Roundup
Data Protection Monitor — 2026-10-25
Assembled deterministically from our recent research runs and ranked by date and importance.
New or updated since 2026-10-18
New to this edition or changed since the last one.
- 1
- 2
US-NM · Algorithmic, Biometric & Surveillance Governance · 2026-08-06
The Aug 6, 2026 Meta judgment created a court-ordered, Meta-funded Child Safety Monitor with independent-researcher audit rights over recommendation systems, now a standing feature of this jurisdiction's algorithmic-governance landscape.
- 3
US-LA · Regulator & Framework · 2026-05-29
LDPA (R.S. 51:1780.1-1780.5) creates a comprehensive consumer-privacy statute, effective 2027-01-01, with AG-exclusive enforcement.
- 4
PH · Children & Vulnerable Groups · 2026-09-22
NPC Show Cause Orders (22 Sept 2026) against Meta, Roblox, Reddit, Discord remain unresolved, framed around youth protection.
- 5
US-AL · Regulator & Framework · 2026-04-16
APDPA enacted, Act No. 2026-552, correcting prior stale no-framework record.
- 6
US-OR · Enforcement & Redress · 2026-01-01
Mandatory 30-day cure period sunset 1 Jan 2026; AG may now proceed directly to enforcement without prior notice; no new enforcement action found in-window.
- 7
NG · Algorithmic, Biometric & Surveillance Governance · 2026-10-25
NDPC's 20 Oct 2026 NITHUB Frontier AI consultation mandated algorithmic transparency and privacy-by-design; 25 Oct 2026 statement warned against unauthorised use of faces/voices.
- 8
US-IA · Enforcement & Redress · 2026-10-14
Four new Consumer Fraud Act filings touching data/privacy risk within a nine-day window (2026-10-06 to 2026-10-14): TP-Link, ADI Global, Lorex, OpenAI.
- 9
MZ · Controller/Processor Duties · 2026-09-29
Cybersecurity Law (Lei n.º 13/2026) entered into force 29 Sept 2026.
- 10
SE · Controller/Processor Duties · 2026-09-22
IMY fined Miljödata SEK1.8m for Article 32(1) security failure.
- 11
US-VA · Lawful Processing & Special Data · 2026-07-01
SB338 precise-geolocation sale ban in force 2026-07-01.
- 12
CA-NB · Regulator & Framework · date pending
RTIPPA legislative review (18 June 2026) recommends biometric and AI/ADM definitions; no bill tabled.
- 13
- 14
US-NE · Children & Vulnerable Groups · 2026-04-14
LB838 materially amends the Age-Appropriate Online Design Code Act, effective July 17, 2026.
Also tracked by financial-integrity:D3
- 15
- 16
US-TX · Algorithmic, Biometric & Surveillance Governance · 2026-10-23
TRAIGA enforcement portal active; OpenAI/Sam Altman suit filed Oct 23, 2026 under DTPA/SCOPE Act.
- 17
CM · Regulator & Framework · date pending
Law No. 2024/017 (23 Dec 2024) creates the APDP, Cameroon's first dedicated personal-data-protection authority; organisational decree not yet located.
- 18
HR · Enforcement & Redress · date pending
AZOP approximately EUR 2.59m fine against unnamed gambling operator over biometric processing.
- 19
US-MI · Sectoral Watch · 2026-09-29
Michigan AG announced $2.3M multistate Labcorp/AMCA settlement on 2026-09-29.
- 20
CL · Regulator & Framework · 2026-02-05
Senate Constitution Committee approved a bill (Boletín N°18.623-07) in general, unanimously, to postpone Ley 21.719's effective date from 1 Dec 2026 to 1 Dec 2027; APDP Consejo Directivo remains unappointed after the Senate rejected the first nominee slate on 20 May 2026.
- 21
VU · Algorithmic, Biometric & Surveillance Governance · date pending
Annual ICT service permit for ICT service providers including AI and AI-related data services
- 22
US-CT · Enforcement & Redress · 2026-10-01
New DCP $200/day/consumer penalty for data-broker deletion-mechanism violations under PA 26-64, effective 2026-10-01.
- 23
US-SD · Lawful Processing & Special Data · 2026-07-01
SB 49 adds an express-consent requirement for genetic data collected by DTC testing companies, effective 2026-07-01.
- 24
US-KS · Sectoral Watch · 2026-04-16
HB 2591 extends Financial Institutions Information Security Act coverage to earned-wage-access registrants.
Also tracked by crypto:crypto_licensing
- 25
US-IL · Lawful Processing & Special Data · 2026-04-01
7th Circuit confirmed BIPA damages amendment applies retroactively.
- 26
NP · Regulator & Framework · date pending
IT and Cyber Security Bill 2082's enactment status remains disputed between sources; no independent DPA exists.
- 27
PE · Enforcement & Redress · date pending
ANPD inspections up 67% YoY in 2025; continuing high-volume enforcement into 2026 with e-commerce newly prominent.
- 28
US-HI · Sectoral Watch · 2026-10-19
Oct 19, 2026 Labcorp/AMCA multistate (44-AG) settlement enforces HIPAA-adjacent vendor-management duties via a consumer-protection action.
- 29
CA · Enforcement & Redress · 2026-10-14
OPC closed its WestJet investigation on 14 October 2026; Bill C-36 would introduce AMPs up to the greater of $25M or 5% of global revenue.
- 30
GI · Regulator & Framework · 2026-07-15
Data Protection Regulations 2026 in force 15 July 2026, amending the Gibraltar GDPR and DPA04.
- 31
KZ · Regulator & Framework · 2026-06-24
Law No. 326-VIII amendments enter into force 25 August 2026; implementing Rules entered into force 12 July 2026.
- 32
US-NH · Children & Vulnerable Groups · 2026-06-19
HB 1460 bans the sale of a known child's personal data, effective 1 January 2027.
- 33
LU · Lawful Processing & Special Data · 2026-03-12
Administrative Court judgment No. 52757C (12 March 2026) on Amazon's legitimate-interest basis and fine annulment/remand.
- 34
US-WY · Regulator & Framework · 2026-03-06
SF0020 (government-entity personal-data statute) enacted March 6, 2026, alongside continued absence of a comprehensive consumer-privacy statute or dedicated regulator.
- 35
BD · Enforcement & Redress · 2026-02-05
Feb 2026 Amendment Ordinance replaced imprisonment for managing directors with monetary fines only; no enforcement decision on record yet.
- 36
- 37
IM · Enforcement & Redress · date pending
ICO increased published regulatory action (Cabinet Office reprimand, 10 Aug 2026); Dept of Infrastructure decision notice (16 Oct 2026) just outside window.
- 38
TH · Algorithmic, Biometric & Surveillance Governance · date pending
PDPC/ETDA published AI data-protection guidelines v1.0 on 7 October 2026 (advisory, not binding); prior biometric-deletion order against World/Worldcoin-linked operator remains the benchmark enforcement action.
- 39
UA · Enforcement & Redress · 2026-10-23
Draft Law No. 8153 penalty ceiling (UAH 90m / 5% turnover) confirmed still proposed; National Programme June 2026 target missed.
- 40
US-CO · Algorithmic, Biometric & Surveillance Governance · 2026-05-14
SB 26-189 ADMT Act interim draft rules and formal rulemaking hearing
- 41
US-NY · Enforcement & Redress · 2026-10-16
BCHP/XTIUM $2.7M settlement (16 Oct 2026) continues an active 12-month enforcement pattern (23andMe, Labcorp, accounting-firm settlement).
- 42
BG · Regulator & Framework · 2026-10-01
EU Commission October 2026 DSA assessment found CPDP's Art. 49 supervisory role left unempowered and a penalty-provision flaw.
- 43
CA-BC · Data Subject Rights · 2026-10-06
PIPA s.23(1) access order issued against a strata corporation, published ~6 Oct 2026, within this cycle's window.
- 44
BZ · Controller/Processor Duties · date pending
Breach-notification timing disputed between two secondary sources (72-hour vs 3-day default); neither confirmed against primary text.
- 45
- 46
- 47
UY · Enforcement & Redress · date pending
Disputed figure on database-suspension length (5 days vs 6 working days) between two sources.
- 48
EG · Enforcement & Redress · 2026-10-31
Grace period under the Executive Regulations expires 31 Oct/1 Nov 2026; no PDPC enforcement decision yet located.
- 49
PW · Controller/Processor Duties · 2026-10-25
Mandatory breach-notification duty for government agencies under RPPL 12-8; immediate reporting duty under Digital Residency Program regulation.
- 50
US-VT · Enforcement & Redress · 2026-06-16
VDPOSA enforced exclusively by the Attorney General, up to $10,000 per violation, no private right of action, 60-day cure period 2028-01-01 to 2029-06-30.
- 51
- 52
- 53
EC · Regulator & Framework · date pending
LOPDP in force since 2021; SPDP operational since Sept/Oct 2024; 2026 Institutional Regulatory Plan set the secondary-rulemaking agenda.
- 54
EE · Sectoral Watch · 2026-10-21
New 936 SE financial-fraud-prevention law creates a personal-data-sharing gateway between PSPs, banks, police and CERT-EE; GDPR legal-basis interaction unconfirmed.
Also tracked by financial-integrity:D7, world-payments:W10
- 55
RU · Algorithmic, Biometric & Surveillance Governance · date pending
Internet-governance regulation effective March 2026 authorises Runet disconnection/site-blocking; VPN-hosting-register bill reported 8 Oct 2026 would add ~RUB60bn traffic-filtering funding and a hosting-provider register.
- 56
- 57
PL · Algorithmic, Biometric & Surveillance Governance · 2026-07-03
Act of 3 July 2026 on AI Systems establishes KRiBSI as sole AI Act market-surveillance authority; UODO's role is advisory (non-voting), a position UODO has publicly criticised.
- 58
PA · Cross-Border & Adequacy · 2026-03-26
ANTAI Resolution ANTAI-DG-003-2026 approved the RIPD Standard Contractual Clauses as a concrete transfer mechanism.
- 59
TN · Regulator & Framework · date pending
Reform bill enactment status disputed; INPDP council mandate reportedly unrenewed; digital-rights forum calls for INPDP reactivation.
- 60
US-WA · Algorithmic, Biometric & Surveillance Governance · date pending
HB 1170 (AI provenance, effective 2027-02-01), RCW 19.375 biometric regime confirmed, SB 5956 pending.
- 61
US-DE · Regulator & Framework · 2026-09-02
HB 380 substantially amends the DPDPA, effective 2027-01-01.
- 62
US-SC · Children & Vulnerable Groups · 2026-02-05
AADC (Act No. 96) newly documented as in-force standing baseline.
- 63
IN · Regulator & Framework · 2026-08-25
DPDP (Removal of Difficulties) Order 2026 issued; Consent Manager registration commences 13/14 Nov 2026.
- 64
VN · Enforcement & Redress · 2026-08-19
Decree 330/2026/ND-CP supplies first dedicated administrative-sanctions framework; no named enforcement decision located yet.
- 65
- 66
SN · Cross-Border & Adequacy · 2026-08-20
Loi n°25/2026 (adopted 20 Aug 2026) imposes a new public-sector data-localisation obligation; implementing decrees not yet confirmed.
- 67
CZ · Algorithmic, Biometric & Surveillance Governance · 2026-08-02
EU AI Act high-risk requirements directly enforceable from 2 Aug 2026; Czech Adaptation Act remains draft.
- 68
- 69
US-MN · Algorithmic, Biometric & Surveillance Governance · 2026-05-26
Minn. Stat. §325M.40 (Laws 2026 ch. 111), signed 2026-05-26, creates a $10,000 statutory-damages claim for a child or parent over addictive/algorithmic social-media design features, effective 2027-07-01.
- 70
US-GA · Algorithmic, Biometric & Surveillance Governance · 2026-05-11
SB 540 (Conversational AI Safety Act, O.C.G.A. §39-5-6) and SB 444 (O.C.G.A. §33-46-7.1), both signed May 11, 2026, impose new minor-protection and AI-utilization-review duties; neither yet in force (effective Jul 1 2027 / Jan 2027 respectively).
- 71
DZ · Algorithmic, Biometric & Surveillance Governance · 2026-05-06
ANPDP Decisions 02 (video surveillance) and 03 (biometric attendance) confirmed; no ADM-specific statutory test located.
- 72
RS · Regulator & Framework · date pending
Draft replacement law published 30 July 2026, consultation closed 10 September 2026, proposing to expand 102 to 175 articles.
- 73
AG · Algorithmic, Biometric & Surveillance Governance · 2026-06-18
Electronic Crimes (Amendment) Act (reported June 2026) strengthens law-enforcement production-order powers over electronic data; a criminal-procedure instrument distinct from the DPA's own national-security exemption.
- 74
CN · Enforcement & Redress · date pending
Amended CSL raised maximum fines to RMB 10 million; named 13 June 2026 Shanghai CAC enforcement action against an online travel platform.
- 75
FR · Controller/Processor Duties · 2026-09-23
CNIL closed FRANCE TRAVAIL and GOOGLE injunctions this cycle, confirming compliance.
- 76
- 77
- 78
SK · Cross-Border & Adequacy · date pending
UK adequacy extended to 27 Dec 2031 via EU-wide implementing decisions.
- 79
US-NJ · Enforcement & Redress · 2026-07-01
Mandatory 30-day cure period sunset 2026-07-01; 10 cure letters issued between 2025-03-24 and the cure period's close.
- 80
UK · Algorithmic, Biometric & Surveillance Governance · 2026-10-08
ICO opened agentic-AI call for evidence (8 Oct-20 Nov 2026) with developer-commitments supervisory report and live enquiries into agentic-AI testing incidents.
Also tracked by aic:authorities_and_enforcement
- 81
CR · Regulator & Framework · date pending
Prodhab maintains three open investigative files (opened Sept 2026) into an alleged dark-web exposure of Costa Ricans' personal data; no resolution this cycle.
- 82
KM-A · Regulator & Framework · date pending
Sources materially disagree on whether a comprehensive data-protection law was ever enacted.
- 83
SA · AdTech & Commercial Privacy · date pending
Marketing without consent remains the most cited SDAIA enforcement violation category; draft amendments touch the Direct Marketing definition.
- 84
- 85
US-ND · Algorithmic, Biometric & Surveillance Governance · 2026-10-20
LC draft 27.0359.1000 recommended by committee on Oct 20, 2026, proposing AI-disclosure duty and biometric/image-consent restrictions.
- 86
TR · Data Subject Rights · 2026-10-01
KVKK Board clarified that final responses must be in writing or electronically, published 1 October 2026.
- 87
- 88
US-MA · Regulator & Framework · date pending
Data Privacy Act conference committee continued negotiating as of 21 Oct 2026, with reconciliation referenced for January 2027.
- 89
HK · Enforcement & Redress · 2025-12-31
Cumulative doxxing enforcement statistics to 31 Dec 2025 reported (3,634 cases, 43 convictions).
- 90
SG · Cross-Border & Adequacy · 2026-03-02
Global CBPR/PRP certification routes added 2 March 2026 (S 86/2026) remain the standing position.
- 91
FI · Algorithmic, Biometric & Surveillance Governance · 2026-01-01
National AI Act enforcement layer (HE 46/2025) in force since 1 January 2026 alongside the EU AI Act's high-risk obligations from 2 August 2026, both outside this window.
- 92
LATAM · Algorithmic, Biometric & Surveillance Governance · 2026-10-01
RIPD 2026 Standards newly incorporate AI, automated decisions, bias prevention and neurodata provisions.
- 93
LV · Algorithmic, Biometric & Surveillance Governance · date pending
DVI's 2025 annual activity report designated DVI as Latvia's supervisory authority for personal data protection under the EU AI Act; VARAM coordinates overall implementation.
- 94
KH · Regulator & Framework · date pending
Draft LPDP under continuing consultation since July 2025; MPTC/EU Delegation workshop held 5 August 2026; law remains unenacted.
- 95
GG · Algorithmic, Biometric & Surveillance Governance · 2026-02-23
ODPA co-signed a 61-authority Joint Statement on AI-Generated Imagery (23 Feb 2026); GFSC declined to issue AI-specific financial-sector rules (29 Jan 2026).
- 96
US-AR · Enforcement & Redress · date pending
Secondary sources directly conflict over whether PIPA carries a private right of action; unresolved this cycle.
- 97
US-WI · Enforcement & Redress · date pending
Multistate enforcement-adjacent AI-chatbot bankruptcy filing
- 98
EEA · Regulator & Framework · 2026-10-21
Council adopted negotiating mandate on Digital Omnibus (GDPR amendment) 21 Oct 2026; trilogue not yet started.
- 99
CW · Cross-Border & Adequacy · 2026-06-19
Dutch AP has warned Curacao's oversight falls short of EU-equivalent standards and intends to intensify supervision of intra-Kingdom data flows.
- 100
LK · Enforcement & Redress · date pending
Penalty-escalation rule reported; DPA/NCCSL readiness session scheduled for 28 October 2026.
Regulatory horizon
- ARExpediente 3397-D-2026 omnibus DP reform bill · 2026-Q4multi year
- BGBulgaria AI Act implementing bill tabling expected · closed 2026-10quarter
- BRANPD fiscalização/sanctions regulation consultation closes · 2026-10-26quarter
- BRANPD sanctions dosimetry update consultation closes · 2026-11-30quarter
- BZNational Data and Statistical Systems Act, 2026 finalisation · 2027-Q2year
- CA-NBRTIPPA reform legislation expected · 2026-Q4half year
- CA-ONBill 97 FIPPA/MFIPPA final amendment tranche · 2027-01-01quarter
- CLLey 21.719 commencement date (1 Dec 2026, possibly postponed to 1 Dec 2027) · 2026-12-01quarter
- CMAPDP organisational decree publication pending · 2026-Q4half year
- COSIC post-consultation protocol under Ley 2573/2026 expected · 2026-Q4quarter
- CRTSE recurso de revocatoria against Prodhab Resolution 029-2026-RF · 2026-Q4half year
- CWPossible Convention 108+ implementing legislation · 2027-Q2multi year
- CYAI Act high-risk obligations deadline deferred (Digital Omnibus) · 2027-12-02year
- CZCzech Data Act implementing/penalty legislation (unadopted, deadline elapsed) · 2027-Q1year
- CZCzech AI Act Adaptation Act (draft) · 2027-Q1year
- DOINDOTEL draft General Telecommunications, Digital Infrastructure and Connectivity Law · 2026-Q4half year
- DZANPDP regional audit poles implementing regulation · 2026-Q4half year
- EE936 SE awaiting Riigi Teataja publication · 2026-Q4quarter
- EE796 SE dark-patterns/distance-financial-services transposition pending · 2026-Q4half year
- EEAData Act switching-charge ban takes full effect · 2027-01-12quarter
- EEAEDPB fine-methodology guidelines consultation closes · 2026-11-13quarter
- FIHE 46/2026 vp public-sector GDPR fines reform · 2027-Q1half year
- HUEDPB smart-glasses guideline public consultation close · 2026-11-13quarter
- INDPDP Act substantive-compliance tranche commences · 2027-05-13quarter
- INConsent Manager registration commences · 2026-11-13quarter
- JPAPPI amendment (Act No. 56/2026) commencement, including administrative fine system and biometric-data category · 2027-Q2year
- JPPPC technical safety-management-measure guideline revision · 2027-Q2half year
- KRPIPA Enforcement Decree implementing 11 Sept 2026 fine-ceiling amendment · closed 2026-09-11quarter
- LATAMRIPD Estándares possible formal adoption at Ibero-American Summit · 2026-Q4half year
- LKPDPA Parts I and III come into force · 2027-01-01quarter
- LKPDPA Part II (data subject rights) commencement date still unannounced · 2027-Q2multi year
- LUEU Data Act cloud-switching charge abolition · 2027-01-12quarter
- LUEU Data Act access-by-design duty for connected products · closed 2026-09-12quarter
- MTAI regulatory sandbox deadline postponed · 2027-08-02quarter
- MZProposta de Lei de Protecção de Dados Pessoais pending before Assembleia da República · 2027-Q1multi year
- NGCBN payments data-localisation deadline with NDPA cross-reference · 2027-01-01quarter
- NONorwegian KI-loven targeted for Storting presentation · 2027-Q2half year
- NPIT and Cyber Security Bill 2082 — disputed enactment status · 2026-Q4half year
- NZCivil pecuniary penalty regime advice to Ministry of Justice · 2027-Q2multi year
- PHNPC Draft Circular on Data Subject Rights adoption · 2026-Q4half year
- PHNPC Draft PIA Circular adoption · 2026-Q4half year
- RSSerbia draft replacement Law on Personal Data Protection · 2026-Q4multi year
- SASDAIA PDPL Implementing Regulation amendments consultation closes · 2026-11-05quarter
- SNLoi n°25/2026 implementing decrees and cybersecurity authority commencement · 2027-Q1year
- TNGDPR-aligned Tunisian data-protection reform bill · 2026-Q4year
- UADraft Law No. 8153 GDPR-alignment adoption (missed target) · closed 2026-06-01multi year
- UKICO agentic-AI call for evidence closes · 2026-11-20quarter
- USConnecticut data-broker registry registration date · 2027-01-01quarter
- US-AKHB 367 Consumer Data Privacy Act — possible future action · 2027-Q1multi year
- US-ALAPDPA effective date · 2027-05-01quarter
- US-ALApp Store Accountability Act in force · 2027-01-01quarter
- US-ALApp Store Accountability Act retroactive deadline for existing accounts · 2027-10-01quarter
- US-COColorado ADMT Act and Chatbot Safety Act take effect · 2027-01-01quarter
- US-COADMT formal rulemaking hearing and comment close · 2026-10-26quarter
- US-DEDPDPA HB 380 amendments take effect · 2027-01-01quarter
- US-GAGeorgia Conversational AI Safety Act (SB 540) in force · 2027-07-01quarter
- US-GAGeorgia SB 444 AI health-plan utilization-review limits in force · 2027-01-01quarter
- US-IDIdaho Conversational AI Safety Act takes effect · 2027-07-01quarter
- US-KYKCDPA DPIA duty takes effect for post-trigger-date processing · closed 2026-06-01quarter
- US-LALouisiana Data Privacy Act takes effect · 2027-01-01quarter
- US-LALDPA 30-day cure-period window closes · 2027-07-31quarter
- US-MAMassachusetts Data Privacy Act conference-committee reconciliation · 2027-01half year
- US-MAMandatory AG rulemaking deadline under House Data Privacy Act bill (if enacted) · 2027-05-01year
- US-MISenate Bills 888-892 breach-notification reform · 2027-Q2year
- US-MIProposed Michigan Consumer Privacy Act (HB 5989) · 2027-Q4multi year
- US-MNMinn. Stat. §325M.40 private-damages claim and age-estimation disclosure take effect · 2027-07-01quarter
- US-NELB838 AADC amendment effective · closed 2026-07-17quarter
- US-NHHB 1460 children's-data sale ban in force · 2027-01-01quarter
- US-NJNJDPA data broker/collector registry launch · 2027-Q2half year
- US-NJNJDPA implementing rulemaking restart (unconfirmed timeline) · 2027multi year
- US-NMAnticipated NM social-media-safety / age-verification bill · 2027-Q1year
- US-NYRAISE Act takes effect · 2027-01-01quarter
- US-OKOklahoma Consumer Data Privacy Act (OKCDPA) takes effect · 2027-01-01quarter
- US-RIRI AI Companion Models Act (S 2195/H 7350) takes effect · 2027-01-01quarter
- US-TNTN TACIR AI study report due · 2027-01-31quarter
- US-UTHB 357 motor-vehicle-data amendments to UCPA take effect · 2027-01-01quarter
- US-VTVDPOSA in force · 2028-01-01quarter
- US-VTData Broker Security Breach Notice Act (Act 138) effective · 2027-01-01quarter
- US-VTAge-Appropriate Design Code (Act 63) effective · 2027-01-01quarter
- US-WAHB 1170 AI content-provenance disclosure comes into force · 2027-02-01quarter
Ranked within this monitor (per_consumer); tie-break recency_date_desc, jid_asc, module_asc, url_asc. Index tool 1.5.0, edition policy 1.2.0.