High
Final regulation
In effect
United States (federal) · Oct 19, 2026 · effective Oct 19, 2026
FCC modifies Lifeline Program system of records (FCC/WCB-1) under the Privacy Act
The Federal Communications Commission is amending the FCC/WCB-1 system of records that supports the Lifeline Program, which provides discounted voice and broadband services to low‑income households. The amendment updates the categories of…
Federal Communications Commission · Privacy Act of 1974
Moderate
Guidance
Published
France · Oct 16, 2026
CNIL guidance on reconstituting professional email addresses and data subject rights
The CNIL explains that organisations may deduce a professional email address from publicly available information, but must comply with the GDPR and specific commercial prospecting rules. Data subjects must be informed clearly about the…
CNIL · RGPD
Moderate
Proposed regulation
Proposed
United States (federal) · Oct 15, 2026
DOJ proposes exemption for BJS statistical data system from certain Privacy Act provisions
The Office of Justice Programs announced a notice of a new system of records, BJS Statistical Data (JUSTICE/OJP-017), covering data collected under 34 U.S.C. 10132. The agency proposes to exempt this system from specific Privacy Act…
U.S. Department of Justice, Office of Justice Programs · Privacy Act of 1974
Moderate
Proposed regulation
Proposed
United States (federal) · Oct 15, 2026
DOJ EOIR proposes new system of records for Fraud and Abuse Prevention Program
The Executive Office for Immigration Review (EOIR) intends to create a new system of records notice, JUSTICE/EOIR-006, to cover all Fraud and Abuse Prevention Program records. The new notice would replace partial coverage under the…
Department of Justice · Privacy Act of 1974
High
Guidance
In effect
United States (federal) · Oct 15, 2026 · effective Nov 24, 2026
Farm Credit Administration amends employee payroll system of records under Privacy Act, effective Nov 24, 2026
The Farm Credit Administration announced an amendment to its FCA-1 system of records covering employee attendance, leave, and payroll. The amendment updates the categories of individuals and records maintained and revises the policies and…
Farm Credit Administration · Privacy Act of 1974
Moderate
Attorney General action
Filed
New York · Oct 14, 2026
NY Attorney General urges bankruptcy court to protect children and consumers in Character.AI sale
New York Attorney General Letitia James and a coalition of 39 state AGs filed a motion in the Character Technologies bankruptcy court demanding strong protections for children and users before any sale of Character.AI. The filing cites…
New York Attorney General's Office
High
Fine
In effect
Italy · Oct 12, 2026 · effective Jun 5, 2026
Italian DPA fines Wind Tre €16.7 million for unlawful telemarketing
The Italian Data Protection Authority imposed an administrative fine of EUR 16 700 000 on Wind Tre S.p.A. for violations of GDPR principles in its telemarketing and contract activation practices. The authority also issued a definitive ban…
Italian Data Protection Authority (Garante) · General Data Protection Regulation
Moderate
Fine
In effect
Italy · Oct 9, 2026 · effective Aug 6, 2026
Italian DPA fines security firm €39,000 for employee data violations
The Italian Data Protection Authority (Garante) imposed a total administrative fine of EUR 39,000 on La Patria S.p.A. for failing to respond to employee access requests and for inadequate information about GPS‑derived geolocation data. The…
Garante – Italian Data Protection Authority · General Data Protection Regulation
Moderate
Enforcement
Decided
France · Oct 8, 2026
CNIL closes injunction against FRANCE TRAVAIL after compliance with data security measures
The French data protection authority (CNIL) closed the injunction issued on 22 January 2026 against FRANCE TRAVAIL, after the organization demonstrated compliance with the security measures required by Article 32 of the GDPR. The original…
CNIL · RGPD
Moderate
Proposed bill
Introduced
United States (federal) · Oct 7, 2026
Sen. Gillibrand reintroduces Data Protection Act to create U.S. Data Protection Agency
U.S. Senator Kirsten Gillibrand (D‑NY) has reintroduced the Data Protection Act, which would establish an independent federal Data Protection Agency. The bill aims to limit collection, use and sharing of personal data, oversee high‑risk…
High
Enforcement
Published
Spain · Oct 6, 2026 · effective Oct 6, 2026
AEPD issues warnings to two Spanish municipalities over AI‑enabled video surveillance projects
The Spanish Data Protection Agency (AEPD) sent preventive warnings (AI‑00170‑2026 and AI‑00171‑2026) to two local councils regarding planned video‑surveillance systems that use automated image analysis with AI. The agency stresses that the…
Agencia Española de Protección de Datos · Reglamento General de Protección de Datos
High
Final regulation
Announced
United States (federal) · Oct 6, 2026 · effective Nov 5, 2026
Treasury exempts new tip intake records from certain Privacy Act provisions
The Department of the Treasury issued a final rule exempting the system of records titled "Treasury .032--Federal Program Waste, Fraud, and Abuse Tip Intake and Referral Records" from specific provisions of the Privacy Act of 1974. The…
Department of the Treasury · Privacy Act of 1974
Moderate
Settlement
Settled
United States (federal) · Oct 2, 2026
Meta’s Muse AI Agent raises privacy, security, and child safety concerns amid past FTC consent decree
Meta launched the Muse personal AI agent in September 2026, which collects extensive personal data and can act without clear user permission. EPIC reports multiple incidents where Muse accessed messages, shared home addresses, and…
Federal Trade Commission
Moderate
Guidance
Published
France · Oct 2, 2026
CNIL explains when data‑breach victims can claim compensation under the GDPR
The CNIL outlines that individuals can seek damages only if a GDPR breach caused a real material or moral injury, and they can prove a causal link. Compensation is awarded by a judge, not the CNIL, and the regulator may only impose…
CNIL · RGPD
High
Guidance
Published
France · Oct 1, 2026 · effective Oct 1, 2026
CNIL and Cybermalveillance.gouv.fr release guide for individuals on personal data breach response
The French data protection authority (CNIL) and Cybermalveillance.gouv.fr have published a practical support document titled “Violation de données personnelles, que faire en 3 étapes clés ?”. The guide provides a three‑step checklist for…
CNIL
Low
Appeal
Appealed
Pennsylvania · Sep 23, 2026
EPIC files amicus brief urging Third Circuit to uphold Pennsylvania’s Internet Sharing Ban on voter data
EPIC submitted an amicus brief in the Third Circuit case Voter Reference Foundation v. Schmidt, asking the court to maintain Pennsylvania’s rule that bars posting voter registration lists online. The brief describes the rule, called the…
Internet Sharing Ban
Moderate
Fine
Decided
Spain · Sep 22, 2026 · effective Feb 1, 2023 · deadline Feb 1, 2024
Spanish DPA fines Securitas Direct €100,000 for charging phone line for data subject rights
The Spanish Data Protection Agency (AEPD) issued a final decision on 1 February 2023 finding Securitas Direct in breach of GDPR Article 12(2) by directing data subjects to a chargeable 902 telephone number to exercise their rights. The…
Spanish Data Protection Agency (AEPD) · General Data Protection Regulation
