July 30, 2026

A coordinated federal-state enforcement action against Hims & Hers marks one of the most significant health data cases of the year, with the FTC joined by Utah and Los Angeles County Counsel alleging the telehealth platform routed sensitive patient information to Meta and Snap while publicly claiming to protect privacy. The case consolidates two recurring enforcement themes — the gap between stated privacy policies and actual ad-tech data flows, and the FTC's sustained focus on the telehealth sector — into a single multi-jurisdictional complaint. Digital health platforms and their ad-tech partners should treat this filing as a direct signal that tracking pixel deployments in patient-facing contexts are under active federal and state scrutiny.

Watch level: PREPARE (telehealth platforms, digital health counsel, health data compliance teams)

New York's Attorney General has finalized technically precise age assurance rules under the SAFE for Kids Act, setting a compliance deadline of January 25, 2027. The rules are notable for introducing tiered numeric false-positive rate thresholds by age cohort — from 0.1 percent for children under eight to 15 percent for 17-year-olds — alongside a 98 percent circumvention-detection floor. No other U.S. jurisdiction has codified age assurance accuracy at this level of technical specificity. Social media platforms and age verification vendors operating in New York should begin mapping existing systems against these thresholds immediately, as the implementation window is less than six months.

Watch level: PREPARE (social media platforms, age assurance vendors, child safety compliance teams)

The Garante has issued three enforcement decisions totaling €740,000 and simultaneously conditioned its approval of Italy's AI Act transposition decree on stronger biometric safeguards, signaling that Rome intends to shape national AI governance through concurrent enforcement and legislative consultation. The fines — against Piaggio & C. SpA (€460,000), Altroconsumo Edizioni (€280,000), and the Città Metropolitana di Sassari — span marketing violations and a data breach. The Garante's conditional endorsement of the AI Act decree is the more structurally significant development: it establishes a precedent for DPA agencies using legislative consultation roles as a lever to embed data protection requirements directly into AI Act implementing measures.

Watch level: PREPARE (Italy-market operators, EU AI Act compliance teams, biometric data processors)

Two U.S. federal AI bills warrant monitoring as legislative signals, though neither is near enactment. HR 9917, the AI Kill Switch Act, referred to the House Committee on Homeland Security, proposes mandatory technical shutdown mechanisms for AI systems subject to government review. Senate bill SB5061, referred to the Commerce, Science, and Transportation Committee, would establish a federal AI incident tracking framework. Both bills reflect a pattern of Congress attempting to define hard technical controls and reporting obligations for AI systems, consistent with directions already emerging in NIST and FTC guidance. Committee advancement on either bill would constitute a material escalation.

Watch level: MONITOR (AI developers, federal contractors, technology counsel)

California's SB 690 — previously covered following its committee advancement on July 1 — has not materially advanced since last reported. The San Francisco Board of Supervisors' continued delay on a resolution backing A.B. 2654's surveillance pricing ban also remains unchanged. Both items are held for monitoring. Separately, the White House's Gold Eagle Initiative, launched July 14 under Trump's June AI executive order, formalizes a centralized AI-assisted vulnerability coordination clearinghouse. Organizations in critical infrastructure sectors should assess whether the initiative's operational requirements will generate disclosure or coordination obligations as implementing guidance is issued.

Watch level: MONITOR (critical infrastructure operators, cybersecurity counsel, federal contractors)