On October 1, 2026, the U.S. Cybersecurity and Infrastructure Security Agency (“CISA”) submitted a draft of the Final Rule implementing the Cyber Incident Reporting for Critical Infrastructure Act of 2022 (“CIRCIA”) to the Office of Information and Regulatory Affairs (“OIRA”)
Latest from Inside Privacy
California Governor Signs Over 20 AI-related Bills into Law
Governor Gavin Newsom of California signed over 20 AI-related bills into law in the final days of September. Several of these bills address topics such as frontier model and generative AI oversight, AI transparency, and new requirements for use of
California Governor Signs SB 690, Eliminating Private Website-Based CIPA Pen Register Claims and Calling for Broader CIPA Reform
On September 30, Governor Gavin Newsom signed SB 690, a significant new law aimed at curbing the wave of lawsuits and demand letters asserting “pen register” claims under the California Invasion of Privacy Act (“CIPA”). The legislation eliminates the private
New California AI Employment Laws: Key Requirements for Employers
On September 30, California Governor Gavin Newsom signed three laws that will regulate the use of AI in the employment context, starting in the new year. Below, we briefly summarize these developments, which we discuss in greater detail in our
Key Takeaways for Private Sector Entities from the FBI’s New Cyber Strategy
On September 9, 2026, the U.S. Federal Bureau of Investigation (“FBI”) announced the publication of the FBI Cyber Strategy (the “Strategy”). The Strategy, which “provides a roadmap for defending the American people and the nation’s critical infrastructure in cyberspace,” is
California Enacts Several Minors’ Privacy and Safety Laws
Recently, California Governor Gavin Newsom signed a sweeping set of laws related to minors’ privacy and safety, including new laws that restrict covered platforms from providing certain features to users under 16, impose a duty of care on social media
The EU KIDS Act Proposal: Towards a New Regulatory Framework for the Protection of Children Online
On September 17, 2026, the European Commission (the “Commission”) published its proposal for a new EU framework on child safety online (the “KIDS Act”). The proposed Regulation aims to introduce EU-harmonized age-based account restrictions, safety-by-design rules, and age-assurance obligations across
Kenya Issues New Cross-Border Data Transfer Guidance: Familiar Concepts, but Important Local Differences
On September 8, 2026, Kenya’s Office of the Data Protection Commissioner (“ODPC”) published new Guidance Notes for Cross-border Data Transfers (“Guidance”), providing organizations with more detailed guidance on the application of Kenya’s rules governing transfers of personal data outside the
California Legislature Advances AI Employment Bills
At the end of August, the California legislature passed three bills that would regulate the use of AI in the employment context. These bills are now on Governor Newsom’s desk, and he has until September 30 to sign or veto.
Horizon Scan: Children’s Online Safety and Privacy (EU and Beyond)
In recent months, children’s online safety and privacy have moved to the top of the EU’s digital agenda. The European Commission is expected to outline its proposal on minors’ access to social media this week, a potentially significant development that