Moderate
Guidance
Published
United States (federal) · Sep 25, 2026
CMS re-establishes matching program with Treasury's Do Not Pay Working System under Privacy Act
The Centers for Medicare & Medicaid Services announced the re-establishment of a data matching program with the Do Not Pay Working System, administered by the Treasury's Bureau of Fiscal Service. The notice cites subsection (e)(12) of the…
U.S. Department of Health and Human Services, Centers for Medicare & Medicaid Services · Privacy Act of 1974
High
Guidance
In effect
United States (federal) · Sep 25, 2026 · effective Oct 26, 2026
Peace Corps announces new CRM system of records (PC 38) effective Oct 26, 2026
The Peace Corps Office of Planning and Performance issued a public notice of a new system of records, the Peace Corps Customer Relationship Management (PC 38) system. The system will monitor, track, and analyze interactions with…
Peace Corps Office of Planning and Performance · Privacy Act of 1974
Moderate
Guidance
Announced
United States (federal) · Sep 24, 2026
DraftKings uses AI to target losing gamblers with online behavioral advertising
DraftKings employs AI and machine learning on customers' betting records to identify likely losing gamblers and serve them targeted promotions. The practice exemplifies online behavioral advertising that leverages first‑party data to…
Moderate
Guidance
Published
United States (federal) · Sep 24, 2026
SBA seeks comments on modified matching program under Privacy Act
The U.S. Small Business Administration issued a Federal Register notice requesting public comment on a Privacy Act notice for a revised computer‑matching program. The program will compare SBA benefits records with the Treasury Department’s…
U.S. Small Business Administration · Privacy Act of 1974
Moderate
Guidance
Published
European Union · Sep 23, 2026
EDPB adopts guidelines on GDPR fines and DSA interaction (17 Sep 2026)
On 17 September 2026 the European Data Protection Board adopted guidelines on the use of administrative fines by data protection authorities and finalised guidance on the interaction between the Digital Services Act (DSA) and the GDPR. The…
European Data Protection Board (EDPB) · Digital Services Act
Moderate
Guidance
Announced
United States (federal) · Sep 22, 2026
WBUR reports driver’s license data appearing on dark web, raising AI‑enabled fraud risks
WBUR discussed a breach where images of driver’s licenses have been posted on the dark web. The episode highlighted risks of new account fraud, especially when combined with AI tools that can synthesize voice, images, or video. It also…
Low
Interpretation
Published
EU-GB · Sep 22, 2026
London faces privacy pushback against smart glasses, EPIC warns
The article reports growing public concern in London over smart glasses that can record video. EPIC's AI and Human Rights director Calli Shroeder says solving privacy problems will be difficult and warns of fear of being left behind in the…
Low
Interpretation
Published
United States (federal) · Sep 22, 2026
EPIC and Consumer Federation issue pamphlet defining surveillance pricing
The Electronic Privacy Information Center and the Consumer Federation of America released an 11‑page pamphlet that provides clearly defined terms for surveillance pricing, a practice the groups condemn. The release follows the FTC’s recent…
Federal Trade Commission
Low
Guidance
Announced
Global · Sep 22, 2026
Future of Privacy Forum opens nominations for 17th Annual Privacy Papers for Policymakers Awards
The Future of Privacy Forum (FPF) announced that submissions for the 17th Privacy Papers for Policymakers Award are open until October 16, 2026. The award seeks privacy, AI‑governance, and youth‑online research that emphasizes data…
Low
Guidance
Published
Global · Sep 18, 2026
How to limit Siri AI access in iOS 27
Apple’s iOS 27 introduces a more powerful Siri AI that can access data from native and third‑party apps and may send information to Apple’s Private Cloud Compute. Users can mitigate privacy risks by disabling Siri, turning off app content…
Low
Guidance
Published
Global · Sep 18, 2026
Secure Messaging and AI Remain In Conflict Despite the Promise of TEEs
The EFF warns that cloud‑based trusted execution environments (TEEs) do not provide the same privacy guarantees as end‑to‑end encryption. When AI features offload message data to TEEs, the content leaves the device and is exposed to…
Low
Guidance
Announced
Global · Sep 18, 2026
EFF warns that cloud TEEs undermine end‑to‑end encryption in messaging apps
The EFF explains that while trusted execution environments (TEEs) can protect data on cloud servers, they do not provide the same mathematical guarantees as end‑to‑end encryption. Sending message content to a TEE for AI processing creates…
Moderate
Guidance
Published
France · Sep 17, 2026
CNIL outlines its status, organization and sanction powers
The CNIL, created by the 1978 Loi Informatique et Libertés, is an independent administrative authority composed of a college of 18 members. Its restricted board can impose fines up to €20 million or 4 % of global annual turnover under the…
CNIL · loi Informatique et Libertés
Moderate
Guidance
Announced
New York · Sep 17, 2026 · effective Jan 1, 2027
NY Attorney General urges workers to file whistleblower complaints on unsafe AI development
New York Attorney General Letitia James issued an alert encouraging employees with knowledge of unsafe or illegal AI development to submit confidential whistleblower complaints. The alert references the Responsible AI Safety and Education…
New York Attorney General's Office · New York SHIELD Act
Moderate
Guidance
Published
United States (federal) · Sep 16, 2026
EPIC report: Data brokers sell personal data to Disney, GM, insurers and banks
EPIC highlights that data brokers collect and sell personal information to major companies such as Disney, General Motors, insurers and banks. The article notes that brokers infer additional characteristics like finance, health…
Low
Guidance
Announced
United States (federal) · Sep 16, 2026
EPIC report finds companies hinder personal data access under state privacy laws
The Electronic Privacy Information Center reports that many large firms make it difficult for consumers to obtain their personal data, despite state privacy statutes. EPIC notes that small fines and warning letters often have limited…
Low
Guidance
Announced
United States (federal) · Sep 16, 2026
EFF appoints former White House official Alexander Macgillivray to Board of Directors
The Electronic Frontier Foundation announced that Alexander "amac" Macgillivray has joined its Board of Directors. Macgillivray previously served as Deputy Assistant to the President and Principal Deputy U.S. Chief Technology Officer and…
Blueprint for an AI Bill of Rights
Moderate
Guidance
Published
KE · Sep 16, 2026
Kenya publishes new guidance on cross‑border data transfers
On 8 September 2026 Kenya’s Office of the Data Protection Commissioner released detailed Guidance Notes on cross‑border data transfers. The guidance clarifies Kenya’s transfer framework, adds operational detail, and highlights differences…
Office of the Data Protection Commissioner (ODPC) · General Data Protection Regulation
Low
Guidance
Announced
United States (federal) · Sep 15, 2026
EPIC senior counsel warns of privacy risks in unproven health technologies
The Washington Post health brief quoted EPIC senior counsel Sara Geoghegan stating that emerging health technologies are unproven and may be riddled with privacy risks. She emphasized that companies must build and demonstrate trust, noting…
Low
Guidance
Published
United States (federal) · Sep 11, 2026
Amazon Ring's 'Throw Away the Key Encryption' adds limited privacy but falls short of true end‑to‑end encryption
Amazon introduced the Throw Away the Key Encryption (TAKE) feature for Ring cameras, where encryption keys are held temporarily in the cloud and deleted after 24 hours. The system still allows Ring to decrypt footage for cloud‑based…
