Insights

On 17 September 2026, the European Data Protection Board (“EDPB”) published its draft Guidelines 04/2026 on the imposition of administrative fines (the "Guidelines"), currently out for public consultation until 13 November 2026. In 2022, the EDPB had adopted guidelines on calculating the amount of an administrative fine (the “Calculation Guidelines”). The present Guidelines fill a gap the Calculation Guidelines left open: they provide a structured, five-step methodology for deciding when to impose a fine and explain how fines interact with the full range of corrective powers. By issuing both sets of guidelines, the EDPB aims to increase harmonization in fining posture. 

At a glance: A New Mexico jury found Meta liable for nearly 44 million deceptive trade practice violations based on misleading privacy and platform-safety statements—showing that public-facing privacy claims can create significant consumer-protection exposure.

At a glance: Governor Gavin Newsom signed SB 690, amending CIPA to restrict private plaintiffs from bringing “pen register” and “trap and trace” claims arising from web-based conduct. The amendment is meant to reduce the wave of private CIPA litigation targeting website tracking technology. However, businesses remain exposed to several major types of claims and enforcement mechanisms under CIPA and related statutes and should audit their tracking technologies, consent mechanisms, and litigation posture accordingly.

For multi-channel marketers, the Telephone Consumer Protection Act (TCPA) has been a persistent and evolving compliance preoccupation. Businesses that rely on automated texts and robocalls to engage customers, particularly in retail, financial services, health care, and political campaigning, have had to navigate its consent requirements with care. For example, in 2024, the Federal Communications Commission (FCC) determined it would permit consumers to revoke consent by “any reasonable method,” a move that sent companies scrambling to bring decentralized communications channels into compliance.

Guidehouse served as the prime contractor responsible for technology services used in administering New York’s Emergency Rental Assistance Program (“ERAP”). Under Guidehouse’s contract with the State of New York, the online ERAP portal was to undergo cybersecurity testing in its pre-production environment before it was launched to the public, and Guidehouse was required to certify that the system met the contract’s requirements. Within hours of going live, the ERAP portal exposed certain applicants’ personally identifiable information and was shut down.

In June, the president, seemingly in reaction to the cybersecurity risks of frontier artificial intelligence models, ordered the establishment of a voluntary regulatory regime for the government to scrutinize frontier models prior to public release.

On September 30, 2026, California Governor Gavin Newsom signed Senate Bill 947, the “No Robo Bosses Act,” into law, effective July 1, 2027. The law prohibits California employers from relying solely on AI or other automated decision systems (ADS) to discipline or terminate employees, and requires meaningful human review and written notice to affected workers when such tools play a primary role in those decisions. Employers using AI-driven workforce management tools should begin compliance planning now.

On September 28, 2026, the General Services Administration (GSA) issued a new clause for incorporation into government contracts of artificial intelligence systems, 552.239-7001, Basic Safeguarding of Data within Large Language Model Artificial Intelligence Systems, as a GSA Regulation Deviation (the Final Clause). The Final Clause will become effective on October 19, 2026.

On September 9, 2026, California Governor Gavin Newsom signed into law SB 813 and AB 1405, creating the nation’s first regulatory framework for AI auditors. And on September 18, Gov. Newsom signed Executive Order N-9-26 (Order) which moved up by about a year some of the implementation deadlines for SB 813 and AB 1405 and convened an expert group to recommend how the Golden State can strengthen existing AI safety laws.

New York Attorney General Letitia James has issued an industry-wide alert encouraging workers with knowledge of unsafe or illegal conduct at artificial intelligence (AI) companies to file confidential whistleblower complaints through the Office of the Attorney General’s (OAG) secure portal. This development signals a significant escalation in regulatory scrutiny of the AI sector and should be carefully considered by any company developing or deploying AI technology that has a nexus to New York.

The wait is over. As of today, manufacturers of connected products (both hardware and software) must comply with the Cyber Resilience Act’s (“CRA”) vulnerability and incident reporting obligations. The CRA’s Single Reporting Platform (“SRP”), operated by the European Union Agency for Cybersecurity (“ENISA”), is now the EU-wide gateway through which those notifications must flow.

On September 2, 2026, the National Archives and Records Administration (NARA), through its Information Security Oversight Office (ISOO), released two new Notices on the topic of Controlled Unclassified Information (CUI): ISOO Notices 2026-07 and 2026-08. 

On August 26, 2026, President Trump issued EO 14420, prohibiting the acquisition, importation, transfer, or installation of foreign-produced bulk-power system electric equipment that meet certain criteria. The prohibitions are in response to the national emergency declared by President Trump pursuant to the International Emergency Economic Powers Act (IEEPA) and the National Emergencies Act (NEA) and based on foreign actors’ potential exploitation of vulnerabilities in U.S. energy infrastructure to harm U.S. national security, including through digital backdoors built into foreign-manufactured equipment that allow remote access and potential sabotage. According to the Order, this threat to national security has become even more acute given the rapid growth of advanced manufacturing, data centers, artificial intelligence, and defense production, which together have exponentially increased U.S. dependence on reliable electricity.

In our previous client alert, we addressed how algorithms and platform features that rely on user generated speech might not receive Section 230 protections because those features may not be considered platform user content.  In these instances, the platform might not carry user generated water through the pipe, but adds its own to the mixture.  At the same time, if it is true that there is less Section 230 protection, these same elements should then imbue the content with First Amendment protections as the expressive content of the platform.

On August 19, 2026, the Federal Trade Commission (FTC) announced a proposed Enforcement Policy Statement on personalized pricing — the practice of companies using consumers’ personal data to set individualized prices, discounts, coupons, or other incentives. The proposed statement, which is open for public comment for 30 days following publication in the Federal Register, marks a major step up in the FTC’s focus on data-driven pricing strategies and puts businesses across industries on notice that undisclosed or inadequately disclosed personalized pricing will not be tolerated. Importantly, while the proposed statement is not a binding legal requirement and does not create new legal obligations, it serves as an enforcement warning that the FTC is prepared to use its existing enforcement authority under Section 5 of the FTC Act (Section 5) and is also a potential harbinger of rulemaking. Businesses that engage in — or are considering — personalized pricing should carefully assess their disclosure practices and data collection procedures against the standards articulated in this statement.

On August 12, 2026, the White House released a National Security Presidential Memorandum (NSPM), marking a seismic shift in U.S. cybersecurity policy and establishing a framework to authorize private-sector companies to conduct offensive cyber operations—historically strictly prohibited by federal law—against foreign Cyber-Enabled Transnational Criminal Organizations (CE-TCOs).  It builds on an executive order issued in March 2026 that directed federal agencies to develop plans to combat cyber-crimes against Americans.

New York is set to become the first state in the nation to restrict algorithmically-driven “addictive” social media features for users under 18. On July 29, 2026, the State published the final rules implementing the Stop Addictive Feeds Exploitation (SAFE) for Kids Act, which takes effect January 25, 2027.

On July 28, 2026, the Federal Communications Commission (FCC) updated its Covered List, established through the Secure and Trusted Communications Networks Act to include foreign-produced connected power inverters and advanced robotic devices. The designation of these products to the Covered List follows an Executive Branch national security determination that they “pose unacceptable risks to the national security of the United States or the safety and security of United States persons.” Equipment listed on the Covered List is ineligible for FCC equipment authorization, effectively prohibiting the import, sale, or marketing of those products absent an exception or approval. This action comes only months after the FCC added consumer-grade routers to the Covered List on March 23, 2026 and uncrewed aircraft systems (UAS) on December 22, 2025. Taken together, these actions reflect the FCC’s increasingly expansive approach to using its authorities to guard against foreign produced connected technologies that may create vulnerabilities enabling disruption of critical infrastructure, unauthorized access to sensitive information, or cyber intrusions. The shift is a departure from the FCC’s previous focus on equipment and services produced by certain PRC and Russian companies.

On July 6, 2026, the U.S. Department of Justice (DOJ) and the U.S. Department of Homeland Security (DHS) published an Interim Final Rule (IFR) setting up a new federal framework that allows state, local, Tribal, and territorial (SLTT) law enforcement and correctional agencies to detect, track, and, in some cases, disable or seize drones. The rule directly affects SLTT agencies looking to stand up counter-drone programs, as well as drone and counter-drone technology companies whose products will be subject to federal review and approval. Although the IFR bypassed the Administrative Procedure Act’s standard notice-and-comment process on good cause grounds — citing the statutory 180-day deadline and urgent public safety needs — the rule is already legally binding and effective as of July 1, 2026. The Departments are nonetheless accepting post-promulgation comments through September 4, 2026.

The Department of War (DoW) is immediately suspending Cybersecurity Maturity Model Certification (CMMC) Phase II requirements, which had been scheduled to take effect on November 10, 2026.