What it means for product design, age assurance and data protection
On September 17, 2026, the European Commission (Commission) adopted its proposal for the EU KIDS Act (Keeping Internet Digital Spaces Accountable and Trustworthy), a new regulation aimed at strengthening the protection of minors online. It applies to the digital services and products children use
Following the UK Information Commission’s (ICO) call for evidence on 8 October 2026 on the application of existing UK data protection laws to “agentic AI” systems, David Naylor, Simon Jones and Paul Jinks share headline thoughts on some of the fundamental data privacy questions raised by the use of agentic AI, summarise the key
The Data (Use and Access) Act 2025 (DUAA)[i] continues to introduce changes to the UK data protection landscape. One of the most visible developments is the formal transition of the UK’s data protection regulator from the Information Commissioner’s Office to the Information Commission[ii].
Despite the legal name change, organisations should not expect
In case you missed it, below are recent posts from Privacy World covering the latest developments on data privacy, security and innovation. Please reach out to the authors if you are interested in additional information.
As privacy regulation, AI governance, and cybersecurity requirements continue to evolve globally, members of Squire Patton Boggs’ Data Privacy, Cybersecurity & Digital Assets team will be speaking on legal developments at several upcoming webinars, conferences, and CLE programs. Explore the events and hot topics below. For many of these programs we can arrange free passes for clients and are noted below. We look forward to connecting with you!
Continue Reading Upcoming Speaking Engagements and CLE Opportunities with the SPB Data Team
As we flagged last month in our mid-year U.S. privacy roundup, the Delaware legislature recently passed House Bill 380 (“HB 380”), which amends the Delaware Personal Data Privacy Act (the “Act”) in ways that impose significant new, and in many ways complex and novel, requirements on controllers, processors and third parties. On September 2, 2026, Delaware Governor Matt Meyer signed House Bill 380 into law and thus amended what was already a fairly strict state consumer privacy law. These amendments significantly lower the volume-based thresholds for applicability, create new obligations for providers of “reports” used to make certain types of decisions and businesses that use that data, add new requirements for consumer rights, impose restrictions on profiling job applicants, employees and independent contractors, and require contracts with and obligations from third parties that receive personal data (e.g., sales), among many other changes. These amendments will become effective on January 1, 2027.
Businesses that are subject to the Act (of which there will be many more as a result of HB 380) should carefully review the amended Act to determine their new obligations, including the significant amendments discussed below. Financial institutions in particular should determine whether they must now comply with the Act, as the broad exemption for financial institutions subject to Title V of the Gramm-Leach-Bliley Act (the “GLBA”) has been replaced by a narrower exemption for only certain types of financial institutions and certain of their affiliates (see discussion below).
Continue Reading Amendments to Delaware’s Consumer Privacy Law Deepen the Morass of State Privacy Regulation
2026 started with 20 state consumer privacy laws (SCPLs), three of which went into force on January 1, 2026. During the first half of 2026, four new SCPLs were added, bringing the count to 24 – all since the California legislature passed the California Consumer Privacy Act (CCPA) in June 2018. Also, during the first half of 2026, state legislatures enacted significant amendments to their existing SCPLs. We cover the state privacy laws developments in this first of a three-part series on mid-year US data law updates – stay tuned for updates on teen online privacy and safety, as well as AI.
Continue Reading Adding to the Count: The latest in state consumer privacy laws
French law requires that where hosting services providers host certain types of health data, they must first obtain certification as “hébergeurs de données de santé” (“HDS”) which translates as “health data hosting service providers”. The relevant HDS certification framework was updated in 2024. This framework notably incorporates the amendments introduced by the law of 21 May 2024 aimed at securing and regulating the digital space, as well the decree of 24 March 2026, which imposes data sovereignty-related obligations that will take effect in September 2026.
Continue Reading V2.0 Certification of French Health Data Hosting Service Providers (HDS) now Fully Effective
Can a data controller reject a data subject’s first data access request on the basis that it is “excessive”? Until recently, many organisations were cautious and adopted an agnostic view about the intentions behind first access requests. However, the EU Court of Justice (“CJEU”) has clarified in a recent decision that although excessive
On April 16, 2026, Governor Kay Ivey signed into law the Alabama Personal Data Protection Act (“APDPA”) after a unanimous vote in favor from both chambers of the Alabama legislature. The APDPA is the 22nd state consumer privacy law overall (counting Florida) and the second one enacted in 2026, following enactment of Oklahoma’s privacy law in March (summarized here).
We highlight key features of the APDPA below. (We also offer a subscription service that offers details and comparisons (by topic) of state consumer privacy laws (“CPLs”).)
Continue Reading The “Heart of Dixie” Embraces Consumer Privacy