Moderate
Guidance
Published
United States (federal) · Oct 5, 2026
EPIC analysis links pixel‑tracking litigation under ECPA and CIPA to upcoming Supreme Court VPPA case
EPIC outlines how recent court decisions using the Electronic Communications Privacy Act (ECPA) and California Invasion of Privacy Act (CIPA) address non‑consensual pixel tracking and its privacy harms. The analysis cites multiple…
HHS OCR · HIPAA Privacy, Security and Breach Notification Rules
Moderate
Guidance
Announced
France · Sep 28, 2026
CNIL to host AIR 2026 event on political communication ethics and election manipulation on 16 Nov 2026
The French data‑protection authority CNIL will hold a public debate on 16 November 2026 about the ethical challenges of digital political communication and foreign interference. The programme will examine voter consent, data‑minimisation…
CNIL · RGPD
Moderate
Guidance
Published
United States (federal) · Sep 24, 2026
SBA seeks comments on modified matching program under Privacy Act
The U.S. Small Business Administration issued a Federal Register notice requesting public comment on a Privacy Act notice for a revised computer‑matching program. The program will compare SBA benefits records with the Treasury Department’s…
U.S. Small Business Administration · Privacy Act of 1974
Moderate
Guidance
Published
United States (federal) · Sep 16, 2026
EPIC report: Data brokers sell personal data to Disney, GM, insurers and banks
EPIC highlights that data brokers collect and sell personal information to major companies such as Disney, General Motors, insurers and banks. The article notes that brokers infer additional characteristics like finance, health…
Moderate
Guidance
Published
KE · Sep 16, 2026
Kenya publishes new guidance on cross‑border data transfers
On 8 September 2026 Kenya’s Office of the Data Protection Commissioner released detailed Guidance Notes on cross‑border data transfers. The guidance clarifies Kenya’s transfer framework, adds operational detail, and highlights differences…
Office of the Data Protection Commissioner (ODPC) · General Data Protection Regulation
Moderate
Guidance
In effect
France · Sep 10, 2026 · effective Sep 1, 2026
CNIL guidance on data‑protection obligations under the electronic invoicing reform effective 1 Sept 2026
The CNIL explains the data‑protection implications of the French electronic invoicing reform that entered into force on 1 Sept 2026. It details which personal data may be processed, the roles of issuers, receivers and certified platforms…
CNIL · réforme relative à la facturation électronique
Moderate
Guidance
Published
United States (federal) · Aug 31, 2026
EFF guide on doxxing incident response and digital footprint protection
The Electronic Frontier Foundation published a guide outlining steps for individuals and groups to respond to doxxing attacks. It covers incident logging, team role assignment, monitoring hate forums, setting up alerts, hardening accounts…
California Delete Act
Moderate
Interpretation
Published
Belgium · Jul 14, 2026 · effective May 28, 2026
EDPB orders Belgian DPA to assess NOYB cookie banner complaint on merits
The European Data Protection Board issued a binding decision on 28 May 2026 requiring the Belgian DPA to evaluate a NOYB complaint about VRT's cookie banners on the merits rather than dismiss it on procedural grounds. The decision found no…
European Data Protection Board · General Data Protection Regulation
Moderate
Guidance
Announced
European Union · Jul 24, 2025
Report flags 'Pay or Okay' consent‑bypass systems as violating GDPR free‑consent requirement
The noyb report documents the spread of “Pay or Okay” systems across Europe, where users must pay to refuse tracking, resulting in near‑universal consent rates that breach the GDPR’s freely‑given consent standard. It cites a July 2023 CJEU…
European Data Protection Board (EDPB) · General Data Protection Regulation
Moderate
Interpretation
In effect
European Union · Dec 2, 2024 · effective Dec 2, 2024
noyb qualified as EU 'Qualified Entity' to bring collective GDPR redress actions
noyb has been approved as a Qualified Entity under Directive (EU) 2020/1828, allowing it to bring collective injunctions and redress actions across the EU. Approvals were issued by Austria's Bundeskartellamt on 2 December 2024 and…
Bundeskartellamt; Irish Ministry for Justice · General Data Protection Regulation
Moderate
Interpretation
Published
European Union · Apr 25, 2024
CJEU Advocate General says Facebook must limit personal data for ads under GDPR data‑minimisation
The Advocate General’s opinion interprets Article 5(1)(c) GDPR to require Meta to restrict the use of personal data for targeted advertising by time, type and source. It also addresses purpose‑limitation, stating that publicly disclosed…
EDPB · General Data Protection Regulation
Moderate
Interpretation
Published
European Union · Apr 17, 2024
EDPB opinion bars Meta from using 'Pay or Okay' consent model
The European Data Protection Board issued an opinion stating that Meta may not rely on a pay‑or‑consent scheme to process personal data for behavioural advertising. The decision requires Meta to offer a genuine opt‑in choice rather than a…
European Data Protection Board · General Data Protection Regulation
Moderate
Guidance
Announced
European Union · Mar 19, 2024
EDPB to issue binding opinion on Meta's 'Pay or Okay' consent model
The European Data Protection Board (EDPB) plans to issue a binding opinion on the legality of Meta's "Pay or Okay" system that charges users to refuse tracking. The opinion could legitimize the practice across the EU, threatening the GDPR…
European Data Protection Board · General Data Protection Regulation
Moderate
Guidance
Announced
European Union · Feb 16, 2024
28 NGOs urge EU Data Protection Board to reject Meta's 'Pay or Okay' consent model
A coalition of 28 NGOs, including Wikimedia Europe, Bits of Freedom and the Norwegian Consumer Council, sent a joint letter to the European Data Protection Board requesting a binding opinion on Meta's "Pay or Okay" system, which forces…
European Data Protection Board (EDPB) · General Data Protection Regulation
Moderate
Interpretation
Announced
European Union · Oct 3, 2023
Meta proposes 'Pay for your Rights' model charging EU users €160/year for non‑consent
Meta plans to charge EU users €160 per year if they do not consent to the processing of their personal data on Facebook and Instagram. The proposal references an obiter dictum from the CJEU case C‑252/21 that an alternative to ads may be…
Irish Data Protection Commission · General Data Protection Regulation
Moderate
Guidance
Announced
European Union · Apr 4, 2023
noyb launches free tool for broad Facebook opt‑out under GDPR
The privacy NGO noyb released an online tool that lets users submit a broad objection to Meta’s processing of personal data for targeted advertising, which Meta bases on “legitimate interest”. The tool simplifies the GDPR right to object…
EDPB · General Data Protection Regulation
Moderate
Guidance
Published
European Union · Jan 24, 2023
EDPB releases draft report on minimum requirements for cookie consent banners
The European Data Protection Board's task force issued a draft report outlining unlawful cookie banner practices under EU law. It sets a minimum threshold for consent banners, including the need for a visible reject option and prohibition…
European Data Protection Board (EDPB) · General Data Protection Regulation
Moderate
Guidance
Published
Ireland · Dec 4, 2021
Irish DPC tried to embed Facebook consent bypass into EDPB Guidelines, but final 2019 guidelines omitted it
A letter shows the Irish DPC held ten meetings with Facebook and agreed on a GDPR bypass by moving consent into terms and conditions. The DPC then drafted EDPB guideline language to allow this approach, but other DPAs criticised it…
Irish Data Protection Commission (DPC) · General Data Protection Regulation
Moderate
Interpretation
Published
European Union · Nov 12, 2018
Max Schrems discusses GDPR on CBS 60 Minutes (Nov 11, 2018)
On 11 November 2018, noyb director Max Schrems appeared on CBS's 60 Minutes to explain the benefits and challenges of the GDPR and how the organization enforces it. The interview highlighted the law's role in allowing Europeans to reclaim…
EDPB · General Data Protection Regulation
