After SolarWinds: What the SEC's Cybersecurity Disclosure Rules Actually Require in 2026
The SEC voluntarily dismissed its cybersecurity enforcement case against SolarWinds and CISO Timothy Brown in November 2025, ending the first-ever SEC...
Compliance & Regulatory Articles
712 articles on privacy laws, security frameworks, and regulatory compliance.
The UK CMA's Agentic AI Guidance: The First Regulatory Framework for Autonomous AI Agents in Consumer Markets
On March 9, 2026, the UK Competition and Markets Authority published the first regulatory guidance specifically addressing how autonomous AI agents mu...
FTC vs. OkCupid: How Sharing 3 Million User Photos With an Undisclosed Third Party Became a Federal Enforcement Action
On March 30, 2026, the FTC took action against OkCupid and parent company Match Group for sharing nearly three million user photos and location data w...
OCR Begins Enforcing 42 CFR Part 2: What Health Systems, Behavioral Health Platforms, and Their Vendors Must Know
On February 16, 2026, HHS Office for Civil Rights commenced enforcement of the updated 42 CFR Part 2 rules governing substance use disorder treatment ...
Reddit Fined £14.47 Million by ICO: Why Age Self-Declaration Is No Longer a Defense
The UK Information Commissioner's Office fined Reddit £14.47 million in February 2026 for unlawfully processing children's personal data. The central ...
California's CPPA Is Fining Real Companies Now: Lessons from Disney, Ford, Honda, and Tractor Supply
The California Privacy Protection Agency issued multiple enforcement decisions in Q1 2026 against well-known companies including Disney/ABC ($2.75M), ...
CNIL's €42 Million Fine Against Free Mobile: Three GDPR Violations Every Security Team Must Study
In January 2026, France's data protection authority fined Free Mobile €27 million and its parent Free €15 million — a combined €42 million — for three...
Colorado Is Repealing Its Own AI Law: What SB 189 Means for State AI Regulation in 2026
Colorado is advancing Senate Bill 189, which would effectively repeal and replace the state's landmark 2024 AI Act before it ever took effect. The new...
The EU AI Act Deadline Is 88 Days Away and the Deal to Delay It Just Collapsed
The second political trilogue on the EU AI Omnibus package — which would delay the August 2, 2026 high-risk AI deadline to 2027 or 2028 — ended withou...
FTC Bans Kochava From Selling Sensitive Location Data: What Every Data Broker and App Publisher Needs to Know
On May 4, 2026, the FTC settled its four-year case against data broker Kochava and subsidiary Collective Data Solutions, permanently banning them from...
Brussels Is Rolling Back Its Own Rules: What the EU Digital Omnibus Means for GDPR, AI Act, and Data Act Compliance
The European Commission's Digital Omnibus package, proposed in November 2025, would simplify GDPR obligations, extend the EU AI Act's high-risk deadli...
20 States Now Enforcing Consumer Privacy Laws: The Complete 2026 Compliance Map
Indiana, Kentucky, and Rhode Island joined the state privacy landscape on January 1, 2026, bringing the total to 20 states with active comprehensive c...