Moderate
New law
Signed
California · Oct 14, 2026
California Governor signs four privacy bills expanding deletion rights, privacy settings, data‑broker rules and limiting CIPA lawsuits
Governor Gavin Newsom signed SB 923, AB 2561, AB 883 and SB 690 into law during the 2026 session. SB 923 broadens CCPA deletion rights and requires online request mechanisms; AB 2561 bars operating systems and apps from changing privacy…
CPPA · California Consumer Privacy Act (as amended by CPRA)
Low
Guidance
Published
EU-GB · Oct 14, 2026
UK ICO publishes report on data protection challenges in AI and launches Agentic AI Project
The Information Commissioner’s Office released a report after scrutinising ten of the world’s largest artificial intelligence foundation model developers operating in the UK. The report highlights data protection challenges associated with…
Information Commissioner’s Office
Moderate
Attorney General action
Filed
New York · Oct 14, 2026
NY Attorney General urges bankruptcy court to protect children and consumers in Character.AI sale
New York Attorney General Letitia James and a coalition of 39 state AGs filed a motion in the Character Technologies bankruptcy court demanding strong protections for children and users before any sale of Character.AI. The filing cites…
New York Attorney General's Office
Moderate
Guidance
Published
New York · Oct 14, 2026
NY Attorney General releases updated guide on AI-generated election misinformation
The New York Attorney General's Office issued an updated guide to help voters identify and report AI‑generated election misinformation ahead of the November 3, 2026 general election. The guide advises checking official sources, not relying…
New York Attorney General's Office · New York law requiring labeling of AI‑generated political communications as manipulated
Moderate
Enforcement
In effect
France · Oct 14, 2026 · effective Sep 23, 2026
CNIL closes injunction against Google after compliance on cookie and Gmail ad consent
On 23 September 2026 the CNIL's restricted formation closed the injunction issued on 1 September 2025 against Google LLC and Google Ireland Limited. The companies complied by adding clear information about advertising cookies during…
CNIL · Article L.34-5 du code des postes et des communications électroniques
Moderate
Guidance
Published
European Union · Oct 14, 2026
Eurobarometer survey shows increasing AI adoption by European companies
A Eurobarometer survey released by the European Commission indicates that the use of artificial intelligence is growing among companies across Europe. The findings highlight trends in AI deployment and potential implications for the…
European Commission
Moderate
Guidance
Published
European Union · Oct 14, 2026
AI adoption more than doubles in EU strategic sectors, JRC report shows
A Joint Research Centre analysis finds AI use in EU strategic sectors rose from 7% in 2021 to 18% in 2025, driven mainly by large language models. The report highlights sector‑specific barriers, especially lack of expertise and regulatory…
European Commission
Moderate
Guidance
Proposed
United States (federal) · Oct 14, 2026
Agency limits programmatic access to FederalRegister.gov and eCFR.gov, requiring API use and CAPTCHA verification
The agency states that due to aggressive automated scraping, programmatic access to FederalRegister.gov and eCFR.gov is restricted to its developer APIs. Users must complete a CAPTCHA to verify they are human and may request a wider IP…
U.S. Federal Government · Paperwork Reduction Act
Moderate
Guidance
Published
United States (federal) · Oct 14, 2026
DoD establishes new matching program to compare TRICARE pharmacy records with Treasury's Do Not Pay system
The Department of Defense announced a new computer‑matching program that will compare its TRICARE Pharmacy Program records with the Treasury's Do Not Pay Working System. The program is established under the Privacy Act of 1974 and the…
Department of Defense · Privacy Act of 1974
Moderate
Guidance
Proposed
United States (federal) · Oct 14, 2026
Federal Register proposes reorganization limiting programmatic access to its sites
The Division of Program Coordination, Planning, and Strategic Initiatives issued a notice proposing a reorganization that will limit programmatic access to FederalRegister.gov and eCFR.gov due to aggressive automated scraping. Access will…
Division of Program Coordination, Planning, and Strategic Initiatives, Office of the Director
Low
Court ruling
Dismissed
California · Oct 13, 2026
California trial court dismisses SIREN v. San Jose challenge to warrantless ALPR searches
A California trial court dismissed SIREN v. San Jose, a case brought by EFF and the ACLU challenging the city’s warrantless searches of automated license plate reader data. The court held that drivers have no reasonable expectation of…
California Constitution
Moderate
Court ruling
Decided
United States (federal) · Oct 13, 2026
Bernstein v. DOJ ruling holds encryption code is protected speech
The podcast notes that the 1995 case Bernstein v. Department of Justice held that code is speech protected by the First Amendment. This precedent underpins modern internet privacy and encryption. The case was brought by Dan Bernstein with…
CPPA · California Delete Act
Moderate
Guidance
Published
European Union · Oct 13, 2026
CEPD issues guidance on data protection challenges of smart glasses
The European Data Protection Board adopted a declaration on connected glasses and released a report outlining privacy risks. It clarifies when users act as data controllers under the GDPR and stresses that manufacturers and service…
European Data Protection Board (CEPD) · RGPD
Moderate
Guidance
Published
European Union · Oct 13, 2026
EDPB issues guidance on privacy challenges of smart glasses
The European Data Protection Board adopted statement 1/2026 on smart glasses, highlighting serious privacy concerns and the need for transparency. It clarifies when users act as data controllers and stresses that manufacturers and service…
European Data Protection Board · General Data Protection Regulation
Moderate
Guidance
Signed
European Union · Oct 13, 2026
EU and Ukraine sign administrative arrangement between CERT-EU and CERT-UA at 5th Cyber Dialogue
During the 5th EU‑Ukraine Cyber Dialogue on 9 October, the EU and Ukraine signed an administrative arrangement to enable information exchange between CERT‑EU and its Ukrainian counterpart, CERT‑UA. The dialogue also covered alignment with…
CERT-EU · NIS2 Directive
Moderate
Proposed regulation
Announced
European Union · Oct 13, 2026
EU Commission references forthcoming EU KIDS Act during EU Code Week 2026 launch
At the EU Code Week 2026 opening, the European Commission highlighted several AI‑related initiatives, including the AI Act, the Digital Education Action Plan, the BIK+ strategy, and the forthcoming EU KIDS Act. The event underscored the…
European Commission · EU AI Act
Moderate
Fine
In effect
France · Oct 13, 2026
French DPA fines Google €325 million for spam emails in Gmail
The French data protection authority imposed a €325 million administrative fine on Google for sending spam emails through Gmail, citing violations of the GDPR.
French Data Protection Authority · General Data Protection Regulation
High
Proposed regulation
Proposed
United States (federal) · Oct 13, 2026 · effective Oct 13, 2026
FHFA proposes to rescind SORN FHFA-12 and consolidate records under SORN FHFA-11
The Federal Housing Finance Agency (FHFA) announced a proposal to rescind the existing System of Records Notice (SORN) FHFA-12, which covers parking program records. The agency will consolidate those records with its transit subsidy…
Federal Housing Finance Agency · Privacy Act of 1974
Moderate
Guidance
Announced
European Union · Oct 12, 2026
Future of Privacy Forum Announces 2026 Award Recipients Honoring Data Protection Leadership in Europe
The Future of Privacy Forum announced the winners of its 2026 Awards, recognizing the European Data Protection Supervisor, scholar Christopher Kuner, and SAP executive Corinna Cellarius for their contributions to data protection and…
EDPB · General Data Protection Regulation
High
Fine
In effect
Italy · Oct 12, 2026 · effective Jun 5, 2026
Italian DPA fines Wind Tre €16.7 million for unlawful telemarketing
The Italian Data Protection Authority imposed an administrative fine of EUR 16 700 000 on Wind Tre S.p.A. for violations of GDPR principles in its telemarketing and contract activation practices. The authority also issued a definitive ban…
Italian Data Protection Authority (Garante) · General Data Protection Regulation
