High
Proposed regulation
Proposed
United States (federal) · Oct 19, 2026 · effective Oct 19, 2026
FCC proposes to modify system of records for National Deaf-Blind Equipment Distribution Program
The Federal Communications Commission proposes amendments to the FCC/CGB-3 system of records, updating its purposes, categories of individuals and records, and adding two new routine uses. The changes are intended to meet Privacy Act…
Federal Communications Commission · Privacy Act of 1974
High
Final regulation
In effect
United States (federal) · Oct 19, 2026 · effective Oct 19, 2026
FCC modifies Lifeline Program system of records (FCC/WCB-1) under the Privacy Act
The Federal Communications Commission is amending the FCC/WCB-1 system of records that supports the Lifeline Program, which provides discounted voice and broadband services to low‑income households. The amendment updates the categories of…
Federal Communications Commission · Privacy Act of 1974
Moderate
Proposed regulation
Proposed
United States (federal) · Oct 15, 2026
DOJ proposes exemption for BJS statistical data system from certain Privacy Act provisions
The Office of Justice Programs announced a notice of a new system of records, BJS Statistical Data (JUSTICE/OJP-017), covering data collected under 34 U.S.C. 10132. The agency proposes to exempt this system from specific Privacy Act…
U.S. Department of Justice, Office of Justice Programs · Privacy Act of 1974
Moderate
Proposed regulation
Proposed
Vermont · Oct 8, 2026
Future of Privacy Forum submits comments on Vermont Age-Appropriate Design Code rulemaking
On October 2, 2026 the Future of Privacy Forum filed comments to the Vermont Attorney General’s rulemaking for the Age-Appropriate Design Code. The act, enacted in June 2025, sets duties for businesses serving minors and will become…
Vermont Office of the Attorney General · California Age-Appropriate Design Code Act
Moderate
Proposed regulation
Proposed
France · Oct 8, 2026
CNIL examines draft deliberation authorizing BIG DATA SANTE to process personal data for anonymized medical research (ONCOVAL)
During its plenary session on 8 October 2026, the CNIL will consider a draft deliberation that would permit BIG DATA SANTE (Octopize Mimethik Data) to carry out automated processing of personal data to create anonymised datasets for…
Commission nationale de l'informatique et des libertés (CNIL) · Law of 6 January 1978
Moderate
Proposed regulation
Proposed
United States (federal) · Oct 7, 2026
DEA proposes to modify and republish its Aviation Division system of records notice
The Drug Enforcement Administration (DEA) announced a proposal to update the system of records notice for its Aviation Division, changing the categories of individuals covered, record categories, purpose, routine uses, and storage…
Justice Department · Privacy Act of 1974
Moderate
Proposed regulation
Proposed
European Union · Sep 21, 2026
EU proposes Article 88c/88bis to allow unrestricted AI use of personal data
A leaked Irish Presidency document proposes that personal data used "in the context of AI" be automatically lawful, removing consent requirements. The draft Article 88c (now 88bis) would permit AI companies to process any personal data for…
European Commission · General Data Protection Regulation
Moderate
Proposed regulation
Announced
France · Sep 3, 2026
CNIL agenda includes review of draft decrees on automated personal data processing and authorizations for health data studies
The CNIL plenary session agenda for 3 September 2026 lists examinations of draft deliberations on a decree modifying decree n° 2023‑935 for the SISPoPP system, a draft decree on the API‑PNR France system, and authorizations for RCTs, IQVIA…
Commission nationale de l'informatique et des libertés (CNIL) · General Data Protection Regulation
Low
Proposed regulation
Proposed
BR · Aug 28, 2026
EFF and allies recommend new privacy safeguards to protect Brazil's electoral integrity
The Electronic Frontier Foundation, Access Now and Data Privacy Brasil issued recommendations urging stronger personal data protection in Brazil's elections. They call for prohibiting processing of sensitive political data, requiring…
LGPD
Moderate
Proposed regulation
Published
European Union · Mar 5, 2026
EU Commission's Digital Omnibus proposal to limit GDPR Right of Access faces criticism from DPOs
The European Commission has published a Digital Omnibus proposal that would narrow the definition of personal data, restrict the Right of Access and allow broader AI training. A survey by noyb shows data protection officers consider the…
European Commission · General Data Protection Regulation
Moderate
Proposed regulation
Proposed
European Union · Feb 24, 2026
EU Commission proposes Digital Omnibus to amend GDPR and ePrivacy Directive
The European Commission published its Digital Omnibus proposal on 19 November 2025, aiming to amend the GDPR and the ePrivacy Directive. noyb’s analysis warns that the proposed changes could conflict with the EU Charter of Fundamental…
European Commission · ePrivacy Directive
Moderate
Proposed regulation
Proposed
European Union · Nov 22, 2025
EU Commission proposes Digital Omnibus package with new personal data definition and research exemption
The European Commission has released the Digital Omnibus proposal, introducing a narrower definition of personal data (Art. 4(1)), a broader research exemption (Arts. 4(38), 5(1)(b), 13, 89), and new AI‑related rules (Arts. 9(2)(k), 9(5)…
European Commission · General Data Protection Regulation
Moderate
Proposed regulation
Proposed
European Union · Nov 11, 2025
Open letter warns EU Commission's Digital Omnibus draft could deregulate GDPR
Noyb, EDRi and the Irish Council for Civil Liberties sent an open letter to the European Commission criticizing a draft Digital Omnibus that would amend core GDPR provisions. The draft proposes redefining personal data, weakening data…
European Commission · General Data Protection Regulation
Moderate
Proposed regulation
Proposed
European Union · May 23, 2023
EU Commission proposes GDPR Procedures Regulation to address enforcement delays
Noyb calls for an EU procedural regulation to fix widespread delays and procedural tricks in GDPR enforcement across member states. The European Commission has indicated interest in such a regulation and also in the upcoming EU Collective…
European Commission · General Data Protection Regulation
Moderate
Proposed regulation
Published
European Union · Jun 14, 2021
noyb and CSL propose Advanced Data Protection Control browser signal to replace cookie banners
noyb and the Sustainable Computing Lab released a technical proposal for an "Advanced Data Protection Control" (ADPC) browser signal. The signal would allow browsers to automatically convey user consent or opt‑in preferences to websites…
EDPB · General Data Protection Regulation
