Privacy & Cybersecurity Law Blog

The Ministry of Public Security of the People’s Republic of China (“MPS”) recently promulgated the Measures for Public Security Organs’ Supervision and Inspection of Cyberspace Security (the “New Rules on Cyberspace Inspection”). The New Rules on Cyberspace Inspection will take effect October 1, 2026, and replace the 2018 Provisions on Internet Security Supervision and Inspection by Public Security Organs, which are simultaneously repealed.

On August 26, 2026, U.S. District Judge Yvonne Gonzalez Rogers approved a settlement between Meta Platforms Inc. and 29 state attorneys general in a federal bellwether case concerning alleged harms to children and teens from Facebook and Instagram.

On August 19, 2026, the FTC announced that it is seeking public comment on a proposed enforcement policy statement regarding personalized pricing. The proposed policy statement outlines the FTC’s legal concerns with the practice and signals the agency’s intent to pursue enforcement actions against businesses that fail to make adequate disclosures to consumers.

On August 12, 2026, President Trump issued a memorandum directing the creation of a federal program under which vetted U.S. companies may be authorized to conduct certain cyber operations against foreign cyber-enabled transnational criminal organizations under U.S. government control and oversight.

On August 11, 2026, New Jersey Governor Mikie Sherrill's signed the Kids Code Act,   imposing a range of privacy-by-default and safety-by-design obligations on online service providers whose services are reasonably likely to be accessed by minors.

The Federal Trade Commission, along with the Utah and California State Attorneys General, recently sued Hims & Hers Health, Inc., alleging that the telehealth company unlawfully shared consumers’ sensitive health information and engaged in deceptive billing and subscription cancellation practices.

Last month, the New York Attorney General released final rules implementing the Stop Addictive Feeds Exploitation for Kids Act, which takes effect on January 25, 2027.

On August 11, 2026, and August 13, 2026, the California Privacy Protection Agency (“CalPrivacy”) announced settlements with two data brokers, LocateSmarter LLC (“LocateSmarter”) and Cybba, Inc. (“Cybba”), respectively, resolving allegations that both companies failed to register as data brokers under California’s data broker law, the Delete Act.

On July 8, 2026, the European Data Protection Board adopted draft guidelines on anonymization and on web scraping in the context of generative AI, and finalized its guidelines on the processing of personal data through blockchain technologies.

On July 24, 2026, China’s cyberspace regulator issued an official Q&A clarifying cross-border data transfer requirements, including separate consent obligations, extensions for passed CAC security assessments and restrictions on overseas transfers of domestic job applicants’ resumes.