AI Governance
Data Centers
Drones
Climate
Privacy
2026 Maine Senate
Bob Dylan
Last Update: 10/27/2026 at 6:00 AM EST
EU Privacy and AI Regulation
Coverage from PPC Land, Future of Privacy Forum, and others
The European Union’s privacy and AI rules include the GDPR, the AI Act, and the ePrivacy Directive, alongside related digital legislation and proposals such as the Digital Omnibus.
They shape how organizations may use personal data—including for AI development—and establish rights, safeguards, compliance duties, and oversight. Regulatory debate and enforcement involve EU institutions, national authorities, and civil society, with recurring questions about personal-data definitions, sensitive information, tracking, access rights, and protections for high-risk AI.
Looking Back
1007 Day Timeline
Mar '24
Jul '24
Dec '24
May '25
Oct '25
Mar '26
Jul '26
History
10/03/2026
The legislative debate has produced concrete institutional outcomes: the Council rejected the proposed personal-data redefinition, while Parliament approved AI Act amendments that include a ban on certain non-consensual intimate-image generation.
All Articles77 articles
Important
AEPD in Spain releases a 71-page GDPR guide addressing agentic AI privacy risks in February 2026.
3/1/2026 • Regulation, Law & Enforcement • General
EU regulators prohibit untargeted facial recognition scraping under the EU AI Act in the European Union to protect biometric privacy.
3/17/2026 • Regulation, Law & Enforcement • General
Italy's government proposed Article 10 of a draft AI decree requiring biometric face collection at public events, while Italy's data protection authority and rights groups raised EU law and rights concerns.
8/10/2026 • Regulation, Law & Enforcement • General
Italy's government proposed in late July a decree enabling biometric face collection in public spaces, drawing objections from the Garante, lawmakers and rights groups over European Union AI Act compliance.
8/10/2026 • Regulation, Law & Enforcement • General
European Data Protection Board issued draft Guidelines 02/2026 on anonymisation on 7 July 2026, replacing earlier Article 29 guidance and using a relative identifiability approach.
7/27/2026 • Regulation, Law & Enforcement • General
EDPB approved draft 7 July 2026 Guidelines on web scraping for generative AI, requiring GDPR-compliant lifecycle safeguards and documented legitimate-interests assessments.
7/13/2026 • Regulation, Law & Enforcement • General
Cabrera and Maier argue GDPR automated decision safeguards and the CJEU explanation right support redress for AI-driven decisions affecting people across the EU.
6/29/2026 • Regulation, Law & Enforcement • General
EU regulators outline targeted prohibition on predictive profiling for criminal risk under the EU AI Act in Europe.
3/11/2026 • Regulation, Law & Enforcement • General
Spain's AEPD warned Tools for Humanity on February 13, 2026 in Spain that planned Orb iris-scanning may constitute biometric processing under the GDPR and requires reassessment.
2/17/2026 • Regulation, Law & Enforcement • General
The European Data Protection Supervisor issued mandatory procedures on DPO dismissals, effective February 18, 2026, for EU institutions and agencies in the European Union.
2/13/2026 • Regulation, Law & Enforcement • General
EU regulators ban AI enabled social scoring under Article 5(1)(c) AI Act in the European Union
3/3/2026 • Regulation, Law & Enforcement • General
European Union regulators last week extended GDPR protections to neural data under the AI Act in Brussels.
2/24/2026 • Regulation, Law & Enforcement • General
On 19 November 2025 in the EU, the European Commission proposed the Digital Omnibus reforms, significantly altering GDPR scope, AI data use rules, and data subject access rights.
2/11/2026 • Regulation, Law & Enforcement • General
In 2025, the European Commission advanced EU Digital Omnibus GDPR amendments in Brussels to formalize legitimate interest and residual special data bases for AI training.
5/21/2025 • Regulation, Law & Enforcement • General
The Court of Justice of the European Union ruled in December 2025 that observed personal data is collected directly from individuals, expanding GDPR Article 13 transparency obligations across EU surveillance and monitoring contexts.
1/1/1900 • Regulation, Law & Enforcement • General
EU supervisory authorities in 2026 state that agentic AI processing remains GDPR governed and accountability rests with controllers and processors in the European Union.
3/6/2026 • Regulation, Law & Enforcement • General
EDPB releases report on anonymisation under GDPR after December 2025 stakeholder event in the European Union.
2/18/2026 • Regulation, Law & Enforcement • General
AI providers and deploying organizations must separately assess GDPR and Swiss FADP obligations for personal-data processing in the European Union and Switzerland.
8/7/2026 • Regulation, Law & Enforcement • General
European Parliament votes to amend the EU AI Act, postponing high-risk AI deadlines and delaying machine-readable AI-generated-content labeling until 2 December 2026.
6/16/2026 • Regulation, Law & Enforcement • General
European Commission Digital Omnibus proposals unveiled in late 2025 would revise GDPR and the AI Act, prompting rights groups to warn of reduced privacy protections and AI oversight in the EU.
4/5/2026 • Regulation, Law & Enforcement • General
EU lawmakers impose data access and transfer obligations on connected devices across the EU, with national authorities enforcing the Data Act across member states.
3/17/2026 • Regulation, Law & Enforcement • General
EU regulators map GDPR DMA interplays in 2025 EU Digital Laws Report to boost data portability and privacy in gatekeeper ecosystems.
3/11/2026 • Regulation, Law & Enforcement • General
Data protection professionals in the EU report divergence between GDPR changes and practical needs following a 5 March survey.
3/5/2026 • Regulation, Law & Enforcement • General
Regulators and lawmakers in Europe weigh GDPR and AI regulation in 2025 and 2026 privacy governance.
3/4/2026 • Regulation, Law & Enforcement • General
Regulators update GDPR and UK data laws in 2025 across Europe and the United Kingdom.
3/3/2026 • Regulation, Law & Enforcement • General
EDPB and EDPS issue joint opinion on Digital Omnibus on February 10 2026 in the EU addressing personal data scope under GDPR.
3/2/2026 • Regulation, Law & Enforcement • General
EU court ruling in 2026 expands portability obligations under GDPR for controllers in the European Union.
2/28/2026 • Regulation, Law & Enforcement • General
Cyprus data protection authority requests suspension of agora platform over GDPR compliance concerns in Cyprus.
2/25/2026 • Regulation, Law & Enforcement • General
france court of appeal clarifies gdpr article 15 dsar scope restricting access to substantive personal data in work emails.
2/25/2026 • Regulation, Law & Enforcement • General
Cyprus data protection authority seeks suspension of Agora app in Cyprus for GDPR compliance issues in 2025.
2/24/2026 • Regulation, Law & Enforcement • General
European Commission proposes Digital Omnibus in late 2025 to redefine personal data in the European Union.
2/24/2026 • Regulation, Law & Enforcement • General
Cyprus presidency leads negotiations on GDPR changes in Brussels in 2024, seeking to redefine personal data scope.
2/23/2026 • Regulation, Law & Enforcement • General
EU regulators enforce the AI Act in August 2026 in the European Union.
2/23/2026 • Regulation, Law & Enforcement • General
Italy implements the Italian AI Act in 2025 with GDPR alignment to govern workplace AI.
2/20/2026 • Regulation, Law & Enforcement • General
EDPB and EDPS adopted a joint opinion on 10 February 2026 opposing Digital Omnibus redefinition of personal data, while the ECJ ruled EDPB binding decisions reviewable in Luxembourg.
2/19/2026 • Regulation, Law & Enforcement • General
European data protection authorities and privacy groups on Wednesday opposed the European Commission's Digital Omnibus amendments in Brussels, warning the changes would narrow GDPR protections and change breach notification rules.
2/12/2026 • Regulation, Law & Enforcement • General
The EU AI Act, effective from August 2024 across the European Union, imposes risk-based data governance and documentation duties on AI providers and deployers, including non-EU firms.
2/11/2026 • Regulation, Law & Enforcement • General
European Commission proposes Digital Omnibus changes to GDPR and ePrivacy on 19 November 2025 in the European Union.
1/20/2026 • Regulation, Law & Enforcement • General
European Commission proposes privacy rule changes, to be unveiled on November 19 in the European Union.
11/10/2025 • Regulation, Law & Enforcement • General
European lawmakers agreed to ban AI nudification tools and postpone high-risk EU AI Act enforcement until December 2027, pending EU country and European Parliament approval.
5/7/2026 • Regulation, Law & Enforcement • General
EU authorities apply GDPR to health data research across European Union member states amid divergent national implementations today.
3/12/2026 • Regulation, Law & Enforcement • General
EDPB issued July 7, 2026 draft GDPR guidelines for organizations using web scraping to train generative AI, focusing on controller duties and compliance across legal basis, minimization, transparency, accuracy, and special-category data.
7/23/2026 • Regulation, Law & Enforcement • General
EDPB issued draft Guidelines 1/2026 on scientific research GDPR compliance, stressing justified secondary-use compatibility and strict storage and transparency safeguards.
5/12/2026 • Regulation, Law & Enforcement • General
On July 8, 2026, EDPB opened consultation on Guidelines 03/2026 requiring GDPR compliance for web scraping used to train and deploy generative AI in the EU.
7/21/2026 • Regulation, Law & Enforcement • General
The EDPB and EDPS issued a March 10, 2026 joint opinion on the proposed EU Biotech Act, requesting GDPR clarifications affecting clinical trial controller roles and data retention.
3/27/2026 • Regulation, Law & Enforcement • General
Spain's AEPD published guidance on agentic AI on February 18, 2026 to clarify controller and processor roles and privacy protections.
3/17/2026 • Privacy Technology & AI • General
EU AI Act Article 5(1)(h) bans real-time biometric identification in public spaces for law enforcement, permitting narrow exceptions only with prior authorization and safeguards.
4/7/2026 • Privacy Technology & AI • General
The EU AI Act restricts biometric categorization systems from inferring sensitive traits such as race and sexual orientation from biometric data when used for individual-level categorization.
3/30/2026 • Privacy Technology & AI • General
The European Commission Guidelines interpret the EU AI Act ban on emotion recognition in workplace and education settings as limited to biometric-data inferred emotions.
3/24/2026 • Privacy Technology & AI • General
Interesting
An EU court ruled in a GDPR case involving a German optician and a customer that refusal of data access requests requires proof of abusive intent.
3/18/2026 • Regulation, Law & Enforcement • General
EU negotiators this week proposed compromise on Digital Omnibus in Brussels, preserving GDPR and ePrivacy safeguards while revising some provisions.
3/17/2026 • Regulation, Law & Enforcement • General
EU Council and European Commission drive privacy and cyber regulation in late 2025 across EU member states, Germany, and the United Kingdom.
2/25/2026 • Regulation, Law & Enforcement • General
EU policymakers in Brussels discuss privacy safeguards amid AI Act changes in February 2026.
2/18/2026 • Regulation, Law & Enforcement • General
The European Data Protection Board adopted the 2026-2027 work programme in Brussels on February 12 to ease GDPR compliance and strengthen cross-border cooperation.
2/12/2026 • Regulation, Law & Enforcement • General
EU data protection authorities announce 2026 coordinated action focusing on GDPR articles 12 to 14 transparency obligations.
8/19/2025 • Regulation, Law & Enforcement • General
The EU Data Act, effective across the European Union from 12 September 2025, imposes new data access, sharing, and enforcement rules on IoT manufacturers and cloud providers.
6/20/2025 • Regulation, Law & Enforcement • General
European Union enactment of the Data Act on January 11, 2024 requires manufacturers and cloud providers to enable user access and third-party portability of use-generated data across the EU.
3/8/2024 • Regulation, Law & Enforcement • General
The European Union adopted the EU Data Act, taking effect in September 2025 across the European Union, to regulate smart contracts used for sharing IoT-generated data.
1/1/1900 • Regulation, Law & Enforcement • General
On 12 March 2026, EDPB and EDPS issued a Joint Opinion on the proposed European Biotech Act I, urging stronger health-data safeguards for clinical trials in the EU.
4/29/2026 • Regulation, Law & Enforcement • General
European Commission Digital Omnibus proposal on personal data definitions for EU advertising faces EDPB and EDPS opposition amid ongoing Council and authority debate.
3/23/2026 • Regulation, Law & Enforcement • General
In the European Union, Article 5(1)(d) of the EU AI Act bans criminal risk assessments based solely on profiling.
3/11/2026 • Regulation, Law & Enforcement • General
EU regulators and AI providers in the European Union apply prohibitions on subliminal and manipulative AI techniques under the AI Act to protect autonomy and data rights.
2/24/2026 • Privacy Technology & AI • General
EU data controllers address GDPR subject access requests under Art 12 deadlines amid 2025 EU Digital Omnibus developments in the European Union.
3/6/2026 • Consumer Privacy & Digital Rights • General
The European Commission's AI Office and EU Member State authorities began enforcing EU AI Act transparency requirements on August 2, 2026, across applicable European Union AI activities.
8/18/2026 • Regulation, Law & Enforcement • General
The European Commission proposed CADA in June 2026 across the European Union to expand AI infrastructure and data access while requiring privacy-preserving safeguards.
8/6/2026 • Regulation, Law & Enforcement • General
In the EU, the AI Omnibus adopted in June and published in July 2026 delays AI Act high-risk deadlines and adds a GDPR-compliant bias detection and correction exception.
7/28/2026 • Regulation, Law & Enforcement • General
Bulgarian Presidency work dated 11 January 2018 shows the EU Council evaluating ePR scope and consent rules for M2M, cookies, and communications metadata before trilogue negotiations.
7/11/2026 • Regulation, Law & Enforcement • General
The Digital Omnibus on AI starts EU AI Act Article 50 transparency and general-purpose AI penalty enforcement on August 2, 2026, with high-risk duties delayed to 2027-2028.
7/10/2026 • Regulation, Law & Enforcement • General
Privacy Partnership and Digiphile will hold a June 18, 2026 webinar on EU AI Act reforms and UK ICO online tracking guidance in a virtual session.
6/18/2026 • Regulation, Law & Enforcement • General
European Union institutions and the UK Information Commissioners Office changed artificial intelligence and online-tracking requirements in Europe during April and May 2026.
6/18/2026 • Regulation, Law & Enforcement • General
EU privacy regulators and corporate counsel in Dublin discuss GDPR, DSA, and breach reporting reforms on February 25.
3/16/2026 • Regulation, Law & Enforcement • General
European Parliament committees endorse small mid-cap definitions and GDPR exemptions in Brussels in 2025 to ease data privacy obligations for growing firms.
2/25/2026 • Regulation, Law & Enforcement • General
EU data protection authorities report on GDPR erasure rights during a 2025 coordinated enforcement across Europe.
2/24/2026 • Regulation, Law & Enforcement • General
The European Union is enforcing AI Act privacy and transparency obligations from 2025, including synthetic-content labeling, biometric restrictions, and penalties for providers.
8/3/2026 • Regulation, Law & Enforcement • General
European companies and regulators have spent the GDPR's first decade expanding compliance and enforcement across Europe, while German businesses report burdens and AI development constraints.
6/3/2026 • Regulation, Law & Enforcement • General
European Commission and EU delegation require Montenegro to align data protection provisions with GDPR before closing accession negotiations.
3/4/2026 • Regulation, Law & Enforcement • General
A court ruling clarifies when GDPR Article 12(5) deems access requests excessive and when Article 82 compensation for access-right violations can be denied due to broken causality.
3/23/2026 • Regulation, Law & Enforcement • General