital Market Act and General Data Protection Regulations (“Guidelines”) clarifying how two legislations must operate together. The Guidelines make it clear that large online platforms or ‘gatekeepers’ such as major search engines, app stores, and messaging services must comply with both frameworks simultaneously. While the DMA ensures fair competition and prevents dominance abuses, the GDPR protects individuals’ privacy and data rights.  The Guidelines warns that gatekeepers cannot invoke the DMA to justify processing personal data in ways that would breach the GDPR. Any data sharing, interoperability, or profiling activities must still meet GDPR requirements such as lawful basis, transparency, purpose limitation, and valid consent. To ensure coordinated enforcement, data protection and competition authorities will enhance cooperation and information sharing.

Feedback is invited till December 4, 2025.

19. Medical Firm penalized for Patient Data Breach^[20]

The Office of the Data Protection Authority (“ODPA”) fined Medical Specialist Group LLP (“Firm”) 100,000 pounds after a major cyberattack exposed sensitive health information from its email system, impacting thousands of patients across Guernsey. Investigations uncovered that the Firm had failed to install critical security updates to its Microsoft Exchange email server for over a year, leaving the infrastructure vulnerable. In August 2021, cybercriminals exploited these gaps, stealing emails containing private patient details and using them for targeted phishing campaigns. The breach went undetected for months, and the Firm’s initial claim of having secured its systems was refuted by later technical assessments. The ODPA’s inquiry found that Firm’s oversight of threat detection and incident investigation was inadequate, breaching local data protection laws on several counts.

Following the penalty, Firm is required to pay 75,000 pounds within 60 days and the remaining 25,000 pounds after 14 months, which could be waived if all prescribed remedial actions are completed on time. Measures already taken include shifting to a cloud-based email platform, enhanced system monitoring, and staff training on data security.

20. Credit Rating Agency fined for Unlawful Data Profiling^[21]

The Dutch Data Protection Authority has imposed a Euro 2.7 million fine on Experian Nederland B.V. (“Company”), for illegally creating and selling consumer credit profiles without proper consent or legal basis under the GDPR. The Company compiled extensive databases of personal and financial data from public records and private companies, which were then used by clients such as landlords, telecom providers, and lenders to evaluate creditworthiness and contract eligibility.

It was observed that consumers were often unaware their data had been collected or used to generate credit assessments that influenced financial decisions. The Company failed to provide sufficient transparency, justification, or access rights for individuals to correct errors. As part of the enforcement outcome, the Company must delete its entire database by the end of 2025 and cease data processing activities in the Netherlands. The Company accepted the decision and will not appeal marking one of the strictest enforcement actions in Europe for non-consensual data profiling.

21. German Federal Labour Court clarifies GDPR liability in Employee Background Checks^[22]

Germany’s Federal Labour Court has issued a key ruling on GDPR compliance in employee screening, holding that employers must have a valid legal basis when conducting online background checks. The case concerned a lawyer whose job application was rejected by a university after it discovered an old, non-final criminal conviction through an internet search. The court found that the university failed to inform the applicant about the categories of data being processed and lacked a   lawful justification for collecting sensitive criminal information. The applicant was awarded Euro 1,000 in non-material damages for loss of privacy and dignity. The judgment clarifies that even publicly available online information cannot be processed without meeting GDPR principles of transparency and purpose limitation. For human resource departments, this decision underscores the need for clear applicant notices, specific justification for online searches, and transparency when sensitive data influences hiring decisions.

This ruling offers timely lessons for India, where the DPDP Act is yet to be fully implemented. Similar issues could arise as employers increasingly rely on online searches and digital profiles during recruitment. The case highlights the importance of transparency, consent, and purpose limitation principles central to the DPDP Act. Indian organizations should proactively adopt these safeguards now to avoid future compliance risks once the law comes into force.

22. Not All Cookies or IP Addresses can be Personal Data holds Polish Court^[23]

Supreme Administrative Court (“NSA”) resolved a key issue concerning the classification of IP addresses and cookie IDs as personal data under the GDPR. The case concerned a company that processed a user’s IP address and cookie identifiers and was ordered by the Personal Data Protection Office to remove them and inform third parties of their deletion. The main issue of the dispute was whether, in the specific circumstances, these internet identifiers actually allowed for the identification of an individual, making them ‘personal data’ under both GDPR and Polish law.

NSA observed that neither an IP address nor a cookie identifier can always be treated as personal data, regardless of whether the address is static or dynamic. Instead, the court emphasised a context-based, ‘reasonably likely’ test i.e., authorities must assess whether identification of a natural person is realistically possible given the technology, cost, and time available at the time of processing. The NSA faulted the data protection authority for presuming identifiability without examining these conditions or precisely considering if the company could tie the identifiers, in that context, to a specific person. This reasoning aligns with both CJEU doctrine and prior Polish rulings, rejecting blanket assumptions in favour of a fact-based analysis for each case. By dismissing the cassation appeal, the NSA underlined that supervisory authorities must provide detailed justification and show clear evidence when declaring that online identifiers amount to personal data.

This ruling offers much-needed relief to businesses by confirming that not all online identifiers, such as cookies or IP addresses, automatically qualify as personal data. It recognises that liability should depend on whether an individual can actually be identified using available technology and resources. The judgment brings practical clarity for companies, ensuring they aren’t unfairly penalised for using routine technical features that don’t, by themselves, enable user identification.

UNITED KINGDOM

23. Tribunal dismisses Major Tech Company’s Encryption Challenge^[24]

The Investigatory Powers Tribunal has formally dismissed Apple Inc.’s (“Company”) high-profile case against the UK Home Office after the Government modified its Technical Capability Notice (“TCN”) demanding backdoor access to encrypted iCloud data. The original January 2025 notice required the firm to enable Government access to encrypted messages and backups protected by its Advanced Data Protection (ADP) feature. The Company argued that such a demand would compromise user privacy and warned it might withdraw encryption services from the UK, sparking international concern over civil liberties.  Following intense criticism, the Home Office issued a revised TCN in October 2025, narrowing its request to data belonging only to UK-based users. Both parties agreed to discontinue the case in light of this modification. While the Company confirmed that its enhanced encryption will remain unavailable in the UK for now, it reiterated its global commitment to data security and privacy-by-design. The case leaves open the broader debate on how far Governments can compel access to encrypted data without undermining digital security standards.

24. Outsourcing Company fined for Cybersecurity failures^[25]

ICO imposed a 14 million pounds fine on Capita PLC (“Company”), one of Britain’s largest outsourcing firms, for failing to protect the personal data of over 6.6 million people during a cyber-attack in March 2023. The breach occurred after hackers gained access through a malicious file downloaded on a company device. Company took 58 hours to isolate the compromised system, allowing attackers to steal nearly one terabyte of personal and financial data and deploy ransomware. The stolen information included not just basic records but also sensitive data like criminal records and financial details, causing substantial anxiety and stress for those affected.​

The ICO investigation found that Company had ignored known security weaknesses, failed to limit administrator access, and operated with an understaffed security team. The company also offered minimal post-incident support to affected clients. Originally facing a 45 million pounds penalty, the fine was reduced after Company’s cooperation and remedial actions, including enhanced access controls and engagement with the National Cyber Security Centre. The case serves as a reminder that timely response, regular testing, and strong governance are essential to safeguarding large-scale data environments.​

OTHERS

25. Canada tightens Data Protection Rules in Hiring Practices^[26]

The Commission d’accès à l’information (“CAI”) in Quebec, Canada has issued new guidance establishing stricter limits on personal data collection during recruitment. Employers may now gather only information essential to assessing a candidate’s suitability such as name, contact details, and work or academic history at the initial stage. Requests for references, medical, or background checks must be deferred to later stages and tied directly to the role’s requirements.

Written candidate consent is mandatory before verifying references, qualifications, or criminal history. Employers using AI or psychometric tools must disclose their use upfront and ensure assessments remain relevant to job performance. The guidelines also restrict social media screening to professional profiles and require prompt destruction of applicant data once hiring concludes. The CAI emphasizes that necessity not convenience remains the standard, and over-collection or irrelevant questioning may result in enforcement action. These rules promote fairness, transparency, and data minimization throughout the hiring process.