June 24, 2026

A White House executive order directing federal agencies to transition to post-quantum cryptography marks the most consequential US federal action in today's developments. The order formalizes a policy commitment that will cascade into procurement requirements, contract security clauses, and data handling standards for agencies and their contractors. Implementation guidance has not yet been issued, but the signal to vendors and compliance teams is clear: cryptographic readiness planning can no longer be treated as speculative. Federal contractors should begin assessing current encryption dependencies against NIST post-quantum standards now.

Watch level: PREPARE (federal agencies, government contractors, cybersecurity counsel)

The EU eIDAS committee's June 18 agreement making facial image inclusion in the European Digital Identity Wallet optional at the member state level resolves a procedural standoff but creates a structurally fragmented compliance environment. Citizens in member states that elect mandatory portrait inclusion will face de facto biometric disclosure requirements when using the wallet for routine transactions. Digital rights organizations EDRi and Epicenter.works have signaled continued opposition, warning that absent a uniform opt-out guarantee, public trust in the scheme may erode ahead of the 2026 rollout deadline. Identity wallet implementers and relying parties operating across multiple member states must now map their service design against a patchwork of national biometric disclosure rules rather than a single EU-wide standard.

Watch level: PREPARE (identity wallet vendors, relying party operators, EU member state DPAs)

Arkansas Attorney General Tim Griffin's suit against both Roblox and Discord — framing them as a coordinated two-stage predatory pipeline for child exploitation — extends the multi-state enforcement pattern into new platform territory. Discord has not previously faced state-level litigation in the Roblox enforcement cluster, and the complaint's framing of cross-platform design as a systemic liability theory warrants attention beyond the immediate parties. Ten states have now filed or settled suits against Roblox, with Alabama, West Virginia, and Nevada each settling for over $11 million. Platforms whose products are used sequentially by minors — even where each product individually might pass scrutiny — should assess whether their combined design patterns could sustain a pipeline theory of liability.

Watch level: PREPARE (social media and gaming platforms, children's online safety counsel, state AG compliance teams)

The EU Digital Omnibus AI Act delay, previously covered as the Parliament vote of June 16, has not materially advanced since European Council approval remains outstanding; it is noted here only for tracking purposes. On the US federal legislative front, the House children's online safety compromise bill omitting a duty-of-care provision signals that congressional negotiators have chosen to pursue passage over structural platform accountability. The NO FAKES Act's referral to the House Judiciary Committee represents an early procedural step toward a federal right of publicity framework for synthetic media, with markup not yet scheduled.

Watch level: MONITOR (platforms subject to children's safety obligations, AI Act compliance teams, entertainment and advertising sector counsel)

Vermont's enactment of two complementary health privacy statutes — H.639 targeting direct-to-consumer genetic testing and S.71 covering consumer health data broadly — adds a materially distinct regulatory layer beyond the comprehensive consumer privacy law noted in recent briefings. Organizations offering genetic testing services to Vermont residents face obligations under a dedicated genetic privacy framework that operates separately from general data rights statutes. This dual-track approach signals a model other states may replicate as the absence of federal health data legislation outside HIPAA continues to drive state-level innovation. Compliance teams should assess whether existing multi-state privacy inventories adequately distinguish genetic data obligations from general consumer health data requirements.

Watch level: PREPARE (direct-to-consumer genetic testing companies, digital health platforms, multi-state privacy compliance teams)

A cluster of Italian Garante enforcement actions — a €120,000 fine for GPS tracking of employees in company vehicles, a fine for post-sick-leave health questionnaires, and the previously covered tissue sample disposal sanction — collectively illustrate the authority's sustained focus on workplace data practices and health data handling in clinical settings. The vehicle tracking fine is the most significant, reinforcing that location monitoring of employees requires documented lawful basis and proportionality assessment regardless of operational justification. EU employers operating company vehicle fleets or administering return-to-work health screenings should treat these decisions as active enforcement signals rather than isolated edge cases.

Watch level: PREPARE (EU employers with company vehicle fleets, HR and occupational health compliance teams, Italian subsidiaries of multinational groups)