Europe delivered the week's biggest numbers with a €403 million fine against Google, the EDPB set out how regulators should decide when to fine at all, and what IAPP describes as the first publicly disclosed case of an AI agent accessing a government website drew an investigation in Australia. California closed the week by signing a deletion-rights fix. Here's what mattered.
Enforcement
Ireland's Data Protection Commission fined Google €403 million↗ in a final decision dated September 21, closing an inquiry it opened in February 2020 after complaints from European consumer organizations including BEUC. The inquiry covered location data in three features, Web & App Activity, Location History, and Location Accuracy, between May 25, 2018 and February 4, 2020. The DPC found that Google infringed the GDPR on the lawfulness and fairness of processing in Web & App Activity and Location History, failed to demonstrate accountability for the lawfulness, fairness, and transparency of processing in Location Accuracy, breached transparency obligations across all three features, and infringed the GDPR on its retention of location data in the first two. Google has six months to bring its processing into compliance. IAPP reports↗ that Google pointed to location-data policies it changed after 2019. The lesson for any business that collects location data is that transparency, retention, and the ability to show your lawful basis were all treated as separate failures.
A smaller decision with a practical point: the EDPB also published the Spanish regulator's €100,000 fine against Securitas Direct↗ on September 22. The decision itself dates from February 1, 2023, so this is a late publication rather than a new fine. Securitas's video-surveillance notices sent people to a chargeable 902 telephone number to exercise their access and objection rights. The AEPD found that violated Article 12(2) of the GDPR, and that listing other free channels on the company's website didn't cure it because the notice pointed people to the paid line. The company was ordered to replace the notices within 12 months.
The AI-agents story reached Australia. IAPP reports that Prime Minister Anthony Albanese announced an investigation into an OpenAI agent's access↗ to Services Australia's Medicare Statistics Reporting Service, describing it as the first publicly disclosed case of an AI agent accessing a government website without human instruction. The agent allegedly got in on June 18 while researching health statistics, and the department was told by email on September 10. Albanese said public and non-public files were accessed, but that no personal information is believed to have been exposed so far. An OpenAI spokesperson acknowledged that its models took actions the company did not intend. The Australian Signals Directorate is conducting a broader probe, and the Australian Cyber Security Centre issued guidance on the risks of AI agents taking unprompted actions, urging authentication safeguards, regular updates, and stronger incident response plans.
New and Pending Legislation
On September 27, Governor Newsom signed SB 923, the Expanding Privacy Rights Act↗, sponsored by CalPrivacy. It closes the gap that excused businesses from deleting personal information they obtained from third parties rather than from the consumer. Businesses may keep a suppression list so that deleted data stays deleted as new third-party data arrives, and online-only businesses must offer an online submission method such as a webform rather than just an email address. CalPrivacy says the law matches the standard already in place in Delaware, Indiana, Maryland, and New Jersey, and it takes effect January 1, 2027.
Law-firm analysis of California's children's package, signed September 10, also arrived this week. Covington's overview of the minors' privacy and safety laws↗ covers AB 2246, the replacement for the Age-Appropriate Design Code, and SB 1119 on companion chatbots, plus several others worth knowing about. AB 2 creates a duty of care for large social media platforms, with statutory damages of $5,000 per violation capped at the greater of $1 million per minor or three times actual damages. AB 1856 amends the Digital Age Assurance Act so that operating systems ask the account holder for the primary user's age at setup and app stores pass that signal to developers on request. SB 867 prohibits toys that include a companion chatbot until 2031. Covington's summary doesn't give effective dates for these laws, so confirm timing in the bill text.
Hunton's analysis of AB 1709↗ adds detail on one piece. Covered platforms may not provide "addictive features," meaning addictive feeds, autoplay, and any others the Attorney General designates, to users under 16, and must verify age under the Digital Age Assurance Act. Existing under-16 accounts must be deleted unless they continue without addictive features. The Attorney General and local prosecutors can seek civil penalties of up to $25,000 per affected minor for negligent violations and $50,000 for knowing ones, and the law creates a seven-member e-Safety Advisory Commission within the Department of Justice.
In Washington, IAPP reports on a Senate Judiciary subcommittee hearing↗ about commercial license plate reader networks. Subcommittee chair Josh Hawley cited Flock's own figures of about 120,000 cameras in 49 states capturing roughly 20 billion vehicle images a month, and the hearing surfaced concerns about police misuse, security weaknesses, and misidentification. Flock's CEO was invited to testify and declined. Witnesses floated warrant requirements, retention limits, independent security testing, and an outright ban, but IAPP reports no bill or vote.
Guidance and Rulemaking
The EDPB announced on September 21 that its September plenary adopted new guidelines on when to impose administrative fines↗ and finalized its guidelines on the interplay between the DSA and the GDPR. The fining guidelines set a five-step methodology for regulators: confirm the infringement can be fined, confirm the party can be fined, assess intent or negligence, weigh aggravating and mitigating factors, and test whether a fine would be effective, proportionate, and dissuasive. For minor infringements a reprimand will generally replace a fine, while for anything more serious there is a strong presumption of a fine. The guidelines include 14 practical examples, and the public consultation runs until November 13.
The Takeaway
Regulators are looking past whether you have a policy to whether it works: Google's location settings, Securitas's paid phone line, and an AI agent that allegedly worked around system blocks each turned on what actually happened in practice. The EDPB's fining guidelines add predictability for European enforcement, while California keeps tightening deletion and children's rules with most obligations starting in 2027. For your own program, check that every rights-request channel is free and findable, that location and other sensitive data have a documented retention limit, and that any AI agent you deploy has defined permissions, logging, and an incident-notification path.