California Takes Away the Private Suit (09/01/2026)

Two items today move in opposite directions on the same question, which is who gets to bring a privacy case. California is narrowing the path for individuals while Austria has just opened one, and the answer determines whether privacy law is something a company negotiates with a regulator or something a customer can raise directly.

Top 5 Critical Privacy Alerts

1. California Narrows Private Enforcement

State lawmakers have cut back the private right of action under a key California privacy law, shifting enforcement weight toward regulators and away from individual plaintiffs. The change alters who can bring a case, not what the law requires. PogoWasRight

Operator Note: A private right of action is the single provision that most changes a company’s actual risk calculus, because a regulator has finite capacity and plaintiffs do not. If this holds, the practical effect for most organizations is that California exposure becomes more predictable and less frequent, which is a real change worth telling your board about rather than a technicality.

2. The FTC and States Sue Amazon Over a Secret Ad Surcharge

The Federal Trade Commission and a coalition of states have sued Amazon over an alleged undisclosed advertising surcharge scheme. The complaint concerns charges the Commission says advertisers could not see. FTC

Operator Note: Read this alongside the FTC’s proposed personalized pricing statement from Friday, because both concern charges a customer cannot see or compare. The pattern the Commission is building is that opacity in pricing is itself the harm, without needing to show the price was unfair. Any organization with a fee structure buried in a settings page should read the complaint.

3. Austria’s Supreme Court Clears a Class Action Against CRIF

The court found that CRIF illegally collected data on millions of people in Austria, opening the path to a class action. The ruling came from the country’s highest court, so the finding is settled. noyb

Operator Note: Credit reference agencies operate on the assumption that legitimate interest covers bulk collection, and a supreme court disagreeing with that is a meaningful crack in the model. If your organization relies on legitimate interest for anything collected at scale without notice, this is the case to have your counsel read.

4. The EFF Asks Newsom to Veto AB 1709

The organization is urging a veto of California’s AB 1709, arriving in the same week the legislature narrowed private enforcement. Two California privacy movements in one week is unusual and they pull in different directions. EFF

Operator Note: California remains the state whose choices propagate furthest, so both of this week’s movements are worth tracking even if you have no California entity. What passes there tends to become the template a dozen other legislatures start from within two sessions.

5. The EDPB Asks Who Your Data Is Anonymous To

Draft anonymization guidelines from the European Data Protection Board frame anonymity as relative to the party holding the data rather than as an absolute property of the data set. VeraSafe

Operator Note: This is the framing that breaks a lot of existing practice, because most organizations treat anonymization as a state a data set reaches and then keeps. If anonymity depends on who holds it and what else they hold, then a set that is anonymous to your analytics vendor may not be anonymous to you, and the label stops travelling with the file.

Additional Privacy Alerts

Surveillance & Facial Recognition

• A digital camouflage shirt confuses AI-powered surveillance cameras: Adversarial patterns moving from research demo to a garment somebody can wear. 404 Media

Transparency

• Oklahoma told a city it could not charge $17,125.44 for a records request: Fee-setting as a way to make public records practically unreachable. 404 Media

The Axe Report is a daily briefing from Grab The Axe. Need help assessing your organization’s security posture? Take our free Human Attack Surface Score assessment.