Moderate
Guidance
Published
United States (federal) · Sep 24, 2026
SBA seeks comments on modified matching program under Privacy Act
The U.S. Small Business Administration issued a Federal Register notice requesting public comment on a Privacy Act notice for a revised computer‑matching program. The program will compare SBA benefits records with the Treasury Department’s…
U.S. Small Business Administration · Privacy Act of 1974
Low
Lawsuit filed
Filed
United States (federal) · Sep 23, 2026
Paramount urges SCOTUS to reject video privacy claim
Paramount filed a brief urging the Supreme Court to reject a video privacy claim under the video privacy law. The Electronic Privacy Information Center and other privacy advocates filed an amicus brief supporting the plaintiff, arguing the…
Video Privacy Act
Low
Lawsuit filed
Pending
United States (federal) · Sep 23, 2026
Paramount asks SCOTUS to reject video privacy lawsuit
Paramount has filed a brief urging the U.S. Supreme Court to reject a video privacy claim. The Electronic Privacy Information Center and other privacy advocates filed a friend‑of‑the‑court brief supporting Salazar, arguing the video…
video privacy law
Low
Lawsuit filed
Filed
United States (federal) · Sep 23, 2026
EPIC asks U.S. District Judge to declare DHS actions unlawful
EPIC has filed a request with U.S. District Judge Paula Xinis seeking a declaration that actions taken by the Department of Homeland Security are unlawful. The hearing is scheduled for Friday following the filing.
Department of Homeland Security
Moderate
Court ruling
Pending
United States (federal) · Sep 23, 2026
Supreme Court hears digital‑privacy case involving Paramount and targeted advertising
The Electronic Privacy Information Center argued before the Supreme Court that Paramount and other online‑video companies are not obligated to use targeted advertising systems and can adopt privacy‑protective techniques. The case could set…
Low
Appeal
Appealed
Pennsylvania · Sep 23, 2026
EPIC files amicus brief urging Third Circuit to uphold Pennsylvania’s Internet Sharing Ban on voter data
EPIC submitted an amicus brief in the Third Circuit case Voter Reference Foundation v. Schmidt, asking the court to maintain Pennsylvania’s rule that bars posting voter registration lists online. The brief describes the rule, called the…
Internet Sharing Ban
Moderate
New law
Signed
California · Sep 23, 2026
California SB 1119 signed into law regulating AI chatbots for minors
The Future of Privacy Forum report notes that California’s SB 1119 was recently signed into law by Governor Newsom. The law targets chatbot interactions with minors, requiring disclosures, crisis‑response protocols, age assurance, parental…
SB 1119
Low
Proposed regulation
Proposed
European Union · Sep 23, 2026
European Commission proposes EU KIDS Act to strengthen online child protections
On September 17, 2026, the European Commission published a proposal for the EU KIDS Act. The draft legislation aims to enhance protections for children using online services. It is part of the Commission's broader effort to safeguard…
European Commission · EU KIDS Act
Moderate
Guidance
Published
European Union · Sep 23, 2026
EDPB adopts guidelines on GDPR fines and DSA interaction (17 Sep 2026)
On 17 September 2026 the European Data Protection Board adopted guidelines on the use of administrative fines by data protection authorities and finalised guidance on the interaction between the Digital Services Act (DSA) and the GDPR. The…
European Data Protection Board (EDPB) · Digital Services Act
High
Fine
Decided
Ireland · Sep 23, 2026 · effective Sep 21, 2026
Irish Data Protection Commission fines Google €403 million for GDPR violations over location data
The Irish Data Protection Commission issued its final decision on 21 September 2026, imposing administrative fines of €403 million on Google Ireland Limited. The DPC found infringements of GDPR principles relating to lawfulness, fairness…
Irish Data Protection Commission · General Data Protection Regulation
Moderate
Guidance
Announced
United States (federal) · Sep 22, 2026
WBUR reports driver’s license data appearing on dark web, raising AI‑enabled fraud risks
WBUR discussed a breach where images of driver’s licenses have been posted on the dark web. The episode highlighted risks of new account fraud, especially when combined with AI tools that can synthesize voice, images, or video. It also…
Low
Proposed bill
Proposed
New York · Sep 22, 2026
New York may ban price discrimination based on income, age, and race
A proposed measure in New York would prohibit businesses from changing prices based on a consumer's income, age, or race. The article highlights privacy concerns about the data consumers provide that could be used for such pricing…
Low
Interpretation
Published
EU-GB · Sep 22, 2026
London faces privacy pushback against smart glasses, EPIC warns
The article reports growing public concern in London over smart glasses that can record video. EPIC's AI and Human Rights director Calli Shroeder says solving privacy problems will be difficult and warns of fear of being left behind in the…
Low
Interpretation
Published
United States (federal) · Sep 22, 2026
EPIC and Consumer Federation issue pamphlet defining surveillance pricing
The Electronic Privacy Information Center and the Consumer Federation of America released an 11‑page pamphlet that provides clearly defined terms for surveillance pricing, a practice the groups condemn. The release follows the FTC’s recent…
Federal Trade Commission
Low
Guidance
Announced
Global · Sep 22, 2026
Future of Privacy Forum opens nominations for 17th Annual Privacy Papers for Policymakers Awards
The Future of Privacy Forum (FPF) announced that submissions for the 17th Privacy Papers for Policymakers Award are open until October 16, 2026. The award seeks privacy, AI‑governance, and youth‑online research that emphasizes data…
Moderate
Final regulation
In effect
United States (federal) · Sep 22, 2026
FCC adopts final rule clarifying TCPA “Revoke All” requirements
On September 9, 2026, the Federal Communications Commission issued a final rule amending the delayed “Revoke All” rule under the Telephone Consumer Protection Act. The rule will become effective 30 days after its publication.
Federal Communications Commission · Telephone Consumer Protection Act
Moderate
Fine
Decided
Spain · Sep 22, 2026 · effective Feb 1, 2023 · deadline Feb 1, 2024
Spanish DPA fines Securitas Direct €100,000 for charging phone line for data subject rights
The Spanish Data Protection Agency (AEPD) issued a final decision on 1 February 2023 finding Securitas Direct in breach of GDPR Article 12(2) by directing data subjects to a chargeable 902 telephone number to exercise their rights. The…
Spanish Data Protection Agency (AEPD) · General Data Protection Regulation
Low
Court ruling
Pending
United States (federal) · Sep 21, 2026
D.C. Circuit urged to vacate FAA drone restriction that criminalized recording immigration agents
EFF and co‑plaintiffs filed an amicus brief in Levine v. FAA asking the D.C. Circuit to void an FAA rule that barred drones from recording DHS immigration agents. The FAA rescinded the rule in April, but pilots could still be punished for…
Federal Aviation Administration
Moderate
Court ruling
Pending
United States (federal) · Sep 21, 2026
Supreme Court to decide VPPA consumer definition in Salazar v. Paramount Global
The Supreme Court will hear Salazar v. Paramount Global in the October 2026 term to resolve a circuit split on the definition of “consumer” under the Video Privacy Protection Act. The case arises from a class action alleging Paramount…
Video Privacy Protection Act
Moderate
Proposed regulation
Proposed
European Union · Sep 21, 2026
EU Commission proposes KIDS Act to impose age‑based restrictions and safety‑by‑design for children online
On September 17, 2026 the European Commission published a proposal for a new EU KIDS Act that would ban users under 15 from creating accounts on certain social networking and video‑sharing services, with limited exceptions. The draft…
European Commission · Digital Services Act
