big win: a US jury has ordered NSO group, the Israeli company behind Pegasus spyware, to pay WhatsApp $168 million for a 2019 hack that targeted journalists, activists, and political dissidents.
it's the first time a spyware maker has been held legally responsible for exploiting smartphone platforms like WhatsApp, setting a major precedent for the surveillance tech industry.
https://www.ft.com/content/be26c503-b4e0-4ba5-a5ca-e9e75c351c46
telemessage, a compliance‑friendly fork of signal used by government and financial outfits, has been breached. an attacker exploited its backend to pull archived chats, contact lists, and login credentials.
telemessage modified signal to store “for‑the‑record” copies, making that data a new attack surface. the official signal client is not affected.
https://www.404media.co/the-signal-clone-the-trump-admin-uses-was-hacked/
TikTok has been fined €530 million ($600 million) by Ireland’s Data Protection Commission for unlawfully transferring European user data to China and failing to adequately protect it under GDPR rules.
the investigation revealed that TikTok did not sufficiently safeguard user data accessed by employees in China and failed to fully disclose China as a data destination. TikTok disputes the findings and plans to appeal, citing reforms under its "Project Clover" initiative.
https://www.businessinsider.com/tiktok-slapped-600m-fine-illegal-data-transfers-to-china-2025-5?utm_source=chatgpt.com
new records show that automakers like GM and Ford are collecting and transmitting large amounts of vehicle data from cars with active subscriptions to features like emergency dashcam and hands-free driving systems, and law enforcement agencies are actively training to access this information during investigations without drivers' knowledge or consent.
https://www.wired.com/story/police-records-car-subscription-features-surveillance/
Google is officially abandoning its plan to phase out third-party cookies in Chrome. after years of delays, the company says it will stick with the current system and won’t roll out a new prompt for cookie choices even despite pushback from privacy advocates, regulators, and advertisers.
Google now says there’s no consensus on how to replace third-party cookies, effectively ending the sandbox project.
https://www.theverge.com/news/653964/google-privacy-sandbox-plans-scrapped-third-party-cookies
a U.S. appeals court just revived a data privacy lawsuit against Shopify, saying the Canadian company can be sued in California for collecting and selling personal data from state residents through tracking cookies.
the court said Shopify “expressly aimed” its actions at Californians—rejecting arguments that its actions weren’t tied to any specific state.
https://www.reuters.com/sustainability/boards-policy-regulation/shopify-must-face-data-privacy-lawsuit-us-2025-04-21/
Pennsylvania lawmakers are proposing new DNA privacy legislation following 23andMe’s bankruptcy, which raised alarms about the fate of over 15 million users’ genetic data.
the proposed Genetic Materials Privacy and Compensation Act would give individuals legal ownership of their DNA, require informed consent before sharing or selling it, and ensure users are compensated if companies profit from their data.
https://www.axios.com/local/pittsburgh/2025/04/01/dna-privacy-23andme-pennsylvania
