Privacy & Information Security Law Blog

On January 15, 2026, the UK Information Commissioner’s Office published updated guidance on international transfers of personal data under the UK GDPR.

On January 20, 2026, the UK government announced a consultation aimed at strengthening children’s well-being in the digital age. The initiative seeks to address growing concerns over the impact of mobile phones and social media on young people.

The New York Office of the Attorney General recently reached a $500,000 settlement with a New York orthopedics practice for allegedly failing to protect patient and employee information in light of a 2023 data breach.

On January 28, 2026, the Federal Trade Commission will hold a public workshop on age verification technologies.

In January 2026, new and amended comprehensive U.S. state privacy laws, as well as U.S. state laws regulating social media platforms and artificial intelligence, went into effect.

The Consumer and Governmental Affairs Bureau (“CBG”) has extended, to January 31, 2027, the effective date of the Federal Communications Commission’s (“FCC”) Telephone Consumer Protection Act (“TCPA”) “global revocation” rule.

On January 8, 2026, the California Privacy Protection Agency announced enforcement activity against Rickenbacher Data LLC d/b/a Datamasters and S&P Global Inc. for failing to register as data brokers in California.

On December 15, 2025, the Federal Trade Commission announced that it, along with 21 states and the District of Columbia, filed an amended complaint in the U.S. District for the Northern District of California alleging that Uber used unfair and deceptive billing and cancellation practices. 

On December 31, 2025, the Federal Trade Commission announced that a federal judge had approved a $10 million settlement of its complaint against Disney for alleged violation of the Children’s Online Privacy Protection Act (“COPPA”).

On December 17, 2025, the California Privacy Protection Agency announced the release of its Enforcement Advisory No. 2025-01, reminding data brokers of their obligations under California’s Delete Act.