Data privacy news and headlines for June

Large corporations like Meta and Netflix are once again making headlines this month, but so are small businesses as CIPA lawsuits continue to target small biz owners across the country.

This month, we also interviewed Lena Kempe on Privacy Lawls. You can listen to the episode, where we discuss the evolving role of Data Protection Officers in the AI era, along with some scenarios here. 

What’s new in privacy?

Below are some of the most notable news in privacy from this month: 

1. Texas sued Meta over “misleading” WhatsApp privacy claims. The Texas Attorney General sued Meta alleging that Meta and WhatsApp misled Texans about how private their messages really are. The lawsuit claims that WhatsApp falsely told users that their messages were protected by end-to-end encryption, meaning that only the sender and the recipient could read them but that Meta and WhatsApp still had ways to access those messages. Read more here. 
2. Netflix sued by Texas for allegedly spying on children and addicting users. The lawsuit claims that Netflix tracked and sold viewers’ habits and preferences to commercial data brokers and advertising technology companies without consent. The lawsuit also claims that Netflix was designed in a way where children and families are glued to the screen and get addicted to the platform. Learn more here. 
3. Small businesses sued over CIPA violations. Many small businesses have been sued for violations of the California Invasion of Privacy Act, claiming that their website tracked individuals from California without consent. Read more here. 
4. Biometric privacy law enacted. The Biometric Transparency and Privacy Act prohibits the collection, use and sale of biometric identifier information in commercial settings in Erie County, NY. Learn more here. 
5. California secures $12.75 million privacy settlement with General Motors. The settlement stems from General Motors selling hundreds of thousands of Californians’ location and driving data to two data brokers in violation of California’s privacy laws. Read more here. 
6. Cox Media fined for claiming it used AI to track consumer conversations. The Federal Trade Commission fined Cox Media Group and two other companies for falsely claiming that they could use AI to target ads based on conversations consumers had near their smart devices. Read more here. 
7. Austria’s DPA states that “reject” needs to be as prominent as “accept” on cookie banners. Following a complaint by NOYB, the Federal Administrative Court of Austria ruled a colored “accept” button is misleading and leads to unintended consent, making a user’s approval no longer unambiguous. The DPA and Courts confirmed that cookie consent banners must have equally prominent “yes” and “no” options. Learn more here.
8. Disney sued for $5 over facial recognition scans at Disneyland. The lawsuit claims that the park did not make it clear that it collects sensitive data from guests through facial recognition technology. The lawsuit also claims that visitors should have the right to expressly opt in to the use of this technology with written consent. Learn more here.  
9. Colorado replaces its AI Act with new framework. Colorado’s new AI framework covers developers and deployers of AI systems doing business in Colorado, The key obligations include documentation, point of interaction notice, post adverse outcome disclosures, and recordkeeping requirements. Read more here. 
10. Maryland leads in surveillance pricing regulation. Maryland recently enacted its “Protection from Predatory Pricing Act”, prohibiting food retailers and third-party delivery providers from using personal data to set a higher price based on that personal data. Read more here. 

What privacy bills are we tracking? 

As part of our service, we keep track of privacy bills that would affect the way Privacy Policies are written. Below is our most recent list of privacy bill proposals in the United States. You can access the privacy bill tracker any time on our blog.

Alaska – AK HB367;

Arizona – AZ SB1815;

Illinois – IL SB52;

Illinois – IL HB3041;

Illinois – IL SB2875;

Illinois – IL SB3220;

Illinois – IL HB5221;

Illinois – IL SB3548;

Illinois – IL SB3890;

Massachusetts – MA SB33;

Massachusetts – MA SB301;

Massachusetts – MA SB2619;

Massachusetts – MA HB4746;

Massachusetts – MA HB5479;

Michigan – MI SB359;

Minnesota – MN SB4666;

New York – NY S4276;

New York – NY AB5827;

New York – NY AB974;

New York – NY AB4947;

New York – NY SB8524;

North Carolina – NC – HB462;

North Carolina – NC – SB757;

North Carolina – NC – SB1022;

Pennsylvania – PA HB78;

Pennsylvania – PA SB112;

Vermont – VT H812;

Vermont – VT S71;

Washington – WA HB1671;

West Virginia – WV HB5123.

Events

Here are some great virtual events that you can attend to learn more about the hottest issues in privacy and meet other privacy professionals: 

1. Lunch and Learn: A conversation on CalPrivacy enforcement – June 11, 2026; 
2. Cybersecurity and Data Protection for Lawyers and Law Firms – July 16, 2026; 
3. 2026 Artificial Intelligence and Robotics National Institute – October 12, 2026.

Conclusion

Now that we are approaching the halfway point of 2026, two privacy law changes are expected to go into effect. These changes are impacting the Australia Privacy Act 1988 and the Connecticut Data Privacy Act. Termageddon users will have their policies updated to meet these changes. For everyone else, be sure to update those policies if needed.

See you next month!