Moderate
Guidance
Announced
United States (federal) · Sep 22, 2026
WBUR reports driver’s license data appearing on dark web, raising AI‑enabled fraud risks
WBUR discussed a breach where images of driver’s licenses have been posted on the dark web. The episode highlighted risks of new account fraud, especially when combined with AI tools that can synthesize voice, images, or video. It also…
Low
Proposed bill
Proposed
New York · Sep 22, 2026
New York may ban price discrimination based on income, age, and race
A proposed measure in New York would prohibit businesses from changing prices based on a consumer's income, age, or race. The article highlights privacy concerns about the data consumers provide that could be used for such pricing…
Low
Interpretation
Published
EU-GB · Sep 22, 2026
London faces privacy pushback against smart glasses, EPIC warns
The article reports growing public concern in London over smart glasses that can record video. EPIC's AI and Human Rights director Calli Shroeder says solving privacy problems will be difficult and warns of fear of being left behind in the…
Low
Interpretation
Published
United States (federal) · Sep 22, 2026
EPIC and Consumer Federation issue pamphlet defining surveillance pricing
The Electronic Privacy Information Center and the Consumer Federation of America released an 11‑page pamphlet that provides clearly defined terms for surveillance pricing, a practice the groups condemn. The release follows the FTC’s recent…
Federal Trade Commission
Low
Guidance
Announced
Global · Sep 22, 2026
Future of Privacy Forum opens nominations for 17th Annual Privacy Papers for Policymakers Awards
The Future of Privacy Forum (FPF) announced that submissions for the 17th Privacy Papers for Policymakers Award are open until October 16, 2026. The award seeks privacy, AI‑governance, and youth‑online research that emphasizes data…
Moderate
Final regulation
In effect
United States (federal) · Sep 22, 2026
FCC adopts final rule clarifying TCPA “Revoke All” requirements
On September 9, 2026, the Federal Communications Commission issued a final rule amending the delayed “Revoke All” rule under the Telephone Consumer Protection Act. The rule will become effective 30 days after its publication.
Federal Communications Commission · Telephone Consumer Protection Act
Moderate
Fine
Decided
Spain · Sep 22, 2026 · effective Feb 1, 2023 · deadline Feb 1, 2024
Spanish DPA fines Securitas Direct €100,000 for charging phone line for data subject rights
The Spanish Data Protection Agency (AEPD) issued a final decision on 1 February 2023 finding Securitas Direct in breach of GDPR Article 12(2) by directing data subjects to a chargeable 902 telephone number to exercise their rights. The…
Spanish Data Protection Agency (AEPD) · General Data Protection Regulation
Moderate
Guidance
Published
European Union · Sep 22, 2026 · effective Sep 22, 2026
ENISA releases 2026 Threat Landscape report highlighting AI-enabled cyber threats and supply‑chain risks
ENISA's 2026 Threat Landscape report analyses incidents from 1 January to 31 December 2025, noting a rise in ransomware, AI‑driven malicious activity, and supply‑chain attacks. The report finds public administration to be the most targeted…
ENISA · NIS2 Directive
Low
Court ruling
Pending
United States (federal) · Sep 21, 2026
D.C. Circuit urged to vacate FAA drone restriction that criminalized recording immigration agents
EFF and co‑plaintiffs filed an amicus brief in Levine v. FAA asking the D.C. Circuit to void an FAA rule that barred drones from recording DHS immigration agents. The FAA rescinded the rule in April, but pilots could still be punished for…
Federal Aviation Administration
Moderate
Court ruling
Pending
United States (federal) · Sep 21, 2026
Supreme Court to decide VPPA consumer definition in Salazar v. Paramount Global
The Supreme Court will hear Salazar v. Paramount Global in the October 2026 term to resolve a circuit split on the definition of “consumer” under the Video Privacy Protection Act. The case arises from a class action alleging Paramount…
Video Privacy Protection Act
Moderate
Proposed regulation
Proposed
European Union · Sep 21, 2026
EU Commission proposes KIDS Act to impose age‑based restrictions and safety‑by‑design for children online
On September 17, 2026 the European Commission published a proposal for a new EU KIDS Act that would ban users under 15 from creating accounts on certain social networking and video‑sharing services, with limited exceptions. The draft…
European Commission · Digital Services Act
Moderate
Proposed regulation
Proposed
European Union · Sep 21, 2026
EU proposes Article 88c/88bis to allow unrestricted AI use of personal data
A leaked Irish Presidency document proposes that personal data used "in the context of AI" be automatically lawful, removing consent requirements. The draft Article 88c (now 88bis) would permit AI companies to process any personal data for…
European Commission · General Data Protection Regulation
Low
Executive order
Announced
California · Sep 18, 2026
California Governor Newsom issues executive order on AI to spur dialogue and address harms
Governor Gavin Newsom issued an executive order calling for a thoughtful conversation about artificial intelligence and its potential harms. The order supports expanding reporting requirements under SB 53 (2025) for loss‑of‑control…
Governor Gavin Newsom · SB 53 (2025)
Low
Guidance
Published
Global · Sep 18, 2026
How to limit Siri AI access in iOS 27
Apple’s iOS 27 introduces a more powerful Siri AI that can access data from native and third‑party apps and may send information to Apple’s Private Cloud Compute. Users can mitigate privacy risks by disabling Siri, turning off app content…
Low
Guidance
Published
Global · Sep 18, 2026
Secure Messaging and AI Remain In Conflict Despite the Promise of TEEs
The EFF warns that cloud‑based trusted execution environments (TEEs) do not provide the same privacy guarantees as end‑to‑end encryption. When AI features offload message data to TEEs, the content leaves the device and is exposed to…
Low
Guidance
Announced
Global · Sep 18, 2026
EFF warns that cloud TEEs undermine end‑to‑end encryption in messaging apps
The EFF explains that while trusted execution environments (TEEs) can protect data on cloud servers, they do not provide the same mathematical guarantees as end‑to‑end encryption. Sending message content to a TEE for AI processing creates…
Low
Lawsuit filed
Filed
United States (federal) · Sep 18, 2026
EPIC sues Trump administration over State Citizenship Lists program
EPIC, together with Protect Democracy and CREW, filed a lawsuit on Sept. 1, 2026 challenging DHS, SSA, and the State Department’s plan to create and distribute State Citizenship Lists for voter eligibility. The suit argues the program is…
Moderate
Proposed regulation
Proposed
United States (federal) · Sep 18, 2026
EFF urges lawmakers to base AI cybersecurity rules on established best practices
The EFF recommends that any new AI cybersecurity legislation focus on proven security measures such as sandboxing, monitoring, and logging to mitigate risks demonstrated by recent AI lab incidents. It calls for minimum safety requirements…
Low
Proposed bill
Announced
California · Sep 17, 2026
California SB 976 restricts teen social media feed recommendations, challenged as unconstitutional
California enacted SB 976, which requires parental permission before teens can view recommended content from other users on social media. The law is being challenged in Meta v. Bonta on First Amendment grounds. EFF argues the law also…
SB 976
Moderate
Settlement
Settled
United States (federal) · Sep 17, 2026
FTC Announces Additional Payments to Consumers Under Amazon Prime Settlement
The FTC announced that under a revised order in the Amazon Prime settlement, the maximum consumer refund increased from $51 to $200. The change allows more consumers to qualify for payments. The announcement was released on September 17…
Federal Trade Commission
