Here's the hot news of the last couple of weeks.

  • CA SB-690 - California's SB 690 has been passed by the legislature and heads to Governor Gavin Newsom's desk for signature. SB 690 would severely limit the wave of California Invasion of Privacy Act (CIPA) claims that have resulted in thousands of class actions being filed under a 1960s telephone wiretapping law against companies for commonly used adtech tracking technologies on websites. CIPA claims won't completely disappear and expect the plaintiff's bar to get ever more creative in its search for ways to bring privacy-related class actions as the appetite for privacy-class actions to limit the adtech industry and online surveillance will remain as well as the deep pockets of the target companies stay flush. Still, expect the wave to diminish and look for other states to adopt similar legislation where similar claims under similar state laws have been popping up.
  • Krebs on Security: FBI Probes Service Selling 153M+ Drivers Licenses - Krebs on Security reports that the FBI is now probing idscan.net, a Louisiana-based identity verification company, for data breach and identity theft claims of more than 150M US and Canadian driver's licenses and other documents. Security researches traced the ID verification back to idscan.net via receipts, personal activity, and personal data to Hertz and marijuana dispensaries. Expect these types of data breaches from identity verification services to explode in the next few years because of the imposition of age verification laws in numerous states (and possibly nationally considering various privacy regulation working its way through Congress right now). The proliferation of identity verification requirements via age verification laws means this trend will only continue and escalate, which is one reason why privacy advocates have been speaking out against these laws at every turn.
  • CNBC: Nvidia agrees to buy Hugging Face for $12.9 billion, report says - No spicy thoughts about the legality of the deal but this is reminiscent of the vertical integration of Google's dominance of search and merging it with adtech. Nvidia is clearly cementing itself to dominate whatever format the future AI market takes, from data centers to chip manufacture to control of major distribution channels for models themselves to, of course, it's investments in the model companies. It's a play that worked for Google 20 years ago and has led to significant antitrust litigation which, speaking of...
  • Ars Technica: US court rules Google will not have to sell ad exchange after losing antitrust case - Somehow, despite winning its antitrust case proving that Google acted illegally and violated antitrust laws in its ad business - where Google owns basically every side of the stack and exerts tremendous control over the economic engine of the internet - Google's ad business won't be broke up for...reasons? The order remains under seal for 14 days but Google will be fined some unknown amount (which will amount to a tax that will be passed through to its customers and then onto all of the rest of us) and...that's it. I guess. Expect appeals (and more outrage when the order is unsealed) because this is nonsense. Thanks Trump DOJ for nothing.
  • Delaware Public Media: Delaware updates its Personal Data Privacy Act, state officials note big tech lobbying efforts - Continuing a trend of amendments slowly rolling out across the 20-some odd states that have passed omnibus state privacy laws in the last few years, Delaware has passed an amendment expanding and bringing into alignment with other states its privacy law. One key thing to note: the DE threshold for its laws has lowered from 35,000 consumers to just 10,000 bringing a larger number of businesses under its umbrella. Small business clients are definitely going to have to pay attention in DE now. Following another trend, inferences about health, race, nationality, and sexual orientation are now expressly considered sensitive personal information. Finally, the new amended law strengthens the purpose limitation language and prohibits processing that is not "reasonably necessary and proportional" in relation to the original purpose of collection. If you're a company that is still collecting data and repurposing it later on without checking the original intent of the collection (hi, AI devs), this is going to come back to bite.