The Hintze Law team continues to monitor global privacy and data security developments to provide timely, practical insights for clients. Below is a summary of key updates from October 2026.
For developments in AI, please see our latest Global AI Updates.
If you’d like to receive email alerts for our blog posts, visit our blog page to sign up.
US Privacy Updates
State AGs Sue TP-Link Alleging Security Risks and Deception Regarding China Ties
On October 6th, 2026, the Florida AG filed a lawsuit against TP-Link Systems, alleging that the company misled Florida consumers about the security of its routers, its separation from China, and risks involving consumer data. Florida joins Texas in suing TP-Link, and additional lawsuits have been filed in Iowa, Montana, and Nebraska.
Based on these claims, on October 7th, a coalition of 21 state Attorneys General sent a letter to the FCC urging the agency to scrutinize cybersecurity and national-security risks before approving new TP-Link router models for sale in the United States.
CA AB 883 - Delete Act Amendments
On September 27, 2026, California enacted AB 883, amending the Delete Act with the first effective date on January 1, 2027. Beginning that day, data brokers must access Delete Request and Opt–out Platform (“DROP”) systems and process deletion requests through it every thirty (30) days, a more frequent cadence than the current cycle of every forty-five (45) days. Additionally, beginning July 1, 2027, data brokers must also process deletion requests made by California residents who are elected officials and judges (this requirement can be enforced by the California AG, county counsel, and city attorneys). While these individuals were not previously explicitly excluded from exercising deletion rights under the Delete Act, it was also not clear how the government-related exemptions in CCPA affected the Delete Act's borrowed definition of "consumer." See our prior blog posts on the Delete Act and its prior amendments by Taylor Widawski and Hansy Piou.
NetChoice Sues to Enjoin CA Social Media Warning Law
On October 22, 2026, following a successful preliminary injunction against a similar CO law, NetChoice filed a complaint filed in the U.S. District Court for the Central District of California challenging AB 56, which requires social media platforms to display warnings to U18 on first use and after continued use in a single session. NetChoice alleges that the social media warning label law violates the First Amendment.
Florida Files Injunction Against Meta Over Child Safety and Addictive Features
On October 7th, 2026, the Florida AG filed a motion for a temporary injunction against Meta Platforms in Florida's ongoing lawsuit concerning Facebook and Instagram's treatment of young users. Florida alleges Meta misrepresented risks to children and implemented product features that encourage excessive use.
The requested injunction would impose substantial restrictions while the case proceeds, including requiring age assurance and removal of Florida users under 14 while imposing usage limits, prohibiting targeted advertising to teens, and restricting a number of features including autoplay, like counts, infinite scroll, and push notifications.
Florida declined to participate in Meta's August 2026 multistate settlement and is continuing its separate litigation seeking stricter protections. The injunction request remains pending, so these restrictions are not yet in effect.
New Mexico Court Orders Meta to Pay $25b to Settle Allegations of Misleading Privacy Disclosures
A judge in New Mexico has ordered Meta to pay $25b in damages to settle allegations relation to misleading privacy disclosures related to the Cambridge Analytica data collection and use during the 2016 presidential election. While the judge is quoted as saying that damages of $219b was warranted, he reduced to the finally awarded damages of $25b.
Rhode Island AG Sues Meta for Fraudulent Advertisements
On October 22, 2026, following a similar lawsuit brought by Santa Clara County, CA, the Rhode Island AG announced a lawsuit against Meta under the RI Deceptive Trade Practices Act for "allegedly failing to curtail advertisements for fraudulent products and financial scams on its platforms, despite representing to the public that it engages in sophisticated efforts to prevent such ads."
South Carolina AG Sends Letter to Flock Regarding its Privacy and Security Practices
On October 5th, 2026, the South Carolina AG sent Flock Safety a letter concerning its privacy and security practices, requesting answers about the company's use of artificial intelligence, restrictions on access to data, and data retention policies.
Chinese Online Retailer Temu Settles Texas Lawsuit
On October 16, 2026, Texas announced a settlement following its February 2026 lawsuit alleging that Temu unlawfully exposed Texans’ sensitive personal data to the CCP and platforming products that may contain harmful chemicals and pose serious health risks to consumers.
The settlement requires Temu to pay $3 million to the State of Texas within 30 days and imposes data security and product safety requirements including:
Retaining an independent firm to annually conduct a mobile application security testing of the then-current version of the Temu app;
Including a reference to applicable Texas law, including the TDPSA, in its privacy notice;
Removing any recalled, prohibited, or noncompliant product from the Temu Platform within two business days of United States and Texas recall or alert.
Storing personal data of Texas consumers on U.S. servers owned and controlled by an American company;
Disclosing, in its U.S. Privacy Policy and/or Addendum for U.S. residents, that personal data of Texas consumers may be disclosed to third parties outside the United States;
Providing a “one-click” link for logged-in users to exercise the right to delete an account and its associated data;
Retaining an independent format to annually assess compliance as to sensitive personal data obligations.
Temu must pay an $8,000,000 penalty for each year a violation occurs.
WA Supreme Court Upholds Seattle Children's Hospital Use of Meta Pixel
On October 8, 2026, the Supreme Court of Washington held that the Washington Privacy Act does not prohibit the Seattle Children's Hospital from using the Meta pixel on its public website. A plaintiff class alleged that the pixel, used to track and share with Meta the plaintiffs’ web activity, intercepted such activity as private communications under the Act without consent.
However, the court held that "RCW 9.73.030(1)(a) governs interception or recording of “communication” between “two or more individuals” and therefore excludes searches and clicks that generate an automated response." Finding that the communication was between the plaintiffs' and the hospital's systems, the court relied on the plain language meaning of individuals in the provision referring to persons, as opposed to other entities such as “partnership[s], corporation[s], association[s], or the state of Washington.”
FCC Revokes TCPA “Revoke All” Rule
On September 30, 2026, the FCC amended TCPA regulations regarding how companies calling or sending texts need to accept and honor opt-out requests. Under the newly modified regulations:
Companies can designate one of the following methods as the exclusive way to revoke consent: automated/interactive voice or key press opt-out; reply to text messages (e.g., stop, end); or website or phone number for opt-outs.
Opt out methods need to be designated in the call/text, and if they are not, then companies need to honor opt outs that are made by any reasonable means.
Certain consent revocations only need to be honored for similar types of calls or texts.
The new requirements will take effect 30 days after publication in the Federal Register.
Supreme Court Hears VPPA Case
On October 14, 2026, the Supreme Court heard arguments in Salazar v. Paramount Global, a case regarding the Video Privacy Protection Act (VPPA). Salazar, a California resident, signed up for a free newsletter from 247sports.com, a website owned by Paramount Global. Salazar alleges that tracking technology on the website disclosed his video watching history to Facebook without his consent. The Court has taken the case to decide whether VPPA’s definition of “consumer” covers all goods and services from a provider or only its audiovisual offerings.
5th Circuit Reverses Dismissal of Wiretap Lawsuit
On October 23, 2026, the 5th Circuit reversed the district court's dismissal of a wiretap suit under federal, Missouri, Illinois wiretap laws (in addition to an intrusion upon seclusion tort claim and breach of contract claims) that alleged Eyemart Express LLC shared plaintiffs' HIPAA-protected information with Meta through its pixel without consent.
The 5th Circuit found that district court erred by construing in the definition of individually identifiable health information ("IIHI") too narrowly: it is sufficient for it to relate to condition or provision of healthcare, not a specific diagnosis or condition. The plaintiffs' search information (such as clicking products or scheduling exams) and prescription eyeglasses information was allegedly transferred to Meta.
11th Circuit Vacates Injunction Against Georgia’s Under-16 Social Media Parental Consent Law
On October 15, 2026, the Eleventh Circuit vacated a preliminary injunction that had blocked enforcement of Georgia SB 351, the Protecting Georgia’s Children on Social Media Act, which Georgia enacted on April 23, 2024. The law requires covered social media platforms to use commercially reasonable age verification and to obtain parental consent before a child under 16 can hold an account.
The panel held that NetChoice’s facial First Amendment challenge failed because NetChoice offered no evidence that enforcement against most covered platforms would be unconstitutional, as Moody v. NetChoice requires. The court also reversed the district court’s holdings that aspects of SB 351 were unconstitutionally vague and preempted by Section 230 of the Communications Decency Act, and remanded the case. The decision does not hold that SB 351 is constitutional. NetChoice has said it is evaluating its legal options, and the case continues in the district court.
Once the Eleventh Circuit’s decision takes effect, absent further court relief, the injunction will no longer bar the Georgia AG from enforcing the challenged provisions. Platforms with Georgia users under 16 should determine whether they are covered, then confirm that their age assurance flows, parental consent mechanisms, and limits on advertising to minors are ready. Companies should track the mandate and any further relief.
11th Circuit Upholds FL HB3 Restrictions on Social Media for Children
On October 14, 2026, the 11th Circuit upheld Florida's restrictions on social media for children under HB3, vacating and reversing a preliminary injunction that blocked the state's enforcement. The court held that the law likely survives a First Amendment challenges because it is content-neutral and thus intermediate scrutiny.
Apple Publishes Plan to Block Identity Resolution Infrastructure
On October 19, 2026, Apple WebKit engineers published a blog post that details Apple's plan to rid Apple devices of third-party web tracking. The post details how Apple fully blocked cross-site cookies six years ago, but "the tracking industry has not sat idle since." It goes on to detail how identity resolution works, but notes that "first party personalization is not tracking, and is not what our technologies seek to prevent." In iOS 27, Safari and WebKit now block network access to identity resolution infrastructure to prevent cross-site tracking. The blocking is done at the domain level, so companies can't just change the structure of the network request to get around the protection. For vendors that are not themselves first-party data owners, the iOS 27 block will be in effect. "Even if identity graphs are only scoped to data from a single company, i.e. a first party, the central identity resolver is a third party and it holds cross-site, cross-device and cross-party data about the user and can perform matching and targeting functions in the capacity of a clearinghouse." It seems like even using a first-party structure might not be enough to escape the iOS blocking.
Global Updates
Italian DPA Guidelines on Pixels in Emails Enters Into Effect October 29
By October 29, 2026, companies, platforms and newsletters will have to comply with to the Italian Data Protection Authority's Guidelines on the use of tracking pixels in email communications. The requirements are discussed in a fact sheet and emphasize the need for consent with such pixels.
Norway's DPA Fines Microsoft's Xandr $9.61 Million
Norway's DPA has fined Xandr (now Microsoft Advertising) 92 million crowns (equivalent to $9.61 million) for relaying sensitive sexual orientation information to advertisers via an integration with Grindr between July 2018 and April 2020. During that time period, Xandr had not yet been acquired by Microsoft. This is the biggest fine to date issued by Norway’s DPA. Xandr has three weeks to appeal the fine.
Norway Plans Harm-Based Age Limit for Social Media, Including Games and Messaging
On October 19, 2026, Norway’s government announced that its planned minimum age law for social media will target harmful platforms. It will also drop the exemptions it had planned for messaging services and games.
The age limit would apply until January 1 of the year a child turns 16. The new element is a harm-risk condition. The law would cover social media that, through design, features, or content, pose a risk to children’s emotional, cognitive, or health development or safety. The government says this widens rather than narrows the law’s reach. Without the condition, blanket carve-outs for messaging and games were needed, but now games with social features and harmful functions, and some messaging services, could be covered. The government expects TikTok, Roblox, and Snapchat to be covered as currently designed. The law would work by triggering the enforcement and sanction obligations of the EU Digital Services Act (DSA), which Norway plans to implement through a national digital services law that has been out for consultation. Providers would choose their own age verification method, which must be privacy-friendly and comply with the GDPR.
Clients with social, chat, or multiplayer features that reach Norwegian children should assess those features against the government’s stated risk factors: harmful content, addictive design, unlawful marketing, and unwanted contact from strangers. They should also evaluate whether their age assurance approach meets GDPR requirements. The government has said it expects compliance from day one and plans to submit the bill to the Storting by the end of 2026.
Japan DPA Discusses Development of Implementing Regulations under Amended APPI
On October 14, 2026, Japan's regulatory body published Basic Approach to Cabinet Orders & Rules (Draft) Part 3. for implementing regulations under the amended APPI. Key provisions include:
Contactable data protected: Info tied to an email, phone number, address or Cookie ID can’t be misused or obtained by deceit, even if it isn't personal information.
Data brokers must vet buyers: Opt-out brokers must verify a buyer’s ID and purpose before selling.
Stricter sourcing checks: Brokers would also need to strictly verify who they buy data from, and record who checked, when, and how.
Surcharges that strip illegal profits: For violations affecting more than 1,000 people, companies must pay what they earned. Repeat offenders pay 1.5x, and self-reporting halves the amount.
Narrow exemption for transfers of data with no identifiers or contact details that may be exempt from surcharges.
Turkey Social Network Law Enters Into Effect On November 1, 2026.
On October 10, 2026, Turkey published Regulation on the Provision of Child-Specific Differentiated Services by Social Network Providers and Age Verification No. 33396. Entering into effect on November 1, 2026, the Regulation has requirements for age verification, services differentiation for children aged 15 and over, parental control tools, and reporting tools for domestic and foreign social network providers accessible from Turkey which include:
Prohibiting U15 users from social network services through necessary technical and administrative measures, including age verification at account creation;
Existing accounts must be verified using an age verification token at least once by March 31, 2027.
Privacy defaults for communications with children's accounts;
Parental tools to control the child's limits for paid transactions, usage time, and location sharing.
Canada's Office of Privacy Commissioner Publishes Children's Privacy Code
On October 20, 2026, Canada's Office of the Privacy Commissioner published its Children's Privacy Code (CA CPC). More akin to guidance under PIPEDA, the CA CPC Applies to any organization subject to PIPEDA that collects, uses or discloses personal information during a commercial activity, where that activity involves an online service (including websites, applications, platforms and digital tools) that is directed at children or is likely to be accessed by children."
Like US state AADCs and the UK AADC, the CA CPC has provisions for Privacy impact assessments, default privacy settings, data minimization, transparency, correction and deletion rights, and profiling, but places a strong emphasis on child development as it applies to risks and consent. Under the code's requirement to balance the best interests of the child in decisions regarding them, the code highlights child-specific risks including:
Content risks pertain to harms associated with the type of materials a child engages with, either by choice or by exposure due to algorithms and advertising.
Contact risks pertain to harms associated with interactions in their daily lives. For instance, they may interact with someone they do not know, who shares inappropriate content with them, or people they know who share information and media about them without their consent.
Commercial risks pertain to harms associated with exploiting children’s personal information for commercial purposes, sometimes by using deceptive design patterns.
Conduct risks pertain to the children as a perpetrator of online harms such as cyberbullying or data theft.
Under this framework, the CA CPC also includes prohibitions on exploiting a child's developmental stage or emotional analytics and restrictions on profiling for marketing purposes and AI profiling.
Pizza Hut Canada Settles CASL Allegations for CN$500,000
Pizza Hut Canada (PH Canada) has agreed to pay CN$500,000 to settle allegations that it violated Canada's Anti-Spam Legislation (CASL) rules under the Personal Information Protection and Electronic Documents Act (PIPEDA). PH Canada has also agreed to review and update its compliance program related to sending commercial electronic messages.
Nonprofit Data Breach May Result In Ontario, Canada Privacy Legislation
The primary vendor of a “crime stoppers” nonprofit based in Ontario, Canada was subject to a massive data breach, and nobody is authorized to investigate it (PIPEDA exempts nonprofits, and the province of Ontario doesn’t have private sector privacy law). Ontario’s privacy regulator identified this as an urgent gap in a 2021 report:
“The significant volumes of data held by the not-for-profit sector in Ontario are not immune from privacy and security vulnerabilities, yet they remain largely unprotected by federal privacy law," reads the 2021 report, which urged the provincial government to fix the gap immediately. "No regulator has been given responsibility for this sector."
Hintze Law PLLC is a Chambers-ranked and Legal 500-recognized, boutique law firm that provides counseling exclusively on AI, privacy, and data security. Hintze attorneys and data consultants support technology, ecommerce, advertising, media, retail, healthcare, and mobile companies, organizations, and industry associations in all aspects of AI, privacy, and data security.