Low
Enforcement
Announced
Germany · Sep 10, 2026
noyb to file injunction against SCHUFA over shadow database
noyb sent a cease-and-desist letter to SCHUFA demanding the removal of its shadow database. SCHUFA's deadline to comply has expired and the agency has rejected the allegations. noyb announced it will now file an injunction and invites…
Moderate
Proposed regulation
Proposed
European Union · Sep 10, 2026
EU Commission proposes Article 88b for automated privacy signals in Digital Omnibus
The European Commission, as part of the Digital Omnibus package, proposed legally binding automated privacy signals under Article 88b of the GDPR to replace cookie banners. The proposal would let users set their privacy preferences once…
European Commission · California Delete Act
Low
Court ruling
Decided
United States (federal) · Sep 9, 2026
2015 court ruling requires warrant for police use of stingray devices
A Baltimore judge concluded that law enforcement hid its use of a Stingray device by using a pen register order, violating disclosure obligations. The decision resulted in a landmark 2015 privacy ruling that police must obtain a warrant to…
Low
Guidance
Announced
Global · Sep 9, 2026
EFF blog outlines digital sovereignty and its impact on privacy, data control and security
The post explains that digital sovereignty refers to the ability of individuals, nations and organizations to control their digital destiny, including data, technology and infrastructure. It highlights policy discussions in Europe and…
Low
Guidance
Announced
Global · Sep 9, 2026
EFF Announces 2026 Award Winners: Access Now, 7amleh, DeFlock, New Media Rights
The Electronic Frontier Foundation announced that Access Now, 7amleh – The Arab Center for the Advancement of Social Media, DeFlock, and New Media Rights received the 2026 EFF Awards. The award recognizes their work defending digital…
Moderate
Enforcement
Announced
Spain · Sep 9, 2026
AEPD opens investigation into Ministry of Interior report listing journalists and political leanings
The Spanish Data Protection Agency announced it will launch a formal, ex officio investigation into a Ministry of Interior communication office report that includes journalists' names and alleged political ideologies. The probe will…
Agencia Española de Protección de Datos · Reglamento General de Protección de Datos (RGPD)
Moderate
Guidance
Repealed
United States (federal) · Sep 9, 2026 · effective Sep 9, 2026
FTC rescinds 2021 Policy Statement on Breaches by Health Apps and Connected Devices
The Federal Trade Commission announced it is rescinding the 2021 Policy Statement on Breaches by Health Apps and Other Connected Devices. The guidance is deemed obsolete and is being withdrawn. The rescission was published on 2026-09-09.
Federal Trade Commission
Moderate
Lawsuit filed
Filed
United States (federal) · Sep 8, 2026
EFF releases 1,000 pages of CMS records on AI-driven Medicare WISeR prior‑authorization program
EFF obtained about 1,000 pages of CMS documents through its FOIA lawsuit filed in March, revealing delays, denials, and financial incentives in the WISeR AI model. The records show requests sometimes waited up to 83 days and vendors denied…
Centers for Medicare & Medicaid Services (CMS)
High
Guidance
Announced
Spain · Sep 8, 2026 · effective Oct 6, 2026
AEPD launches “Las claves de…” series on privacy and emerging neurotechnologies
The Spanish Data Protection Agency (AEPD) announced a new audiovisual dialogue format, “Las claves de…”, to discuss privacy challenges of neurotechnologies and neurodata. The first episode will be streamed live on 6 October 2026 with AEPD…
Agencia Española de Protección de Datos (AEPD) · Reglamento General de Protección de Datos (RGPD)
Moderate
Enforcement
Decided
Ireland · Sep 7, 2026
Irish DPC welcomes court conviction of Brown Thomas for ePrivacy breaches
The Dublin Metropolitan District Court convicted Brown Thomas Arnotts Limited on 7 September 2026 for multiple breaches of Regulation 13 of the ePrivacy Regulations. The company pleaded guilty to five sample charges, including failures to…
Data Protection Commission · ePrivacy Directive
Low
Enforcement
Announced
European Union · Sep 4, 2026 · effective Aug 31, 2026
EU Commission designates ChatGPT as VLOSE and Reddit, Roblox as VLOPs under DSA
On August 31, 2026, the European Commission announced that it had designated ChatGPT as a Very Large Online Search Engine (VLOSE) and Reddit and Roblox as Very Large Online Platforms (VLOPs) under the Digital Services Act. The designations…
European Commission · Digital Services Act
Moderate
Guidance
Announced
United States (federal) · Sep 3, 2026
SEC Investor Advisory Committee to Host Sept. 10 Meeting on AI Technologies and NMS Rules
The U.S. Securities and Exchange Commission’s Investor Advisory Committee will hold a public meeting on Sept. 10, 2026 to discuss artificial intelligence technologies in the public markets and the SEC’s Regulation National Market System…
Securities and Exchange Commission · Regulation National Market System
High
Amendment
Signed
Delaware · Sep 3, 2026 · effective Jan 1, 2027
Delaware Governor signs HB 380, amending the DPDPA effective Jan 1 2027
Governor Meyer signed HB 380 on September 2, amending the Delaware Personal Data Privacy Act. The amendment expands the definition of sensitive data, lowers applicability thresholds, adds new contractual and due‑diligence requirements for…
CFPB · Fair Credit Reporting Act
Moderate
Proposed regulation
Announced
France · Sep 3, 2026
CNIL agenda includes review of draft decrees on automated personal data processing and authorizations for health data studies
The CNIL plenary session agenda for 3 September 2026 lists examinations of draft deliberations on a decree modifying decree n° 2023‑935 for the SISPoPP system, a draft decree on the API‑PNR France system, and authorizations for RCTs, IQVIA…
Commission nationale de l'informatique et des libertés (CNIL) · General Data Protection Regulation
High
Enforcement
Decided
Ireland · Sep 3, 2026 · effective Aug 28, 2026
Data Protection Commission issues €645,000 fine and compliance orders against HSE
The Irish Data Protection Commission issued a final decision on 28 August 2026 concerning the Health Service Executive's handling of paper medical records. The DPC found physical security and integrity failures at external storage…
Data Protection Commission · General Data Protection Regulation
Moderate
Executive order
Signed
United States (federal) · Sep 2, 2026 · deadline Sep 30, 2026
Texas bans state funding for ALPRs; Florida orders removal of highway ALPRs
On August 28, Texas Governor Greg Abbott issued an order prohibiting state agencies from spending public funds on Flock ALPR cameras. On August 31, the Florida Department of Transportation, announced by Governor Ron DeSantis, issued a memo…
Moderate
Data protection authority action
Announced
Spain · Sep 2, 2026
AEPD to host data‑protection session at XX Jornadas STIC on 24 Nov 2026
The Spanish Data Protection Agency (AEPD) will hold a dedicated data‑protection space on 24 November 2026 during the XX Jornadas STIC conference in Madrid. The event, organized by the Centro Criptológico Nacional, the Centro Nacional de…
Agencia Española de Protección de Datos
Low
Court ruling
Decided
United States (federal) · Sep 2, 2026
Federal judge rules DoD illegally retaliated against Anthropic for refusing mass surveillance use
Anthropic sued the Department of Defense after being labeled a “supply chain risk” for refusing to let its AI be used for mass surveillance of U.S. persons. A federal judge held that the designation was unlawful retaliation in violation of…
First Amendment
Moderate
Settlement
Announced
United States (federal) · Sep 1, 2026
Meta to implement age‑verification framework under $17 B settlement with 52 U.S. states
Meta has agreed to a $17 billion settlement with 52 state attorneys general that mandates age‑assurance technology for its platforms. The settlement requires Meta to apply age‑verification methods within one year, classify users into 18+…
state attorneys general · Children's Online Privacy Protection Act
Moderate
Court ruling
Decided
Austria · Sep 1, 2026
Austrian Supreme Court rules CRIF’s use of address‑publisher data for credit scoring violates GDPR purpose limitation
The Austrian Supreme Court (OGH) held that credit reference agencies may not collect personal data from address publishers that process the data for marketing purposes, confirming a GDPR purpose‑limitation breach. The ruling supports…
EDPB · General Data Protection Regulation
