Moderate
Guidance
Published
France · Oct 16, 2026
CNIL guidance on reconstituting professional email addresses and data subject rights
The CNIL explains that organisations may deduce a professional email address from publicly available information, but must comply with the GDPR and specific commercial prospecting rules. Data subjects must be informed clearly about the…
CNIL · RGPD
High
Fine
Decided
Norway (EEA) · Oct 16, 2026
Norwegian DPA fines Xandr €8.6M for unlawful processing of Grindr users' data
The Norwegian Data Protection Authority issued a final decision on 2 October 2026 imposing an administrative fine of EUR 8.6 million on Xandr Inc. for processing personal and special category data of Grindr users without valid consent.…
Norwegian Data Protection Authority · General Data Protection Regulation
Moderate
Guidance
Published
European Union · Oct 12, 2026
noyb ranks EU Parliament members on their stance toward GDPR and ePrivacy amendments
noyb analysed over 1,000 amendments to the GDPR and ePrivacy Directive linked to the Digital Omnibus reform, grading each MEP on whether their changes strengthen or weaken privacy protections. The report finds the European People’s Party…
ePrivacy Directive
High
Fine
In effect
Italy · Oct 9, 2026 · effective Jul 3, 2026
Italian DPA fines BBVA €5.508 million for ignoring customer’s objection to direct marketing
The Italian Data Protection Authority issued a final decision on 3 July 2026 finding BBVA infringed Articles 5, 12, 21 and 24 of the GDPR by failing to honor a customer's objection to direct marketing. BBVA was ordered to pay an…
Italian Data Protection Authority · General Data Protection Regulation
Moderate
Proposed bill
Proposed
United States (federal) · Oct 8, 2026
EPIC urges Congress to ban CBP's use of financial data in predictive policing
EPIC reports that Customs & Border Patrol's Predictive Intelligence Targeting Teams are using financial records and travel data to target individuals without disclosing how the data was obtained. The article cites past ICE bulk subpoenas…
U.S. Customs and Border Protection (CBP) · Right to Financial Privacy Act
Moderate
Proposed regulation
Proposed
Vermont · Oct 8, 2026
Future of Privacy Forum submits comments on Vermont Age-Appropriate Design Code rulemaking
On October 2, 2026 the Future of Privacy Forum filed comments to the Vermont Attorney General’s rulemaking for the Age-Appropriate Design Code. The act, enacted in June 2025, sets duties for businesses serving minors and will become…
Vermont Office of the Attorney General · California Age-Appropriate Design Code Act
High
Fine
Published
Netherlands · Oct 8, 2026
Dutch DPA fines Uber €824.99 million for unlawful automated decision‑making
The Autoriteit Persoonsgegevens imposed an administrative fine of €824,990,000 on Uber for violating GDPR Article 22 by automatically deactivating drivers’ accounts and for failing to provide sufficient information under Article 13. The…
Autoriteit Persoonsgegevens · General Data Protection Regulation
Moderate
Guidance
Announced
United States (federal) · Oct 7, 2026
FTC announces new study on personalized pricing under Section 6(b) of the FTC Act
FTC Chair Andrew Ferguson announced plans for a study examining personalized pricing practices. The study will be conducted under the authority of Section 6(b) of the FTC Act.
Federal Trade Commission · FTC Act Section 5
Moderate
New law
Signed
California · Oct 6, 2026
California signs law banning AI tools that assess employee emotions or collect neural data
On September 30, 2026, Governor Gavin Newsom signed legislation that prohibits employers from using AI-powered workplace surveillance to evaluate employees' emotional states or gather neural data. The law creates new restrictions on…
High
Enforcement
Published
Spain · Oct 6, 2026 · effective Oct 6, 2026
AEPD issues warnings to two Spanish municipalities over AI‑enabled video surveillance projects
The Spanish Data Protection Agency (AEPD) sent preventive warnings (AI‑00170‑2026 and AI‑00171‑2026) to two local councils regarding planned video‑surveillance systems that use automated image analysis with AI. The agency stresses that the…
Agencia Española de Protección de Datos · Reglamento General de Protección de Datos
Low
FRAMEWORK UPDATE
Announced
Global · Oct 5, 2026
Future of Privacy Forum urges standardized privacy benchmarks for frontier AI systems
The paper argues that standardized privacy benchmarks are needed to evaluate privacy risks in frontier AI models, including data memorization, inference of sensitive attributes, and over‑collection. It describes emerging efforts such as…
Low
Proposed regulation
Proposed
Vermont · Oct 5, 2026
EPIC comments on Vermont Attorney General's proposed Age-Appropriate Design Code rules
On October 2, EPIC submitted comments on two proposed rules announced by the Vermont Attorney General to implement the state's Age-Appropriate Design Code. The rules target addictive design practices for minors and outline methods for age…
Vermont Attorney General · California Age-Appropriate Design Code Act
Moderate
Guidance
Published
United States (federal) · Oct 5, 2026
EPIC analysis links pixel‑tracking litigation under ECPA and CIPA to upcoming Supreme Court VPPA case
EPIC outlines how recent court decisions using the Electronic Communications Privacy Act (ECPA) and California Invasion of Privacy Act (CIPA) address non‑consensual pixel tracking and its privacy harms. The analysis cites multiple…
HHS OCR · HIPAA Privacy, Security and Breach Notification Rules
Low
Lawsuit filed
Filed
United States (federal) · Oct 2, 2026
EPIC files amicus brief challenging Spirit Airlines' bankruptcy sale of employee data to Google
EPIC and Professor Seema Patel submitted an amicus brief in a bankruptcy case to contest Spirit Airlines' proposed $10 million sale of employee data to Google for AI training. The brief argues the sale lacks adequate privacy protections…
Moderate
Settlement
Settled
United States (federal) · Oct 2, 2026
Meta’s Muse AI Agent raises privacy, security, and child safety concerns amid past FTC consent decree
Meta launched the Muse personal AI agent in September 2026, which collects extensive personal data and can act without clear user permission. EPIC reports multiple incidents where Muse accessed messages, shared home addresses, and…
Federal Trade Commission
Moderate
Proposed regulation
Proposed
United States (federal) · Sep 28, 2026
EPIC and consumer groups urge FTC to ban surveillance pricing, calling disclosure insufficient
On September 25, EPIC and several consumer groups filed comments with the FTC urging it to go beyond disclosure in its Proposed Enforcement Policy Statement on personalized pricing. The commenters argue that surveillance pricing violates…
Federal Trade Commission · FTC Act Section 5
Moderate
Guidance
Announced
France · Sep 28, 2026
CNIL to host AIR 2026 event on political communication ethics and election manipulation on 16 Nov 2026
The French data‑protection authority CNIL will hold a public debate on 16 November 2026 about the ethical challenges of digital political communication and foreign interference. The programme will examine voter consent, data‑minimisation…
CNIL · RGPD
Moderate
Guidance
Announced
United States (federal) · Sep 24, 2026
DraftKings uses AI to target losing gamblers with online behavioral advertising
DraftKings employs AI and machine learning on customers' betting records to identify likely losing gamblers and serve them targeted promotions. The practice exemplifies online behavioral advertising that leverages first‑party data to…
Low
Investigation
Announced
United States (federal) · Sep 24, 2026
Senate Judiciary Subcommittee holds hearing on Flock Safety AI surveillance network
The Senate Judiciary Committee’s Subcommittee on Crime and Counterterrorism conducted a hearing on Flock Safety’s nationwide AI surveillance system. Experts highlighted the extensive data collection, facial tracking, and cybersecurity…
Low
Lawsuit filed
Filed
United States (federal) · Sep 23, 2026
Paramount urges SCOTUS to reject video privacy claim
Paramount filed a brief urging the Supreme Court to reject a video privacy claim under the video privacy law. The Electronic Privacy Information Center and other privacy advocates filed an amicus brief supporting the plaintiff, arguing the…
Video Privacy Act
