Moderate
Proposed regulation
Proposed
France · Oct 15, 2026
CNIL examines draft decree on real‑time audio capture by public transport operators
The CNIL plenary session on 15 October 2026 will examine a draft deliberation providing an opinion on a draft decree concerning the experimentation of real‑time sound capture and transmission systems by bus and coach operators. The agenda…
Commission nationale de l'informatique et des libertés (CNIL) · décret n° 2022‑377 du 17 mars 2022
Moderate
Proposed regulation
Proposed
United States (federal) · Oct 15, 2026
DOJ proposes exemption for BJS statistical data system from certain Privacy Act provisions
The Office of Justice Programs announced a notice of a new system of records, BJS Statistical Data (JUSTICE/OJP-017), covering data collected under 34 U.S.C. 10132. The agency proposes to exempt this system from specific Privacy Act…
U.S. Department of Justice, Office of Justice Programs · Privacy Act of 1974
Moderate
Proposed regulation
Proposed
United States (federal) · Oct 15, 2026
DOJ EOIR proposes new system of records for Fraud and Abuse Prevention Program
The Executive Office for Immigration Review (EOIR) intends to create a new system of records notice, JUSTICE/EOIR-006, to cover all Fraud and Abuse Prevention Program records. The new notice would replace partial coverage under the…
Department of Justice · Privacy Act of 1974
Moderate
Proposed regulation
Proposed
United States (federal) · Oct 15, 2026
DOJ proposes to exempt EOIR "Fraud and Abuse Prevention Program Records" from certain Privacy Act provisions
The Executive Office for Immigration Review (EOIR) announced a new system of records titled "Fraud and Abuse Prevention Program Records" (JUSTICE/EOIR-006). EOIR proposes to exempt this system from specific provisions of the Privacy Act to…
Executive Office for Immigration Review · Privacy Act of 1974
Moderate
Proposed regulation
Proposed
Vermont · Oct 8, 2026
Future of Privacy Forum submits comments on Vermont Age-Appropriate Design Code rulemaking
On October 2, 2026 the Future of Privacy Forum filed comments to the Vermont Attorney General’s rulemaking for the Age-Appropriate Design Code. The act, enacted in June 2025, sets duties for businesses serving minors and will become…
Vermont Office of the Attorney General · California Age-Appropriate Design Code Act
Moderate
Proposed regulation
Proposed
France · Oct 8, 2026
CNIL examines draft deliberation authorizing BIG DATA SANTE to process personal data for anonymized medical research (ONCOVAL)
During its plenary session on 8 October 2026, the CNIL will consider a draft deliberation that would permit BIG DATA SANTE (Octopize Mimethik Data) to carry out automated processing of personal data to create anonymised datasets for…
Commission nationale de l'informatique et des libertés (CNIL) · Law of 6 January 1978
Moderate
Proposed regulation
Proposed
United States (federal) · Oct 7, 2026
DOJ proposes exemption for Firearms Rights Restoration Electronic Records Database from Privacy Act provisions
The Office of the Pardon Attorney within the U.S. Department of Justice announced a notice of a new system of records called the Firearms Rights Restoration Electronic Records Database (FRRERD). The agency proposes to exempt this system…
U.S. Department of Justice · Privacy Act of 1974
Moderate
Proposed regulation
Announced
European Union · Oct 6, 2026
Commission registers European Citizens' Initiative for sovereign European AI domains
The European Commission has officially registered a European Citizens' Initiative that calls for the creation of sovereign European AI domains. The initiative seeks to shape future EU policy on artificial intelligence and digital…
European Commission
Moderate
Proposed regulation
Proposed
European Union · Oct 2, 2026
Commission seeks feedback on proposed EU Kids Act
The European Commission is gathering feedback on the proposed EU Kids Act, which aims to improve online safety for children with measures such as a social‑media delay, safety‑by‑design rules, privacy‑preserving age assurance, and…
European Commission · EU Kids Act
Moderate
Proposed regulation
Announced
United States (federal) · Oct 1, 2026
HUD announces intent to establish eVMS system of records under the Privacy Act
The Department of Housing and Urban Development (HUD) issued a Federal Register notice announcing its intent to create a new Privacy Act system of records called the Enterprise Voucher Management System (eVMS). The system will manage…
Department of Housing and Urban Development (HUD) · Privacy Act of 1974
Moderate
Final regulation
Published
California · Sep 28, 2026
California Privacy Protection Agency adopts multiple regulations including Conflict of Interest Code Amendments and Data Broker Registration Fee
The CPPA has adopted several regulations, such as the Conflict of Interest Code Amendments Regulation (September 2026) and Data Broker Registration Fee Regulation (December 2025). These were adopted through the Administrative Procedures…
California Privacy Protection Agency · California Consumer Privacy Act (as amended by CPRA)
Moderate
Proposed regulation
Proposed
France · Sep 24, 2026
CNIL examines draft decree creating SI-Mandoline personal data system for protection of adults
The CNIL plenary session on 24 September 2026 will examine a draft decree establishing the personal data processing system "Système d’information de la protection juridique des majeurs" (SI-Mandoline). It will also consider a draft decree…
Commission nationale de l'informatique et des libertés (CNIL) · code de commerce
Moderate
Proposed regulation
Announced
United States (federal) · Sep 24, 2026
FTC seeks public comment on updating impersonation rule for platforms
The Federal Trade Commission announced it is seeking public comment on whether to update its rule on impersonation of government and businesses. The focus is on platforms' role in promoting impersonation scams. The comment period is part…
Federal Trade Commission
Moderate
Final regulation
In effect
United States (federal) · Sep 22, 2026
FCC adopts final rule clarifying TCPA “Revoke All” requirements
On September 9, 2026, the Federal Communications Commission issued a final rule amending the delayed “Revoke All” rule under the Telephone Consumer Protection Act. The rule will become effective 30 days after its publication.
Federal Communications Commission · Telephone Consumer Protection Act
Moderate
Proposed regulation
Proposed
European Union · Sep 21, 2026
EU Commission proposes KIDS Act to impose age‑based restrictions and safety‑by‑design for children online
On September 17, 2026 the European Commission published a proposal for a new EU KIDS Act that would ban users under 15 from creating accounts on certain social networking and video‑sharing services, with limited exceptions. The draft…
European Commission · Digital Services Act
Moderate
Proposed regulation
Announced
France · Sep 17, 2026
CNIL plenary agenda includes draft decrees on prison camera use, Apple ATT, and data collection in real‑estate rentals
The CNIL plenary session of 17 September 2026 will discuss a draft decree on the use of on‑board cameras by prison surveillance staff, a draft decree amending the 2019 decree that implements the French data protection law, and a…
Commission nationale de l'informatique et des libertés (CNIL) · décret n° 2019-536 du 29 mai 2019
Moderate
Proposed regulation
Proposed
France · Sep 10, 2026
CNIL to examine draft deliberation on finance bill 2027 provisions for online platform content collection for tax purposes
The CNIL plenary session on 10 September 2026 will examine a draft deliberation giving an opinion on provisions of the 2027 finance bill that would perpetuate the collection and exploitation of content from online platforms for tax…
Commission nationale de l'informatique et des libertés (CNIL) · projet de loi de finances pour 2027
Moderate
Proposed regulation
Proposed
European Union · Sep 10, 2026
EU Commission proposes Article 88b for automated privacy signals in Digital Omnibus
The European Commission, as part of the Digital Omnibus package, proposed legally binding automated privacy signals under Article 88b of the GDPR to replace cookie banners. The proposal would let users set their privacy preferences once…
European Commission · California Delete Act
Moderate
Proposed regulation
Announced
France · Sep 3, 2026
CNIL agenda includes review of draft decrees on automated personal data processing and authorizations for health data studies
The CNIL plenary session agenda for 3 September 2026 lists examinations of draft deliberations on a decree modifying decree n° 2023‑935 for the SISPoPP system, a draft decree on the API‑PNR France system, and authorizations for RCTs, IQVIA…
Commission nationale de l'informatique et des libertés (CNIL) · General Data Protection Regulation
Moderate
Proposed regulation
Announced
European Union · Jul 30, 2026
EDPB announces stakeholder event on upcoming data protection and competition law guidelines
The European Data Protection Board and the European Commission will hold a remote stakeholder event on 15 October 2026 to discuss upcoming guidelines on the interplay between data protection and competition law. The event aims to gather…
European Data Protection Board (EDPB) · General Data Protection Regulation
