Content Category
On October 21, 2026 TransUnion unveiled Transaction Matching, which uses Fiserv's Unknown Shopper solution to link dip, tap and wallet payments to customer identities. Red Lobster is the only named merchant; no match rate was given.
Why it matters
Linking in-store payments to people supports loyalty and CRM, but raises consent and privacy questions about cards as identifiers.
The UK Information Commissioner's Office published a 37-page call for evidence on agentic AI on October 8, 2026. Responses close November 20; the evidence will inform guidance and a statutory code, and an adtech report is planned later in 2026.
Why it matters
Agents that act for users raise controller and lawful basis questions, and adtech is explicitly in scope.
On October 21, 2026 the Federal Court of Justice (BGH) set aside four Dresden judgments that ordered SCHUFA to disclose how scores were calculated, finding Article 22 GDPR applies but the lower court's findings were insufficient. Written reasons are unpublished.
Why it matters
Scores used by lenders and retailers for pay-later and credit decisions face transparency duties that affect any business using them.
noyb published on October 21, 2026 closing notices dated September 24 from the Berlin authority on the CDU, SPD, Greens and Die Linke. noyb says the parties had no legal basis for targeting voters by political interest in 2021; no fine is reported.
Why it matters
Political opinion is special category data under GDPR, so targeting on it needs explicit consent, which affects advertisers and platforms in the EU.
On October 21, 2026 Santa Fe judge Francis Mathew ordered Meta to pay $25 billion after jurors found more than 43 million violations. He found a penalty above $219 billion warranted, then reduced it. Meta plans to appeal.
Why it matters
It shows that privacy and safety statements by platforms can carry very large liability, with consequences for ad revenue and compliance.
On October 14, 2026 attorneys general from 39 states and DC filed a 28-page notice in Character.ai's Delaware bankruptcy case, setting nine conditions for any buyer of the app or user data. Eleven states did not join.
Why it matters
User chats can contain intimate information, and a bankruptcy sale is a rare moment when it could change hands.
noyb's Annual Report 2025, published October 13, 2026, reports 21 new complaints, 460 pending cases and a surplus of about €280,630. CEO Max Schrems says work on the EU Digital Omnibus limited resources for other matters.
Why it matters
noyb's complaints have driven major rulings in ad tech and consent, so its capacity affects enforcement risk for marketers.
On October 13, 2026 the European Data Protection Board adopted an eight-page preliminary statement on smart glasses. It says makers and AI service providers may be controllers and a terms clause asking wearers to inform bystanders is not enough.
Why it matters
Camera glasses record bystanders who cannot consent, and any product that sends such data to AI services will face these questions.
Norway's data protection authority fined Xandr NOK 92 million (about €8.5 million) in a decision dated October 2, 2026 and made public October 12. It found Xandr handled Grindr users' special category data without valid consent.
Why it matters
It shows that platforms in the bidding chain can be held responsible as joint controllers for consent they did not verify.
A regulation published October 10, 2026 takes effect November 1. It bars under-15s from social media and requires a state token confirming only whether a user is 15+ or 18+; existing accounts must be verified by March 31, 2027.
Why it matters
State-issued tokens are a different model from platform self-checks, and other countries may copy it.
