On May 8, 2026, California Attorney General Rob Bonta — joined by the District Attorneys of San Francisco, Los Angeles, Napa, and Sonoma Counties, with support from the California Privacy Protection Agency (CalPrivacy) — announced a $12.75 million settlement with General Motors and OnStar (collectively, “GM”) over the alleged unlawful sale of California drivers’ geolocation
Continue Reading U.S.: California’s GM Settlement: Has Data Minimization Finally Arrived?U.S.: Seventh Circuit Holds BIPA’s 2024 Damages Amendment Applies Retroactively
In 2024, the Illinois General Assembly amended the Illinois Biometric Information Privacy Act (“BIPA”) to clarify that an individual cannot seek recovery for multiple alleged violations of BIPA when those violations concern the same person, defendant entity, and method of collection.
On April 1, 2026, the Seventh Circuit issued its decision in Clay v. Union
Continue Reading U.S.: Seventh Circuit Holds BIPA’s 2024 Damages Amendment Applies Retroactively
U.S.: Illinois Law Trumps Meta’s California Choice-of-Law Provision in BIPA Class Action
A recent federal court decision raises questions about the enforcement of contractual choice‑of‑law provisions in the context of a case brought under Illinois’s Biometric Information Privacy Act (BIPA).
In Hartman, et al. v. Meta Platforms, Inc., the U.S. District Court for the Southern District of Illinois denied Meta’s motion for summary judgment seeking to
Continue Reading U.S.: Illinois Law Trumps Meta’s California Choice-of-Law Provision in BIPA Class Action
Europe/Germany: Right to bring collective action for violations of information obligations under GDPR
Summary
In its judgement of 11 July 2024 (C-757/22), the European Court of Justice (‘ECJ’) ruled that the violation of a controller’s information obligations under Art. 12 and 13 GDPR, can be subject to a representative action under Article 80(2) GDPR.
Facts of the case
Meta Platforms Ireland Limited (“
Continue Reading Europe/Germany: Right to bring collective action for violations of information obligations under GDPR