GME3: Fifty Shades of Grey Market, 23andBreach & Big App v. Big Apple

This week’s GME3 is all about blurred lines – and who’s responsible for drawing them. A new report shows Alberta and B.C. gamblers are still flocking to the grey market, privacy regulators in Canada and the U.K. call out 23andMe for failing to protect genetic data, and X is suing New York over a law it says crosses the line on free speech. Read the full stories below!

Gambling

Fifty Shades of Grey Market

A new Ipsos report commissioned by the Canadian Gaming Association (CGA) highlights the widespread use of unregulated online gambling platforms in Alberta and British Columbia. The study surveyed over 2,600 online gamblers between February and March 2025 and found that a significant majority in both provinces are placing bets outside government-regulated channels.

In Alberta, nearly 90% of respondents reported gambling on unregulated websites in the previous three months. Only 10.4% said they used Play Alberta – the province’s sole regulated platform – exclusively, and just 22.7% used it at all. The remaining 77.3% relied solely on unregulated operators, resulting in a notably low “channelization” rate. In B.C., where the BCLC’s PlayNow has operated for much longer, the situation is slightly better. Around 60.4% of gamblers used only unregulated sites, while 23.9% used PlayNow exclusively and 15.6% used both.

The report also uncovered a widespread misconception among players: more than half of those gambling on unregulated sites mistakenly believed they were using regulated platforms. In Alberta, 55% of unregulated site users thought they were on legal platforms; in B.C., the figure was 51%. This confusion underscores a major education gap in both provinces.

The findings come at a pivotal time for Alberta, which is preparing to launch a regulated private market similar to Ontario’s. Since launching its open market in 2022, Ontario has achieved a channelization rate of 83.7%, with only 16.3% of online gamblers still using exclusively unregulated sites. The CGA argues Alberta and B.C. could see similar improvements through market liberalization, clearer regulation, and better consumer awareness.

Media

23andBreach

A joint investigation by Canadian and U.K. privacy regulators has found that genetic testing company 23andMe failed to implement basic security measures to protect customer data, leading to a massive data breach affecting nearly seven million people globally – including 320,000 in Canada and over 150,000 in the U.K. The breach, which came to light in 2023, exposed sensitive personal and genetic information, particularly targeting customers with Chinese and Ashkenazi Jewish ancestry.

U.K. Information Commissioner John Edwards has fined the company £2.31 million (CAD $4.24 million), citing inadequate security systems and a slow response to warning signs. Canada’s privacy commissioner, Philippe Dufresne, while unable to issue fines under current law, strongly criticized 23andMe’s lack of safeguards and called for reforms to give his office more enforcement powers.

The compromised data included not just contact details, but also DNA-derived insights related to health, race, ethnicity, and familial relationships. Privacy commissioners warned that such breaches carry long-term risks – unlike passwords, genetic makeup can’t be changed.

The investigation, launched in June 2024, also found that 23andMe failed to meet notification requirements under Canadian and U.K. law, leaving affected individuals in the dark. The company later settled a U.S. class action lawsuit for USD $30 million and filed for bankruptcy in March 2025. A nonprofit led by co-founder Anne Wojcicki acquired it for USD $305 million.

Both regulators urged stronger data protections, with Dufresne emphasizing the need for tools like mandatory multi-factor authentication and better breach detection. He also renewed calls for updated Canadian privacy legislation to allow for timely, enforceable actions when serious breaches occur.

Entertainment

Big App v. Big Apple

Elon Musk’s X (formerly Twitter) has filed a lawsuit against New York state, challenging a law that requires social media companies to disclose how they monitor and handle hate speech, extremism, and similar content. The platform argues that the law, known as the Stop Hiding Hate Act, violates the First Amendment by compelling companies to reveal how they manage “highly sensitive and controversial speech.”

Filed on Tuesday, the suit names New York Attorney General Letitia James as the defendant and comes amid broader legal debates over the limits of government regulation of online speech. X claims that deciding what speech should be moderated is a matter of public discourse, not a role for lawmakers, and asserts that the law intrudes on editorial judgment protected by the Constitution.

The Stop Hiding Hate Act, passed in December, requires platforms to publicly disclose their moderation policies and actions taken against hateful content. Its sponsors, Senator Brad Hoylman-Sigal and Assemblymember Grace Lee, argue the law is necessary because platforms like X have become “cesspools of hate speech” and have failed to keep the public informed about their enforcement efforts. They insist the law is consistent with constitutional protections.

X’s suit echoes its earlier legal victory in California, where a similar law was blocked. The company criticized New York for not adjusting its legislation in light of that precedent. Experts note that Musk has not only loosened moderation rules on X since acquiring the company in 2022, but also cut enforcement resources – contributing to a noticeable rise in spam and hate speech. Last year, a judge also dismissed Musk’s lawsuit against researchers who reported an increase in harmful content on the platform.