App tracking fines, GPC rules, and accessibility updates
This week: France fines Fnac €7M over app tracking, California proposes GPC rules, and EU reports reveal ongoing accessibility challenges.
Weekly Compliance Brief: October 26 - 30, 2026
France fined Fnac €7 million after finding that its mobile app tracked users without valid consent. California proposed new rules for Global Privacy Control (GPC), while EU reports highlighted ongoing gaps in digital accessibility.
Here’s a look at the privacy, accessibility, and digital compliance developments businesses should know this week.
Data privacy law news
CNIL fines Fnac €7 million for tracking users without consent
France’s data protection authority (CNIL) fined two Fnac companies a combined €7 million after finding that their mobile app tracked users without valid consent. The decision was announced on October 29 following a complaint from privacy group noyb.
The investigation found that Fnac’s app shared user identifiers and browsing activity with a third party to provide product recommendations and train its recommendation algorithm, even when users had not agreed to tracking.
The companies now have one month to demonstrate that their new consent tool works correctly. Otherwise, they could face a €10,000 daily penalty.
California proposes new rules for Global Privacy Control
California’s privacy regulator, CalPrivacy, has proposed changes to its rules for handling opt-out preference signals.
The proposal specifically names Global Privacy Control (GPC), a browser or device setting that lets users automatically communicate their preference to opt out of certain personal data sales and sharing.
It also provides examples of how businesses should handle these signals across browsers, devices, and user accounts. Websites would be expected to clearly indicate when they honor an opt-out request, for example, by displaying “Opt-Out Request Honored.”
The CalPrivacy Board is expected to discuss the proposal at its November 5–6 meeting.
Quebec warns that misleading designs can invalidate consent
Quebec’s privacy regulator, the Commission d’accès à l’information (CAI), has published guidance on deceptive design practices, also known as dark patterns.
These are website or app designs that manipulate users into making choices they might not otherwise make.
The regulator warns that these practices can invalidate consent, potentially making the subsequent use or sharing of personal information unlawful.
The guidance explains common examples of deceptive design and offers recommendations for businesses.
Washington Supreme Court dismisses Meta Pixel wiretap claims
The Washington Supreme Court unanimously upheld the dismissal of privacy claims against Seattle Children’s Hospital involving the Meta Pixel.
The lawsuit alleged that the hospital’s website shared visitors’ communications with Meta through the tracking technology.
However, the court ruled that interactions between a person and an automated website do not qualify as communications “between two or more individuals” under the Washington Privacy Act.
The court did not decide whether the information was private or whether visitors had consented to the tracking.
EU privacy watchdog calls for stricter rules on traveler data sharing
The European Data Protection Supervisor (EDPS) has called for stronger privacy protections in a proposed agreement between the EU and the United States.
The agreement would allow authorities to exchange personal information, including biometric data, for border security and visa screening.
In its October 27 opinion, the EDPS recommended clearer limits on what information can be shared and when. It also called for individual assessments of data requests, greater transparency about further sharing, and stronger legal protections for affected travelers.
The EDPS noted that this would be the EU’s first agreement with a non-EU country involving large-scale biometric data sharing for border control.
Australia’s privacy regulator shares guidance on privacy impact assessments
Australia’s privacy regulator, the Office of the Australian Information Commissioner (OAIC), has published guidance on conducting privacy impact assessments (PIAs).
A PIA helps organizations identify and address privacy risks before introducing new systems, processes, or technologies.
Although the guidance primarily targets government agencies, the OAIC encourages other organizations covered by Australia’s Privacy Act to follow it.
The regulator recommends identifying potentially high-risk projects early and completing assessments while changes are still possible. It also shares lessons from recent investigations, including the use of AI in workplaces.
Web accessibility news
EU reports show uneven progress on digital accessibility
AccessibleEU, the European Commission’s accessibility resource center, published its 2025 monitoring reports on October 26.
The reports reviewed progress across all EU member states using 30 accessibility indicators.
While every member state has now incorporated the European Accessibility Act (EAA) into national law, accessibility performance still varies significantly between countries.
The reports also highlight progress in national accessibility strategies and training programs, while calling for stronger enforcement and better data collection.
EU study finds businesses struggle to put accessibility into practice
A new AccessibleEU study published on October 27 examined how 75 companies across the EU are implementing accessibility requirements under the European Accessibility Act (EAA).
The findings show that while businesses are increasingly aware of accessibility requirements, many still struggle to make accessibility part of their everyday operations.
Common challenges include complex regulations, unclear guidance, and limited internal expertise. Smaller businesses often face additional difficulties because they have fewer resources.
India extends digital accessibility deadlines for financial firms
India’s securities regulator, the Securities and Exchange Board of India (SEBI), has extended several digital accessibility deadlines to January 31, 2027.
The extension gives regulated financial organizations additional time to appoint certified accessibility auditors, assess their digital platforms, and address issues identified during audits.
The changes apply to stock exchanges, depositories, intermediaries, and other regulated organizations. All other requirements remain unchanged.
Content takedown news
Ofcom opens probes into intimate image abuse on adult platforms
The UK’s online safety regulator, Ofcom, opened investigations into two adult content platforms on October 26 under the Online Safety Act.
The investigations focus on whether the platforms properly assessed the risks of illegal content and took adequate steps to protect users from non-consensual intimate imagery (NCII).
NCII refers to private or intimate images shared without the consent of the person depicted.
The investigations are part of Ofcom’s broader efforts to address this type of online abuse.
EU accepts Temu’s plan to address illegal products
The European Commission accepted Temu’s action plan on October 26 after issuing a €200 million fine in May 2026 under the Digital Services Act (DSA).
The fine related to the platform’s handling of risks involving illegal products.
Temu’s plan includes five measures to improve how the platform identifies and addresses these risks.
These include assessing platform-specific risks, measuring the effectiveness of content moderation, reviewing recommendation systems, and identifying sellers who misuse platform features.
Temu must also submit an interim risk assessment within four months.
Whistleblowing news
DOJ launches new rewards program for fraud whistleblowers
The U.S. Department of Justice (DOJ) has launched a three-year pilot program offering financial rewards to people who report certain types of fraud.
Under the Fraud Whistleblower Incentive Program (WHIP), eligible whistleblowers can receive between $10,000 and $30,000 when their information leads to criminal charges.
Unlike some existing programs, whistleblowers do not have to wait for a case to be resolved before receiving a reward.
The program covers certain federal healthcare offenses and fraud involving benefit programs administered by eight federal agencies.
Reports can be submitted through an AI-assisted online portal, and there is no minimum financial loss required.
Until next week
That’s it for this week. We’ll be back with more privacy, accessibility, and digital compliance news to help you stay informed about developments that may affect your business.
Adam is the Head of Digital Marketing at Clym, where he leverages his diverse expertise in marketing to support businesses with their compliance needs and drive awareness about data privacy and web accessibility. As one of the company’s original team members, Adam has been instrumental in shaping its journey from the very beginning. When he’s not diving into marketing strategies, Adam can be found cheering on his favorite sports teams or enjoying fishing.
