Privacy Law and Privacy Regulations

Effective January 1, 2026, the California Consumer Privacy Act (CCPA) requires certain employers to complete detailed, documented risk assessments before engaging in many routine data processing practices.

On February 18 2026, the Spanish supervisory authority (the AEPD) published guidance on Agentic Artificial Intelligence systems (the Guidance).

The FTC recently issued a COPPA enforcement policy statement regarding age verification. This statement adds to the children’s patchwork, which we recently wrote about. The statement also comes in advance of the April 22, 2026 compliance deadline for new COPPA Rules (which we wrote about last year)