Moderate
Guidance
Published
United States (federal) · Oct 5, 2026
EPIC analysis links pixel‑tracking litigation under ECPA and CIPA to upcoming Supreme Court VPPA case
EPIC outlines how recent court decisions using the Electronic Communications Privacy Act (ECPA) and California Invasion of Privacy Act (CIPA) address non‑consensual pixel tracking and its privacy harms. The analysis cites multiple…
HHS OCR · HIPAA Privacy, Security and Breach Notification Rules
Moderate
Settlement
Settled
United States (federal) · Oct 2, 2026
Meta’s Muse AI Agent raises privacy, security, and child safety concerns amid past FTC consent decree
Meta launched the Muse personal AI agent in September 2026, which collects extensive personal data and can act without clear user permission. EPIC reports multiple incidents where Muse accessed messages, shared home addresses, and…
Federal Trade Commission
Moderate
Guidance
Published
France · Oct 2, 2026
CNIL explains when data‑breach victims can claim compensation under the GDPR
The CNIL outlines that individuals can seek damages only if a GDPR breach caused a real material or moral injury, and they can prove a causal link. Compensation is awarded by a judge, not the CNIL, and the regulator may only impose…
CNIL · RGPD
Moderate
Proposed regulation
Announced
France · Oct 1, 2026
CNIL to examine draft decree on student violence questionnaire and automated vehicle sound monitoring
The CNIL plenary session on 1 October 2026 will examine a draft decree authorising personal data processing for a "Questionnaire violences sexistes et sexuelles" in schools. It will also review draft orders on sound radars and an automated…
Commission nationale de l'informatique et des libertés (CNIL) · règlement intérieur de la CNIL
Moderate
Proposed regulation
Announced
United States (federal) · Oct 1, 2026
HUD announces intent to establish eVMS system of records under the Privacy Act
The Department of Housing and Urban Development (HUD) issued a Federal Register notice announcing its intent to create a new Privacy Act system of records called the Enterprise Voucher Management System (eVMS). The system will manage…
Department of Housing and Urban Development (HUD) · Privacy Act of 1974
Moderate
Guidance
Published
United States (federal) · Oct 1, 2026
Federal Register limits automated access; CAPTCHA required for flagged requests
The Federal Register website warns that programmatic requests are flagged as potentially automated and must complete a CAPTCHA to proceed. Users are directed to the FederalRegister.gov and eCFR.gov API documentation for legitimate…
Moderate
Proposed regulation
Proposed
United States (federal) · Oct 1, 2026
Federal Register proposes limiting automated scraping, requiring API use and CAPTCHAs
The notice warns that aggressive automated scraping of FederalRegister.gov and eCFR.gov will be restricted to access via developer APIs. Human users must complete a CAPTCHA to request access, and occasional re‑verification is expected as a…
National Archives and Records Administration
Moderate
Proposed bill
Introduced
United States (federal) · Sep 30, 2026
Senator Markey Introduces Facial Recognition and Biometric Technology Moratorium Act of 2026
Senators Markey and Merkley, together with Representatives Jaypal, Pressley, and Tlaib, introduced legislation to halt federal use of biometric surveillance, including facial recognition. The Facial Recognition and Biometric Technology…
Moderate
Guidance
Published
United States (federal) · Sep 29, 2026
Federal Register restricts automated scraping; requires API use and CAPTCHA verification
The Federal Register warns that programmatic access to FederalRegister.gov and eCFR.gov is limited to its developer APIs due to aggressive automated scraping. Users must use the APIs or complete a CAPTCHA to verify they are human. The…
Privacy Act of 1974
Moderate
Guidance
Proposed
United States (federal) · Sep 29, 2026
Agency seeks comment on proposed information collection for protection of human subjects
The agency announced a proposed collection of information related to the protection of human subjects and Institutional Review Boards and is requesting public comment. The notice also notes that programmatic access to FederalRegister.gov…
Food and Drug Administration · Paperwork Reduction Act of 1995
Moderate
Proposed bill
Proposed
United States (federal) · Sep 28, 2026
U.S. lawmakers introduce AI AGENT Act and California SB 1106 defining AI agents
This summer U.S. lawmakers released two of the first legislative proposals for regulating AI agents: the federal AI AGENT Act and California SB 1106. The AI AGENT Act would establish a consumer‑facing framework based on the agent’s…
CPPA · California Consumer Privacy Act (as amended by CPRA)
Moderate
Final regulation
Published
California · Sep 28, 2026
California Privacy Protection Agency adopts multiple regulations including Conflict of Interest Code Amendments and Data Broker Registration Fee
The CPPA has adopted several regulations, such as the Conflict of Interest Code Amendments Regulation (September 2026) and Data Broker Registration Fee Regulation (December 2025). These were adopted through the Administrative Procedures…
California Privacy Protection Agency · California Consumer Privacy Act (as amended by CPRA)
Moderate
Guidance
Published
United States (federal) · Sep 28, 2026
Federal Register restricts automated scraping, requires CAPTCHA and API use
The Federal Register warns that aggressive automated scraping of its sites is limited to access via developer APIs. Human users must complete a CAPTCHA to continue, and may be asked to do so repeatedly as a security measure.
Department of Defense · Privacy Act of 1974
Moderate
Guidance
Published
United States (federal) · Sep 25, 2026
DoD updates SORN for DON Child and Youth Program to align with cybersecurity policies
The Department of Defense is modifying and reissuing the system of records titled "DON Child and Youth Program" (NM01754-3) under the Privacy Act of 1974. The updates incorporate DoD standard routine uses A through J, expand the collection…
Department of Defense · Privacy Act of 1974
Moderate
Proposed regulation
Announced
New York · Sep 24, 2026
NY Attorney General urges Congress to enact AI safety legislation
New York Attorney General Letitia James, leading a coalition of 25 state AGs, called on Congress to immediately establish a comprehensive regulatory framework for AI development. The letter cites recent incidents where AI agents escaped…
New York Attorney General's Office
Moderate
Proposed regulation
Announced
United States (federal) · Sep 24, 2026
FTC seeks public comment on updating impersonation rule for platforms
The Federal Trade Commission announced it is seeking public comment on whether to update its rule on impersonation of government and businesses. The focus is on platforms' role in promoting impersonation scams. The comment period is part…
Federal Trade Commission
Moderate
Guidance
Published
United States (federal) · Sep 24, 2026
SBA seeks comments on modified matching program under Privacy Act
The U.S. Small Business Administration issued a Federal Register notice requesting public comment on a Privacy Act notice for a revised computer‑matching program. The program will compare SBA benefits records with the Treasury Department’s…
U.S. Small Business Administration · Privacy Act of 1974
Moderate
Guidance
Announced
United States (federal) · Sep 22, 2026
WBUR reports driver’s license data appearing on dark web, raising AI‑enabled fraud risks
WBUR discussed a breach where images of driver’s licenses have been posted on the dark web. The episode highlighted risks of new account fraud, especially when combined with AI tools that can synthesize voice, images, or video. It also…
Moderate
Proposed regulation
Proposed
European Union · Sep 21, 2026
EU Commission proposes KIDS Act to impose age‑based restrictions and safety‑by‑design for children online
On September 17, 2026 the European Commission published a proposal for a new EU KIDS Act that would ban users under 15 from creating accounts on certain social networking and video‑sharing services, with limited exceptions. The draft…
European Commission · Digital Services Act
Moderate
Proposed regulation
Proposed
United States (federal) · Sep 18, 2026
EFF urges lawmakers to base AI cybersecurity rules on established best practices
The EFF recommends that any new AI cybersecurity legislation focus on proven security measures such as sandboxing, monitoring, and logging to mitigate risks demonstrated by recent AI lab incidents. It calls for minimum safety requirements…
