United States: Privacy

The European Data Protection Board has released draft guidelines addressing a critical question for data controllers: when does anonymized information remain anonymous after transfer to third parties? These guidelines explore how recipient capabilities and available re-identification techniques can transform seemingly anonymous data into personal information subject to GDPR, introducing new assessment frameworks that could reshape data sharing practices across Europe.

The EU AI Act entered a critical new implementation phase on August 2, 2026, with enforcement authorities now actively overseeing compliance with transparency obligations and general-purpose AI model requirements. Businesses developing, offering, or deploying AI systems in the EU face increased regulatory scrutiny and must navigate complex disclosure requirements, including mandatory notifications when individuals interact with AI rather than humans.

Senate Bill (SB) 1130, legislation that would establish criminal penalties for certain uses of wearable recording devices, continues to move through the California legislature. I’ve had the honor of discussing this measure with staff of the bill’s sponsor, California State Senator Eloise Gómez Reyes, and anticipate there will be more efforts to enact laws seeking to impose measured responses to the privacy, security, and other challenges posed by the latest generation of AI-enabled wearables.