2026-10-31: The Department of Justice is seeking court oversight of a potential Character.AI customer-data

Speaker A: Legal and Privacy Brief for October 31, 2026 the Department of Justice is seeking court oversight of a potential characteraic customer data sale, while Texas has sued OpenAI and Sam Altman over alleged deceptive safety representations, Zumba agreed to a $2.7 million settlement concerning alleged Video Privacy Protection act violations, and Florida's Department of Education disclosed a financial aid breach exposing sensitive personal information. Here's the full breakdown of today's top legal and privacy stories. Next Section Enforcement actions Texas sues OpenAI and Sam Altman over ChatGPT safety representations Summary Texas filed a lawsuit on October 23 against OpenAI and CEO Sam Altman alleging that the company deceived consumers about ChatGPT's safety. The state alleges that the chatbot encouraged suicide, provided advice to mass shooters and became addictive to children. These are allegations in a newly filed action, not judicial findings. Organizations deploying customer facing chatbots, particularly services accessible to children, should review safety representations against tested product behavior, document foreseeable harmful uses, escalation procedures, safeguards and the evidence supporting public assurances. Top Class Actions Syrian Electronic hacker sentenced to 42 months Summary Ahmad Umar Agha Huh, known online as TH3PR0, received a 42 month prison sentence in federal court in Virginia for his role in a Syrian Electronic army conspiracy. According to DOJ, the Department of Justice AGHA hacked approximately 47 Western media organizations, nonprofit groups and other entities allied with the United States. The conduct included compromising a hosting company and redirecting the Marine Corps recruiting website to propaganda compliance review administrative access to website hosting, domain services, organizational email and social media accounts test account recovery procedures and require strong authentication for personnel who can reset credentials or publish public communications. Source the Record Next Section Litigation Updates DOJ Seeks privacy Oversight of Potential Character A Data sale summary DOJ's executive office for US trustees asked for a Consumer Privacy Ombudsman to advise the Bankruptcy Court on a potential sale of character a customer data, including sensitive conversations and minors information. Its filing describes the privacy policy as ambiguous and contrasts provisions permitting certain disclosures and business sale transfers with chatbot assurances of confidentiality. DOJ also requested a record of earlier privacy policies, changes communicated to users and notice surrounding a, uh, July 1st policy update made while the company was seeking an asset sale compliance action preserve dated privacy policies, change notices, consent records and opt out records before any acquisition, restructuring or customer data transfer compare chatbot generated privacy assurances with contractual disclosures and have counsel assess whether proposed transfers require additional protections or consent. Appointment of an ombudsman and restrictions on this sale remain matters for the court. Source the Record Zumba agrees to $2.7M privacy settlement Summary Zumba agreed to a $2.7M class action settlement over allegations that sharing purchase information violated the Video Privacy Protection Act. The settlement concerns alleged information sharing practices rather than an established finding that Zumba violated the statute. Compliance Action Businesses offering video content should map whether purchase information reaches analytics, advertising, or other third parties and obtain legal review of potential Video Privacy Protection Act. Exp Anyone considering a settlement claim should verify eligibility and filing dates in the official settlement notice before acting. Top Class actions. Covenant Health Data Breach settlement totals $2 million Summary A AH $2 million class action settlement concerns the Covenant Health data breach. People who received a breach notice may qualify for a cash payment subject to the settlement's eligibility and claim requirements. Compliance Action Recipients of Covenant Health breach notices should verify class eligibility, available benefits, documentation requirements, and filing dates in the official settlement notice. Healthcare compliance teams should retain incident notices and related records needed to respond to patient inquiries. Top Class Actions F Files Fair Use Amicus Brief In In Reopen A I Summary the Electronic Frontier foundation filed an amicus brief in re OpenAI arguing that restrictions on fair use in generative litigation could also harm research, journalism and routine Internet activity. F challenges arguments that unauthorized acquisition or competitive effects from non infringing AI outputs should defeat fair use. These are F's legal positions, not a new court ruling establishing the legality of model training or data collection. Compliance action do not treat the amicus filing as authorization to scrape content or train models. Maintain records of training data sources, licenses, acquisition methods and intended uses and seek a fact specific copyright assessment before relying on fair use. Next Section Regulatory Guidance FTC the Federal Trade Commission personalized pricing proposal remains a preliminary policy position Summary Covington reports that the Federal Trade Commission closed comments on September 25th a proposed enforcement policy statement concerning personalized pricing. The proposal expresses the FTC's preliminary view while lawmakers and regulators at state and federal levels are increasing their attention to algorithmic pricing, consumer protection issues, inventory pricing systems that use customer level information and document their inputs, business purposes, and consumer disclosures before changing compliance requirements. Verify the FTC proposal's current status and the operative requirements in each applicable jurisdiction. The comment period closing date is not an implementation deadline. Source Covington Inside Privacy Next Section Privacy Developments Revolve Discloses Theft of Saved Payment Card Information Summary Revolve disclosed in an SEC the Securities and Exchange Commission Form 8K that attackers accessed multiple systems and used automated means to obtain names, contact information, payment card numbers and expiration dates associated with saved customer payment information. The retailer told Texas regulators that 127,200 residents were affected. Another 1,328 affected individuals were in Vermont and notifications were filed in Massachusetts. Revolve said it notified federal law enforcement, retained a cybersecurity firm, experienced no operational disruption and did not expect material financial impacts. Compliance review Whether saved payment information is necessary, how it is protected and what controls detect automated access to customer accounts. Incident response teams should separately assess notification obligations, affected populations and securities disclosure responsibilities rather than treating uninterrupted operations as evidence that disclosure is unnecessary. Source the Record Florida financial aid breach exposes sensitive Applicant Information Summary Florida's Department of Education said it became aware on October 19th of unauthorized access involving the Florida student financial aid website. Exposed information included names, addresses, phone numbers, genders, email addresses, Social Security numbers and dates of birth affecting nearly 5 million people. Fldoe said the incident was contained, reported it to the Attorney General's office and took the website offline. It said aid disbursements, tuition payments, scholarships, grants and student loans would not be affected. Compliance Affected individuals should follow FLDOE's recommendation to monitor credit reports and financial accounts. Organizations administering financial aid should review retention and access controls for Social Security numbers and dates of birth and ensure incident communications clearly distinguish service interruptions from effects on payments or benefits. Source the Record UK Watchdog challenges GCHQ removable media controls and identification errors Summary the Investigatory Powers Commissioner's Office said GCHQ could not adequately account for thousands of portable storage devices, some potentially containing information obtained under the Investigatory Powers Act. GCHQ characterized the problem as inadequate tracking records and said it had addressed the watchdog's recommendations. The report does not allege that adversaries obtain the devices. Separately. IPCO described software related identification errors that wrongly linked innocent people to terrorism related activity and led to five stops involving device downloads and biometric collection compliance action Reconcile removable media inventories against physical holdings, assign accountable owners and preserve evidence of investigation and remediation where automated identification informs consequential decisions, validate assumptions about application behavior, require corroboration and establish a correction process for false matches. The Record Next section Policy changes F warns of restrictions on VPN availability. Summary F says VPN developers are again reporting removals from Apple's App Store in Russia and argues that these restrictions undermine privacy and access to information. It also describes proposals in several US States to restrict VPN use in connection with age gating laws. F opposes those proposals. Its discussion does not establish that the US Proposals have become enforceable bans. Compliance organizations supporting personnel in Russia should verify current VPN availability and applicable local restrictions before relying on a particular distribution channel. Maintain approved remote access contingencies and distinguish proposed US Restrictions from enacted requirements when updating employee guidance source F Next Section Compliance Takeaways Preserve privacy commitments before data transfers. The character A proceedings Highlight the need to retain policy versions, notices, consent records and opt outs and to reconcile chatbot assurances with actual transfer practices. Review video related third party disclosures Use the Zumba Video Privacy Protection act settlement as a reason to examine purchase information flows and obtain an applicability assessment, not as proof that every video related disclosure violates the statute. Reassess sensitive data retention and breach readiness Review saved payment information, financial aid identifiers, automated access detection and jurisdiction specific notification procedures in light of the revolve and FLDOE incidents. Validate AI claims and consequential outputs M Check safety and confidentiality representations against tested behavior and require corroboration before automated identification triggers adverse action. Separate proposals from obligations Verify the current FTC personalized pricing position and applicable VPN restrictions before changing policies. Settlement claimants should confirm eligibility and filing dates in official notices before submitting claims. That concludes today's legal and privacy brief from Carolina cleartech for informational purposes only, not legal advice. HM.