Unless you are very young – and certainly not a reader of this digest – machines have been tools: things that people used, sometimes abused, or stood in front of, having no idea what to do with them. But recently they have become something else. They are decision makers now.
An algorithm at Uber decided which drivers kept their livelihoods. The recommender systems at Meta and TikTok decided what hundreds of millions of people, a great many of them children, would see next, and how hard it would be to stop. And in each case, at real scale and (more or less) for the first time, the law turned up to ask by what right.
The Dutch regulator fined Uber 825 million euros for letting software deactivate drivers with no human in the loop, the second-largest penalty in the history of the GDPR and the largest ever for automated decision-making. By the same token, Brussels declared the addictive design of Instagram and Facebook unlawful, weeks before Meta settled parallel claims in the United States for up to 17 billion dollars. The EU AI Act, meanwhile, reached the milestone that was supposed to give it some teeth – and then mostly chose to postpone them. All that seems to show that the rulebook is racing to catch up with the machine and arriving, in the European manner, a little out of breath. In all fairness: the machines are rather fast.
A much older and eerily familiar game carried on alongside. Attackers spent the quarter strolling into healthcare systems right through the front door on borrowed credentials, with the pharmaceutical distributor McKesson the largest of an unsettling run of health-data breaches. Google managed to be fined twice in nine weeks, once by competition regulators and once over location tracking, which drew from Washington (read: Trump) the now-ritual threat of tariffs in return. And the Data Privacy Framework continued its slow, fully public structural failure, with everyone watching and nobody yet willing to be the one to call it done.
If you take the trouble and pull the stories together, the same shape shows up. We have handed our decisions, our data, and our secrets to systems we cannot see inside, do not even have a clear idea how they work in principle, and 2026 is the year the chickens come home to roost, one lawsuit and one leaked database at a time, telling us whether that trust was ever warranted.
It usually was not, and that is the story. Let’s take a closer look.
The Machine Decides: Uber and the €825 Million Price of Automation
In 2019, an Uber driver in Paris named Brahim Ben Ali opened his app and found he no longer had a job. The software had decided he was a fraud risk, and for that reason switched him off. There was no hearing, no phone call, no human on the other end who could look at his case. There was just a decision, made by a system, that ended his income from one moment to the next.
The man was not alone. He gathered testimony from 170 other drivers who had met the same wall, the complaint was lodged with France’s CNIL, and under the GDPR’s one-stop-shop rule it travelled to the Netherlands, where Uber keeps its European headquarters. Only seven years later, that complaint produced the second-largest fine in the history of the GDPR.
On 21 August 2026, the Dutch data protection authority, the Autoriteit Persoonsgegevens, fined Uber 824.99 million euros, roughly 964 million dollars, or about 1.85 percent of the company’s 2025 global turnover. Only Meta’s 1.2-billion-euro transfer fine from 2023 is larger. And in one specific respect this fine stands entirely alone: it is the largest ever imposed for a violation of Article 22 of the GDPR, the provision on automated decision-making.
What Article 22 Actually Says
Most data protection rules are about how you collect and store information. Article 22 is a bit different: it is about letting a machine decide. For the uninitiated, it grants every person the right not to be subject to a decision based solely on automated processing when that decision produces legal effects or similarly significant ones. In plain terms, if a computer, with no meaningful human involvement, makes a choice that materially changes your life, denies you a loan, rejects your job application, closes your account, cuts off your income, then Article 22 says you have rights. To be told it is happening, to get a human to look at it, to argue your side, and to contest the outcome. That kind of stuff.
Article 22 is not an “AI rule” as such. It predates the current wave of machine learning by years and does not care whether the system is a sophisticated neural network or a crude set of if-then rules programmed in Cobol. What matters is not how clever the machine is but whether a human being with the authority to say “No” is actually in the loop.
What Uber Did
Between 2018 and 2022, Uber ran software that monitored its drivers’ behavior and their customer ratings. When the system suspected fraud, it suspended the driver’s account. When ratings stayed too low, it could deactivate the account permanently. These were not recommendations handed to a manager for review. They were decisions, executed by the system, with real-world consequences. The regulator said it in plain words: a deactivated driver, in the AP’s account, was cut off from one moment to the next, losing all income through the platform with no human having looked at the case. Losing your livelihood is about as “similarly significant” an effect as the drafters of Article 22 could have imagined.
The AP found two distinct failures. First, the automated deactivations themselves fell clearly within the Article 22 prohibition, without the safeguards that would have made them lawful. Second, and separately, Uber failed to tell its drivers adequately, under Articles 13 and 14, that automated decision-making was being used at all, how it worked, or what it could do to them. The drivers were being judged by a machine, and they were not even properly informed that such a machine existed.
Uber’s Defense, and Why This Matters Everywhere
Uber has appealed, and its arguments are worth looking into because they are the arguments every company will reach for. The fine is disproportionate, it says. The permanent deactivations were never fully automated, it says, pointing out that only 126 driver accounts across Europe were permanently cut for low ratings in 2021. And besides, it says, the practice stopped in 2022. These are not frivolous points, and the appeal will test exactly how much human involvement is enough to lift a decision out of “solely automated” territory. That question, how “thin” the human layer can be before it stops counting, is now the single most important open question in European automation law.
The question of whether a human is really involved or purely ornamental reaches well beyond ride-hailing. Automated decisions are no longer exotic. They allocate work, screen job candidates, flag transactions as fraudulent, approve or deny access, and lock accounts, across virtually every sector that runs on software. The Uber decision is a warning shot to all of them: if your system can cut someone off, deny them something they are entitled to, or materially alter their situation, a real human with real authority has to be able to step in, and the people affected have to know the machine is there. A “human in the loop” that consists of a rubber stamp, or a support queue that never actually reverses anything, will not survive contact with Article 22. Or so we hope.
We at Engity watch this with particular interest, because access is exactly the kind of decision that is more and more being handed to machines. Every automated lockout, every algorithmic fraud flag that revokes a credential, every system that decides on its own who gets in and who gets shut out, is an automated decision in the Article 22 sense. The lesson of Uber is not “stop automating.” Automation is not going away, nor do we believe it should. The lesson is that the machine can decide, but a human must be able to overrule it, and the person on the receiving end must never be left talking to a good old brick wall.
When the Algorithm Is the Violation
The Uber case is about decisions. The Meta case is about capture. Or, if you want, the power to direct attention.
In the third quarter of 2026, European regulators made clear that they now regard the second kind as just as much a legal problem as the first. The shift runs deep: enforcement is no longer aimed only at what a platform hosts, the illegal content, the privacy breach, but at how the platform is built and run. The recommender algorithm itself, the very thing engineered to keep you scrolling, has become the violation.
Meta and the Architecture of Attention
Meta felt it first. On 10 July, following a (by European standards) short two-year investigation, the European Commission issued preliminary findings that the design of Instagram and Facebook breaches the Digital Services Act. The target was not any particular post. Rather, it was infinite scroll, autoplay, push notifications, and the personalized recommender system, features the Commission says nudge users into what it calls “autopilot mode” and foster compulsive use. Meta, it found, had failed to properly assess the risks these pose to minors and vulnerable adults, had ignored its own evidence of how long children spend on the apps at night, and had offered mitigation measures that do not work. The remedy the Commission demands is not a content tweak but structural surgery: disable autoplay and infinite scroll by default, build in real screen-time breaks, and retune the recommender so it stops optimizing for engagement at any cost. Meta disagrees, naturally, citing the “significant steps” it has taken to protect teens. If the findings are confirmed, the exposure runs to 6 percent of global annual turnover, which for Meta is measured in billions.
TikTok: A Second Helping
TikTok, which opened this story back in February as, to nobody’s surprise, the first platform accused of unlawful addictive design, had a busy quarter of its own. That February finding remains unresolved, a potential fine of up to 6 percent of global turnover still hanging over it, which for ByteDance, TikTok’s parent and now almost the size of Meta, means billions. But on 24 July the Commission piled on with a second set of preliminary findings, this time for failing to protect minors’ privacy: on TikTok, a child’s account and content were visible far too widely by default, including to adults and to people with no TikTok account at all. The Commission’s position is that a minor’s content should default to visibility only for contacts the minor has actually accepted. Two preliminary findings against one platform in six months, both about design defaults rather than individual posts, are no accident.
Meanwhile, Across the Atlantic
None of this is happening in a European vacuum, and the most expensive confirmation came from across the Atlantic. On 26 August, mid-trial in a federal courtroom in Oakland, Meta settled a landmark case brought by a coalition of US state attorneys general for up to 17.1 billion dollars, roughly 12.2 billion of it fixed and the rest contingent on YouTube and TikTok agreeing to comparable terms. It is the largest consumer-protection settlement in American history outside the tobacco deals of the 1990s. With the stories discussed before, the claims will sound familiar: that Meta deliberately engineered Facebook and Instagram to be addictive to children, and that it collected data from under-thirteens without parental consent, in breach of the US children’s privacy statute. The remedies will sound familiar too, because they are the same ones Brussels is demanding, stronger age assurance, limits on how long kids spend on the platforms, likes hidden by default for teenagers, and, tellingly, a ban on “extreme makeup filters” for minors.
Two legal systems that agree on almost nothing right now, as the rest of this digest makes plain, reached the same verdict within weeks of each other: that building a product to maximize the engagement of children is no longer a growth strategy but a liability, and that the design choices themselves, not merely the content they surface, are what the law will judge.
There is an identity dimension here that we at Engity cannot help but notice. Nearly every remedy on both continents leans on one unglamorous capability: knowing, reliably, whether the user is a child. Age assurance was the heart of the Reddit fine we covered in Q2, and it is the hinge on which these far larger cases now turn. You cannot apply different rules to minors if you cannot tell who the minors are. The algorithm may be the violation, but identity is the precondition for the fix.
Welcome to the Machine: Brussels Is Getting There
If the first two sections of this digest show the machine making decisions and the algorithm doing harm, this one shows the other side of the coin: the law trying to keep up. Q3 was a busy quarter for Europe’s digital rulebook. It was not, on close inspection, an especially decisive one.
2 August: Teeth, Deferred
On 2 August 2026, the EU AI Act reached what the jargon calls “general application,” the milestone that was supposed to be the moment the Act got serious. It arrived, and it was mostly a postponement.
The transparency obligations under Article 50, the ones that require you to label deepfakes and tell people they are talking to a machine, became enforceable, and the Commission’s power to fine providers of general-purpose AI switched on. But the genuinely demanding part, the full regime for high-risk systems, did not arrive at all. Thanks to the AI Omnibus, which entered into force as Regulation 2026/1744 on 27 July, the high-risk obligations are now formally deferred to December 2027 and, for embedded systems, August 2028. Readers of our Q2 edition will recognize the theme we flagged back then: in this package, “simplification” keeps meaning “later.”
The EDPB Draws the Lines
Then came the European Data Protection Board (EDPB), mapping the GDPR onto the AI stack. On 7 July the Board adopted new guidelines on anonymization and on web scraping for generative AI. The anonymization guidelines matter to us because they answer exactly the question IQVIA, the health-data firm fined 5 million euros by the French CNIL in Q2 for insisting its pseudonymized data was anonymous, lost: when is data truly anonymous and therefore outside the GDPR entirely? The Board’s answer is a three-part test, the data is anonymous only if you cannot single out an individual, cannot link records to them, and cannot infer information about them. Fail any one of the three, and you are still holding personal data, with every obligation that entails.
The web scraping guidelines, for their part, confirm that the open internet is not a free buffet: the GDPR applies to the personal data you hoover up to train a model, public or not, and special categories remain, in principle, off the menu. Both sets of guidelines were adopted only as drafts, open for public consultation until 30 October.
It is not that Europe is doing nothing. It is doing a great deal: adopting, consulting, deferring, negotiating, publishing. All that good stuff. The question the quarter leaves open is how much of that activity will actually constrain the machines by the time the machines have moved on again. The rulebook is catching up. It is just catching up at the speed of bureaucracy, and the machine does not wait.
The Breach Will See You Now
For two quarters running, this digest has made the same observation: the attackers are not breaking in, they are logging in.
A Phone Call to the Pharmacy
Q3 extends the pattern to the softest, juiciest target of all. If you want a single file that contains a person’s identity, their money, and their secrets in one convenient package, you do not want a bank. You want a health record. It holds the name, the address, the date of birth, the social security number, the insurance details, and, for good measure, the diagnoses. This quarter, the people who traffic in stolen data went shopping for exactly that, and the checkout queue was long.
The anchor incident is McKesson, one of the largest healthcare and pharmaceutical distributors in the United States, a company that moves roughly a third of all prescription medicines in North America. On 25 August it detected a cybersecurity incident, and by the 28th it had told the SEC, the US regulator that requires listed firms to disclose serious hacks, and its customers what it could confirm: attackers had reached certain third-party applications and exfiltrated data belonging to a subset of customers in its oncology and medical-surgical units. The extortion group behind it, ShinyHunters, claims to have taken 284 million records. That number has been splashed across headlines as “284 million patients,” which it is not. ShinyHunters itself clarified that the figure is a raw count of database rows, not of human beings, drawn from McKesson’s Snowflake and Salesforce environments, with the actual number of affected patients running to “tens of millions.” So we have here one of the rare cases where modest criminals correct the press.
Anyway, the more interesting number is the method. According to the reporting, the attackers did not defeat any serious technical control. They used voice phishing to talk their way into an Okta single sign-on account, and from that foothold reached the cloud data platforms where the records actually lived. A phone call, a convincing voice, a borrowed identity, and the keys to a third of America’s pharmacy data. Readers who remember Carnival from last quarter, or Match Group from the one before, will recognize the playbook exactly. ShinyHunters is not winning on genius. It is just nice on the telephone.
A Season of Health Breaches
And McKesson had company, though to see it you have to understand how healthcare breaches surface, which is slowly and late. The third quarter did not so much produce a run of new health-data breaches as reveal one. The largest to come to light, at the records-migration firm Aesto Health, exposed some 9.5 million people, yet the intrusion itself dated back to December 2025; it took until a regulatory filing this quarter for the true scale to surface. Veradigm, by contrast, was fresh: in early September it confirmed that attackers had used a vendor’s stolen credentials to pull patient data straight through its own API.
Either way the reason healthcare keeps appearing in these pages is the same. Hospitals and their supply chains run on sprawling webs of interconnected third-party software, each connection a door, each vendor a set of credentials, and the data behind those doors is the most valuable kind there is.
The Fire You Haven’t Smelled Yet
It is the lag that should keep you up at night. If the breaches making headlines this quarter happened six or nine months ago, then the breaches happening right now will not surface until next spring. Somewhere out there, at this moment, the records of millions of people are already copied, already indexed, already changing hands, and the people in question are sleeping soundly, filing their insurance claims, booking their appointments, entirely unaware. A breach notice reads like news of a fire that has been put out. More often it is the first wisp of smoke from one that has been burning for months. The house is already alight. Most of us simply have not smelled it yet.
The Real Attack Surface
That attack surface deserves a name, because it is the real story of the quarter and not only in healthcare. The common thread running through these breaches is not malware. It is trusted connections, the SSO logins, the OAuth tokens, the vendor integrations that stitch modern IT together and that an attacker, once inside one of them, can ride straight into everything else. It is the same lesson we drew from the leaked developer token at Novo Nordisk last quarter. The perimeter is not where the fight is. The fight is over who holds a valid credential, and whether a stranger with a telephone can persuade someone to hand one over.
So here is the pitch, and yes, we at Engity have a dog in this fight: the single most valuable security investment most organizations could make this year has nothing to do with firewalls. It is knowing, with confidence, who is on the end of the line, who holds which credential, and how fast you can take it away when the voice on the phone turns out to be a stranger. Until that is solved, the breach will keep seeing us now.
Google Pays Twice, and Washington Notices
The quarter’s single largest penalty went to Uber, and we have given it a section of its own. But if one company defined the enforcement quarter, it was Google, which managed to be fined twice in nine weeks by two different arms of European regulation, for two entirely different sins.
First, the Competition Blow
The first blow was a competition one. On 23 July, the European Commission handed Google its first-ever fine under the Digital Markets Act (DMA): 890 million euros, split into 460 million for favoring its own services, shopping, hotels, transport, in Google Search results, and 430 million for stopping developers on Google Play from steering users toward cheaper deals elsewhere.
The headline number, rounded to “a billion dollars” almost everywhere, is the least interesting part. The sharp bit is the timeline: Google was given 60 days to stop, after which the Commission can levy daily penalties of up to 5 percent of worldwide turnover.
Seven Years for €403 Million
The second blow was a privacy one, and it came from Dublin. On 21 September, Ireland’s Data Protection Commission fined Google 403 million euros over the way it handled users’ location data across three features of its services, finding the processing neither lawful nor fair, poorly explained, and retained too long. Location data, as the Deputy Commissioner noted, can reveal where a person has been, what they do, and what they might be persuaded to buy. What the decision also reveals, almost by accident, is the state of GDPR enforcement: the inquiry ran for 2,421 days, very nearly seven years, from opening to penalty. The fine is real, but so is the glacier it rode in on, and it is a reminder of why the reform of GDPR enforcement, stuck as we have seen in the Council, keeps being demanded.
Enter Washington
These fines did not land in a vacuum. They arrived in a quarter when the transatlantic temperature over European enforcement against American tech reached a new high. Or low. We are a bit unsure about the proper picture here.
The day after the Commission’s 890-million-euro DMA fine, President Trump took to Truth Social to announce he would “immediately” open a Section 301 trade investigation into the EU, accusing the bloc of “ROBBING” (yes, capital letters) American companies, declaring that “Europe is not a piggy bank,” and demanding the fines be “entirely reversed” on pain of tariffs.
Strictly, not every one of these penalties is the kind he has in his sights, his anger is aimed at the competition fines under the DMA, not at a data protection penalty won by Uber’s drivers or by Irish regulators over location logs. But in politics that distinction dissolves. What Washington sees is a pattern: an 825 million euro fine here, an 890 million there, a 403 million to round it off, all landing on American letterhead in the space of a single quarter. And what the pattern shows is a European Union that, for now, is pressing ahead regardless. As the EU’s competition chief put it, Europe was making “a stand for the rule of law in the face of bullying.” Whether that resolve survives an actual tariff war is one of the open questions of the year, and it is the same question, wearing a different hat, that haunts the Data Privacy Framework we turn to shortly.
The DPF, Still Simmering
Regular readers will remember that we devoted last quarter’s deep-dive to the slow-motion collapse of the EU-US Data Privacy Framework (DPF), the adequacy decision that lets personal data flow to the United States without extra paperwork.
The short version: in June, the US Supreme Court stripped the Federal Trade Commission of its independence, and the FTC’s independence was one of the two foundations holding the whole arrangement up. We promised we would be writing about it again. Here we are.
What happened in Q3 is a great deal of motion and no actual movement. Within a day of the ruling, Max Schrems and his organization NOYB sent the Commission a formal letter demanding an “orderly withdrawal” of the adequacy decision, and announced that a challenge before the Court of Justice, the long-awaited “Schrems III,” is being prepared. Their argument has a certain arithmetical elegance: the Commission’s 2023 adequacy decision relies on the independence of the FTC, by NOYB’s count, 259 times (we checked that number). Remove that independence, and you have removed the reasoning 259 times over. A coalition of three dozen civil-society organizations and academics piled in with a petition of their own.
And the Commission did what the Commission does when the ground shifts under an inconvenient decision. It announced that it is monitoring the situation closely, remains in contact with its US counterparts, and has tools at its disposal should adequacy no longer be assured. It did nothing. The adequacy decision remains formally in force. Transfers made under it today are lawful.
So the position at the end of Q3 is the one we described at the end of Q2, only worse: a legal foundation that everyone with eyes can see has cracked, a regulator unwilling to be the one to condemn the building, and a growing queue of litigants happy to do it for them. For anyone actually responsible for moving data across the Atlantic, the practical advice has not changed and is not going to: do not build your house on this shaky foundation.
Standard contractual clauses, European-operated infrastructure, and a healthy assumption that the DPF may not outlive the next ruling are not pessimism. They are just planning.
No Logs, They Said
We like to end on something small, and this quarter offers a near-perfect miniature of the digest’s recurring theme: trust, and the moment you find out whether it was warranted.
In late July, a 17-gigabyte database surfaced on a cybercrime forum, attributed to SplitVPN, a Russian VPN service formerly known as NotVPN and marketed, as these services always are, on a strict “no-logs” promise.
Please keep in mind that a VPN’s entire value proposition rests on that promise. You route your traffic through it precisely because it swears it is not writing down where you go, when, or from what address, a guarantee that matters most to the people who use such a tool to get around state censorship, in Russia, Iran, Myanmar. The deal is simple: trust us, we keep nothing.
However, researchers who examined the dump reported finding a table logging nearly 58 million device-to-server connections, complete with timestamps, running continuously from June 2025 to the very day of the leak. Not the websites visited, to be fair, but exactly the kind of connection metadata the company’s own policy said it did not collect, the sort of record from which an attentive adversary can reconstruct who was online, when, and from where. Have I Been Pwned has since confirmed 865,000 affected email addresses.
SplitVPN disputes all of it. The 58-million-row table, it says, is a fabrication bolted on by the seller to inflate the price; the real exposure is “only basic account information,” entirely consistent with its no-logs commitment. And that may be true. The attribution of that particular table has not been independently nailed down.
But that is the point: a no-logs promise is unfalsifiable right up until the day it is catastrophically falsified. You cannot audit it, you cannot see behind it, you simply decide to believe it, and you learn whether your trust was justified only when a database turns up on a forum.
It is the lesson of everything above, shrunk to a single table: whether it is a framework, a platform, an algorithm, or a VPN, trust placed in a system you cannot inspect is a bet, and the bet is only ever settled at the worst possible moment.