Moderate
Proposed bill
In committee
United States (federal) · Aug 5, 2026
Senate Commerce Committee to vote on four privacy‑invasive bills (KOSA, SCREEN Act, Youth AI Privacy Act, CHATBOT Act)
The Senate Commerce Committee will vote this week on four bills: KOSA, the SCREEN Act, the Youth AI Privacy Act, and the CHATBOT Act. The bills are presented as child‑protection measures but are criticized for creating new privacy and…
U.S. Senate Commerce Committee · KOSA
Low
Court ruling
Decided
United States (federal) · Aug 4, 2026
Ninth Circuit rules Perplexity AI’s Comet browser not liable under CFAA
The Ninth Circuit Court of Appeals held that Perplexity AI’s Comet browser does not violate the Computer Fraud and Abuse Act because the tool itself does not access Amazon’s servers; users do. The court rejected Amazon’s claim that…
Computer Fraud and Abuse Act
Moderate
Enforcement
In effect
European Union · Aug 2, 2026 · effective Aug 2, 2026
EU Commission begins enforcing AI Act and new transparency rules on 2 August 2026
From 2 August 2026 the European Commission’s AI Office and national authorities will start enforcing the AI Act. New transparency rules require chatbots to disclose they are AI and AI‑generated content such as deepfakes to be labelled with…
European Commission AI Office · EU AI Act
Moderate
Proposed regulation
Announced
European Union · Jul 30, 2026
EDPB announces stakeholder event on upcoming data protection and competition law guidelines
The European Data Protection Board and the European Commission will hold a remote stakeholder event on 15 October 2026 to discuss upcoming guidelines on the interplay between data protection and competition law. The event aims to gather…
European Data Protection Board (EDPB) · General Data Protection Regulation
Low
Enforcement
Filed
Austria · Jul 30, 2026
noyb files GDPR complaint against dict.cc over 1,741‑partner consent banner
noyb lodged a complaint with the Austrian Data Protection Authority alleging that dict.cc’s cookie banner forces users to consent to tracking by 1,741 partner companies with a single click, violating GDPR consent requirements. The…
Austrian Data Protection Authority · General Data Protection Regulation
Moderate
Guidance
Announced
Spain · Jul 28, 2026
AEPD Privacy Lab invites entities to submit projects, research and initiatives
The AEPD's Privacy Lab has opened its Novedades space for publications, research projects, calls and activities related to privacy, data protection, AI and emerging technologies. Universities, research centres, public and private…
Agencia Española de Protección de Datos (AEPD) · Genetic Information Nondiscrimination Act
Moderate
Guidance
Announced
Spain · Jul 27, 2026
AEPD announces 2026 Data Protection Awards to recognize privacy promotion
The Spanish Data Protection Agency (AEPD) has launched the ‘Premios Protección de Datos 2026’ with nine categories covering research, vulnerable groups, communication, education, best practices, legal research, social media diffusion, DPO…
Agencia Española de Protección de Datos (AEPD) · RGPD
Moderate
Guidance
Announced
European Union · Jul 23, 2026
EDPB announces stakeholder event on upcoming data protection and competition law guidelines (15 Oct 2026)
The European Data Protection Board and the European Commission will hold a remote stakeholder event on 15 October 2026 to discuss upcoming guidelines on the interplay between competition law and data protection. The event invites…
European Data Protection Board · General Data Protection Regulation
Moderate
Guidance
Announced
Spain · Jul 23, 2026 · effective Jul 23, 2026
AEPD reopens registration for public research network on privacy and emerging technologies
The Spanish Data Protection Agency (AEPD) has reopened enrollment for its public network of research groups and projects focused on privacy and emerging technologies. The new registration phase allows groups that missed the first call and…
Agencia Española de Protección de Datos
Moderate
Guidance
Published
Spain · Jul 21, 2026
AEPD publishes technical guidance on data accuracy and minimisation in AI processing
The Spanish Data Protection Agency (AEPD) released a technical note interpreting the GDPR accuracy and data‑minimisation principles for AI‑driven personal data processing. It provides criteria for controllers, processors and DPOs to assess…
Agencia Española de Protección de Datos · RGPD
Moderate
Guidance
Announced
European Union · Jul 17, 2026
EDPB calls for legal basis for cross‑regulatory information sharing
The European Data Protection Board urged the European Commission to create a clear legal basis for regulators to share information across competences. It highlighted the need for stronger legislation to enable confidential information…
European Data Protection Board · General Data Protection Regulation
Moderate
Interpretation
Published
Belgium · Jul 14, 2026 · effective May 28, 2026
EDPB orders Belgian DPA to assess NOYB cookie banner complaint on merits
The European Data Protection Board issued a binding decision on 28 May 2026 requiring the Belgian DPA to evaluate a NOYB complaint about VRT's cookie banners on the merits rather than dismiss it on procedural grounds. The decision found no…
European Data Protection Board · General Data Protection Regulation
Moderate
Court ruling
Decided
United States (federal) · Jun 29, 2026
US Supreme Court decision undermines EU‑US Data Privacy Framework
The US Supreme Court ruled in Trump v. Slaughter that the FTC cannot be an independent agency. The decision calls into question the independence requirement for the EU‑US Data Privacy Framework, effectively collapsing the adequacy…
EDPB · General Data Protection Regulation
Moderate
Proposed regulation
Proposed
European Union · Jun 23, 2026
EU Council scrapes Article 88b proposal to replace cookie banners with automated signal
The European Commission proposed adding Article 88b to the GDPR to replace cookie banners with an automated consent signal. On 18 June, the Council’s position paper removed the article, keeping the existing cookie banner regime. The change…
European Commission · General Data Protection Regulation
Low
Enforcement
Filed
Austria · Jun 9, 2026
noyb files injunction against Austrian credit agency CRIF over GDPR violations
noyb, a state‑approved qualified entity, filed an injunction against CRIF to stop its alleged unlawful collection and scoring of personal data under the GDPR. The filing also suspends the limitation period and prepares a subsequent class…
EDPB · General Data Protection Regulation
Low
Investigation
Filed
Norway (EEA) · Jun 3, 2026
Norwegian Consumer Council and noyb file complaint against Schibsted over “Pay or Okay” tracking scheme
The Norwegian Consumer Council and privacy NGO noyb have lodged a joint complaint with the Norwegian Data Protection Authority against Schibsted for its “Pay or Okay” system that forces users to pay to refuse tracking. The complaint argues…
Norwegian Data Protection Authority · General Data Protection Regulation
Moderate
Guidance
Published
European Union · May 28, 2026
ENISA releases NIS360 report showing improved cybersecurity maturity of EU critical sectors
The ENISA NIS360 report released on 28 May 2026 indicates that cybersecurity maturity across EU critical sectors has improved, while sector criticality remains relatively stable. The report identifies a risk zone of sectors with lower…
ENISA · NIS2 Directive
Low
Court ruling
Decided
Austria · May 21, 2026
Austrian Federal Administrative Court orders ORF to redesign cookie banner for equal consent options
The Federal Administrative Court (BVwG) upheld the Austrian Data Protection Authority's 2024 decision that ORF.at's cookie banner violates the GDPR. The court ruled that the ‘Accept’ button must not be highlighted in colour and that…
EDPB · General Data Protection Regulation
Low
Enforcement
Filed
Austria · May 5, 2026
LinkedIn blocks GDPR access to profile visitor data behind paywall, noyb files complaint in Austria
LinkedIn requires users to pay to view who has visited their profile, despite the data being personal under the GDPR. noyb argues the data must be provided free of charge under Article 15 and has lodged a complaint with the Austrian Data…
Austrian Data Protection Authority · General Data Protection Regulation
Moderate
Lawsuit filed
Filed
Germany · Apr 30, 2026
noyb files lawsuit against Hamburg DPA over inaction on PimEyes biometric data case
noyb has filed a lawsuit against the Hamburg Data Protection Authority, alleging that the authority has failed to act on illegal biometric data processing by PimEyes. The DPA considers PimEyes' facial recognition practices illegal but…
Hamburg Data Protection Authority · General Data Protection Regulation
