Privacy & Information Security Law Blog

On October 13, 2025, California Governor Newsom signed into law Assembly Bill 56,  which requires social media platforms to display health warnings to users under 18 years old about the risks of social media use.

On November 4, 2025, the European Data Protection Board adopted its opinion on the European Commission’s draft decision regarding the adequacy of Brazil’s personal data protection framework. Once finalized, this decision will enable the free flow of personal data from the European Union to Brazil.

On October 10, 2025, California Governor Gavin Newsom signed Senate Bill 683, amending California’s Right of Publicity statute to add injunctive relief to the available remedies and extend protection to digital replicas.

On October 31, 2025, the UK ICO launched a public consultation on its draft Data Protection Enforcement Procedural Guidance which sets out the updated procedures for investigations and enforcement by the ICO.

On October 13, 2025, California Governor Gavin Newsom signed into law the Digital Age Assurance Act, which introduces new requirements for age verification in software applications.

On Oct 14, 2025, the Cyberspace Administration of China and the State Administration for Market Regulation issued Measures for the Certification for Outbound Cross-Border Transfer of Personal Information, effective Jan 1, 2026.

On October 21, 2025, the UK Technology Secretary announced plans to introduce an AI Growth Lab, consisting of AI sandboxes to allow companies and innovators to test new AI products in real-world conditions.

On October 20, 2025, the European Data Protection Board adopted two opinions on the European Commission’s draft decisions to extend the validity of the UK’s adequacy status until December 2031.

Wotton Kearney reports that on September 23, 2025, the New Zealand Privacy Amendment Act 2025, which introduces new privacy notification requirements that will become effective May 1, 2026, received royal assent.

On October 8, 2025, California Governor Gavin Newsom signed into law SB-361, which amends the California Delete Act to require data brokers to provide significantly more information in their registration applications with the California Privacy Protection Agency.