GDPR

Évolutions récentes

• 4 Nov 2026 Regulatory Guidance published High 67 EU-FR European Data Protection Board (EDPB)

  CEPD launches Privacy for Kids platform to educate children and families on data privacy

  The initiative creates a Europe‑wide hub of educational resources to improve children’s digital privacy awareness. The European Data Protection Board, together with data protection authorities including France’s CNIL, has launched the “Privacy for Kids” platform. It offers videos, quizzes, comics, podcasts and games for children, parents, teachers and educators across Europe to help them understand and protect personal data online.

  Effective: 4 November 2026.

  Source: CNIL (France). GDPR in the regulations library.

• 30 Oct 2026 Regulatory Guidance proposed Moderate 46 EU European Data Protection Board

  EPIC urges EDPB to tighten draft guidelines on web scraping for AI training

  The comments highlight significant privacy risks of web‑scraped data for AI, urging stricter guidance to protect individuals under the GDPR. EPIC submitted comments to the European Data Protection Board on its draft Guidelines addressing web scraping for generative AI. The organization argues that the practice is largely illegal under the GDPR, citing legitimate interest as the only possible legal basis and highlighting deficiencies in transparency and data minimisation. EPIC recommends a public registry for scraped data use and a default prohibition unless explicit permission is indicated.

  Source: EPIC. GDPR in the regulations library.

• 27 Oct 2026 Enforcement Action filed Moderate 49 EU EDPB

  noyb files five GDPR complaints against Scale AI’s Outlier platform for invasive tracking and biometric surveillance

  The filings highlight potential GDPR violations by an AI training platform that surveils its freelance workforce, prompting EU data‑protection authorities to investigate. The privacy NGO noyb, together with partners, lodged five GDPR complaints in France, Italy, the Netherlands and Austria against US‑based Scale AI. The complaints allege illegal placement of trackers on workers’ devices without consent, excessive collection of personal data, and forced biometric verification. No response to access requests was provided, breaching GDPR rights.

  Source: noyb and 1 more. GDPR in the regulations library.

• 26 Oct 2026 Framework Update published Low 31 WORLD EDPB

  AI Hallucination Goes to Court: Global Mapping of Emerging Legal Issues

  The post shows how existing legal frameworks are being stretched to address the harms of AI‑generated misinformation, signalling emerging obligations for AI providers and users. A Future of Privacy Forum blog post maps 11 recent judicial and regulatory matters worldwide where AI‑generated false statements have become legally salient. The article highlights cases in China, Germany, Canada, the United States and the EU, showing how courts and regulators are applying existing doctrines such as defamation, unfair competition, misrepresentation and data‑protection accuracy to AI hallucinations.

  Source: Future of Privacy Forum. GDPR in the regulations library.

• 26 Oct 2026 Dpa Action pending Moderate 50 EU Data Protection Authorities

  noyb files GDPR complaints (C078, C097) over AI-generated inaccurate personal data

  These complaints highlight how AI hallucinations challenge GDPR's accuracy and correction rights for individuals. The privacy NGO noyb has lodged two complaints (C078 and C097) with Data Protection Authorities alleging that ChatGPT generated false personal data, including an incorrect date of birth and a fabricated criminal narrative. The complaints argue that OpenAI cannot adequately correct or erase the inaccurate outputs, testing GDPR obligations on accuracy, rectification and erasure. The cases remain pending as of the publication date.

  Case C078, C097.

  Source: Future of Privacy Forum. GDPR in the regulations library.

• 26 Oct 2026 Court Ruling decided Moderate 41 EU-DE EDPB

  German court grants preliminary injunction against Google for AI-generated search summary linking publishers to fraud

  The ruling highlights that providers may be liable for inaccurate AI‑generated content presented as their own, shaping future AI governance and privacy obligations. The Munich I Regional Court issued a preliminary injunction in the Google AI Overview proceedings (26 O 869/26). The court found that the AI-generated search summary, which linked two publishers to fraud and other dubious practices, was treated as Google's own content. The decision emphasizes the provider’s responsibility for the authority created by AI‑generated statements.

  Case 26 O 869/26.

  Source: Future of Privacy Forum. GDPR in the regulations library.

• 23 Oct 2026 Amendment announced Moderate 53 EU EDPB

  EU Council approves amendment to GDPR allowing unrestricted AI data processing

  The amendment could override fundamental privacy rights by permitting AI firms to use all personal data with minimal safeguards. EU Member States, through the Council, approved a change to the GDPR that would make processing personal data "in the context of AI" automatically lawful. The amendment (Article 88bis) would let AI companies use any personal data without consent, relying on a broad legitimate interest. The proposal still requires negotiation with the European Parliament before becoming law.

  Effective: not stated.

  Source: noyb and 1 more. GDPR in the regulations library.

• 21 Oct 2026 Regulatory Guidance published Moderate 44 EU European Data Protection Board

  EDPB adopts Guidelines 3/2025 on DSA‑GDPR interplay

  The new EDPB guidance helps platforms align DSA duties with GDPR privacy requirements. On 17 September 2026 the European Data Protection Board adopted Guidelines 3/2025 addressing how the Digital Services Act interacts with the EU General Data Protection Regulation. The guidance clarifies the application of GDPR obligations for services covered by the DSA.

  Effective: 17 September 2026.

  Source: Hunton Privacy & Cybersecurity Law Blog. GDPR in the regulations library.