Personal data regulation

The US experience

The California Privacy Protection Agency held consultations on the implementation of the unified “DROP” portal (under the 2023 Deletion¹ Act ). Previously, California consumers could only opt out of the sale of their data to third parties at the time their data was collected by companies. At present, a centralized state platform is created to enable consumers to find data brokers to whom companies have already transferred their data and request that they² delete their data. At the DROP a data broker must process requests for data deletion at least every 45 days. After processing the request, a data broker notifies the requesting consumer whether the user's data is found in the broker's database and deleted. At the same time, it is prohibited to use the DROP portal to contact consumers beyond the data deletion procedure.

In the US, Attorneys General from 37³ states sent a letter to Meta regarding the introduction of a new location sharing feature on⁴ Instagram . By displaying the exact location of users in real time on a map the feature is expected to increase the risk of stalking and harassment, especially for minors. The companies are advised to restrict the use of this feature for minors, introduce warnings for adults about the risks of sharing their location, and ensure that users can opt out of using the feature.

The experience of Austria

In August 2025, the Federal⁵ Administrative Court of Austria found that Austrian media group Der Standard had violated the EU General Data Protection Regulation (GDPR) requirements regarding the collection of⁶ consent through a “Pay or OK” mechanism. This practice of charging for access to content was discussed in the previous issue of⁷ Monitoring.

Earlier, following a complaint from the human rights organization Noyb, the Data Protection Authority, found that the news publication Der Standard forced users to either agree to all data processing purposes, including automated data analysis, targeted advertising, and access to social networks, or pay for a subscription to the publication in order to access the platform's content. In the proceedings, Der Standard argued that it had the right to collect user data, citing the exception for media⁸ freedom (Article 85(2) of the GDPR). However, the Court pointed out that blanket consent mechanisms violate the GDPR (the principle of clear consent (Article 5), the condition of lawfulness of processing based on consent (Article 6)), as users must be able to choose the specific purposes for which they give their consent. Clicking an “OK” button is not voluntary, as it does not allow the user to choose a purpose of data processing and, therefore, such consent is invalid. The GDPR exemption for journalism does not apply in this case, as the data is processed for targeted advertising, which cannot be considered journalistic activity. The court ordered the processing of previously collected data to be stopped and the data to be deleted.

The question arose as to what data Der Standard should delete. The court confirmed that all behavioral user data, including so-called “transparency and consent strings” – records of user choices when giving consent (e.g., cookie settings) – must be deleted. The court considers such data as personal because, in combination with Internet Protocol addresses, TC strings make users identification possible.

The experience of Russia

In August, the Ministry of Digital Development, Communications and Mass Media presented draft requirements for the collection and processing of personal data by⁹ data operators. The purpose of the amendments is to expand the control of data subjects over their collected data by providing the ability to track who and how processes their data by means of the “Gosuslugi” government services portal.

Data subjects are enabled to give their consent to data processing using a standard form developed by Roskomnadzor and to manage their consent through the Gosuslugi portal (for example, receive information about data processing or submit complaints to Roskomnadzor against actions of data operators). This obliges data operators to transfer the information requested by the data subject to the Gosuslugi system. As a result, the proposed regulations establish a centralized mechanism for public control over the relationship between individuals and companies in regard of personal data processing.

From the monitoring issue No. 8 (20), August 2025. Download the full issue (PDF) · issue page at the Gaidar Institute