Moderate
Enforcement
Decided
Greece · Oct 8, 2026 · effective Jul 28, 2026
Hellenic DPA fines Ministry and EETAA for data breach
The Hellenic Data Protection Authority imposed administrative fines of EUR 200,000 on the Ministry of Social Cohesion and Family Affairs and EUR 150,000 on E.E.T.A.A. S.A. for a large‑scale personal data breach. The Authority also ordered…
Hellenic Data Protection Authority · General Data Protection Regulation
High
Fine
Published
Netherlands · Oct 8, 2026
Dutch DPA fines Uber €824.99 million for unlawful automated decision‑making
The Autoriteit Persoonsgegevens imposed an administrative fine of €824,990,000 on Uber for violating GDPR Article 22 by automatically deactivating drivers’ accounts and for failing to provide sufficient information under Article 13. The…
Autoriteit Persoonsgegevens · General Data Protection Regulation
Moderate
Guidance
Published
Spain · Oct 8, 2026
AEPD publishes second issue of scientific journal “Privacy, Innovation and Technology”
The Spanish Data Protection Agency released the second issue of its scientific journal PIT, dedicated to the 10th anniversary of the GDPR. The monograph examines proactive responsibility, the right to explanation in automated decisions…
Agencia Española de Protección de Datos (AEPD) · Reglamento General de Protección de Datos (RGPD)
Low
Proposed bill
Proposed
New York · Oct 7, 2026
EPIC urges NYC Council to adopt AI liability bills Intro 2599 and 2600
EPIC counsel testified before the New York City Council, supporting Intro 2599, which would treat AI chatbots as products with developer liability, and Intro 2600, which would create a private right of action for foreseeable AI harms. The…
People-First Chatbot Bill
Moderate
Guidance
Announced
United States (federal) · Oct 7, 2026
FTC announces new study on personalized pricing under Section 6(b) of the FTC Act
FTC Chair Andrew Ferguson announced plans for a study examining personalized pricing practices. The study will be conducted under the authority of Section 6(b) of the FTC Act.
Federal Trade Commission · FTC Act Section 5
Moderate
New law
Signed
California · Oct 7, 2026
California Governor Signs AB 2246 Replacing Age-Appropriate Design Code Act
On September 10, 2026, the governor of California signed AB 2246. The bill repeals and replaces the California Age-Appropriate Design Code Act, establishing a new framework for online services accessed by children.
CA AG · California Age-Appropriate Design Code Act
High
Proposed regulation
Proposed
United States (federal) · Oct 7, 2026 · effective Nov 6, 2026
Treasury proposes new system of records for federal student aid data
The Department of the Treasury proposes to establish a new system of records titled “Department of the Treasury .033--Federal Student Aid Portfolio Research, Analysis, Oversight, Reporting, and Compliance Records.” The system would allow…
Department of the Treasury · Privacy Act of 1974
Moderate
Proposed regulation
Proposed
United States (federal) · Oct 7, 2026
DOJ proposes exemption for Firearms Rights Restoration Electronic Records Database from Privacy Act provisions
The Office of the Pardon Attorney within the U.S. Department of Justice announced a notice of a new system of records called the Firearms Rights Restoration Electronic Records Database (FRRERD). The agency proposes to exempt this system…
U.S. Department of Justice · Privacy Act of 1974
Moderate
Proposed regulation
Announced
European Union · Oct 6, 2026
Commission registers European Citizens' Initiative for sovereign European AI domains
The European Commission has officially registered a European Citizens' Initiative that calls for the creation of sovereign European AI domains. The initiative seeks to shape future EU policy on artificial intelligence and digital…
European Commission
High
Proposed regulation
Proposed
United States (federal) · Oct 6, 2026 · effective Nov 16, 2026
NARA proposes revisions to System of Records NARA 44 for reasonable accommodation requests
The National Archives and Records Administration (NARA) proposes to revise its System of Records NARA 44, updating the system manager and location. The revision would expand the record type to include reasonable accommodation requests…
National Archives and Records Administration · Privacy Act of 1974
High
Final regulation
Announced
United States (federal) · Oct 6, 2026 · effective Nov 5, 2026
Treasury exempts new tip intake records from certain Privacy Act provisions
The Department of the Treasury issued a final rule exempting the system of records titled "Treasury .032--Federal Program Waste, Fraud, and Abuse Tip Intake and Referral Records" from specific provisions of the Privacy Act of 1974. The…
Department of the Treasury · Privacy Act of 1974
Low
FRAMEWORK UPDATE
Announced
Global · Oct 5, 2026
Future of Privacy Forum urges standardized privacy benchmarks for frontier AI systems
The paper argues that standardized privacy benchmarks are needed to evaluate privacy risks in frontier AI models, including data memorization, inference of sensitive attributes, and over‑collection. It describes emerging efforts such as…
Low
Proposed regulation
Proposed
Vermont · Oct 5, 2026
EPIC comments on Vermont Attorney General's proposed Age-Appropriate Design Code rules
On October 2, EPIC submitted comments on two proposed rules announced by the Vermont Attorney General to implement the state's Age-Appropriate Design Code. The rules target addictive design practices for minors and outline methods for age…
Vermont Attorney General · California Age-Appropriate Design Code Act
Moderate
Guidance
Published
United States (federal) · Oct 5, 2026
EPIC analysis links pixel‑tracking litigation under ECPA and CIPA to upcoming Supreme Court VPPA case
EPIC outlines how recent court decisions using the Electronic Communications Privacy Act (ECPA) and California Invasion of Privacy Act (CIPA) address non‑consensual pixel tracking and its privacy harms. The analysis cites multiple…
HHS OCR · HIPAA Privacy, Security and Breach Notification Rules
Low
Lawsuit filed
Filed
United States (federal) · Oct 2, 2026
EPIC files amicus brief challenging Spirit Airlines' bankruptcy sale of employee data to Google
EPIC and Professor Seema Patel submitted an amicus brief in a bankruptcy case to contest Spirit Airlines' proposed $10 million sale of employee data to Google for AI training. The brief argues the sale lacks adequate privacy protections…
Low
Proposed bill
Introduced
United States (federal) · Oct 2, 2026
Rep. Darrell Issa introduces the American Copyright Protection Act (H.R. 10364) targeting VPNs for site‑blocking
Rep. Darrell Issa (R‑CA) has introduced H.R. 10364, the American Copyright Protection Act, which would allow copyright owners to seek court orders blocking U.S. users from foreign piracy sites. The bill expands blocking obligations to…
American Copyright Protection Act (ACPA)
Low
Court ruling
Decided
New York · Oct 2, 2026
Federal judge rejects motion to dismiss social media surveillance lawsuit against Trump administration
A U.S. District Court in New York denied the government’s motion to dismiss a lawsuit filed by three labor unions alleging viewpoint‑based social media surveillance of noncitizens. The case, filed in October 2025, targets the Departments…
Administrative Procedure Act
Moderate
New law
Signed
California · Oct 2, 2026
California Governor signs three AI employment laws
Governor Gavin Newsom signed SB 947, SB 951, and AB 1883 to regulate AI in employment. The laws restrict automated decision systems, require technology-related layoff notices, and limit workplace surveillance tools. Each law includes civil…
California Labor Commissioner · SB 947 (No Robo Bosses Act)
Low
Guidance
Published
European Union · Oct 2, 2026
EDPB adopts Guidelines 04/2026 on GDPR fines and corrective powers for public consultation
The European Data Protection Board adopted Guidelines 04/2026 on the application of administrative fines and other corrective powers under the EU GDPR. The guidelines were released on September 17, 2026 for public consultation.
European Data Protection Board · General Data Protection Regulation
Moderate
Proposed regulation
Proposed
European Union · Oct 2, 2026
Commission seeks feedback on proposed EU Kids Act
The European Commission is gathering feedback on the proposed EU Kids Act, which aims to improve online safety for children with measures such as a social‑media delay, safety‑by‑design rules, privacy‑preserving age assurance, and…
European Commission · EU Kids Act
