Enforcement and Litigation
The week's biggest story landed Wednesday: a New Mexico state court ordered Meta to pay $25 billion in civil penalties over the Cambridge Analytica incident↗, after a jury found the company and its executives liable for nearly 44 million violations of the state's Unfair Practices Act for false statements about user privacy. The judge cut the penalty down from the $219.5 billion the violation count implied, but it's still the largest state-court privacy judgment on record. Meta has said it will appeal, and New Mexico Attorney General Raúl Torrez notably didn't join the other state AGs who settled with Meta over the same conduct back in August — a reminder that a multistate settlement doesn't always close the door on a bigger number from a holdout state.
On the other side of the Atlantic, the Dutch data protection authority fined Uber €824.99 million for unlawful automated decision-making and insufficient transparency about profiling↗ — the biggest GDPR fine in recent memory. The case traces back to complaints from French drivers whose accounts were automatically deactivated over suspected fraud or low ratings, with Uber accused of not adequately explaining the automated logic or giving drivers a real path to contest it. It's a clear signal that regulators are treating ADM disclosure failures, not just data breaches, as fine-worthy on their own. The same EDPB enforcement roundup included three more notable actions: Norway's Datatilsynet fined ad-tech vendor Xandr €8.6 million↗ for unlawful processing, while Italy's Garante fined IQVIA €7 million over patient health data↗ and BBVA €5.5 million↗ for ignoring a customer's objection to direct marketing.
Worth watching beyond this week's numbers: IAPP reports↗ that the consumer-protection playbook state AGs built against social media companies is now being pointed at AI chatbot makers. On October 14, eight states — seven Republican-led, one Democrat-led — filed coordinated suits against OpenAI alleging unfair and deceptive practices around safety claims and manipulative design, echoing the theories that produced the Meta settlement over minors' social media use. The remedies sought include data deletion, disgorgement, and injunctions on model testing — a preview of where AI-and-privacy enforcement may be headed next.
New and Pending Legislation
In Brussels, EU member states finalized the Council's negotiating position on the Digital Omnibus↗, the package meant to simplify overlapping GDPR, ePrivacy, and AI Act obligations. Notably, the Council rejected the Commission's push to narrow the GDPR's definition of personal data, keeping it as-is, while adding new pseudonymization standards and proposing exemptions from cookie consent for things like audience measurement and device security. It also called for clearer rules on the lawful basis for using personal data in AI model training. Trilogue negotiations can start once the European Parliament lands on its own position — so there's still real room for these provisions to shift before anything is final.
Also on the EU calendar: the long-anticipated Digital Fairness Act is now in its final countdown↗, expected to be formally proposed on November 11. It's aimed at dark patterns, influencer marketing, addictive design, and manipulative personalization, with newer additions like unfair event-ticketing practices reportedly in scope. Expect an early fight over which European Parliament committee leads the file, and over how terms like "dark pattern" and "vulnerability" get defined without creating friction for routine business practices.
Closer to home, California Governor Gavin Newsom signed a cluster of privacy bills in the final days of the legislative session. The headline measure, SB 690↗, eliminates the private right of action for website-based pen-register and trap-and-trace claims under the California Invasion of Privacy Act — a significant cut to the wiretap-style litigation that's targeted website tracking tools in recent years, though CIPA's wiretapping and confidential-recording provisions remain untouched. Alongside it, Newsom signed SB 923, AB 2561, and AB 883↗, which respectively broaden CCPA deletion rights, bar apps and operating systems from silently overriding a user's privacy settings, and tighten data broker deletion-request deadlines — while vetoing a broader bill that would have restricted the sale and sharing of sensitive personal information.
On the federal side, CISA has sent the final CIRCIA rule to OMB for review↗, one of the last steps before the critical-infrastructure cyber incident reporting rule — 72-hour incident reports, 24-hour ransomware payment reports — can be published in the Federal Register. OIRA review can run up to 90 days or longer, so don't expect this one to take effect before early next year.
The Takeaway
This week's through-line is enforcement math getting bigger and reaching further. A single state court just set a new privacy-judgment record, European regulators are treating automated-decision transparency as its own fineable offense at nine-figure scale, and the legal playbook built against social platforms is already being retooled for AI companies. At the same time, EU and California lawmakers are both — for different reasons — trying to simplify what compliance actually requires: Brussels by consolidating overlapping rules, Sacramento by narrowing one of its most litigated private rights of action. For privacy teams, the practical read is the same either way: automated decision-making disclosures and AI training data practices deserve the kind of scrutiny that used to be reserved for breach response, because that's clearly where the next wave of enforcement attention is going.