July 17, 2026

Senate Republicans hold the decisive vote on whether the most significant US children's online safety legislation in a generation becomes law. The House passed H.R. 7757, the KIDS Online Safety Act package, 267-117, sending to the Senate a bill whose age-verification mechanism would, in practice, compel platforms to collect government-issued ID, biometric data, or behavioral profiles at scale. Civil liberties organizations including EFF have flagged the structural privacy and free-expression risks. Opposition to the age-gating provisions is organized and active in the Senate, making passage uncertain.

Watch level: PREPARE (social media platforms, messaging services, legal counsel for digital media companies with minor-user exposure)

The EDPB's anonymisation and web scraping guidance — already flagged in this briefing as operative — now warrants formal compliance review rather than continued monitoring. Published alongside finalized blockchain and data protection guidelines, the materials close interpretive gaps that have permitted inconsistent GDPR enforcement across member states on two of AI development's most contested questions: what constitutes genuine anonymisation of training data, and which web scraping practices are permissible. Organizations training generative AI models on European data should treat these documents as authoritative and act accordingly.

Watch level: PREPARE (AI developers, data engineering teams, DPOs at organizations training or fine-tuning models on EU-sourced data)

The FTC's $2.25 million settlement with RentGrow establishes a concrete benchmark for FCRA reasonable-procedures obligations in the specialized screening sector. The agency found that RentGrow reported duplicate records and failed to disclose data sources — failures with direct consequences for housing access decisions. The action follows a pattern of FTC enforcement targeting data-quality failures at sector-specific consumer reporting agencies. Background check and tenant-screening vendors should audit their source-disclosure and deduplication procedures against this settlement's implied standard.

Watch level: PREPARE (tenant-screening vendors, background check providers, FCRA compliance counsel)

The EDPB–AMLA joint guidelines initiative signals that EU regulators are moving to resolve a persistent structural tension: AML information-sharing obligations and GDPR data minimization requirements frequently pull in opposite directions for financial institutions. The announcement confirms the initiative is underway; substantive draft output is not yet available. Financial sector compliance architects designing data-sharing arrangements between regulated entities should build flexibility into current frameworks, as the guidelines are likely to constrain or reshape permissible architectures once finalized.

Watch level: MONITOR (EU financial institutions, AML compliance officers, legal counsel advising on data-sharing partnership structures)

Dock Labs' analysis of the EUDI Wallet framework clarifies the market boundary between state-controlled identity infrastructure and private-sector participation — a question with direct commercial implications ahead of the 2027 mandatory deployment deadline across all 27 EU member states. Governments retain exclusive authority over primary wallet certification and personal identity documents; commercial entities may participate through non-qualified Electronic Attestation of Attributes or by qualifying as — or partnering with — qualified trust service providers. Several framework elements, including relying party registration and cross-border interoperability, remain unresolved and vary by member state. UK-based organizations with EU market exposure face additional complexity given divergent post-Brexit identity infrastructure trajectories.

Watch level: MONITOR (identity technology vendors, relying parties integrating EU digital identity, UK-based firms with EU operations)