Low
Enforcement
Published
United States (federal) · Oct 14, 2026
DHS OIG audit finds TSA failed to safeguard passenger facial recognition data
The DHS Office of Inspector General reported a significant weakness in TSA's facial recognition system, noting that the vendor could access and extract sensitive driver’s license and passport images without TSA’s knowledge. The audit found…
Department of Homeland Security Office of Inspector General (DHS OIG)
Moderate
Attorney General action
Filed
New York · Oct 14, 2026
NY Attorney General urges bankruptcy court to protect children and consumers in Character.AI sale
New York Attorney General Letitia James and a coalition of 39 state AGs filed a motion in the Character Technologies bankruptcy court demanding strong protections for children and users before any sale of Character.AI. The filing cites…
New York Attorney General's Office
Moderate
Enforcement
In effect
France · Oct 14, 2026 · effective Sep 23, 2026
CNIL closes injunction against Google after compliance on cookie and Gmail ad consent
On 23 September 2026 the CNIL's restricted formation closed the injunction issued on 1 September 2025 against Google LLC and Google Ireland Limited. The companies complied by adding clear information about advertising cookies during…
CNIL · Article L.34-5 du code des postes et des communications électroniques
Moderate
Fine
In effect
France · Oct 13, 2026
French DPA fines Google €325 million for spam emails in Gmail
The French data protection authority imposed a €325 million administrative fine on Google for sending spam emails through Gmail, citing violations of the GDPR.
French Data Protection Authority · General Data Protection Regulation
High
Fine
In effect
Italy · Oct 12, 2026 · effective Jun 5, 2026
Italian DPA fines Wind Tre €16.7 million for unlawful telemarketing
The Italian Data Protection Authority imposed an administrative fine of EUR 16 700 000 on Wind Tre S.p.A. for violations of GDPR principles in its telemarketing and contract activation practices. The authority also issued a definitive ban…
Italian Data Protection Authority (Garante) · General Data Protection Regulation
Low
Enforcement
In effect
TR · Oct 9, 2026
Turkish courts block LGBTQ+ NGOs' websites and detain activists under obscenity and criminal organization laws
Since mid‑September, Turkish courts have ordered the blocking of websites and social media accounts of several LGBTQ+ organizations and have detained over 60 activists. Investigations are being conducted under Article 226 (obscenity) and…
Turkish Penal Code
High
Data protection authority action
Decided
Italy · Oct 9, 2026 · effective Sep 23, 2026
Italian DPA fines IQVIA €7 million for unlawful processing of patients’ health data
The Italian Data Protection Authority imposed an administrative fine of EUR 7,000,000 on IQVIA Solutions Italy S.r.l. for processing health data without a legal basis, inadequate information to patients, and missing DPIA and retention…
Italian Data Protection Authority · General Data Protection Regulation
High
Fine
In effect
Italy · Oct 9, 2026 · effective Jul 3, 2026
Italian DPA fines BBVA €5.508 million for ignoring customer’s objection to direct marketing
The Italian Data Protection Authority issued a final decision on 3 July 2026 finding BBVA infringed Articles 5, 12, 21 and 24 of the GDPR by failing to honor a customer's objection to direct marketing. BBVA was ordered to pay an…
Italian Data Protection Authority · General Data Protection Regulation
Moderate
Enforcement
Decided
Greece · Oct 8, 2026 · effective Jul 28, 2026
Hellenic DPA fines Ministry and EETAA for data breach
The Hellenic Data Protection Authority imposed administrative fines of EUR 200,000 on the Ministry of Social Cohesion and Family Affairs and EUR 150,000 on E.E.T.A.A. S.A. for a large‑scale personal data breach. The Authority also ordered…
Hellenic Data Protection Authority · General Data Protection Regulation
High
Fine
Published
Netherlands · Oct 8, 2026
Dutch DPA fines Uber €824.99 million for unlawful automated decision‑making
The Autoriteit Persoonsgegevens imposed an administrative fine of €824,990,000 on Uber for violating GDPR Article 22 by automatically deactivating drivers’ accounts and for failing to provide sufficient information under Article 13. The…
Autoriteit Persoonsgegevens · General Data Protection Regulation
Low
Enforcement
Announced
California · Oct 1, 2026
EFF and ACLU demand records from Marin County Sheriff over illegal ALPR data sharing
The Electronic Frontier Foundation and the ACLU of Northern California sent a demand letter to the Marin County Sheriff’s Office requesting records under the California Public Records Act. The letter alleges violations of California law SB…
SB 34
Moderate
Enforcement
Announced
Bulgaria · Oct 1, 2026
European Commission sends formal notice to Bulgaria for non‑compliance with the Digital Services Act
The Commission issued a formal notice (INFR(2024)2241) to Bulgaria for failing to fully comply with the DSA, specifically for not designating and empowering the required Digital Services Coordinators. Bulgaria has two months to respond…
European Commission · Digital Services Act
Low
Investigation
Announced
United States (federal) · Sep 24, 2026
Senate Judiciary Subcommittee holds hearing on Flock Safety AI surveillance network
The Senate Judiciary Committee’s Subcommittee on Crime and Counterterrorism conducted a hearing on Flock Safety’s nationwide AI surveillance system. Experts highlighted the extensive data collection, facial tracking, and cybersecurity…
Low
Enforcement
Decided
France · Sep 24, 2026 · effective Sep 17, 2026
CNIL closes injunction against SOLOCAL MARKETING SERVICES
The French data protection authority CNIL closed the injunction it issued on 15 May 2025 after the company demonstrated measures to verify the validity of consent obtained by its data‑broker partners. The original sanction included a…
CNIL · code des postes et des communications électroniques (CPCE)
High
Fine
Decided
Ireland · Sep 23, 2026 · effective Sep 21, 2026
Irish Data Protection Commission fines Google €403 million for GDPR violations over location data
The Irish Data Protection Commission issued its final decision on 21 September 2026, imposing administrative fines of €403 million on Google Ireland Limited. The DPC found infringements of GDPR principles relating to lawfulness, fairness…
Irish Data Protection Commission · General Data Protection Regulation
Moderate
Fine
Decided
Spain · Sep 22, 2026 · effective Feb 1, 2023 · deadline Feb 1, 2024
Spanish DPA fines Securitas Direct €100,000 for charging phone line for data subject rights
The Spanish Data Protection Agency (AEPD) issued a final decision on 1 February 2023 finding Securitas Direct in breach of GDPR Article 12(2) by directing data subjects to a chargeable 902 telephone number to exercise their rights. The…
Spanish Data Protection Agency (AEPD) · General Data Protection Regulation
Moderate
Settlement
Settled
United States (federal) · Sep 16, 2026
Settlement codifies Meta's surveillance practices into law as states move to curb ALPR use
The EFF newsletter reports a settlement that enshrines Meta's harmful surveillance into law. It also notes that several U.S. states are introducing measures to limit the use of automated license plate reader (ALPR) networks, citing police…
Low
Settlement
Settled
United States (federal) · Sep 16, 2026
Meta settles lawsuit with 52 US states imposing age‑gating and time limits on under‑18 users
Meta settled a lawsuit with 52 states and territories that will require age‑gating, a two‑hour daily usage limit, and content restrictions for users under 18. The agreement also pressures other platforms such as TikTok and YouTube to adopt…
Low
Enforcement
Announced
United States (federal) · Sep 15, 2026
DOJ partially confirms DHS whistleblower allegations on SAVE voter eligibility program
The Department of Justice issued a notice to a federal court partially confirming whistleblower allegations that DHS is expanding the SAVE system to check voter eligibility. EPIC and the League of Women Voters argue this violates the U.S.…
Department of Justice (DOJ) · U.S. Constitution
Low
Enforcement
Pending
United States (federal) · Sep 15, 2026
EPIC warns sale of Google’s Spirit Air AI worker data lacks private right of action
EPIC counsel Mayu Tobin‑Miyaji says unions’ concerns are valid and highlights the absence of a private right of action, leaving enforcement of worker data protections dependent on state attorneys general. She notes that without such a…
