REGULATORY WATCH

Low Guidance Published Global · Sep 18, 2026

How to limit Siri AI access in iOS 27

Apple’s iOS 27 introduces a more powerful Siri AI that can access data from native and third‑party apps and may send information to Apple’s Private Cloud Compute. Users can mitigate privacy risks by disabling Siri, turning off app content…

Low Guidance Published Global · Sep 18, 2026

Secure Messaging and AI Remain In Conflict Despite the Promise of TEEs

The EFF warns that cloud‑based trusted execution environments (TEEs) do not provide the same privacy guarantees as end‑to‑end encryption. When AI features offload message data to TEEs, the content leaves the device and is exposed to…

Low Guidance Announced Global · Sep 18, 2026

EFF warns that cloud TEEs undermine end‑to‑end encryption in messaging apps

The EFF explains that while trusted execution environments (TEEs) can protect data on cloud servers, they do not provide the same mathematical guarantees as end‑to‑end encryption. Sending message content to a TEE for AI processing creates…

Low Lawsuit filed Filed United States (federal) · Sep 18, 2026

EPIC sues Trump administration over State Citizenship Lists program

EPIC, together with Protect Democracy and CREW, filed a lawsuit on Sept. 1, 2026 challenging DHS, SSA, and the State Department’s plan to create and distribute State Citizenship Lists for voter eligibility. The suit argues the program is…

Moderate Proposed regulation Proposed United States (federal) · Sep 18, 2026

EFF urges lawmakers to base AI cybersecurity rules on established best practices

The EFF recommends that any new AI cybersecurity legislation focus on proven security measures such as sandboxing, monitoring, and logging to mitigate risks demonstrated by recent AI lab incidents. It calls for minimum safety requirements…

Low Proposed bill Announced California · Sep 17, 2026

California SB 976 restricts teen social media feed recommendations, challenged as unconstitutional

California enacted SB 976, which requires parental permission before teens can view recommended content from other users on social media. The law is being challenged in Meta v. Bonta on First Amendment grounds. EFF argues the law also…

SB 976

Moderate Settlement Settled United States (federal) · Sep 17, 2026

FTC Announces Additional Payments to Consumers Under Amazon Prime Settlement

The FTC announced that under a revised order in the Amazon Prime settlement, the maximum consumer refund increased from $51 to $200. The change allows more consumers to qualify for payments. The announcement was released on September 17…

Federal Trade Commission

Moderate Proposed regulation Announced France · Sep 17, 2026

CNIL plenary agenda includes draft decrees on prison camera use, Apple ATT, and data collection in real‑estate rentals

The CNIL plenary session of 17 September 2026 will discuss a draft decree on the use of on‑board cameras by prison surveillance staff, a draft decree amending the 2019 decree that implements the French data protection law, and a…

Commission nationale de l'informatique et des libertés (CNIL) · décret n° 2019-536 du 29 mai 2019

High Enforcement Settled United States (federal) · Sep 17, 2026

FleetCor to Pay $100M to Settle FTC Administrative Action Over Unauthorized Fuel Card Fees

The Federal Trade Commission alleged that FleetCor, now operating as Corpay, charged small‑business customers hidden fees and misrepresented savings from its fuel cards. The company agreed to pay $100 million to resolve the FTC…

Federal Trade Commission · FTC Act Section 5

Moderate Guidance Published France · Sep 17, 2026

CNIL outlines its status, organization and sanction powers

The CNIL, created by the 1978 Loi Informatique et Libertés, is an independent administrative authority composed of a college of 18 members. Its restricted board can impose fines up to €20 million or 4 % of global annual turnover under the…

CNIL · loi Informatique et Libertés

Moderate Guidance Announced New York · Sep 17, 2026 · effective Jan 1, 2027

NY Attorney General urges workers to file whistleblower complaints on unsafe AI development

New York Attorney General Letitia James issued an alert encouraging employees with knowledge of unsafe or illegal AI development to submit confidential whistleblower complaints. The alert references the Responsible AI Safety and Education…

New York Attorney General's Office · New York SHIELD Act

Moderate FRAMEWORK UPDATE Published European Union · Sep 17, 2026 · effective Aug 2, 2026

EU AI Board discusses AI Act implementation and publishes Action Plan on cybersecurity and AI

On 17 September 2026 the EU AI Board met under the Irish Presidency to review priorities for EU AI policy and AI Act enforcement. The meeting included an update on the Commission’s Action Plan on cybersecurity and AI and on transparency…

European Commission · EU AI Act

Low Court ruling Decided United States (federal) · Sep 16, 2026

Ninth Circuit rejects expansive DMCA copyright claim over AI‑generated code

The U.S. Court of Appeals for the Ninth Circuit held that the removal of copyright management information (CMI) from a newly created work does not itself violate DMCA Section 1202. The case involved OpenAI and Microsoft using GitHub code…

Digital Millennium Copyright Act

Low Court ruling Decided Arizona · Sep 16, 2026

Supreme Court ruling allows Arizona mail ballots to proceed as usual

The U.S. Supreme Court issued a decision permitting the continued use of mail ballots in Arizona, which are used by 75% of voters. The ruling was challenged by the League of Women Voters and EPIC, who argued it would give DHS broad…

Moderate Guidance Published United States (federal) · Sep 16, 2026

EPIC report: Data brokers sell personal data to Disney, GM, insurers and banks

EPIC highlights that data brokers collect and sell personal information to major companies such as Disney, General Motors, insurers and banks. The article notes that brokers infer additional characteristics like finance, health…

Low Guidance Announced United States (federal) · Sep 16, 2026

EPIC report finds companies hinder personal data access under state privacy laws

The Electronic Privacy Information Center reports that many large firms make it difficult for consumers to obtain their personal data, despite state privacy statutes. EPIC notes that small fines and warning letters often have limited…

Low Guidance Announced United States (federal) · Sep 16, 2026

EFF appoints former White House official Alexander Macgillivray to Board of Directors

The Electronic Frontier Foundation announced that Alexander "amac" Macgillivray has joined its Board of Directors. Macgillivray previously served as Deputy Assistant to the President and Principal Deputy U.S. Chief Technology Officer and…

Blueprint for an AI Bill of Rights

Moderate Settlement Settled United States (federal) · Sep 16, 2026

Settlement codifies Meta's surveillance practices into law as states move to curb ALPR use

The EFF newsletter reports a settlement that enshrines Meta's harmful surveillance into law. It also notes that several U.S. states are introducing measures to limit the use of automated license plate reader (ALPR) networks, citing police…

Low Settlement Settled United States (federal) · Sep 16, 2026

Meta settles lawsuit with 52 US states imposing age‑gating and time limits on under‑18 users

Meta settled a lawsuit with 52 states and territories that will require age‑gating, a two‑hour daily usage limit, and content restrictions for users under 18. The agreement also pressures other platforms such as TikTok and YouTube to adopt…

Moderate Guidance Published KE · Sep 16, 2026

Kenya publishes new guidance on cross‑border data transfers

On 8 September 2026 Kenya’s Office of the Data Protection Commissioner released detailed Guidance Notes on cross‑border data transfers. The guidance clarifies Kenya’s transfer framework, adds operational detail, and highlights differences…

Office of the Data Protection Commissioner (ODPC) · General Data Protection Regulation