Dechert Cyber Bits

Happy 5th Anniversary to Dechert's Cyber Bits!

Five years ago, our global Cyber, Privacy and AI team launched Cyber Bits with a simple goal: to keep you informed on what matters most in privacy, cybersecurity and AI. Today, we're proud of how far it's come, and that's thanks to you, our readers.

Behind every issue is a team committed to tracking developments from around the globe and distilling them into clear, actionable guidance. Our focus remains the same as it was on day one: cutting through the noise to tell you what's happening and what it means for you.

As always, we welcome your feedback. Please send any suggestions to privacyandcybersecurity@dechert.com. We thank you again for your support!

UK ICO Marks New Chapter With New Governance Structure and Manchester Office Opening

On September 30, 2026, the UK data protection regulator adopted a new governance structure and new name. The Information Commissioner has been replaced by the Information Commission with the regulator now being led by a Board rather than a single Information Commissioner. The Board's non-executive members are now in place, and the process of recruiting a permanent Chair is underway. What was previously the Information Commissioner's Office is now the Information Commission’s Office and will continue under the same “ICO” brand. The ICO has also relocated to a new head office in Manchester.

Paul Arnold, Chief Executive of the Information Commission, said the governance and office changes are intended to make the organization “more connected to the people and organizations we serve” and “more capable of meeting the challenges of a rapidly changing digital world.” The ICO said the governance transition does not change the regulator’s core responsibilities, and that it will continue its regulatory work while preparing a forthcoming corporate strategy focused on areas including AI, cyber resilience, children’s privacy, and public services.

Takeaway: The rebrand to the Information Commission reflects a structural change in oversight, moving from a single Commissioner to a Board-led model, rather than a change in regulatory priorities. All existing enforcement tools and investigative responsibilities of the ICO remain identical, and we do not expect this change to affect the day-to-day work of the ICO.

Washington Supreme Court Holds State Wiretap Act Does Not Prohibit Use of Meta Pixel

On October 8, 2026, the Washington Supreme Court unanimously upheld a trial court’s dismissal of a putative class action alleging that the Seattle Children’s Hospital’s (“SCH”) use of the Meta pixel on its public website violated the Washington Privacy Act (“WPA”).

The WPA includes a prohibition on intercepting or recording any “[p]rivate communication transmitted by telephone, telegraph, radio, or other device between two or more individuals . . . without first obtaining the consent of all the participants in the communication.” In this class action suit, the plaintiffs alleged that SCH violated the WPA by using the Meta pixel to track the plaintiffs’ searches and clicks on its public website without user consent, and that Meta then used plaintiffs’ data to serve targeted advertising.

In affirming the trial court’s dismissal of the suit, the Court explained that the WPA only reaches interceptions or recordings of communications that take place between two or more “individuals.” Because the plaintiffs’ communications (i.e., clicks, keystrokes and searches on SCH’s website) were with an automated website, the Court reasoned, they represented a one-way communication with a corporate entity, rather than a communication taking place between two or more individuals.

Takeaway: Tracking technology litigation continues to proliferate, but plaintiffs’ firms’ attempts to twist the WPA have been significantly thwarted in Washington, at least for corporate operators of public websites that want to deploy the Meta pixel. We are eager to see continued steps in this direction by legislatures and courts in other states, but, in the meantime, website operators will need to remain vigilant of ongoing pixel litigation risk and continue to execute processes for inventorying and monitoring their use of tracking technologies.

FTC Commissioner Meador Says UK, EU Digital Rules Undermine International Enforcement Cooperation

At the recent EU Competition Law Conference, Federal Trade Commission (“FTC”) Commissioner Mark Meador remarked that emerging ex ante regulatory models and weakening procedural safeguards in the UK and EU are undermining future prospects for convergence and collaboration with the US.

Meador framed his remarks within the FTC’s ongoing effort to work with its international counterparts, citing procedural fairness, due process, regulatory overreach, and an overreliance on broad prescriptive rules (in lieu of case-by-case enforcement) as factors straining the FTC’s foreign relationships. In particular, Meador expressed concern regarding enforcement of the EU’s Digital Services Act and other content moderation statutes, including the UK’s Online Safety Act. Meador indicated that the US remains committed to strong cooperation with its foreign counterparts.

Takeaway: Meador’s remarks reflect the Trump administration’s intensifying push against European and UK regulators and regulations. The UK and the EU are pushing back, and it is to be seen if the EU/UK and the US can find common ground regarding potential enforcement actions against Big Tech.

UK ICO Opens Consultation on Data Protection Implications of Agentic AI

On October 8, 2026, the Information Commission’s Office (“ICO”) launched a call for evidence on applying data protection law requirements when using AI agents.

The ICO’s definition of an “AI agent” involves three elements: (1) it is a system based on large language models (“LLMs”), (2) the system has access to tools, memory and an environment, and (3) the system has a level of autonomy in using those resources to complete tasks. The ICO highlights that AI agents have the capability to collect or generate personal data, analyze that personal data, share the personal data and make decisions using personal data. The choices made by AI agents are therefore relevant to data protection principles in various ways. The ICO also discusses the variability of an AI agent’s data processing, indicating that on different occasions the same AI agent can approach similar tasks in different ways and using different tools.

The call for evidence seeks views on six areas: data security, transparency, allocating and evidencing accountability, automated decision-making, fairness and purpose limitations, and lawful processing of personal data. Respondents can reply through an online survey until November 20, 2026.

Alongside the call for evidence, the ICO published a report detailing data protection improvements it says it has secured from the developers of a number of the world's largest AI foundation models.

Takeaway: Although described as a “call for evidence,” the materials published by the ICO set out the ICO’s expectations on various data protection requirements in the context of AI agents. The ICO is primarily seeking views on how organizations are addressing data protection issues in practice, rather than requesting comment on the ICO’s positions set out in the published materials. The call for evidence materials are therefore a valuable resource for organizations implementing agentic AI.

Dechert Tidbits 

23andMe Beats California’s Bankruptcy Sale Challenge

On September 29, 2026, the Federal District Court for the Eastern District of Missouri dismissed California’s appeal to unwind the $305 million bankruptcy sale of 23andMe’s assets, noting that California had not established bankruptcy appellate standing. California had argued, in part, that the sale’s structure was engineered to avoid the affirmative-consent requirements of the state’s Genetic Information Privacy Act for roughly two million California customers’ DNA data.

California Governor Vetoes Sensitive Data Sales Ban

California Governor Gavin Newsom vetoed California State Assembly Bill 1542 (“A.B. 1542”), which would have amended the California Consumer Privacy Act to generally prohibit businesses, service providers and contractors from selling or “sharing” for cross-context behavioral advertising California consumers’ sensitive personal information, such as precise geolocation data, biometric information and health information. In his veto message, Newsom called a categorical ban “a step too far,” noting that California already allows consumers to opt out of the sale and sharing of their personal information.