Dechert Cyber Bits

Proposed Settlement Seeks to End FTC’s Four-Year Battle Over Sensitive Location Data 

On May 4, 2026, the Federal Trade Commission (“FTC”) announced a proposed settlement with data broker Kochava Inc. (“Kochava”) and its subsidiary Collective Data Solutions LLC (“CDS”), which has assumed Kochava’s data broker business (“Proposed Settlement”). The Proposed Settlement, previewed in Cyber Bits Issue 92, would resolve allegations that the companies violated Section 5 of the FTC Act by collecting and selling sensitive location data derived from hundreds of millions of mobile devices allegedly without consumers’ knowledge or consent (see Complaint). The FTC originally filed suit against Kochava in August 2022—a saga discussed in Cyber Bits Issue 33 and Issue 49—alleging that the data could be used to trace individuals’ movements to and from sensitive locations, including, for example, reproductive health clinics and places of worship. Neither Kochava nor CDS admitted any wrongdoing in connection with this matter.

Under the proposed order, which awaits federal court approval, Kochava and CDS are, among other things: (i) prohibited from selling, licensing, transferring, sharing, or disclosing sensitive location data in any products or services unless they first obtain consumers’ affirmative express consent and the data is used to provide a service directly requested by the consumer; (ii) required to establish a sensitive location data program, overseen by a designated senior officer, such as a Chief Privacy Officer or Chief Compliance Officer; (iii) required to implement a supplier assessment program to confirm that consumers have provided consent for the collection and use of all location data obtained from third parties; and (iv) required to provide consumers with a clear and conspicuous mechanism to request the names of any business or individual to which their precise location data was sold and a simple means to withdraw consent. While the proposed order contains no monetary penalty—which is consistent with prior FTC location data settlements with data brokers—Kochava agreed to bear the expenses of the litigation under the settlement terms.

Takeaway: The Proposed Settlement will, if approved, underscore several critical dimensions of the FTC’s evolving approach to location data and data broker enforcement. Notably, it demonstrates that corporate restructuring will not insulate companies from regulatory accountability. Although Kochava transferred its data broker operations to its subsidiary CDS, the FTC imposed obligations on both entities, putting companies on notice that spinning off regulated activities to affiliates is unlikely to serve as a shield against enforcement. The Proposed Settlement does, however, adopt a narrower definition of sensitive location data that is more limited than prior location data settlements, omitting categories such as LGBTQ-related locations and locations associated with racial or ethnic origin. Data brokers and companies that collect, aggregate, or monetize precise location data will find it prudent to evaluate their data supply chains, consent mechanisms, consumer disclosures and contractual safeguards to align with the types of programs the FTC expects to see in place.

California Sets Record $12.75 Million CCPA Settlement with General Motors Over Alleged Unauthorized Sale of Driver Data

California Attorney General Rob Bonta, in coordination with the California Privacy Protection Agency (“CalPrivacy”) and state district attorneys from San Francisco, Los Angeles, Napa and Sonoma counties (collectively, the “State Regulators”), recently announced a proposed settlement with General Motors LLC (“General Motors”) and GM’s subsidiary OnStar LLC (“OnStar”) (together, “GM”) to resolve allegations that GM violated the California Consumer Privacy Act (“CCPA”) and California’s Unfair Competition Law (“Proposed Settlement”). Under the Proposed Settlement, GM would pay $12.75 million in civil penalties.

The Proposed Settlement addresses allegations that between 2020 and 2024, GM sold driving behavior, geolocation, and other data collected through OnStar to data brokers Verisk Analytics Inc. (“Verisk”) and LexisNexis Risk Solutions (“LexisNexis”). The State Regulators further alleged that GM: (i) failed to notify consumers that GM would sell their driving behavior and precise location data to third-party data brokers; (ii) misled drivers by implying that their data would only be used to provide requested OnStar services; (iii) failed to provide consumers with a meaningful opportunity to opt out of the sale of their personal data; and (iv) retained drivers’ data for too long.

Under the Proposed Settlement, GM would be required to: (i) pay $12.75 million in civil penalties; (ii) cease selling driving data to any consumer reporting agencies for five years; (iii) delete, within 180 days, any driving data retained without customers’ express consent; (iv) request that Verisk and LexisNexis delete all previously shared driving data; and (v) develop and maintain a comprehensive privacy program designed to assess, mitigate, and document the risks of data collection through OnStar, with regular reporting obligations to California’s Department of Justice, CalPrivacy, and the participating district attorneys.

The Proposed Settlement follows the Federal Trade Commission’s January 2026 order against GM and OnStar imposing a parallel five-year ban on GM’s disclosure of geolocation and driver behavior data to consumer reporting agencies.

Takeaway: The Proposed Settlement with GM is a key moment for CCPA enforcement. The record $12.75 million civil penalty is nearly five times the prior record. The Proposed Settlement also represents the first data minimization enforcement action by the California Attorney General under the CCPA. Finally, the multi-agency nature of this enforcement action reflects an increasingly coordinated state and federal enforcement posture that companies should expect to intensify.

UK Data Regulator Calls for Review of Automated Recruitment

The UK’s Information Commissioner’s Office (“ICO”) has called on businesses to review their use of automated decision-making (“ADM”) in recruitment.

The Data (Use and Access) Act 2025 relaxed existing rules on ADM, permitting its use in broader circumstances (except where special category data is processed), including fully automated decisions without human involvement. The ICO engaged with a selection of employers and found that while automation delivered significant benefits - particularly at early stages of hiring - there was a need for greater transparency, more consistent human involvement, and improved monitoring for bias.

The ICO expects organizations using ADM in recruitment to proactively monitor for bias (including through regular testing and monthly bias reviews), be transparent with jobseekers about how ADM is used, and explain candidates' rights to challenge decisions and request human review. The ICO has launched a consultation on draft ADM guidance, which is open until May 29, 2026.

• Meaningful human involvement: According to the ICO’s proposed guidance, businesses are expected to thoroughly assess the level of human involvement and apply caution in allowing ADM tools to make final decisions, rather than merely analyzing candidate data.
• Transparency and safeguards: The ICO expects businesses to consider whether the privacy information provided to candidates is sufficient to inform candidates that ADM is being used and how their personal data will be processed. The ICO considers that general information and/or references to a third-party privacy policy are unlikely to be sufficient.
• Fairness, bias and discrimination: The ICO’s proposed guidance provides that businesses should consider assessing the fairness of their use of ADM and whether outcomes have resulted in bias or discrimination.
• Data Protection Impact Assessment: The ICO expects businesses to complete a Data Protection Impact Assessment before processing candidate information and to take steps to mitigate any identified risks.

Takeaway: AI is increasingly popular for screening job applications. However, ADM in recruitment is a central area of scrutiny under the ICO's AI strategy. Businesses using AI in recruitment will want to treat compliance as a live regulatory risk and implement appropriate safeguards to protect jobseekers' data protection rights. Businesses should also note that unlike the UK, the EU has not loosened restrictions on ADM in recruitment under the EU GDPR. While individual member states have enacted national provisions authorizing ADM in certain circumstances, fully automated recruitment decisions without meaningful human involvement remain significantly more constrained under both the EU GDPR and member state implementing legislation.

UK Court of Appeal Clarifies That Consent Under Data Protection Law is an Objective Concept 

Overturning a decision of the English High Court, the UK Court of Appeal held that a data subject’s actual state of mind was not relevant to assessing the validity of their consent.

The High Court had ruled in favor of a recovering gambling addict who alleged that the operators of the Sky Betting and Gaming Platform had unlawfully collected and analyzed his data to target personalized marketing to him (see prior discussion in Cyber Bits Issue 71). The High Court held that a "relatively high" level of consent to cookies and profiling was required where an individual is vulnerable, finding that consent in this context meant "good quality subjective consent, depending on the individual’s actual state of mind.”

The Court of Appeal disagreed, concluding that consent under the UK GDPR is an objective concept. Whether a consent meets the requirements to be valid for UK GDPR-purposes is to be assessed by reference to the parties' outward communications, not the individual's inner state of mind. It held that the High Court's subjective approach would have created unworkable uncertainty, as unknown vulnerabilities could always vitiate consent. The High Court’s approach was, according to the Court of Appeal, inconsistent with the UK GDPR's objective of legal and practical certainty.

Takeaway: The Court of Appeal has taken a pragmatic and business-friendly approach to UK GDPR consent requirements. Based on the Court of Appeal’s decision, organizations that design appropriate consent procedures should not be based on an individual’s unknown state of mind at the time of giving the consent. However, the Court noted that processing may not be "fair" under Article 5(1)(a) UK GDPR where a controller knew or should have known that a data subject's will was overborne by a disability or external factor. Organizations will want to take into account the characteristics of their user-base when designing consumer-facing privacy frameworks.

Bipartisan Support for AI Regulation in Connecticut 

On May 1, 2026, Connecticut’s House of Representatives gave final approval to Senate Bill 5, now rebranded as the Connecticut Artificial Intelligence Responsibility and Transparency Act (the “Bill”). If signed by the Governor, as is expected, the Bill would come into effect beginning October 1, 2026.

The Bill seeks to provide a comprehensive regulatory framework for AI in Connecticut, spanning governance requirements for AI systems, consumer disclosure rules, AI content detection, healthcare enhancements, employment discrimination prevention, and the creation of an ‘AI Academy’ to upskill the workforce.

The Bill also covers more controversial developments in the AI landscape, including proposed restrictions on minors under 18 accessing romantic, erotic or sexually explicit chatbot companions, a move that is controversial for those opposed to digital age verification and which, due to the language used in the Bill, may invite First Amendment challenges. Certain safety measures set forth in the Bill would apply regardless of age, including requirements for AI "companion" providers to detect expressions of suicide, self-harm or imminent violence, and to provide initial and hourly notices that a bot is not human.

The Bill also includes whistleblower protections for employees of frontier AI model developers who disclose severe risks.

Takeaway: Senate Bill 5 would enact major AI regulatory frameworks for developers and employers with coverage of multiple key areas including hiring and employment disclosures, chatbot and mental health safeguards and protections for minors. It would put Connecticut in the spotlight as a frontrunner of one of the nation’s most comprehensive AI laws, which is not surprising given the robust privacy law and technology practices and enforcement activities of the Connecticut Attorney General in this space. As with other state laws, federal preemption in light of the December 2025 Trump Executive Order remains an area where the law could face additional scrutiny, even if enacted.

Dechert Tidbits

Access Denied: Journalist Challenges the Bavarian Data Protection Authority

A German journalist has challenged the Bavarian Data Protection Authority’s refusal to grant him full access to its file relating to a complaint he made about a third party. The Advocate General opined that data protection authorities qualify as "controllers" when handling complaints, and must therefore comply with data subjects' rights. However, the rights of access to personal data did not extend to the entire administrative file, but only the personal data within it. The Advocate General indicated that Bavarian legislation that excluded access rights to data protection authority files on a blanket basis was incompatible with the GDPR.

CalPrivacy Signals Heightened Data Broker Enforcement Ahead of Delete Act Deadline

The California Privacy Protection Agency (“CalPrivacy”) noted at its latest board meeting that it intends to intensify enforcement of data broker registration obligations under the California Delete Act, noting that only 575 data brokers have registered despite thousands operating in the state. CalPrivacy’s Deputy Director of Enforcement, Michael Macko, stated that the agency plans to “devote significant enforcement resources” ahead of the August 1, 2026, deadline, after which registered brokers must conduct consumer data deletion sweeps every 45 days.