Privacy & analytics compliance — by jurisdiction

M.K. · 3 May 2026

Korea's PIPC closed out the SK Telecom USIM-breach file in late August with a ₩134.5B penalty — the largest single PIPA fine against a domestic operator on record. The April 2025 disclosure had hit roughly 27 million subscriber-authentication records; the final order cites inadequate access controls, weak key encryption, and slow breach notification. We've moved South Korea from "investigation pending" to a closed entry and re-tagged the enforcement bucket. Posture remains moderate-trending-active; expect a closer look at session-replay vendors through 2026.

M.K. · 30 Apr 2026

Two adjacent files refreshed this week. France: CNIL's €150M SHEIN decision (1 Sept 2025) is now the largest cookie-consent fine on record, tied with Google 2021 — banner-level reject button missing on first layer, cookies persisting after refusal. Ireland: DPC × TikTok €530M (May 2025) for EEA→China transfers under SCCs without adequate supplementary measures, plus DPC × Meta €251M (Dec 2024) on the 2018 "View As" breach. Both files now carry the 2025 cycle in full. No new countries this pass — corpus stays at 36.

M.K. · 25 Apr 2026

Two US-side updates worth pinning. California: the CPPA's ADMT, risk-assessment, and cybersecurity-audit regulations cleared the board in late September — phased compliance dates run through 2027-28. Texas: the Google CUBI matter ($1.375B) settled in May and finalized 31 October — three claims (face-grouping in Photos, Incognito tracking, geolocation-after-disable), all under pre-TDPSA CUBI + UDAP theories. The takeaway for analytics teams: state AGs are now matching EU-scale numbers without needing the privacy statute itself to do the work.