Moderate
Guidance
Published
United States (federal) · Oct 5, 2026
EPIC analysis links pixel‑tracking litigation under ECPA and CIPA to upcoming Supreme Court VPPA case
EPIC outlines how recent court decisions using the Electronic Communications Privacy Act (ECPA) and California Invasion of Privacy Act (CIPA) address non‑consensual pixel tracking and its privacy harms. The analysis cites multiple…
HHS OCR · HIPAA Privacy, Security and Breach Notification Rules
Moderate
Settlement
Settled
United States (federal) · Oct 2, 2026
Meta’s Muse AI Agent raises privacy, security, and child safety concerns amid past FTC consent decree
Meta launched the Muse personal AI agent in September 2026, which collects extensive personal data and can act without clear user permission. EPIC reports multiple incidents where Muse accessed messages, shared home addresses, and…
Federal Trade Commission
Moderate
Proposed regulation
Proposed
United States (federal) · Sep 28, 2026
EPIC and consumer groups urge FTC to ban surveillance pricing, calling disclosure insufficient
On September 25, EPIC and several consumer groups filed comments with the FTC urging it to go beyond disclosure in its Proposed Enforcement Policy Statement on personalized pricing. The commenters argue that surveillance pricing violates…
Federal Trade Commission · FTC Act Section 5
Moderate
Guidance
Announced
France · Sep 28, 2026
CNIL to host AIR 2026 event on political communication ethics and election manipulation on 16 Nov 2026
The French data‑protection authority CNIL will hold a public debate on 16 November 2026 about the ethical challenges of digital political communication and foreign interference. The programme will examine voter consent, data‑minimisation…
CNIL · RGPD
Moderate
Guidance
Announced
United States (federal) · Sep 24, 2026
DraftKings uses AI to target losing gamblers with online behavioral advertising
DraftKings employs AI and machine learning on customers' betting records to identify likely losing gamblers and serve them targeted promotions. The practice exemplifies online behavioral advertising that leverages first‑party data to…
Low
Lawsuit filed
Filed
United States (federal) · Sep 23, 2026
Paramount urges SCOTUS to reject video privacy claim
Paramount filed a brief urging the Supreme Court to reject a video privacy claim under the video privacy law. The Electronic Privacy Information Center and other privacy advocates filed an amicus brief supporting the plaintiff, arguing the…
Video Privacy Act
Low
Lawsuit filed
Pending
United States (federal) · Sep 23, 2026
Paramount asks SCOTUS to reject video privacy lawsuit
Paramount has filed a brief urging the U.S. Supreme Court to reject a video privacy claim. The Electronic Privacy Information Center and other privacy advocates filed a friend‑of‑the‑court brief supporting Salazar, arguing the video…
video privacy law
Moderate
Court ruling
Pending
United States (federal) · Sep 23, 2026
Supreme Court hears digital‑privacy case involving Paramount and targeted advertising
The Electronic Privacy Information Center argued before the Supreme Court that Paramount and other online‑video companies are not obligated to use targeted advertising systems and can adopt privacy‑protective techniques. The case could set…
High
Fine
Decided
Ireland · Sep 23, 2026 · effective Sep 21, 2026
Irish Data Protection Commission fines Google €403 million for GDPR violations over location data
The Irish Data Protection Commission issued its final decision on 21 September 2026, imposing administrative fines of €403 million on Google Ireland Limited. The DPC found infringements of GDPR principles relating to lawfulness, fairness…
Irish Data Protection Commission · General Data Protection Regulation
Low
Proposed bill
Proposed
New York · Sep 22, 2026
New York may ban price discrimination based on income, age, and race
A proposed measure in New York would prohibit businesses from changing prices based on a consumer's income, age, or race. The article highlights privacy concerns about the data consumers provide that could be used for such pricing…
Low
Interpretation
Published
United States (federal) · Sep 22, 2026
EPIC and Consumer Federation issue pamphlet defining surveillance pricing
The Electronic Privacy Information Center and the Consumer Federation of America released an 11‑page pamphlet that provides clearly defined terms for surveillance pricing, a practice the groups condemn. The release follows the FTC’s recent…
Federal Trade Commission
Moderate
Court ruling
Pending
United States (federal) · Sep 21, 2026
Supreme Court to decide VPPA consumer definition in Salazar v. Paramount Global
The Supreme Court will hear Salazar v. Paramount Global in the October 2026 term to resolve a circuit split on the definition of “consumer” under the Video Privacy Protection Act. The case arises from a class action alleging Paramount…
Video Privacy Protection Act
Moderate
Proposed regulation
Proposed
European Union · Sep 21, 2026
EU proposes Article 88c/88bis to allow unrestricted AI use of personal data
A leaked Irish Presidency document proposes that personal data used "in the context of AI" be automatically lawful, removing consent requirements. The draft Article 88c (now 88bis) would permit AI companies to process any personal data for…
European Commission · General Data Protection Regulation
Moderate
Proposed bill
Announced
European Union · Sep 14, 2026
EU Commission to propose EU-wide minimum age for social media, linked to Digital Fairness Act
The European Commission will release a legislative proposal by the end of 2026 establishing an EU-wide minimum age for social media, building on the Special Panel's age‑tiered framework. The proposal may be incorporated into the Digital…
European Commission · Digital Services Act
Moderate
Proposed bill
Passed one chamber
California · Aug 31, 2026
California Assembly Bill 1709 passed, bans social media recommendation features for users under 16
The California legislature passed Assembly Bill 1709, which would prohibit platforms from providing recommendation algorithms and related features to users under 16. The bill would require age‑verification methods that could involve…
AB 1709
Low
Proposed regulation
Proposed
BR · Aug 28, 2026
EFF and allies recommend new privacy safeguards to protect Brazil's electoral integrity
The Electronic Frontier Foundation, Access Now and Data Privacy Brasil issued recommendations urging stronger personal data protection in Brazil's elections. They call for prohibiting processing of sensitive political data, requiring…
LGPD
Low
Investigation
Announced
Global · Aug 19, 2026
EFF report finds mobile ad libraries may leak user location data
EFF released a new report highlighting how mobile ad libraries can cause apps to unintentionally expose users' location information. The investigation notes that this leakage can reveal intimate details about individuals and be exploited…
High
New law
Signed
New Jersey · Aug 12, 2026 · effective Sep 1, 2027
New Jersey enacts Age-Appropriate Design Code (A4015) signed by Governor Sherrill
On August 11, Governor Sherrill signed A4015, the New Jersey Age-Appropriate Design Code (NJAADC). The law, effective September 1, 2027, imposes safety defaults, bans dark patterns, and creates a private right of action. It applies to…
New Jersey Attorney General · Connecticut Data Privacy Act
Moderate
Proposed bill
In committee
United States (federal) · Aug 5, 2026
Senate Commerce Committee to vote on four privacy‑invasive bills (KOSA, SCREEN Act, Youth AI Privacy Act, CHATBOT Act)
The Senate Commerce Committee will vote this week on four bills: KOSA, the SCREEN Act, the Youth AI Privacy Act, and the CHATBOT Act. The bills are presented as child‑protection measures but are criticized for creating new privacy and…
U.S. Senate Commerce Committee · KOSA
Moderate
Proposed regulation
Proposed
European Union · Jun 23, 2026
EU Council scrapes Article 88b proposal to replace cookie banners with automated signal
The European Commission proposed adding Article 88b to the GDPR to replace cookie banners with an automated consent signal. On 18 June, the Council’s position paper removed the article, keeping the existing cookie banner regime. The change…
European Commission · General Data Protection Regulation
