News

Open Letter: Civil society coalition urges EU to kill the cookie banner!

GDPR Policy For once, EU legislators have an opportunity to deliver genuine simplification for people: a solution to the ongoing issue of misleading cookie banners. As part of its…

SCHUFA insists on shadow database. noyb lawsuit now certain

Credit Scoring Two weeks ago, noyb sent a cease-and-desist letter to SCHUFA regarding its shadow database. At the same time, we announced that we would bring an injunction should…

Garante per la protezione dei dati personali (Italy) - 666

Sf deleted page Garante per la protezione dei dati personali (Italy) - 666 Wanted to show a technicla error, and in trying it submitted

Health data breach: the CNIL fined Hôpital Privé de la Loire 500 000 EUR

Background informationDate of final decision: 3 September 2026National caseController: Hôpital Privé de la LoireLegal Reference: Article 32 (Security of processing), Article 34…

Digital Sovereignty: What It Is, What It Could Be

The term “digital sovereignty” has become ubiquitous. European officials invoke it in debates about cloud infrastructure, AI, semiconductors, and platform regulation. Governments…

Cops Play Hide and Seek About Using Spy Tech to Avoid Scrutiny and Bad PR

Law enforcement agencies across the country are increasingly relying on spying technologies—automated license plate readers (ALPR), cell-site simulators, and facial recognition,…

Failure to respect individuals' rights: fine of 300,000 euros imposed on the company EXTIA ⇄

On 21 July 2026, the CNIL imposed a fine of 300,000 euros on the company EXTIA for various violations relating to the respect of individuals' rights, in particular the right to…

New Records Reveal Problems with Medicare’s AI Prior Authorization Experiment

EFF sued the government back in March for information about the Wasteful and Inappropriate Service Reduction (WISeR) model, a new Medicare program that uses AI to evaluate prior…

Why the EU age-verification tool does not solve privacy concerns

An EU legislative proposal for a social media ban will be presented at the State of the European Union (SOTEU) annual address, but the tools which are pitched as “ready” and…

AP opens its doors during 'Rondje Rechtsstaat': come by ⇄

Are you curious about what goes on behind the doors of the Dutch Data Protection Authority (AP) at Lange Voorhout number 7 in The Hague? And what the AP does for you? On Saturday,…

EDRi stands in solidarity with Autistici/Inventati after “terrorist” designation by the US government

The United States government has designated the Italian non-profit organisation Autistici/Inventati as a "Specially Designated Global Terrorist" for providing digital…

Agenda of the plenary session of 3 September 2026 ⇄

The French Data Protection Authority (Commission nationale de l'informatique et des libertés) met on Thursday 3 September 2026 at 9:30 a.m. with the following agenda:

New for SMEs: practical templates to comply with privacy rules ⇄

The Dutch Data Protection Authority (AP) has published 2 practical documents specifically for SMEs. These are templates for a processing register and a privacy statement. This…

Data Protection Commission announces Final Decision following Inquiry into the Health Service Executive (HSE)

Background informationDate of final decision: 28 August 2026National caseLegal Reference(s): Article 5 (Principles relating to processing of personal data), Article 32 (Security…

Health Data Breach: Fine of €500,000 Imposed on HÔPITAL PRIVÉ DE LA LOIRE ⇄

On 3 September 2026, the CNIL imposed a fine of €500,000 on HÔPITAL PRIVÉ DE LA LOIRE for failing to implement appropriate measures to ensure the security of its patients' data…

14 students and opposition politicians targeted by spyware in Serbia

EDRi member SHARE Foundation has confirmed that at least 14 people in Serbia were targeted with advanced spyware since the beginning of 2026 – the largest documented wave of such…

The EU is ready to bet billions on data centers. Not all countries want in.

An EU industrial policy plan to build AI infrastructure is forcing European capitals to free up investment — or else fall further behind.

Judge Rules DOD Unlawfully Retaliated Against Anthropic

A federal judge has sided with Anthropic on its claims that the Department of Defense illegally retaliated against Anthropic’s protected speech by labeling the AI company a…

Meta's $17 Billion Settlement is a Bad Deal for Teens and All Social Media Users

Meta’s settlement with 52 state attorneys general is a bad deal for all internet users, and especially for teens. That’s what we said the day the settlement was announced. In this…

Supreme Court: CRIF illegally collected data of millions in Austria. Way clear for class action!

Credit Scoring In June 2026, noyb brought an injunction against the unlawful data collection practices of the Austrian credit reference agency CRIF. In several unrelated cases,…

LGBT Q&A: What’s One Thing I Can Do Today to Improve My Safety and Security Online as an LGBTQ+ Person?

This post is adapted from a video recorded by EFF and the Trevor Project. Head over to our TikTok or Instagram to watch! EFF answers all the queer digital rights questions you…

Doxxing Safety Pt I: Prevention and Footprint Management

Doxxing is the deliberate disclosure of personal information in order to bully, harass, intimidate, or instigate a chain of harms against someone. It's a tricky thing to protect…

Doxxing Safety Part II: Incident Response

Doxxing, also known as the deliberate sharing of personal information to harass or endanger someone, is a tricky thing to protect against. It often happens by some ill-intentioned…

EFF to Courts: Don’t Rewrite Copyright Over AI Hype

The history of technology is rife with copyright panics. In the 1980s, major rightsholders ran to Congress and the courts, claiming that videotape recorders (VTR) were “to the…

EFF to Governor Newsom: Veto California’s AB 1709

The California legislature passed Assembly Bill 1709 (A.B. 1709) today, which functions as a sweeping ban on social media use for young people under the age of 16. This…

Climate and AI to loom large in von der Leyen’s State of the Union

Drafting is advancing on a speech that will set the course for the next phase of Ursula von der Leyen’s Commission.

EFF and Allies on Brazil's Elections: Privacy Protections are Crucial to Electoral Integrity

EFF, Access Now, and Data Privacy Brasil are putting forward recommendations to strengthen robust privacy and data protection safeguards in the context of Brazil's elections. The…

Raising Awareness About Data Protection Among Fifth-Grade Students ⇄

In 2026, the CNIL educated 2,500 fifth-grade students in the Oise department about digital issues and the protection of personal data. Are you a teacher? On this page, you’ll find…

Advice from the AP to WordPress Users Affected by the Data Breach ⇄

Vulnerabilities have recently been discovered in the WordPress software. WordPress is used quite extensively in the Netherlands. These vulnerabilities in WordPress are currently…

Apple threat notifications and spyware: what everyone should know

Since 2001, Apple has been warning its users when they may have been targeted by spyware, using email, iMessage, and banners in their accounts. But in September of this year,

French Top Court Gets It Right, Strikes Down Social Media Ban For Youths

Earlier this month, France’s top court struck down the country’s legislation that banned social media use for people under 15 years old, which had been scheduled to take effect in…

EFF Statement on Meta Settlement

Under this settlement, young users will now have less access to Meta products, and a lesser ability to exercise their rights to speak, access information and art and culture,…

EFF's Policy Position on ALPR Surveillance: Eliminate It and Reduce Its Harms

Automated license plate readers (ALPRs) build a searchable map of everywhere a driver goes, fed into databases that police, ICE, and private vendors can query after the fact.…

A List of ICE Subpoenas to Tech Companies

Immigration and Customs Enforcement (ICE) has conducted unlawful investigations into dozens of individuals who have documented ICE activities in their communities, social media…

AI: The CNIL Updates Its Tool for Tracking Open-Source Models ⇄

The CNIL has released a new version of its demo tool that allows users to explore the lineage of open-source AI models. This update notably improves the tool’s performance and…

AP (The Netherlands) - Uber B.V & Uber Technologies Inc.

The DPA fined Uber €824.99 million for automatically deactivating drivers’ accounts without human intervention, in violation of Article 22 GDPR, and for insufficient transparency.…

GDPRhub style guide

Consistent indication of dates Use a comma if the number is 1,000 or bigger, don't use a comma if it's smaller.Use a comma if the number is 1,000 or bigger, don't…

Elementary and Secondary Education: Guidelines and Best Practices for Using Online Collaboration Tools ⇄

Elementary and secondary schools wishing to use online collaboration tools must exercise caution regarding the protection of personal data. The CNIL outlines the rules to follow…

Higher Education: Guidelines and Best Practices for Using Online Collaboration Tools ⇄

Higher education institutions wishing to use online collaboration tools must exercise caution regarding the protection of personal data. The CNIL reiterates the rules that apply…

EFF and Civil Society Groups Call on Nottinghamshire Police to Halt Live Face Recognition

This week, EFF, along with Big Brother Watch, Defend Digital Me, Liberty, Open Rights Group, Race Equality First, Statewatch, and Stopwatch, wrote to Nottinghamshire Police Force…

Uber fined nearly 825 million euros for automated blocking of drivers ⇄

The Dutch Data Protection Authority (Autoriteit Persoonsgegevens) has imposed a fine of 824,990,000 euros on Uber. The reason for this is the Authority's ruling that Uber made…

Intermediary Liability in Brazil: The Intricate Path Ahead

Brazil's new internet intermediary liability regime is underway. The implementation of changes established by the Supreme Court includes notice and takedown mechanisms and duty of…

LAYING THE GROUNDWORK FOR AI-POWERED CYBERSECURITY

The EU’s Action Plan on Cybersecurity and AI lays the groundwork for new, AI-powered approaches to IT security but organizations need to ensure their security foundations are fit…

Some Tech Companies Have Privately Pushed Back on ICE Subpoenas. They Should All Do More.

In a handful of known cases, large social media companies have privately pushed back against Immigration and Customs Enforcement (ICE) subpoenas when the agency tried to unmask…

Credit Denial: Frequently Asked Questions ⇄

Did you apply for a loan and get turned down? Are you listed in a registry maintained by the Banque de France or in a registry kept by your bank? What steps do you need to take?

Ninth Circuit Ruling Will Force Online Platforms That Host User Speech to Fight Lengthy and Costly Lawsuits Before They Are Dismissed Under Section 230

A federal appeals court just made it harder for online services, big and small, to get lawsuits over user speech dismissed early. In California v. Meta, a Ninth Circuit…

Hack of the Tax Information System: Investigations Are Underway ⇄

The CNIL has been notified of data breaches affecting the information system of the Directorate General of Public Finance (DGFiP). It is therefore already investigating these…

The FRIA for AI systems is coming: prepare yourself ⇄

Are you a government organization or a private organization providing public services? And do you plan to use a high-risk AI system? Or will you, as a public or private…

Visit the AP: Rule of Law Tour on 12 September 2026 ⇄

Are you curious about what happens behind the doors of the Dutch Data Protection Authority (AP)? You are cordially invited to the Bentinckhuis at Lange Voorhout 7 in The Hague on…

Vita Activa & the Digital Security Helpline join forces to support mental health and digital safety for activists

Access Now's Digital Security Helpline and Vita Activa offer holistic digital safety and mental health support for activists.

Too Little, Too Late: Flock Admits Their Technology Needs Reforms

Flock Safety, the embattled vendor of mass surveillance technology, has rolled out a handful of new reforms intended to appease the justified nationwide anger that has seen scores…

#KeepItOn @10: celebrating a decade of fighting internet shutdowns

Internet shutdowns have to stop. As Access Now marks the 10th anniversary of the #KeepItOn campaign in 2026, we’re reflecting on the path travelled so far — and the journey still…

Dismiss Church’s Trademark Lawsuit Against “Mormon Stories” Podcast, EFF Urges Court

Imagine if McDonald’s could use trademark law to control how you use the term “fast food.” Or if the Canadian government could stop you from using the word “Canada” in the title…

Zuckerberg warns against centralizing AI power

In a 6,500 word essay, Zuckerberg detailed his vision for AI.

Data Protection Officer: Identifying and Managing Conflicts of Interest Related to the DPO Role ⇄

The GDPR allows organizations to assign other responsibilities to their Data Protection Officer (DPO). However, these responsibilities must not interfere with the DPO’s core…

Anthropic and OpenAI models attempted to deceive software developers ⇄

These AI models aim to trick people into unwittingly participating in a cyberattack. This is fueling the debate about the dangers of AI development.

CNIL Board: Five New Members Appointed on August 2, 2026 ⇄

Effective August 2, 2026, five new members will join the CNIL. These appointments are part of a partial renewal of the Board.

#KeepItOn: authorities in Zambia must resist hitting the kill switch during upcoming elections

Access Now and the #KeepItOn coalition — a global network of over 370 organizations from 106 countries working to end internet shutdowns, through an open letter, are urging…

Can I request that my personal information be removed from an online news article? ⇄

Any affected individual has the right to request that a media organization delete personal data about them that appears in an online news article. However, this is not an absolute…

Tomorrow’s U.S. Senate Vote: Four Internet Bills, One Wrong Direction

The Senate Commerce Committee will vote this week on several censorious and privacy invasive bills: KOSA, the SCREEN Act, Youth AI Privacy Act, and CHATBOT Act. While we…

Appeals Court Agrees with EFF that Building a Web Browser Doesn’t Violate the CFAA

The Ninth Circuit Court of Appeals has endorsed a commonsense technical interpretation of the Computer Fraud and Abuse Act (CFAA), a law not usually given to such interpretation.…

Technology's Power in the Hands of the People

In the scorching heat of every Las Vegas summer, EFF joins thousands of hackers, makers, policy analysts, and activists for the world's largest computer security gathering. If…

Mobile Ad Software Encourages Location Data Sharing, EFF Report Finds

Developers Must Beware of Ad Libraries that Betray Users’ PrivacySAN FRANCISCO – Some software development kits (SDKs) provided by advertising companies to help developers…

Joint statement on surveillance and interception in Bangladesh

DPD: privacy risks from the use of menstruation apps ⇄

If you track your menstrual cycle in an app, you are sharing highly sensitive information. Often, it remains unclear what such an app does with this information or with whom these…

EFF Joins Call for FTC to Drop Its Disastrous AI Policy Proposal

The Federal Trade Commission (FTC) in July issued a proposed policy statement “concerning the suppression of accuracy in artificial intelligence systems.” We urge the FTC to…

EFF Joins 18 Civil Rights Organizations Calling on Governor Hochul to Reject the Stealth Crawler Prohibition Act

EFF joined a group of 18 civil society organizations to send a letter encouraging New York Governor Kathy Hochul to veto Senate Bill 9934A, the New York Stealth Crawler…

The Senate Should Reject KOSA's Privacy Risks

Update: The Senate Commerce Committee voted to advance this bill on August 5, 2026. EFF continues to oppose the bill, which still needs approval from the full Senate. The Senate…

White House finalizes voluntary AI oversight framework

The administration is preparing to brief leading AI companies on its blueprint for reviewing advanced AI models.

EFF at BSidesLV, Black Hat, and DEF CON 👨‍💻

It's time. Time for tinkerers, security researchers, hackers, and fellow nerds to gather together in signature black hoodies and utilikilts to beat the heat in Las Vegas for the…

The CHATBOT Act Forces One Parenting Model On Every Family

Update: The Senate Commerce Committee voted to advance this bill on August 5, 2026. EFF continues to oppose the bill, which still needs approval from the full Senate. Artificial…

The SCREEN Act Threatens Privacy Far Beyond Adult Websites

Update: On August 5, 2026, The Senate Commerce Committee voted 15-13 to advance this bill, but the bill did not advance because of a lack of Senators in attendance. EFF continues…

EFF Guide to Recording Law Enforcement

This post is available as a printable one page handout in English and Spanish. Recordings of law enforcement, whether by bystanders or by those directly encountering officers, can…

As of August 2, it will become clearer whether it is AI or real ⇄

The chat with the webshop's customer service, that video on social media, the photo on a news site: as of August 2, 2026, it must be stated in many cases that artificial…

Commission launches major hiring push for AI Office

The EU's executive is seeking contract agents for two units within the two-year-old AI Office just as its power is expanding.

Watch the Webinar - Updates to MR-001 and MR-003: What's Changing in 2026 ⇄

The CNIL invites you to explore a topic or current event related to data protection through a series of webinars. Check out this new episode focused on reference methodologies in…

EU launches €30B push to build 7 massive AI data centers

Germany, Greece, Portugal, Italy and Spain are backing plans to build the largest hubs.

1,741 “informed” consents with one click?! GDPR complaint against dict.cc filed

Cookie Banners Today, noyb has filed a complaint against the popular online dictionary dict.cc. The GDPR requires that consent is freely given, informed, specific and unambiguous.…

🏃 Fitness Tracker Privacy Fails | EFFector 38.14

Watches, bands, and rings—if you want to digitally monitor your fitness, more companies than ever are selling devices to do it. And more Americans than ever now own at least one…

OpenAI’s rogue models roamed the internet for 4 days and staged a second attack

A new analysis reveals that the artificial intelligence company’s most powerful models spent days probing the open internet before breaching AI developer platform Hugging Face.

Why Are Gay Bars Building Databases of Their Patrons?

Update 8/10/2026: Two San Francisco bars that used Patronscan have said they will stop using the system after listening to customers’ privacy concerns. EFF applauds this change…

Anthropic CEO: Don’t ban cheap AI — but clamp down on China

Dario Amodei continued to stand aloof from other U.S. tech leaders’ unified praise for inexpensive “open weight” models.

Advanced Search ⇄

Swap to "decisions" backend gdprhub" level="submit" path="search-embed" width="100%" height="10000" />"decisions" path="search/embedded" width="100%" height="10000" />

Ransomware attacks: learn from the mistakes of others ⇄

A ransomware attack often does more than just shut down computer systems. The personal data of hundreds, and sometimes millions, of people can also be compromised. Organizations…

Can Europe’s new AI safety regime tame US rogue agents — and Chinese ambitions?

The first-ever case of an artificial intelligence agent going rogue coincides with the EU's major new powers to regulate AI. But Europe's leverage may be limited by the U.S.-China…

Missed EFF's Livestream with Adam Savage and iFixit? Listen Here!

EFF’s first EFFecting Change livestream was all the way back in July of 2024. Maybe you've caught each stream, or maybe you’ve only caught a few. Or maybe you’re like me and…

Farmers Are Getting Control Of Their Equipment Back

For years, John Deere had actively made repairing their tractors near-impossible for anyone but itself and the few "authorized" repair shops—regardless of the ability of its…

Hundreds of Drone-as-First-Responder Programs Could Soon Be Launched Across the Country

Police departments across the country are lining up to launch drone-as-first-responder (DFR) programs, and hundreds have cleared a necessary hurdle toward making deployment a…

Brussels is coming for Google — and the bill could be huge

Google could be hit with the largest fine yet under the EU’s Digital Markets Act. Zoya Sheftalovich and Kathryn Carlson explain why Brussels believes the tech giant is unfairly…

Oral statement at the United Nations Global Mechanism on ICT Security

OpenAI’s models broke free and launched a cyberattack. US Congress wants new rules before it happens again.

The first fully autonomous breach by OpenAI’s most powerful AI models has prompted a bipartisan push for stronger oversight over increasingly powerful artificial intelligence…

The Fourth Circuit Says Border Agents Can Search Your Phone By Hand, No Suspicion Required

Legal intern Suzanne Castillo was the principal author of this post. The Fourth Circuit issued a disappointing opinion in U.S. v. Belmonte Cardozo, a case in which EFF filed an…

Trump administration steers $5B toward AI research

The initiative marks a wider push to steer federal science funding toward AI-powered research and individual investigators.

Q&A - CNIL Recommendation on Pixels in Emails ⇄

The CNIL addresses the main questions professionals have about implementing its recommendation on tracking pixels.

Watch the Webinar - Suppliers and Service Providers in the “Pixels” Ecosystem: How to Implement the CNIL Recommendation? ⇄

The CNIL invites you to explore a topic or current event related to data protection through a series of webinars. Check out this new episode on tracking pixels.

“Stealth Crawlers” Are Not a Threat to the Open Web. Bills Targeting Them Would Be.

There’s a new boogeyman in the battles over AI: so-called “stealth crawlers.” We’ll admit it—the term “stealth crawlers” sounds quite nefarious. In reality, they’re anything but.…

Protect Your Privacy with California's DROP Tool

Are you a California resident? Then we've got exciting news for you: there's a tool just for you that lets you take a single, relatively easy step to protect your privacy. It's…

The EDPS Calls for a Legal Basis for Cross-Regulatory Information Sharing ⇄

At a high-level meeting held in Dublin on July 16 and 17, 2026, the European Data Protection Board (EDPB) called for a clear legal basis for the sharing of information among…