Data protection and digital regulation developments, collected automatically from 17+ sources.
Get this as an email digestEFF asked a California appeals court to uphold a lower court’s decision to strike a tech CEO’s lawsuit against a journalist that sought to silence reporting the CEO, Maury…
Government invasion of a reporter’s home, and seizure of journalistic materials, is exactly the kind of abuse of power the First Amendment is designed to prevent. It represents…
EFF last summer asked a federal judge to block the federal government from using Medicaid data to identify and deport immigrants. We also warned about the danger of the Trump…
This blog also appears in our Age Verification Resource Hub: our one-stop shop for users seeking to understand what age-gating laws actually do, what’s at stake, how to protect…
The Italian data protection authority (DPA) has fined Verisure Italy €400,000 for unlawful marketing communications. The company lacked a valid legal basis for its marketing…
join the international community, including the UN’s Independent International Fact-Finding Mission, in calling on Iran to immediately restore internet and mobile communications…
The Supreme Court has reduced the fine imposed on Amazon France Logistique by the Data Protection Authority from 32 million euros to 15 million euros. The court ruled that Amazon…
Summary: A court has awarded €3,500 to a person whose financial data was accidentally sent to another customer by a bank. The court ruled that this unauthorized disclosure…
Commentary. Article 39 of the GDPR, titled "Tasks of the Data Protection Officer," describes the key responsibilities of the Data Protection Officer (DPO). This provision should…
English Summary: A court has awarded €3,500 to an individual whose financial data was accidentally sent by a bank to another customer. The court ruled that this unlawful…
Commentary. Article 39 of the GDPR, titled "Tasks of the data protection officer", describes the primary responsibilities of the data protection officer (DPO). This provision must…
The ICO has issued a consultation to seek organisations’ views on the processes the ICO follows when it suspects a breach of the UK GDPR or the Data Protection Act 2018
Editorial for UK Report January 2026
Blog for UK Report January 2026
Access Now appeals to you, President Yoweri Museveni, to ensure that people in Uganda have unfettered access to the internet, digital platforms, and all other communication…
As millions of people prepare to head to the polls in Uganda on January, 15 2026, Access Now and the #KeepItOn coalition — a global network of over 345 organizations from 106…
A university lecturer (the complainant) has requested access to the content of evaluation reports from independent reviewers and letters of recommendation that were prepared…
Updated biography: "Ava", law student (LL.B), part-time study, is pursuing certification as a Data Protection Officer. Works full-time with databases for the regulation of…
Read more about how ICE has spent hundreds of millions of dollars on surveillance technology to spy on everyone – and potentially even the entire population – in the United…
Read more about how ICE has spent hundreds of millions of dollars on surveillance technology to spy on anyone—and potentially everyone—in the United States, and how to follow the…
The National Commission for Information Technology and Civil Liberties met on Thursday, January 8, 2026, at 9:30 a.m. with the following agenda:
Facts. Finally, the court reiterated that consent was not required, because Article 6 of the GDPR provides alternative, legal grounds for data processing. Since the requirements…
Facts: A court has declared the decision of the Dutch Data Protection Authority (AP) to reject a complaint regarding the General Data Protection Regulation (GDPR) to be invalid.…
Read more about how enterprising hackers have started projects to monitor the activities of ICE and learn how you can track the expenditures of the Department of Homeland…
A court has dismissed the appeal of a patient who requested a correction of a medical report. The court ruled that a patient cannot request a correction of a medical examination,…
Facts: A court has annulled the decision of the Data Protection Authority (DPA) to dismiss a complaint concerning the General Data Protection Regulation (GDPR). The court…
Facts: A court has ruled that a television station lawfully published a video containing personal data of a board member of a listed company, as this information served the public…
Read more about how enterprising hackers have started projects to do counter surveillance against ICE, and learn how to follow the Homeland Security spending trail. U.S.…
Age verification mandates are spreading rapidly, ushering in a new era of online surveillance, censorship, and exclusion, not only for young people but for everyone. Laws…
This guide was written by Andrew Zuker, with support from the Heinrich Boell Foundation. The US government publishes vast amounts of detailed spending data, but searching through…
This guide was co-written by Andrew Zuker with support from the Heinrich Boell Foundation. The U.S. government publishes volumes of detailed data on the money it spends, but…
Age verification mandates are spreading fast, and they’re ushering in a new age of online surveillance, censorship, and exclusion for everyone—not just young people. Age-gating…
Commentary: Codes of Conduct (CoC) are voluntary instruments that establish specific data protection rules for certain categories of controllers and processors. In other words, a…
(1) Promotion of codes of conduct and supervisory authorities: * EDPB, 'Guidelines 1/2019 on codes of conduct and supervisory authorities pursuant to Regulation 2016/679', June 4,…
Commentary: Codes of Conduct (CoCs) are voluntary instruments that establish specific data protection rules for certain categories of controllers and processors. In other words, a…
(a) Demonstrable independence and expertise (a) Demonstrable independence and expertise (a) Demonstrable independence and expertise It is clear from Article 41(1) of the GDPR that…
(1) Promotion of codes of conduct and supervisory authorities: * EDPB, 'Guidelines 1/2019 on codes of conduct and supervisory authorities in accordance with Regulation 2016/679',…
(a) Demonstrable independence and expertise (a) Demonstrable independence and expertise. (a) Demonstrable independence and expertise. It is clear from Article 41(1) of the GDPR…
So-called “tourist” cameras used by municipalities to promote a region should not be used to collect personal data. The CNIL presents a summary of the inspections conducted on…
The Ministry of National Education and the CNIL are organizing the “Trophées des classes” contest, whose theme for this year’s edition is “How do I protect my privacy online?”
2025 was the year age verification went from a fringe policy experiment to a sweeping reality across the United States. Half of the U.S. now mandates age verification for…
2025 was the year in which age verification shifted from a niche experiment to a widespread reality in the United States. Currently, half of the US states require age verification…
Our guides on privacy protection and self-defense (Surveillance Self-Defense, SSD), which provide practical tips and explanations on how to deal with government and corporate…
Our Surveillance Self-Defense (SSD) guides, which provide practical advice and explainers for how to deal with government and corporate surveillance, had a big year. We published…
In at least a dozen states, legislators believe they can pass laws prohibiting minors from accessing social media, or requiring them to obtain parental consent before logging in.…
In the name of "protecting children online," Congress introduced legislation this year that could have severely compromised our privacy and restricted freedom of expression. These…
Lawmakers in at least a dozen states believe that they can pass laws blocking young people from social media or require them to get their parents’ permission before logging on.…
In the name of 'protecting kids online,' Congress pushed forward legislation this year that could have severely undermined our privacy and stifled free speech. These…
Throughout 2025, EFF conducted groundbreaking investigations into Flock Safety's automated license plate reader (ALPR) network, revealing a system designed to enable mass…
Throughout 2025, EFF conducted groundbreaking research into Flock Safety's automated license plate recognition (ALPR) system, uncovering a system designed to enable mass…
This year, we resisted the return of a dreadful idea that has not improved over the years: laws that enable the blocking of websites. More than a decade ago, Congress attempted to…
You may not have noticed, given the numerous reports focusing on new questions regarding copyright and generative AI, but the biggest copyright case of the year concerned a…
You might not know it, given the many headlines focused on new questions about copyright and Generative AI, but the year’s biggest copyright case concerned an old-for-the-internet…
This year, we fought back against the return of a terrible idea that hasn’t improved with age: site blocking laws. More than a decade ago, Congress tried to pass SOPA and PIPA—two…
EFF’s attorneys, activists, and technologists don’t just do the hard, endless work of defending our digital civil liberties — they also spend a lot of time and effort explaining…
Artificial Intelligence: Building Data Protection In from the Start
The deployment of drones as first responders (Drone First Responder, DFR) has truly gained momentum in 2025. Although the concept has existed since 2018, this year the technology…
The lawyers, activists, and technologists at EFF not only do the difficult, ongoing work of defending our digital civil liberties but also devote significant time and energy to…
It is no secret that digital surveillance and other forms of technology-enabled oppression pose serious dangers to people active in liberation movements. The increasing trends of…
Drone as first responder (DFR) adoption really took off in 2025. Though the concept has been around since 2018, this year saw more normalization of the technology, its integration…
It's no secret that digital surveillance and other tech-enabled oppressions are acute dangers for liberation movement workers. The rising tides of tech-fueled…
Professionals (doctors, lawyers, notaries, etc.) are increasingly being evaluated online through directories that include rating and review systems. The CNIL explains the…
This year, you may have heard EFF speaking out about our civil liberties on NPR, BBC Radio, or via various podcasts. But in 2025, we also began sharing our message directly with…
This year, you may have heard EFF sounding off about our civil liberties on NPR, BBC Radio, or any number of podcasts. But we also started sharing our voices directly with…
Webshops are generally not permitted to require customers to create an account before they can make a purchase. This is evident from new recommendations by the European Data…
Online stores are generally not allowed to require customers to create an account before they can make a purchase. This is according to new recommendations from the European Data…
On December 22, 2025, the CNIL sanctioned NEXPUBLICA FRANCE with a fine of 1,700,000 euros for failing to implement sufficient security measures for its PCRM software, a user…
Since the European Commission has determined that the United Kingdom continues to provide a level of protection substantially equivalent to that of the European Union, transfers…
On December 9, 10, and 12, as part of GDPR Day in Nantes, the CNIL met with students, digital mediators, and city officials. The program included discussions and awareness-raising…
The Data Regulation establishes a European framework for organizing the sharing and use of data from connected devices. It strengthens users’ rights and creates new obligations…
On December 11, 2025, the CNIL sanctioned MOBIUS SOLUTIONS LTD, a processor responsible for a data breach affecting users of the company DEEZER. A fine of one million euros was…
Online & Mobile tracking Austrian Supreme Court (OGH): Meta must provide full access to all personal data of user within 14 days, including the sources, recipients and purposes…
Electronic Health Records: Data Protection Builds Trust and Encourages Use
The National Commission for Information Technology and Civil Liberties met on Thursday, December 18, 2025, at 9:30 a.m. with the following agenda:
Online & Mobile tracking TikTok not only tracks its users while they are using the TikTok app itself, but it is increasingly integrated with many other websites and apps. For…
The Dutch Data Protection Authority (AP) has fined HAN University of Applied Sciences (HAN) €175,000 for violating the General Data Protection Regulation (GDPR). An investigation…
TikTok tracks the activities of its users, even when they are using other apps. As a result, the video platform also knows which dating app you are using.
The Dutch Data Protection Authority (Autoriteit Persoonsgegevens) has imposed a fine of 175,000 euros on HAN University of Applied Sciences (HAN) for violating the General Data…
For the time being, TikTok continues to send user data to, among others, China. In doing so, the company is acting against a joint decision by the European privacy regulators, who…
Access Now and several human rights groups are deeply alarmed by the allegations of MTN Congo's enabling of human rights abuses.
Access Now,together with several human rights organizations, are calling on MTN Group to protect mobile service subscribers and ensure transparency and accountability for data…
This article highlights evidence-based alternatives that strengthen child safety while simultaneously protecting encryption and fundamental rights. It advocates for better…
G7 Data Protection Authorities Continue Their Joint Efforts to Promote International Data Protection
Access Now’s latest report, Internet shutdowns in armed conflict: a typology of harms, unpacks the serious harms that internet shutdowns inflict on civilian populations during…
EDRi partner Danes je nov dan launched a multifaceted campaign in response to a government proposal that would allow the Slovenian Intelligence and Security Agency (SOVA) to use…
What has the EDRi network been doing over the past few weeks? Discover the latest news on digital rights in our bi-weekly newsletter. In this edition: 2025 is almost over, but we…
The European Ombudsman has found that the European Commission ignored important transparency laws during the preparation of the Europol Regulation, which is part of the…
This article highlights evidence-based alternatives that strengthen child safety while safeguarding encryption and fundamental rights. It calls for better enforcement, more…
EDRi affiliate Danes je nov dan launched a multi-faceted campaign in response to a government proposal that would allow the Slovene Intelligence and Security Agency (SOVA) to use…
The European Ombudsman has found that the Commission disregarded important transparency rules while preparing the Europol Regulation, which is a part of the legislation to…
What has the EDRi network been up to over the past few weeks? Find out the latest digital rights news in our bi-weekly newsletter. In this edition: 2025 might be almost over, but…
As the instability in the US legal system becomes increasingly apparent and the US sends openly hostile signals toward the EU, it is time to reconsider where our data is being…
Data Transfers Most EU-US data transfers are based on the “Transatlantic Data Privacy Framework” (TAFPF) or so-called “Standard Contract Clauses” (SCCs). Both instruments rely on…
The European Commission has fined X for violating the Digital Services Act (DSA), proving that this groundbreaking European law can indeed have an effect. Despite political…
The European Commission took aim at X for breaking the DSA, proof that Europe’s landmark law can bite. Despite political pressure and corporate pushback, the EU is showing that…
Cookie Banners So-called ‘Pay or Okay’ systems are on the rise in Europe. Instead of giving users a choice to either accept or reject ad tracking, Pay or Okay systems require a…
Brussels, 4 December - During the last plenary meeting, the EDPB (European Data Protection Board) adopted recommendations on the legal basis for requiring the creation of user…
The ruling on the relationship between the European Data Protection Supervisor (EDPS) and the Single Resolution Board (SRB) touches upon the core of the fundamental right to data…
In light of the upcoming "Pay or Consent" guidelines from the EDPB (European Data Protection Board), noyb commissioned a study into user choice options.
The EDPS vs. Single Resolution Board judgment goes to the heart of the EU’s fundamental right to data protection, shaping how artificial intelligence, data spaces and so-called…
Brussels, 4 December - During its latest plenary, the EDPB adopted recommendations on the legal basis for requiring the creation of user accounts on e-commerce websites. In…
Brussels, 3 December - As part of its December’s plenary meeting, the European Data Protection Board (EDPB) held yesterday an online meeting with Commissioners and representatives…
Over the coming months, the Dutch Data Protection Authority (AP) will be conducting random inspections of healthcare providers, such as hospitals and primary care centers. The AP…
Brussels, 3 December - During the December plenary meeting, the European Data Protection Board (EDPB) yesterday held an online meeting with commissioners and representatives of…
In the coming months, the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) will conduct random inspections of healthcare providers, such as hospitals or general…
"Use cookies wisely." With this message, the Dutch Data Protection Authority (AP) is launching a three-week public awareness campaign, urging organizations to review their cookie…
“Handle cookies smartly.” With this message, the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) is starting a 3-week public campaign, calling on organisations to…
Brussels, 28 November - The EDPB has published a call for expressions of interest to establish a new reserve pool for the "Support Pool of Experts" (SPE) programme. The objective…
Brussels, 28 November - The EDPB launched a call for expression of interest to establish a new reserve list for the Support Pool of Experts (SPE) programme. The objective is set…
Cookie Banners Today, the French data protection authority CNIL has fined the French magazine publisher Conde Nast €750.000 for violating the consent requirements on its Vanity…
Artificial intelligence systems require a vast amount of human labor, carried out by millions of workers, often in countries in the Global South, under precarious conditions. In…
What has the EDRi network been up to in recent weeks? Discover the latest news on digital rights in our biweekly newsletter. In this edition: The “Digital Omnibus” curtails…
The European Commission's new "Digital Omnibus" is presented as a simple "simplification", but in practice, it undermines important safeguards in the GDPR, the ePrivacy rules, and…
AI systems involve a huge amount of human effort at the hands of millions of workers, often in Global South countries, working in precarious conditions. In this blog, EDRi member…
The European Commission’s new Digital Omnibus is presented as simple “streamlining”, but in practice it dismantles key safeguards in the GDPR, ePrivacy rules and the AI Act. It…
What has the EDRi network been up to over the past few weeks? Find out the latest digital rights news in our bi-weekly newsletter. In this edition: Digital Omnibus rolls back…
Age verification is a short-sighted, ineffective, and dangerous means of protecting young people from online risks. It is a disproportionate measure, especially since better…
Since September 2025, the General Data Protection Regulation (GDPR) has been in effect. This new European regulation aims to give consumers within the EU more control over the use…
Driven by Metamorphosis, a member of EDRi, e-Society.mk brings together top experts and decision-makers to discuss the future of the digital society. The article "e-Society.mk…