Climate
Privacy
Bob Dylan
Drones
Data Centers
AI Governance
2026 Maine Senate Race
Key developments
California data broker deletions start August 1
ABC7 News's Luz Pena reports that more than 300,000 Californians are expected to have personal data deleted as California's Delete Act reaches its first enforcement deadline on August 1. Nearly 600 data brokers had to disclose registries and data types, and Alston & Bird Privacy's Santi Villar notes that brokers must retrieve DROP requests at least every 45 days, report status within 45 days, and maintain deletion lists. Unverifiable deletion requests must be treated as opt-outs of sale or sharing; noncompliance can trigger $200 plus expenses per request per day.
Why it matters
California is turning a one-stop consumer deletion request system into a recurring operational obligation for the data broker ecosystem.
Sources & driving stories
ABC7 NEWS · Luz Pena
ABC7 News coverageALSTON & BIRD PRIVACY · Santi Villar
Alston & Bird Privacy coverageGermany approves AI surveillance police powers
Deutsche Welle's Ben Knight reports that Germany's Bundestag approved a new Federal Police Law, the first since 1994, expanding powers for drones, AI-supported facial recognition, behavior recognition, and telecommunications surveillance. The law permits facial recognition in federally controlled public spaces such as airports, intercity rail stations, and border areas, and allows AI behavior-recognition alerts from surveillance footage. Critics, including digital-rights advocates and Amnesty International, warned of mass-surveillance infrastructure, racial profiling risks, and weak safeguards after real-time AI provisions were added shortly before the vote without a public hearing.
Why it matters
The law embeds AI surveillance into federal policing in a major EU member state and is likely to face constitutional and data-protection challenges.
Sources & driving stories
DEUTSCHE WELLE · Ben Knight
Deutsche Welle coverage23andMe states settlement approved in bankruptcy
GenomeWeb reports that a U.S. Bankruptcy Court in Missouri approved a settlement between Chrome Holding, successor to 23andMe, and 42 U.S. states over the 2023 breach affecting nearly seven million customers. Because 23andMe entered bankruptcy, the court authorized $18 million in payments to states, while also ordering the 23andMe Research Institute to implement protections for genetic information, including a data security advisory board, risk assessments, privacy-law compliance, and deletion mechanisms. The Tribune-Democrat's Eric Scicchitano reports that Pennsylvania's allocation is $491,902 and that state allegations focused on credential stuffing, weak multifactor-authentication enforcement, and insufficient logging and monitoring.
Why it matters
The settlement links bankruptcy resolution to ongoing safeguards for highly sensitive genetic data after one of the most consequential consumer DNA breaches.
Sources & driving stories
GENOMEWEB
GenomeWeb coverageTHE TRIBUNE-DEMOCRAT · Eric Scicchitano
The Tribune-Democrat coverageWorth noting
WORTH NOTING
Stardust shared reproductive health analytics
TechCrunch's Zack Whittaker reports Mozilla testing found Stardust shared birthdates, birth-control type, reproductive goals, and symptoms with RudderStack using a unique identifier, while Mozilla's 2026 review scored Stardust 2/10 and Euki 10/10 for privacy.
WORTH NOTING
EY disclosed tax-information breach
SC Media and Emery Reddy report Ernst & Young notified regulators after unauthorized access to a third-party support ticket system exposed tax-related personal and financial data, with notices filed in California and Vermont on July 15 and 16.
WORTH NOTING
Wyoming weighs data ownership bill
News Block's Lane Cassidy reports Wyoming lawmakers introduced a proposal to treat residents' personal data as private property and a companion measure to restrict license-plate reader collection and sharing of vehicle-location data.
Still unclear
OPEN QUESTION
Can DROP enforcement scale across brokers?
California's system depends on hundreds of brokers repeatedly matching, deleting, suppressing, and propagating requests across downstream service providers every 45 days.
OPEN QUESTION
Will Germany's law survive court review?
Germany's Constitutional Court has previously rejected disproportionate federal police surveillance powers, and critics say the new AI provisions arrived without adequate public scrutiny.