UNITED STATES (FEDERAL)

High Proposed regulation Proposed United States (federal) · Oct 13, 2026 · effective Oct 13, 2026

FHFA proposes to rescind SORN FHFA-12 and consolidate records under SORN FHFA-11

The Federal Housing Finance Agency (FHFA) announced a proposal to rescind the existing System of Records Notice (SORN) FHFA-12, which covers parking program records. The agency will consolidate those records with its transit subsidy…

Federal Housing Finance Agency · Privacy Act of 1974

Moderate Executive order Signed United States (federal) · Oct 9, 2026

President Trump issues executive order creating federal voter eligibility list

In March 2026, President Trump issued an executive order directing DHS to compile a list of U.S. citizens 18 years or older and directing DOJ to prosecute officials who provide ballots to ineligible voters. The order has been challenged by…

Privacy Act of 1974

Low Guidance Announced California · Oct 9, 2026

EFF joins Oakland Tech Week to discuss surveillance and AI impacts

The Electronic Frontier Foundation participated in Oakland Tech Week on Sept. 30, co‑presenting an all‑day event with MediaJustice and Upturn. Attendees discussed how technology can empower or oppress communities, focusing on surveillance…

Low Proposed regulation Announced United States (federal) · Oct 9, 2026

CISA submits Final CIRCIA Rule to OIRA for interagency review

On October 1, 2026, CISA submitted a draft of the Final Rule implementing the Cyber Incident Reporting for Critical Infrastructure Act of 2022 (CIRCIA) to OIRA. CIRCIA will require covered critical‑infrastructure entities to report…

Cybersecurity and Infrastructure Security Agency (CISA) · Cyber Incident Reporting for Critical Infrastructure Act of 2022 (CIRCIA)

Moderate Proposed regulation Proposed Vermont · Oct 8, 2026

Future of Privacy Forum submits comments on Vermont Age-Appropriate Design Code rulemaking

On October 2, 2026 the Future of Privacy Forum filed comments to the Vermont Attorney General’s rulemaking for the Age-Appropriate Design Code. The act, enacted in June 2025, sets duties for businesses serving minors and will become…

Vermont Office of the Attorney General · California Age-Appropriate Design Code Act

Moderate Proposed regulation Proposed United States (federal) · Oct 7, 2026

DOJ proposes exemption for Firearms Rights Restoration Electronic Records Database from Privacy Act provisions

The Office of the Pardon Attorney within the U.S. Department of Justice announced a notice of a new system of records called the Firearms Rights Restoration Electronic Records Database (FRRERD). The agency proposes to exempt this system…

U.S. Department of Justice · Privacy Act of 1974

Moderate Proposed regulation Proposed United States (federal) · Oct 7, 2026

DEA proposes to modify and republish its Aviation Division system of records notice

The Drug Enforcement Administration (DEA) announced a proposal to update the system of records notice for its Aviation Division, changing the categories of individuals covered, record categories, purpose, routine uses, and storage…

Justice Department · Privacy Act of 1974

High Proposed regulation Proposed United States (federal) · Oct 7, 2026 · effective Nov 6, 2026

Treasury proposes new system of records for federal student aid data

The Department of the Treasury proposes to establish a new system of records titled “Department of the Treasury .033--Federal Student Aid Portfolio Research, Analysis, Oversight, Reporting, and Compliance Records.” The system would allow…

Department of the Treasury · Privacy Act of 1974

Moderate New law Signed California · Oct 6, 2026

California Governor signs over 20 AI‑related bills into law

Governor Gavin Newsom signed more than 20 bills covering AI transparency, synthetic performer disclosures, chatbot labeling, and industry‑specific AI use restrictions. The measures amend the California AI Transparency Act, create new…

California AI Transparency Act

Low Enforcement Announced Texas · Oct 6, 2026

Texas AG launches investigation into children's clothing companies over toxic chemicals

Texas Attorney General Ken Paxton announced an investigation into major children’s clothing brands, including Hanes and Fruit of the Loom, for potential toxic chemicals in undergarments. The AG issued Civil Investigative Demands to the…

Texas Attorney General's Office

High Final regulation Announced United States (federal) · Oct 6, 2026 · effective Nov 5, 2026

Treasury exempts new tip intake records from certain Privacy Act provisions

The Department of the Treasury issued a final rule exempting the system of records titled "Treasury .032--Federal Program Waste, Fraud, and Abuse Tip Intake and Referral Records" from specific provisions of the Privacy Act of 1974. The…

Department of the Treasury · Privacy Act of 1974

High Proposed regulation Proposed United States (federal) · Oct 6, 2026 · effective Nov 16, 2026

NARA proposes revisions to System of Records NARA 44 for reasonable accommodation requests

The National Archives and Records Administration (NARA) proposes to revise its System of Records NARA 44, updating the system manager and location. The revision would expand the record type to include reasonable accommodation requests…

National Archives and Records Administration · Privacy Act of 1974

Low Proposed regulation Proposed Vermont · Oct 5, 2026

EPIC comments on Vermont Attorney General's proposed Age-Appropriate Design Code rules

On October 2, EPIC submitted comments on two proposed rules announced by the Vermont Attorney General to implement the state's Age-Appropriate Design Code. The rules target addictive design practices for minors and outline methods for age…

Vermont Attorney General · California Age-Appropriate Design Code Act

Moderate Guidance Published United States (federal) · Oct 5, 2026

EPIC analysis links pixel‑tracking litigation under ECPA and CIPA to upcoming Supreme Court VPPA case

EPIC outlines how recent court decisions using the Electronic Communications Privacy Act (ECPA) and California Invasion of Privacy Act (CIPA) address non‑consensual pixel tracking and its privacy harms. The analysis cites multiple…

HHS OCR · HIPAA Privacy, Security and Breach Notification Rules

Low Lawsuit filed Filed United States (federal) · Oct 2, 2026

EPIC files amicus brief challenging Spirit Airlines' bankruptcy sale of employee data to Google

EPIC and Professor Seema Patel submitted an amicus brief in a bankruptcy case to contest Spirit Airlines' proposed $10 million sale of employee data to Google for AI training. The brief argues the sale lacks adequate privacy protections…

Low Proposed bill Introduced United States (federal) · Oct 2, 2026

Rep. Darrell Issa introduces the American Copyright Protection Act (H.R. 10364) targeting VPNs for site‑blocking

Rep. Darrell Issa (R‑CA) has introduced H.R. 10364, the American Copyright Protection Act, which would allow copyright owners to seek court orders blocking U.S. users from foreign piracy sites. The bill expands blocking obligations to…

American Copyright Protection Act (ACPA)

Moderate Settlement Settled United States (federal) · Oct 2, 2026

Meta’s Muse AI Agent raises privacy, security, and child safety concerns amid past FTC consent decree

Meta launched the Muse personal AI agent in September 2026, which collects extensive personal data and can act without clear user permission. EPIC reports multiple incidents where Muse accessed messages, shared home addresses, and…

Federal Trade Commission

Low Court ruling Decided New York · Oct 2, 2026

Federal judge rejects motion to dismiss social media surveillance lawsuit against Trump administration

A U.S. District Court in New York denied the government’s motion to dismiss a lawsuit filed by three labor unions alleging viewpoint‑based social media surveillance of noncitizens. The case, filed in October 2025, targets the Departments…

Administrative Procedure Act

Moderate New law Signed California · Oct 2, 2026

California Governor signs three AI employment laws

Governor Gavin Newsom signed SB 947, SB 951, and AB 1883 to regulate AI in employment. The laws restrict automated decision systems, require technology-related layoff notices, and limit workplace surveillance tools. Each law includes civil…

California Labor Commissioner · SB 947 (No Robo Bosses Act)

High Guidance In effect United States (federal) · Oct 2, 2026 · effective Nov 2, 2026

DOI establishes new matching program under Privacy Act of 1974

The U.S. Department of the Interior announced a new matching program that will compare records from 20 DOI programs with the Treasury's Do Not Pay Working System. The program aims to verify prepayment or pre‑award eligibility, prevent…

U.S. Department of the Interior · Privacy Act of 1974

Low Enforcement Announced California · Oct 1, 2026

EFF and ACLU demand records from Marin County Sheriff over illegal ALPR data sharing

The Electronic Frontier Foundation and the ACLU of Northern California sent a demand letter to the Marin County Sheriff’s Office requesting records under the California Public Records Act. The letter alleges violations of California law SB…

SB 34

Low Court ruling In effect United States (federal) · Oct 1, 2026

Court order forces Google to allow third‑party app stores on Play Store

A court order stemming from Epic Games v. Google requires Google to permit rival Android app stores to be listed in the Play Store and to let developers direct users to alternative payment and distribution options. The change expands user…

Low Court ruling In effect Utah · Oct 1, 2026

Federal judge blocks Utah's anti-VPN age‑verification law (SB 73) with preliminary injunction

A U.S. federal judge issued a preliminary injunction halting enforcement of Utah's SB 73, which required adult websites to block VPN users or determine their physical location for age verification. The court found the statute imposes a…

Utah SB 73

Low Guidance Announced United States (federal) · Oct 1, 2026

EFF launches Opt Out October campaign urging users to leave tech giants for privacy

The Electronic Frontier Foundation (EFF) released its annual Opt Out October campaign, encouraging individuals to regain control of their data by opting out of major platforms, apps, and operating systems. The initiative provides…

Moderate Proposed regulation Proposed United States (federal) · Oct 1, 2026

Federal Register proposes limiting automated scraping, requiring API use and CAPTCHAs

The notice warns that aggressive automated scraping of FederalRegister.gov and eCFR.gov will be restricted to access via developer APIs. Human users must complete a CAPTCHA to request access, and occasional re‑verification is expected as a…

National Archives and Records Administration

Moderate Guidance Published United States (federal) · Oct 1, 2026

Federal Register limits automated access; CAPTCHA required for flagged requests

The Federal Register website warns that programmatic requests are flagged as potentially automated and must complete a CAPTCHA to proceed. Users are directed to the FederalRegister.gov and eCFR.gov API documentation for legitimate…

Moderate Proposed regulation Announced United States (federal) · Oct 1, 2026

HUD announces intent to establish eVMS system of records under the Privacy Act

The Department of Housing and Urban Development (HUD) issued a Federal Register notice announcing its intent to create a new Privacy Act system of records called the Enterprise Voucher Management System (eVMS). The system will manage…

Department of Housing and Urban Development (HUD) · Privacy Act of 1974

Low Court ruling Decided California · Sep 30, 2026

California Court of Appeals affirms dismissal of CEO's anti‑SLAPP suit against journalist

The California Court of Appeals upheld a lower court’s dismissal of a lawsuit filed by former Premise Data CEO Maury Blackman against journalist Jack Poulson, Substack, and AWS. The court ruled the suit was meritless under California’s…

California anti‑SLAPP statute

Low Guidance Announced United States (federal) · Sep 30, 2026 · effective Sep 9, 2026

FBI announces new Cyber Strategy emphasizing public‑private collaboration and rapid threat‑intel sharing

On September 9, 2026 the FBI published its Cyber Strategy, outlining four pillars that include investigating adversaries, supporting victims, and expanding partnerships. The strategy stresses the importance of private‑sector telemetry…

Federal Bureau of Investigation

Moderate Proposed bill Introduced United States (federal) · Sep 30, 2026

Senator Markey Introduces Facial Recognition and Biometric Technology Moratorium Act of 2026

Senators Markey and Merkley, together with Representatives Jaypal, Pressley, and Tlaib, introduced legislation to halt federal use of biometric surveillance, including facial recognition. The Facial Recognition and Biometric Technology…

Low Guidance Published United States (federal) · Sep 30, 2026

EFF discusses privacy implications of Apple Siri AI features in iOS 27

The EFF newsletter examines how Apple’s new Siri AI in iOS 27 handles user data. It contrasts on‑device processing with server‑side processing and explains the privacy risks. The piece offers guidance on limiting the data Siri can access.

Low Enforcement Published New York · Sep 30, 2026

NY Attorney General releases body‑worn camera footage of minor’s death investigation

New York Attorney General Letitia James released body‑worn camera footage from an investigation into the June 27, 2026 death of a minor in Dutchess County. The footage shows officers from NY State Police, Dutchess County Sheriff’s Office…

New York Attorney General's Office · New York State Executive Law Section 70-b

Moderate Guidance Announced United States (federal) · Sep 30, 2026

Commerce Department seeks input on digitizing and modernizing the National Technical Reports Library

The National Technical Information Service (NTIS) issued a Request for Information to gather stakeholder feedback on fully digitizing the National Technical Reports Library (NTRL). The agency aims to make the technical reports more…

National Technical Information Service

Moderate Guidance Published United States (federal) · Sep 30, 2026

NHTSA seeks OMB approval to renew and modify information collection for qualitative feedback on service delivery

The National Highway Traffic Safety Administration (NHTSA) announced its intention to request Office of Management and Budget (OMB) approval to renew a currently approved information collection, adding annual tracking studies for…

National Highway Traffic Safety Administration (NHTSA) · Paperwork Reduction Act of 1995

Moderate Guidance Published United States (federal) · Sep 30, 2026

HUD modifies system of records notice for Inventory Management System and Housing Information Portal

The Department of Housing and Urban Development (HUD) Office of Public and Indian Housing is updating its system of records notice for the Inventory Management System and Housing Information Portal. The amendment adds three new routine…

Department of Housing and Urban Development · Privacy Act of 1974

Low Guidance Announced California · Sep 29, 2026

San Francisco announces new ALPR policy with limited safeguards, no warrant requirement, 30‑day data transfer deadline

San Francisco released a policy that retains Automated License Plate Reader (ALPR) surveillance but provides only limited safeguards. The policy does not require a warrant to search stored ALPR data and sets a 30‑day deadline to move data…

San Francisco Police Department

Low Guidance Announced United States (federal) · Sep 29, 2026

EFF launches 'Privacy’s Defenders' podcast on digital surveillance history

The Electronic Frontier Foundation released a new podcast episode featuring Cindy Cohn and John Gilmore discussing mass surveillance, early internet activism, and ongoing privacy challenges. The episode highlights historical battles…

Moderate Guidance Published United States (federal) · Sep 29, 2026

Federal Register restricts automated scraping; requires API use and CAPTCHA verification

The Federal Register warns that programmatic access to FederalRegister.gov and eCFR.gov is limited to its developer APIs due to aggressive automated scraping. Users must use the APIs or complete a CAPTCHA to verify they are human. The…

Privacy Act of 1974

Moderate Guidance Proposed United States (federal) · Sep 29, 2026

Agency seeks comment on proposed information collection for protection of human subjects

The agency announced a proposed collection of information related to the protection of human subjects and Institutional Review Boards and is requesting public comment. The notice also notes that programmatic access to FederalRegister.gov…

Food and Drug Administration · Paperwork Reduction Act of 1995

Moderate Guidance Announced United States (federal) · Sep 29, 2026

FCC and USAC launch new computer matching program to verify Lifeline eligibility

The Federal Communications Commission and the Universal Service Administrative Company will conduct a computer matching program with the Connecticut Department of Social Services. The program is intended to verify the eligibility of…

Federal Communications Commission · Privacy Act of 1974