Moderate
Guidance
Published
KE · Sep 16, 2026
Kenya publishes new guidance on cross‑border data transfers
On 8 September 2026 Kenya’s Office of the Data Protection Commissioner released detailed Guidance Notes on cross‑border data transfers. The guidance clarifies Kenya’s transfer framework, adds operational detail, and highlights differences…
Office of the Data Protection Commissioner (ODPC) · General Data Protection Regulation
Moderate
Proposed bill
Passed
California · Sep 15, 2026
California legislature passes three AI employment bills pending Governor's signature
The California State Legislature approved SB 947, SB 951, and AB 1883, which impose restrictions on automated decision systems, require technology displacement notices under Cal/WARN, and limit workplace surveillance tools. Each bill would…
California Labor Commissioner · SB 947 (No Robo Bosses Act)
Moderate
Proposed bill
Announced
European Union · Sep 14, 2026
EU Commission to propose EU-wide minimum age for social media, linked to Digital Fairness Act
The European Commission will release a legislative proposal by the end of 2026 establishing an EU-wide minimum age for social media, building on the Special Panel's age‑tiered framework. The proposal may be incorporated into the Digital…
European Commission · Digital Services Act
Moderate
Proposed bill
Passed
California · Sep 14, 2026 · effective Jan 1, 2027
California Legislature passes SB 690 to limit pen register lawsuits under CIPA
On August 28, 2026 the California Legislature passed SB 690, a bill that would eliminate private lawsuits for website-based pen register claims under the California Invasion of Privacy Act. The bill would restrict such claims to actions…
California Attorney General · California Invasion of Privacy Act (CIPA)
Moderate
Investigation
Announced
United States (federal) · Sep 14, 2026
Police misuse ALPR data with frivolous reasons, EFF finds
EFF analysis of Flock Safety ALPR logs shows officers across the United States entering nonsensical reasons such as "LOL", "LMAO" and "idk" to access vehicle location data. The lack of warrant requirements and weak audit controls enables…
CPPA · California Delete Act
Moderate
Final regulation
In effect
European Union · Sep 11, 2026 · effective Sep 11, 2026
EU Cyber Resilience Act reporting obligations take effect for manufacturers
As of September 11, 2026, manufacturers of products with digital elements are subject to new incident reporting obligations under the EU Cyber Resilience Act. The obligations require manufacturers to report cybersecurity incidents related…
European Commission · Cyber Resilience Act
Moderate
Guidance
Announced
European Union · Sep 11, 2026
ENISA launches Single Reporting Platform for Cyber Resilience Act reporting
ENISA has deployed the initial operating capability of the Single Reporting Platform (SRP) to support the Cyber Resilience Act (CRA) reporting obligations. From 11 September 2026 manufacturers and open‑source software stewards must report…
ENISA · Cyber Resilience Act
Moderate
New law
Signed
California · Sep 10, 2026
California AB 1709, a ban on social media for under‑16, signed into law
AB 1709 was signed into law by Governor Gavin Newsom. The law imposes a functional ban on social media use for people under the age of 16 and requires age‑verification. Critics say the ban will increase data collection and limit free…
AB 1709
Moderate
Fine
Announced
Netherlands · Sep 10, 2026
Dutch DPA fines Uber €824,990,000 for automated decisions affecting drivers
On August 21, 2026, the Dutch Data Protection Authority announced it had fined Uber €824,990,000 for breaching the EU GDPR rules on solely automated decision‑making. The fine targets Uber's use of automated systems that affect driver…
Dutch Data Protection Authority · General Data Protection Regulation
Moderate
Proposed regulation
Proposed
France · Sep 10, 2026
CNIL to examine draft deliberation on finance bill 2027 provisions for online platform content collection for tax purposes
The CNIL plenary session on 10 September 2026 will examine a draft deliberation giving an opinion on provisions of the 2027 finance bill that would perpetuate the collection and exploitation of content from online platforms for tax…
Commission nationale de l'informatique et des libertés (CNIL) · projet de loi de finances pour 2027
Moderate
Guidance
In effect
France · Sep 10, 2026 · effective Sep 1, 2026
CNIL guidance on data‑protection obligations under the electronic invoicing reform effective 1 Sept 2026
The CNIL explains the data‑protection implications of the French electronic invoicing reform that entered into force on 1 Sept 2026. It details which personal data may be processed, the roles of issuers, receivers and certified platforms…
CNIL · réforme relative à la facturation électronique
Moderate
Guidance
Published
France · Sep 10, 2026
CNIL releases Volume 2 of “L’Agence Privacy” to educate adolescents on cybercrime and data privacy
On 10 September 2026 the French data‑protection authority CNIL published the second volume of its educational comic series “L’Agence Privacy”. The free online and paper resource targets teenagers and parents, covering risks such as…
CNIL
Moderate
Proposed regulation
Proposed
European Union · Sep 10, 2026
EU Commission proposes Article 88b for automated privacy signals in Digital Omnibus
The European Commission, as part of the Digital Omnibus package, proposed legally binding automated privacy signals under Article 88b of the GDPR to replace cookie banners. The proposal would let users set their privacy preferences once…
European Commission · California Delete Act
Moderate
Enforcement
Announced
Spain · Sep 9, 2026
AEPD opens investigation into Ministry of Interior report listing journalists and political leanings
The Spanish Data Protection Agency announced it will launch a formal, ex officio investigation into a Ministry of Interior communication office report that includes journalists' names and alleged political ideologies. The probe will…
Agencia Española de Protección de Datos · Reglamento General de Protección de Datos (RGPD)
Moderate
Guidance
Repealed
United States (federal) · Sep 9, 2026 · effective Sep 9, 2026
FTC rescinds 2021 Policy Statement on Breaches by Health Apps and Connected Devices
The Federal Trade Commission announced it is rescinding the 2021 Policy Statement on Breaches by Health Apps and Other Connected Devices. The guidance is deemed obsolete and is being withdrawn. The rescission was published on 2026-09-09.
Federal Trade Commission
Moderate
Lawsuit filed
Filed
United States (federal) · Sep 8, 2026
EFF releases 1,000 pages of CMS records on AI-driven Medicare WISeR prior‑authorization program
EFF obtained about 1,000 pages of CMS documents through its FOIA lawsuit filed in March, revealing delays, denials, and financial incentives in the WISeR AI model. The records show requests sometimes waited up to 83 days and vendors denied…
Centers for Medicare & Medicaid Services (CMS)
Moderate
Enforcement
Decided
Ireland · Sep 7, 2026
Irish DPC welcomes court conviction of Brown Thomas for ePrivacy breaches
The Dublin Metropolitan District Court convicted Brown Thomas Arnotts Limited on 7 September 2026 for multiple breaches of Regulation 13 of the ePrivacy Regulations. The company pleaded guilty to five sample charges, including failures to…
Data Protection Commission · ePrivacy Directive
Moderate
Guidance
Announced
United States (federal) · Sep 3, 2026
SEC Investor Advisory Committee to Host Sept. 10 Meeting on AI Technologies and NMS Rules
The U.S. Securities and Exchange Commission’s Investor Advisory Committee will hold a public meeting on Sept. 10, 2026 to discuss artificial intelligence technologies in the public markets and the SEC’s Regulation National Market System…
Securities and Exchange Commission · Regulation National Market System
Moderate
Proposed regulation
Announced
France · Sep 3, 2026
CNIL agenda includes review of draft decrees on automated personal data processing and authorizations for health data studies
The CNIL plenary session agenda for 3 September 2026 lists examinations of draft deliberations on a decree modifying decree n° 2023‑935 for the SISPoPP system, a draft decree on the API‑PNR France system, and authorizations for RCTs, IQVIA…
Commission nationale de l'informatique et des libertés (CNIL) · General Data Protection Regulation
Moderate
Executive order
Signed
United States (federal) · Sep 2, 2026 · deadline Sep 30, 2026
Texas bans state funding for ALPRs; Florida orders removal of highway ALPRs
On August 28, Texas Governor Greg Abbott issued an order prohibiting state agencies from spending public funds on Flock ALPR cameras. On August 31, the Florida Department of Transportation, announced by Governor Ron DeSantis, issued a memo…
