Moderate
Proposed regulation
Proposed
Vermont · Oct 8, 2026
Future of Privacy Forum submits comments on Vermont Age-Appropriate Design Code rulemaking
On October 2, 2026 the Future of Privacy Forum filed comments to the Vermont Attorney General’s rulemaking for the Age-Appropriate Design Code. The act, enacted in June 2025, sets duties for businesses serving minors and will become…
Vermont Office of the Attorney General · California Age-Appropriate Design Code Act
Moderate
Proposed regulation
Proposed
France · Oct 8, 2026
CNIL examines draft deliberation authorizing BIG DATA SANTE to process personal data for anonymized medical research (ONCOVAL)
During its plenary session on 8 October 2026, the CNIL will consider a draft deliberation that would permit BIG DATA SANTE (Octopize Mimethik Data) to carry out automated processing of personal data to create anonymised datasets for…
Commission nationale de l'informatique et des libertés (CNIL) · Law of 6 January 1978
Moderate
Proposed regulation
Announced
France · Oct 1, 2026
CNIL to examine draft decree on student violence questionnaire and automated vehicle sound monitoring
The CNIL plenary session on 1 October 2026 will examine a draft decree authorising personal data processing for a "Questionnaire violences sexistes et sexuelles" in schools. It will also review draft orders on sound radars and an automated…
Commission nationale de l'informatique et des libertés (CNIL) · règlement intérieur de la CNIL
Moderate
Proposed regulation
Proposed
United States (federal) · Sep 28, 2026
EPIC and consumer groups urge FTC to ban surveillance pricing, calling disclosure insufficient
On September 25, EPIC and several consumer groups filed comments with the FTC urging it to go beyond disclosure in its Proposed Enforcement Policy Statement on personalized pricing. The commenters argue that surveillance pricing violates…
Federal Trade Commission · FTC Act Section 5
Moderate
Final regulation
Published
California · Sep 28, 2026
California Privacy Protection Agency adopts multiple regulations including Conflict of Interest Code Amendments and Data Broker Registration Fee
The CPPA has adopted several regulations, such as the Conflict of Interest Code Amendments Regulation (September 2026) and Data Broker Registration Fee Regulation (December 2025). These were adopted through the Administrative Procedures…
California Privacy Protection Agency · California Consumer Privacy Act (as amended by CPRA)
Moderate
Proposed regulation
Proposed
European Union · Sep 21, 2026
EU Commission proposes KIDS Act to impose age‑based restrictions and safety‑by‑design for children online
On September 17, 2026 the European Commission published a proposal for a new EU KIDS Act that would ban users under 15 from creating accounts on certain social networking and video‑sharing services, with limited exceptions. The draft…
European Commission · Digital Services Act
Moderate
Proposed regulation
Proposed
European Union · Sep 21, 2026
EU proposes Article 88c/88bis to allow unrestricted AI use of personal data
A leaked Irish Presidency document proposes that personal data used "in the context of AI" be automatically lawful, removing consent requirements. The draft Article 88c (now 88bis) would permit AI companies to process any personal data for…
European Commission · General Data Protection Regulation
Moderate
Proposed regulation
Announced
France · Sep 3, 2026
CNIL agenda includes review of draft decrees on automated personal data processing and authorizations for health data studies
The CNIL plenary session agenda for 3 September 2026 lists examinations of draft deliberations on a decree modifying decree n° 2023‑935 for the SISPoPP system, a draft decree on the API‑PNR France system, and authorizations for RCTs, IQVIA…
Commission nationale de l'informatique et des libertés (CNIL) · General Data Protection Regulation
Moderate
Proposed regulation
Proposed
European Union · Feb 24, 2026
EU Commission proposes Digital Omnibus to amend GDPR and ePrivacy Directive
The European Commission published its Digital Omnibus proposal on 19 November 2025, aiming to amend the GDPR and the ePrivacy Directive. noyb’s analysis warns that the proposed changes could conflict with the EU Charter of Fundamental…
European Commission · ePrivacy Directive
Moderate
Proposed regulation
Proposed
European Union · Nov 22, 2025
EU Commission proposes Digital Omnibus package with new personal data definition and research exemption
The European Commission has released the Digital Omnibus proposal, introducing a narrower definition of personal data (Art. 4(1)), a broader research exemption (Arts. 4(38), 5(1)(b), 13, 89), and new AI‑related rules (Arts. 9(2)(k), 9(5)…
European Commission · General Data Protection Regulation
Moderate
Proposed regulation
Proposed
European Union · Nov 11, 2025
Open letter warns EU Commission's Digital Omnibus draft could deregulate GDPR
Noyb, EDRi and the Irish Council for Civil Liberties sent an open letter to the European Commission criticizing a draft Digital Omnibus that would amend core GDPR provisions. The draft proposes redefining personal data, weakening data…
European Commission · General Data Protection Regulation
