🔒 Data Protection Regulatory Intelligence
Data Protection Monitor · dataprotection.gi
Previous editions

Archived edition for the week of 2026-09-07, as published that week.

Weekly roundup

Data Protection Monitor — 2026-09-07

100 developments, ranked within this monitor. Assembled deterministically from the most recent periodic union run for this consumer — no model wrote this page, and no other monitor's coverage affects it.

223 of 488 ranked developments are withheld because their jurisdiction emitted no evidential publication gate this cycle. They are not missing and this is not a quiet week — they are unpublished pending that gate. Gate verdicts across all 488 ranked developments: BLOCK 223, OVERRIDDEN 2, PASS 263.

165 further gate-open developments fall below this edition's cut and are held for the per-jurisdiction pages.

Developments

  1. 1

    GICross-Border & Adequacy2026-07-15

    GI no longer treated as a third country for inward EEA transfers via UK-EU Treaty Art 14(7); formal EU-Commission GDPR adequacy for GI itself remains unresolved.

    HM Government of GibraltarT1Confirmed

  2. 2

    GIRegulator & Framework2026-07-15

    Data Protection Regulations 2026 amended the Gibraltar GDPR to re-instate EU GDPR standards, in force 15 July 2026.

    Gibraltar Regulatory AuthorityT1Confirmed

  3. 4

    US-COAlgorithmic, Biometric & Surveillance Governance2026-05-14

    SB26-189 repeals/re-enacts Colorado AI law, narrowing scope to covered ADMT; predecessor SB24-205 enjoined and AG will not enforce pending rulemaking.

    Colorado General AssemblyT1Confirmed

  4. 5

    NZRegulator & Framework2026-05-01

    IPP 3A came into force 1 May 2026 (Privacy Amendment Act 2025); Statutes Amendment Act 2025 made technical clarifications in force 27 Nov 2025.

    New Zealand Ministry of JusticeT1Confirmed

  5. 6

    LUEnforcement & Redress2026-03-12

    Annulment of CNPD's EUR 746m Amazon fine, remanded on fault-based-liability grounds; new class-action framework established.

    CNPDT1Confirmed

  6. 7

    DEController/Processor Duties2026-03-04

    BVerwG dismissed BfDI's suit to enforce inspection rights over the BND (4 March 2026); 2025 complaint inputs rose 36% YoY to 11,824.

    BfDIT1Confirmed

  7. 8

    UKRegulator & Framework2026-02-05

    DUAA 2025 Part 5 amendments substantially commenced via SI 2026/82; all data-protection provisions now in force.

    legislation.gov.uk (SI 2026/82)T1Confirmed

  8. 9

    US-MNEnforcement & Redress2026-01-31

    Cure period expiry (2026-01-31) and MN AG's opposition to the federal SECURE Data Act (2026-06-02) are the two material developments this window.

    Minnesota Attorney GeneralT1Confirmed

  9. 10

    BRCross-Border & Adequacy2026-01-27

    Reciprocal EU-Brazil adequacy decisions (26-27 Jan 2026) eliminate routine SCC/BCR requirement for EU/EEA transfers, Brazil's first-ever adequacy decision.

    ANPD (gov.br)T1Confirmed

  10. 11

    SEEnforcement & Redress2026-01-26

    SportAdmin (SEK 6m, Jan 2026), Apoteket (SEK 37m) and Apohem (SEK 8m) Meta Pixel fines mark escalating enforcement; IMY's own-initiative capacity reported constrained.

    IMYT1Confirmed

  11. 13

    US-OREnforcement & Redress2026-01-01

    Mandatory 30-day cure period expired January 1, 2026; AG can now proceed directly to enforcement. SB 1587 (data-broker/immigration restriction) took effect June 5, 2026.

    Oregon Department of JusticeT1Confirmed

  12. 14

    BECross-Border & Adequacy2025-12-04

    Market Court referred 13 preliminary questions to the CJEU on GDPR Article 96's scope over pre-GDPR agreements such as FATCA, following the Litigation Chamber's finding that FPS Finance's FATCA transfers were unlawful.

    APD/GBAT1Confirmed

  13. 16

    PERegulator & Framework2025-03-31

    New implementing Reglamento (D.S. N° 016-2024-JUS) entered into force 31 March 2025, replacing the 2013 regulation.

    ANPD (gob.pe)T1Confirmed

  14. 17

    IMCross-Border & Adequacy2025-02-20

    UK Data Protection (Law Enforcement) (Adequacy) (Isle of Man) Regulations 2025 (SI 2025/89) in force 20 February 2025; EU adequacy (2004) reaffirmed January 2024 as continuing to operate satisfactorily.

    UK Legislation (legislation.gov.uk)T1Confirmed

  15. 20

    US-CTRegulator & Framework2023-07-01

    PA 25-113 (eff. 2026-07-01) and PA 26-64 (eff. 2026-10-01+) substantially amend the CTDPA, lowering the applicability threshold to 35,000 consumers, adding no-threshold sensitive-data/sale triggers, and establishing a data-broker registry.

    Connecticut Attorney GeneralT1Confirmed

  16. 21

    AFRRegulator & Framework2023-06-08

    Malabo Convention in force since 8 June 2023; only 16 of 55 AU states ratified; NADPA/RAPDP is a cooperation network, not an enforcement body.

    African UnionT1Confirmed

  17. 22

    RWEnforcement & Redress2021-10-15

    DPO Rwanda conducted a study visit to a peer DPA (15-17 July 2026) and ran ISO 31000 DPO training (27-31 July 2026), indicating continued institutional capacity-building rather than a legislative change; no named-entity enforcement action located this cycle.

    DPO Rwanda FAQsT1Confirmed

  18. 30

    LARegulator & Framework2017-05-12

    New Law on Cybersecurity (20 Mar 2026) revises the personal-data definition and creates critical-infrastructure obligations.

    Lao Services PortalT1Confirmed

  19. 31

    QARegulator & Framework2017-02-13

    Baseline established: dual mainland (PDPPL/NCGAA) and QFC (QFC DPR 2021/QFC DPO) regimes.

    National Cyber Governance and Assurance Affairs (NCGAA)T1Confirmed

  20. 35

    CA-BCLawful Processing & Special Datadate pending

    OIPC-OPC joint investigation found PIPA does not enable OpenAI to establish implicit consent for AI training/processing.

    Office of the Information and Privacy Commissioner for BCT1Confirmed

  21. 36

    RSRegulator & Frameworkdate pending

    New Law on Personal Data Protection reported to have progressed significantly during 2025, aimed at AI/advanced-tech alignment; draft text not yet public.

    Commissioner for Information of Public Importance and Personal Data ProtectionT1Confirmed

  22. 37

    UYCross-Border & Adequacydate pending

    URCDP Resolution No. 8/2026 (17 April 2026) recommends model clauses for international data transfers, extending transfer-mechanism guidance.

    European CommissionT1Confirmed

  23. 39

    SIRegulator & Framework2023-01-26

    ZVOP-2 confirmed in force since 26 January 2023; IP is sole DPA; two amendments (ZInfV-1, ZP-1L) confirmed.

    Informacijski pooblaščenec (IP)T1Confirmed

  24. 42

    ISRegulator & Framework2018-07-15

    GDPR incorporated via EEA Agreement into Act No. 90/2018; Persónuvernd is sole DPA.

    Althingi (Icelandic Parliament)T1Confirmed

  25. 43

    UARegulator & Framework2011-01-01

    Ombudsman-embedded model persists; Draft Law 8153 GDPR-alignment reform remains pre-second-reading.

    Verkhovna Rada Legal Database (zakon.rada.gov.ua)T1Confirmed

  26. 44

    EERegulator & Frameworkdate pending

    AKI remains the sole supervisory authority; a 2025-effective amendment grants AKI collective-redress standing.

    Andmekaitse Inspektsioon (AKI)T1Confirmed

  27. 45

    US-DCController/Processor Dutiesdate pending

    Binding breach-notification duty confirmed with 50-resident AG-notice threshold and 18-month identity-theft protection for SSN/TIN breaches.

    DC Office of the Attorney GeneralT1Confirmed

  28. 48

    US-WAAlgorithmic, Biometric & Surveillance Governance2026-03-30

    SB 6002 (Driver Privacy Act) signed 2026-03-30, WA's first comprehensive ALPR statute limiting retention to 21 days and barring immigration-enforcement/protected-activity tracking use.

    ACLU of WashingtonT2Confirmed

  29. 50

    IEEnforcement & Redress2025-01-01

    €530M TikTok fine (2025, under appeal); January 2026 FOI disclosure shows €4.02bn of €4.04bn cumulative fines uncollected.

    RTET2Confirmed

  30. 52

    US-ILChildren & Vulnerable Groups2026-07-31

    Children's Online Social Media Safety Act (HB5511/P.A. 104-0664) signed 31 July 2026, requiring OS-level age-signal interface by 1 Jan 2028.

    Office of Governor JB PritzkerT2Confirmed

  31. 53

    PEEnforcement & Redress2026-05-14

    760 inspections in 2025 (up 67% YoY), 136 sanctioning procedures, fines exceeding S/11 million; 301 inspections/52 procedures YTD to 14 May 2026.

    LexLatinT2Confirmed

  32. 57

    US-CARegulator & Framework2026-01-01

    CPPA's comprehensive Sept 2025-adopted regulations package (cybersecurity audits, risk assessments, ADMT) became effective January 1, 2026.

    California Privacy Protection AgencyT1Confirmed

  33. 58

    US-ORAdTech & Commercial Privacy2026-01-01

    Universal opt-out signal recognition, geolocation-data-sale ban, and minors'-data-sale ban all took effect January 1, 2026 under HB 2008.

    Oregon Department of JusticeT1Confirmed

  34. 60

    US-KYRegulator & Framework2026-01-01

    KCDPA (KRS 367.3611-367.3629) took effect January 1, 2026; AG's Office of Data Privacy has exclusive enforcement authority.

    Kentucky Attorney General — Office of Data PrivacyT1Confirmed

  35. 61

    US-RIRegulator & Framework2026-01-01

    RIDTPPA (R.I. Gen. Laws ch. 6-48.1) took effect January 1, 2026, enforced exclusively by the RI Attorney General with no private right of action.

    Rhode Island General LawsT1Confirmed

  36. 62

    US-ALController/Processor Duties2018-06-01

    Applicability thresholds (>25,000 consumers, or material revenue share from data sales) are the principal accountability trigger; no DPIA/DPO/ROPA requirement identified, a departure from peer-state models.

    Alabama Attorney General's OfficeT1Confirmed

  37. 63

    MYRegulator & Framework2010-06-02

    Personal Data Protection (Amendment) Act 2024 fully commenced across three phases, in force as of 1 June 2025.

    Department of Personal Data Protection (JPDP)T1Confirmed

  38. 65

    US-VTRegulator & Framework2026-06-16

    S.71/Act 145 (VDPOSA) enacted June 16, 2026, effective January 1, 2028; AG sole enforcer.

    Vermont General Assembly — Bill Status S.71 (Act 145)T1Confirmed

  39. 67

    ITAlgorithmic, Biometric & Surveillance Governance2026-07-09

    Character.AI fine, deepfake ruling, facial-recognition decree dispute, and OpenAI fine annulment all active this cycle.

    Garante per la protezione dei dati personaliT1Confirmed

  40. 68

    NOEnforcement & Redress2026-06-05

    Elkjøp fined NOK 20 million (2026); Borgarting Court of Appeal dismissed Grindr's final appeal in August 2025, leaving the NOK 65 million fine (Norway's largest GDPR fine) in place.

    DatatilsynetT1Confirmed

  41. 69

    US-COChildren & Vulnerable Groups2025-10-01

    SB24-041 adds age-appropriate design code and minor-data protections, effective Oct 1, 2025; notice-and-cure mechanism sunsets Dec 31, 2026.

    Colorado General AssemblyT1Confirmed

  42. 70

    US-NJRegulator & Framework2025-01-15

    A5328 (P.L.2026, c.25) signed 2026-06-30 amending the NJDPA to add a data-broker/data-collector registration regime and sensitive-data sale ban, effective immediately.

    NJCCICT1Confirmed

  43. 73

    NLAlgorithmic, Biometric & Surveillance Governancedate pending

    Record €824,990,000 Uber fine (21 Aug 2026) for automated driver-deactivation decisions, following the earlier Clearview AI biometric-data fine.

    Autoriteit PersoonsgegevensT1Confirmed

  44. 74

    SECross-Border & Adequacydate pending

    IMY fined Apoteket (SEK 37m) and Apohem (SEK 8m) for Meta Pixel sensitive-data transfers without adequate safeguards; continued Google Analytics transfer-safeguard enforcement.

    IMYT1Confirmed

  45. 75

    DERegulator & Framework2026-05-30

    BfDI leadership transition (Hennemann elected) and DADG Data Act personal-data competence entered into force 30 May 2026.

    BfDIT1Confirmed

  46. 76

    US-MSController/Processor Duties2026-04-08

    HB1596 imposes written information-security-program, qualified-individual, and breach-notification obligations on MTL licensees, effective July 1, 2026.

    Mississippi Legislature Bill Status System (HB1596)T1Confirmed

    Also tracked by financial-integrity:D6

  47. 77

    US-MSRegulator & Framework2026-04-01

    HB1220 creates a cybersecurity liability safe harbor and amends the Insurance Data Security Law, effective July 1, 2026.

    Mississippi Legislature Bill Status System (HB1220)T1Confirmed

  48. 79

    CA-QCAlgorithmic, Biometric & Surveillance Governance2023-09-22

    CAI decision prohibiting Metro Inc. from operating a biometric-characteristics database, evidencing active supervisory scrutiny of biometric processing.

    Commission d'accès à l'information du QuébecT1Confirmed

  49. 87

    BRChildren & Vulnerable Groups2026-08-25

    25 Aug 2026: ANPD sanctioned a social-media platform R$153,769,671.33 for LGPD violations in processing children's/adolescents' data -- among the largest ANPD fines on record.

    Daniel LawT3Confirmed

  50. 88

    NLEnforcement & Redress2026-08-21

    The Uber fine, the Council of State's annulment of the Enschede fine, and the ten-municipality fine package together constitute the single most material development in this cycle's NL sweep.

    GblockT3Confirmed

  51. 89

    US-VAAdTech & Commercial Privacy2026-07-01

    SB338 (2026 c.820) prohibits sale of consumers' precise geolocation data, effective 1 July 2026; Virginia does not require GPC recognition and retains a permanent cure period.

    Regulatory Oversight (Baker Donelson)T3Confirmed

  52. 91

    CA-BCRegulator & Framework2026-02-18

    Bill 9 (FIPPA amendments) introduced Feb 26 2026; Clearview AI Court of Appeal confirms PIPA's extraterritorial application; PIPA itself remains unreformed despite OIPC advocacy.

    FaskenT3Confirmed

  53. 92

    UKEnforcement & Redress2026-02-05

    DUAA raises ICO's maximum PECR penalty to GDPR-parity level (£17.5m or 4% global turnover), up from £500,000 fixed cap, effective 5 Feb 2026.

    Osborne ClarkeT3Confirmed

  54. 93

    US-CAController/Processor Duties2026-01-01

    Mandatory cybersecurity audits and ADMT/risk-assessment obligations became operative January 1, 2026, a substantial expansion of accountability duties.

    Ervin Cohen & Jessup LLPT3Confirmed

  55. 94

    US-NHEnforcement & Redress2026-01-01

    Mandatory 60-day AG cure period expired 1/1/2026, shifting to full enforcement discretion; data-broker registration bill HB1694 failed February 2026.

    PrivacyLawMapT3Confirmed

  56. 95

    US-OKController/Processor Duties2026-01-01

    SB 626 (eff. 2026-01-01, in force) expands breach-notification duties to include biometric data and online-account credentials, with mandatory 60-day AG notification; SB 546 adds DPIA and security-practice duties, not yet in force.

    Constangy Brooks & PropheteT3Confirmed

    Also tracked by world-payments:W1b

  57. 96

    INRegulator & Framework2025-11-13

    DPDP Rules 2025 notified 13 Nov 2025; DPBI established immediately; staggered 3-phase commencement schedule through 13 May 2027.

    Baker BottsT3Confirmed

  58. 98

    MYController/Processor Duties2025-06-01

    Mandatory breach notification (72hrs to Commissioner, 7 days to data subjects), mandatory DPO appointment, and direct processor liability under s.9 all fully in force since 1 June 2025 / 1 April 2025.

    DLA PiperT3Confirmed

  59. 99

    US-NYController/Processor Duties2024-12-21

    Dec 2024 SHIELD Act amendment introduced a firm 30-day breach-notification deadline (replacing 'most expedient time possible') plus a new DFS-notification requirement for DFS-regulated entities.

    Ropes & Gray via JD SupraT3Confirmed

  60. 103

    PLEnforcement & Redressdate pending

    2025 record enforcement year (>PLN 64m); Warsaw court overturned the PLN 27m Poczta Polska fine; UODO fined the Nawrocki Presidential Electoral Committee PLN 35,500; enforcement intensifying on employee-monitoring and HR health-data practices.

    CMS GDPR Enforcement TrackerT3Confirmed

  61. 104

    US-ORAlgorithmic, Biometric & Surveillance Governance2027-01-01

    SB 1546 (AI companion chatbot law, signed March 31, 2026, effective January 1, 2027) imposes transparency, mental-health-safeguard, and disclosure mandates with a private right of action.

    LegiScanT3Confirmed

  62. 108

    US-OKRegulator & Framework2026-03-20

    Governor Stitt signed SB 546, enacting the Oklahoma Consumer Data Privacy Act, effective 2027-01-01, with exclusive AG enforcement.

    WilmerHaleT3Confirmed

  63. 117

    IDRegulator & Framework2022-09-20

    UU PDP fully enforceable since 17 Oct 2024 but the PDP Agency remains unestablished; a June 2026 Constitutional Court petition challenges the lack of a statutory deadline.

    Pertama PartnersT3Confirmed

  64. 124

    US-SCChildren & Vulnerable Groups2026-02-05

    Act No. 96 requires default-off engagement/discovery features (messages, comments, personalized-recommendation algorithms) for minors under 18 unless affirmatively enabled.

    Bloomberg LawT3Confirmed

  65. 125

    US-ARRegulator & Framework2025-07-01

    APDPA (eff. 2025-07-01) is a hybrid comprehensive-privacy overlay alongside breach-notification-only PIPA; both enforced by the Arkansas Attorney General.

    Arkansas Attorney GeneralT1Confirmed

  66. 130

    US-NEEnforcement & Redress2025-06-12

    Nebraska AG filed a June 12, 2025 consumer-protection lawsuit against Temu alleging malware-like data exfiltration without consent; no private right of action exists under NDPA or AAODCA.

    Nebraska Attorney GeneralT1Confirmed

  67. 131

    NZEnforcement & Redress2026-05-01

    OPC pursuing compliance notices against Manage My Health/Health NZ; Green Party proposed raising maximum privacy penalties to NZ$10 million for firms (10 Jun 2026), amid Commissioner's own call for higher civil-penalty powers.

    LinklatersT2Confirmed

  68. 132

    US-INEnforcement & Redress2026-01-01

    AG may seek injunction/civil penalty up to $7,500/violation after 30-day cure period; active enforcement begins July 1, 2026, a six-month grace period beyond the Jan 1 2026 effective date.

    Koley JessenT3Confirmed

  69. 133

    US-INRegulator & Framework2026-01-01

    ICDPA (SEA 5, IC 24-15) effective January 1, 2026; enforced exclusively by Indiana AG.

    Hunton Andrews Kurth Privacy BlogT3Confirmed

  70. 134

    US-ORData Subject Rights2026-01-01

    Mandatory universal opt-out preference signal (e.g. Global Privacy Control) recognition took effect January 1, 2026.

    Oregon Department of JusticeT1Confirmed

  71. 135

    BEController/Processor Duties2025-05-14

    Strategic Plan demands demonstrable accountability logs; Market Court confirms IAB Europe as joint controller for TCF TC-String processing.

    APD/GBAT1Confirmed

  72. 136

    US-NYRegulator & Framework2025-03-21

    No dedicated DPA exists; SHIELD Act (AG-enforced) remains the sole general-purpose statute; NY Privacy Act (S8158/A8158) remains in committee.

    Bleakley PlattT3Confirmed

  73. 137

    BEEnforcement & Redress2022-02-02

    Active caseload includes the IAB Europe TCF annulment (7 January 2026) and the FATCA/FPS Finance CJEU referral (4 December 2025); historical fines up to EUR 250,000 (IAB Europe) and EUR 174,640 (Decision 07/2024).

    APD/GBAT1Confirmed

  74. 138

    NPRegulator & Framework2018-09-18

    No independent DPA exists; MoCIT holds adjacent competence under the Individual Privacy Act 2075 and Privacy Regulation 2077.

    DLA Piper Data Protection Laws of the WorldT3Confirmed

  75. 139

    HKRegulator & Frameworkdate pending

    PCPD remains sole independent supervisory authority; Protection of Critical Infrastructures (Computer Systems) Ordinance came into full force 1 January 2026, adding a cybersecurity layer outside the PDPO.

    Linklaters Tech Insights — PCPD updated Data Breach GuidanceT3Confirmed

  76. 142

    US-NJEnforcement & Redress2026-07-01

    The NJDPA's mandatory 30-day cure period ended 2026-07-01; the Division of Consumer Affairs can now proceed directly to penalty calculation. A5328 adds $2,500/day non-registration penalties and $50,000/record sensitive-data-sale penalties.

    PrivacyLawMap — cure-period/AG detailT4Confirmed

  77. 143

    US-CAAdTech & Commercial Privacy2026-05-01

    Active, intensifying enforcement against non-compliant opt-out/tracking implementations: PlayOn Sports, Ford, Disney, General Motors actions in Q1-Q2 2026.

    ReflectizT4Confirmed

  78. 145

    BEAdTech & Commercial Privacy2026-01-07

    Market Court annulled the APD's 2023 IAB Europe TCF validation on 7 January 2026, requiring re-validation with narrower scope; RTL Belgium fined EUR 50,000 for non-compliant cookie banners.

    Secure PrivacyT4Confirmed

  79. 149

    MYEnforcement & Redress2025-06-01

    Maximum PDPA penalty raised to RM1,000,000 with imprisonment extended to 3 years under the 2024 Amendment Act.

    InCorp MalaysiaT4Confirmed

  80. 150

    LTEnforcement & Redressdate pending

    2024 annual enforcement statistics, June 2026 doctor fine, and May 2026 decision cluster establish active enforcement baseline.

    GRIP (Global Relay)T2Confirmed

  81. 152

    US-NERegulator & Framework2026-07-17

    NDPA in force since Jan 2025; three new 2026 statutes (Agricultural Data Privacy Act, Conversational AI Safety Act, AAODCA amendment) layer additional sectoral instruments effective July 17, 2026.

    Nebraska Legislature — LB525 Slip LawT1Confirmed

  82. 153

    US-OKData Subject Rights2026-03-23

    SB 546 grants access, correction, deletion, portability and opt-out rights, effective 2027-01-01.

    Oklahoma House of RepresentativesT1Confirmed

  83. 154

    US-KYEnforcement & Redress2026-01-01

    AG's Office of Data Privacy brought its first case Jan 8, 2026, seven days after KCDPA took effect, evidencing immediate regulator capacity and enforcement posture.

    Kentucky Attorney General — Rights of Kentuckians under the KCDPAT1Confirmed

  84. 155

    GRController/Processor Duties2022-01-27

    COSMOTE (EUR 6m) and OTE (EUR 3.25m) fined for inadequate DPIA/security-by-design; telecoms provider fined EUR 40,000 for breach-notification failure.

    EDPBT1Confirmed

  85. 156

    EEAlgorithmic, Biometric & Surveillance Governancedate pending

    Statutory ADM/profiling prohibition confirmed; state-surveillance carveout directly relevant to the PPA/KAPO review.

    Riigi Teataja — Isikuandmete kaitse seadus (ADM provision)T1Confirmed

  86. 157

    US-VALawful Processing & Special Data2026-07-01

    2026 amendment (SB338/c.820) adds a specific consent/necessity gate for collecting precise geolocation data from a known child.

    Virginia LIS — Enrolled Act CHAP0820T1Probable

  87. 158

    US-COLawful Processing & Special Datadate pending

    SB25-276 adds precise geolocation data as covered Sensitive Data requiring opt-in consent.

    Colorado Attorney GeneralT1Probable

  88. 165

    CA-QCEnforcement & Redressdate pending

    Statutory SAP up to $10M/2% and penal fines up to $25M/4% confirmed; Metro Inc. biometric decision is a concrete recent-enforcement example this cycle.

    GAM Tech (vendor commentary)T4Confirmed

  89. 166

    US-NJLawful Processing & Special Data2026-06-30

    A5328 imposes an absolute ban on the sale of sensitive data, applying even to entities otherwise below NJDPA applicability thresholds, with penalties of $50,000 per record.

    McDermott Will & EmeryT3Confirmed

  90. 169

    US-ALSectoral Watch2026-09-05

    ALDPA exempts HIPAA, FCRA, FERPA, DPPA, Farm Credit Act, Airline Deregulation Act data, and Title 8 Ch. 7A money-transmission licensees.

    Alabama Secretary of State (HB351 Enrolled Act text)T1Confirmed

  91. 170

    US-VTChildren & Vulnerable Groupsdate pending

    AG active rulemaking under Vermont AADC (Act 63) §§2449f/2449g, proposed rules published for comment.

    Office of the Vermont Attorney GeneralT1Confirmed

  92. 171

    US-ALRegulator & Framework2026-09-05

    Alabama enacted ALDPA (HB351), its first comprehensive consumer-privacy statute, effective 2027-05-01, enforced solely by the AG.

    Recording LawT3Confirmed

  93. 172

    US-RIEnforcement & Redress2026-01-01

    RIDTPPA violations are deceptive trade practices carrying civil penalties up to $10,000/violation, no cure period, no private right of action; zero enforcement actions reported yet since Jan 1 2026.

    WilmerHaleT3Confirmed

  94. 174

    SARegulator & Framework2023-09-07

    SDAIA consultation on Implementing Regulations amendments remains open/unconfirmed as of this cycle.

    Clyde & CoT3Confirmed

  95. 175

    US-MASectoral Watch2026-02-26

    MGC granted DraftKings a conditional waiver over a crypto-to-cash segregation tool with full transaction-reporting and audit conditions; c.169B MTL regime layers onto existing GLBA/BSA data-handling duties for licensees.

    Massachusetts Gaming CommissionT1Confirmed

  96. 176

    BRRegulator & Framework2026-02-01

    ANPD converted to full autonomous regulatory-agency status via Law 15.352 (Feb 2026), ending ~5 years of largely educational enforcement posture.

    Compliance WeekT3Probable

  97. 177

    GRAdTech & Commercial Privacy2026-01-01

    HDPA launched EDPB's 2026 Coordinated Enforcement Framework action on transparency; cookie-specific formal enforcement still building.

    HDPAT1Confirmed

  98. 178

    US-VAChildren & Vulnerable Groups2026-01-01

    AG announced (18 Feb 2026) intent to fully enforce SB854 minor social-media time restrictions, moving to dismiss NetChoice's First Amendment/Commerce Clause challenge; litigation ongoing.

    Hunton Andrews Kurth Privacy BlogT3Probable

  99. 179

    SAEnforcement & Redress2024-09-14

    SDAIA reported 48 formal enforcement decisions in the year to early 2026, confirming active post-grace-period enforcement; penalties up to SAR 5 million per breach.

    Global Privacy & Security Compliance BlogT3Probable

  100. 180

    PHLawful Processing & Special Datadate pending

    NPC Advisory No. 2026-01 sets guidelines on when scraping of publicly available personal data is deemed unauthorized under the DPA and its IRR.

    National Privacy CommissionT1Confirmed

Regulatory horizon