EU Advances Simplification of the AI Act and the 2026 Compliance Date May Be Postponed

On March 18, 2026, the European Parliament’s Committee on the Internal Market and Consumer Protection (IMCO) and the Committee on Civil Liberties, Justice and Home Affairs (LIBE) adopted their joint negotiating position on the European Commission’s proposed Digital Omnibus on AI, which seeks to simplify the implementation of the EU AI Act. The Final Compromise Amendments will serve as the ...

EU Court of Justice Defines Limits to the GDPR Right of Access

On March 19, 2026, the Court of Justice of the European Union issued its judgment in *Brillen Rottler GmbH & Co. KG v. TC* (Case C-526/24), addressing whether a controller may refuse even a first request for access as “excessive” under Article 12(5) of the GDPR, and whether a data subject can claim compensation under Article 82(1) for infringement ...

Trump Administration Releases New National Cybersecurity Strategy and AI Policy

On March 6, 2026, the Trump Administration released “President Trump’s Cyber Strategy for America” alongside an Executive Order titled “Combating Cybercrime, Fraud, and Predatory Schemes Against American Citizens.” Together, these documents articulate the Administration’s comprehensive cybersecurity posture, organized around the offensive disruption of adversaries, the deregulation of industry, and the protection of American citizens from transnational cybercrime.

The strategy document ...

California State Court Jury Find Meta and Google Liable for Teen Addiction

Back in November 2025, Judge Carolyn B. Kuhl of the Los Angeles Superior Court denied summary judgment motions filed by Meta, Google (YouTube), ByteDance (TikTok), and Snap in the bellwether case K.G.M. v. Meta Platforms et al., allowing claims by a young woman who alleged that social media platforms’ design features caused her depression, anxiety, and compulsive use to ...

France’s High Court Clarifies the Boundary Between Pseudonymization and Anonymization

France’s Conseil d’État—the country’s highest administrative court—rejected challenges by three companies in the Cegedim group to CNIL fines totaling €1.8 million, delivering an important ruling on when pseudonymized health data remains personal data under the GDPR.

The companies operated two databases, fed by data collected from doctors’ practice management software and pharmacy systems. By March 2021, one database held data ...

Washington State and Oregon Pass Key AI Bills

Washington State’s legislature passed two AI bills. The first is Bill 2225, introduced at the request of Governor Ferguson. It regulates AI companion chatbots — defined as AI systems with natural language interfaces that provide adaptive, human-like responses, exhibit anthropomorphic features, and sustain relationships across multiple interactions. The definition excludes bots used solely for business operations, customer service, or technical ...

California Issues $1.1 Million Fine for Privacy Violations Involving Students

On March 3, 2026, the California Privacy Protection Agency (CalPrivacy) Board issued a decision requiring PlayOn Sports to pay a $1.1 million administrative fine and overhaul its business practices, marking CalPrivacy’s first enforcement action addressing privacy violations involving students and California schools. The settlement, reached in January 2026, represents a significant escalation in state privacy enforcement and signals that CalPrivacy ...