USA: DOJ file lawsuit against Iconic Hearts for COPPA violations. The DOJ sued Iconic Hearts for violating #COPPA, the #FTC Act, and ROSCA by mishandling children's data and using deceptive marketing. Read now: https://bit.ly/3IDLvBr

Montana: Act to revise privacy laws related to biometric, genetic, and neural data enters into effect. Learn more: https://bit.ly/3WgrPXo

Colorado: Act amending CPA to address minors protection enters into effect. Colorado strengthens online privacy for minors, banning targeted ads and manipulative design, requiring consent and risk assessments. Read on: https://bit.ly/3IKZxRM

California: Regulations protecting against AI employment discrimination enter into effect. The regulations clarify that using AI or automated decision systems in hiring and employment must not discriminate against protected groups. Learn more: https://bit.ly/46PCM74

USA: FTC issues a proposed order for $1 million against Citizens Disability for telemarketing violations. The FTC reached a settlement with Citizens Disability over unlawful robocalls, misrepresentations, and Do Not Call violations. Check it out: https://bit.ly/46B7nqo

Montana: Act to revise privacy laws enters into effect. Montana's new privacy law strengthens minors' protections, expands consumer rights, and speeds up enforcement. Read now: https://bit.ly/46Ih6LD

USA: HHS reaches $182,000 settlement with Cadia for disclosure of medical data. HHS OCR reached a settlement with Cadia Rehabilitation for improperly disclosing patient health information on social media. Learn more: https://bit.ly/4mLmG4v

UK: NCSC publishes guidance on understanding OT environments. The guidance from the UK's NCSC outlines how organizations can create and maintain a definitive record of their OT environments. Read on: https://bit.ly/4mLmlyL

Ecuador: SPDP publishes draft regulation on data transfers. The SPDP released a draft regulation on national and international personal data transfers, detailing safeguards, authorization procedures, and reporting obligations. Learn more: https://bit.ly/4nSjrsS

California: CPPA fines Tractor Supply Company $1.35M for CCPA violations. The company must update policies, contracts, and procedures to ensure compliance and strengthen consumer privacy protections. Check it out: https://bit.ly/486vU7P

Maryland: MODPA takes effect. MODPA takes effect October 1, 2025, giving consumers new rights and imposing data protection rules and penalties on businesses handling residents' personal data. Read now: https://bit.ly/4mNbXXc

Italy: AI Law published in Official Gazette. Italy's new AI Law aligns AI use with GDPR and national privacy rules, sets sector-specific obligations, and establishes a National AI Strategy under AgID and CAN. Learn more: https://bit.ly/4mLa9Oq

Czechia: MIT introduces draft law on AI. The law sets supervisory authorities, establishes a regulatory sandbox, and outlines enforcement mechanisms, aiming to take effect in 2026. Read on: https://bit.ly/4pJy9nX

USA: FTC takes action against Sendit App over unlawful collection of personal data. The FTC took action against Sendit app for unlawfully collecting children's data and using deceptive practices to sell premium subscriptions. Learn more: https://bit.ly/3KuWf5C

California: Bill on health and location data privacy signed by Governor. California's new Health Data Privacy Act bans geofencing around health providers and restricts the collection or use of personal data near family planning centers. Check it out: https://bit.ly/3IKdkb5

California: Transparency in Frontier Artificial Intelligence Act signed by Governor. California's new Transparency in Frontier AI Act requires large AI developers to publish frameworks and reports on risk, safety, and governance. Read now: https://bit.ly/4mKNNfP

Croatia: AZOP presents 2024 annual report to Parliament. The report highlights record GDPR enforcement in 2024, with AZOP issuing 38 fines totaling €536,200 and 168 corrective measures. Learn more: https://bit.ly/3KnJdHb

Austria: NOYB announces DSB decision in complaint against KSV1870 and Unsere Wasserkraft on automated credit checks. The decision followed NOYB's 2024 complaint highlighting GDPR violations in automated decision-making and lack of transparency. Read on: https://bit.ly/3VGQynt

Romania: ANSPDCP fines S.C. PRIMONET RO RON 101,545 for data breach. The ANSPDCP fined S.C. PRIMONET RO for a data breach exposing customer payment information and ordered improved website security and access logging. Learn more: https://bit.ly/46Krdhw

UK: ICO issues statement on changes to Meta advertising model. Meta will ask users to consent to personalized ads or pay for an ad-free service, with the ICO monitoring compliance and the impact on user choices under UK law. Check it out: https://bit.ly/4nss5i9

EU: Commission publishes draft guidance and reporting template on serious AI incidents. The Commission released guidance and a reporting template for high-risk AI systems, clarifying definitions, examples, and links to other EU laws ahead of the August 2026 rules. Read now: https://bit.ly/4nNtpvu

Jordan: Personal Data Protection Council approves data subject requests forms. The standardized forms aim to streamline data subject requests with templates covering rights such as withdrawing consent and objecting to data processing. Learn more: https://bit.ly/4pDThfn

USA: Senators announce MIND Act. The bill directs the FTC to assess existing laws and identify gaps regarding the governance of neural data and related biometric/behavioral data with a view to propose safeguards. Check it out: https://bit.ly/4noqUQN

Jordan: Regulation on the Organization of Data Subject Rights for 2025 comes into effect. The Regulation requires data controllers to establish clear mechanisms and procedures for data subjects to effectively exercise their rights. Learn more: https://bit.ly/3KrdK6K

South Korea: PIPC launches national policy on personal information protection system. The initiative aims to strengthen corporate accountability, expand personal information rights, and support AI innovation through secure data utilization. Check it out: https://bit.ly/3WbsFEI

Massachusetts: Bill for Consumer Data Privacy Act passed by Senate. The bill provides for consumer rights and controller obligations, and, if enacted, will take effect in two stages on January 1, 2027, and June 1, 2027. Read now: https://bit.ly/3KkWGPY

Turkey: Turkish Council of State annuls KVKK's regulation on certification of data protection officers. Learn more: https://bit.ly/3IjQJSO

Brazil: Cybersecurity Bill introduced in Senate. The bill's aims include strengthening cyber resilience in public administration and promoting integration of cybersecurity, data protection, and information security policies. Read on: https://bit.ly/4nObkxq

UK: ICO fines Green Spark Energy £250,000 for making unsolicited direct marketing calls. The ICO found that GSE made 9.5 million automated marketing calls to subscribers without their consent, violating several provisions of the PECR. Learn more: https://bit.ly/46mDdH7

Poland: UODO works with platforms to combat false advertising and deepfake misuse. Together with the Irish DPC, the UODO is engaging in dialogue with social media platforms, including Meta, to develop solutions aligned with data protection principles. Check it out: https://bit.ly/4nmqlXH

UK: ICO fines Home Improvement Marketing £300,000 for unsolicited direct marketing calls. The ICO found that HIML violated several provisions of the PECR for transmitting unsolicited direct marketing communication without consent. Read now: https://bit.ly/3IFRW6O

Australia: Digital platform regulators release working paper on immersive technologies. The paper explores immersive technologies, such as AI, VR, and AR. Learn more: https://bit.ly/4mtNoyf

Norway: Datatilsynet announces LinkedIn's AI training on user content. The training is due to begin on November 3, 2025, and Datatilsynet has asked LinkedIn for clarifications. Read on: https://bit.ly/42Jdg2b

Canada: Authorities find TikTok's data processing practices in violation of PIPEDA and provincial privacy laws. The authorities found violations regarding sensitive personal information of underage users and legitimate interest and invalid consent. Learn more: https://bit.ly/4nQ0PK5

New Zealand: Privacy Amendment Bill receives Royal Assent and adopted. The Amended Privacy Act introduces IPP 3A, requiring agencies to inform individuals about third-party data collection. Check it out: https://bit.ly/48hjzhh

California: CPPA finalizes Privacy regulations covering cybersecurity, risk, ADMT, and insurance. The regulations will take effect on January 1, 2026, with phased compliance deadlines until April 1, 2030, depending on how much a business makes. Read now: https://bit.ly/3KjuZXS

France: CNIL fines SAMARITAINE €100,000 for breaches of GDPR. CNIL found multiple GDPR violations, such as unfair and non-transparent processing and a lack of accountability, excessive data collection, and failure to notify a data breach. Learn more: https://bit.ly/46xXJ6B

Liechtenstein: DSS issues guidance on employee access requests and use of AI systems with personal data. The guidance outlines former employees' right to information under the GDPR. Read on: https://bit.ly/3VwfC0w

Germany: ACS publishes guide to penetration testing of LLMs. The guide aims to serve as a basis for a consistent approach to penetration testing of LLMs, providing a foundation for planning, commissioning, and implementation. Learn more: https://bit.ly/4niEKnK

China: TC260 publishes guide on AI emergency response. The guide proposes a grading system for security incidents based on the importance of the affected systems or data, the severity of the business loss, and the social harm. Check it out: https://bit.ly/3IpJtEW

USA: EPIC shows support for Algorithmic Accountability Act of 2025. The bill includes transparency and accountability requirements for entities that use automated decision systems to make key decisions about consumers. Read now: https://bit.ly/4nip3gl

New Zealand: Privacy Amendment Bill passes third reading. The bill amends sections of the Privacy Act, including removing the obligation under IPP 3 to inform individuals of the consequences of not providing requested information. Learn more: https://bit.ly/42JMt5M

Colombia: SIC issues circular on the processing of personal data through fintech. The Circular highlights instructions for entities, including to only process data for constitutionally legitimate purposes, and only for as long as necessary. Read on: https://bit.ly/3IzWbRp

Nigeria: NDPA GAID takes effect. The GAID for the NDPA came into effect on September 19, 2025, and covers areas including data subject rights, principles and lawful bases for data processing, and cross-border data transfers. Learn more: https://bit.ly/4nMzB7h

Missouri: Senator requests AI chatbot policy documents from big tech companies. Senator Hawley emphasized the harm that AI chatbots can cause to children and requested information from the companies no later than October 17. Check it out: https://bit.ly/4gElMW3

Portugal: NIS2 transposition bill passes Parliament. The bill establishes the CNCS as the authority responsible for oversight of the bill and includes cybersecurity obligations for covered entities, such as submitting annual cybersecurity reports. Read now: https://bit.ly/47VvrFs

EU: IAB Europe publishes report on AI and digital advertising. IAB Europe's first AI in advertising report shows 85% of companies use AI tools, with privacy and governance gaps as key challenges. Learn more: https://bit.ly/4pwp9lK

Germany: DSK adopts application notes on data transfers in context of scientific research for medical purposes. Germany's DSK issued guidance on GDPR-compliant data transfers abroad for medical research, emphasizing encryption, anonymization, and limited access. Read on: https://bit.ly/46qFkIK

Brazil: Digital ECA sanctioned by President. Brazil enacted Law No. 15.211 to protect minors online, requiring digital services to safeguard children, ensure privacy by default, implement age verification, and prevent exposure to harmful content. Learn more: https://bit.ly/4ptEXWq

Vietnam: MPS requests comments on decree detailing personal data protection law. Vietnam's Ministry of Public Security released a draft decree on the Personal Data Protection Law, detailing data handling rules, especially for finance and credit sectors. Check it out: https://bit.ly/3VXv2ed