This Week in Privacy: Sep 21-27, 2026

·9 events covered
AppleDiscordFacebookGoogleLinkedInTikTokX (Twitter)

This week brought a rare $250 million settlement from Apple over AI marketing claims, while European regulators hit Google with a massive €403 million fine for location tracking violations. The week highlighted how companies face consequences for both overpromising features and underdelivering on transparency.

Top Stories

Apple Settles AI Marketing Lawsuit for $250 Million

Apple agreed to pay $250 million to settle a class action lawsuit claiming the company misled customers about AI-enhanced Siri features. The case centered on Apple's WWDC 2024 announcements, where the company previewed AI capabilities that plaintiffs say created false expectations for the iPhone 16 launch. Those upgraded Siri features didn't actually arrive until iOS 27 in September 2026, years after customers made their purchases. US residents who bought an iPhone 15 Pro, iPhone 15 Pro Max, or any iPhone 16 model between June 2024 and March 2025 can file claims through December 21, 2026. The settlement represents one of the larger payouts for marketing misrepresentation in tech, though it's still a fraction of Apple's quarterly revenue.

Google Fined €403 Million for Location Tracking Violations

Ireland's Data Protection Commission fined Google €403 million for violating GDPR between May 2018 and February 2020. The regulator found Google processed user location data unlawfully and unfairly, specifically failing to handle web and app activity, location history, and location accuracy data transparently. Google must bring its practices into compliance within six months. The fine joins a growing list of GDPR penalties against major tech companies, though Google has faced limited enforcement pressure from Ireland in recent years compared to other EU member states.

LinkedIn Wins Settlement Against Data Scraping Operations

A California federal judge finalized a settlement requiring software companies ProAPIs and Netswift to permanently stop scraping LinkedIn data, delete all previously collected information, and cease using fake accounts to access the platform. LinkedIn alleged the companies created millions of bogus accounts, adding hundreds or thousands daily, to continuously harvest member profiles, company information, school data, and user interactions including reactions, comments, and posts. Even as LinkedIn blocked accounts within hours, the companies allegedly kept creating new fakes to maintain access. The settlement demonstrates the ongoing cat-and-mouse game between platforms and data scrapers, though enforcement remains challenging when operations simply resurface under new names.

In Brief

  • TikTok agreed to pay a £12.7 million UK fine for unlawfully processing children's data, withdrawing its appeal and making the 2023 penalty final.
  • A New Mexico jury is deliberating whether Facebook violated state consumer protection law over a 2014 incident where apps accessed user data to create targeted political ads affecting 9.7 million users.

The Big Picture

This week's events reveal a maturing enforcement environment where consequences for privacy violations are becoming both more substantial and more diverse. We're seeing traditional GDPR fines hitting hundreds of millions of euros, class action settlements reaching similar scales, and platforms taking more aggressive stances against data scraping operations. At the same time, the US government's intervention in X's EU case signals growing geopolitical tension around cross-border digital regulation. Companies can no longer treat privacy compliance as optional or marketing claims as inconsequential. The financial and reputational costs are real, whether they come from regulators in Dublin, juries in New Mexico, or judges in California.

This Week in Privacy: Sep 21-27, 2026 | PrivacyWire