Privacy news doesn’t exactly take the month off. From huge changes to California’s CIPA, to AI agents accessing sensitive systems, to smart glasses, location tracking, and another hefty privacy settlement, there’s been plenty happening in the world of data privacy. In this month’s roundup, we’re covering some of the biggest privacy stories from the past few weeks, the U.S. privacy bills we’re currently tracking, upcoming events worth checking out, more.
Plus, this month, we spoke with Linn Freedman on Privacy Lawls on the dangers of sharing your medical information with AI tools. You can listen to the episode here. Now let’s dive in!
Table of Contents
What’s new in privacy?
Below are some of the most notable news in privacy from this month:
- Major changes to CIPA. The California Governor signs SB690, which states that individuals may no longer bring civil action against private actors (e.g. private companies) for violations of CIPA – all violations would be investigated and prosecuted by the California Attorney General. This applies retroactively for 2 years as well. Read more here.
- Instinct’s AI assistant is raising privacy and security concerns. The AI tool is still in private testing but is raising some privacy and security concerns over its access. Users can connect to your applications and devices, including email, messaging apps, calendar, audio, location, screen and more and can perform tasks such as booking appointments, scheduling rides, cleaning up the inbox, handling shopping, and more. Read more here.
- Android apps may be sharing location data with third parties without the developers’ knowledge. New findings by the Electronic Frontier Foundation warn app developers that some of the third party code they place in their apps may also collect their users’ location data and share it with advertisers. Read more here.
- OpenAI agent breaches Australia’s government health data portal. The Government of Australia stated that an OpenAI agent breached a government data portal in June, gaining unauthorized access to files. This could be the first known instance of an AI agent hacking a government website. Learn more here.
- Dutch DPA argues that smart glasses should be banned in hospitals and courthouses. The DPA stated that the ban should be introduced at sensitive locations, such as hospitals and courthouses as individuals are wearing smart glasses and sharing that footage on social media without consent, which is not permitted under GDPR. In addition, the DPA also discusses the fact that the images and video may be processed by AI, leading to increased privacy and security risks. Learn more here.
- Privacy concerns lead to record Flock contract cancellations. Amid privacy concerns and public backlash, 214 cities and towns have terminated their contracts with Flock since 2021 and, of those, 90 cancelled their deals with Flock since August 2026. Read more here.
- Google fined 403 million euros for breaching location data rules. Ireland’s DPC said its investigation found that Google did not lawfully or fairly process location data in users’ Web & App Activity and their Location History. The DPC also found that the company failed to be lawful, fair and transparent when processing this personal data. Read more here.
- CVS settles privacy lawsuit for $20.5 million. The lawsuit alleged that CVS shared data from its websites and mobile app with advertising company Criteo and others through tracking software embedded on sites in violation of state and federal law. Read more here.
- Meta unveils camera-free smart glasses. While the glasses do not have a camera, they still can record audio. Meta representatives also stated that the glasses come with a light that makes it more clear when someone is recording. Learn more here.
- New York expands employee access to personnel records. Beginning November 8, 2026, all New York employers must provide current and former employees with copies of their personnel records within 5 business days of a written request, at no cost to the employee. Employees may also dispute the contents of their personnel records. Learn more here.
What privacy bills are we tracking?
As part of our service, we keep track of privacy bills that would affect the way Privacy Policies are written. Below is our most recent list of privacy bill proposals in the United States. You can access the privacy bill tracker any time on our blog.
- Alaska – AK HB367;
- Arizona – AZ SB1815;
- Illinois – IL SB52;
- Illinois – IL HB3041;
- Illinois – IL SB2875;
- Illinois – IL SB3220;
- Illinois – IL HB5221;
- Illinois – IL SB3548;
- Illinois – IL SB3890;
- Massachusetts – MA SB33;
- Massachusetts – MA SB301;
- Massachusetts – MA SB2619;
- Massachusetts – MA HB4746;
- Massachusetts – MA HB5479;
- Michigan – MI SB359;
- Minnesota – MN SB4666;
- New York – NY S4276;
- New York – NY AB5827;
- New York – NY AB974;
- New York – NY AB4947;
- New York – NY SB8524;
- North Carolina – NC – HB462;
- North Carolina – NC – SB757;
- North Carolina – NC – SB1022;
- Pennsylvania – PA HB78;
- Pennsylvania – PA SB112;
- Vermont – VT H812;
- Washington – WA HB1671;
- West Virginia – WV HB5123.
Events
Here are some great virtual events that you can attend to learn more about the hottest issues in privacy and meet other privacy professionals:
- DPDPA Across Industries: Navigation the Road from Compliance to Implementation – October 9, 2026;
- 2026 Artificial Intelligence and Robotics National Institute – October 12, 2026;
- Data Privacy and Cryptocurrency in 2026 – October 15, 2026.
Conclusion
As you can see, privacy continues to be a rapidly changing landscape, with new laws, enforcement actions, emerging technologies, and privacy concerns appearing every month. From AI agents and smart devices to tracking technologies and evolving state privacy laws, staying informed is becoming increasingly important for businesses and the professionals who build and manage their websites.
We’ll keep tracking these developments so you don’t have to, and we’ll be back next month with another roundup of what’s new in privacy.
