September 23, 2026

Converging legislative and enforcement pressure on child safety standards is reshaping compliance obligations across two of the world's largest digital markets simultaneously. California has enacted a package of laws imposing feature restrictions, a duty of care, and revised age-assurance requirements on platforms serving users under 16 — extending an architecture that routinely becomes the reference point for other US states. The European Commission's KIDS Act proposal, published September 17, pursues a parallel harmonization at EU scale, establishing age-based account restrictions, safety-by-design mandates, and unified age-assurance obligations across member states. The simultaneous advance of both frameworks marks a structural shift: platforms can no longer treat child safety obligations as jurisdiction-specific edge cases requiring local patches, but must design for two overlapping regulatory regimes with distinct but potentially reconcilable requirements.

Watch level: PREPARE (digital platforms, social media operators, age-assurance vendors, compliance counsel with US-CA or EU exposure)

Germany's Bundestag is weighing legislation that would materially expand automated surveillance powers across federal law enforcement and migration agencies, and the committee stage now underway represents the most consequential near-term checkpoint. On September 21, AlgorithmWatch appeared before the Interior Committee as an expert witness, opposing draft measures from the Interior and Justice Ministries that would extend biometric and AI-based investigative authorities to the BKA, Bundespolizei, and BAMF. Separately, German credit agency Schufa has received a formal cease-and-desist warning over an undisclosed secondary database, following a civil society access-request campaign that generated more than 22,000 individual GDPR inquiries. The Schufa action reinforces that Articles 13–15 transparency obligations are being tested through coordinated civil enforcement as well as regulatory channels — a model that other organized privacy advocacy groups in the EU may replicate against similarly opaque data processors.

Watch level: PREPARE (German federal agencies, financial data processors, credit reporting infrastructure operators, EU compliance counsel)

Two US federal court decisions issued this month clarify — and in one case narrow — the legal exposure of technology platforms in biometric litigation. In California, a federal judge dismissed a CDAFA-based voiceprint class action against Meta, finding that the company's Terms of Service, Privacy Policy, and Regional Privacy Notice supplied sufficient authorization for alleged voice data collection; critically, the court left unresolved whether Meta generates actual biometric voiceprints or whether its disclosures would satisfy a dedicated biometric statute. In the Western District of Washington, Amazon and Ring are pursuing dismissal of a bystander biometric suit, arguing that individuals who appear incidentally before Ring cameras cannot establish cognizable claims under Washington, Virginia, and California consumer protection statutes without explicit legislative authorization for private suits. Together, these cases underscore that broadly drafted privacy disclosures remain a significant but incomplete shield, and that bystander standing in biometric litigation is unresolved federal-court terrain with sector-wide implications.

Watch level: MONITOR (platform operators, biometric technology vendors, privacy litigation counsel)

Spain's AEPD has imposed a €100,000 fine on Securitas Direct for routing data subject rights requests through a premium-rate telephone line — a barrier that the authority treats as a direct violation of the obligation under GDPR Articles 12–22 to facilitate rights exercise without cost or friction. The decision is notable not for its fine size but for its operational specificity: it establishes that telephony infrastructure choices are themselves a compliance variable, not merely a customer-service matter. Organizations using call-center or hotline channels as their primary rights-request mechanism should audit whether associated charges constitute unlawful obstruction under the AEPD's reasoning, particularly given the EDPB's recently finalized unified fining methodology, which increases the cross-border stakes of decisions originating from any single supervisory authority.

Watch level: PREPARE (customer operations, compliance teams managing DSR workflows via telephony channels across the EU)

Western Australia Police Force has published results from a three-month live facial recognition trial — 905,117 scans, 209 alerts, 79 arrests — and the headline arrest figures have drawn immediate scrutiny after eight confirmed false matches, all involving individuals with darker skin tones. Senior officials declined to address the demographic pattern directly and cited deterrence as a primary program objective, a framing that sidesteps substantive accuracy and equity questions. The trial reflects an accelerating normalization of biometric public surveillance in Australian policing absent any dedicated federal or state legislative framework governing deployment, data retention, or error-correction obligations. For vendors and public-sector clients considering similar programs in comparable common-law jurisdictions, the absence of a governing legal standard — not just the trial's arrest count — is the operative risk variable.

Watch level: MONITOR (law enforcement technology vendors, civil liberties counsel, Australian federal and state policymakers)

Still developing: Ireland DPC fine of €403 million against Google for location data violations: no material change since last reported; decision stands as issued. AEPD first AI agent data breach: no material change since last reported; AEPD classification and analysis remain as previously covered. BIA use of Clearview AI preceding procurement notice: no material change since last reported; contract status and Interior Department response remain unresolved. Meta appeals of Ofcom OSA categorization: no material change since last reported; appeal proceeding as filed.