Two enforcement actions put pressure on the data supply chain this week: a European fine against an ad-tech platform for relying on someone else's consent, and a Texas settlement that dictates where a shopping platform stores user data. Regulators also turned their attention to AI agents and smart glasses, and law firms dug into what California's end-of-session privacy bills actually require. Here's what mattered.
Enforcement
The Norwegian Data Protection Authority fined Xandr €8.6 million↗ in a decision dated October 2 that the EDPB published on October 16. The case began with a 2020 complaint by the Norwegian Consumer Council about real-time bidding in Grindr, a dating app aimed at gay, bi, trans, and queer users. The regulator found that Xandr, formerly AppNexus and now part of Microsoft, processed Grindr users' data during bidding, at least the fact that a person was using Grindr, their advertising ID, and their IP address, and that this was data concerning sexual orientation. Because it was special category data, explicit consent was required. Xandr didn't collect any itself, relying instead on Grindr's consent, which the authority found invalid. As the EDPB's summary puts it, accountability can't be outsourced: each joint controller has to verify independently that consent is valid and covers its own processing. For anyone buying or selling ad inventory, the practical question is whether you can show, not just assume, that the consent upstream of you is real.
In Texas, Attorney General Ken Paxton announced a settlement with Temu↗ on October 16, resolving a February 2026 lawsuit against PDD Holdings and WhaleCo that alleged the platform deceived consumers by exposing their sensitive data to the Chinese Communist Party. Temu must store Texans' personal data on American-owned and controlled servers in the United States and restrict access by people and entities based in China, subject to essential business functions. Violations of the data security provisions carry an $8 million penalty for each year they occur, and Temu will pay Texas $3 million. The settlement also requires annual independent product-safety testing, with removal, seller termination, notification, and refunds if harmful substances are confirmed. It is an unusual kind of privacy remedy for an eCommerce company: the state specified the data's location and access controls, not just disclosures.
New and Pending Legislation
Covington's roundup of California's end-of-session privacy bills↗ adds detail beyond SB 923 and SB 690, which this series covered earlier. AB 2561 bars operating systems and applications from changing a user's affirmative privacy setting without consent, subject to some exceptions, and defines "privacy setting" broadly. AB 883 amends the data broker law and the DROP platform, shortening the period for brokers to process deletion requests from every 45 days to every 30. Newsom also vetoed a bill that would have broadly restricted the sale and sharing of sensitive personal information, though Covington's summary doesn't identify the bill or the veto reasoning. The post doesn't state effective dates, so check each bill's text.
Advertisers got their own analysis. Covington's piece on AI transparency laws for advertisers and deployers↗ covers California's SB 1050, signed September 16 and effective January 1, 2027. It requires a clear and conspicuous disclosure when an ad prominently includes a synthetic performer, meaning a realistic AI-generated figure or voice that isn't recognizable as a specific person, and violations count as false advertising. It closely resembles New York's existing law, and Hawaii took a different route, prohibiting realistic digital imitations of identifiable people used without consent in advertising or to cause harm.
On chatbots, IAPP reports on a Future of Privacy Forum webinar where state lawmakers discussed 2026 chatbot legislation↗. FPF counted 37 states that introduced chatbot bills this year, with common themes of AI disclosure, mental health safeguards, and limits on underage users, and most enacted laws rely on attorney general enforcement. Iowa's law becomes enforceable July 1, 2027, while Oregon's SB 1546 and Tennessee's SB 1580 create private rights of action. Lawmakers also raised concern that a patchwork of state laws could invite federal preemption.
Guidance and Rulemaking
The EDPB adopted Statement 1/2026 on smart glasses↗ at its plenary and announced it October 13, alongside an expert report. It is preliminary guidance. A wearer is a data controller if they share recordings on a public social account or use the glasses for professional or official activities, but filming family and friends or private translation falls under the household exemption. The statement stresses that manufacturers and app providers are controllers in their own right and can't push their obligations onto users, and it calls for reliable recording indicators such as bright LEDs or audio cues so bystanders know they are being recorded.
The UK ICO published a report on data protection in AI↗ after reviewing ten major foundation model developers, and opened a six-week call for evidence on agentic AI, with responses due November 20. Per Hunton's summary, the ICO expects developers to explain what data they use and where it comes from, to document a lawful basis, and to provide rights mechanisms, and it says technical complexity is not an excuse for non-compliance. It also says a model may fall within UK data protection law if training data is embedded in a way that allows singling out or extraction. The evidence will feed into future guidance and the ICO's forthcoming statutory code of practice on AI and automated decision-making.
CalPrivacy used its first Delete Week↗, October 12 to 16, to publish adoption figures for the DROP platform. More than 560,000 Californians have registered since launch, data brokers have reported close to 100 million consumer profiles deleted, and a typical user has had their information reported deleted by more than 150 of the 660-plus brokers. For brokers, that is a reminder of the volume and tighter timelines coming through the platform.
The Takeaway
The enforcement thread this week is supply-chain accountability: Xandr couldn't lean on Grindr's consent, and Temu now has to prove where its data lives and who can touch it. The guidance thread is that regulators are writing expectations for AI and new devices before enforcing them, with the ICO refusing to let technical complexity excuse gaps and the EDPB pressing for visible recording signals. The practical to-do list is to check that your vendors and ad partners can document consent rather than assert it, map where customer data is stored and who has access, review any AI-generated imagery in your advertising against California's SB 1050 disclosure rule before January 1, and, if you are a data broker, confirm you can meet AB 883's shorter DROP processing period once it applies.