Second Circuit: no suspicion needed to search your phone at the border. Manual scroll is "routine." Like opening a suitcase. It is not a suitcase.

California will require end-to-end encryption for school exam proctoring software. The proctoring vendor cannot read the data. That starts July 2027.

Six of nine AI chatbots sent chat data to ad trackers. Reject cookies. Most trackers stayed on. Your prompts became inventory.

A Lagos court ordered Meta to stop unlawful behavioral advertising on Nigerian users. Consent buried in the terms is not consent.

Russia squeezed ten VPN services in a week. Right after the elections. Circumvention is the target.

Italy switches on real-time facial recognition for police today. Narrow purposes on paper. Urgent cases can start before a judge signs.

Connecticut cuts ALPR retention to 21 days on October 1. Vendors can't sell the plate data either.

German customs reads WhatsApp and Signal by linking a police computer as a second device. The encryption still works. It just delivers to one more endpoint.

Japan wants police to remotely hack phones and pull data from encrypted messaging apps. Calling it remote analysis does not make it private.

The UK set March for its under-16 social media ban. Ofcom still has to define the age checks that enforce it. The ban is the easy line. The gate is the privacy fight.

California just closed a CCPA delete loophole. Businesses kept broker-bought profiles after you hit delete. That ends January 1. Bought data has to go too.

Flock's CEO told the Senate it's possible to search for humans in its camera images. The company website still says those cameras aren't designed to search for people.

A Cologne court barred Snap from using My AI chatbot chats to pick ads. What you tell a bot is not ad inventory.

Apple no longer offers Advanced Data Protection to UK users. Reporting says a secret Home Office order sought access to encrypted iCloud data. On Sep 17 the government still refused to confirm it in court.

Google is appealing an EU order to share anonymized search data with rivals. It says the anonymization is not enough. Medical worries and private relationships are hard to scrub clean.

An EU Council draft would let AI firms process personal data for training under GDPR legitimate interest, without the Commission's unconditional opt-out. Cookie rules shift back to ePrivacy. Still a proposal, not law.

A Santa Fe jury found Meta made deceptive statements about Facebook privacy protections, totaling over 43 million Unfair Practices Act violations. Penalties are still up to the judge at an October 1 hearing.

A phone-extraction firm sold to U.S. and European police hid Russian ownership, DOJ alleges. Oxygen Forensics developed software in Russia while a sister company sold the same tech to the FSB.

Utah tried to force adult sites to verify anyone physically in the state, even when they used a VPN. A federal judge blocked that rule on Thursday. Perfect geolocation does not exist, he wrote, and the statute required it.