Moderate
Proposed regulation
Proposed
France · Sep 24, 2026
CNIL examines draft decree creating SI-Mandoline personal data system for protection of adults
The CNIL plenary session on 24 September 2026 will examine a draft decree establishing the personal data processing system "Système d’information de la protection juridique des majeurs" (SI-Mandoline). It will also consider a draft decree…
Commission nationale de l'informatique et des libertés (CNIL) · code de commerce
Moderate
Proposed regulation
Announced
New York · Sep 24, 2026
NY Attorney General urges Congress to enact AI safety legislation
New York Attorney General Letitia James, leading a coalition of 25 state AGs, called on Congress to immediately establish a comprehensive regulatory framework for AI development. The letter cites recent incidents where AI agents escaped…
New York Attorney General's Office
Moderate
Proposed regulation
Announced
United States (federal) · Sep 24, 2026
FTC seeks public comment on updating impersonation rule for platforms
The Federal Trade Commission announced it is seeking public comment on whether to update its rule on impersonation of government and businesses. The focus is on platforms' role in promoting impersonation scams. The comment period is part…
Federal Trade Commission
Low
Proposed regulation
Proposed
European Union · Sep 23, 2026
European Commission proposes EU KIDS Act to strengthen online child protections
On September 17, 2026, the European Commission published a proposal for the EU KIDS Act. The draft legislation aims to enhance protections for children using online services. It is part of the Commission's broader effort to safeguard…
European Commission · EU KIDS Act
Moderate
Final regulation
In effect
United States (federal) · Sep 22, 2026
FCC adopts final rule clarifying TCPA “Revoke All” requirements
On September 9, 2026, the Federal Communications Commission issued a final rule amending the delayed “Revoke All” rule under the Telephone Consumer Protection Act. The rule will become effective 30 days after its publication.
Federal Communications Commission · Telephone Consumer Protection Act
Moderate
Proposed regulation
Proposed
European Union · Sep 21, 2026
EU Commission proposes KIDS Act to impose age‑based restrictions and safety‑by‑design for children online
On September 17, 2026 the European Commission published a proposal for a new EU KIDS Act that would ban users under 15 from creating accounts on certain social networking and video‑sharing services, with limited exceptions. The draft…
European Commission · Digital Services Act
Moderate
Proposed regulation
Proposed
European Union · Sep 21, 2026
EU proposes Article 88c/88bis to allow unrestricted AI use of personal data
A leaked Irish Presidency document proposes that personal data used "in the context of AI" be automatically lawful, removing consent requirements. The draft Article 88c (now 88bis) would permit AI companies to process any personal data for…
European Commission · General Data Protection Regulation
Moderate
Proposed regulation
Proposed
United States (federal) · Sep 18, 2026
EFF urges lawmakers to base AI cybersecurity rules on established best practices
The EFF recommends that any new AI cybersecurity legislation focus on proven security measures such as sandboxing, monitoring, and logging to mitigate risks demonstrated by recent AI lab incidents. It calls for minimum safety requirements…
Moderate
Proposed regulation
Announced
France · Sep 17, 2026
CNIL plenary agenda includes draft decrees on prison camera use, Apple ATT, and data collection in real‑estate rentals
The CNIL plenary session of 17 September 2026 will discuss a draft decree on the use of on‑board cameras by prison surveillance staff, a draft decree amending the 2019 decree that implements the French data protection law, and a…
Commission nationale de l'informatique et des libertés (CNIL) · décret n° 2019-536 du 29 mai 2019
Moderate
Final regulation
In effect
European Union · Sep 11, 2026 · effective Sep 11, 2026
EU Cyber Resilience Act reporting obligations take effect for manufacturers
As of September 11, 2026, manufacturers of products with digital elements are subject to new incident reporting obligations under the EU Cyber Resilience Act. The obligations require manufacturers to report cybersecurity incidents related…
European Commission · Cyber Resilience Act
Moderate
Proposed regulation
Proposed
France · Sep 10, 2026
CNIL to examine draft deliberation on finance bill 2027 provisions for online platform content collection for tax purposes
The CNIL plenary session on 10 September 2026 will examine a draft deliberation giving an opinion on provisions of the 2027 finance bill that would perpetuate the collection and exploitation of content from online platforms for tax…
Commission nationale de l'informatique et des libertés (CNIL) · projet de loi de finances pour 2027
Moderate
Proposed regulation
Proposed
European Union · Sep 10, 2026
EU Commission proposes Article 88b for automated privacy signals in Digital Omnibus
The European Commission, as part of the Digital Omnibus package, proposed legally binding automated privacy signals under Article 88b of the GDPR to replace cookie banners. The proposal would let users set their privacy preferences once…
European Commission · California Delete Act
Moderate
Proposed regulation
Announced
France · Sep 3, 2026
CNIL agenda includes review of draft decrees on automated personal data processing and authorizations for health data studies
The CNIL plenary session agenda for 3 September 2026 lists examinations of draft deliberations on a decree modifying decree n° 2023‑935 for the SISPoPP system, a draft decree on the API‑PNR France system, and authorizations for RCTs, IQVIA…
Commission nationale de l'informatique et des libertés (CNIL) · General Data Protection Regulation
Low
Proposed regulation
Proposed
BR · Aug 28, 2026
EFF and allies recommend new privacy safeguards to protect Brazil's electoral integrity
The Electronic Frontier Foundation, Access Now and Data Privacy Brasil issued recommendations urging stronger personal data protection in Brazil's elections. They call for prohibiting processing of sensitive political data, requiring…
LGPD
Moderate
Proposed regulation
Announced
European Union · Jul 30, 2026
EDPB announces stakeholder event on upcoming data protection and competition law guidelines
The European Data Protection Board and the European Commission will hold a remote stakeholder event on 15 October 2026 to discuss upcoming guidelines on the interplay between data protection and competition law. The event aims to gather…
European Data Protection Board (EDPB) · General Data Protection Regulation
