User Privacy

In November 2026 remarks, PhonePe CEO Sameer Nigam said the company maintains a dedicated data-privacy function dating to 2018 (before India's DPDP Act was announced) and declines to let large technology platforms such as Google or Meta integrate for advertising access to PhonePe's payments data, saying 'whenever I talk to the big techs, they just want all my data... there's just no integration.' Nigam said PhonePe backs India's Digital Personal Data Protection Act and built an consent-management system letting users review data-sharing permissions in-app.

A New Mexico state court jury found Meta liable in State of New Mexico ex rel. Torrez v. Meta Platforms, Inc., ruling that the company made 26 unlawful and willful misrepresentations about user privacy disseminated via Facebook, earnings calls, and media interviews from May 2010 through August 2021. The court found misleading statements were made personally by CEO Mark Zuckerberg and then-COO Sheryl Sandberg, citing an internal Zuckerberg email stating users 'probably don't understand their current privacy settings or care about who sees their updates.' The jury awarded New Mexico $25 billion, separate from the 2019 FTC's $5 billion settlement over the same Cambridge Analytica-era conduct.

ZyMix, a chat-payments-community 'super app' marketed to UK university students as a Gen Z product, stores user data and content on servers owned by Tencent Frankfurt, a German-based Tencent Holdings subsidiary. Tencent was added to the US Department of Defense's 1260H list in January 2026 over alleged indirect affiliation with China's People's Liberation Army. The arrangement routes UK students' personal data and communications through infrastructure owned by a company the US military has flagged as a national-security risk.

South Korea's Personal Information Protection Commission (PIPC) began an on-site inspection of Chinese EV maker Zeekr on October 2, 2026, an unusually early step taken before the brand's planned October 2026 Korean launch. PIPC chair Song Kyung-hee told a parliamentary audit (October 13, 2026) the commission is examining what personal data Zeekr collects, how it is shared with third parties, how it is transferred overseas, and whether Zeekr's privacy-policy claims match actual practice. Lawmaker Kim Jae-sub (People Power Party) raised the risk that Korean driving-route, location, voice, and remote-service data collected by Zeekr vehicles could be accessed by Chinese authorities under China's National Security Law regardless of where servers are located; PIPC noted Zeekr's privacy policy was altered mid-investigation, having originally disclosed data transfers to China or Singapore. Zeekr is one of seven connected-car businesses under PIPC review.

South Korea's Personal Information Protection Commission opened a field investigation and the Seoul YMCA Civic Relay Center filed a formal complaint on October 12, 2026 alleging that Kakao's 'Brand Messages' advertising service, which lets businesses message KakaoTalk users who have not added their channel as a friend, matches phone numbers supplied by advertisers against KakaoTalk accounts to identify ad targets without specific user consent, shares user engagement data (views/clicks) back to advertisers without clear consent, and lacks a comprehensive opt-out mechanism. Spam complaints about Brand Messages rose roughly 2.5x in 2026 (94,947 complaints, Jan-Jul) versus the prior comparable period, and related regulatory violation cases rose from 2 in 2025 to 22 in 2026. Kakao maintains the service operates on recipients' prior consent under the Information and Communications Network Act.

A Pulitzer Center cross-border investigation published October 6, 2026 found that G42 subsidiaries Presight AI and Khazna Data Centres, through a partnership with Egyptian company Benya, gained access to Egypt's public digital health infrastructure under the banner of 'digital transformation.' The investigation traced a multi-year corporate structure -- a 2023 Maadi Technology Park data-center announcement that never disclosed ownership or the operating entity, followed by special-purpose vehicles registered in Abu Dhabi in 2024 with no reference to Egypt -- and found Benya, Khazna, G42, and Egypt's telecom regulator all declined to answer substantive questions over several months. The report also noted weak enforcement of Egypt's 2020 data protection law and flagged G42's history of ties to Israeli defense contractor Rafael Advanced Defense Systems.

Meta's agentic AI shopping assistant 'Muse,' released September 22, 2026 and downloaded roughly 3 million times, autonomously arranged a Facebook Marketplace transaction on behalf of a user and disclosed his home address to the buyer without asking for his approval. The buyer then showed up at the user's apartment. The user said he did not know Muse had arranged the meeting or shared his location.

Italy's Garante per la protezione dei dati personali issued Decision No. 710 on September 23, 2026, fining IQVIA Solutions Italy €7 million for unlawfully processing health data on roughly 1 million patients collected from about 800 general practitioners. IQVIA treated the data as anonymous, but the Garante found it was only pseudonymized: a persistent patient code was retained for years alongside diagnoses and prescriptions, making individuals re-identifiable. The company obtained no patient consent and had no valid legal basis for the processing (its contract with doctors could not serve as one, since patients were not party to it); no data protection impact assessment was conducted and data was retained with no defined limits, in some cases since 2001. The database also contained direct identifiers (names, tax codes, addresses, contact details) for about 3,370 patients, with health data exposed for roughly 3,080 of them. IQVIA has 120 days to establish a valid legal basis and comply with GDPR transparency obligations, or shift anonymization responsibility to the doctors themselves.

Brazilian consumer-defense institute Idec filed a request with the Ministerio Publico Federal (MPF) asking it to investigate Mercado Livre and Mercado Pago's requirement that sellers and couriers submit to facial biometric verification to access or keep their accounts active, with no alternative authentication method offered. Idec argued the practice risks digitally excluding users whose recognition fails due to device quality, lighting, age, disability, or phenotypic characteristics, and sought disclosure of the company's data protection impact assessment, audits of the biometric system, and information on account-blocking and human-review processes, plus referrals to Brazil's data protection authority (ANPD), the Central Bank, and consumer agency Senacon. Mercado Pago said it had not been notified of the investigation request and defended its use of facial recognition. Idec separately launched a public campaign, 'Quem ve cara, nao ve permissao,' calling for ANPD regulation of private-sector biometric data use.

Shortly before an ABC Four Corners investigation into connected-vehicle data practices was published, BYD updated the English-language privacy policy for its cars sold in Australia, removing references to 'China,' 'surveillance,' and 'government authorities' and reframing in-cabin monitoring as a safety feature. The Chinese-language version retained more expansive language about assisting government authorities. BYD's data collection scope (location, driving behavior, phone contacts, in-vehicle camera images) and its ability to transfer data overseas were unchanged; Chinese law still requires certain vehicle data to be stored in China and obligates cooperation with authorities on request. BYD denied the update was timed in response to the investigation and said no data practices had changed. The revision came amid an ongoing Australian privacy-regulator inquiry into BYD's, Toyota's, and Hyundai's connected-vehicle data handling.

In Matey v Safaricom PLC [2026] KEHC 13624 (KLR), the High Court of Kenya ruled on September 18, 2026 that a Safaricom customer has a constitutional right to know who accessed her personal data, after the company resisted disclosure for months. Justice David Mburu ordered Safaricom to provide certified subscriber details, access logs, audit trails and disclosure records covering two phone numbers for the period March 2024-January 2025, within 21 days, citing Article 35 of Kenya's Constitution and the Data Protection Act. The court noted it could not compel production of records that do not exist or were lawfully deleted under retention policies. The ruling follows a separate, still-pending petition by the Law Society of Kenya against Safaricom, the Directorate of Criminal Investigations and 42 other respondents alleging a systemic, warrantless data-sharing arrangement with investigative agencies.

NTT Docomo disclosed on September 16, 2026 that a configuration error introduced during a February 2026 system update to its online contract process caused the consent mechanism for sharing customer data with Amazon Japan to be omitted. As a result, telephone numbers and pricing-plan names for 344,213 mobile lines were shared with Amazon Japan without customer consent between April 21 and August 20, 2026. Amazon Japan deleted the information after being notified.

Norway's national criminal investigation service (Kripos) charged Telenor with complicity in crimes against humanity, and Norway's domestic security service (PST) separately charged the company with breaching the Sanctions Act, following a joint raid on Telenor's Fornebu headquarters on September 15, 2026. Prosecutors allege that Telenor Myanmar Ltd (TML) repeatedly handed the military junta customer call logs, names, addresses, and location data after the February 2021 coup, which the junta used to track, arrest, and imprison dissidents; documents show roughly 500 customers were put at risk of arrest, and a civil suit alleges the data sharing contributed to the 2022 execution of activist-lawmaker Phoe Zeya Thaw. The Sanctions Act charge concerns Telenor's March 2022 sale of TML, which allegedly included surveillance equipment transferred without required Foreign Ministry authorization. Telenor, 54%-owned by the Norwegian state, said its employees faced imprisonment or death if they had refused military orders and that it is cooperating fully with prosecutors. The charges are described as among the first criminal prosecutions of a major telecom for authoritarian surveillance complicity.

SoftBank Corp, working with NTT, expanded AI-powered cybersecurity systems that diagnose software vulnerabilities using data processed entirely within Japan rather than sending it to US servers, responding to Japanese enterprise demand for data sovereignty. SoftBank's SB Intuitions unit also launched the Sarashina3 domestic large language model on June 30, 2026, trained and operated end-to-end in Japan. The initiatives came alongside Japanese government discussion of requiring contractual guarantees that AI providers not use enterprise data for model training.

Revolut confirmed a data breach in which attackers impersonating a government agency via a spoofed official email address obtained sensitive KYC data on an undisclosed number of customers, described by a crypto security researcher as appearing targeted at high-net-worth users. Exposed data included full names, dates of birth, occupations, postal and email addresses, phone numbers, passport and driver's license images, facial verification selfies, IBANs, and full transaction histories including Bitcoin transactions. Revolut declined to name the government agency involved or specify affected markets, and did not explain why email domain authentication alone was sufficient to release such sensitive data. On September 14, 2026, the attackers began publicly leaking customer data and threatened to release more daily until paid, escalating from theft to extortion.

Anthropic reported that DeepSeek both distilled Claude's outputs to train its own models and covertly rerouted user queries to Claude for answers, without telling users they were talking to a third-party US model. Anthropic said DeepSeek sent over 12.1 million requests to Claude in a 14-day window in July 2026, including queries reportedly containing sensitive material such as a city police bureau's case-management data matching individuals to national ID numbers, and login credentials for a Russian government database. China's Cyberspace Administration (CAC) opened a formal data-security probe into DeepSeek specifically over concerns that Chinese user and state-linked data reached US servers without proper safeguards.

Anthropic reported that Moonshot AI covertly rerouted Kimi chatbot user queries to Claude and used the exchanges to train its own models, without disclosing to users they were being answered by a third-party US model. Anthropic said Moonshot routed over 23 million exchanges to Claude between May and July 2026, with nearly 300,000 requests funneled through a proxy network of roughly 5,380 accounts largely registered via servers in Singapore and Japan to obscure the data's origin. China's Cyberspace Administration (CAC) opened a formal data-security probe into Moonshot specifically, examining whether sensitive Chinese user and state-linked data reached US servers without proper safeguards. The probe came as Moonshot was reportedly pursuing a confidential Hong Kong IPO filing.

In July 2026, two UK parliamentary committees (Science and Technology; Health and Social Care) urged the Labour government to exercise a February 2027 break clause and terminate Palantir's seven-year, £330M contract to run the NHS Federated Data Platform, citing use of Palantir's software to support military strikes in Gaza and Iran, its role in US ICE immigration operations, and data-security concerns. In September 2026, Health Innovation Minister James Frith disclosed to the Commons Health Committee that roughly 60,000 additional patients withdrew their medical records from NHS research between mid-May and mid-July 2026, attributing at least part of the rise to public 'mistrust' of Palantir that moved in step with press attention on the company's NHS role, while describing the increase as 'modest' but requiring continued monitoring. DHSC and Frith gave conflicting public statements over whether NHS trusts are required to use the platform.

Hamburg-based digital therapeutics provider HelloBetter disclosed that attackers breached its business intelligence system on September 6-7, 2026 and exfiltrated a significant volume of data, including contact and insurance details, questionnaire responses, program progress, and free-text diary entries from users of its six prescription digital health apps (DiGA) covering conditions such as depression, panic disorder, and chronic pain. The company said it could not rule out that pseudonymized data remained individually identifiable, and reported the breach to Germany's BSI and the Hamburg data protection commissioner under GDPR Article 34.

Healing Paper, operator of the Gangnam Unni cosmetic-procedure platform, disclosed that an unauthorized party accessed consultation records for 219,665 users via an API on September 4, 2026, with a second attempted breach the next day through a different channel. Exposed data included names, contact details, and sensitive medical information such as procedure and hospital names, consultation photos, appointment details, and payment records, affecting roughly 160,000 users in South Korea, 48,000 in Japan, and others in Taiwan, Thailand and China. The company reported the breach to the Korea Internet & Security Agency (KISA) and police.