Privacy & Cybersecurity Law Blog

On September 30, 2026, California Governor Gavin Newsom signed legislation prohibiting employers from using certain AI-powered workplace surveillance tools to assess employees’ emotional states or collect their neural data.

On September 17, 2026, the European Data Protection Board adopted Guidelines 04/2026 on the application of administrative fines in relation to other corrective powers under the EU General Data Protection Regulation for public consultation.

On September 10, 2026, Governor Newsom signed into law SB 1119, which amends California’s existing companion chatbot law and enacts a new law, known as “Adam’s Law,” establishing comprehensive child safety requirements for companion chatbots.  

On September 10, 2026, California Governor Gavin Newsom signed AB 1709, which restricts the availability of specified addictive features on certain online platforms for users under 16 and establishes the e-Safety Advisory Commission.

On September 17, 2026, the European Commission published a proposed EU KIDS Act aimed at strengthening protections for children online.

On September 9, 2026, the Federal Communications Commission issued a final rule amending the previously issued and subsequently delayed “Revoke All” rule applicable to the Telephone Consumer Protection Act.

On September 9, 2026, the FTC withdrew its 2021 Policy Statement on Breaches by Health Apps and Other Connected Devices.

As of September 11, 2026, manufacturers of products with digital elements are subject to new incident reporting obligations under the EU Cyber Resilience Act.

On August 21, 2026, the Dutch Data Protection Authority announced that it had fined Uber €824,990,000 for infringing the rules on solely automated decision-making under the EU GDPR.

On September 2, 2026, Delaware Governor Matt Meyer signed House Bill 380, significantly expanding the Delaware Personal Data Privacy Act, effective January 1, 2027.