Privacy & Data Rights
State privacy laws, data-broker rules, deletion rights, and the systems built to collect and profile consumer data.
Start with the writing
California's privacy agency brought its first case under both the CCPA and the Delete Act, against an Iowa data broker that failed to register and made consumers hand over unnecessary personal information to opt out. It lands less than two weeks after DROP deletion requests became mandatory.
As of August 1, every registered data broker in California must check the state's one-stop deletion platform every 45 days and actually delete what verified requesters ask for. Over 242,000 Californians signed up before the mandate kicked in, the first real test of a statewide deletion right at scale.
Meta's 'Muse Image' tool let anyone generate AI images of public accounts via @-mention — opt-out by default. SAG-AFTRA and CAA led the consent revolt, and Meta killed it in three days: a clean case study in how fast likeness-without-consent now backfires.
A.5328 took effect the moment it was signed June 30 — banning sensitive-data sales and uniquely requiring 'data collectors,' not just brokers, to register at fees up to $1.5M. On July 10 the AG blinked, delaying registration to 2027 after business outcry — the messiest data-broker rollout yet.
The FTC says the screening vendor duplicated criminal and eviction records, wrote off disputes as 'invalid,' and hid its data sources — making applicants look worse than they were. A clean case of bad consumer-report data costing people housing.
July 1 brought Arkansas's comprehensive privacy law online, Connecticut amendments that lower applicability thresholds and add neural data to sensitive categories, and Utah's new correction and social-graph access rights. A useful roundup of what changed and what's still coming in 2026.
The FTC's three-year case against data broker Kochava closes with a consent order barring sale of sensitive geolocation data without affirmative consent, plus deletion schedules and supplier-consent vetting. A capstone federal data-broker enforcement as state law takes over the beat.
Vermont enacts a comprehensive consumer-privacy law with opt-outs for data sale, targeted advertising, and profiling — enforced solely by the state attorney general and effective January 1, 2028.
Connecticut's omnibus privacy expansion, signed May 27, folds data-broker registration, geolocation-sale limits and pricing restrictions into one law, joining California, Texas, Vermont and Oregon.
Indiana, Kentucky and Rhode Island join the patchwork this year; California's DROP deletion platform is now compounding $200/day fines on brokers that ignore deletion requests.
EFF formally backs California’s AB 2564, which would bar retailers from setting customized prices off a shopper’s personal data and give consumers a private right to sue. The clearest privacy-first case yet against surveillance pricing as the bill heads to the state Senate.
The emotion-AI market nears $6B in 2026 with vendors claiming 90%+ accuracy reading faces and voices, even as the science stays contested and consent regimes lag. The next extraction frontier after behavioral tracking.
The definitive overview of the 20 state privacy regimes now in effect and California's data-broker DROP deletion platform phasing in, background to nearly every privacy story this year.
CalPrivacy's new enforcement unit, plus SB 361's expanded disclosure rules including sales to generative-AI developers, signals the data-broker crackdown has teeth ahead of the August 1 deadline.
From June 9, users receive a second cut of Meta's $725M Cambridge Analytica settlement (first round averaged $29.43) — the 'settle' stage of the playbook, priced at pennies on the data dollar.
Settlement over claims that an AI tool listened through phone microphones and fed targeting data into sold email lists. A clean example of the 'know, deny, settle' arc playing out in real time.
A first read on the federal bill that would set a national baseline for consumer-data rules — worth watching against the patchwork of state laws now in effect.
Bans the sale of precise cell-phone location data and keeps a private right of action despite heavy industry lobbying. The 'regulate' stage of the playbook, arriving on schedule.
A biometric-privacy suit testing whether face-scanning at the doorbell triggers the same liability as workplace fingerprint cases.
A study on how opt-out flows are engineered to fail — concrete evidence for the gap between privacy rights on paper and in practice.
The full chronological feed lives at On My Radar.
EFX-TBV-PII-RISK · Google Patents ↗
Isolates individual identity elements a consumer leaves behind in a transaction — email address, phone number, device ID — and scores each against modeled historical fraud distributions (chargebacks, declines) to rate the risk of card-not-present purchases. Equifax says the method is already deployed in its Consumer Insights, Signal Score for Email, and Payments Fraud products. It is data-broker infrastructure in its purest form: a credit bureau converting the contact details and devices of ordinary shoppers into behavioral risk scores that merchants act on and consumers never see, with no mechanism for a person to know why their transaction was flagged. NOTE: patent number to be verified — announced in Equifax's June 30, 2026 patent-portfolio release without a USPTO number; this entry links to the announcement until the number is confirmed.
In the news(1)
EFX-TBV-DATA-FABRIC · Google Patents ↗
Coordinates event data moving between multiple computing systems by holding records until defined triggers are met, so downstream systems receive complete, structured datasets rather than fragments — the patented plumbing of Equifax's 'data fabric.' That fabric ingests 20 billion records a month and orchestrates more than 250 billion keyed and linked consumer records unified from over 100 formerly siloed sources, feeding products like Account Protection, Identity Proofing, and Synthetic Identity Risk. Nominally back-office, it matters because it is the orchestration layer that makes bureau-scale profiling operate in real time: the more seamlessly consumer records flow between systems, the less friction stands between data collection and its use. NOTE: patent number to be verified — announced in Equifax's June 30, 2026 patent-portfolio release without a USPTO number; this entry links to the announcement until the number is confirmed.
In the news(1)
US12541610B2 · Google Patents ↗
A digital targeting system that scans a regulated consumer database, identifies the users who satisfy an advertiser's 'content factors,' and outputs a pre-validated list of those users to be matched against external digital-ID databases — so a display network can serve them ads. It operates over records governed by data-sharing restrictions (such as government-regulated or financial data), framing itself around compliance even as its purpose is to make otherwise-restricted consumer records addressable for targeting. Filed by Experian, one of the largest consumer data brokers, and granted February 2026. It is the identity-graph plumbing beneath behavioral advertising: the mechanism that turns regulated personal records into targetable ad audiences, with consent and accountability handled as access-control bookkeeping rather than as a consumer choice.
US12513102B2 · Google Patents ↗
Constructs a persistent AI persona from a user's behavioral, emotional, and interaction data — including post-mortem operation (posthumous digital presence). The system analyzes a lifetime of platform activity to generate a digital twin capable of posting, reacting, and interacting on the user's behalf, including after death. Originally filed by Meta CTO Andrew Bosworth in 2023; granted December 2025 and published February 2026. Meta has stated it has no current plans to ship this as a product, describing it as a protective filing — the same framing used across the tobacco-playbook 'deny' phase. The most-cited patent across all daily briefing editions.
In the news(8)
The full catalog lives at Patent Watch.