Data rights, surveillance, GDPR, CCPA, and privacy regulation.
99 articles across 4 topics
The Connecticut Data Privacy Act (CTDPA) has been revised multiple times since being enacted in 2022: SB 3 added heightened protections for consumer health data and for minors in 2023; and SB 1295 in 2025 expanded the law's scope, updated and added consumer rights, modified the data minimization ...
This report provides in-depth analysis of U.S. state comprehensive privacy laws, with a focus on the 2025 legislative session.
Complete guide to the EU-US Data Privacy Framework: history, self-certification, the Data Protection Review Court, the Latombe case (dismissed September 2025, appealed to CJEU as C-703/25 P), PCLOB disruption, and what happens if the DPF falls.
Surveillance pricing, which uses consumer data to drive prices, has caught the eye of government officials, Kwamina Willford, Christopher J. Armstrong, Ashley Joyner Chavous, Benjamin Genn of Holland & Knight write. Companies must ensure their practices are transparent and defensible.
California, Colorado, Connecticut, ... in 2025 and 2026. California sets the enforcement standard. The state imposed its largest CCPA fine to date in 2025—a $1.55 million settlement over failure to honor opt-out requests and improper data sharing. New regulations covering automated ...
Privacy, cybersecurity, and AI regulation continue to be front and center in all aspects of business operations. Two additional states, Oklahoma and Alabama, have recently passed comprehensive...
Key point: Colorado repealed and replaced the Colorado AI Act, Georgia enacted a chatbot law, and California and New York advanced numerous bills. Below
On April 22, 2026, the House Energy & Commerce Committee released the “Securing and Establishing Consumer Uniform Rights and Enforcement over Data
As global businesses navigate numerous privacy and data protection laws worldwide, GDPR and CCPA compliance can provide a common baseline for meeting requirements in other jurisdictions.
California companies may have less time than they think to prepare for privacy audits. The California Privacy Protection Agency’s (CPPA) new Audits Division, created in February 2026, is expected to begin assessing companies’ compliance with the California Consumer Privacy Act (CCPA) this ...
Platform design liability is testing security policy as courts assess whether addictive design, algorithms, and digital products can create actionable harm | Opinion.
The bill is weaker than congressional proposals in prior years, as well as most of the 21 state consumer privacy bills already on the books.
The California Privacy Protection Agency's The agency's 1 May board meeting unpacked the agency's data broker enforcement priorities, opposition to U.S. Congress' new privacy bill and the hurdles to EU-California adequacy.
Data processing begins even before the data is received. A recent ruling of the Supreme Court of Spain clarifies the scope of GDPR obligations and the
Fashion, beauty, and wearable technology companies are entering 2026 amid a rapidly evolving data privacy landscape that will shape how brands design products, personalize customer experiences, and process personal information. 2026 brings new U.S. state omnibus consumer privacy laws, increasingly ...
While 2025 marks the first time in five years in which no new state comprehensive privacy laws were enacted, it has not been a quiet year. There has been a flurry of consumer privacy bills introduced, a number of enacted amendments and multiple states engaged in rulemaking.
Ethics researchers have warned that while data leaks and hacks are taken seriously, the threat of data misuse by ‘rogue’ researchers is flying under the radar
California lawmakers are fast-tracking A.B. 1709—a sweeping bill that would ban anyone under 16 from using social media and force every user, regardless of age, to verify their identity before accessing social platforms.That means that under this bill, all Californians would be required to ...
Stephanie Pell and Richard Salgado discuss the Electronic Communications Privacy Act and the need for improvements to the surveillance law.
This news item continues the reporting on the latest DSA developments by giving a chronological overview. It covers the period from November 2025 to February 2026. For overviews of previous developments → related links.
The IAPP's Washington, D.C., office reviews the first public draft of U.S. House Republicans' consumer privacy bill, the first major federal consumer privacy bill released in years.
Explore key 2026 CCPA changes affecting technology companies, including privacy risk assessments, AI-related oversight, and increased enforcement expectations.
This resource maps the interplays between the EU AI Act and the GDPR.
On 26 March, the European Commission escalated its approach towards digital regulation by launching a formal investigation into Snapchat's adherence to the Digital Services Act (DSA), the EU’s legal framework for accountability in digital services. At the same time, the Commission issued ...
(Series Information) European Papers - A Journal on Law and Integration, 2026 11(1), 563-594 | Article | (Table of Contents) 1. Introduction. – 2. State of the art. – 2.1. European online surveillance between content moderation and digital constitutionalism.
The 2026 IAPP Global Privacy Summit, held in Washington, D.C. from March 30 to April 2, convened over 15,000 privacy and digital responsibility professionals to address the most pressing issues at the intersection of artificial intelligence (AI), data privacy, and regulatory enforcement.
How EU proposals to “simplify” tech laws will roll back our rights in order to feed AI and undermine our rights online.
Written by: Haim Ravia, Dotan Hammer California is rolling out two significant regulatory packages that will reshape business obligations under California privacy law beginning January 1, 2026. Together, these regulations introduce comprehensive automated decision-making requirements, mandatory ...
Learn how CCPA 2026 Regulations now impose new rules on opt-out requests, correction rights, ADMT, risk assessments, and cybersecurity audits.
Is a risk assessment on your 2026 roadmap? If your website uses cookies to serve behavioral or cross context advertising, it may need to be. As many who deal with California’s privacy law are aware, in several situations using the vendors needed to serve behavioral advertising cookies can ...
Track the latest U.S. data privacy updates, state legislation, enforcement actions, and regulatory developments in 2026.
Investigation into Delve, a compliance platform that allegedly fabricated compliance certifications, generated fake auditor conclusions from certification mills, and misled hundreds of customers into believing they were compliant with HIPAA, GDPR, and other frameworks. Delves US-based auditors were actually Indian certification mills operating through empty US shells.
20 states now have comprehensive privacy laws. See which laws take effect in 2026, what's changing, and what your organization needs to know to stay compliant. Proposed: Which state privacy laws take effect in 2026? Key dates, amendments, and compliance implications for all 20 states — updated ...
By Catalina Goanta & Anda Iamnitchi Article 40 of the Digital Services Act was hailed as a breakthrough for platform research. But what does the the procedure look like in practice? Drawing on their own rejected data access request, the authors reflect candidly on early lessons for the first ...
California continues to drive national privacy and data governance standards, and with only three months into 2026, the new year is proving to be an active regulatory, enforcement and litigation...
Grammarly's new 'Expert Review' feature simulates editorial feedback as if from figures like Stephen King or Carl Sagan — without their consent. Journalist Julia Angwin filed a class action lawsuit against Grammarly's parent company Superhuman, alleging violation of privacy and publicity rights. Hundreds of writers and public figures were impersonated without permission.
🇫🇷 French: Traduction du dossier Chat Control 2.0, stopchatcontrol.fr🇸🇪 Swedish: Chat Control 2.0🇩🇰 Danish: chatcontrol.dk🇳🇱 Dutch: Chatcontrole Table of contents: The End of the Privacy of Digital Correspondence and the End of Anonymous Communication Take action to stop Chat
California continues to drive national privacy and data governance standards, and with only three months into 2026, the new year is proving to be an…
Thanos Rammos, Richard Gläser and Debbie Heywood look at what to expect in terms of EU and UK regulation and enforcement of online safety.
Explore all major privacy laws coming in 2026, upcoming enforcement timelines, and practical compliance steps. Learn how to automate multi-region privacy operations.
Privacy compliance has entered a new phase—one defined not only by high-profile enforcement actions but by the growing expectation that organizations implement and maintain mature information governance programs capable of validating true, system-level technical compliance rather than merely ...
March 2026 Treasury report draws new line between crypto privacy and crypto crime.
TakeawaysUpdated California Consumer Privacy Act rules clarify obligations related to ADMT, risk assessments, and cybersecurity audits, requiring covered businesses to adopt new procedures and safeguards.Entities may need to update policies, notices, internal processes, or vendor agreements ...
In 2026, organizations face a cyber and data landscape that is increasingly fragmented, with AI continuing to dominate debate.
Global data protection laws are expanding fast in 2026. Track key regulatory trends, regional risks and what data access governance leaders must do to stay compliant.
Drawing from the Digital Policy Alert’s daily monitoring of G20 countries, the roundup summarizes the highlights in four core areas of digital policy.
The bipartisan push to remove anonymity from the internet is ushering in an era of unprecedented mass surveillance and censorship.
The California Privacy Protection Agency's 27 Feb., board meeting provided an update into consumer deletion requests and the agencies ongoing efforts to streamline data broker compliance of the California Delete Act’s Delete Request and Opt-Out Platform ahead of the 1 Aug. deadline.
Key point: Alabama’s House passed a consumer data privacy bill, amendments advanced in Utah and Virginia, and the text of the latest CTDPA amendment was
IAPP News Editor Joe Duball rounds up the new U.S. state privacy laws and rules that came into force 1 Jan. and the potential impacts they will bring.
PrivacyWorld’s Alan Friel and Kyle Fath broke down what companies need to consider in 2026 to meet new and ongoing data laws and regulations in a Stafford
The data privacy world is evolving at a break-neck pace—what are the biggest trends in data privacy in 2026 and how should you respond?
Troubling new legislation proposes a significant change to how businesses must respond to “massive” data breach incidents.
IAPP European Operations Coordinator Laura Pliauškaitė summarizes February developments among European privacy regulators.
The US has never had a single, unified privacy law. Instead, it has long operated under a sector-based, state-influenced patchwork. The 2026 updates to California’s CCPA do not change that reality.
Includes a cure period that expires mid-2026, increasing enforcement risk. NJ also requires honoring universal opt-out mechanisms starting mid-2025. Connecticut, Oregon and Other States (Amendments Effective in 2026) Oregon privacy law is being updated effective January 1, 2026, with stricter limits on precise geolocation data and youth data. Connecticut is enhancing sensitive data definitions and youth protections effective July 1, 2026. ... New CCPA...
The portal could potentially put Washington in the unfamiliar position of appearing to encourage citizens to flout local laws.
2026 brings major CCPA updates plus new privacy laws in IN, KY, and RI—covering ADMT opt-outs, risk assessments, audits, and brokers.
Troops deployed in combat areas are at risk of being tracked and targeted by adversaries using their cellphone location data.
Poor accountability, feeble control mechanisms, and insufficient legal frameworks have led to systematic human rights violations in the Americas, with no consistent remedy or reparation to victims. What's needed is to materialize essential guarantees and measures to combat repeated surveillance...
AI’s increasing ability to sift through data and track Americans’ locations has some lawmakers reconsidering parts of the Foreign Intelligence Surveillance Act.
Commercially available bulk datasets have long been a privacy concern. LLMs could make them far more useful.
To augment information about you that it collects directly, the US Government is buying less-regulated information harvested by cameras, cellphones and apps and sold on the commercial data market.
April 14, 2026 | Jeramie D. Scott, Director EPIC's Surveillance Oversight Program · The government wants to use AI to analyze Americans’ information obtained without a warrant though purchases from data brokers and “incidental” collection from foreign intelligence surveillance.
Section 702 of the Foreign Intelligence Surveillance Act is responsible for a huge share of intel collected by the U.S. Lawmakers and civil liberties advocates are worried it enables warrantless spying on U.S. citizens.
What began as a tool to identify threats to national security is becoming a surveillance infrastructure that can be used to track everyone.
Attachment to smart devices and biometric surveillance leaves Americans more vulnerable to police searches than ever. Left unchecked it will only get worse.
Anthropic fought against the government’s misuse of its technology, but authorities are buying Americans’ data, enabling them to surveil citizens at scale
A French Navy officer uploaded a Strava workout from the deck of the Charles de Gaulle aircraft carrier, inadvertently exposing the vessel’s location as it headed toward the Middle East. The incident highlights longstanding risks from public fitness-tracking data, including operational security leaks involving military personnel and senior officials.
Patel confirms agency purchases tracking data as lawmakers push warrant requirement to close surveillance loophole.
Agencies are reportedly pooling immigration data, Social Security numbers, and more into a central database. FPF is suing to learn how deep it goes.
The UK’s tax and customs authority has been quietly amassing an arsenal of surveillance technology, signing contracts with companies that supply mobile phone tracking equipment and for downloading the content of mobile devices. Since multi-billion pound tax gaps have put HM Revenue and Customs ...
The agency is expanding detection and tracking technology projects while simultaneously loosening the reins on oversight.
We need to have a hard look at the surveillance industry. It is a key enabler of vast and untold violations of human rights and civil liberties, and it continues to be used by aspiring autocrats to threaten our very democracy. As long as it exists, the surveillance industry, and the data it ...
: After DHS’s $2.3M PenLink contract gets ‘shady’ label
Researchers strip away pseudonymity with large language models.
Bipartisan legislation seeking to establish guardrails and add transparency are surfacing ahead of a statute’s expiration that allows spy agencies to bypass court authorization.
AI tools built to guard America’s borders are now extending policing into America’s neighborhoods, as ICE begins tracking U.S. citizens.
Privacy law class action litigation has entered a new phase of heightened activity, with a surge in cases driven by technological advances, legislative changes, and evolving judicial interpretations. …
In the eight years since the General Data Protection Regulation (GDPR) became applicable, GDPR enforcement has significantly increased awareness of…
In the 7th edition of the GDPR Enforcement Tracker Report, with a cut-off date of 1 March 2026, a total number of 2,685 fines (+440 in comparison to the GDPR Enforcement Tracker Report 2025) have been recorded in the CMS Enforcement Tracker database (3,062 if fines with limited information ...
The Foreign Policy Journal is a leading news publication covering US and international politics, business, and global affairs news.
California regulators characterize this settlement as the “largest CCPA penalty in California history” and the state’s first data minimization enforcement action. The settlement signals heightened scrutiny for connected vehicle data, including precise geolocation (including parking location) ...
California privacy authorities announced a USD12.75 million settlement with General Motors over allegations the company unlawfully collected and sold Californians’ driving and location data. It marked the largest California Consumer Privacy Act penalty to date.
If 2025 was the year website-tracking claims became impossible to ignore, 2026 is the year those cases began to mature. Courts are looking beyond whether
US state privacy fines reached $3.425 billion in 2025, exceeding the prior five years combined, with enforcement set to accelerate.
The increase is being driven by powerful privacy laws in states like California, new interstate partnerships and a renewed focus on the privacy impacts of AI and automation.
GDPR fines now exceed €7.1 billion with €1.2 billion in 2025 alone. How enforcement acceleration and new state privacy laws reshape compliance strategy in 2026.
Track US state privacy law enforcement in 2026 and learn what actions your business must take with a practical, state-by-state compliance playbook.
On September 25, the California Privacy Protection Agency (CPPA) Board advanced OAL-approved updates to the California Consumer Privacy Act (CCPA), the
Sensitive-data enforcement is accelerating across U.S. and EU regimes. The FTC’s PADFAA reminder and California settlements targeting health-condition lists signal heightened scrutiny of data broker models and high-sensitivity targeting, with expectations around counterparty diligence and ...
Californians have the right to understand whether their data is being used to set individual prices they pay for items like groceries OAKLAND — In honor of Data Privacy Day, California Attorney General Rob Bonta today announced an investigative sweep focused on businesses’ use of consumers’ ...
Key point: Just one month into 2026, state lawmakers are already considering hundreds of AI and privacy related bills. In this post, we provide key
Data brokers buy up huge amounts of information from cell phones and browsers to sell for targeted advertising. But the government, including ICE, also buys the data.
Massive quantities of Americans’ personal information are being purchased by federal agencies from private brokers.
A report copublished by WIRED sparked a probe into opt-out pages hidden by data brokers. Now congressional Democrats say breaches tied to the industry have cost people tens of billions of dollars.