Moderate
Guidance
Published
United States (federal) · Sep 28, 2026
Federal Register restricts automated scraping, requires CAPTCHA and API use
The Federal Register warns that aggressive automated scraping of its sites is limited to access via developer APIs. Human users must complete a CAPTCHA to continue, and may be asked to do so repeatedly as a security measure.
Department of Defense · Privacy Act of 1974
Moderate
Guidance
Published
United States (federal) · Sep 25, 2026
DoD updates SORN for DON Child and Youth Program to align with cybersecurity policies
The Department of Defense is modifying and reissuing the system of records titled "DON Child and Youth Program" (NM01754-3) under the Privacy Act of 1974. The updates incorporate DoD standard routine uses A through J, expand the collection…
Department of Defense · Privacy Act of 1974
Moderate
Guidance
Published
United States (federal) · Sep 25, 2026
CMS re-establishes matching program with Treasury's Do Not Pay Working System under Privacy Act
The Centers for Medicare & Medicaid Services announced the re-establishment of a data matching program with the Do Not Pay Working System, administered by the Treasury's Bureau of Fiscal Service. The notice cites subsection (e)(12) of the…
U.S. Department of Health and Human Services, Centers for Medicare & Medicaid Services · Privacy Act of 1974
Moderate
Guidance
Announced
United States (federal) · Sep 24, 2026
DraftKings uses AI to target losing gamblers with online behavioral advertising
DraftKings employs AI and machine learning on customers' betting records to identify likely losing gamblers and serve them targeted promotions. The practice exemplifies online behavioral advertising that leverages first‑party data to…
Moderate
Proposed bill
Proposed
United States (federal) · Sep 24, 2026
State bills propose exemption for biometric data converted to irreversible mathematical representations
Several U.S. state privacy bills are introducing a new exception that excludes biometric data once it is transformed into an irreversible mathematical representation that cannot be used to recreate the original measurement. The proposed…
Illinois Biometric Information Privacy Act
Moderate
Proposed regulation
Proposed
France · Sep 24, 2026
CNIL examines draft decree creating SI-Mandoline personal data system for protection of adults
The CNIL plenary session on 24 September 2026 will examine a draft decree establishing the personal data processing system "Système d’information de la protection juridique des majeurs" (SI-Mandoline). It will also consider a draft decree…
Commission nationale de l'informatique et des libertés (CNIL) · code de commerce
Moderate
Proposed regulation
Announced
United States (federal) · Sep 24, 2026
FTC seeks public comment on updating impersonation rule for platforms
The Federal Trade Commission announced it is seeking public comment on whether to update its rule on impersonation of government and businesses. The focus is on platforms' role in promoting impersonation scams. The comment period is part…
Federal Trade Commission
Moderate
Guidance
Published
United States (federal) · Sep 24, 2026
SBA seeks comments on modified matching program under Privacy Act
The U.S. Small Business Administration issued a Federal Register notice requesting public comment on a Privacy Act notice for a revised computer‑matching program. The program will compare SBA benefits records with the Treasury Department’s…
U.S. Small Business Administration · Privacy Act of 1974
Moderate
Court ruling
Pending
United States (federal) · Sep 23, 2026
Supreme Court hears digital‑privacy case involving Paramount and targeted advertising
The Electronic Privacy Information Center argued before the Supreme Court that Paramount and other online‑video companies are not obligated to use targeted advertising systems and can adopt privacy‑protective techniques. The case could set…
Moderate
New law
Signed
California · Sep 23, 2026
California SB 1119 signed into law regulating AI chatbots for minors
The Future of Privacy Forum report notes that California’s SB 1119 was recently signed into law by Governor Newsom. The law targets chatbot interactions with minors, requiring disclosures, crisis‑response protocols, age assurance, parental…
SB 1119
Moderate
Guidance
Published
European Union · Sep 23, 2026
EDPB adopts guidelines on GDPR fines and DSA interaction (17 Sep 2026)
On 17 September 2026 the European Data Protection Board adopted guidelines on the use of administrative fines by data protection authorities and finalised guidance on the interaction between the Digital Services Act (DSA) and the GDPR. The…
European Data Protection Board (EDPB) · Digital Services Act
Moderate
Guidance
Announced
United States (federal) · Sep 22, 2026
WBUR reports driver’s license data appearing on dark web, raising AI‑enabled fraud risks
WBUR discussed a breach where images of driver’s licenses have been posted on the dark web. The episode highlighted risks of new account fraud, especially when combined with AI tools that can synthesize voice, images, or video. It also…
Moderate
Final regulation
In effect
United States (federal) · Sep 22, 2026
FCC adopts final rule clarifying TCPA “Revoke All” requirements
On September 9, 2026, the Federal Communications Commission issued a final rule amending the delayed “Revoke All” rule under the Telephone Consumer Protection Act. The rule will become effective 30 days after its publication.
Federal Communications Commission · Telephone Consumer Protection Act
Moderate
Fine
Decided
Spain · Sep 22, 2026 · effective Feb 1, 2023 · deadline Feb 1, 2024
Spanish DPA fines Securitas Direct €100,000 for charging phone line for data subject rights
The Spanish Data Protection Agency (AEPD) issued a final decision on 1 February 2023 finding Securitas Direct in breach of GDPR Article 12(2) by directing data subjects to a chargeable 902 telephone number to exercise their rights. The…
Spanish Data Protection Agency (AEPD) · General Data Protection Regulation
Moderate
Court ruling
Pending
United States (federal) · Sep 21, 2026
Supreme Court to decide VPPA consumer definition in Salazar v. Paramount Global
The Supreme Court will hear Salazar v. Paramount Global in the October 2026 term to resolve a circuit split on the definition of “consumer” under the Video Privacy Protection Act. The case arises from a class action alleging Paramount…
Video Privacy Protection Act
Moderate
Proposed regulation
Proposed
European Union · Sep 21, 2026
EU Commission proposes KIDS Act to impose age‑based restrictions and safety‑by‑design for children online
On September 17, 2026 the European Commission published a proposal for a new EU KIDS Act that would ban users under 15 from creating accounts on certain social networking and video‑sharing services, with limited exceptions. The draft…
European Commission · Digital Services Act
Moderate
Proposed regulation
Announced
France · Sep 17, 2026
CNIL plenary agenda includes draft decrees on prison camera use, Apple ATT, and data collection in real‑estate rentals
The CNIL plenary session of 17 September 2026 will discuss a draft decree on the use of on‑board cameras by prison surveillance staff, a draft decree amending the 2019 decree that implements the French data protection law, and a…
Commission nationale de l'informatique et des libertés (CNIL) · décret n° 2019-536 du 29 mai 2019
Moderate
Guidance
Published
France · Sep 17, 2026
CNIL outlines its status, organization and sanction powers
The CNIL, created by the 1978 Loi Informatique et Libertés, is an independent administrative authority composed of a college of 18 members. Its restricted board can impose fines up to €20 million or 4 % of global annual turnover under the…
CNIL · loi Informatique et Libertés
Moderate
Guidance
Announced
New York · Sep 17, 2026 · effective Jan 1, 2027
NY Attorney General urges workers to file whistleblower complaints on unsafe AI development
New York Attorney General Letitia James issued an alert encouraging employees with knowledge of unsafe or illegal AI development to submit confidential whistleblower complaints. The alert references the Responsible AI Safety and Education…
New York Attorney General's Office · New York SHIELD Act
Moderate
Guidance
Published
United States (federal) · Sep 16, 2026
EPIC report: Data brokers sell personal data to Disney, GM, insurers and banks
EPIC highlights that data brokers collect and sell personal information to major companies such as Disney, General Motors, insurers and banks. The article notes that brokers infer additional characteristics like finance, health…
