Low
Court ruling
Decided
United States (federal) · Sep 15, 2026
Supreme Court hears challenge to DHS/SSA upgrades to SAVE database
The League of Women Voters and EPIC urged the Supreme Court to deny the administration’s emergency request to stay a Washington, D.C., federal judge’s summary judgment that set aside DHS and SSA upgrades to the Systematic Alien…
Low
Guidance
Announced
United States (federal) · Sep 15, 2026
EPIC senior counsel warns of privacy risks in unproven health technologies
The Washington Post health brief quoted EPIC senior counsel Sara Geoghegan stating that emerging health technologies are unproven and may be riddled with privacy risks. She emphasized that companies must build and demonstrate trust, noting…
Moderate
Proposed bill
Passed
California · Sep 15, 2026
California legislature passes three AI employment bills pending Governor's signature
The California State Legislature approved SB 947, SB 951, and AB 1883, which impose restrictions on automated decision systems, require technology displacement notices under Cal/WARN, and limit workplace surveillance tools. Each bill would…
California Labor Commissioner · SB 947 (No Robo Bosses Act)
Low
Enforcement
Announced
United States (federal) · Sep 15, 2026
DOJ partially confirms DHS whistleblower allegations on SAVE voter eligibility program
The Department of Justice issued a notice to a federal court partially confirming whistleblower allegations that DHS is expanding the SAVE system to check voter eligibility. EPIC and the League of Women Voters argue this violates the U.S.…
Department of Justice (DOJ) · U.S. Constitution
Low
Lawsuit filed
Filed
United States (federal) · Sep 15, 2026
EPIC sues DHS over expansion of SAVE voter eligibility program
The Electronic Privacy Information Center (EPIC) and the League of Women Voters filed a lawsuit challenging DHS’s attempt to expand the SAVE system to check voter eligibility, alleging violations of the U.S. Constitution and federal…
U.S. Constitution
Low
Enforcement
Pending
United States (federal) · Sep 15, 2026
EPIC warns sale of Google’s Spirit Air AI worker data lacks private right of action
EPIC counsel Mayu Tobin‑Miyaji says unions’ concerns are valid and highlights the absence of a private right of action, leaving enforcement of worker data protections dependent on state attorneys general. She notes that without such a…
Moderate
Proposed bill
Announced
European Union · Sep 14, 2026
EU Commission to propose EU-wide minimum age for social media, linked to Digital Fairness Act
The European Commission will release a legislative proposal by the end of 2026 establishing an EU-wide minimum age for social media, building on the Special Panel's age‑tiered framework. The proposal may be incorporated into the Digital…
European Commission · Digital Services Act
Moderate
Proposed bill
Passed
California · Sep 14, 2026 · effective Jan 1, 2027
California Legislature passes SB 690 to limit pen register lawsuits under CIPA
On August 28, 2026 the California Legislature passed SB 690, a bill that would eliminate private lawsuits for website-based pen register claims under the California Invasion of Privacy Act. The bill would restrict such claims to actions…
California Attorney General · California Invasion of Privacy Act (CIPA)
Moderate
Investigation
Announced
United States (federal) · Sep 14, 2026
Police misuse ALPR data with frivolous reasons, EFF finds
EFF analysis of Flock Safety ALPR logs shows officers across the United States entering nonsensical reasons such as "LOL", "LMAO" and "idk" to access vehicle location data. The lack of warrant requirements and weak audit controls enables…
CPPA · California Delete Act
Low
New law
Signed
California · Sep 11, 2026
California Governor signs AB 2071 and AB 2298 to add digital literacy and cybersecurity to school curricula
Governor Newsom signed a package of 12 bills, including AB 2071 and AB 2298, that require digital wellness and cybersecurity education in California schools. The bills aim to protect children online through education rather than bans.
AB 2071
Low
Guidance
Published
United States (federal) · Sep 11, 2026
Amazon Ring's 'Throw Away the Key Encryption' adds limited privacy but falls short of true end‑to‑end encryption
Amazon introduced the Throw Away the Key Encryption (TAKE) feature for Ring cameras, where encryption keys are held temporarily in the cloud and deleted after 24 hours. The system still allows Ring to decrypt footage for cloud‑based…
Low
Enforcement
Announced
New Jersey · Sep 11, 2026
Cameras capture alleged vandal in Morristown SafetyStick pilot
EPIC senior counsel Jeramie D. Scott said the community should be informed before any surveillance technology is deployed. Cameras in the Morristown SafetyStick pilot captured an alleged camera vandal. Scott warned that surveillance can be…
Moderate
Final regulation
In effect
European Union · Sep 11, 2026 · effective Sep 11, 2026
EU Cyber Resilience Act reporting obligations take effect for manufacturers
As of September 11, 2026, manufacturers of products with digital elements are subject to new incident reporting obligations under the EU Cyber Resilience Act. The obligations require manufacturers to report cybersecurity incidents related…
European Commission · Cyber Resilience Act
Moderate
Guidance
Announced
European Union · Sep 11, 2026
ENISA launches Single Reporting Platform for Cyber Resilience Act reporting
ENISA has deployed the initial operating capability of the Single Reporting Platform (SRP) to support the Cyber Resilience Act (CRA) reporting obligations. From 11 September 2026 manufacturers and open‑source software stewards must report…
ENISA · Cyber Resilience Act
High
Fine
Decided
France · Sep 11, 2026 · effective Jul 21, 2026
CNIL fines French IT firm EXTIA €300,000 for failing to honor data erasure requests
In 2024 EXTIA received 265 requests for erasure, many of which were not processed or not communicated to the requesters. The CNIL audit found breaches of Articles 12 and 17 GDPR regarding transparency and the right to erasure. The CNIL…
CNIL · General Data Protection Regulation
Moderate
New law
Signed
California · Sep 10, 2026
California AB 1709, a ban on social media for under‑16, signed into law
AB 1709 was signed into law by Governor Gavin Newsom. The law imposes a functional ban on social media use for people under the age of 16 and requires age‑verification. Critics say the ban will increase data collection and limit free…
AB 1709
Moderate
Fine
Announced
Netherlands · Sep 10, 2026
Dutch DPA fines Uber €824,990,000 for automated decisions affecting drivers
On August 21, 2026, the Dutch Data Protection Authority announced it had fined Uber €824,990,000 for breaching the EU GDPR rules on solely automated decision‑making. The fine targets Uber's use of automated systems that affect driver…
Dutch Data Protection Authority · General Data Protection Regulation
Moderate
Proposed regulation
Proposed
France · Sep 10, 2026
CNIL to examine draft deliberation on finance bill 2027 provisions for online platform content collection for tax purposes
The CNIL plenary session on 10 September 2026 will examine a draft deliberation giving an opinion on provisions of the 2027 finance bill that would perpetuate the collection and exploitation of content from online platforms for tax…
Commission nationale de l'informatique et des libertés (CNIL) · projet de loi de finances pour 2027
Moderate
Guidance
In effect
France · Sep 10, 2026 · effective Sep 1, 2026
CNIL guidance on data‑protection obligations under the electronic invoicing reform effective 1 Sept 2026
The CNIL explains the data‑protection implications of the French electronic invoicing reform that entered into force on 1 Sept 2026. It details which personal data may be processed, the roles of issuers, receivers and certified platforms…
CNIL · réforme relative à la facturation électronique
Moderate
Guidance
Published
France · Sep 10, 2026
CNIL releases Volume 2 of “L’Agence Privacy” to educate adolescents on cybercrime and data privacy
On 10 September 2026 the French data‑protection authority CNIL published the second volume of its educational comic series “L’Agence Privacy”. The free online and paper resource targets teenagers and parents, covering risks such as…
CNIL
