A short account of what changed in privacy law between spring and autumn 2026, and what did not.

United Kingdom: reform delivered

The main data protection provisions of the Data (Use and Access) Act 2025 came into force on 5 February 2026. They introduced a list of recognised legitimate interests, relaxed the rules on automated decision-making, allowed controllers to pause the clock on access requests while seeking clarification, and raised cookie penalties to GDPR levels. Since 19 June 2026 every organisation must have a process for handling data protection complaints, with acknowledgement within 30 days. On 30 September 2026 the Information Commissioner’s Office became the Information Commission, a board-led regulator. The EU has renewed its adequacy decisions for the UK until 2031.

European Union: reform stalled

The Commission’s Digital Omnibus proposed changes to the GDPR, the cookie rules and the Data Act. The part dealing with AI became law in July 2026. The data part has not. In late September it was still at first reading, with more than 1,750 amendments in Parliament and no agreed position among member states. The GDPR as it stands is still the law.

United States: more states, tighter rules

Twenty states now have comprehensive privacy laws. Indiana, Kentucky and Rhode Island joined on 1 January 2026. On 1 July 2026 Connecticut lowered its threshold to 35,000 consumers and began requiring businesses to say whether personal data is used to train large language models. Virginia banned the sale of precise location data. New Jersey and Maryland added limits on selling sensitive data. In California, risk assessments have been required since January, and regulators have fined companies whose opt-outs did not work.

The common threads

Three themes run through all of it: children’s data, sensitive data such as location, and disclosure of AI use.

The UK has moved, the EU is arguing, and the US is legislating state by state. A single global privacy notice is harder to write than it was a year ago.

This article is general information on the law as at November 2026. It is not legal advice and has not been updated since that date. See the terms of use.