Topic
EU AI Act, Data Act, GDPR reform, DORA, NIS2 and the rules shaping how organisations use data.
Internal research projects need no prior CNIL formalities, but the regulator says they remain subject to GDPR records, impact assessments, patient information and the right to object.
A law-firm analysis of the Commission's 17 September proposal sets out age tiers, a six-month review of existing accounts and GDPR questions for age assurance, as the text enters the legislative procedure.
The Commission says TikTok did not adequately assess how its feed pulls users into repeated content on sadness, isolation or body image, and that its safeguards do not work. A confirmed breach could bring a fine of up to 6% of worldwide turnover.
The French regulator's guidance covers tool providers and site or app publishers, and asks for masking of irrelevant data, limits on sessions recorded and masking of chatbot conversations.
Sweden's data protection authority will examine lawfulness, necessity, which personal data are needed, how jobseekers are informed and whether automated decision-making occurs.
The Artificial Intelligence Deceptive Advertising Act, signed on 22 October 2026, takes effect on 21 December 2026 and allows courts to impose a civil fine of up to $3,000 for a violation.
The guidelines cover machine learning, generative AI and AI agents, and require AI inventories, risk materiality assessments and senior management accountability, according to a contributed IAPP analysis.
The draft would also bar certain browser features from blocking opt-out signals and extend annual metrics reporting to businesses subject to cybersecurity audits or risk assessments. The Board was due to consider it on 5–6 November.
IAPP analysis says Democrats' midterm wins in Congress and the states could revive federal privacy and AI bills, tighten FTC scrutiny and restart stalled state legislation.
The US bank regulator says examiners should not treat AI as a separate risk category and that scrutiny may be scaled to consequences, delegated authority and human oversight, not technical sophistication.
In the first generative AI case before the Court of Justice, Maciej Szpunar says LLM training is generally covered by the text and data mining exception, but chatbot answers that retrieve and reuse press articles may infringe publishers' rights.
Sweden's data protection authority says Lexbase, Krimfup, MrKoll and Upplysning must follow GDPR rules on criminal-offence data and erasure, despite holding voluntary publishing certificates.
The regulator's largest fine ever finds the ad-tech firm was a joint controller with Grindr and could not rely on the app to secure explicit consent for real-time bidding.
A federal judge in Washington granted a preliminary injunction and stayed the agencies' 'Voter Data Transmission Policy' on the eve of the midterms, after evidence the matched lists misidentified US citizens.
The industry group wants the Cloud and AI Development Act's mandatory requirements to cover areas such as defence and justice, not the whole public sector, under one EU-wide framework.
The FTC's draft enforcement statement says undisclosed use of personal data to set prices could breach the FTC Act, while four states and Seattle already apply differing bans and disclosure rules.
Oregon's stipulated judgment, one of the parallel multistate settlements, details what GM must build from 30 November 2026, including a disclosure inventory and a strict test for deidentified data.
The DOJ's bankruptcy trustee office calls Character.AI's privacy policy 'ambiguous' and says the court should examine whether users' chats, including minors' data, can lawfully be sold.
The tracker sent browsing data to a third-party domain to personalise product recommendations and train a recommendation algorithm. Fnac must prove its new consent tool works within a month or face daily penalties.
The Autoriteit Persoonsgegevens sets out its enforcement principles, how its procedure runs and how it cooperates with other supervisors, after receiving 12 responses to an April 2026 draft.
In comments on the Colorado Department of Law's 6 October interim draft rules, FPF asks for two of six human-involvement factors to be dropped and for developers to supply version and output-data details.
The settlement requires affirmative express consent before GM collects or discloses driving and location data, plus data minimisation and a privacy programme subject to internal and external assessments.
The fine traces back to a 2023 noyb complaint. The CNIL found the Fnac app sent browsing data to a third party without consent, both to show product recommendations and to train the recommendation algorithm.
EPIC, CFA and Fairplay say the October draft drops principal-reason notices, weakens human review and lets deployers cite unknown data sources. They also seek tighter age-assurance data limits under the Chatbot Safety Act.
SB 53 targets a handful of frontier developers; the Training Data Transparency Act reaches any developer that builds or substantially modifies public generative AI, including through fine-tuning.
Section 6(b) orders to Delta, Uber, Walmart and six others ask for the inputs, tools and procedures behind individualised prices and gig-worker compensation. Recipients have 45 days to respond.
Garante president Pasquale Stanzione told an Italian parliamentary committee that age verification and parental controls must respect minors' privacy and autonomy.
The law bans companion chatbot features in 12 unsafe categories for minors, requires multiple age assurance methods and takes effect on 1 January 2027, leaving providers little time to prepare.
The 4th Circuit found the provision a content-based speech restriction that fails strict scrutiny, mainly because it lacks the notice-and-removal step other states' versions require.
Following a complaint, the Swedish regulator found that signs did not clearly tell people, including those arriving by train, that they were entering a monitored area.
Member state ambassadors set the Council's position on rewriting GDPR, Data Act and other digital rules. noyb says the new Article 88bis would treat AI-related processing as lawful by default; Parliament has yet to take its position.
A jury found almost 44 million violations of the state's Unfair Practices Act, covering Meta's statements and practices on third-party data access, user privacy and harmful content.
According to noyb, the authority found the CDU, SPD, Greens and Die LINKE had no legal basis, such as consent, for targeting users by their political interests. A complaint against the AfD remains pending.
The CMA will examine bundling, customers' freedom to choose AI tools other than Copilot, and cloud licensing. Microsoft and AWS have already removed data transfer fees for customers switching cloud provider.
The Commission says enforcement of the rules for general-purpose AI models has begun, with requests on security, external evaluation and monitoring of model use. Media reports name OpenAI and Anthropic.
Supervisors in the UK, the US and the euro area are questioning banks about controls over autonomous AI agents and recovery from AI-enabled cyber attacks, according to a Reuters report.
The privacy group's scoring, published on a new website, says the EPP tabled the most amendments weakening protections, while S&D, the Left and the Greens score positively overall.
An amicus brief backs a flight attendants' union objection, arguing the $10 million deal protects consumer data but not decades of payroll, discipline and internal communications records.
