Moderate
New law
Signed
California · Sep 10, 2026
California AB 1709, a ban on social media for under‑16, signed into law
AB 1709 was signed into law by Governor Gavin Newsom. The law imposes a functional ban on social media use for people under the age of 16 and requires age‑verification. Critics say the ban will increase data collection and limit free…
AB 1709
Moderate
Fine
Announced
Netherlands · Sep 10, 2026
Dutch DPA fines Uber €824,990,000 for automated decisions affecting drivers
On August 21, 2026, the Dutch Data Protection Authority announced it had fined Uber €824,990,000 for breaching the EU GDPR rules on solely automated decision‑making. The fine targets Uber's use of automated systems that affect driver…
Dutch Data Protection Authority · General Data Protection Regulation
Moderate
Proposed regulation
Proposed
France · Sep 10, 2026
CNIL to examine draft deliberation on finance bill 2027 provisions for online platform content collection for tax purposes
The CNIL plenary session on 10 September 2026 will examine a draft deliberation giving an opinion on provisions of the 2027 finance bill that would perpetuate the collection and exploitation of content from online platforms for tax…
Commission nationale de l'informatique et des libertés (CNIL) · projet de loi de finances pour 2027
Moderate
Guidance
In effect
France · Sep 10, 2026 · effective Sep 1, 2026
CNIL guidance on data‑protection obligations under the electronic invoicing reform effective 1 Sept 2026
The CNIL explains the data‑protection implications of the French electronic invoicing reform that entered into force on 1 Sept 2026. It details which personal data may be processed, the roles of issuers, receivers and certified platforms…
CNIL · réforme relative à la facturation électronique
Moderate
Guidance
Published
France · Sep 10, 2026
CNIL releases Volume 2 of “L’Agence Privacy” to educate adolescents on cybercrime and data privacy
On 10 September 2026 the French data‑protection authority CNIL published the second volume of its educational comic series “L’Agence Privacy”. The free online and paper resource targets teenagers and parents, covering risks such as…
CNIL
Low
Enforcement
Announced
Germany · Sep 10, 2026
noyb to file injunction against SCHUFA over shadow database
noyb sent a cease-and-desist letter to SCHUFA demanding the removal of its shadow database. SCHUFA's deadline to comply has expired and the agency has rejected the allegations. noyb announced it will now file an injunction and invites…
Moderate
Proposed regulation
Proposed
European Union · Sep 10, 2026
EU Commission proposes Article 88b for automated privacy signals in Digital Omnibus
The European Commission, as part of the Digital Omnibus package, proposed legally binding automated privacy signals under Article 88b of the GDPR to replace cookie banners. The proposal would let users set their privacy preferences once…
European Commission · California Delete Act
Low
Court ruling
Decided
United States (federal) · Sep 9, 2026
2015 court ruling requires warrant for police use of stingray devices
A Baltimore judge concluded that law enforcement hid its use of a Stingray device by using a pen register order, violating disclosure obligations. The decision resulted in a landmark 2015 privacy ruling that police must obtain a warrant to…
Low
Guidance
Announced
Global · Sep 9, 2026
EFF blog outlines digital sovereignty and its impact on privacy, data control and security
The post explains that digital sovereignty refers to the ability of individuals, nations and organizations to control their digital destiny, including data, technology and infrastructure. It highlights policy discussions in Europe and…
Low
Guidance
Announced
Global · Sep 9, 2026
EFF Announces 2026 Award Winners: Access Now, 7amleh, DeFlock, New Media Rights
The Electronic Frontier Foundation announced that Access Now, 7amleh – The Arab Center for the Advancement of Social Media, DeFlock, and New Media Rights received the 2026 EFF Awards. The award recognizes their work defending digital…
Moderate
Enforcement
Announced
Spain · Sep 9, 2026
AEPD opens investigation into Ministry of Interior report listing journalists and political leanings
The Spanish Data Protection Agency announced it will launch a formal, ex officio investigation into a Ministry of Interior communication office report that includes journalists' names and alleged political ideologies. The probe will…
Agencia Española de Protección de Datos · Reglamento General de Protección de Datos (RGPD)
Moderate
Guidance
Repealed
United States (federal) · Sep 9, 2026 · effective Sep 9, 2026
FTC rescinds 2021 Policy Statement on Breaches by Health Apps and Connected Devices
The Federal Trade Commission announced it is rescinding the 2021 Policy Statement on Breaches by Health Apps and Other Connected Devices. The guidance is deemed obsolete and is being withdrawn. The rescission was published on 2026-09-09.
Federal Trade Commission
Moderate
Lawsuit filed
Filed
United States (federal) · Sep 8, 2026
EFF releases 1,000 pages of CMS records on AI-driven Medicare WISeR prior‑authorization program
EFF obtained about 1,000 pages of CMS documents through its FOIA lawsuit filed in March, revealing delays, denials, and financial incentives in the WISeR AI model. The records show requests sometimes waited up to 83 days and vendors denied…
Centers for Medicare & Medicaid Services (CMS)
High
Guidance
Announced
Spain · Sep 8, 2026 · effective Oct 6, 2026
AEPD launches “Las claves de…” series on privacy and emerging neurotechnologies
The Spanish Data Protection Agency (AEPD) announced a new audiovisual dialogue format, “Las claves de…”, to discuss privacy challenges of neurotechnologies and neurodata. The first episode will be streamed live on 6 October 2026 with AEPD…
Agencia Española de Protección de Datos (AEPD) · Reglamento General de Protección de Datos (RGPD)
High
Amendment
Signed
Delaware · Sep 3, 2026 · effective Jan 1, 2027
Delaware Governor signs HB 380, amending the DPDPA effective Jan 1 2027
Governor Meyer signed HB 380 on September 2, amending the Delaware Personal Data Privacy Act. The amendment expands the definition of sensitive data, lowers applicability thresholds, adds new contractual and due‑diligence requirements for…
CFPB · Fair Credit Reporting Act
Moderate
Proposed regulation
Announced
France · Sep 3, 2026
CNIL agenda includes review of draft decrees on automated personal data processing and authorizations for health data studies
The CNIL plenary session agenda for 3 September 2026 lists examinations of draft deliberations on a decree modifying decree n° 2023‑935 for the SISPoPP system, a draft decree on the API‑PNR France system, and authorizations for RCTs, IQVIA…
Commission nationale de l'informatique et des libertés (CNIL) · General Data Protection Regulation
High
Enforcement
Decided
Ireland · Sep 3, 2026 · effective Aug 28, 2026
Data Protection Commission issues €645,000 fine and compliance orders against HSE
The Irish Data Protection Commission issued a final decision on 28 August 2026 concerning the Health Service Executive's handling of paper medical records. The DPC found physical security and integrity failures at external storage…
Data Protection Commission · General Data Protection Regulation
Moderate
Executive order
Signed
United States (federal) · Sep 2, 2026 · deadline Sep 30, 2026
Texas bans state funding for ALPRs; Florida orders removal of highway ALPRs
On August 28, Texas Governor Greg Abbott issued an order prohibiting state agencies from spending public funds on Flock ALPR cameras. On August 31, the Florida Department of Transportation, announced by Governor Ron DeSantis, issued a memo…
Moderate
Data protection authority action
Announced
Spain · Sep 2, 2026
AEPD to host data‑protection session at XX Jornadas STIC on 24 Nov 2026
The Spanish Data Protection Agency (AEPD) will hold a dedicated data‑protection space on 24 November 2026 during the XX Jornadas STIC conference in Madrid. The event, organized by the Centro Criptológico Nacional, the Centro Nacional de…
Agencia Española de Protección de Datos
Low
Court ruling
Decided
United States (federal) · Sep 2, 2026
Federal judge rules DoD illegally retaliated against Anthropic for refusing mass surveillance use
Anthropic sued the Department of Defense after being labeled a “supply chain risk” for refusing to let its AI be used for mass surveillance of U.S. persons. A federal judge held that the designation was unlawful retaliation in violation of…
First Amendment
