Moderate
Guidance
Published
Spain · Oct 8, 2026
AEPD publishes second issue of scientific journal “Privacy, Innovation and Technology”
The Spanish Data Protection Agency released the second issue of its scientific journal PIT, dedicated to the 10th anniversary of the GDPR. The monograph examines proactive responsibility, the right to explanation in automated decisions…
Agencia Española de Protección de Datos (AEPD) · Reglamento General de Protección de Datos (RGPD)
Moderate
Proposed bill
Introduced
United States (federal) · Oct 7, 2026
Sen. Gillibrand reintroduces Data Protection Act to create U.S. Data Protection Agency
U.S. Senator Kirsten Gillibrand (D‑NY) has reintroduced the Data Protection Act, which would establish an independent federal Data Protection Agency. The bill aims to limit collection, use and sharing of personal data, oversee high‑risk…
Low
Proposed bill
Proposed
New York · Oct 7, 2026
EPIC urges NYC Council to adopt AI liability bills Intro 2599 and 2600
EPIC counsel testified before the New York City Council, supporting Intro 2599, which would treat AI chatbots as products with developer liability, and Intro 2600, which would create a private right of action for foreseeable AI harms. The…
People-First Chatbot Bill
Moderate
Guidance
Announced
United States (federal) · Oct 7, 2026
FTC announces new study on personalized pricing under Section 6(b) of the FTC Act
FTC Chair Andrew Ferguson announced plans for a study examining personalized pricing practices. The study will be conducted under the authority of Section 6(b) of the FTC Act.
Federal Trade Commission · FTC Act Section 5
Moderate
New law
Signed
California · Oct 7, 2026
California Governor Signs AB 2246 Replacing Age-Appropriate Design Code Act
On September 10, 2026, the governor of California signed AB 2246. The bill repeals and replaces the California Age-Appropriate Design Code Act, establishing a new framework for online services accessed by children.
CA AG · California Age-Appropriate Design Code Act
High
Proposed regulation
Proposed
United States (federal) · Oct 7, 2026 · effective Nov 6, 2026
Treasury proposes new system of records for federal student aid data
The Department of the Treasury proposes to establish a new system of records titled “Department of the Treasury .033--Federal Student Aid Portfolio Research, Analysis, Oversight, Reporting, and Compliance Records.” The system would allow…
Department of the Treasury · Privacy Act of 1974
Moderate
Proposed regulation
Proposed
United States (federal) · Oct 7, 2026
DEA proposes to modify and republish its Aviation Division system of records notice
The Drug Enforcement Administration (DEA) announced a proposal to update the system of records notice for its Aviation Division, changing the categories of individuals covered, record categories, purpose, routine uses, and storage…
Justice Department · Privacy Act of 1974
Moderate
Proposed regulation
Proposed
United States (federal) · Oct 7, 2026
DOJ proposes exemption for Firearms Rights Restoration Electronic Records Database from Privacy Act provisions
The Office of the Pardon Attorney within the U.S. Department of Justice announced a notice of a new system of records called the Firearms Rights Restoration Electronic Records Database (FRRERD). The agency proposes to exempt this system…
U.S. Department of Justice · Privacy Act of 1974
Moderate
New law
Signed
California · Oct 6, 2026
California Governor signs over 20 AI‑related bills into law
Governor Gavin Newsom signed more than 20 bills covering AI transparency, synthetic performer disclosures, chatbot labeling, and industry‑specific AI use restrictions. The measures amend the California AI Transparency Act, create new…
California AI Transparency Act
Moderate
Proposed regulation
Announced
European Union · Oct 6, 2026
Commission registers European Citizens' Initiative for sovereign European AI domains
The European Commission has officially registered a European Citizens' Initiative that calls for the creation of sovereign European AI domains. The initiative seeks to shape future EU policy on artificial intelligence and digital…
European Commission
Low
Enforcement
Announced
Texas · Oct 6, 2026
Texas AG launches investigation into children's clothing companies over toxic chemicals
Texas Attorney General Ken Paxton announced an investigation into major children’s clothing brands, including Hanes and Fruit of the Loom, for potential toxic chemicals in undergarments. The AG issued Civil Investigative Demands to the…
Texas Attorney General's Office
Moderate
New law
Signed
California · Oct 6, 2026
California signs law banning AI tools that assess employee emotions or collect neural data
On September 30, 2026, Governor Gavin Newsom signed legislation that prohibits employers from using AI-powered workplace surveillance to evaluate employees' emotional states or gather neural data. The law creates new restrictions on…
High
Enforcement
Published
Spain · Oct 6, 2026 · effective Oct 6, 2026
AEPD issues warnings to two Spanish municipalities over AI‑enabled video surveillance projects
The Spanish Data Protection Agency (AEPD) sent preventive warnings (AI‑00170‑2026 and AI‑00171‑2026) to two local councils regarding planned video‑surveillance systems that use automated image analysis with AI. The agency stresses that the…
Agencia Española de Protección de Datos · Reglamento General de Protección de Datos
High
Proposed regulation
Proposed
United States (federal) · Oct 6, 2026 · effective Nov 16, 2026
NARA proposes revisions to System of Records NARA 44 for reasonable accommodation requests
The National Archives and Records Administration (NARA) proposes to revise its System of Records NARA 44, updating the system manager and location. The revision would expand the record type to include reasonable accommodation requests…
National Archives and Records Administration · Privacy Act of 1974
High
Final regulation
Announced
United States (federal) · Oct 6, 2026 · effective Nov 5, 2026
Treasury exempts new tip intake records from certain Privacy Act provisions
The Department of the Treasury issued a final rule exempting the system of records titled "Treasury .032--Federal Program Waste, Fraud, and Abuse Tip Intake and Referral Records" from specific provisions of the Privacy Act of 1974. The…
Department of the Treasury · Privacy Act of 1974
Low
FRAMEWORK UPDATE
Announced
Global · Oct 5, 2026
Future of Privacy Forum urges standardized privacy benchmarks for frontier AI systems
The paper argues that standardized privacy benchmarks are needed to evaluate privacy risks in frontier AI models, including data memorization, inference of sensitive attributes, and over‑collection. It describes emerging efforts such as…
Low
Proposed regulation
Proposed
Vermont · Oct 5, 2026
EPIC comments on Vermont Attorney General's proposed Age-Appropriate Design Code rules
On October 2, EPIC submitted comments on two proposed rules announced by the Vermont Attorney General to implement the state's Age-Appropriate Design Code. The rules target addictive design practices for minors and outline methods for age…
Vermont Attorney General · California Age-Appropriate Design Code Act
Moderate
Guidance
Published
United States (federal) · Oct 5, 2026
EPIC analysis links pixel‑tracking litigation under ECPA and CIPA to upcoming Supreme Court VPPA case
EPIC outlines how recent court decisions using the Electronic Communications Privacy Act (ECPA) and California Invasion of Privacy Act (CIPA) address non‑consensual pixel tracking and its privacy harms. The analysis cites multiple…
HHS OCR · HIPAA Privacy, Security and Breach Notification Rules
Low
Lawsuit filed
Filed
United States (federal) · Oct 2, 2026
EPIC files amicus brief challenging Spirit Airlines' bankruptcy sale of employee data to Google
EPIC and Professor Seema Patel submitted an amicus brief in a bankruptcy case to contest Spirit Airlines' proposed $10 million sale of employee data to Google for AI training. The brief argues the sale lacks adequate privacy protections…
Low
Proposed bill
Introduced
United States (federal) · Oct 2, 2026
Rep. Darrell Issa introduces the American Copyright Protection Act (H.R. 10364) targeting VPNs for site‑blocking
Rep. Darrell Issa (R‑CA) has introduced H.R. 10364, the American Copyright Protection Act, which would allow copyright owners to seek court orders blocking U.S. users from foreign piracy sites. The bill expands blocking obligations to…
American Copyright Protection Act (ACPA)
