Privacy Roundup: Top 10 Stories of July 2025

From new state laws and enforcement actions to global breaches and AI-specific guidance, here are the top 10 stories you need to know from July.

The Tennessee Information Protection Act is now live (as of July 1), and Minnesota’s Consumer Data Privacy Act will follow on July 31. They join a growing list of US states like California, Virginia, and Texas, advancing privacy legislation this year. If your business targets users in these regions, it’s time to revisit your compliance setup. Read more

Ireland’s DPC has launched another investigation into TikTok, questioning whether it’s still moving EU user data to China, months after a €530 million fine. The probe revives concerns about the platform’s cross-border compliance. Read more

Italy’s privacy watchdog, the Garante, has fined a car dealership €45,000 for sending marketing emails without valid consent and ignoring data access requests. The decision underscores the authority’s preference for double opt-in as a best practice for consent under GDPR. Read more

On 22 July 2025, France’s data protection authority, the CNIL, formally adopted comprehensive recommendations focused on applying GDPR requirements to AI system development, particularly large language models and systems trained on personal data. Read more

Qantas confirmed a major cyberattack compromised the data of 5.7 million customers, including emails, dates of birth, and frequent flyer numbers. While no passwords or payment info were exposed, authorities are investigating possible ransom motives as the airline takes legal steps to prevent misuse. Read more

General Motors and OnStar are being sued by Nebraska for allegedly harvesting and selling user location and driving data without consent. This follows an FTC investigation and adds heat to the growing auto-privacy debate. Read more 

The Connecticut Attorney General’s Office has issued the first-ever enforcement under the state’s new Connecticut Data Privacy Act (CTDPA). Online ticketing platform TicketNetwork was fined $85,000 for violating privacy rights. Read more

From California to Connecticut, at least six US states are building in-house privacy enforcement teams with tech and cybersecurity expertise. This marks a new phase in privacy regulation, with more technical scrutiny of how companies manage user data. Read more

New York has enacted the first U.S. law regulating AI companions. Starting November 2025, these apps must clearly disclose that they are not human and include safeguards to detect and respond to signs of suicidal ideation or emotional distress. Read more

Google’s Gemini AI has default permissions that let it access user data from apps like WhatsApp, Gmail, and Calendar, often without users realizing it. Privacy advocates argue this oversteps boundaries by weakening Android’s permission model and creating a blurred line between user control and automated system behavior. Read more