Ad tech fines and platform duties
This week: Norway fines Xandr NOK 92M, SCOTUS hears VPPA pixel case, Italy's email pixel rules near, and the UK and Australia push whistleblowing and safety rules.
Weekly Compliance Brief: October 12 - 16, 2026
Norway issued its largest-ever privacy fine against Microsoft's Xandr, the US Supreme Court weighed how a 1980s video privacy law applies to tracking pixels, and the UK proposed its biggest whistleblowing overhaul in decades.
Here are the privacy, accessibility, and digital compliance developments worth knowing this week.
Data privacy law news
Norway hands Microsoft's Xandr its largest-ever privacy fine
Norway's data protection authority, Datatilsynet, fined Microsoft-owned ad tech company Xandr NOK 92 million on October 12, the regulator's largest-ever penalty.
The regulator found Xandr passed Grindr users' data, including information revealing sexual orientation, to potentially thousands of companies through real-time bidding without valid explicit consent. Xandr argued it relied on Grindr to collect consent, but Datatilsynet ruled the two were joint controllers.
For publishers and ad tech partners, the takeaway is clear: every company in the chain must prove its own legal basis, and relying on a partner's consent isn't enough.
Supreme Court weighs whether video privacy law covers pixel tracking
The US Supreme Court heard oral argument on October 14 in Salazar v. Paramount Global, a case on how the 1988 Video Privacy Protection Act (VPPA) applies online.
The plaintiff says Paramount's 247Sports.com shared his video-viewing history with Facebook through the Meta Pixel after he signed up for its newsletter. The Sixth Circuit dismissed the claim, ruling that a VPPA "consumer" must specifically subscribe to audio-visual content.
The decision could determine whether any newsletter or account signup on a video-enabled site opens the door to VPPA claims worth up to $2,500 per person. Sites that pair embedded video with tracking pixels should review their tag and consent setup now.
Washington high court rejects Meta Pixel claims against hospital
On October 8, the Washington Supreme Court unanimously upheld the dismissal of a class action claiming Seattle Children's Hospital violated the Washington Privacy Act (WPA) by using the Meta Pixel on its public website.
The court held that the WPA only covers private communications "between two or more individuals," and a visitor's searches on a website do not meet that test.
The ruling benefits organizations using ad tech pixels, but it applies only to Washington law. Pixel claims under other state wiretap laws and the VPPA remain an active risk for website operators.
Italy's email tracking pixel rules take effect October 29
Organizations emailing recipients in Italy have until October 29, 2026, to comply with the Italian Data Protection Authority's (Garante) guidelines on tracking pixels in emails.
The Garante treats email pixels like cookies under Italy's ePrivacy rules. They must disclose their use in advance, and consent is generally required unless an exemption applies, such as anonymized, aggregate open-rate counting.
Marketing and CRM teams should audit their email platforms, update privacy notices and signup forms, and confirm where consent is needed for engagement tracking.
Michigan restricts manufacturer access to dealer customer data
Michigan Governor Gretchen Whitmer signed the Motor Vehicle Dealer Data Collection Act on October 9, and it took effect immediately.
Manufacturers and third parties can no longer require direct access to dealer data systems, and they need the dealer's separate, prior express written consent to access or share consumer data stored there. Dealers can revoke that consent, and manufacturers cannot tie it to incentive payments.
Automotive marketers, data vendors, and integrators should review their data-sharing agreements and integrations with Michigan dealers.
Turkey sets limits on employer monitoring of work email
Turkey's Personal Data Protection Board published a Principle Decision on October 8 setting the rules for employers monitoring corporate email and other work communication channels.
Employers must inform staff in advance and in specific terms, limit monitoring to legitimate and proportionate purposes, and review message content only when there is a concrete need. The Board also said employee consent often cannot serve as the primary legal basis, given the power imbalance at work.
Organizations with Turkish operations should review acceptable use policies, employee privacy notices, access logs, and how they handle former employees' accounts.
Revolut to cover ID costs after sending customer data to hackers
Revolut will pay for affected customers to replace identity documents after the bank sent the personal data of 680 customers to hackers posing as an Italian police agency, its Western Europe CEO said on October 7.
The attackers used an address never used before on the Reggio Calabria police email system. Italy's interior minister told lawmakers that Revolut should have verified the request with minimal due diligence.
The incident shows that law enforcement data requests need verification too. Privacy and security teams should confirm how they authenticate official requests before disclosing personal data.
Web accessibility news
Two in three website accessibility lawsuits target smaller businesses
Seyfarth Shaw counted 5,006 federal ADA Title III lawsuits in the first half of the year, up about 9% and the highest first-half total since 2021. UsableNet data shows about two in three website and app lawsuits targeted companies with under $50 million in annual revenue, and nearly four in five involved ecommerce.
With WebAIM finding WCAG failures on about 96% of top home pages, smaller online businesses cannot assume they are too small to be targeted. Regular testing and remediation can help address accessibility barriers and reduce legal exposure.
Content takedown news
Australia introduces online duty of care bill with A$109.2M penalties
Australia's government introduced the Online Safety Amendment (Digital Duty of Care) Bill 2026 to Parliament on October 15.
The bill would require social media, gaming, app, and AI chatbot providers to identify and reduce serious-harm risks, meet minimum complaint-handling standards, and let users aged 16 and over opt out of algorithmic feeds. Penalties could reach A$109.2 million, and the eSafety Commissioner would gain new powers to restrict access to apps and sites used to create fake nude images.
The bill still needs Senate approval after an inquiry, but platforms serving Australian users should start mapping their risk assessment and complaints processes now.
Meta challenges how Ofcom calculates Online Safety Act fines
Meta's legal challenge to Ofcom's rules for calculating Online Safety Act fees and penalty caps was heard in London's High Court on October 13 and 14.
Meta argues that Ofcom should use UK revenue rather than worldwide revenue, and should not pool revenue across a corporate group. Under the Act, fines can reach 10% of qualifying worldwide revenue or £18 million, whichever is greater.
A written judgment is expected in the coming weeks or months. The outcome will shape the financial exposure of every large platform regulated under the UK's online safety regime.
Whistleblowing news
UK proposes mandatory whistleblowing procedures and rewards for fraud tips
The UK government opened a consultation on October 12 on what could be the biggest overhaul of its whistleblowing framework in almost 30 years, alongside a proposed Serious Fraud Office (SFO) reward scheme.
Proposals include a statutory duty for private employers with 50 or more staff to operate effective whistleblowing procedures, backed by civil penalties, and doubling the window to seek interim relief after dismissal from 7 to 14 days. The SFO scheme would pay whistleblowers a percentage of the penalty in economic crime cases.
The consultation closes January 8, 2027. Compliance and HR teams should benchmark their reporting channels, follow-up processes, and anti-retaliation policies against the proposals.
Until next week
That's it for this week. We'll be back next week with the privacy, accessibility, and digital compliance developments businesses need to know.
Adam is the Head of Digital Marketing at Clym, where he leverages his diverse expertise in marketing to support businesses with their compliance needs and drive awareness about data privacy and web accessibility. As one of the company’s original team members, Adam has been instrumental in shaping its journey from the very beginning. When he’s not diving into marketing strategies, Adam can be found cheering on his favorite sports teams or enjoying fishing.
