August 25, 2026

Algorithmic management of platform workers has produced the EU's largest enforcement action since the GDPR's record fines of recent years. The Dutch Data Protection Authority, acting jointly with France's CNIL, has imposed an €824,990,000 penalty on Uber B.V. and Uber Technologies Inc. for violating GDPR Article 22—the provision restricting solely automated decisions that produce significant legal or similarly significant effects on individuals without adequate human oversight or safeguard mechanisms. The scale and cooperative structure of the decision reinforce that gig-economy platforms face coordinated, cross-border scrutiny of their algorithmic workforce management systems, not merely national-level regulatory risk.

Watch level: PREPARE (gig-economy platform operators, EU privacy counsel, labor-relations compliance teams)

California's legislature has advanced SB1159, an AI transparency and governance bill, on a 37-0 Senate concurrence vote, sending the measure to the governor for signature. The unanimous margin reflects consolidated legislative will around codifying disclosure and oversight obligations for AI systems—an outcome that narrows the political uncertainty that has stalled comparable bills in prior sessions. If signed, California would join Connecticut's CART Act as one of only two US states to have enacted comprehensive AI governance legislation, accelerating pressure on multistate operators to build compliance programs that span both regimes simultaneously.

Watch level: PREPARE (AI developers and deployers with California exposure, multistate compliance counsel)

Ofcom's £630,000 fine against Fapello.com marks a meaningful shift in UK online safety enforcement posture. The penalty, issued for failure to deploy highly effective age assurance under Section 12 of the Online Safety Act during a four-month window in 2025, establishes that geoblocking the UK market does not extinguish retroactive liability—a holding that narrows exit options for platforms seeking to avoid OSA obligations by withdrawing UK access. The action was accelerated by pressure from compliant platforms like Pornhub, which argued that regulatory forbearance toward non-compliant sites distorted competitive conditions. For adult content operators and age-assurance vendors globally, the decision underscores that compliance timelines are now effectively closed.

Watch level: PREPARE (adult content platforms, age-assurance technology vendors, OSA compliance teams)

New Zealand has introduced two overlapping legislative instruments banning under-16 access to high-risk social media platforms, with fines reaching 10 percent of global revenue for noncompliant operators and explicit prohibition on self-declaration as a valid age assurance method. The bills require risk assessments, regulatory reporting, and enumerated technical age assurance measures including facial age estimation and digital identity services. Political risk is material: coalition partners New Zealand First and ACT have both publicly opposed the measures, and the government's ability to secure a parliamentary majority remains uncertain. For platforms already navigating Australia's Online Safety Act and the UK's Children's Code, the New Zealand bills represent a further front in common-law jurisdictions' converging demands for technical age gating.

Watch level: MONITOR (social media platforms with APAC exposure, age-assurance vendors, children's privacy counsel)

Australia's eSafety Commissioner has accepted a court-enforceable undertaking from Roblox requiring child protection measures within three months, including restrictions on adult-to-child contact and tightened privacy defaults for minors. The undertaking introduces mandatory independent third-party auditing of safety systems—the first such requirement under Australia's Online Safety Act—closing a self-assessment gap that regulators have consistently identified as a structural weakness in platform accountability frameworks. Noncompliance exposes Roblox to Federal Court enforcement, raising the stakes for platforms that have relied on internal compliance attestations. The audit mandate is the detail most likely to be replicated in future undertakings and regulatory guidance across Australian and analogous regimes.

Watch level: PREPARE (gaming platforms, children's platform operators, online safety counsel with Australian exposure)

Still developing: CNIL's €49M-plus enforcement wave against four entities: no material change since last reported; decisions stand as issued. Connecticut CART Act: no material change; law enacted and compliance timelines running. Brazil Supreme Court platform liability regime: 60-day deadline continues to run with no reported judicial stay or material procedural change. New Jersey Children's Design Code: no material change since enactment; implementation obligations remain in force.