This week’s compliance updates show regulators, courts, and advocacy groups putting more pressure on privacy and accessibility programs.
In the UK, the ICO issued a major nuisance marketing fine. In Europe, a French court ordered Carrefour to fix accessibility issues on its website and app under EAA-related national law. In the US, disability advocates challenged delayed ADA web accessibility deadlines.
Here are the key updates compliance, legal, marketing, and digital teams should know.
Data privacy law news
ICO fines UK firm £300,000 over 5.5 million unlawful marketing texts
The UK ICO fined KRA Consultancy Ltd £300,000 after the company sent more than 5.5 million unsolicited marketing texts to people in financial difficulty. Some messages falsely warned recipients about bailiff visits, and the campaign led to more than 60,000 complaints.
The ICO found that the firm did not verify consent and continued unlawful activity after regulatory action. For marketing teams, this is a clear reminder that consent must be checked before sending direct marketing messages.
Learn more
Article 27 enforcement expands against non-EU businesses
EU regulators are increasingly taking action against non-EU businesses that fail to appoint an Article 27 representative. This obligation applies to many companies that process EU personal data but do not have an EU establishment.
Regulators can identify this gap quickly, making it an easy starting point for enforcement. Businesses using analytics, consent tools, ecommerce, or other website-based data collection should confirm whether an EU representative is required.
Learn more
Vermont updates data broker law with KYC rules and higher penalties
Vermont has strengthened its data broker law through H.211, signed in June 2026. From January 1, 2027, data brokers must identify data recipients and certify the intended use of personal data before disclosure.
The law also increases penalties, including fines for materially incorrect filings and a new surety bond requirement. Businesses that buy, sell, or share third-party marketing data should review their Vermont obligations before the effective date.
Learn more
Ireland’s EU council presidency brings new scrutiny to GDPR enforcement
Ireland takes over the rotating EU Council presidency on July 1, 2026. Its role will include work on Digital Omnibus negotiations, which critics say could affect parts of the GDPR.
Because Ireland is home to the European headquarters of major technology companies, its approach to digital regulation is likely to face close attention. Compliance teams should watch how GDPR-related discussions develop over the next six months.
Learn more
Alberta issues new guidance on privacy management programs
Alberta’s privacy regulator has published new guidance for public bodies implementing privacy management programs and privacy impact assessments. The guidance covers privacy officer responsibilities, AI and automated decision-making policies, employee training, and high-risk processing reviews.
Although it focuses on the Canadian public sector, it reflects broader accountability expectations seen in many privacy laws. Organizations building formal privacy programs may find the framework useful as a reference point.
Learn more
