Data protection and digital regulation developments, collected automatically from 17+ sources.
Get this as an email digestVersion 2 of our report includes specific recommendations for the EU legislator on each of the most important articles, including on whether to reject or maintain proposed changes
The government has launched a consultation to seek views on whether under 16s should be banned from accessing social media
Earlier this month, Iran’s internet connectivity faced one of its most severe disruptions in recent years with a near-total shutdown from the global internet and major…
So many data breaches happen throughout the year that it can be pretty easy to gloss over not just if, but how many different breaches compromised your data. We're diving…
We're taking part in Copyright Week, a series of actions and discussions supporting key principles that should guide copyright policy. Every day this week, various groups are…
Credit Scoring An investigation into data flows at the Austrian credit agency CRIF has shed further light on the matter: most of the address data in the CRIF database comes from…
A partial granting of a request under the Public Access of Information Act (Ministry of Finance) regarding the "policy situation" surrounding Transaction Monitoring Netherlands…
Brussels, 19 January - During its latest plenary, the EDPB adopted a report to support the European Commission’s evaluation of the Law Enforcement Directive (LED). The Commission…
Report: "Information Security within Digital Voting Assistance Tools," attached as an appendix to the evaluation of the Dutch Lower House elections of October 29, 2025.
"The purpose of this research is to identify the need for player data for independent research with social and/or scientific objectives in the field of gambling behavior. The…
WODC report: "Five Years of the WAMCA Act: An Evaluation of the Act on the Resolution of Mass Claims in Collective Actions (2020-2025)." "This evaluation examines how collective…
"Corporate Europe Observatory (CEO)", which describes itself as "a research group and advocacy organization dedicated to exposing and addressing the privileged access and…
"The research was structured around three main questions: (1) What is the legal framework in different European countries for collecting (online) data for the purpose of…
"The government recognizes the importance of protecting fundamental rights and appreciates that the Commission also gives attention to this issue. Nevertheless, the government has…
Planning for the SUWI work agenda. This section provides more information about the planning for legislative proposals concerning "careful data exchange (legal basis)" and…
Rathenau Institute, "The Price of Free Internet: Directions for Future Online Tracking Policy (2025)," including a letter from the Parliament responding to the report.
Amendment to the Implementing Act of the General Data Protection Regulation and several other laws, concerning the streamlining and updating of data protection law (Data…
Rathenau Institute, The price of free internet. Directions for future online tracking policy (2025), including a Letter to Parliament responding thereto.
Amendment of the GDPR Implementation Act and several other laws in connection with the streamlining and updating of data protection law (Data Protection Omnibus Act); Memorandum…
A partial granting of a Woo decision (Ministry of Finance) regarding the 'policy situation' surrounding Transaction Monitoring Netherlands.
WODC report 'Five years of WAMCA. Evaluation of the Mass Damage Settlement in Collective Action Act (2020-2025)'. "This legislative evaluation examines how the collective action…
"The purpose of this study is to inventory the need for player data for independent research with a social and/or scientific objective in the field of gambling behavior. The…
"The research is structured around three main questions: (1) What is the legal framework in various European countries for the collection of (online) data for the purpose of the…
SUWI work agenda planning. This contains more information regarding the planning of legislative proposals for inspection 'careful data exchange (legal bases)' and proactive…
“The cabinet endorses the importance of the protection of fundamental rights and appreciates that the Commission is also paying attention to this. Nevertheless, the cabinet…
'This briefing analyses the establishment of the European Anti-Money Laundering Authority (AMLA) as a cornerstone of the EU’s 2024 Anti-Money Laundering/Countering the Financing…
'Corporate Europe Observatory (CEO)', which describes itself as "a research and action group committed to exposing and tackling the privileged access and influence enjoyed by…
The Baton Rouge Police Department announced this week that it will begin using a drone designed by military equipment manufacturer Lockheed Martin and Edge Autonomy, making it one…
Lawmakers in Washington are once again focusing on kids, screens, and mental health. But according to Congress, Big Tech is somehow both the problem and the solution. The Senate…
EFF asked a California appeals court to uphold a lower court’s decision to strike a tech CEO’s lawsuit against a journalist that sought to silence reporting the CEO, Maury…
Government invasion of a reporter’s home, and seizure of journalistic materials, is exactly the kind of abuse of power the First Amendment is designed to prevent. It represents…
EFF last summer asked a federal judge to block the federal government from using Medicaid data to identify and deport immigrants. We also warned about the danger of the Trump…
This blog also appears in our Age Verification Resource Hub: our one-stop shop for users seeking to understand what age-gating laws actually do, what’s at stake, how to protect…
The Italian data protection authority (DPA) has fined Verisure Italy €400,000 for unlawful marketing communications. The company lacked a valid legal basis for its marketing…
join the international community, including the UN’s Independent International Fact-Finding Mission, in calling on Iran to immediately restore internet and mobile communications…
The Supreme Court has reduced the fine imposed on Amazon France Logistique by the Data Protection Authority from 32 million euros to 15 million euros. The court ruled that Amazon…
Summary: A court has awarded €3,500 to a person whose financial data was accidentally sent to another customer by a bank. The court ruled that this unauthorized disclosure…
Commentary. Article 39 of the GDPR, titled "Tasks of the Data Protection Officer," describes the key responsibilities of the Data Protection Officer (DPO). This provision should…
English Summary: A court has awarded €3,500 to an individual whose financial data was accidentally sent by a bank to another customer. The court ruled that this unlawful…
Commentary. Article 39 of the GDPR, titled "Tasks of the data protection officer", describes the primary responsibilities of the data protection officer (DPO). This provision must…
The ICO has issued a consultation to seek organisations’ views on the processes the ICO follows when it suspects a breach of the UK GDPR or the Data Protection Act 2018
Editorial for UK Report January 2026
Blog for UK Report January 2026
Access Now appeals to you, President Yoweri Museveni, to ensure that people in Uganda have unfettered access to the internet, digital platforms, and all other communication…
As millions of people prepare to head to the polls in Uganda on January, 15 2026, Access Now and the #KeepItOn coalition — a global network of over 345 organizations from 106…
A university lecturer (the complainant) has requested access to the content of evaluation reports from independent reviewers and letters of recommendation that were prepared…
Updated biography: "Ava", law student (LL.B), part-time study, is pursuing certification as a Data Protection Officer. Works full-time with databases for the regulation of…
Read more about how ICE has spent hundreds of millions of dollars on surveillance technology to spy on everyone – and potentially even the entire population – in the United…
Read more about how ICE has spent hundreds of millions of dollars on surveillance technology to spy on anyone—and potentially everyone—in the United States, and how to follow the…
The National Commission for Information Technology and Civil Liberties met on Thursday, January 8, 2026, at 9:30 a.m. with the following agenda:
Facts. Finally, the court reiterated that consent was not required, because Article 6 of the GDPR provides alternative, legal grounds for data processing. Since the requirements…
Facts: A court has declared the decision of the Dutch Data Protection Authority (AP) to reject a complaint regarding the General Data Protection Regulation (GDPR) to be invalid.…
Read more about how enterprising hackers have started projects to monitor the activities of ICE and learn how you can track the expenditures of the Department of Homeland…
A court has dismissed the appeal of a patient who requested a correction of a medical report. The court ruled that a patient cannot request a correction of a medical examination,…
Facts: A court has annulled the decision of the Data Protection Authority (DPA) to dismiss a complaint concerning the General Data Protection Regulation (GDPR). The court…
Facts: A court has ruled that a television station lawfully published a video containing personal data of a board member of a listed company, as this information served the public…
Read more about how enterprising hackers have started projects to do counter surveillance against ICE, and learn how to follow the Homeland Security spending trail. U.S.…
Age verification mandates are spreading rapidly, ushering in a new era of online surveillance, censorship, and exclusion, not only for young people but for everyone. Laws…
This guide was written by Andrew Zuker, with support from the Heinrich Boell Foundation. The US government publishes vast amounts of detailed spending data, but searching through…
This guide was co-written by Andrew Zuker with support from the Heinrich Boell Foundation. The U.S. government publishes volumes of detailed data on the money it spends, but…
Age verification mandates are spreading fast, and they’re ushering in a new age of online surveillance, censorship, and exclusion for everyone—not just young people. Age-gating…
Commentary: Codes of Conduct (CoC) are voluntary instruments that establish specific data protection rules for certain categories of controllers and processors. In other words, a…
(1) Promotion of codes of conduct and supervisory authorities: * EDPB, 'Guidelines 1/2019 on codes of conduct and supervisory authorities pursuant to Regulation 2016/679', June 4,…
Commentary: Codes of Conduct (CoCs) are voluntary instruments that establish specific data protection rules for certain categories of controllers and processors. In other words, a…
(a) Demonstrable independence and expertise (a) Demonstrable independence and expertise (a) Demonstrable independence and expertise It is clear from Article 41(1) of the GDPR that…
(1) Promotion of codes of conduct and supervisory authorities: * EDPB, 'Guidelines 1/2019 on codes of conduct and supervisory authorities in accordance with Regulation 2016/679',…
(a) Demonstrable independence and expertise (a) Demonstrable independence and expertise. (a) Demonstrable independence and expertise. It is clear from Article 41(1) of the GDPR…
So-called “tourist” cameras used by municipalities to promote a region should not be used to collect personal data. The CNIL presents a summary of the inspections conducted on…
The Ministry of National Education and the CNIL are organizing the “Trophées des classes” contest, whose theme for this year’s edition is “How do I protect my privacy online?”
2025 was the year in which age verification shifted from a niche experiment to a widespread reality in the United States. Currently, half of the US states require age verification…
Our guides on privacy protection and self-defense (Surveillance Self-Defense, SSD), which provide practical tips and explanations on how to deal with government and corporate…
Our Surveillance Self-Defense (SSD) guides, which provide practical advice and explainers for how to deal with government and corporate surveillance, had a big year. We published…
2025 was the year age verification went from a fringe policy experiment to a sweeping reality across the United States. Half of the U.S. now mandates age verification for…
In at least a dozen states, legislators believe they can pass laws prohibiting minors from accessing social media, or requiring them to obtain parental consent before logging in.…
In the name of "protecting children online," Congress introduced legislation this year that could have severely compromised our privacy and restricted freedom of expression. These…
Lawmakers in at least a dozen states believe that they can pass laws blocking young people from social media or require them to get their parents’ permission before logging on.…
In the name of 'protecting kids online,' Congress pushed forward legislation this year that could have severely undermined our privacy and stifled free speech. These…
Throughout 2025, EFF conducted groundbreaking investigations into Flock Safety's automated license plate reader (ALPR) network, revealing a system designed to enable mass…
Throughout 2025, EFF conducted groundbreaking research into Flock Safety's automated license plate recognition (ALPR) system, uncovering a system designed to enable mass…
This year, we resisted the return of a dreadful idea that has not improved over the years: laws that enable the blocking of websites. More than a decade ago, Congress attempted to…
You may not have noticed, given the numerous reports focusing on new questions regarding copyright and generative AI, but the biggest copyright case of the year concerned a…
You might not know it, given the many headlines focused on new questions about copyright and Generative AI, but the year’s biggest copyright case concerned an old-for-the-internet…
This year, we fought back against the return of a terrible idea that hasn’t improved with age: site blocking laws. More than a decade ago, Congress tried to pass SOPA and PIPA—two…
EFF’s attorneys, activists, and technologists don’t just do the hard, endless work of defending our digital civil liberties — they also spend a lot of time and effort explaining…
Artificial Intelligence: Building Data Protection In from the Start
The deployment of drones as first responders (Drone First Responder, DFR) has truly gained momentum in 2025. Although the concept has existed since 2018, this year the technology…
The lawyers, activists, and technologists at EFF not only do the difficult, ongoing work of defending our digital civil liberties but also devote significant time and energy to…
It is no secret that digital surveillance and other forms of technology-enabled oppression pose serious dangers to people active in liberation movements. The increasing trends of…
Drone as first responder (DFR) adoption really took off in 2025. Though the concept has been around since 2018, this year saw more normalization of the technology, its integration…
It's no secret that digital surveillance and other tech-enabled oppressions are acute dangers for liberation movement workers. The rising tides of tech-fueled…
Professionals (doctors, lawyers, notaries, etc.) are increasingly being evaluated online through directories that include rating and review systems. The CNIL explains the…
This year, you may have heard EFF speaking out about our civil liberties on NPR, BBC Radio, or via various podcasts. But in 2025, we also began sharing our message directly with…
This year, you may have heard EFF sounding off about our civil liberties on NPR, BBC Radio, or any number of podcasts. But we also started sharing our voices directly with…
Online stores are generally not allowed to require customers to create an account before they can make a purchase. This is according to new recommendations from the European Data…
On December 22, 2025, the CNIL sanctioned NEXPUBLICA FRANCE with a fine of 1,700,000 euros for failing to implement sufficient security measures for its PCRM software, a user…
Webshops are generally not permitted to require customers to create an account before they can make a purchase. This is evident from new recommendations by the European Data…
Since the European Commission has determined that the United Kingdom continues to provide a level of protection substantially equivalent to that of the European Union, transfers…
On December 9, 10, and 12, as part of GDPR Day in Nantes, the CNIL met with students, digital mediators, and city officials. The program included discussions and awareness-raising…
The Data Regulation establishes a European framework for organizing the sharing and use of data from connected devices. It strengthens users’ rights and creates new obligations…
On December 11, 2025, the CNIL sanctioned MOBIUS SOLUTIONS LTD, a processor responsible for a data breach affecting users of the company DEEZER. A fine of one million euros was…
Online & Mobile tracking Austrian Supreme Court (OGH): Meta must provide full access to all personal data of user within 14 days, including the sources, recipients and purposes…
Electronic Health Records: Data Protection Builds Trust and Encourages Use
The National Commission for Information Technology and Civil Liberties met on Thursday, December 18, 2025, at 9:30 a.m. with the following agenda:
Online & Mobile tracking TikTok not only tracks its users while they are using the TikTok app itself, but it is increasingly integrated with many other websites and apps. For…
The Dutch Data Protection Authority (AP) has fined HAN University of Applied Sciences (HAN) €175,000 for violating the General Data Protection Regulation (GDPR). An investigation…
TikTok tracks the activities of its users, even when they are using other apps. As a result, the video platform also knows which dating app you are using.
The Dutch Data Protection Authority (Autoriteit Persoonsgegevens) has imposed a fine of 175,000 euros on HAN University of Applied Sciences (HAN) for violating the General Data…
For the time being, TikTok continues to send user data to, among others, China. In doing so, the company is acting against a joint decision by the European privacy regulators, who…
Access Now and several human rights groups are deeply alarmed by the allegations of MTN Congo's enabling of human rights abuses.
Access Now,together with several human rights organizations, are calling on MTN Group to protect mobile service subscribers and ensure transparency and accountability for data…
This article highlights evidence-based alternatives that strengthen child safety while simultaneously protecting encryption and fundamental rights. It advocates for better…
G7 Data Protection Authorities Continue Their Joint Efforts to Promote International Data Protection
Access Now’s latest report, Internet shutdowns in armed conflict: a typology of harms, unpacks the serious harms that internet shutdowns inflict on civilian populations during…
EDRi partner Danes je nov dan launched a multifaceted campaign in response to a government proposal that would allow the Slovenian Intelligence and Security Agency (SOVA) to use…
What has the EDRi network been doing over the past few weeks? Discover the latest news on digital rights in our bi-weekly newsletter. In this edition: 2025 is almost over, but we…
The European Ombudsman has found that the European Commission ignored important transparency laws during the preparation of the Europol Regulation, which is part of the…
This article highlights evidence-based alternatives that strengthen child safety while safeguarding encryption and fundamental rights. It calls for better enforcement, more…
EDRi affiliate Danes je nov dan launched a multi-faceted campaign in response to a government proposal that would allow the Slovene Intelligence and Security Agency (SOVA) to use…