The European Commission has set a clear timeline for rolling out age verification across the EU:
This timeline, set out in the Commission’s (non-binding)…
On 29 April 2026, the UK Information Commissioner’s Office (“ICO”) updated its guidance on the use of storage and access technologies (i.e., cookies and other technologies that store or access information stored on users’ devices) under Regulation 6 of the Privacy and Electronic Communications Regulations 2003 (“PECR”). These updates follow on the heels of two…
On April 27, 2026, District of Columbia Attorney General Brian L. Schwalb filed a complaint against Mid‑America Apartment Communities, Inc., and its subsidiaries (collectively, “MAA”) alleging that the landlord charged illegal fees and misled prospective tenants about the true cost of rent. This action is the latest example of state and federal enforcement scrutiny of…
On April 14, 2026, the FTC announced three settlements and issued closing letters to two additional companies concerning “Made in America,” “Made in the USA,” and similar U.S.‑origin claims (collectively, “MUSA claims”). These actions reflect the FTC’s continued focus on MUSA claims and, more broadly, the Trump administration’s focus on American manufacturing and related claims…
On 31 March 2026, the UK’s Information Commissioner’s Office (“ICO”) launched a public consultation on draft updated guidance on automated decision-making (“ADM”), including profiling (“Draft Guidance”) and simultaneously published a report on the use of ADM in recruitment (“Recruitment Report”).
The Draft Guidance is the ICO’s first detailed interpretation of the Data (Use and Access)…
…
On April 20, 2026, the Spanish Data Protection Agency (AEPD) has published new guidance on how to comply with the GDPR when using AI‑powered voice transcription tools. The guidance builds on earlier AEPD guidance on this topic from January 2026. This blog post sets out the key takeaways of both guidance documents, which are…
The Federal Trade Commission (FTC) announced a settlement with dating app operator OkCupid and its affiliate Match Group Americas (Match), resolving allegations that the company had violated Section 5 of the FTC Act by sharing users’ personal information with a third party in a manner that was not disclosed in the company’s privacy notice. Specifically,…
On April 17, 2026, the Governor of Alabama signed HB 351, Alabama Personal Data Protection Act (ALDPA), into law. The law resembles Connecticut’s data privacy statute, but omits certain requirements, such as a data protection impact assessment. Alabama follows Oklahoma as the second state to enact a comprehensive privacy law this year. The law…
The Governor of Oklahoma signed SB 546 into law (OKDPA), which closely tracks the Virginia Consumer Data Protection Act (“VCDPA”). The law will take effect January 1, 2027.
…
