July 21, 2026

Age-verification legislation in the United States and AI data-processing standards in the European Union are converging to reshape compliance obligations for platform operators on both sides of the Atlantic. The US House passed the KIDS Act by a 267–117 margin, and the EDPB has now issued substantive guidance on anonymisation and web scraping for generative AI — two developments that, taken together, define the near-term compliance frontier for technology companies.

The KIDS Act's passage through the House advances a direct threat to platform privacy architectures that have avoided age-gating. The bill consolidates the Kids Online Safety Act with broader internet regulations requiring platforms to distinguish minor from adult users — a mechanism critics including the Electronic Frontier Foundation argue structurally mandates collection of government-issued ID, biometric data, or behavioral profiles. Senate consideration is now the critical variable, with civil liberties coalitions actively mobilizing on First Amendment and structural privacy grounds. The Senate outcome will determine whether the bill's age-verification model becomes a federal compliance floor or is substantially revised.

Watch level: PREPARE (online platform operators, app store counsel, age-verification technology vendors)

The EDPB's new guidance on anonymisation thresholds and web scraping for generative AI establishes the most specific GDPR-grounded framework yet for AI training data practices. The board addressed two questions that have driven significant compliance uncertainty: what anonymisation standard is sufficient under GDPR to permit data reuse, and what lawful basis applies when web-scraped data feeds generative model development. Organizations training or fine-tuning models on web-sourced corpora should treat this guidance as requiring immediate review of their data sourcing and anonymisation protocols. This item was previously noted as finalized; the substantive content of the anonymisation thresholds and scraping standards warrants action beyond the earlier awareness signal.

Watch level: PREPARE (AI developers, data controllers training generative models, DPOs at EU-facing technology companies)

The EDPB and the Anti-Money Laundering Authority have confirmed plans to develop joint guidelines reconciling AML-mandated information flows with GDPR obligations — a structural tension that has generated compliance friction across European financial services for years. No draft has yet been published; the significance lies in the formal institutional commitment to address the conflict rather than leave resolution to individual DPA enforcement. Financial institutions that have relied on informal interpretations to justify AML-driven data sharing should begin mapping those practices against the likely framework contours.

Watch level: MONITOR (EU financial institutions, compliance officers in AML-regulated sectors, privacy counsel at banks and payment processors)

Dock Labs' analysis of EUDI Wallet market boundaries offers useful orientation for private sector participants weighing entry strategies ahead of the mandatory 2027 member-state deployment deadline. The framework identifies relying party, credential issuer, and wallet provider as the three primary private-sector roles, with governments retaining exclusive control over legal identity and Personal Identification Data. Key governance questions — wallet certification schemes, relying party registration, and cross-border interoperability — remain unresolved. Organizations planning product or service integration with the EUDI ecosystem should treat this as a structural map rather than final compliance guidance.

Watch level: AWARENESS (identity technology vendors, EU-market fintech and regtech firms, digital identity counsel)