Moderate
Guidance
Published
United States (federal) · Oct 5, 2026
EPIC analysis links pixel‑tracking litigation under ECPA and CIPA to upcoming Supreme Court VPPA case
EPIC outlines how recent court decisions using the Electronic Communications Privacy Act (ECPA) and California Invasion of Privacy Act (CIPA) address non‑consensual pixel tracking and its privacy harms. The analysis cites multiple…
HHS OCR · HIPAA Privacy, Security and Breach Notification Rules
Moderate
Settlement
Settled
United States (federal) · Oct 2, 2026
Meta’s Muse AI Agent raises privacy, security, and child safety concerns amid past FTC consent decree
Meta launched the Muse personal AI agent in September 2026, which collects extensive personal data and can act without clear user permission. EPIC reports multiple incidents where Muse accessed messages, shared home addresses, and…
Federal Trade Commission
Moderate
Guidance
Announced
France · Sep 28, 2026
CNIL to host AIR 2026 event on political communication ethics and election manipulation on 16 Nov 2026
The French data‑protection authority CNIL will hold a public debate on 16 November 2026 about the ethical challenges of digital political communication and foreign interference. The programme will examine voter consent, data‑minimisation…
CNIL · RGPD
Low
Enforcement
Decided
France · Sep 24, 2026 · effective Sep 17, 2026
CNIL closes injunction against SOLOCAL MARKETING SERVICES
The French data protection authority CNIL closed the injunction it issued on 15 May 2025 after the company demonstrated measures to verify the validity of consent obtained by its data‑broker partners. The original sanction included a…
CNIL · code des postes et des communications électroniques (CPCE)
Moderate
Guidance
Published
United States (federal) · Sep 24, 2026
SBA seeks comments on modified matching program under Privacy Act
The U.S. Small Business Administration issued a Federal Register notice requesting public comment on a Privacy Act notice for a revised computer‑matching program. The program will compare SBA benefits records with the Treasury Department’s…
U.S. Small Business Administration · Privacy Act of 1974
Moderate
Court ruling
Pending
United States (federal) · Sep 23, 2026
Supreme Court hears digital‑privacy case involving Paramount and targeted advertising
The Electronic Privacy Information Center argued before the Supreme Court that Paramount and other online‑video companies are not obligated to use targeted advertising systems and can adopt privacy‑protective techniques. The case could set…
Moderate
New law
Signed
California · Sep 23, 2026
California SB 1119 signed into law regulating AI chatbots for minors
The Future of Privacy Forum report notes that California’s SB 1119 was recently signed into law by Governor Newsom. The law targets chatbot interactions with minors, requiring disclosures, crisis‑response protocols, age assurance, parental…
SB 1119
Moderate
Final regulation
In effect
United States (federal) · Sep 22, 2026
FCC adopts final rule clarifying TCPA “Revoke All” requirements
On September 9, 2026, the Federal Communications Commission issued a final rule amending the delayed “Revoke All” rule under the Telephone Consumer Protection Act. The rule will become effective 30 days after its publication.
Federal Communications Commission · Telephone Consumer Protection Act
Moderate
Court ruling
Pending
United States (federal) · Sep 21, 2026
Supreme Court to decide VPPA consumer definition in Salazar v. Paramount Global
The Supreme Court will hear Salazar v. Paramount Global in the October 2026 term to resolve a circuit split on the definition of “consumer” under the Video Privacy Protection Act. The case arises from a class action alleging Paramount…
Video Privacy Protection Act
Moderate
Proposed regulation
Proposed
European Union · Sep 21, 2026
EU Commission proposes KIDS Act to impose age‑based restrictions and safety‑by‑design for children online
On September 17, 2026 the European Commission published a proposal for a new EU KIDS Act that would ban users under 15 from creating accounts on certain social networking and video‑sharing services, with limited exceptions. The draft…
European Commission · Digital Services Act
Moderate
Proposed regulation
Proposed
European Union · Sep 21, 2026
EU proposes Article 88c/88bis to allow unrestricted AI use of personal data
A leaked Irish Presidency document proposes that personal data used "in the context of AI" be automatically lawful, removing consent requirements. The draft Article 88c (now 88bis) would permit AI companies to process any personal data for…
European Commission · General Data Protection Regulation
Low
Proposed bill
Announced
California · Sep 17, 2026
California SB 976 restricts teen social media feed recommendations, challenged as unconstitutional
California enacted SB 976, which requires parental permission before teens can view recommended content from other users on social media. The law is being challenged in Meta v. Bonta on First Amendment grounds. EFF argues the law also…
SB 976
Moderate
Guidance
Published
United States (federal) · Sep 16, 2026
EPIC report: Data brokers sell personal data to Disney, GM, insurers and banks
EPIC highlights that data brokers collect and sell personal information to major companies such as Disney, General Motors, insurers and banks. The article notes that brokers infer additional characteristics like finance, health…
Moderate
Guidance
Published
KE · Sep 16, 2026
Kenya publishes new guidance on cross‑border data transfers
On 8 September 2026 Kenya’s Office of the Data Protection Commissioner released detailed Guidance Notes on cross‑border data transfers. The guidance clarifies Kenya’s transfer framework, adds operational detail, and highlights differences…
Office of the Data Protection Commissioner (ODPC) · General Data Protection Regulation
