The Adair County Board of Supervisors conducted the second reading of Ordinance No. 41 regulating data centers and cryptocurrency mining in unincorporated areas; the auditor received two letters opposing data centers and no additional public testimony was recorded.

The commission advanced commission-initiated text amendments Oct. 22 that prohibit stand-alone data centers, clarify accessory-use limits for data-processing operations, and adopt floodplain/subdivision edits required to maintain FEMA eligibility.

Responding to a question about data centers and AI, the candidate said the federal government must act to protect local communities and pointed to EPA policies as a model for giving locals time to understand project impacts.

Council unanimously adopted ordinance 15-24 to classify data centers as a restricted use in the industrial district, require conditional use permits, and make the City Council the final approval authority after Planning & Zoning review; staff cited 10–20 acres of potentially vacant industrial land and public comment called for ballot measures.

  Norway's data protection authority has issued its largest fine to date, hitting Microsoft-owned advertising company Xandr with a NOK 92 million ($9.6 million) penalty for passing sensitive personal data belonging to Norwegian Grindr users through automated advertising auctions without a legal basis. The decision, signed October 2 by Datatilsynet Director General Line Coll and Head of International Tobias Judin, targets one of the most contested privacy questions in digital advertising: whether ad intermediaries can claim ignorance of how consent was collected by the apps they serve. Grindr is a location-based dating app primarily used by gay, bisexual, trans, and queer people. For nearly two years, from July 2018 to April 2020, Xandr sat at the center of the app's advertising infrastructure, operating on both the buying and selling sides of real-time bidding. The process works fast and invisibly. The moment a user opened Grindr, the app passed their data through Xandr to a pool of companies competing in a split-second auction for the right to show that person an ad. Datatilsynet found that this relay included at minimum each user's advertising ID, IP address, and the fact of their Grindr use. Under GDPR, that last detail matters enormously. The authority concluded that being identifiable as a Grindr user is itself information that indicates sexual orientation, a category that European data law places under strict protection and requires explicit consent to process. Xandr's defense rested on the argument that it believed Grindr had already collected consent from its users. Datatilsynet rejected that reasoning on a straightforward legal basis: Xandr was not a passive conduit but a joint controller alongside Grindr. Under GDPR's joint controller framework, both parties carry independent obligations to confirm a lawful basis exists before processing sensitive data. Xandr never verified that any such basis was in place, and the authority ruled that the company had no right to treat consent as someone else's responsibility. "Xandr omitted to verify that the consents from Grindr were valid, and did not do anything to ensure they had a legal basis for their own processing," Coll stated in the decision. The investigation turned up a complicating detail. Xandr had been notified of the probe by Datatilsynet in February 2020. Despite that, the company deleted documentation about its processing of Grindr users' data between July 2020 and February 2023, when the authority sent a second information order. Xandr told investigators the deletion had occurred as part of its routine data retention policies. Datatilsynet refused to let that explanation close the gap, noting that the company knew an active investigation was underway when the records were removed. In setting the penalty at NOK 92 million, Datatilsynet cited the duration of the violations, the direct financial benefit Xandr drew from the unlawful sharing, and the fact that thousands of Norwegian users had their sensitive data exposed to potentially thousands of companies without their knowledge. Crucially, the fine was calculated against Xandr's own annual turnover and not Microsoft's. The authority noted that the violations took place before Microsoft completed its acquisition of Xandr in June 2022, after AT&T sold the unit it had rebranded from AppNexus in 2019. A Microsoft spokesperson mentioned that the investigation "focused on conduct that predates Microsoft's acquisition of Xandr," adding that interpretations and applications of legal standards have continued to evolve since then. The company said it is reviewing the decision and assessing its options. Xandr, which now operates as Microsoft Advertising, has three weeks to appeal to Norway's Privacy Appeals Board. The case has roots in January 2020, when the Norwegian Consumer Council filed complaints against Grindr and five ad tech companies: AppNexus, MoPub, OpenX, AdColony, and Smaato. Austrian privacy rights organization noyb joined the action and celebrated the outcome, calling the decision "a major blow to the online adtech industry." This week's fine against Xandr is the downstream enforcement of a broader probe that, on the Grindr side, produced a NOK 65 million penalty against the app itself in 2021. Norway's Borgarting Court of Appeal upheld that fine against Grindr in October 2025 after the company challenged it through two rounds of litigation. Grindr's data-sharing history has had consequences beyond Norwegian borders as well. In September 2026, the dating app agreed to pay £26 million to settle a UK class action brought by roughly 12,000 users who alleged the platform had shared information including HIV status, sexual orientation, ethnicity, and location with third-party advertising firms before 2020. The London lawsuit, filed in April 2024 by law firm Austen Hays, alleged violations of UK data protection law during roughly the same period covered by the Norwegian proceedings. The Datatilsynet decision marks one of the more pointed statements yet from a European privacy regulator on how far down an ad supply chain accountability can reach. By treating Xandr as a joint controller rather than an infrastructure provider, the authority made clear that operating the pipes through which sensitive data flows carries its own legal obligations, regardless of which company collected the data in the first place.

After extensive public comment and debate, the board voted to advertise a draft data-center ordinance developed by the township’s Environmental Advisory Committee and planning commission; the advertisement starts a formal public-comment and county-review period.

Ten parts and 43 sections set duties for data controllers and AI vendors handling personal data, from training to retirement. Will transition periods follow?

Ten parts and 43 sections set duties for data controllers and AI vendors handling personal data, from training to retirement. Will transition periods follow?

Mayor Davis told residents annexation authority lies with the city council for contiguous requests; County Attorney Freyberg explained that while zoning and regulation are allowed, outright bans on legal uses are typically not legally sustainable, framing why the county regulated rather than banned data centers.

Ten parts and 43 sections set duties for data controllers and AI vendors handling personal data, from training to retirement. Will transition periods follow?

Ten parts and 43 sections set duties for data controllers and AI vendors handling personal data, from training to retirement. Will transition periods follow?

Ten parts and 43 sections set duties for data controllers and AI vendors handling personal data, from training to retirement. Will transition periods follow?

Ten parts and 43 sections set duties for data controllers and AI vendors handling personal data, from training to retirement. Will transition periods follow?

AI Office: the European Commission body supervising general-purpose AI models under the EU AI Act, with power to demand data, test models and fine providers.

AI Office: the European Commission body supervising general-purpose AI models under the EU AI Act, with power to demand data, test models and fine providers.

Councilors and staff spent hours reviewing a draft ordinance for data centers, debating zoning, setbacks, water use, utility impacts, noise and decommissioning bonds. The council scheduled a follow‑up work session after requesting additional technical and legal review.

The Des Moines County Board approved a contract with the Southeast Iowa Regional Planning Commission to draft a data‑center ordinance for up to $12,000. Public commenters urged the board to move slowly, raised concerns about tax exemptions and possible on‑site power proposals, and recommended robust public engagement.

Supervisors heard a work session presentation on a contract with the Southeast Iowa Regional Planning Commission to draft a county data‑center ordinance; the contract scope includes reviewing other ordinances, outreach and a not‑to‑exceed payment of $12,000. Staff said public input and department review will follow before approval next week.

Dutch data authority releases feedback summary from consultation on meaningful human intervention requirements, revealing complex implementation challenges across organizations.

Dutch data authority releases feedback summary from consultation on meaningful human intervention requirements, revealing complex implementation challenges across organizations.

Dutch data authority releases feedback summary from consultation on meaningful human intervention requirements, revealing complex implementation challenges across organizations.

Dutch data authority releases feedback summary from consultation on meaningful human intervention requirements, revealing complex implementation challenges across organizations.

  A court in the Netherlands has taken strict action against the platform X and its artificial intelligence system Grok, directing both to stop enabling the creation of sexually explicit images generated without consent, as well as any material involving minors. The ruling carries a financial penalty of €100,000 per day for each entity if they fail to follow the court’s instructions. This decision, delivered by the Amsterdam District Court, marks a pivotal legal development. It is the first time in Europe that a judge has formally imposed restrictions on an AI-powered image generation tool over the production of abusive or non-consensual sexual content. The legal complaint was filed by Offlimits together with Fonds Slachtofferhulp. Both groups argued that the pace of regulatory enforcement had not kept up with the speed at which harm was being caused. Existing Dutch legislation already makes it illegal to create or share manipulated nude images of individuals without their permission. However, concerns intensified after Grok introduced an image-editing capability toward the end of December 2025, which led to a sharp increase in reported incidents. On February 4, 2026, Offlimits formally contacted xAI and X, demanding that the feature be withdrawn. In its ruling, the court instructed xAI to immediately halt the production and distribution of sexualized images involving individuals living in the Netherlands unless clear consent has been obtained. It also ordered the company to stop generating or displaying any content that falls under the legal definition of child sexual abuse material. Alongside this, X Corp and X Internet Unlimited Company have been required to suspend Grok’s functionality on the platform for as long as these violations continue. Legal representatives for Offlimits emphasized that the so-called “undressing” feature cannot remain active anywhere in the world, not just within Dutch borders. The court further instructed xAI to submit written confirmation explaining the steps taken to comply. If this confirmation is not provided, the daily financial penalty will continue to apply. Doubts Over Safeguards A central question for the court was whether the companies had actually made it impossible for such content to be created, as they claimed. The judges concluded that this had not been convincingly demonstrated. During a hearing on March 12, lawyers representing xAI argued that strong safeguards had been implemented starting January 20, 2026. They maintained that Grok no longer allowed the generation of non-consensual intimate imagery or content involving minors. However, evidence presented by Offlimits challenged that claim. On March 9, the same day the companies denied any remaining risk, it was still possible to produce a sexualized video of a real person using only a single uploaded image. The system did not require any confirmation of consent. The court viewed this as a contradiction that cast doubt on the effectiveness of the safeguards. The judges also pointed out inconsistency in xAI’s position regarding child sexual abuse material. The company argued both that such content could not be generated and that it was not technically possible to guarantee complete prevention. Legal Responsibility and Framework The court determined that creating non-consensual “undressing” images amounts to a violation of the General Data Protection Regulation. It also found that enabling the production of child sexual abuse material constitutes unlawful behavior under Dutch civil law. Importantly, the court rejected the argument that responsibility should fall solely on users who input prompts. Instead, it concluded that the platform itself, which controls how the system functions, must take responsibility for preventing misuse. This reasoning aligns with the Russmedia judgment issued by the Court of Justice of the European Union. That earlier ruling established that platforms can be treated as joint controllers of personal data and cannot rely on intermediary protections to avoid obligations under European data protection law. Applying this principle, the Dutch court found that xAI and X’s European entity are responsible for how personal data is processed within Grok’s image generation system. The court went a step further by highlighting a key distinction. Unlike platforms that merely host user-generated content, Grok actively creates the material itself. Because xAI designed and operates the system, it was identified as the party responsible for preventing unlawful outputs, regardless of who initiates the request. Jurisdictional Limits The ruling applies differently across entities. X Corp, which is based in the United States, faces narrower restrictions because it does not directly provide services within the Netherlands. Its obligation is limited to suspending Grok’s functionality in relation to non-consensual imagery. By contrast, X Internet Unlimited Company, which serves users within the European Union, must comply with both the ban on non-consensual sexualized content and the restrictions related to child abuse material. Increasing Global Scrutiny The case follows findings from the Center for Countering Digital Hate, which estimated that Grok generated around 3 million sexualized images within a ten-day period between late December 2025 and early January 2026. Approximately 23,000 of those images appeared to involve minors. Regulatory pressure is also building internationally. Ireland’s Data Protection Commission has launched an investigation under GDPR rules, while the European Commission has opened proceedings under the Digital Services Act. In the United Kingdom, Ofcom has initiated action under its Online Safety framework. In the United States, legal challenges have also emerged, including lawsuits filed by teenagers in Tennessee and by the city of Baltimore. At the policy level, the European Parliament has supported efforts to strengthen the AI Act by introducing an explicit ban on tools designed to digitally remove clothing from images. A Turning Point for AI Accountability Authorities are revising how they approach artificial intelligence systems. Earlier debates often treated platforms as passive intermediaries. However, systems like Grok actively generate content, which changes the question of responsibility. The decision makes it clear that companies developing such technologies are expected to take active steps to prevent harm. Claims about technical limitations are unlikely to be accepted if evidence shows that misuse remains possible. X and xAI have been given ten working days to provide written confirmation explaining how they have complied with the court’s order.

  A whirlwind of concerns around Meta’s AI-enabled smart glasses are intensifying after reports suggested that human reviewers may have accessed sensitive user recordings, raising broader questions about privacy, consent, and data protection. Online discussions have surged, with users expressing alarm over how much data may be visible to the company. Some individuals on forums have claimed that recorded footage could be manually reviewed to train artificial intelligence systems, while others raised concerns about the use of such devices in sensitive environments like healthcare settings, where patient information could be unintentionally exposed. What triggered the controversy? The debate gained momentum following an investigation by Swedish media outlets, which reported that contractors working at external facilities were tasked with reviewing video recordings captured through Ray-Ban Meta Smart Glasses. According to these findings, some of the reviewed material included highly sensitive content. The issue has since drawn regulatory attention in multiple regions. Authorities in the United Kingdom, including the Information Commissioner's Office, have sought clarification on how such user data is processed. In the United States, the controversy has also led to legal action against Meta Platforms, with allegations that consumers were not adequately informed about the device’s privacy safeguards. The timing is of essence here, as smart glasses are rapidly gaining popularity. Legal filings suggest that more than seven million units were sold in 2025 alone. Unlike smartphones, these glasses resemble regular eyewear but can discreetly capture images, audio, and video from the wearer’s perspective, often without others being aware. Why are experts concerned? Legal analysts highlight that such practices could conflict with India’s Digital Personal Data Protection Act, 2023 if data involving Indian individuals is collected. According to legal experts, consent remains a foundational requirement. Any access to recordings involving identifiable individuals must be based on informed approval. If footage is reviewed without the knowledge or permission of those captured, it could constitute a violation of Indian data protection law. Beyond legality, specialists argue that wearable AI devices introduce a deeper structural issue. Unlike traditional data collection methods, these tools continuously capture real-world environments, making it difficult to define clear boundaries for data usage. Experts also point out that although Meta includes visible indicators such as LED lights to signal recording, these measures do not fully address how the data of bystanders is processed. There are concerns about the absence of strict limitations on why such data is collected or how much of it is retained. Additionally, outsourcing the review of user-generated content introduces further complications. Apart from the risk of misuse or unauthorized sharing, there are also ethical concerns regarding the working conditions and psychological impact on individuals tasked with reviewing potentially distressing material. Cross-border and systemic risks Another key concern is international data handling. If recordings involving Indian users are accessed by contractors located overseas, companies are still expected to maintain the same standards of security and confidentiality required under Indian regulations. Experts emphasize that these devices are part of a much larger artificial intelligence ecosystem. Data captured through smart glasses is not simply stored. It may be uploaded to cloud servers, processed by machine learning systems, and in some cases, reviewed by humans to improve system performance. This creates a chain of data handling where highly personal information, including facial features, voices, surroundings, and behavioral patterns, may circulate beyond the user’s direct control. What is Meta’s response? Meta has stated that protecting user data remains a priority and that it continues to refine its systems to improve privacy protections. The company has explained that its smart glasses are designed to provide hands-free AI assistance, allowing users to interact with their surroundings more efficiently. It also acknowledged that, in certain cases, human reviewers may be involved in evaluating shared content to enhance system performance. According to the company, such processes are governed by its privacy policies and include steps intended to safeguard user identity, such as automated filtering techniques like face blurring. However, reports citing Swedish publications suggest that these safeguards may not always function consistently, with some instances where identifiable details remain visible. While recording must be actively initiated by the user, either manually or through voice commands, experts note that many users may not fully understand that their captured content could be subject to human review. The Ripple Effect This controversy reflects a wider shift in how personal data is generated and processed in the age of AI-driven wearables. Unlike earlier technologies, smart glasses operate in real time and in shared environments, raising complex questions about consent not just for users, but for everyone around them. As adoption runs rampant, regulators worldwide are likely to tighten scrutiny on such devices. The challenge for companies will be to balance innovation with transparent data practices, especially as public awareness around digital privacy continues to rise. For users, this is a wake up call to not rely on new age technology blindly and take into account that convenience-driven technologies often come with hidden trade-offs, particularly when it comes to control over personal data.