APAC
- The Supreme Court of India cautioned a major social media platform against using citizens’ private information for targeted advertising.
- South Korean Personal Information Protection Commission announced the results of its 2025 evaluation of personal information processing policies.
- China’s CAC introduced new regulations classifying online information that may affect minors.
- Personal Data Protection Commission of Taiwan published draft measures on maintaining security of personal data files.
- Singapore’s Infocomm Media Development Authority released model framework for governance of agentic AI.
- AI Regulation Law establishing liability for processing of personal data using AI came into force in Uzbekistan.
EMEA
- European Union and Brazil adopted mutual adequacy decisions, creating largest area of secure data flow.
- The UK Information Commissioner’s Office fined two companies a combined GBP 225,000 for sending unsolicited marketing communications.
- France’s CNIL issued final recommendations on collecting user consent across multiple devices.
- European Data Protection Board established cooperation procedure for authorization of contractual clauses and adoption of Standard Contractual Clauses under GDPR.
- Spanish Data Protection Agency reported receipt of more than 2,700 notifications of personal data breach in 2025.
- Monaco’s Personal Data Protection Authority issued opinion on draft law relating to confidentiality in medical, medico-social or social context.
- European Commission launched investigation into AI assistant and social media company’s recommender system under Digital Services Act.
- Liechtenstein’s Data Protection Office released guidance regarding handling of personal data during due diligence in company sale.
- CNIL launched a consultation on proof of consent in marketing sector.
- EU Commission initiated proceedings to help technology company comply with Digital Markets Act obligations on interoperability and online search data sharing.
Americas
- California’s Attorney General issued a cease-and-desist letter to AI company to stop creation and distribution of deepfake, inappropriate images and child sexual abuse material.
- Electronic Privacy Information Centre developed people-first model chatbot bill, addressing key data privacy violations.
- Brazil’s Data Protection Agency, Federal Prosecution Office and Consumer Secretariat issued joint recommendations to social media company to stop inappropriate AI content.
- Social Media Regulation Act passed by South Carolina General Assembly.
- US Department of Justice’s lawsuit seeking data of California voters dismissed by the Federal Court.
