A new class action in the U.S. District Court for the Northern District of California alleges that Ace Hardware tracked users’ online activity through third-party tools before users could make meaningful choices through cookie consent tools, and that it continued
Latest from Data Privacy + Cybersecurity Insider - Page 15
Oklahoma Joins Comprehensive State Privacy Law Landscape
On March 20, 2026, Oklahoma Governor Kevin Stitt signed into law Enrolled Senate Bill No. 546, a comprehensive privacy law that will go into effect on January 1, 2027—this makes Oklahoma the 21st state to enact a comprehensive privacy
Mandiant M-Trends 2026 Report: Threat Actors Using AI in Attacks
Mandiant recently issued its M-Trends 2026 Report, a must read for all cybersecurity professionals. The report provides several conclusions and insights, including that both nation states and run of the mill financially motivated threat actors are “integrating AI to accelerate
Carfax Motion to Dismiss Denied in DPPA Crash-Report Data Sales Case
Carfax, Inc. faced an early loss in a closely-watched privacy case under the federal Driver’s Privacy Protection Act (DPPA), after a judge in Maryland refused to throw out a proposed class action alleging the company sold drivers’ personal information sourced
Privacy Tip #485 – Preventing Identity Theft
According to Security.org, “every 4.9 seconds, someone becomes a victim of identity theft in the United States” and the Federal Trade Commission receives over 6.4 million reports of identity theft and fraud every year.
Identity theft incidents continue to climb,
Expel Annual Threat Report Shows Identity Compromise Continues to Be Threat Actors’ Favorite Tool
Cybersecurity firm Expel recently published its 2026 Threat Report, which analyzed over 1,000,000 alerts in its Security Operations Center throughout 2025. The results showed that threat actors continue to use compromised credentials to gain access to company systems. The Report
No Good Deed Goes Unpunished: Victim Stryker Sued for Iranian-Backed Cyber Attack
As we reported last week, Stryker was attacked by Iranian-backed hackers in retaliation for Israeli and U.S. strikes against Iran. It was a significant cyberattack, known as a wiper attack. A wiper attack is designed not to extort money
Ford Settlement Highlights Simple Practice: Opt-Outs Must be Easy
The California Privacy Protection Agency (CPPA) issued a decision requiring Ford Motor Company to pay a fine of $375,703 and update its privacy practices following a settlement for its alleged violations of the California Consumer Privacy Act (CCPA). Under the
Skullcandy Can’t Transfer its CIPA Case Out of California
A federal court in the Southern District of California declined to dismiss wiretapping and eavesdropping claims tied to Skullcandy Inc.’s alleged use of online trackers on its retail website, allowing the lawsuit to move forward. Plaintiff alleges that Skullcandy used
Whose Voice Is It Anyway: The Likeness Line in AI Product Design
A recent class action complaint filed in the Southern District of New York, Angwin v. Superhuman Platform, Inc., No. 26 Civ. 02005, 2026 WL 704131 (S.D.N.Y. 3/11/26), highlights an evolving issue in artificial intelligence (AI) product design: what happens