Moderate
Guidance
Published
France · Oct 16, 2026
CNIL guidance on reconstituting professional email addresses and data subject rights
The CNIL explains that organisations may deduce a professional email address from publicly available information, but must comply with the GDPR and specific commercial prospecting rules. Data subjects must be informed clearly about the…
CNIL · RGPD
High
Guidance
Published
France · Oct 16, 2026 · effective Oct 16, 2026
CNIL guidance on lawful reconstitution of professional email addresses
The CNIL explains that reconstructing professional email addresses from publicly available data must comply with the GDPR and can rely on legitimate interest only if specific conditions are met. Organizations must assess the visibility of…
CNIL · RGPD
High
Fine
Decided
Norway (EEA) · Oct 16, 2026
Norwegian DPA fines Xandr €8.6M for unlawful processing of Grindr users' data
The Norwegian Data Protection Authority issued a final decision on 2 October 2026 imposing an administrative fine of EUR 8.6 million on Xandr Inc. for processing personal and special category data of Grindr users without valid consent.…
Norwegian Data Protection Authority · General Data Protection Regulation
Moderate
Proposed regulation
Proposed
France · Oct 15, 2026
CNIL examines draft decree on real‑time audio capture by public transport operators
The CNIL plenary session on 15 October 2026 will examine a draft deliberation providing an opinion on a draft decree concerning the experimentation of real‑time sound capture and transmission systems by bus and coach operators. The agenda…
Commission nationale de l'informatique et des libertés (CNIL) · décret n° 2022‑377 du 17 mars 2022
Moderate
New law
Signed
California · Oct 14, 2026
California Governor signs four privacy bills expanding deletion rights, privacy settings, data‑broker rules and limiting CIPA lawsuits
Governor Gavin Newsom signed SB 923, AB 2561, AB 883 and SB 690 into law during the 2026 session. SB 923 broadens CCPA deletion rights and requires online request mechanisms; AB 2561 bars operating systems and apps from changing privacy…
CPPA · California Consumer Privacy Act (as amended by CPRA)
Moderate
Attorney General action
Filed
New York · Oct 14, 2026
NY Attorney General urges bankruptcy court to protect children and consumers in Character.AI sale
New York Attorney General Letitia James and a coalition of 39 state AGs filed a motion in the Character Technologies bankruptcy court demanding strong protections for children and users before any sale of Character.AI. The filing cites…
New York Attorney General's Office
Moderate
Enforcement
In effect
France · Oct 14, 2026 · effective Sep 23, 2026
CNIL closes injunction against Google after compliance on cookie and Gmail ad consent
On 23 September 2026 the CNIL's restricted formation closed the injunction issued on 1 September 2025 against Google LLC and Google Ireland Limited. The companies complied by adding clear information about advertising cookies during…
CNIL · Article L.34-5 du code des postes et des communications électroniques
High
Fine
In effect
Italy · Oct 12, 2026 · effective Jun 5, 2026
Italian DPA fines Wind Tre €16.7 million for unlawful telemarketing
The Italian Data Protection Authority imposed an administrative fine of EUR 16 700 000 on Wind Tre S.p.A. for violations of GDPR principles in its telemarketing and contract activation practices. The authority also issued a definitive ban…
Italian Data Protection Authority (Garante) · General Data Protection Regulation
High
Fine
In effect
Italy · Oct 9, 2026 · effective Jul 3, 2026
Italian DPA fines BBVA €5.508 million for ignoring customer’s objection to direct marketing
The Italian Data Protection Authority issued a final decision on 3 July 2026 finding BBVA infringed Articles 5, 12, 21 and 24 of the GDPR by failing to honor a customer's objection to direct marketing. BBVA was ordered to pay an…
Italian Data Protection Authority · General Data Protection Regulation
Moderate
Proposed bill
Introduced
United States (federal) · Oct 7, 2026
Sen. Gillibrand reintroduces Data Protection Act to create U.S. Data Protection Agency
U.S. Senator Kirsten Gillibrand (D‑NY) has reintroduced the Data Protection Act, which would establish an independent federal Data Protection Agency. The bill aims to limit collection, use and sharing of personal data, oversee high‑risk…
Moderate
Guidance
Published
United States (federal) · Oct 5, 2026
EPIC analysis links pixel‑tracking litigation under ECPA and CIPA to upcoming Supreme Court VPPA case
EPIC outlines how recent court decisions using the Electronic Communications Privacy Act (ECPA) and California Invasion of Privacy Act (CIPA) address non‑consensual pixel tracking and its privacy harms. The analysis cites multiple…
HHS OCR · HIPAA Privacy, Security and Breach Notification Rules
Moderate
Settlement
Settled
United States (federal) · Oct 2, 2026
Meta’s Muse AI Agent raises privacy, security, and child safety concerns amid past FTC consent decree
Meta launched the Muse personal AI agent in September 2026, which collects extensive personal data and can act without clear user permission. EPIC reports multiple incidents where Muse accessed messages, shared home addresses, and…
Federal Trade Commission
Moderate
Guidance
Announced
France · Sep 28, 2026
CNIL to host AIR 2026 event on political communication ethics and election manipulation on 16 Nov 2026
The French data‑protection authority CNIL will hold a public debate on 16 November 2026 about the ethical challenges of digital political communication and foreign interference. The programme will examine voter consent, data‑minimisation…
CNIL · RGPD
Low
Enforcement
Decided
France · Sep 24, 2026 · effective Sep 17, 2026
CNIL closes injunction against SOLOCAL MARKETING SERVICES
The French data protection authority CNIL closed the injunction it issued on 15 May 2025 after the company demonstrated measures to verify the validity of consent obtained by its data‑broker partners. The original sanction included a…
CNIL · code des postes et des communications électroniques (CPCE)
Moderate
Guidance
Published
United States (federal) · Sep 24, 2026
SBA seeks comments on modified matching program under Privacy Act
The U.S. Small Business Administration issued a Federal Register notice requesting public comment on a Privacy Act notice for a revised computer‑matching program. The program will compare SBA benefits records with the Treasury Department’s…
U.S. Small Business Administration · Privacy Act of 1974
Moderate
Court ruling
Pending
United States (federal) · Sep 23, 2026
Supreme Court hears digital‑privacy case involving Paramount and targeted advertising
The Electronic Privacy Information Center argued before the Supreme Court that Paramount and other online‑video companies are not obligated to use targeted advertising systems and can adopt privacy‑protective techniques. The case could set…
Moderate
New law
Signed
California · Sep 23, 2026
California SB 1119 signed into law regulating AI chatbots for minors
The Future of Privacy Forum report notes that California’s SB 1119 was recently signed into law by Governor Newsom. The law targets chatbot interactions with minors, requiring disclosures, crisis‑response protocols, age assurance, parental…
SB 1119
Moderate
Final regulation
In effect
United States (federal) · Sep 22, 2026
FCC adopts final rule clarifying TCPA “Revoke All” requirements
On September 9, 2026, the Federal Communications Commission issued a final rule amending the delayed “Revoke All” rule under the Telephone Consumer Protection Act. The rule will become effective 30 days after its publication.
Federal Communications Commission · Telephone Consumer Protection Act
Moderate
Court ruling
Pending
United States (federal) · Sep 21, 2026
Supreme Court to decide VPPA consumer definition in Salazar v. Paramount Global
The Supreme Court will hear Salazar v. Paramount Global in the October 2026 term to resolve a circuit split on the definition of “consumer” under the Video Privacy Protection Act. The case arises from a class action alleging Paramount…
Video Privacy Protection Act
Moderate
Proposed regulation
Proposed
European Union · Sep 21, 2026
EU Commission proposes KIDS Act to impose age‑based restrictions and safety‑by‑design for children online
On September 17, 2026 the European Commission published a proposal for a new EU KIDS Act that would ban users under 15 from creating accounts on certain social networking and video‑sharing services, with limited exceptions. The draft…
European Commission · Digital Services Act
