Low
Enforcement
Announced
Germany · Sep 10, 2026
noyb to file injunction against SCHUFA over shadow database
noyb sent a cease-and-desist letter to SCHUFA demanding the removal of its shadow database. SCHUFA's deadline to comply has expired and the agency has rejected the allegations. noyb announced it will now file an injunction and invites…
Moderate
Proposed regulation
Proposed
European Union · Sep 10, 2026
EU Commission proposes Article 88b for automated privacy signals in Digital Omnibus
The European Commission, as part of the Digital Omnibus package, proposed legally binding automated privacy signals under Article 88b of the GDPR to replace cookie banners. The proposal would let users set their privacy preferences once…
European Commission · California Delete Act
Low
Enforcement
Announced
European Union · Sep 4, 2026 · effective Aug 31, 2026
EU Commission designates ChatGPT as VLOSE and Reddit, Roblox as VLOPs under DSA
On August 31, 2026, the European Commission announced that it had designated ChatGPT as a Very Large Online Search Engine (VLOSE) and Reddit and Roblox as Very Large Online Platforms (VLOPs) under the Digital Services Act. The designations…
European Commission · Digital Services Act
Moderate
Guidance
Published
United States (federal) · Aug 31, 2026
EFF guide on doxxing incident response and digital footprint protection
The Electronic Frontier Foundation published a guide outlining steps for individuals and groups to respond to doxxing attacks. It covers incident logging, team role assignment, monitoring hate forums, setting up alerts, hardening accounts…
California Delete Act
Low
Proposed regulation
Proposed
BR · Aug 28, 2026
EFF and allies recommend new privacy safeguards to protect Brazil's electoral integrity
The Electronic Frontier Foundation, Access Now and Data Privacy Brasil issued recommendations urging stronger personal data protection in Brazil's elections. They call for prohibiting processing of sensitive political data, requiring…
LGPD
Moderate
Settlement
Settled
Connecticut · Aug 27, 2026
Connecticut AG settles with TaxAct over taxpayer data disclosures via tracking tech
On August 19, 2026, Connecticut Attorney General William Tong announced a $275,000 settlement with TaxAct for improperly disclosing taxpayer information to advertising partners through third‑party tracking technologies. The settlement…
Connecticut Attorney General
Low
Enforcement
Announced
Germany · Aug 26, 2026 · effective Aug 26, 2026
noyb sends cease‑and‑desist letter to SCHUFA over alleged ‘shadow database’ GDPR violations
In July 2026, the NGO noyb issued a cease‑and‑desist letter to German credit agency SCHUFA demanding it stop storing data beyond retention periods and provide full historical data under Article 15 GDPR. The organization warned it will seek…
EDPB · General Data Protection Regulation
Moderate
New law
Signed
Colorado · Aug 17, 2026 · effective Jan 1, 2027
Colorado governor signs SB 26-189, revising AI Act to regulate ADMT in employment
On May 14, 2026, Colorado Governor signed SB 26-189, repealing and replacing the 2024 Artificial Intelligence Act. The new law, effective January 1, 2027, targets automated decision‑making technology (ADMT) that materially influences…
DE DOJ · Delaware Personal Data Privacy Act
Low
Guidance
Published
United States (federal) · Aug 11, 2026
EFF states all images are human-generated, with rare AI exceptions
EFF announced that its blog and merchandise images are created by human designers, not AI image generators, except for rare cases that are explicitly credited. The organization added a credit label "Image created by EFF" to banner images…
Creative Commons Attribution (CC‑By) license
Moderate
Guidance
Announced
United States (federal) · Aug 5, 2026
Future of Privacy Forum releases updated AI risk assessment framework and best practices for hiring
Future of Privacy Forum and leading HR software firms released Updated Best Practices for AI and Workplace Assessment Technologies, addressing generative and agentic AI in employment. The guidance outlines a risk assessment framework and…
EU AI Office · EU AI Act
Moderate
Proposed bill
Introduced
United States (federal) · Aug 5, 2026
Senator Mark Kelly introduces Senior Chatbot Protection Act
Future of Privacy Forum notes the bipartisan Senior Chatbot Protection Act was introduced to establish baseline consumer protections and transparency for AI chatbots used by older adults. The statement welcomes the effort to create clear…
Delaware Personal Data Privacy Act
Moderate
Enforcement
In effect
European Union · Aug 2, 2026 · effective Aug 2, 2026
EU Commission begins enforcing AI Act and new transparency rules on 2 August 2026
From 2 August 2026 the European Commission’s AI Office and national authorities will start enforcing the AI Act. New transparency rules require chatbots to disclose they are AI and AI‑generated content such as deepfakes to be labelled with…
European Commission AI Office · EU AI Act
