US Law Firm Accuses Lenovo of Bulk Data Transfers to China

[Brownie2019]

Content source

https://cybersecuritynews.com/us-law-firm-accuses-lenovo/

A U.S. law firm has filed a proposed class action alleging that Lenovo’s website tracking and advertising infrastructure enabled “bulk” transfers of Americans’ sensitive identifiers and browsing context to entities tied to China, in violation of the Justice Department’s Data Security Program rules.

The complaint, filed by Almeida Law Group on behalf of San Francisco resident Spencer Christy, frames the alleged conduct as both a privacy harm and a national security risk under the DOJ’s Bulk Sensitive Data Transfer Rule (28 C.F.R. Part 202).

Full Story:

US Law Firm Accuses Lenovo of Bulk Data Transfers to China

A U.S. law firm has filed a proposed class action alleging that Lenovo’s website tracking and advertising infrastructure enabled “bulk” transfers of Americans’ sensitive identifiers and browsing context to entities tied to China, in violation of the Justice Department’s Data Security Program rules.

cybersecuritynews.com

 

[Bot]

Full Story:

US Law Firm Accuses Lenovo of Bulk Data Transfers to China

A U.S. law firm has filed a proposed class action alleging that Lenovo’s website tracking and advertising infrastructure enabled “bulk” transfers of Americans’ sensitive identifiers and browsing context to entities tied to China, in violation of the Justice Department’s Data Security Program rules.

cybersecuritynews.com

This is a (so far) unproven allegation in a newly filed proposed class action, but it’s notable because it tries to apply the DOJ’s newer “Data Security Program” / Bulk Sensitive Data Transfer Rule framework (28 C.F.R. Part 202) to ordinary website tracking/advertising tech.

What’s been filed (and what hasn’t been proven)

A complaint titled Christy v. Lenovo (United States) Inc. was filed in the U.S. District Court for the Northern District of California on February 5, 2026 (case 3:26-cv-01133). ([cand.uscourts.gov](https://cand.uscourts.gov/cases-e-filing/cases/326-cv-01133/christy-v-lenovo-united-states-inc?utm_source=openai))

The plaintiff alleges Lenovo’s US website loads third‑party tracking/advertising tools and that this results in “bulk” transfers of covered identifiers and browsing context to “covered persons” tied to China, violating 28 C.F.R. Part 202 (and also alleges other privacy law theories). ([theregister.com](https://www.theregister.com/2026/02/17/lenovo_privacy_lawsuit/?utm_source=openai))

Lenovo has publicly denied improper sharing, saying the suggestion is “false” and that it complies with applicable requirements. ([theregister.com](https://www.theregister.com/2026/02/17/lenovo_privacy_lawsuit/?utm_source=openai))

Key point: a complaint is just an accusation; there’s no court finding yet, no class certification yet, and the facts/technical claims will be contested.

Why Part 202 is being pulled into a “website trackers” case

28 C.F.R. Part 202 (DOJ’s Data Security Program) is designed to restrict/prohibit certain covered data transactions involving “bulk” sensitive personal data and “countries of concern” / “covered persons.” The rule’s effective date was April 8, 2025, with a “good faith” safe harbor period DOJ discussed that ended July 8, 2025; additional compliance-related provisions had later effective dates (commonly cited as October 6, 2025). ([hoganlovells.com](https://www.hoganlovells.com/en/publications/new-doj-rule-limits-crossborder-data-transfers-to-protect-national-security?utm_source=openai))

The lawsuit theory (as summarized by multiple outlets) is essentially: modern ad-tech ecosystems can behave like automated cross-border “data pipelines,” and if the recipient/ultimate controller is deemed a “covered person,” routine tracking could become a regulated (or prohibited) transfer when done at scale. ([theregister.com](https://www.theregister.com/2026/02/17/lenovo_privacy_lawsuit/?utm_source=openai))

Practical takeaways for users (regardless of the lawsuit outcome)

Even if this case goes nowhere, it’s a good reminder that “basic web hygiene” still matters:

• Use a reputable content/tracker blocker (e.g., uBlock Origin). This reduces third-party beacons/pixels on vendor sites.
• Block third-party cookies (or use strict tracking protection). This won’t stop every form of tracking, but it helps.
• Treat a vendor’s shopping/support site as “high tracking probability” and consider using a separate browser profile/container for it.
• Don’t rely on a VPN to “stop tracking.” A VPN may hide your IP from the site, but it typically does not prevent tracker scripts from running in your browser.

What to watch next

The only reliable way to track the truth here is the docket/filings and any technical evidence (expert declarations, tag audits, etc.). The ND California case page shows the filing date and publicly available documents as they appear. ([cand.uscourts.gov](https://cand.uscourts.gov/cases-e-filing/cases/326-cv-01133/christy-v-lenovo-united-states-inc?utm_source=openai))

Sources

• US lawyers file privacy class action against Lenovo
• Christy v. Lenovo (United States) Inc.
• Lenovo Hit With Suit for Breaking US Bulk Data Transfer Rule (1)
• New DOJ rule limits cross-border data transfers to protect national security
• Maturing Compliance with the Bulk Sensitive Data Rule (Data Security Program) before the July 8, 2025 Safe Harbor Expires

 

[Parkinsond]

Your car is spying on you – and Israeli firms are leading the surveillance race

From Hands-free Systems to Tire-pressure Data, a New Field Known as CARINT Turns Vehicles Into Powerful Intelligence Tools

www.haaretz.com

 

[Halp2001]

The unsettling part is not only the flow of data, but the crack it opens in digital trust. Each accusation of this magnitude reminds us that corporate walls may be far more porous than they appear, and that technological sovereignty is played out on a board where users barely glimpse the pieces.

 

[oldschool]

Start driving cars without internet, Apple Auto, Android Auto, etc.. My Hyundai Elantra GT doesn't even have working Bluelink, and is no longer supported since it uses 2G cellular.

Time for back to the future a la Mad Max. Go retro baby!

where users barely glimpse the pieces.

Users have no control as they're only pawns. Corporations rule.

 

[Parkinsond]

Go retro baby!

oldschool driving

 

[TuxTalk]

I just have a Normal Hyundai i30 CW, no internet, no carplay, no android auto, no calling home, and most important, not electric/hybrid , Petrol is the way to go.
The driving range on a full charge is simply not sufficient.

 

[Wrecker4923]

While the allegations are unproven and will be contested, the case highlights how standard ad-tech data flows, persistent IDs, plus URL-level context, can be framed as “bulk sensitive personal data” when aggregated and linked to covered persons in countries of concern.

Chinese companies should have no ad tech in their products sold in the US or whatever. (Also good for Google, Meta, etc.) I wonder if China can ask for the same treatment for Google, etc.

 

[Parkinsond]

Chinese companies should have no ad tech in their products sold in the US or anywhere else. (Also good for Google, Meta, etc.) I wonder if China can ask for the same treatment for Google, etc.

They may offer ads on their BYD electric cars dash displays

 

[ForgottenSeer 123960]

There is a well-documented track record of similar security concerns involving Lenovo's hardware and software.

Lenovo has faced long-standing accusations regarding potential, state-sponsored backdoors, leading to bans on its equipment within intelligence and defense networks in the U.S., UK, Canada, Australia, and New Zealand since the mid-2000s. Concerns center on suspected BIOS-level vulnerabilities, pre-installed adware like Superfish, and ties to the Chinese military.

Reports indicate that in 2008, U.S. Marine Corps officials in Iraq found that certain Lenovo machines were transmitting data to China, as noted in this PDF from China Tech Threat.

IOActive researchers discovered flaws in 2015 that could allow for malware installation or remote control.

Despite the bans, the U.S. government continued to purchase Lenovo equipment for some non-sensitive uses. Lenovo has consistently denied these accusations, stating that claims regarding government ties are based on inaccurate or outdated information.

While some reports suggest the accusations were based on older, resolved issues, others argue the risks of espionage remain, especially for sensitive data.

 

[Zero Knowledge]

Lenovo is a Chinese company so isn't it obvious data flows back to China? I'm not surprised and for consumers I don't think there is a big risk.

And you should be rolling in a 1966 Ford Mustang . And Chinese electric cars are very very good at great prices, don't dismiss them just because they are Chinese.

 

[Parkinsond]

Lenovo is a Chinese company so isn't it obvious data flows back to China? I'm not surprised and for consumers I don't think there is a big risk.

And you should be rolling in a 1966 Ford Mustang . And Chinese electric cars are very very good at great prices, don't dismiss them just because they are Chinese.

Xiaomi is harvesting my data since 2018; I am still fine

 

[Zero Knowledge]

Xiaomi is harvesting my data since 2018; I am still fine

Everyone has been harvesting data since the early 2000's when companies and governments realized there was power and money to made.

Makes you want to go back to the early, mid, late 90's when things were much simpler with no tracking except for hit counters.

 

[Parkinsond]

Makes you want to go back to the early, mid, late 90's

The good old days of Windows 98

 

[ForgottenSeer 123960]

In the modern digital landscape, you don't need to be a high-value intelligence target to be caught in the middle of a geopolitical data dispute; simply browsing a laptop manufacturer's website is enough to become part of a "bulk sensitive data" transfer.

 

[Zero Knowledge]

In the modern digital landscape, you don't need to be a high-value intelligence target to be caught in the middle of a geopolitical data dispute; simply browsing a laptop manufacturer's website is enough to become part of a "bulk sensitive data" transfer.

Yes but as you said in your previous post most Western allies and Western aligned countries have rules banning certain countries from government use.

Even industries that use Lenovo like universities I'm thinking the Lenovo X1 Carbon laptops which are common in education and enterprise have them locked down.

 

[ForgottenSeer 123960]

Yes but as you said in your previous post most Western allies and Western aligned countries have rules banning certain countries from government use.

Even industries that use Lenovo like universities I'm thinking the Lenovo X1 Carbon laptops which are common in education and enterprise have them locked down.

When we shift the focus from consumer data harvesting to the targeting of U.S. critical infrastructure, the threat model changes fundamentally, we are no longer just talking about passive espionage; we are talking about the capability for active sabotage.

U.S. intelligence and cybersecurity agencies, including CISA, the NSA, and the FBI, have been sounding the alarm on this exact issue. In fact, the FBI Director recently called this specific Chinese cyber activity "the defining threat of our generation.

Historically, Chinese state-sponsored hackers focused on intellectual property theft, stealing military secrets, corporate research, and technology.

However, recent operations spearheaded by state-sponsored groups like Volt Typhoon and Salt Typhoon are entirely different. They are targeting "lifeline" sectors, communications, the power grid, water and wastewater facilities, and transportation networks. The goal here isn't to steal data. It is to secretly embed themselves within these systems and "pre-position" for the future.

When you aggregate the consumer-level data harvesting with the critical infrastructure targeting, the strategic rationale behind these warnings becomes undeniable.

 

[Wrecker4923]

And Chinese electric cars are very very good at great prices, don't dismiss them just because they are Chinese.

Xiaomi is harvesting my data since 2018; I am still fine

Using Chinese products is inevitable for me economically. I sometimes feel bitter that their security postures seem to indicate a setup for surveillance or future transformation into state instruments. My Chinese phone wouldn't allow email alias registration, only for Google email; it also allows only a 16-character PIN, which makes it impossible to use a strong passphrase. My Chinese DVR has a "cloud-encryption" password of 12 characters; okay, but if it is even "encrypted" in the first place, a 12-character password, even a randomly generated one, still seems crackable at this point. I know they generally tell you to assume incompetence over malice, but still, the doubt is always there.

 

[oldschool]

And Chinese electric cars are very very good at great prices, don't dismiss them just because they are Chinese.

The U.S. electric car market would be up shitz creek if Chinese electrics didn't face such huge tariffs. Their cars are clearly superior to American brands.

 

[Zero Knowledge]

Spoiler: Old school and the art of car maintenance

View attachment 295731

When blackface was deemed funny? Something about changing the oil of your car engine and filling up your tank with diesel while getting a nice buzz from the fumes.

Seriously though BWD and the other electric car makers are very good, the problem is they are probably built on stolen IP. But if the price is right who cares?

Same with Lenovo laptops, they are very very good and have a very good entry price point when on sale or through the EDU portal.