The IT Nerd

It’s Data Privacy Week, the National Cybersecurity Alliance’s annual international initiative to empower people and businesses to respect privacy, safeguard data and enable trust.

NCA warns consumers: “Your online activity creates a treasure trove of data – from your interests and purchases to your online behaviors, and it is collected by websites, apps, devices, services, and companies all around the globe, and can even include information about your physical self, like health data”

This is to share timely, helpful data privacy and litigation/risk advice and cautions for consumers and the retail, financial, healthcare, entertainment and personal services organizations targeting them from three data privacy, cybersecurity and AI experts.

Consumer Advice: Are Your Security Apps Are Putting You At Risk?

Ifrah Arif, Product Manager at PureVPN, a leader in personal cybersecurity and data privacy protections, warns: “We rely on an array of data privacy and security apps: VPNs, password managers, ad blockers, dark web monitors and more. They can conflict with one another, failing the user just when they’re needed most.”

“Non-integrated security tools from different vendors can actually drive ‘alert storms’ that put sensitive info at risk.

“Notification storms typically arise when someone’s using incompatible, non-integrated password managers, VPNs, dark web monitors, trackers, ad blockers and other security tools from differing vendors. The storm arises when tools roll out uncoordinated alerts and notifications to get the user’s attention. One tool mistakes another tool’s attempt to do its job as a threat, and sends users alerts. The resulting ‘alert fatigue’ often drives users to close their VPN or password manager, opening their devices to threats and exposing themselves to data theft and fraud.

The recent study “The Cost of Fragmentation: Measuring Time, Spend and Risk in Personal Cybersecurity Tool Stacks,” found that 44% of users receive overlapping alerts, and 38% of those receiving overlapping alerts say they ignore them.

That’s why it’s important to use an integrated suite of security tools – a single unified platform. That way, instead of juggling multiple apps competing for your attention and overriding one another, you get a single, intelligent alert stream and a single place to act on it.

B2Cs, Be Aware:  That Popular Web Visitor Tracking Tech You’re Using? It May Be Illegal.

Ian Cohen, CEO and Founder at Lokker, said: “Data Privacy Week 2026 marks a watershed moment: plaintiffs’ attorneys and regulators are no longer asking whether organizations have compliant policies. They’re demanding proof of how data is processed in practice.”

The finalization of California’s Risk Assessment and Cybersecurity Audit regulations and the CCPA (mandates and penalties now in place as of January 1st) foreshadow regulatory trends to come.

Tracking Technologies and Data Privacy

“The popular tracking technologies companies use to personalize visitors’ experiences have emerged as the primary enforcement focal point. Their widespread deployment, reliance on third parties, and tendency to change without notice place them squarely within the definition of high-risk processing.”

Cohen notes that litigation and enforcement measures will put the spotlight on whether organizations can demonstrate visibility into and control of these tracking technologies.

Why this matters:  

• 78% of sites deploy session replay tools that courts are treating as wiretap violations, and
• 49.2% of S&P 500 companies include the Meta Pixel despite its status as a frequent litigation target.

Cohen notes: “Risk exists regardless of whether consent banners are present or policies are well-drafted. The convergence of private rights of action, operational regulatory mandates, and California’s expanding pen registry framework, through CIPA enforcement and class action activities, creates an environment in which technical privacy missteps can become costly litigated events overnight if neglected or mismanaged.

“To protect themselves and their customers, organizations need continuous visibility, defensible documentation, and clear remediation capabilities.

“Moving from static representations to operational proof isn’t optional anymore. It’s the foundation of modern privacy compliance.”

Michael Bell, CEO and co-Founder of AI implementation and cybersecurity firm Suzu Labs, confirms the problem.

“For businesses with websites (i.e. virtually every business), privacy compliance is moving from documentation theater to operational proof. The regulatory environment no longer accepts “we have a policy” as sufficient. Regulators and plaintiffs now ask ‘can you prove what actually happens?’ ” Bell said.

The 92.7% Problem: “Nearly all websites load third-party trackers before user consent is given. That’s not a configuration problem at the margins. That’s an industry-wide failure of the consent model as implemented. The banner exists. The policy exists. The trackers fire anyway,” he warned.

“This is exactly the gap between stated controls and actual controls that creates legal exposure. When plaintiffs’ attorneys or regulators examine what’s technically happening versus what disclosures claim, they find daylight. That daylight becomes litigation. There’s No grace period – the CCPA came into effect January 1.”

UPDATE: I have a pair of additional comments:

Andrew Costis, Manager of the Adversary Research Team at AttackIQ:

“Data has never been more under fire than it is currently. With the introduction of AI into cybercriminal activity, the number of attack surfaces has increased dramatically, as well as the number of exploitable vulnerabilities. If organizations don’t know exactly where their sensitive data lives or how it could be accessed, with or without authorization, they’re flying blind with their security defenses.

The emulation of adversarial attack tactics and techniques is paramount to the security of an organization’s data. Validating defenses against realistic attack paths protects data proactively by not only determining where the exploitable vulnerabilities lie, but also revealing which security controls actually prevent data exfiltration. Organizations need to take away the pathways to internal systems and data before attackers can find them and exploit them.

That being said, it’s important not to overlook the basics of cybersecurity hygiene and the backbone they provide for security defenses. Maintaining up-to-date software and applying distributed patches is a key first layer of protection for both individuals and organizations. Additionally, the use of strong, unique passwords and implementation of multi-factor authentication adds multiple layers of defense, making it harder for attackers to steal data, even if a set of credentials is already exposed.”

Ross Filipek, CISO at Corsica Technologies:

“In today’s environment where data is constantly moving between clouds, partners, and internal systems, modern platforms are forced to handle increasingly complex data flows across EDI, ERP, and CRM connections. With this comes greater risk, as with more systems to secure comes more potential attack surfaces, as well as more opportunities for sensitive customer or organizational data to be exposed.

Organizations need a platform that can offer visibility into data movement to maintain control and accountability over shared data. Prioritization of real-time monitoring and proactive issue resolution can help organizations detect anomalous behavior or unauthorized access before threat actors can fully infiltrate systems. These capabilities can transform a company’s infrastructure into a defensive layer that actively increases and supports data privacy, instead of standing by and watching as attackers march right to the core of a company’s network.”

UPDATE #2: Here’s another comment that just came in from Karl Bagci, Head of Information Security, Exclaimer:

• “Email is a key target for cyber threats, which makes data privacy an everyday operational issue, not just a security concern. In regulated industries, email governance is one of the clearest signals of data protection maturity. All it takes is one unhinged email to expose risk, no matter how strong the underlying controls, audits, or certifications may be. Data Privacy Day is a reminder for organizations to embed governance into everyday communication, as this is what turns compliance from a best-effort activity into something enforceable, auditable, and sustainable.”
• “Most data privacy failures don’t start with a breach or a sophisticated cyber-attack. They begin with everyday communication that isn’t governed, where information is shared quickly and repeatedly without consistent controls. If data protection policies don’t hold up in routine email, then those policies exist on paper rather than in practice. Data Privacy Day reminds us to adopt secure practices and protect sensitive information in every communication.”
• “Data protection isn’t a policy document or a once-a-year compliance exercise. It’s an operational discipline that shows up in every external message an organization sends. The small details, the