Latest Worldwide Developments on Personal Data

UK installs 48-hour removal rule for nonconsensual explicit images.

The U.K. Department for Science, Innovation and Technology announced an amendment to the Crime and Policing Bill requiring technology companies to remove reported nonconsensual explicit images within 48 hours of notification. The government indicated failure to comply could result in "fines of up to 10% of their qualifying worldwide revenue or having their services blocked in the UK." Additionally, forthcoming guidance will outline how internet providers should go about blocking access to websites hosting nonconsensual content.

Click on the link for the full story.

EDPB releases reports on CEF, anonymization stakeholder workshop

The European Data Protection Board issued a report recapping the work of the Coordinated Enforcement Framework in 2025, which focused on the implementation of the right to erasure across the EU. Additionally, the board published a second report containing highlights from an EDPB workshop held in December 2025 that sought stakeholder input for updated guidance on anonymization and pseudonymization following the Court of Justice of the European Union's decision in the EU Single Resolution Board v. European Data Protection Supervisor issued last September.

Click on the link for the full story.

AEPD releases guidance on agentic AI tools.

Spain's data protection authority, the Agencia Española de Protección de Datos, released guidance on agentic AI tools' potential data protection implications. The agency noted while AI could be a helpful tool, data controllers and processors should take caution when using AI. The AEPD said it believes "understanding this constantly evolving technology is key to making informed decisions when considering its implementation for personal data processing. In particular, it advocates proactively leveraging the opportunities offered by agentic AI for enhanced data protection by design."

Click on the link for the full story.

Meta to continue fight with FTC over monetization of underage users' data.

Meta filed paperwork with the U.S. District Court for the District of Columbia to continue its fight against the Federal Trade Commission after the authority argued teenage social media users' data cannot be monetized, MediaPost reports. Meta argued the FTC cannot block its 2020 settlement with Cambridge Analytica and indicated the FTC's proposal to prevent Meta's use of underage users' data for advertising purposes would significantly harm the company.

Click on the link for the full story.

Luxembourg's DPA now qualified to bring GDPR class-action litigation.

Luxembourg's National Commission for Data Protection announced it is now a qualified entity capable of bringing class-action litigation on behalf of consumers whose rights have been violated under the EU General Data Protection Regulation. The CNPD was granted these powers after the country's Consumer Code was amended November 2025.

Click on the link for the full story.

Texas attorney general sues Temu over alleged data harvesting.

Texas Attorney General Ken Paxton filed a lawsuit against Chinese-based retailer Temu for allegedly "deceiving consumers while covertly harvesting Texans' personal data." Paxton's lawsuit claimed Temu is "a trojan horse that allows the app to bypass security protocols and create a backdoor into user's private data" to support "harvesting vast swaths of data to be stored on servers in China." The lawsuit was filed under the Texas Deceptive Trade Practices Act. Editor's note: IAPP News Editor Joe Duball reported in 2024 how Texas has become a hotbed of privacy enforcement action on the state level.

Click on the link for the full story.

India reportedly considering a youth social media ban.

An unnamed senior official at the Ministry of Electronics and Information Technology of India indicated the government is considering passing legislation that would ban children under age 16 from accessing social media, following the lead of Australia and several European countries, the Hindustan Times reports. The official said the government could enact the ban by amending the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021. India Minister of Electronics and Information Technology Ashwini Vaishnaw said in a recent press conference the government is engaging with social media companies on age-based restrictions.

Click on the link for the full story.

Portugal moves toward child social media restrictions.

The Assembly of the Portuguese Republic approved the first reading of proposed requirements to limit minors' exposure to social media, Reuters reports. The bill, which passed 148-69, calls for explicit parental consent to allow children ages 13-16 to access social media. Noncompliance could result in fines of up to 2% of company revenue, Social Democratic Party lawmaker Paulo Marcelo said before the vote. Meanwhile, Time named Australian eSafety Commissioner Julie Inman Grant to its Time100 Health 2026 list, recognizing Inman Grant for her efforts to bolster online safety through enforcing Australia's under age 16 social media ban.

Click on the link for the full story.

ICO secures win in Court of Appeal's case against tech retailer.

The U.K. Information Commissioner's Office won its Court of Appeal's case against DSG Retail, with the court ruling the company should have implemented additional security measures to protect consumer data from unauthorized access even if the individuals could not be identified. ICO General Counsel Binnie Goh noted the ruling strengthens the authority's "ability to take robust action in the future and sends a clear message to all organisations: you have a protective duty to safeguard the personal data you hold."

Click on the link for the full story.

Ring stands by privacy practices following controversial Super Bowl ad.

Ring founder and Chief Inventor Jamie Siminoff claimed the company has secure privacy practices and does not store user camera data without a subscription following the company's controversial Super Bowl advertisement, The New York Times reports. The company faced pushback over ads for its Search Party feature, which aimed to allow users to opt in to use AI and camera images to find missing pets. Siminoff argued the tool does not collect user data by default and looks to serve as a helpful tool for consumers.

Click on the link for the full story.

IAPP Weekly News 16.02.2026 - 20.02.2026