On March 18, 2026, the European Parliament’s Committee on the Internal Market and Consumer Protection (IMCO) and the Committee on Civil Liberties, Justice and Home Affairs (LIBE) adopted their joint negotiating position on the European Commission’s proposed Digital Omnibus on AI, which seeks to simplify the implementation of the EU AI Act. The Final Compromise Amendments will serve as the ...

On March 6, 2026, the Trump Administration released “President Trump’s Cyber Strategy for America” alongside an Executive Order titled “Combating Cybercrime, Fraud, and Predatory Schemes Against American Citizens.” Together, these documents articulate the Administration’s comprehensive cybersecurity posture, organized around the offensive disruption of adversaries, the deregulation of industry, and the protection of American citizens from transnational cybercrime.

The strategy document ...

Washington State’s legislature passed two AI bills. The first is Bill 2225, introduced at the request of Governor Ferguson. It regulates AI companion chatbots — defined as AI systems with natural language interfaces that provide adaptive, human-like responses, exhibit anthropomorphic features, and sustain relationships across multiple interactions. The definition excludes bots used solely for business operations, customer service, or technical ...

On March 3, 2026, the California Privacy Protection Agency (CalPrivacy) Board issued a decision requiring PlayOn Sports to pay a $1.1 million administrative fine and overhaul its business practices, marking CalPrivacy’s first enforcement action addressing privacy violations involving students and California schools. The settlement, reached in January 2026, represents a significant escalation in state privacy enforcement and signals that CalPrivacy ...

On March 19, 2026, the Court of Justice of the European Union issued its judgment in *Brillen Rottler GmbH & Co. KG v. TC* (Case C-526/24), addressing whether a controller may refuse even a first request for access as “excessive” under Article 12(5) of the GDPR, and whether a data subject can claim compensation under Article 82(1) for infringement ...

Back in November 2025, Judge Carolyn B. Kuhl of the Los Angeles Superior Court denied summary judgment motions filed by Meta, Google (YouTube), ByteDance (TikTok), and Snap in the bellwether case K.G.M. v. Meta Platforms et al., allowing claims by a young woman who alleged that social media platforms’ design features caused her depression, anxiety, and compulsive use to ...

France’s Conseil d’État—the country’s highest administrative court—rejected challenges by three companies in the Cegedim group to CNIL fines totaling €1.8 million, delivering an important ruling on when pseudonymized health data remains personal data under the GDPR.

The companies operated two databases, fed by data collected from doctors’ practice management software and pharmacy systems. By March 2021, one database held data ...

The European Data Protection Board and the European Data Protection Supervisor adopted two significant Joint Opinions in March 2026, addressing major European Commission legislative proposals that intersect with cybersecurity, health data governance, and data protection.

On March 19, the EDPB and EDPS published their Joint Opinion on the proposed Cybersecurity Act 2 (CSA2) and the proposed amendments to the NIS2 ...

The European Commission published two significant sets of draft guidelines in March 2026, providing practical compliance guidance for two of the EU’s most consequential recent digital regulations.

On March 3, 2026, the Commission published draft guidelines intended to clarify the application of the EU Cyber Resilience Act (CRA) and opened a public consultation for stakeholder feedback. The CRA, which entered ...

On March 2, 2026, the U.S. Court of Appeals for the Ninth Circuit issued a significant decision in *Freeman v. 3Commas Technologies OÜ*, reversing a district court’s dismissal of a class action against an Estonian cryptocurrency trading software company for lack of personal jurisdiction in California. The ruling provides important guidance on when foreign technology companies that operate online platforms ...