EU reforms and children's privacy
This week: EU states set their Digital Omnibus stance, California's $6M 23andMe deal, Canada's Children's Privacy Code, and a DSA probe into Booking.com.
Weekly Compliance Brief: October 19 - 23, 2026
EU member states agreed on their position on proposed GDPR and cookie rule changes, California announced a $6 million settlement involving 23andMe, and Canada introduced its first Children’s Privacy Code.
Here’s what happened this week in privacy, accessibility, and digital compliance, and what it could mean for businesses.
Data privacy law news
EU member states keep GDPR's personal data definition in Digital Omnibus deal
EU member states have agreed on their negotiating position for the Digital Omnibus, the European Commission's package to simplify the GDPR, the ePrivacy Directive, and other digital rules, IAPP reported on October 22.
The Council rejected a proposal to narrow what counts as personal data under the GDPR. Instead, it introduced additional standards for pseudonymized data.
Negotiations between the EU institutions can begin once the European Parliament agrees on its position. Website, analytics, and marketing teams should closely follow the cookie exemptions, as they could change when consent banners are required.
EU's Digital Fairness Act expected November 11
The European Commission is expected to present its Digital Fairness Act (DFA) on November 11, according to an October 22 analysis by IAPP's Isabelle Roccia.
The proposal focuses on misleading design practices, influencer marketing, addictive features, and personalization that exploits consumers. It may also address unfair practices in live-event ticket sales. A Commission consultation drew more than 4,300 responses.
Some of these practices are already covered by existing EU laws, raising questions about how the new rules would work alongside them. Ecommerce, UX, and marketing teams should review consent flows, subscription journeys, and personalization logic ahead of the proposal.
California secures $6M settlement from 23andMe over data breach
California Attorney General Rob Bonta announced a $6 million settlement with Chrome Holding Co., formerly 23andMe, on October 19. Pending bankruptcy court approval, it resolves claims tied to the 2023 breach that affected nearly 7 million customers, including more than 855,000 Californians.
The settlement also addresses concerns about selling customers’ genetic data without separate consent, as required under California’s Genetic Information Privacy Act. Consumers keep the right to have their data deleted and samples destroyed, no matter who owns them.
Bankruptcy does not erase privacy obligations, so companies holding sensitive data should treat security, deletion requests, and consent for data transfers in a sale or merger as core compliance work.
Canada launches its first Children's Privacy Code
The Office of the Privacy Commissioner of Canada (OPC) launched the country's first Children's Privacy Code on October 20, setting practical expectations for organizations that handle children's personal information.
The Code calls for parental consent for children under 13, explicit consent for non-essential data collection, and privacy-friendly default settings. It also discourages profiling children for targeted advertising. It also states that websites and apps cannot use deceptive design to push children into sharing more data.
The OPC is accepting comments until January 20, 2027. Websites, apps, and games used by Canadian young people should review their default settings, ad targeting, and interface design now.
Missouri sues Temu over covert data collection
Missouri Attorney General Catherine Hanaway filed a lawsuit against Temu, alleging its app covertly collects large amounts of personal information from users' devices.
Following a multi-year investigation, the Attorney General’s office claims the app can access users’ precise locations, microphones, cameras, and information about installed apps and accounts. It also alleges the app can change how it works without users knowing. The suit also claims Temu lacks adequate age-verification or parental-consent measures.
The case is part of a growing wave of state AG actions against app data practices. Ecommerce and app teams should ensure requested permissions match what their privacy notices disclose.
Spain's data breach notifications more than double
Spain's data protection authority (AEPD) said on October 21 that it had received more than 4,500 data breach notifications by September 1, 2026, compared with 2,735 in all of 2025.
Many reports came from tourism businesses affected by breaches at their third-party service providers. One breach at a large booking or management platform can trigger notifications from many companies at once.
The AEPD reminded organizations that they must notify reportable breaches within 72 hours under the GDPR. Privacy and security teams should review vendor due diligence and test their incident response plans.
Ninth Circuit: unauthorized disclosure alone is enough to sue
A US federal appeals court ruled that sharing someone’s sensitive health information without permission can be enough for them to file a lawsuit, even if they cannot prove financial loss.
The plaintiffs' data was mistakenly emailed to other plan members, and the court compared the harm to a breach of confidence, holding that a broken promise to keep information private is the injury, even without proof of financial loss.
The decision could make it easier for people to bring privacy lawsuits in states covered by the Ninth Circuit. Organizations should make sure their privacy policies match what they actually do, because those promises can now support a claim by themselves.
Norway's regulator says real-time bidding leaves users powerless
Norway’s privacy regulator warned about real-time bidding, the automated process used to buy and sell digital ads. According to an estimate the regulator cited, the average Norwegian’s data is shared with advertising platforms 340 times a day.
Section head Tobias Judin said websites and apps share data at enormous scale with an unknown number of companies, while each points to the others for responsibility. He also warned that foreign intelligence services can harvest this data and repeated the regulator's call to ban behavioral advertising.
Publishers and app owners should map which partners receive bid request data and make sure cookie and tracking choices are respected across the ad tech chain.
Web accessibility news
Outdated funding models keep assistive technology out of reach
A new report from the European Disability Forum highlights how different funding rules across EU countries make it difficult for people with disabilities to access the technology they need.
Many countries still fund one-off purchases, which do not cover subscription-based tools, connected devices, software updates, or technical support. Users can also lose access to devices they have used for years when they move to another member state.
Assistive technology helps many people access websites and apps. Testing with a range of tools, including older versions, can help address accessibility barriers for users who cannot easily upgrade.
75% of UK digital identity services meet accessibility standards
The UK's Office for Digital Identities and Attributes (OfDIA) reported that about three-quarters of certified digital identity services now meet WCAG 2.0 AA or higher, the highest level in three years.
While accessibility has improved, half of biometric identity services still don’t offer an alternative to facial recognition or fingerprint scans. This can create barriers for people who cannot use these methods.
As identity checks spread to age verification and onboarding flows, businesses should confirm that their verification providers meet accessibility standards and offer alternative routes.
Small retailer's ADA settlement shows the risk of third-party apps
Candycopia, a candy retailer in Oak Park, Illinois, faced a five-figure settlement over its website's accessibility, the Wednesday Journal reported on October 20.
The retailer relied on outside developers and third-party Shopify apps, but still faced an accessibility lawsuit. UsableNet projects more than 6,000 digital accessibility lawsuits in 2026, with ecommerce accounting for about 79% of targeted businesses.
Third-party apps can introduce accessibility barriers, even when a website’s own design has been tested. Businesses should include plugins, checkout tools, and other third-party components in their accessibility reviews.
Content takedown news
EU opens DSA probe into Booking.com over scam listings
The European Commission opened formal proceedings against Booking.com under the Digital Services Act (DSA) on October 21.
The investigation will examine whether the platform properly assessed and reduced the risks of fraudulent listings, including non-existent properties, and whether it removes them effectively. It will also look at phishing scams that misuse reservation data and whether paid boosted listings are clearly labeled as ads.
For online marketplaces and booking platforms, removing fraudulent listings may not be enough. Regulators are also looking at how companies identify and reduce these risks.
Ofcom says most Online Safety Act fines remain unpaid
Ofcom Chief Executive Melanie Dawes told UK lawmakers on October 20 that only two of the 11 fines issued under the Online Safety Act have been paid.
Several companies facing fines are based outside the UK, and some have blocked UK users from accessing their services rather than paying. Dawes said Ofcom may not be able to recover every fine, especially if foreign courts obstruct enforcement.
Collection problems do not reduce obligations for UK-facing platforms. Companies serving UK users should still expect investigations, information requests, and penalties for content and safety failures.
Whistleblowing news
DOJ will pay fraud whistleblowers before convictions
The US Department of Justice launched a new program that rewards people for reporting certain types of fraud. The three-year pilot has $25 million in funding.
Whistleblowers may receive between $10,000 and $30,000 for qualifying tips once criminal charges are made public, rather than waiting until a case concludes. The program covers federal health care fraud and fraud on programs run by agencies such as HHS, USDA, and the SBA.
Faster payouts make external reporting more attractive. Organizations receiving federal funds should ensure internal reporting channels are trusted and that complaints are investigated quickly.
Until next week
That’s a wrap for this week. Thanks for reading, and we’ll see you next week for more updates on privacy, accessibility, and digital compliance.
Adam is the Head of Digital Marketing at Clym, where he leverages his diverse expertise in marketing to support businesses with their compliance needs and drive awareness about data privacy and web accessibility. As one of the company’s original team members, Adam has been instrumental in shaping its journey from the very beginning. When he’s not diving into marketing strategies, Adam can be found cheering on his favorite sports teams or enjoying fishing.
