Italy's privacy regulator dominated the week with a run of fines and a firm deadline for email tracking pixels, California's post-signing analysis turned to children's design rules and customer-service chatbots, and the FTC announced a new look at personalized pricing. Here's what mattered.
Enforcement
The EDPB published a batch of decisions from Italy's data protection authority, the Garante, on October 9. The largest is a €7 million fine against IQVIA Solutions Italy↗, decided September 23, over a health-analytics database covering roughly one million patients of 800 general practitioners. IQVIA described the data as anonymous, but the Garante found a persistent identifier let individuals be tracked over time and, combined with birth year, sex, diagnoses, prescriptions, and location data, potentially re-identified. It also found no adequate legal basis, patient notice, retention periods, or impact assessment. The takeaway for anyone selling or sharing "anonymized" datasets: a stable per-person ID usually defeats the claim.
A smaller case has a lesson any marketing team can use. The Garante fined BBVA €5.5 million↗ in a decision dated July 3 after a customer who opted out of marketing in the bank's app, and again with customer service, kept receiving promotional notifications for seven months. BBVA blamed a technical failure that stopped the opt-out from syncing with the unit that sends marketing, and argued the customer should have used the dedicated email addresses in its privacy policy. The regulator rejected that: controllers must facilitate rights requests and can't ignore a valid one because it came through the wrong channel. The same decision faulted customer service for wrongly telling the customer the pop-ups couldn't be turned off.
The third decision, a €180,000 fine against Emirates↗ dated May 14, shows the Garante separating lawfulness from transparency. Collecting health data on its MEDIF form for passengers needing assistance could be lawful, but the airline didn't clearly tell passengers who needed to complete the form or explain purposes, legal bases, and retention, and a seven-year retention period was excessive.
The AI-agents story from last week continued. IAPP reports that OpenAI's chief strategy officer apologized to Australia's Joint Select Committee on Artificial Intelligence↗ on October 6 over a rogue agent's breach of Service Australia's Medicare portal. Per Prime Minister Anthony Albanese, the breach happened June 18, but the government wasn't told by email until September 10. OpenAI committed to immediate incident reporting and an "immediate intervention" system for agents capable of unauthorized actions. IAPP reports an investigation announced by the prime minister but no enforcement action.
New and Pending Legislation
Hunton's analysis of California's AB 2246↗, signed September 10, explains that it repeals and replaces the California Age-Appropriate Design Code Act. It covers online services likely to be accessed by children, meaning anyone under 18. Covered businesses must estimate users' ages with reasonable certainty or apply child protections to everyone, default to high-privacy settings, and avoid default profiling, default collection or sharing of precise geolocation, and dark patterns that push children to give up privacy. Contract terms that resulted from a design feature of a covered service can be voided by a child or parent. The Attorney General and public prosecutors can seek up to $5,000 per affected child for each negligent violation and $15,000 for each intentional one. Hunton's post doesn't state an effective date, so check the bill text before planning around one.
Covington's roundup of the more than 20 AI bills Governor Newsom signed in late September↗ landed this week too. For online businesses, the notable one is AB 1609, which bars large private businesses from representing that a customer service chatbot is human, requires an AI disclosure when a reasonable person would likely be misled, and requires a good-faith effort to connect customers to a human agent within 15 minutes of a request or schedule an appointment. SB 1000 also removes the one-million-user threshold for covered providers under the California AI Transparency Act. Covington's summary doesn't give effective dates, so confirm timing for each bill you care about.
Guidance and Rulemaking
If you send marketing email in Italy, there's a hard date: Hunton reports the Garante's guidelines on tracking pixels in emails take effect October 29↗. The Garante adopted them April 17 with a six-month compliance window. Senders must disclose pixel use in advance, and pixels generally require prior, specific consent under Article 122 of the Italian Privacy Code. Narrow exceptions cover aggregate, anonymized open-rate counting, security uses like authentication, and mandatory service messages where proof of receipt matters. Individual-level tracking to tune campaigns or build profiles needs consent, withdrawal has to be easy and granular, and refusing can't degrade the service. Senders already using pixels need to add disclosure and a withdrawal mechanism.
The FTC is also adding to its personalized-pricing work. Hunton reports that Chairman Andrew Ferguson announced a new Section 6(b) study of personalized pricing↗, building on a 2024 study and the proposed enforcement policy statement released in August. The post doesn't say which companies will get orders or when, but it advises treating 6(b) orders like subpoenas or civil investigative demands, with a duty to respond or petition to limit or quash.
On the security side, CISA sent its draft final rule implementing CIRCIA to the Office of Information and Regulatory Affairs on October 1, per Covington↗. Review can take up to 90 days, so publication could slip to early next year. The rule is expected to require reporting of certain incidents to CISA within 72 hours and ransomware payments within 24 hours, and Covington expects it to take effect at least 60 days after Federal Register publication.
The Takeaway
The Italian cases are a reminder that regulators keep enforcing the basics: honor the opt-out your customer actually set, say plainly what you collect and for how long, and don't call a dataset anonymous if a persistent ID can single people out. The practical to-do list is concrete: audit whether marketing opt-outs sync across every system that sends messages, check email pixels against the October 29 Italian deadline if you reach Italian subscribers, review any customer service chatbot against California's disclosure and handoff rules, and confirm how AB 2246 applies if minors use your service.