App opt-outs and biometric rules
This week: Lyft's 1.8MCCPAsettlement,aS178,000 breach fine for Courts, UK facial recognition plans, and new Ofcom crisis response duties.
Weekly Compliance Brief: November 2 - 6, 2026
California reached a $1.8 million settlement with Lyft over missing in-app privacy controls. Singapore fined retailer Courts after a ransomware attack exposed data belonging to nearly 1 million people. Meanwhile, the UK announced plans for new rules governing facial recognition.
Here are this week's key developments in data privacy, accessibility, and digital compliance.
Data privacy law news
Lyft pays $1.8 million over missing in-app opt-out
California Attorney General Rob Bonta announced a $1.8 million settlement with Lyft on October 29. The company was accused of violating the California Consumer Privacy Act (CCPA) by not allowing users to opt out of the sale or sharing of their personal data directly within its app.
Since mid-2023, Lyft has used personal data to show targeted ads in its app. However, users who wanted to opt out had to leave the app, visit a separate webpage, and log in again.
Under the settlement, Lyft must provide an in-app opt-out option and notify California users of their right to prevent the sale of their personal data.
Why it matters: Businesses with mobile apps should make privacy opt-outs easy to find and use, without unnecessary steps such as additional logins.
Courts fined S$178,000 for its third data protection breach
Singapore's Personal Data Protection Commission (PDPC) fined electronics and furniture retailer Courts S$178,000 following a ransomware attack in 2022. The attack exposed personal data belonging to 946,972 customers and employees, according to a November 3 report by The Straits Times.
The attacker gained access through backup recovery servers connected to the internet. Courts had not included these servers in its regular security checks or installed necessary updates.
The PDPC considered the company's previous two data protection violations when determining the penalty.
Why it matters: Security checks should cover backup and recovery systems, not just primary servers. Businesses should regularly scan and update any systems that can access personal data.
UK plans new laws governing police facial recognition
The UK Home Office published its response to a public consultation on November 4, outlining plans for new rules governing how police and other public bodies use facial recognition and biometric technologies.
The consultation received more than 13,800 submissions.
The government plans to introduce legal requirements for approving the use of these technologies, testing to reduce bias, and independent oversight. A new regulatory body would also have enforcement powers.
The government intends to keep its approach to law enforcement and private sector use consistent.
Why it matters: Businesses using or supplying facial recognition technology should monitor these developments, as future rules could influence how the technology is used in the private sector.
EDPB launches a privacy hub for kids, parents, and teachers
The European Data Protection Board (EDPB) launched Privacy for Kids on November 4, bringing together educational resources from data protection authorities across Europe.
The hub includes games, videos, quizzes, and other materials designed to help children, parents, and teachers understand online privacy.
Users can filter resources by age group (3–10, 11–15, and 16+), country, topic, and format. They cover all 27 EU member states, plus Iceland, Liechtenstein, and Norway.
Topics include social media, smartphones, apps, smart toys, and cyberbullying.
Why it matters: Children's privacy remains a regulatory priority in Europe. Businesses offering apps, games, or websites used by children should review how clearly they explain their data practices to young users and parents.
Bavaria's regulator makes AI agents its 2027 audit focus
Bavaria's Data Protection Authority (BayLDA), which oversees private companies in the German state, announced on November 3 that AI agents will be a major focus of its 2027 regulatory audits.
The regulator has also updated its AI guidance to address how AI agents collect, store, and use personal data.
The guidance covers AI memory features, individuals' rights to access or correct their information, and security risks such as malicious instructions designed to manipulate AI agents.
The BayLDA will pay particular attention to transparency, access permissions, and effective human oversight.
Why it matters: Businesses using AI agents that handle customer or employee data should document their purposes, limit access to personal information, and make sure privacy requests also cover data stored in AI agent memories and logs.
Web accessibility news
China upgrades more than 14,000 websites and apps for accessibility
China has made accessibility improvements to more than 14,000 websites, apps, and digital services, according to a report Xinhua covered on November 3.
By the end of 2025, approximately 11,000 government websites had received accessibility upgrades. More than 3,100 widely used websites, mobile apps, and mini-programs were also improved to make them easier to use, including for older adults.
China now has more than 260 national standards covering accessibility and age-friendly design.
With more than 323 million people aged 60 and older, improving digital accessibility is becoming an increasingly important priority.
Why it matters: Businesses operating websites or apps in China should monitor accessibility requirements as the country continues expanding its standards and digital inclusion efforts.
Undercover test finds restaurant kiosks unusable for blind customers
CBC's Marketplace aired an investigation on November 6 examining how accessible self-service ordering kiosks are for blind customers at major restaurant chains in Ontario, Canada.
A blind customer visited several locations using hidden cameras to document the experience.
At McDonald's and Wendy's, the kiosks offered no way to hear the menu options. None of the five fast-food locations visited could provide a Braille menu.
Accessibility advocates criticized Ontario's existing standards under the Accessibility for Ontarians with Disabilities Act (AODA), arguing that they are too weak and poorly enforced.
Many Ontario businesses also face an AODA compliance reporting deadline of December 31.
Why it matters: Accessibility isn't limited to websites. Accessibility testing should also include self-service kiosks, ordering screens, and other digital customer touchpoints.
ADA Title II deadline approaches, putting procurement in focus
Most US state and local governments face an April 26, 2027 deadline to meet WCAG 2.1 AA accessibility requirements under ADA Title II.
A November 2 commentary published by Route Fifty highlighted the growing importance of accessibility when government agencies purchase digital products and services.
Government agencies are also responsible for the accessibility of third-party tools, including payment systems, scheduling software, electronic signatures, and PDFs.
A 2026 NASCIO survey found that 63% of states already include accessibility requirements in all requests for proposals or contracts.
Meanwhile, a lawsuit filed by the National Federation of the Blind challenges the extended compliance deadlines, potentially affecting when some requirements take effect.
Why it matters: Technology vendors working with government agencies should be prepared to provide accessibility testing results and plans to address identified issues, rather than relying only on accessibility claims.
New Zealand First proposes enforceable accessibility standards
New Zealand First announced plans on November 4 to introduce legislation to establish legally enforceable accessibility standards across industries.
Under the proposal, government ministers could introduce accessibility requirements for services, facilities, and public-facing organizations.
Organizations could also be required to publish accessibility plans, while the Human Rights Commission would handle complaints.
The party highlighted accessibility barriers in communications, banking, and digital public services.
The proposal is currently a political initiative, not an enacted law.
Why it matters: Businesses serving customers in New Zealand should monitor the proposal, particularly whether future requirements will apply to websites, apps, and other digital services.
Content takedown news
Ofcom's crisis response duties take effect for UK platforms
New crisis response requirements under the UK's Online Safety Act came into effect on November 2.
Online platforms covered by Ofcom's rules must have a plan for handling sudden increases in illegal or harmful content during a crisis.
They must also assign a senior team to manage these situations and review their response within 90 days.
Platforms with more than 700,000 UK users must maintain a dedicated communication channel for law enforcement.
Why it matters: Platforms that host user-generated content should review whether their moderation and content removal processes can handle sudden increases in harmful or illegal material during emergencies.
India considers making platforms more responsible for recommended content
India is considering changes that could make online platforms more legally responsible for content they recommend or promote through algorithms, according to a November 4 report by Business Standard.
Currently, Section 79 of India's IT Act provides certain legal protections for platforms that host user-generated content.
The government is exploring whether these protections should continue to apply broadly when platforms actively rank or promote content through algorithms.
Discussions are still in the early stages, and any changes would require amendments to the law and consultation with stakeholders.
A separate proposal would make it easier for users to request the removal of deepfakes and non-consensual intimate images directly from platforms, without first going through the police or courts.
Why it matters: Platforms serving Indian users should monitor potential changes to content liability and prepare for faster, user-initiated content removal requests.
Whistleblowing news
UK whistleblowing tribunal claims jump more than 1,150%
Employment tribunal claims involving whistleblowing in the UK have increased sharply, according to a November 6 report by Compliance Week.
Figures from the Presidents of the Employment Tribunals show that claims rose from 547 in 2023/24 to 6,842 in 2025/26, an increase of more than 1,150%.
Experts have suggested several possible reasons, including greater awareness of whistleblowing rights, weaknesses in workplace reporting processes, and AI tools making it easier for individuals to prepare claims.
Meanwhile, the UK government is consulting on possible reforms to whistleblowing protections, including creating an Office of the Whistleblower.
The consultation remains open until January 8, 2027.
Why it matters: Employers should review their internal whistleblowing processes and make it easier for employees to report concerns confidentially and receive timely responses. Trusted reporting channels may help organizations address issues before they escalate into legal disputes.
Until next week
That's it for this week. We'll be back next week with more privacy, accessibility, and digital compliance developments businesses need to know.
Adam is the Head of Digital Marketing at Clym, where he leverages his diverse expertise in marketing to support businesses with their compliance needs and drive awareness about data privacy and web accessibility. As one of the company’s original team members, Adam has been instrumental in shaping its journey from the very beginning. When he’s not diving into marketing strategies, Adam can be found cheering on his favorite sports teams or enjoying fishing.
