Moderate
Proposed regulation
Proposed
European Union · Oct 1, 2026
EU Commission proposes KIDS Act to ban social‑media access for under‑13s and set minimum account age of 15
The European Commission has presented the EU KIDS Act, which would prohibit social‑media platforms from providing services to children under 13 and require a minimum age of 15 for users to open their own accounts. The proposal shifts the…
European Commission · EU KIDS Act
Moderate
Proposed regulation
Announced
United States (federal) · Oct 1, 2026
HUD announces intent to establish eVMS system of records under the Privacy Act
The Department of Housing and Urban Development (HUD) issued a Federal Register notice announcing its intent to create a new Privacy Act system of records called the Enterprise Voucher Management System (eVMS). The system will manage…
Department of Housing and Urban Development (HUD) · Privacy Act of 1974
Moderate
Proposed regulation
Proposed
United States (federal) · Oct 1, 2026
Federal Register proposes limiting automated scraping, requiring API use and CAPTCHAs
The notice warns that aggressive automated scraping of FederalRegister.gov and eCFR.gov will be restricted to access via developer APIs. Human users must complete a CAPTCHA to request access, and occasional re‑verification is expected as a…
National Archives and Records Administration
Low
Proposed regulation
Proposed
California · Sep 28, 2026
San Francisco Police Department proposes expanded drone surveillance policy, drawing criticism from EFF
The San Francisco Police Department (SFPD) has issued a new proposed policy that would allow broader use of drones for public safety and patrol. The policy has been criticized by the Electronic Frontier Foundation and other groups for…
San Francisco Police Commission · Proposition E
Moderate
Proposed regulation
Proposed
United States (federal) · Sep 28, 2026
EPIC and consumer groups urge FTC to ban surveillance pricing, calling disclosure insufficient
On September 25, EPIC and several consumer groups filed comments with the FTC urging it to go beyond disclosure in its Proposed Enforcement Policy Statement on personalized pricing. The commenters argue that surveillance pricing violates…
Federal Trade Commission · FTC Act Section 5
Moderate
Final regulation
Published
California · Sep 28, 2026
California Privacy Protection Agency adopts multiple regulations including Conflict of Interest Code Amendments and Data Broker Registration Fee
The CPPA has adopted several regulations, such as the Conflict of Interest Code Amendments Regulation (September 2026) and Data Broker Registration Fee Regulation (December 2025). These were adopted through the Administrative Procedures…
California Privacy Protection Agency · California Consumer Privacy Act (as amended by CPRA)
High
Final regulation
In effect
United States (federal) · Sep 28, 2026 · effective Oct 28, 2026
HHS modifies ORR Unaccompanied Children system of records, effective Oct 28, 2026
The Department of Health and Human Services is amending the Office of Refugee Resettlement's system of records for unaccompanied children. The change renames the system to "ORR Unaccompanied Alien Children Bureau (UACB) Administrative…
Department of Health and Human Services (HHS) · Privacy Act of 1974
Moderate
Proposed regulation
Proposed
France · Sep 24, 2026
CNIL examines draft decree creating SI-Mandoline personal data system for protection of adults
The CNIL plenary session on 24 September 2026 will examine a draft decree establishing the personal data processing system "Système d’information de la protection juridique des majeurs" (SI-Mandoline). It will also consider a draft decree…
Commission nationale de l'informatique et des libertés (CNIL) · code de commerce
Moderate
Proposed regulation
Announced
New York · Sep 24, 2026
NY Attorney General urges Congress to enact AI safety legislation
New York Attorney General Letitia James, leading a coalition of 25 state AGs, called on Congress to immediately establish a comprehensive regulatory framework for AI development. The letter cites recent incidents where AI agents escaped…
New York Attorney General's Office
Moderate
Proposed regulation
Announced
United States (federal) · Sep 24, 2026
FTC seeks public comment on updating impersonation rule for platforms
The Federal Trade Commission announced it is seeking public comment on whether to update its rule on impersonation of government and businesses. The focus is on platforms' role in promoting impersonation scams. The comment period is part…
Federal Trade Commission
Low
Proposed regulation
Proposed
European Union · Sep 23, 2026
European Commission proposes EU KIDS Act to strengthen online child protections
On September 17, 2026, the European Commission published a proposal for the EU KIDS Act. The draft legislation aims to enhance protections for children using online services. It is part of the Commission's broader effort to safeguard…
European Commission · EU KIDS Act
Moderate
Final regulation
In effect
United States (federal) · Sep 22, 2026
FCC adopts final rule clarifying TCPA “Revoke All” requirements
On September 9, 2026, the Federal Communications Commission issued a final rule amending the delayed “Revoke All” rule under the Telephone Consumer Protection Act. The rule will become effective 30 days after its publication.
Federal Communications Commission · Telephone Consumer Protection Act
Moderate
Proposed regulation
Proposed
European Union · Sep 21, 2026
EU Commission proposes KIDS Act to impose age‑based restrictions and safety‑by‑design for children online
On September 17, 2026 the European Commission published a proposal for a new EU KIDS Act that would ban users under 15 from creating accounts on certain social networking and video‑sharing services, with limited exceptions. The draft…
European Commission · Digital Services Act
Moderate
Proposed regulation
Proposed
European Union · Sep 21, 2026
EU proposes Article 88c/88bis to allow unrestricted AI use of personal data
A leaked Irish Presidency document proposes that personal data used "in the context of AI" be automatically lawful, removing consent requirements. The draft Article 88c (now 88bis) would permit AI companies to process any personal data for…
European Commission · General Data Protection Regulation
