Low
Enforcement
Announced
California · Oct 1, 2026
EFF and ACLU demand records from Marin County Sheriff over illegal ALPR data sharing
The Electronic Frontier Foundation and the ACLU of Northern California sent a demand letter to the Marin County Sheriff’s Office requesting records under the California Public Records Act. The letter alleges violations of California law SB…
SB 34
Moderate
Enforcement
Announced
Bulgaria · Oct 1, 2026
European Commission sends formal notice to Bulgaria for non‑compliance with the Digital Services Act
The Commission issued a formal notice (INFR(2024)2241) to Bulgaria for failing to fully comply with the DSA, specifically for not designating and empowering the required Digital Services Coordinators. Bulgaria has two months to respond…
European Commission · Digital Services Act
Low
Enforcement
Published
New York · Sep 30, 2026
NY Attorney General releases body‑worn camera footage of minor’s death investigation
New York Attorney General Letitia James released body‑worn camera footage from an investigation into the June 27, 2026 death of a minor in Dutchess County. The footage shows officers from NY State Police, Dutchess County Sheriff’s Office…
New York Attorney General's Office · New York State Executive Law Section 70-b
Low
Investigation
Announced
Texas · Sep 28, 2026
Texas AG Paxton launches investigation into AI data center development on land originally conveyed for park use
Attorney General Ken Paxton announced an investigation into a proposed AI data center in Taylor, Texas, built on land conveyed in 1999 for future public park use. The probe will examine whether the trust and deed restrictions were altered…
Texas Attorney General
Low
Investigation
Announced
United States (federal) · Sep 24, 2026
Senate Judiciary Subcommittee holds hearing on Flock Safety AI surveillance network
The Senate Judiciary Committee’s Subcommittee on Crime and Counterterrorism conducted a hearing on Flock Safety’s nationwide AI surveillance system. Experts highlighted the extensive data collection, facial tracking, and cybersecurity…
Low
Enforcement
Decided
France · Sep 24, 2026 · effective Sep 17, 2026
CNIL closes injunction against SOLOCAL MARKETING SERVICES
The French data protection authority CNIL closed the injunction it issued on 15 May 2025 after the company demonstrated measures to verify the validity of consent obtained by its data‑broker partners. The original sanction included a…
CNIL · code des postes et des communications électroniques (CPCE)
High
Settlement
Settled
New York · Sep 24, 2026
NY AG secures $2.3M settlement and reforms from Labcorp after data breach
The New York Attorney General, together with 43 other state AGs, secured a $2.3 million settlement and mandated security reforms from Laboratory Corporation of America (Labcorp) following a 2019 breach that exposed personal and health data…
New York Attorney General's Office
Moderate
Enforcement
Published
Spain · Sep 23, 2026
Spanish Data Protection Agency issues warning to company over AI-driven resume screening
On 23 September 2026 the AEPD sent a formal warning to a company planning to use an AI tool for analysing CVs and assigning scores. The agency stresses that data protection must be built in from the start, including DPIA for high‑risk…
Agencia Española de Protección de Datos (AEPD) · Reglamento General de Protección de Datos (RGPD)
High
Fine
Decided
Ireland · Sep 23, 2026 · effective Sep 21, 2026
Irish Data Protection Commission fines Google €403 million for GDPR violations over location data
The Irish Data Protection Commission issued its final decision on 21 September 2026, imposing administrative fines of €403 million on Google Ireland Limited. The DPC found infringements of GDPR principles relating to lawfulness, fairness…
Irish Data Protection Commission · General Data Protection Regulation
Moderate
Fine
Decided
Spain · Sep 22, 2026 · effective Feb 1, 2023 · deadline Feb 1, 2024
Spanish DPA fines Securitas Direct €100,000 for charging phone line for data subject rights
The Spanish Data Protection Agency (AEPD) issued a final decision on 1 February 2023 finding Securitas Direct in breach of GDPR Article 12(2) by directing data subjects to a chargeable 902 telephone number to exercise their rights. The…
Spanish Data Protection Agency (AEPD) · General Data Protection Regulation
Moderate
Settlement
Settled
United States (federal) · Sep 17, 2026
FTC Announces Additional Payments to Consumers Under Amazon Prime Settlement
The FTC announced that under a revised order in the Amazon Prime settlement, the maximum consumer refund increased from $51 to $200. The change allows more consumers to qualify for payments. The announcement was released on September 17…
Federal Trade Commission
High
Enforcement
Settled
United States (federal) · Sep 17, 2026
FleetCor to Pay $100M to Settle FTC Administrative Action Over Unauthorized Fuel Card Fees
The Federal Trade Commission alleged that FleetCor, now operating as Corpay, charged small‑business customers hidden fees and misrepresented savings from its fuel cards. The company agreed to pay $100 million to resolve the FTC…
Federal Trade Commission · FTC Act Section 5
Moderate
Settlement
Settled
United States (federal) · Sep 16, 2026
Settlement codifies Meta's surveillance practices into law as states move to curb ALPR use
The EFF newsletter reports a settlement that enshrines Meta's harmful surveillance into law. It also notes that several U.S. states are introducing measures to limit the use of automated license plate reader (ALPR) networks, citing police…
Low
Settlement
Settled
United States (federal) · Sep 16, 2026
Meta settles lawsuit with 52 US states imposing age‑gating and time limits on under‑18 users
Meta settled a lawsuit with 52 states and territories that will require age‑gating, a two‑hour daily usage limit, and content restrictions for users under 18. The agreement also pressures other platforms such as TikTok and YouTube to adopt…
Low
Enforcement
Announced
United States (federal) · Sep 15, 2026
DOJ partially confirms DHS whistleblower allegations on SAVE voter eligibility program
The Department of Justice issued a notice to a federal court partially confirming whistleblower allegations that DHS is expanding the SAVE system to check voter eligibility. EPIC and the League of Women Voters argue this violates the U.S.…
Department of Justice (DOJ) · U.S. Constitution
Low
Enforcement
Pending
United States (federal) · Sep 15, 2026
EPIC warns sale of Google’s Spirit Air AI worker data lacks private right of action
EPIC counsel Mayu Tobin‑Miyaji says unions’ concerns are valid and highlights the absence of a private right of action, leaving enforcement of worker data protections dependent on state attorneys general. She notes that without such a…
Moderate
Investigation
Announced
United States (federal) · Sep 14, 2026
Police misuse ALPR data with frivolous reasons, EFF finds
EFF analysis of Flock Safety ALPR logs shows officers across the United States entering nonsensical reasons such as "LOL", "LMAO" and "idk" to access vehicle location data. The lack of warrant requirements and weak audit controls enables…
CPPA · California Delete Act
Low
Enforcement
Announced
New Jersey · Sep 11, 2026
Cameras capture alleged vandal in Morristown SafetyStick pilot
EPIC senior counsel Jeramie D. Scott said the community should be informed before any surveillance technology is deployed. Cameras in the Morristown SafetyStick pilot captured an alleged camera vandal. Scott warned that surveillance can be…
High
Fine
Decided
France · Sep 11, 2026 · effective Jul 21, 2026
CNIL fines French IT firm EXTIA €300,000 for failing to honor data erasure requests
In 2024 EXTIA received 265 requests for erasure, many of which were not processed or not communicated to the requesters. The CNIL audit found breaches of Articles 12 and 17 GDPR regarding transparency and the right to erasure. The CNIL…
CNIL · General Data Protection Regulation
Moderate
Fine
Announced
Netherlands · Sep 10, 2026
Dutch DPA fines Uber €824,990,000 for automated decisions affecting drivers
On August 21, 2026, the Dutch Data Protection Authority announced it had fined Uber €824,990,000 for breaching the EU GDPR rules on solely automated decision‑making. The fine targets Uber's use of automated systems that affect driver…
Dutch Data Protection Authority · General Data Protection Regulation
