Moderate
Guidance
Published
France · Oct 2, 2026
CNIL explains when data‑breach victims can claim compensation under the GDPR
The CNIL outlines that individuals can seek damages only if a GDPR breach caused a real material or moral injury, and they can prove a causal link. Compensation is awarded by a judge, not the CNIL, and the regulator may only impose…
CNIL · RGPD
High
Guidance
In effect
United States (federal) · Oct 2, 2026 · effective Nov 2, 2026
DOI establishes new matching program under Privacy Act of 1974
The U.S. Department of the Interior announced a new matching program that will compare records from 20 DOI programs with the Treasury's Do Not Pay Working System. The program aims to verify prepayment or pre‑award eligibility, prevent…
U.S. Department of the Interior · Privacy Act of 1974
Low
Court ruling
In effect
United States (federal) · Oct 1, 2026
Court order forces Google to allow third‑party app stores on Play Store
A court order stemming from Epic Games v. Google requires Google to permit rival Android app stores to be listed in the Play Store and to let developers direct users to alternative payment and distribution options. The change expands user…
Low
Court ruling
In effect
Utah · Oct 1, 2026
Federal judge blocks Utah's anti-VPN age‑verification law (SB 73) with preliminary injunction
A U.S. federal judge issued a preliminary injunction halting enforcement of Utah's SB 73, which required adult websites to block VPN users or determine their physical location for age verification. The court found the statute imposes a…
Utah SB 73
Moderate
Proposed regulation
Announced
France · Oct 1, 2026
CNIL to examine draft decree on student violence questionnaire and automated vehicle sound monitoring
The CNIL plenary session on 1 October 2026 will examine a draft decree authorising personal data processing for a "Questionnaire violences sexistes et sexuelles" in schools. It will also review draft orders on sound radars and an automated…
Commission nationale de l'informatique et des libertés (CNIL) · règlement intérieur de la CNIL
High
Guidance
Published
France · Oct 1, 2026 · effective Oct 1, 2026
CNIL and Cybermalveillance.gouv.fr release guide for individuals on personal data breach response
The French data protection authority (CNIL) and Cybermalveillance.gouv.fr have published a practical support document titled “Violation de données personnelles, que faire en 3 étapes clés ?”. The guide provides a three‑step checklist for…
CNIL
Moderate
Proposed regulation
Announced
United States (federal) · Oct 1, 2026
HUD announces intent to establish eVMS system of records under the Privacy Act
The Department of Housing and Urban Development (HUD) issued a Federal Register notice announcing its intent to create a new Privacy Act system of records called the Enterprise Voucher Management System (eVMS). The system will manage…
Department of Housing and Urban Development (HUD) · Privacy Act of 1974
Moderate
Guidance
Published
United States (federal) · Oct 1, 2026
Federal Register limits automated access; CAPTCHA required for flagged requests
The Federal Register website warns that programmatic requests are flagged as potentially automated and must complete a CAPTCHA to proceed. Users are directed to the FederalRegister.gov and eCFR.gov API documentation for legitimate…
Moderate
Proposed regulation
Proposed
United States (federal) · Oct 1, 2026
Federal Register proposes limiting automated scraping, requiring API use and CAPTCHAs
The notice warns that aggressive automated scraping of FederalRegister.gov and eCFR.gov will be restricted to access via developer APIs. Human users must complete a CAPTCHA to request access, and occasional re‑verification is expected as a…
National Archives and Records Administration
Moderate
Proposed bill
Introduced
United States (federal) · Sep 30, 2026
Senator Markey Introduces Facial Recognition and Biometric Technology Moratorium Act of 2026
Senators Markey and Merkley, together with Representatives Jaypal, Pressley, and Tlaib, introduced legislation to halt federal use of biometric surveillance, including facial recognition. The Facial Recognition and Biometric Technology…
Low
Guidance
Published
United States (federal) · Sep 30, 2026
EFF discusses privacy implications of Apple Siri AI features in iOS 27
The EFF newsletter examines how Apple’s new Siri AI in iOS 27 handles user data. It contrasts on‑device processing with server‑side processing and explains the privacy risks. The piece offers guidance on limiting the data Siri can access.
Moderate
Guidance
Published
United States (federal) · Sep 29, 2026
Federal Register restricts automated scraping; requires API use and CAPTCHA verification
The Federal Register warns that programmatic access to FederalRegister.gov and eCFR.gov is limited to its developer APIs due to aggressive automated scraping. Users must use the APIs or complete a CAPTCHA to verify they are human. The…
Privacy Act of 1974
Moderate
Guidance
Proposed
United States (federal) · Sep 29, 2026
Agency seeks comment on proposed information collection for protection of human subjects
The agency announced a proposed collection of information related to the protection of human subjects and Institutional Review Boards and is requesting public comment. The notice also notes that programmatic access to FederalRegister.gov…
Food and Drug Administration · Paperwork Reduction Act of 1995
Low
Proposed regulation
Proposed
California · Sep 28, 2026
San Francisco Police Department proposes expanded drone surveillance policy, drawing criticism from EFF
The San Francisco Police Department (SFPD) has issued a new proposed policy that would allow broader use of drones for public safety and patrol. The policy has been criticized by the Electronic Frontier Foundation and other groups for…
San Francisco Police Commission · Proposition E
Moderate
Proposed bill
Proposed
United States (federal) · Sep 28, 2026
U.S. lawmakers introduce AI AGENT Act and California SB 1106 defining AI agents
This summer U.S. lawmakers released two of the first legislative proposals for regulating AI agents: the federal AI AGENT Act and California SB 1106. The AI AGENT Act would establish a consumer‑facing framework based on the agent’s…
CPPA · California Consumer Privacy Act (as amended by CPRA)
Moderate
Final regulation
Published
California · Sep 28, 2026
California Privacy Protection Agency adopts multiple regulations including Conflict of Interest Code Amendments and Data Broker Registration Fee
The CPPA has adopted several regulations, such as the Conflict of Interest Code Amendments Regulation (September 2026) and Data Broker Registration Fee Regulation (December 2025). These were adopted through the Administrative Procedures…
California Privacy Protection Agency · California Consumer Privacy Act (as amended by CPRA)
High
Interpretation
Published
European Union · Sep 28, 2026
Commission designates ChatGPT, Reddit, Roblox as VLOPs/VLOSE under the Digital Services Act
The European Commission has designated ChatGPT as a Very Large Online Search Engine and Reddit and Roblox as Very Large Online Platforms under the DSA, citing each service’s reach of at least 45 million EU monthly users. The designated…
European Commission · Digital Services Act
Moderate
Guidance
Published
United States (federal) · Sep 28, 2026
Federal Register restricts automated scraping, requires CAPTCHA and API use
The Federal Register warns that aggressive automated scraping of its sites is limited to access via developer APIs. Human users must complete a CAPTCHA to continue, and may be asked to do so repeatedly as a security measure.
Department of Defense · Privacy Act of 1974
Moderate
Guidance
Published
United States (federal) · Sep 25, 2026
DoD updates SORN for DON Child and Youth Program to align with cybersecurity policies
The Department of Defense is modifying and reissuing the system of records titled "DON Child and Youth Program" (NM01754-3) under the Privacy Act of 1974. The updates incorporate DoD standard routine uses A through J, expand the collection…
Department of Defense · Privacy Act of 1974
High
Guidance
In effect
United States (federal) · Sep 25, 2026 · effective Oct 26, 2026
Peace Corps announces new CRM system of records (PC 38) effective Oct 26, 2026
The Peace Corps Office of Planning and Performance issued a public notice of a new system of records, the Peace Corps Customer Relationship Management (PC 38) system. The system will monitor, track, and analyze interactions with…
Peace Corps Office of Planning and Performance · Privacy Act of 1974
