1. UK Information Commissioner's Office ("ICO") releases a statement on Ofcom's assessment of highly effective age assurance.
The UK ICO welcomed Ofcom's rapid assessment of highly effective age assurance at the 16-age threshold, emphasizing its importance in protecting children from online harm. The ICO stressed that age gates must ensure personal information remains secure while allowing individuals to exercise data rights, urging social media and video-sharing platforms to implement appropriate measures immediately to shield underage users from unlawful data processing risks.
Click on the link for the full story.
2. Danish Data Protection Authority ("Datatilsynet") concludes its audit of personal data processing at Copenhagen Airport's duty-free shops.
Datatilsynet concluded an audit regarding Gebr. Heinemann Retail's practice of scanning boarding passes at duty-free shops to verify tax-exempt exports. The authority found that the retailer's legitimate interests in preventing financial losses outweighed data subjects' interests, highlighting that technical safeguards—such as the immediate anonymization of customers' full names and seat numbers—adequately mitigated risks, and noted the retailer proactively improved transparency by revising its privacy policy and adding explanatory signage.
Click on the link for the full story.
3. Policymakers scrutinize the deployment of youth personalization systems as child safety concerns mount.
As lawmakers and courts increasingly weigh the impacts of personalized recommendation systems on minors, experts are cautioning against a one-size-fits-all regulatory ban. Distinguishing between functional personalization—like adaptive learning tools—and high-impact engagement mechanisms designed to maximize screen time, privacy advocates emphasize the need for a risk-proportionate approach that restricts harmful data collection practices without eliminating features that genuinely support youth development and digital safety.
Click on the link for the full story.
4. Dutch Data Protection Authority ("AP") publishes its final enforcement policy for privacy violations.
The Dutch AP has officially issued its final enforcement policy, establishing a clearer framework to address privacy violations across the Netherlands. The updated guidance is designed to streamline sanctioning procedures and enhance supervisory cooperation, providing organizations with vital clarity on regulatory expectations and the specific mechanisms the authority will employ to enforce strict compliance with data protection laws.
Click on the link for the full story.
5. Italian Data Protection Authority ("Garante") highlights the need for balanced youth protection in the proposed EU Kids Act.
During a parliamentary hearing on the proposed EU Kids Act, the President of the Italian Garante emphasized that age verification measures on social media platforms must strictly limit data collection to respect the privacy and autonomy of minors. Acknowledging the necessity of curbing manipulative features and algorithmic profiling, the authority advocated for a risk-based, gradual approach to internet access that balances parental supervision with the growing self-determination capacity of young users.
Click on the link for the full story.
6. AI-enabled autonomous agents reshape the global cybersecurity threat landscape and targeted industry attacks.
The rapid deployment of autonomous AI agents by malicious actors is fundamentally reshaping the global cybersecurity landscape, enabling attackers to exploit vulnerabilities faster and target data-rich sectors such as legal and healthcare at unprecedented scales. As organizations face increasingly sophisticated extortion and ransomware incidents, experts are urging entities to prioritize foundational security basics—like multi-factor authentication and rapid patching—while regulators scramble to formulate comprehensive AI safety and liability frameworks.
Click on the link for the full story.
7. New York implements stringent chatbot safety legislation to protect minors from manipulative AI interactions.
New York has enacted sweeping legislation establishing robust safety guardrails for minors interacting with companion AI chatbots, explicitly banning systems designed to mimic human relationships or encourage self-harm. Effective January 2027, the law mandates strict age assurance mechanisms devoid of government-issued IDs and requires immediate deletion of verification data, marking a significant regulatory push against emotionally manipulative algorithmic behaviors that target vulnerable youth.
Click on the link for the full story.
8. European Commission advances Health Data Space templates and steps up Digital Services Act ("DSA") enforcement against online fraud.
The European Commission has opened a public consultation on draft templates governing data access and permit procedures for the secondary use of health data under the European Health Data Space ("EHDS"). In parallel, the Commission intensified its enforcement of the Digital Services Act by investigating major platforms, including Booking.com and Temu, over consumer fraud, illegal listings, and ad-labeling transparency, while actively consulting financial institutions and civil society on establishing a voluntary Code of Conduct against online scams.
Click on the link for the full story.
9. U.S. Federal Trade Commission ("FTC") intensifies scrutiny on corporate reliance on AI-driven personalized pricing.
The U.S. FTC has escalated its investigation into "surveillance pricing," ordering nine major retail and transportation companies to detail how consumer data and AI algorithms are utilized to set individualized prices and worker compensation. As bipartisan concerns mount regarding opaque pricing practices that leverage sensitive demographic and browsing data, regulatory bodies and state attorneys general are mobilizing to determine whether these dynamic pricing mechanisms violate foundational consumer protection laws.
Click on the link for the full story.
10. General Motors settles for United States Dollar ("USD") 220 million in a landmark multistate driver privacy enforcement action.
In the most significant data protection enforcement action of the state privacy era, General Motors agreed to a USD 220 million bipartisan settlement with 36 states over allegations of unlawfully collecting and brokering driver telematics data. The settlement, which builds upon a prior FTC order, mandates sweeping twenty-year injunctive remediation—including precise consent disclosures, stringent third-party due diligence, and comprehensive data deletion protocols—highlighting the potency of combining consumer protection and privacy authorities.
Click on the link for the full story.