Moderate
Guidance
Published
France · Oct 2, 2026
CNIL explains when data‑breach victims can claim compensation under the GDPR
The CNIL outlines that individuals can seek damages only if a GDPR breach caused a real material or moral injury, and they can prove a causal link. Compensation is awarded by a judge, not the CNIL, and the regulator may only impose…
CNIL · RGPD
High
Guidance
In effect
United States (federal) · Oct 2, 2026 · effective Nov 2, 2026
DOI establishes new matching program under Privacy Act of 1974
The U.S. Department of the Interior announced a new matching program that will compare records from 20 DOI programs with the Treasury's Do Not Pay Working System. The program aims to verify prepayment or pre‑award eligibility, prevent…
U.S. Department of the Interior · Privacy Act of 1974
Low
Enforcement
Announced
California · Oct 1, 2026
EFF and ACLU demand records from Marin County Sheriff over illegal ALPR data sharing
The Electronic Frontier Foundation and the ACLU of Northern California sent a demand letter to the Marin County Sheriff’s Office requesting records under the California Public Records Act. The letter alleges violations of California law SB…
SB 34
Low
Court ruling
In effect
United States (federal) · Oct 1, 2026
Court order forces Google to allow third‑party app stores on Play Store
A court order stemming from Epic Games v. Google requires Google to permit rival Android app stores to be listed in the Play Store and to let developers direct users to alternative payment and distribution options. The change expands user…
Low
Court ruling
In effect
Utah · Oct 1, 2026
Federal judge blocks Utah's anti-VPN age‑verification law (SB 73) with preliminary injunction
A U.S. federal judge issued a preliminary injunction halting enforcement of Utah's SB 73, which required adult websites to block VPN users or determine their physical location for age verification. The court found the statute imposes a…
Utah SB 73
Low
Guidance
Announced
United States (federal) · Oct 1, 2026
EFF launches Opt Out October campaign urging users to leave tech giants for privacy
The Electronic Frontier Foundation (EFF) released its annual Opt Out October campaign, encouraging individuals to regain control of their data by opting out of major platforms, apps, and operating systems. The initiative provides…
High
Guidance
Published
France · Oct 1, 2026 · effective Oct 1, 2026
CNIL and Cybermalveillance.gouv.fr release guide for individuals on personal data breach response
The French data protection authority (CNIL) and Cybermalveillance.gouv.fr have published a practical support document titled “Violation de données personnelles, que faire en 3 étapes clés ?”. The guide provides a three‑step checklist for…
CNIL
Moderate
Enforcement
Announced
Bulgaria · Oct 1, 2026
European Commission sends formal notice to Bulgaria for non‑compliance with the Digital Services Act
The Commission issued a formal notice (INFR(2024)2241) to Bulgaria for failing to fully comply with the DSA, specifically for not designating and empowering the required Digital Services Coordinators. Bulgaria has two months to respond…
European Commission · Digital Services Act
Moderate
Proposed regulation
Announced
United States (federal) · Oct 1, 2026
HUD announces intent to establish eVMS system of records under the Privacy Act
The Department of Housing and Urban Development (HUD) issued a Federal Register notice announcing its intent to create a new Privacy Act system of records called the Enterprise Voucher Management System (eVMS). The system will manage…
Department of Housing and Urban Development (HUD) · Privacy Act of 1974
Low
Court ruling
Decided
California · Sep 30, 2026
California Court of Appeals affirms dismissal of CEO's anti‑SLAPP suit against journalist
The California Court of Appeals upheld a lower court’s dismissal of a lawsuit filed by former Premise Data CEO Maury Blackman against journalist Jack Poulson, Substack, and AWS. The court ruled the suit was meritless under California’s…
California anti‑SLAPP statute
Moderate
Proposed bill
Introduced
United States (federal) · Sep 30, 2026
Senator Markey Introduces Facial Recognition and Biometric Technology Moratorium Act of 2026
Senators Markey and Merkley, together with Representatives Jaypal, Pressley, and Tlaib, introduced legislation to halt federal use of biometric surveillance, including facial recognition. The Facial Recognition and Biometric Technology…
Low
Guidance
Published
United States (federal) · Sep 30, 2026
EFF discusses privacy implications of Apple Siri AI features in iOS 27
The EFF newsletter examines how Apple’s new Siri AI in iOS 27 handles user data. It contrasts on‑device processing with server‑side processing and explains the privacy risks. The piece offers guidance on limiting the data Siri can access.
Moderate
Guidance
Published
United States (federal) · Sep 30, 2026
NHTSA seeks OMB approval to renew and modify information collection for qualitative feedback on service delivery
The National Highway Traffic Safety Administration (NHTSA) announced its intention to request Office of Management and Budget (OMB) approval to renew a currently approved information collection, adding annual tracking studies for…
National Highway Traffic Safety Administration (NHTSA) · Paperwork Reduction Act of 1995
Moderate
Guidance
Published
United States (federal) · Sep 30, 2026
HUD modifies system of records notice for Inventory Management System and Housing Information Portal
The Department of Housing and Urban Development (HUD) Office of Public and Indian Housing is updating its system of records notice for the Inventory Management System and Housing Information Portal. The amendment adds three new routine…
Department of Housing and Urban Development · Privacy Act of 1974
Low
Guidance
Announced
California · Sep 29, 2026
San Francisco announces new ALPR policy with limited safeguards, no warrant requirement, 30‑day data transfer deadline
San Francisco released a policy that retains Automated License Plate Reader (ALPR) surveillance but provides only limited safeguards. The policy does not require a warrant to search stored ALPR data and sets a 30‑day deadline to move data…
San Francisco Police Department
Low
Guidance
Announced
United States (federal) · Sep 29, 2026
EFF launches 'Privacy’s Defenders' podcast on digital surveillance history
The Electronic Frontier Foundation released a new podcast episode featuring Cindy Cohn and John Gilmore discussing mass surveillance, early internet activism, and ongoing privacy challenges. The episode highlights historical battles…
Moderate
Guidance
Announced
United States (federal) · Sep 29, 2026
FCC and USAC launch new computer matching program to verify Lifeline eligibility
The Federal Communications Commission and the Universal Service Administrative Company will conduct a computer matching program with the Connecticut Department of Social Services. The program is intended to verify the eligibility of…
Federal Communications Commission · Privacy Act of 1974
Moderate
Guidance
Proposed
United States (federal) · Sep 29, 2026
Agency seeks comment on proposed information collection for protection of human subjects
The agency announced a proposed collection of information related to the protection of human subjects and Institutional Review Boards and is requesting public comment. The notice also notes that programmatic access to FederalRegister.gov…
Food and Drug Administration · Paperwork Reduction Act of 1995
Low
Proposed regulation
Proposed
California · Sep 28, 2026
San Francisco Police Department proposes expanded drone surveillance policy, drawing criticism from EFF
The San Francisco Police Department (SFPD) has issued a new proposed policy that would allow broader use of drones for public safety and patrol. The policy has been criticized by the Electronic Frontier Foundation and other groups for…
San Francisco Police Commission · Proposition E
Moderate
Final regulation
Published
California · Sep 28, 2026
California Privacy Protection Agency adopts multiple regulations including Conflict of Interest Code Amendments and Data Broker Registration Fee
The CPPA has adopted several regulations, such as the Conflict of Interest Code Amendments Regulation (September 2026) and Data Broker Registration Fee Regulation (December 2025). These were adopted through the Administrative Procedures…
California Privacy Protection Agency · California Consumer Privacy Act (as amended by CPRA)
