High
Proposed regulation
Proposed
United States (federal) · Oct 13, 2026 · effective Oct 13, 2026
FHFA proposes to rescind SORN FHFA-12 and consolidate records under SORN FHFA-11
The Federal Housing Finance Agency (FHFA) announced a proposal to rescind the existing System of Records Notice (SORN) FHFA-12, which covers parking program records. The agency will consolidate those records with its transit subsidy…
Federal Housing Finance Agency · Privacy Act of 1974
Low
Proposed regulation
Announced
United States (federal) · Oct 9, 2026
CISA submits Final CIRCIA Rule to OIRA for interagency review
On October 1, 2026, CISA submitted a draft of the Final Rule implementing the Cyber Incident Reporting for Critical Infrastructure Act of 2022 (CIRCIA) to OIRA. CIRCIA will require covered critical‑infrastructure entities to report…
Cybersecurity and Infrastructure Security Agency (CISA) · Cyber Incident Reporting for Critical Infrastructure Act of 2022 (CIRCIA)
Moderate
Proposed regulation
Proposed
Vermont · Oct 8, 2026
Future of Privacy Forum submits comments on Vermont Age-Appropriate Design Code rulemaking
On October 2, 2026 the Future of Privacy Forum filed comments to the Vermont Attorney General’s rulemaking for the Age-Appropriate Design Code. The act, enacted in June 2025, sets duties for businesses serving minors and will become…
Vermont Office of the Attorney General · California Age-Appropriate Design Code Act
Moderate
Proposed regulation
Proposed
France · Oct 8, 2026
CNIL examines draft deliberation authorizing BIG DATA SANTE to process personal data for anonymized medical research (ONCOVAL)
During its plenary session on 8 October 2026, the CNIL will consider a draft deliberation that would permit BIG DATA SANTE (Octopize Mimethik Data) to carry out automated processing of personal data to create anonymised datasets for…
Commission nationale de l'informatique et des libertés (CNIL) · Law of 6 January 1978
High
Proposed regulation
Proposed
United States (federal) · Oct 7, 2026 · effective Nov 6, 2026
Treasury proposes new system of records for federal student aid data
The Department of the Treasury proposes to establish a new system of records titled “Department of the Treasury .033--Federal Student Aid Portfolio Research, Analysis, Oversight, Reporting, and Compliance Records.” The system would allow…
Department of the Treasury · Privacy Act of 1974
Moderate
Proposed regulation
Proposed
United States (federal) · Oct 7, 2026
DEA proposes to modify and republish its Aviation Division system of records notice
The Drug Enforcement Administration (DEA) announced a proposal to update the system of records notice for its Aviation Division, changing the categories of individuals covered, record categories, purpose, routine uses, and storage…
Justice Department · Privacy Act of 1974
Moderate
Proposed regulation
Proposed
United States (federal) · Oct 7, 2026
DOJ proposes exemption for Firearms Rights Restoration Electronic Records Database from Privacy Act provisions
The Office of the Pardon Attorney within the U.S. Department of Justice announced a notice of a new system of records called the Firearms Rights Restoration Electronic Records Database (FRRERD). The agency proposes to exempt this system…
U.S. Department of Justice · Privacy Act of 1974
Moderate
Proposed regulation
Announced
European Union · Oct 6, 2026
Commission registers European Citizens' Initiative for sovereign European AI domains
The European Commission has officially registered a European Citizens' Initiative that calls for the creation of sovereign European AI domains. The initiative seeks to shape future EU policy on artificial intelligence and digital…
European Commission
High
Proposed regulation
Proposed
United States (federal) · Oct 6, 2026 · effective Nov 16, 2026
NARA proposes revisions to System of Records NARA 44 for reasonable accommodation requests
The National Archives and Records Administration (NARA) proposes to revise its System of Records NARA 44, updating the system manager and location. The revision would expand the record type to include reasonable accommodation requests…
National Archives and Records Administration · Privacy Act of 1974
High
Final regulation
Announced
United States (federal) · Oct 6, 2026 · effective Nov 5, 2026
Treasury exempts new tip intake records from certain Privacy Act provisions
The Department of the Treasury issued a final rule exempting the system of records titled "Treasury .032--Federal Program Waste, Fraud, and Abuse Tip Intake and Referral Records" from specific provisions of the Privacy Act of 1974. The…
Department of the Treasury · Privacy Act of 1974
Low
Proposed regulation
Proposed
Vermont · Oct 5, 2026
EPIC comments on Vermont Attorney General's proposed Age-Appropriate Design Code rules
On October 2, EPIC submitted comments on two proposed rules announced by the Vermont Attorney General to implement the state's Age-Appropriate Design Code. The rules target addictive design practices for minors and outline methods for age…
Vermont Attorney General · California Age-Appropriate Design Code Act
Moderate
Proposed regulation
Proposed
European Union · Oct 2, 2026
Commission seeks feedback on proposed EU Kids Act
The European Commission is gathering feedback on the proposed EU Kids Act, which aims to improve online safety for children with measures such as a social‑media delay, safety‑by‑design rules, privacy‑preserving age assurance, and…
European Commission · EU Kids Act
Moderate
Proposed regulation
Announced
France · Oct 1, 2026
CNIL to examine draft decree on student violence questionnaire and automated vehicle sound monitoring
The CNIL plenary session on 1 October 2026 will examine a draft decree authorising personal data processing for a "Questionnaire violences sexistes et sexuelles" in schools. It will also review draft orders on sound radars and an automated…
Commission nationale de l'informatique et des libertés (CNIL) · règlement intérieur de la CNIL
Moderate
Proposed regulation
Proposed
European Union · Oct 1, 2026
EU Commission proposes KIDS Act to ban social‑media access for under‑13s and set minimum account age of 15
The European Commission has presented the EU KIDS Act, which would prohibit social‑media platforms from providing services to children under 13 and require a minimum age of 15 for users to open their own accounts. The proposal shifts the…
European Commission · EU KIDS Act
Moderate
Proposed regulation
Announced
United States (federal) · Oct 1, 2026
HUD announces intent to establish eVMS system of records under the Privacy Act
The Department of Housing and Urban Development (HUD) issued a Federal Register notice announcing its intent to create a new Privacy Act system of records called the Enterprise Voucher Management System (eVMS). The system will manage…
Department of Housing and Urban Development (HUD) · Privacy Act of 1974
Moderate
Proposed regulation
Proposed
United States (federal) · Oct 1, 2026
Federal Register proposes limiting automated scraping, requiring API use and CAPTCHAs
The notice warns that aggressive automated scraping of FederalRegister.gov and eCFR.gov will be restricted to access via developer APIs. Human users must complete a CAPTCHA to request access, and occasional re‑verification is expected as a…
National Archives and Records Administration
Low
Proposed regulation
Proposed
California · Sep 28, 2026
San Francisco Police Department proposes expanded drone surveillance policy, drawing criticism from EFF
The San Francisco Police Department (SFPD) has issued a new proposed policy that would allow broader use of drones for public safety and patrol. The policy has been criticized by the Electronic Frontier Foundation and other groups for…
San Francisco Police Commission · Proposition E
Moderate
Proposed regulation
Proposed
United States (federal) · Sep 28, 2026
EPIC and consumer groups urge FTC to ban surveillance pricing, calling disclosure insufficient
On September 25, EPIC and several consumer groups filed comments with the FTC urging it to go beyond disclosure in its Proposed Enforcement Policy Statement on personalized pricing. The commenters argue that surveillance pricing violates…
Federal Trade Commission · FTC Act Section 5
Moderate
Final regulation
Published
California · Sep 28, 2026
California Privacy Protection Agency adopts multiple regulations including Conflict of Interest Code Amendments and Data Broker Registration Fee
The CPPA has adopted several regulations, such as the Conflict of Interest Code Amendments Regulation (September 2026) and Data Broker Registration Fee Regulation (December 2025). These were adopted through the Administrative Procedures…
California Privacy Protection Agency · California Consumer Privacy Act (as amended by CPRA)
High
Final regulation
In effect
United States (federal) · Sep 28, 2026 · effective Oct 28, 2026
HHS modifies ORR Unaccompanied Children system of records, effective Oct 28, 2026
The Department of Health and Human Services is amending the Office of Refugee Resettlement's system of records for unaccompanied children. The change renames the system to "ORR Unaccompanied Alien Children Bureau (UACB) Administrative…
Department of Health and Human Services (HHS) · Privacy Act of 1974
