https://digitalprivacyregs.com/Privacy law developments across 197 jurisdictions.en-ushttps://digitalprivacyregs.com/news.html#n-2026-10-21-united-statesdpr-2026-10-21-united-statesWed, 21 Oct 2026 08:00:00 GMTJudge Francis Mathew set the civil penalty for the 43,899,725 willful Unfair Practices Act violations a jury found in September, including statements that users controlled how their information was shared and that Facebook did not sell or provide personal data to advertisers. The statute allowed up to about $219.5 billion and the state had asked for $35 billion to $40 billion. Meta says it expects to win on appeal.https://digitalprivacyregs.com/news.html#n-2026-10-21-european-uniondpr-2026-10-21-european-unionWed, 21 Oct 2026 08:00:00 GMTAfter talks stalled over trade secret protection in the Data Act part of the Digital Omnibus, ambassadors agreed the Council's negotiating mandate on October 21. It keeps the GDPR's definition of personal data while adding a rule on pseudonymisation, adds safeguards for sensitive data used in biometric verification and AI training, exempts cookies needed to provide a service, for audience measurement or for device security from consent, and replaces the single EU cyber incident entry point with national ones. Negotiations with the Parliament can start only after its lead committees vote, expected in early 2027.https://digitalprivacyregs.com/news.html#n-2026-10-21-germanydpr-2026-10-21-germanyWed, 21 Oct 2026 08:00:00 GMTThe Berlin data protection authority found that the CDU, SPD, Greens and Die Linke unlawfully targeted 2021 federal election ads at users according to political interests derived from their platform profiles, without a legal basis such as consent. The parties received reprimands rather than fines, and the case against the AfD is still open.https://digitalprivacyregs.com/news.html#n-2026-10-20-chiledpr-2026-10-20-chileTue, 20 Oct 2026 08:00:00 GMTThe Senate Constitution Committee unanimously approved in general the government's bill to move Law 21.719 from 1 December 2026 to 1 December 2027 and enlarge the agency's board to five members, and the government committed to immediate urgency. The committee now takes the bill article by article, with proposals for a phased start on the table. Until a law is published, 1 December 2026 remains the legal date.https://digitalprivacyregs.com/news.html#n-2026-10-19-united-statesdpr-2026-10-19-united-statesMon, 19 Oct 2026 08:00:00 GMTChrome Holding Co., formerly 23andMe, will pay $6 million to resolve California's claims over the 2023 breach that exposed data on nearly 7 million customers, including more than 855,000 Californians, and the state's appeal of court rulings that let the company sell genetic data and samples to TTAM Research Institute in 2025 despite the Genetic Information Privacy Act's separate consent requirement. The settlement needs bankruptcy court approval.https://digitalprivacyregs.com/news.html#n-2026-10-16-united-statesdpr-2026-10-16-united-statesFri, 16 Oct 2026 08:00:00 GMTTemu's operators will pay Texas $3 million and store Texans' personal data on American-owned and controlled servers in the United States, with access from China limited to essential business functions and an $8 million penalty for each year a data security term is breached. The same day Connecticut settled with Frontier Communications for $625,000 over an April 2024 breach that exposed the Social Security numbers of 58,841 residents, with compliance terms under the Connecticut Data Privacy Act, its unfair trade practices law and its data safeguards law.https://digitalprivacyregs.com/news.html#n-2026-10-15-united-statesdpr-2026-10-15-united-statesThu, 15 Oct 2026 08:00:00 GMTThe Eleventh Circuit vacated the injunction against Florida's HB 3, which bars children under 14 from accounts on platforms with addictive features and requires parental consent at 14 and 15, finding the law likely content-neutral. A day later the same panel vacated the injunction against Georgia's SB 351, which requires age verification, parental consent for users under 16 and limits on the personal data used to target ads to them, holding that NetChoice had not carried its burden on a facial challenge and that the advertising limit is not preempted by Section 230. Both cases return to the district courts.https://digitalprivacyregs.com/news.html#n-2026-10-13-european-uniondpr-2026-10-13-european-unionTue, 13 Oct 2026 08:00:00 GMTStatement 1/2026, adopted at the October plenary, says wearers fall under the GDPR when they post recordings publicly or use the glasses for professional, official or political work, while private use stays within the household exemption. Producers and app providers remain controllers for their own processing, cannot shift their obligations to users, and are expected to give bystanders clear recording signals such as lights or sounds.https://digitalprivacyregs.com/news.html#n-2026-10-12-norwaydpr-2026-10-12-norwayMon, 12 Oct 2026 08:00:00 GMTDatatilsynet's decision of 2 October treats Microsoft's adtech unit as a joint controller, on both the supply and demand side, for Grindr users' advertising IDs, IP addresses and the fact that they used the app, which it counts as data concerning sexual orientation. It found processing without a legal basis under Article 6(1) and without a valid exemption under Article 9(1). The fine is about EUR 8.6M.https://digitalprivacyregs.com/news.html#n-2026-10-12-united-statesdpr-2026-10-12-united-statesMon, 12 Oct 2026 08:00:00 GMTCalPrivacy opened its first Delete Week, reporting that more than 560,000 Californians have registered with DROP, the Delete Act platform that sends one deletion request to more than 660 registered data brokers, and that brokers have reported nearly 100 million consumer profiles deleted since it opened to them on August 1.https://digitalprivacyregs.com/news.html#n-2026-10-11-european-uniondpr-2026-10-11-european-unionSun, 11 Oct 2026 08:00:00 GMTThe Irish Presidency's October 2 compromise on the Digital Omnibus data package keeps cookie consent in the ePrivacy Directive rather than moving it into the GDPR, drops the duty to honor browser consent signals, lets sites ask again four months after a refusal, limits breach notifications to high-risk incidents with a 96-hour deadline, and allows legitimate interest for AI training subject to the right to object. Ambassadors ended their October 7 meeting without a mandate, with Germany and other governments pressing for stronger trade secret protection in the Data Act part of the package, and the file was taken off their October 11 agenda with no new date. Nothing changes for advertisers until Council and Parliament agree a final text.https://digitalprivacyregs.com/news.html#n-2026-10-08-united-statesdpr-2026-10-08-united-statesThu, 08 Oct 2026 08:00:00 GMTIn Baker v. Seattle Children's Hospital, the Washington Supreme Court held that searches and clicks on a public website answered by an automated server are not communications between two or more individuals under the state privacy act, which requires all-party consent, and affirmed dismissal of claims that the hospital's Meta Pixel sent health-related searches to Meta. The court left open communications with human staff and systems that do more than return stored content.https://digitalprivacyregs.com/news.html#n-2026-10-06-saudi-arabiadpr-2026-10-06-saudi-arabiaTue, 06 Oct 2026 08:00:00 GMTSDAIA opened consultation, running to November 5, on amendments to the PDPL Implementing Regulations that would require controllers to store personal data in Saudi Arabia while still permitting lawful transfers, require breach notification to SDAIA within 72 hours with no harm threshold, make registration mandatory for controllers that transfer data abroad or process sensitive data, and widen DPO and impact assessment duties. Approved amendments would take effect 60 days after publication in the Official Gazette.https://digitalprivacyregs.com/news.html#n-2026-10-02-chiledpr-2026-10-02-chileFri, 02 Oct 2026 08:00:00 GMTThe government's bill would move Law 21.719 from 1 December 2026 to 1 December 2027 and enlarge the new agency's board to five members; Senate Constitution Committee chair Pedro Araya and Senators Matías Walker and Juan Luis Castro argue a year is too long and propose a delay of about six months or a phased start. The committee had not begun its debate, so 1 December 2026 remains the legal date.https://digitalprivacyregs.com/news.html#n-2026-10-02-italydpr-2026-10-02-italyFri, 02 Oct 2026 08:00:00 GMTThe Garante found that IQVIA Solutions Italy held records on about one million patients of 800 general practitioners for pharmaceutical studies under codes that allowed tracking over time, with no legal basis, no impact assessment and no retention limit (records went back to 2001), and that more than 3,300 patients had names, tax codes and addresses stored alongside health data. The company has 120 days to bring the processing into line.https://digitalprivacyregs.com/news.html#n-2026-10-01-united-statesdpr-2026-10-01-united-statesThu, 01 Oct 2026 08:00:00 GMTPublic Act 26-64 (SB 4) now bars controllers and third parties from selling precise geolocation data, narrows the publicly available data exemption, and requires businesses that use facial recognition for security to match only against their own databases and post entrance signage linking to their policy. The data broker registry at the Department of Consumer Protection ($2,500 a year) opens January 1, 2027, and the state deletion mechanism is due July 1, 2028. Connecticut's CART Act on artificial intelligence (PA 26-15) took effect the same day. In Maryland, HB 895 bans large grocers and delivery services from using personal data or dynamic pricing to charge individual shoppers more, enforced by the Attorney General with a 45-day cure period.https://digitalprivacyregs.com/news.html#n-2026-09-30-united-statesdpr-2026-09-30-united-statesWed, 30 Sep 2026 08:00:00 GMTGovernor Newsom signed SB 690 on the last day of the signing window. From January 1, 2027, only the Attorney General may sue over Penal Code 638.51 pen-register and trap-and-trace claims arising from websites and apps, and the limit applies retroactively to pending claims in actions filed within the two years before that date, which ends the private class actions that made website tracking a CIPA industry. He had signed AB 2561 on September 27, stopping operating systems and apps from undoing a user's privacy settings without consent, and he vetoed SB 1130 on wearable recording devices.https://digitalprivacyregs.com/news.html#n-2026-09-30-united-kingdomdpr-2026-09-30-united-kingdomWed, 30 Sep 2026 08:00:00 GMTSections 117 to 119 of the Data (Use and Access) Act 2025 commenced under SI 2026/1015, abolishing the office of Information Commissioner and transferring its functions to a board-led Information Commission, with Paul Arnold as chief executive and Maggie Carver as interim deputy chair while a permanent chair is recruited. The regulator keeps the ICO name in daily use and its powers are unchanged.https://digitalprivacyregs.com/news.html#n-2026-09-27-united-statesdpr-2026-09-27-united-statesSun, 27 Sep 2026 08:00:00 GMTGovernor Newsom returned AB 1542 without his signature, writing that a categorical ban on sharing sensitive personal information was a step too far when consumers already hold a right to limit its use, and that the bill carried costs not in the 2026 budget. The same day he signed SB 923, which extends the CCPA right to delete to data a business obtained from third parties and requires online-only businesses to offer a webform for requests, and AB 883, which adds an accessible deletion mechanism for data brokers and a deletion process for elected officials and judges. Both take effect 1 January 2027. SB 690, the CIPA pen-register reform, and AB 2561 on privacy settings were still on his desk, with 30 September the deadline.https://digitalprivacyregs.com/news.html#n-2026-09-25-united-statesdpr-2026-09-25-united-statesFri, 25 Sep 2026 08:00:00 GMTIn State of New Mexico v. Facebook, a jury found 43,899,725 willful violations of the Unfair Practices Act, including statements that users controlled how their information was shared and that Facebook did not sell or provide personal data to advertisers, along with its Cambridge Analytica follow-up promises. The statute allows up to $5,000 per willful violation; the judge sets the penalty in a separate phase, with the state asking for $35 billion to $40 billion.https://digitalprivacyregs.com/news.html#n-2026-09-24-united-kingdomdpr-2026-09-24-united-kingdomThu, 24 Sep 2026 08:00:00 GMTTikTok withdrew its appeal against the 2023 penalty for processing the personal data of UK children under 13 without parental consent, along with its appeal against an information notice about how its recommender systems process 13 to 17 year olds' data. The withdrawal followed an Upper Tribunal ruling in August that rejected TikTok's artistic-purposes argument, and the ICO says it will now progress that investigation. The regulator itself becomes the board-led Information Commission on 30 September under the Data (Use and Access) Act 2025.https://digitalprivacyregs.com/news.html#n-2026-09-22-philippinesdpr-2026-09-22-philippinesTue, 22 Sep 2026 08:00:00 GMTThe National Privacy Commission issued show-cause orders to the four platforms over registration requirements under the Data Privacy Act, part of an intensified push on how digital platforms handle children's data.https://digitalprivacyregs.com/news.html#n-2026-09-21-irelanddpr-2026-09-21-irelandMon, 21 Sep 2026 08:00:00 GMTThe Data Protection Commission found that Google processed location data from Location History and Web & App Activity unlawfully and unfairly between May 2018 and February 2020, fell short on transparency across those features and Location Accuracy, and kept location data too long. Google has six months to bring its processing into compliance.https://digitalprivacyregs.com/news.html#n-2026-09-21-european-uniondpr-2026-09-21-european-unionMon, 21 Sep 2026 08:00:00 GMTThe EDPB adopted Guidelines 04/2026 on whether to impose administrative fines, a five-step method that complements its 2022 guidance on calculating them, and opened consultation until 13 November. It also adopted the final version of its guidelines on the interplay between the Digital Services Act and the GDPR.https://digitalprivacyregs.com/news.html#n-2026-09-11-south-koreadpr-2026-09-11-south-koreaFri, 11 Sep 2026 08:00:00 GMTA PIPA amendment passed in February now allows fines of up to 10% of total revenue for repeat intentional violations, incidents affecting 10 million or more people, and breaches after an ignored corrective order.https://digitalprivacyregs.com/news.html#n-2026-09-02-united-statesdpr-2026-09-02-united-statesWed, 02 Sep 2026 08:00:00 GMTHB 380, signed by Governor Meyer, lowers the Delaware Personal Data Privacy Act's applicability from 35,000 consumers to 10,000, or to 5,000 where more than 20% of gross revenue comes from selling personal data, from January 1, 2027. It also adds inferences and new categories to sensitive data, extends the teen opt-in to profiling, limits sales of sensitive data to what a consumer-requested service strictly needs, and requires contracts and due diligence for disclosures to third parties.https://digitalprivacyregs.com/news.html#n-2026-09-01-chiledpr-2026-09-01-chileTue, 01 Sep 2026 08:00:00 GMTThe government filed an urgent bill to push Law 21.719's start from 1 December 2026 to 1 December 2027 and enlarge the new agency's board from three members to five, after the Senate rejected the nominees and the agency could not be constituted. Until Congress acts, 1 December 2026 remains the legal date.https://digitalprivacyregs.com/news.html#n-2026-08-31-united-statesdpr-2026-08-31-united-statesMon, 31 Aug 2026 08:00:00 GMTThe Legislature closed its session by passing eight privacy bills, headlined by AB 1542, which would replace the CCPA's opt-out for sensitive personal information with a prohibition on selling or sharing it, and SB 690, which would end private pen-register lawsuits under CIPA for website and app tracking, retroactively. SB 923 expands deletion to data collected about a consumer from third parties, AB 883 tightens data broker timelines, and AB 2561 would stop operating systems and apps from overriding users' privacy settings. Governor Newsom has until September 30, and signed bills take effect January 1, 2027. The signed AB 2246 has already replaced the court-blocked Age-Appropriate Design Code.https://digitalprivacyregs.com/news.html#n-2026-08-21-netherlandsdpr-2026-08-21-netherlandsFri, 21 Aug 2026 08:00:00 GMTThe Autoriteit Persoonsgegevens imposed EUR 824,990,000 on Uber for deactivating drivers' accounts by fully automated decision, over suspected fraud or low customer ratings and without human review, and for failing to tell drivers enough about that automated decision-making. It is the second-largest GDPR fine to date, and Uber has appealed.https://digitalprivacyregs.com/news.html#n-2026-08-19-vietnamdpr-2026-08-19-vietnamWed, 19 Aug 2026 08:00:00 GMTDecree 330/2026/ND-CP, effective the day it was issued, sets the sanctions for the Personal Data Protection Law: fines of up to VND 3 billion for personal data violations, up to ten times the proceeds for unlawful trading in personal data, and up to 5% of prior-year Vietnam revenue where an unlawful cross-border transfer leads to leakage or loss, tiered by the number of people affected. Individuals pay half the organizational rate.https://digitalprivacyregs.com/news.html#n-2026-08-01-turkeydpr-2026-08-01-turkeySat, 01 Aug 2026 08:00:00 GMTAmendments to Turkey's commercial advertising regulation took effect, requiring targeted ads to tell consumers which criteria selected them and how to change them, banning profiling-based targeting of known children, and requiring AI-generated endorsements to be labeled.https://digitalprivacyregs.com/news.html#n-2026-07-17-japandpr-2026-07-17-japanFri, 17 Jul 2026 08:00:00 GMTThe Diet passed the triennial-review amendment to the Act on the Protection of Personal Information on 10 July, and it was promulgated on 17 July as Act No. 56 of 2026. Criminal provisions take effect on 17 January 2027 and the rest, including administrative surcharges, AI and statistics consent exceptions and parental consent for under-16s, by 17 July 2028.https://digitalprivacyregs.com/news.html#n-2026-07-01-vietnamdpr-2026-07-01-vietnamWed, 01 Jul 2026 08:00:00 GMTVietnam's consolidated Cybersecurity Law entered into force on 1 July 2026, completing a three-law rebuild (PDPL, Data Law, Cybersecurity Law) that began in 2025 and leaves foreign platforms with layered filing and classification duties.https://digitalprivacyregs.com/news.html#n-2026-07-01-united-statesdpr-2026-07-01-united-statesWed, 01 Jul 2026 08:00:00 GMTConnecticut's CTDPA amendments took effect, lowering the applicability threshold to 35,000 residents, pulling in any business that processes sensitive data or sells personal data, and adding impact assessments for significant profiling. Utah's amendments landed the same day, Virginia banned selling precise geolocation data, and Arkansas's Children and Teens' Online Privacy Protection Act extended COPPA-style rules to teens and banned targeted advertising to minors. Arkansas still has no comprehensive consumer privacy law.https://digitalprivacyregs.com/news.html#n-2026-06-29-european-uniondpr-2026-06-29-european-unionMon, 29 Jun 2026 08:00:00 GMTThe Council formally adopted the Digital Omnibus on AI, delaying and adjusting parts of the AI Act. The data protection half, which would amend the GDPR and cookie rules, remains in negotiation, with the Council's June text dropping the single-click reject duty and the consent-banner moratorium.https://digitalprivacyregs.com/news.html#n-2026-06-23-cameroondpr-2026-06-23-cameroonTue, 23 Jun 2026 08:00:00 GMTThe 18-month transition under Law No. 2024/017 ended, so its obligations now apply, although the presidential decree creating the supervisory authority has not been issued.https://digitalprivacyregs.com/news.html#n-2026-06-19-united-kingdomdpr-2026-06-19-united-kingdomFri, 19 Jun 2026 08:00:00 GMTFurther Data (Use and Access) Act 2025 provisions took effect on 19 June 2026, one year after Royal Assent, including the duty on controllers to handle data protection complaints. The staged rollout began with the main data protection package on 5 February.https://digitalprivacyregs.com/news.html#n-2026-06-10-south-koreadpr-2026-06-10-south-koreaWed, 10 Jun 2026 08:00:00 GMTThe Personal Information Protection Commission penalized Coupang over a breach affecting 37.5 million people and, separately, KRW 201.1B for collecting 11.17 million members' activity on third-party websites and apps through its Coupang Partners affiliate program. The total is a Korean record.https://digitalprivacyregs.com/news.html#n-2026-05-27-united-statesdpr-2026-05-27-united-statesWed, 27 May 2026 08:00:00 GMTGovernor Lamont signed SB 4, which bans selling precise geolocation data and adds facial recognition transparency duties from 1 October 2026. Companion bills restrict surveillance pricing from the same date and create data broker registration from 1 January 2027.https://digitalprivacyregs.com/news.html#n-2026-05-11-united-statesdpr-2026-05-11-united-statesMon, 11 May 2026 08:00:00 GMTThe Attorney General, the California Privacy Protection Agency and local prosecutors reached a $12.75M settlement with General Motors over driving behavior and location data sold to data brokers without consumers' consent, the largest CCPA settlement to date.https://digitalprivacyregs.com/news.html#n-2026-04-29-italydpr-2026-04-29-italyWed, 29 Apr 2026 08:00:00 GMTThe Garante's guidelines on tracking pixels in email (provvedimento 284 of 17 April 2026), published in the Gazzetta Ufficiale on 29 April, apply the Privacy Code's device-access rule to email opens: measuring individual recipients' opens, adjusting send frequency by engagement or profiling reading behavior needs prior consent, which can sit alongside marketing consent if the request is neutral and can be withdrawn selectively. Anonymized aggregate open-rate measurement, security and authentication messages and mandatory service notices are exempt, and senders have six months, until 29 October 2026, to comply.https://digitalprivacyregs.com/news.html#n-2026-04-10-bangladeshdpr-2026-04-10-bangladeshFri, 10 Apr 2026 08:00:00 GMTThe Personal Data Protection Act, 2026 replaced the interim government's 2025 ordinance and is treated as in force from 6 November 2025, except the chief data officer, complaints, fines and compensation provisions, which await a government notice at least 18 months after enactment. A separate act creates the National Data Management Authority as regulator.https://digitalprivacyregs.com/news.html#n-2026-04-07-japandpr-2026-04-07-japanTue, 07 Apr 2026 08:00:00 GMTJapan's Cabinet approved the triennial-review APPI amendment and sent it to the Diet: consent exceptions for statistics and AI development, under-16 parental consent, and stronger PPC enforcement, with implementation to follow through PPC rules.https://digitalprivacyregs.com/news.html#n-2026-03-19-european-uniondpr-2026-03-19-european-unionThu, 19 Mar 2026 08:00:00 GMTThe EDPB kicked off its 2026 coordinated enforcement framework on 19 March, sweeping a single compliance topic across dozens of national authorities simultaneously, the annual exercise that has previously covered DPOs, access rights and erasure.https://digitalprivacyregs.com/news.html#n-2026-03-17-brazildpr-2026-03-17-brazilTue, 17 Mar 2026 08:00:00 GMTBrazil's online protection statute for children and adolescents entered into force six months after its September 2025 enactment. It requires age assurance and parental tools, bars profiling-based advertising to minors, and is enforced by the ANPD, which became a full regulatory agency in February.https://digitalprivacyregs.com/news.html#n-2026-03-10-burundidpr-2026-03-10-burundiTue, 10 Mar 2026 08:00:00 GMTLaw No. 1/03 took effect on promulgation, giving private-sector processing six months to comply and the public sector a year. The Personal Data Protection Agency it creates still needs an implementing decree.https://digitalprivacyregs.com/news.html#n-2026-02-05-united-kingdomdpr-2026-02-05-united-kingdomThu, 05 Feb 2026 08:00:00 GMTThe bulk of the Data (Use and Access) Act's changes to the UK GDPR, DPA 2018 and PECR commenced on 5 February 2026 under SI 2026/82, with the ICO racing to finalize guidance and signaling it will assess conduct against the rules in force at the time.https://digitalprivacyregs.com/news.html#n-2026-01-16-saudi-arabiadpr-2026-01-16-saudi-arabiaFri, 16 Jan 2026 08:00:00 GMTSDAIA's violation committees announced 48 decisions under the Personal Data Protection Law, including penalties for sending advertising and marketing messages without the recipients' consent. Penalty amounts were not disclosed.https://digitalprivacyregs.com/news.html#n-2026-01-01-united-statesdpr-2026-01-01-united-statesThu, 01 Jan 2026 08:00:00 GMTIndiana, Kentucky and Rhode Island's comprehensive laws took effect on 1 January 2026, bringing the in-force count to twenty. Rhode Island arrives with a 35,000-consumer threshold, among the lowest in the country, and no cure period.https://digitalprivacyregs.com/news.html#n-2026-01-01-vietnamdpr-2026-01-01-vietnamThu, 01 Jan 2026 08:00:00 GMTLaw 91/2025 and implementing Decree 356/2025 replaced Decree 13, moving Vietnam's consent-first privacy regime from decree to statute with impact-assessment filings to the Ministry of Public Security.https://digitalprivacyregs.com/news.html#n-2026-01-01-united-states-2dpr-2026-01-01-united-states-2Thu, 01 Jan 2026 08:00:00 GMTThe CPPA's regulation package on automated decision-making technology, risk assessments and cybersecurity audits took effect on 1 January 2026 with staged compliance. The automated decision-making rights (pre-use notice, access and opt-out) become operative on 1 January 2027, and cybersecurity audit certifications phase in from April 2028. Together they are the biggest expansion of CCPA duties since the CPRA itself.https://digitalprivacyregs.com/news.html#n-2026-01-01-bruneidpr-2026-01-01-bruneiThu, 01 Jan 2026 08:00:00 GMTMost substantive duties under the Personal Data Protection Order 2025 took effect after a one-year grace period, making Brunei's first private-sector privacy law enforceable by AITI.https://digitalprivacyregs.com/news.html#n-2025-12-31-united-statesdpr-2025-12-31-united-statesWed, 31 Dec 2025 08:00:00 GMTDelaware's DPDPA cure period ended 31 December 2025, the first of several sunsets (Montana follows 1 April 2026) that let state AGs move straight to penalties without a fix-it warning.https://digitalprivacyregs.com/news.html#n-2025-11-19-european-uniondpr-2025-11-19-european-unionWed, 19 Nov 2025 08:00:00 GMTThe Commission proposed its Digital Omnibus package, pairing GDPR and ePrivacy amendments (cookies folded into the GDPR, machine-readable consent signals, a single breach entry point, a narrowed personal-data definition) with AI Act changes. The EDPB and EDPS later backed the simplification goal while raising key concerns in a joint opinion.https://digitalprivacyregs.com/news.html#n-2025-11-13-indiadpr-2025-11-13-indiaThu, 13 Nov 2025 08:00:00 GMTMeitY notified the DPDP Rules 2025 on 13 November, bringing the provisions that establish the Data Protection Board into force immediately. Consent-manager provisions follow on 13 November 2026, and the substantive duties, the Board's enforcement powers and penalties of up to INR 250 crore apply from 13 May 2027.https://digitalprivacyregs.com/news.html#n-2025-08-14-israeldpr-2025-08-14-israelThu, 14 Aug 2025 08:00:00 GMTThe largest reform of Israeli privacy law since 1981 entered into force, arming the Privacy Protection Authority with administrative fines and modern GDPR-style definitions.https://digitalprivacyregs.com/news.html#n-2025-07-22-united-kingdomdpr-2025-07-22-united-kingdomTue, 22 Jul 2025 08:00:00 GMTThe Commission published draft decisions renewing both UK adequacy findings after assessing the Data (Use and Access) Act. The renewals were completed before the old decisions lapsed at the end of 2025 and run to 27 December 2031, subject to monitoring.https://digitalprivacyregs.com/news.html#n-2025-06-26-vietnamdpr-2025-06-26-vietnamThu, 26 Jun 2025 08:00:00 GMTThe National Assembly passed Law 91/2025/QH15, giving Vietnam a statute-level privacy law effective 1 January 2026 and confirming the consent-first, filing-heavy model of Decree 13.https://digitalprivacyregs.com/news.html#n-2025-06-19-united-kingdomdpr-2025-06-19-united-kingdomThu, 19 Jun 2025 08:00:00 GMTThe DUAA became law, amending the UK GDPR, DPA 2018 and PECR with recognised legitimate interests, direct-marketing acknowledgments, cookie exceptions and PECR fines aligned to UK GDPR levels.https://digitalprivacyregs.com/news.html#n-2025-05-30-russiadpr-2025-05-30-russiaFri, 30 May 2025 08:00:00 GMTRussia's liability overhaul introduced turnover-based fines (to 3% of revenue) for personal data leaks plus criminal exposure for data trafficking, sharply raising the cost of breaches involving Russian citizens' data.https://digitalprivacyregs.com/news.html#n-2025-03-21-mexicodpr-2025-03-21-mexicoFri, 21 Mar 2025 08:00:00 GMTThe rebuilt LFPDPPP took effect one day after publication, preserving ARCO rights and tacit consent while moving enforcement from the dissolved INAI to the executive-branch SABG.https://digitalprivacyregs.com/news.html#n-2025-02-11-european-uniondpr-2025-02-11-european-unionTue, 11 Feb 2025 08:00:00 GMTThe Commission's 2025 work programme listed the ePrivacy Regulation for withdrawal after nearly a decade of deadlock, leaving the 2002 Directive and its 27 national implementations as the EU's cookie law for the foreseeable future.https://digitalprivacyregs.com/news.html#n-2025-01-06-canadadpr-2025-01-06-canadaMon, 06 Jan 2025 08:00:00 GMTBill C-27, which would have replaced PIPEDA with the CPPA and added an AI law, died when Parliament was prorogued in January 2025, leaving Canada's federal regime without fining powers while Quebec's Law 25 sets the national pace.