Practical compliance insight on consent management, cookie law, and tracking technologies.
Laws and RegulationsThe EU General Court recently ruled that the European Commission violated EU data protection laws by transferring personal data to the U.S. without proper safeguards. The Commission must pay damages t
Laws and RegulationsWhen your team receives a GDPR Article 17 deletion request, the clock starts ticking. You have one month to respond, and your answer must be documented, defensible, and technically accurate. This temp
Laws and RegulationsMany believe California s privacy laws, the CCPA and CPRA, set the standard for U.S. privacy regulation. The idea is that if you align with California s requirements, you re prepared for other states.
Laws and RegulationsOn March 20, 2025, Mexico published its new Federal Law on the Protection of Personal Data held by Private Parties in the Official Gazette of the Federation. The law became effective the next day, Mar
Get weekly security insights and compliance updates delivered to your inbox.
Laws and RegulationsScope - What This Guide Covers This guide addresses the emerging patchwork of US state data broker laws enacted as of early 2025. It s designed for data governance teams managing compliance across jur
Laws and RegulationsThe Challenge A Berlin-based technology partner faced a major shift when the EU AI Act transitioned from draft to enforceable regulation. Carsten Kociok, a top-ranked Fintech legal advisor in Germany,
Laws and RegulationsYou re facing 19 different state privacy laws, and the rulebook that let you treat them as variations of the same thing just expired. Seven states enacted privacy laws in 2024, but more importantly, 2
Laws and RegulationsWhen state attorneys general coordinate their enforcement efforts, organizations find that compliance strategies designed for isolated audits don t scale. The formation of bipartisan privacy enforceme
Laws and RegulationsThese questions come from privacy operators, DSAR coordinators, and consent managers who ve been reaching out over the past few months. You re seeing more enforcement notices, handling more subject ri
Laws and RegulationsThe UK Data (Access and Use) Act 2025 came into law on June 19. If your organization relies on the EU-UK adequacy bridge for cross-border data flows, you need a systematic way to track whether changes
Laws and RegulationsConnecticut s $85,000 enforcement action against TicketNetwork marks a turning point: state attorneys general are no longer issuing warnings. They re issuing fines. The violations weren t exotic edge
Laws and RegulationsOn September 3, 2025, the European General Court rejected French MP Philippe Latombe s request to annul the EU-U.S. Data Privacy Framework (DPF). This decision allows over 3,400 U.S. organizations cer
Laws and RegulationsChina s Q2 2025 regulatory sprint has introduced five simultaneous compliance workstreams for multinational privacy officers. The CAC s draft Cybersecurity Law amendments, TC260 s audit guidelines, th
Laws and RegulationsConnecticut s settlement with TicketNetwork reveals a truth many privacy officers suspect: your privacy policy might be worse than you think. The Attorney General didn t just find missing disclosures.
Laws and RegulationsIf your team is grappling with privacy questions from product, engineering, or compliance departments, you re not alone. With Maryland s law in effect as of October 1st and three more states set for J
Laws and RegulationsYou ve got three years, maybe five, depending on your revenue. The California Privacy Protection Agency approved its automated decision-making, risk assessment, and cybersecurity audit regulations on
Laws and RegulationsThe Conventional Wisdom Many privacy teams follow a simple rule: never reject a Data Subject Access Request (DSAR). This approach seems logical because Article 15 of the GDPR grants individuals the ri
Laws and RegulationsOver the past year, your team has likely dealt with more right-to-erasure and right-to-object requests than in all of 2022 combined. If you re concerned about whether your processes will withstand scr
Laws and RegulationsThe conventional wisdom says this: if you re a platform controller handling user data, the CJEU s Russmedia decision means you need to bolt AI governance frameworks onto your existing GDPR compliance
Laws and RegulationsThe decision isn t whether to comply with U.S. state privacy laws, but how to do it effectively. With 24 states now having comprehensive privacy statutes, you need to decide between managing distinct
