New privacy rules, GDPR fines and online safety updates
California's age-signal law, Montenegro's GDPR-style rules, EDPB fine guidelines, a €7M health data fine, and Mexico's content decree.
Weekly Compliance Brief: October 5 - 9, 2026
California is preparing to introduce new age-verification requirements for apps, Montenegro has adopted GDPR-style privacy rules, and Italy has issued a €7 million fine for improperly anonymized health data.
This week’s brief covers these developments and more, including what they could mean for businesses managing data privacy, accessibility, and digital compliance.
Data privacy law news
California’s new law will require apps to account for users’ ages
California's Digital Age Assurance Act (DAAA), enacted through AB 1043, takes effect January 1, 2027. It requires operating system providers to collect age information at account setup and share age-band signals with app developers.
Once developers receive these signals, they are deemed to have "actual knowledge" of a user's age range. Operating systems have until July 1, 2027, to age-band existing accounts, so signals will arrive in phases.
App developers should review how they will receive and use age signals, particularly when managing user accounts, parental consent, and children’s privacy requirements under COPPA.
Montenegro adopts GDPR-style privacy law with tougher penalties
Montenegro's new Personal Data Protection Law, modeled on the GDPR, entered into force on September 19, 2026 and will apply from March 19, 2027.
Maximum fines rise from EUR 20,000 to EUR 2 million or 4% of worldwide annual turnover, and the law now reaches foreign businesses that offer goods or services to, or monitor, people in Montenegro. Until Montenegro joins the EU, the EU will not recognize adequacy decisions and standard contractual clauses (SCCs) as transfer tools.
Companies serving Montenegrin users should check whether they need a local representative and rework transfer arrangements before March.
EU seeks feedback on proposed online safety rules for children
The European Commission is gathering feedback on the proposed EU KIDS Act from children, parents, educators, and the online platforms it would cover.
Adopted as a proposal in September, the act would introduce a social media delay, safety-by-design rules, privacy-preserving age assurance, and stronger enforcement. The Commission will summarize responses for the European Parliament and Council to inform the legislative debate.
Platforms likely to be used by minors in the EU can use this window to weigh in on age assurance and design requirements, and should start mapping how their services would be affected.
EU privacy regulators propose new guidance on GDPR fines
The European Data Protection Board (EDPB) released draft Guidelines 04/2026 for public consultation, setting out how regulators should choose between a GDPR fine and other corrective measures, such as a reprimand.
Under the proposed guidance, more serious GDPR violations are more likely to result in fines.
Businesses that identify and address problems quickly, particularly before an investigation begins, may receive more favorable treatment. Simply meeting existing legal obligations or cooperating with regulators may not be enough to reduce a penalty.
Privacy teams should treat quick, documented remediation as a real factor in enforcement outcomes. Comments are open until November 13, 2026.
Italy fines health data company €7 million for inadequate anonymization
Italy's data protection authority, the Garante, fined IQVIA Solutions Italy €7 million for a database that held health information on one million patients across 800 family doctors and was used for studies, including some commissioned by pharmaceutical companies.
The regulator found the data was not anonymous: a persistent patient code combined with details such as birth year, diagnoses, prescriptions, and location made re-identification possible. The company also lacked a legal basis, set no retention limits (some records dated back to 2001), and carried out no impact assessment.
Any business that labels analytics or research datasets as "anonymous" should test that claim, since persistent identifiers plus rich attributes can still count as personal data under the GDPR.
Poland clarifies which data breaches businesses must report
Poland's data protection authority (UODO) reminded organizations that not every personal data breach must be reported, following a wave of incidents involving unauthorized access to customer databases and invoicing systems.
Exposing data that is already public in Poland's business register, such as a sole trader's name and tax ID, is usually low risk. Notification is required when national ID (PESEL) numbers, financial details, or purchase data revealing health information are also exposed.
Even when no report is filed, the GDPR requires a documented risk assessment and an entry in the internal breach register, so incident response teams should build both steps into their process.
Web accessibility news
Indian courts examine accessibility barriers in air travel and digital books
India's Supreme Court issued notices on a public interest petition alleging systemic discrimination against people with disabilities in civil aviation, citing barriers in booking, check-in, Digi Yatra digital boarding, and security screening. A day later, the Delhi High Court issued notices on a separate plea seeking timelines for making books and reading material available in accessible formats.
Both cases test how the Rights of Persons with Disabilities Act, 2016 applies to digital services, with petitioners arguing that a service open to everyone can still discriminate if disabled people cannot use it independently.
Airlines, travel platforms, and publishers serving India should review booking flows, self-service tools, and digital content for screen reader compatibility as courts push for stronger enforcement.
Content takedown news
UK investigates Instagram’s disappearing posts over online safety concerns
Ofcom, the UK's online safety regulator, opened an investigation into whether Meta properly assessed the risks of Instagram Instants, a feature launched in May that makes shared content disappear after it is viewed.
Ofcom is examining whether Meta completed suitable illegal content and children's risk assessments before launch, as the Online Safety Act requires for significant service changes. Fines can reach £18 million or 10% of qualifying worldwide revenue.
Platforms serving UK users should treat risk assessments as a pre-launch step for every major new feature, not a task to complete after release.
Mexico introduces new rules targeting violent content and child safety
President Claudia Sheinbaum presented a mandatory decree requiring platforms to identify and quickly remove accounts and content that promote violence, and to keep minors away from harmful material. Publication in Mexico's official gazette is expected on October 13 or 14.
Obligations include age-based content classification, parental controls, user reporting tools, the strictest privacy settings by default for minors, and a 24/7 contact point for investigators. No penalties are set yet, but the government said it could follow up with a law with sanctions if platforms do not comply.
Platforms with Mexican users should prepare their takedown, reporting, and child safety settings now and review the final text as soon as it is published.
Whistleblowing news
US lawmakers propose stronger protections for Medicaid whistleblowers
House Energy and Commerce Republicans introduced the Medicaid Whistleblower Protection Act, part of a 14-bill anti-fraud package, to create nationwide protections for state and local Medicaid workers who report suspected fraud.
The bill bars firing, demoting, or harassing workers who report fraud, legal violations, or mismanagement, and lets workers who face retaliation seek reinstatement, double back pay, and punitive damages. If passed, it would take effect on January 1, 2028.
The proposal is part of a wider push to protect internal reporters, so compliance and HR teams should make sure reporting channels are easy to use and anti-retaliation policies are enforced in practice.
Until next week
With new privacy rules approaching in California and Montenegro, and regulators placing greater scrutiny on how businesses manage personal data, now is a good time to review existing practices and identify areas that may need attention.
We’ll continue tracking these developments and breaking down what they mean for your business.
Adam is the Head of Digital Marketing at Clym, where he leverages his diverse expertise in marketing to support businesses with their compliance needs and drive awareness about data privacy and web accessibility. As one of the company’s original team members, Adam has been instrumental in shaping its journey from the very beginning. When he’s not diving into marketing strategies, Adam can be found cheering on his favorite sports teams or enjoying fishing.