Privacy & Cybersecurity Law Blog

On September 17, 2026, the European Data Protection Board adopted Guidelines 3/2025 on the interplay between the Digital Services Act and the EU General Data Protection Regulation.

The UK ICO published a report following its scrutiny of ten of the world’s largest artificial intelligence foundation model developers operating in the UK.

Portolano Cavallo reports that organizations have until October 29, 2026, to comply with the Italian Data Protection Authority’s guidelines on the use of tracking pixels in email communications.

On September 10, 2026, California’s governor signed AB 2246, a bill that repeals and replaces the California Age-Appropriate Design Code Act.

Federal Trade Commission Chairman Andrew Ferguson recently announced plans for a new study of personalized pricing under Section 6(b) of the FTC Act.

On September 30, 2026, California Governor Gavin Newsom signed legislation prohibiting employers from using certain AI-powered workplace surveillance tools to assess employees’ emotional states or collect their neural data.

On September 27, 2026, Gov. Gavin Newsom approved AB 883, which tightens the state’s existing data broker legislation.

On September 17, 2026, the European Data Protection Board adopted Guidelines 04/2026 on the application of administrative fines in relation to other corrective powers under the EU General Data Protection Regulation for public consultation.

On September 10, 2026, Governor Newsom signed into law SB 1119, which amends California’s existing companion chatbot law and enacts a new law, known as “Adam’s Law,” establishing comprehensive child safety requirements for companion chatbots.  

On September 10, 2026, California Governor Gavin Newsom signed AB 1709, which restricts the availability of specified addictive features on certain online platforms for users under 16 and establishes the e-Safety Advisory Commission.