PrivacySignal
Enforcement

NY Attorney General James Secures $18 Million From 23andMe for Failing to Protect Customers’ Genetic Data

DataBreaches.net · · International · Enforcement

New York Attorney General Letitia James, joined by a bipartisan coalition of 42 other state attorneys general, reached an $18 million settlement with genetic testing company 23andMe over its failure to adequately protect customers' genetic data. California's attorney general has filed a separate lawsuit against the company under state privacy law.

Why this matters: Genetic data is not like a leaked password you can reset. It is permanent, it identifies your relatives, and it can reveal things about your health that even you do not know yet. 23andMe collected that data from millions of people who trusted them with it. The $18 million settlement spread across 43 states is a signal that regulators are paying attention, but it does not undo what happened. The California lawsuit still ahead means this company is not done answering for how it handled some of the most sensitive personal information that exists.

Who should care: Lawyers · Privacy officers · Compliance · General readers · Policy

This summary is AI-assisted and may contain errors. It is an original briefing to help you gauge significance quickly — not a reproduction of the source. Always read the linked original before relying on it. See our methodology.

Analysis

All analysis →

Weekly Editorial Analysis from Experts and Editors

Logged Is Not Authorized

Georgia law restricts police use of license plate data to law enforcement purposes. A new lawsuit alleges deputies searched a man's vehicle five times while he was suing their sheriff. Two recorded reasons were "info" and "37." The system accepted both.

· 6 min read Read →
Deep Signal · Part I of III

The Algorithm Said So

Federal rulemakers are deciding what to do when artificial intelligence produces the kind of conclusion that once required an expert. They disagree about how to regulate it. They also disagree about whether the problem has arrived.

· 10 min read Read →

Related stories

Enforcement
U Unite.AI · · International

The Widening Gap Between AI Policy and Real-World Enforcement

A growing disconnect has emerged between the policies governments and organizations are writing to govern AI and their actual ability to enforce those rules in practice.

Who should care: Lawyers · Privacy officers · Compliance · AI governance · Administrators · General readers · Policy

#enforcement#ai-governance#ai Read original →
Enforcement
HIPAA Journal · · US Federal

PJ&A to Pay Up to $10 Million to Resolve Violations of HIPAA; State Law

Medical transcription company Perry Johnson & Associates has agreed to pay up to $10 million to settle a multi-state investigation into violations of HIPAA and state privacy laws. The settlement resolves findings related to how the company handled protected health information.

Who should care: Lawyers · Privacy officers · Compliance · Healthcare professionals

#enforcement#healthcare#state-privacy Read original →
Enforcement
DataBreaches.net · · International

Weill Cornell patient data entered into AI tools without authorization

Weill Cornell Medicine disclosed that patient health information was used in AI and machine learning tools without authorization during a radiology research study. The institution discovered the incident on September 6 and opened an investigation into how patient data from its imaging unit was handled.

Who should care: Lawyers · Privacy officers · Compliance · Healthcare professionals · General readers · AI governance · Policy

#enforcement#healthcare#ai Read original →
Enforcement
HIPAA Journal · · US Federal

HIPAA Enforcement by State Attorneys General

While the federal Office for Civil Rights at HHS leads HIPAA enforcement, state attorneys general also hold authority to pursue violations on behalf of residents. This dual enforcement structure means healthcare entities can face action from both federal and state levels for the same privacy failures.

Who should care: Lawyers · Privacy officers · Compliance · Healthcare professionals

#enforcement#healthcare#regulation Read original →
Enforcement
DataBreaches.net · · International

County of Sussex, New Jersey Notice of Data Privacy Incident

The Sussex County Prosecutor's Office in New Jersey disclosed a data privacy incident after detecting a disruption to its computer network around August 10, 2026. The office launched an investigation with outside cybersecurity help and confirmed that personal information was involved.

Who should care: Lawyers · Privacy officers · Compliance · General readers · Policy

#enforcement#privacy Read original →
Enforcement
NPR — Tech · · International

Google, Meta and TikTok sue to block California youth social media law

Google, Meta, and TikTok have filed a lawsuit challenging a California law designed to prevent children from developing addictive relationships with social media platforms. The companies are seeking to block the law from taking effect.

Who should care: Lawyers · Privacy officers · Compliance

#enforcement#state-privacy Read original →