Privacy & Cybersecurity Law Blog

On July 6, 2026, Illinois Governor JB Pritzker signed Senate Bill 315, the Artificial Intelligence Safety Measures Act, into law, making Illinois the third state to enact comprehensive safety and transparency requirements for developers of the most advanced AI systems.

The Cybersecurity and Infrastructure Security Agency continues to finalize regulations to implement the Cyber Incident Reporting for Critical Infrastructure Act of 2022, with a final rule expected in September 2026.

On June 30, 2026, New Jersey Governor Mikie Sherrill signed a new law requiring data brokers and data collectors to register annually, pay a fee, make specified disclosures, and refrain from selling or licensing sensitive data.

John Salloum and Maryna Polataiko from Osler, Hoskin & Harcourt LLP report that Canada is contemplating a social media ban for children under 16 and other restrictions through a new online safety regime that takes aim at harmful material, platform accountability and synthetic content. 

On June 19, 2026, New Hampshire Governor Kelly Ayotte signed HB 1460 into law, amending the New Hampshire Data Privacy Act to prohibit the sale of personal data of children under the age of 13 effective January 1, 2027.

On July 7, 2026, the European Commission presented an Action Plan on Cybersecurity and Artificial Intelligence aimed at supporting the safe and responsible use of AI while strengthening cyber resilience across the European Union.

On July 8, 2026, the European Commission announced that it had referred Ireland, Spain, France, and the Netherlands to the Court of Justice of the European Union for failing to notify the Commission that they had fully transposed the NIS2 Directive into national law.

The European Data Protection Board has opened a public consultation on a new template for personal data breach notifications.

On July 2, 2026, the European Commission proposed the new Cloud and AI Development Act as part of the AI Continent Action Plan.

As reported by Bloomberg Law, a European Commission spokesperson has stated that the European Commission will assess whether the recent U.S. Supreme Court ruling in Trump v. Slaughter, which addressed the U.S. president’s authority to remove Federal Trade Commission Commissioners, could affect the validity of the EU-U.S. Data Privacy Framework.