Laws & Guides
EU Kids Act: Proposed Age-Based Restrictions on Minors’ Social Media Use
The EU Kids Act draft sets out age-based access rules, safer design, AI safeguards and audits. We examine the proposed changes and their implications for products.
Indonesia’s PDPL Implementing Regulation: Key GDPR Differences
How Indonesia’s PP 33/2026 and PDPL differ from the GDPR on contracts, individual rights, processing records, breach notices and international transfers.
ChatGPT Is Now a VLOSE Under the DSA: What Changes?
The European Commission has designated ChatGPT as a very large online search engine. We explain the DSA threshold and six additional duties that follow.
California DROP Starts August 1 with Ongoing Deletion Duties
California data brokers must process DROP requests from August 1, 2026. The rules cover 45-day cycles, ongoing deletion, matching, and vendor instructions.
Privacy Alert | Vietnam’s Personal Data Protection Law (PDPL) Officially Enacted
Vietnam’s Personal Data Protection Law (PDPL), enacted in June 2025 and effective from January 1, 2026, establishes a comprehensive national framework for personal data protection, replacing the 2023 Decree No. 13/2023/NĐ-CP. Applicable to both domestic and foreign entities processing Vietnamese citizens’ or residents’ data, the PDPL introduces strict penalties (up to 10 times illegal proceeds for data trading or 5% of annual revenue for cross-border violations), a narrow “legitimate rights and interests” processing basis, and exemptions for micro-enterprises. It mandates explicit consent, data processing and transfer impact assessments (DPIA and TIA), and robust data subject rights, including access, correction, and deletion. Enterprises must implement consent mechanisms, data security measures, and compliance with data localization under the Cybersecurity Law, with specific rules for sensitive data like children’s or health information, and a 72-hour breach reporting requirement.
FTC Enforces New "Click to Cancel" Rule for Subscription Cancellations
The FTC's new “Click to Cancel” rule mandates businesses to simplify subscription cancellations, making them as straightforward as the sign-up process.
EU Releases FAQ on Data Act Clarifying IoT Data Sharing and Relationship with GDPR
On September 6, the EU published a FAQ on the Data Act, explaining its relationship with the GDPR and addressing issues related to IoT data access and business-to-business data sharing.
U.S. IoT Cybersecurity Label Takes Effect to Strengthen Device Security and Consumer Trust
On September 9, the U.S. IoT Cybersecurity Label, known as the "Cyber Trust Mark," came into effect to enhance the security of consumer IoT devices.
Singapore’s PDPC Reminds Businesses to Register Data Protection Officers by September 30, 2024
Singapore’s PDPC urges businesses to register their Data Protection Officers through the BizFile+ platform by September 30, 2024, to comply with the PDPA.
New Data Privacy Laws in Florida, Oregon, and Texas: Compliance Requirements and Implications
On July 1, new data privacy laws in Florida, Oregon, and Texas came into effect, requiring businesses to update privacy policies, conduct impact assessments, and strengthen data security measures. Companies must ensure compliance with these regulations to protect consumer privacy and avoid significant penalties.
Texas Enforces New Data Broker Law with Registration Requirement
Texas Attorney General Ken Paxton has reminded companies to register as data brokers under the newly enacted S.B. 2105 by March 1, 2024, or face penalties. The law mandates registration, public notice, and the implementation of a comprehensive information security program for entities that collect, process, or transfer personal data of Texas residents.
FCC Proposes IoT Cybersecurity Labeling Rules and National Security Measures
The Federal Communications Commission (FCC) has proposed cybersecurity labeling rules for Internet of Things (IoT) products, introducing a voluntary labeling program called the "Cyber Trust Mark" to enhance consumer transparency and data protection.
US Rep. Introduce the American Privacy Rights Act of 2024 to Establish Comprehensive Data Privacy and Security Standards
The American Privacy Rights Act (APRA) of 2024, announced by US Representative Cathy Rogers and Senator Maria Cantwell, aims to establish comprehensive national data privacy and security standards in the US.
FCC Launches Cybersecurity Labeling for IoT to Boost Consumer Trust and Compliance
The U.S. Federal Communications Commission (FCC) has approved a voluntary cybersecurity labeling program for wireless consumer IoT products. The program provides consumers with an FCC IoT label, indicating compliance with minimum cybersecurity standards.
Complete Guide to App Store Spring New Requirements
This article provides a complete guide to the new requirements for the App Store in relation to privacy manifest and signature.
Understanding the EU Data Act
The EU Data Act, which came into effect on January 11, 2024, aims to address problems in data sharing and usage. It sets clear rules for accessing, getting, and sharing data, particularly for products connected to the internet.
India Cracks Down on Digital Deception: Guidelines Target Dark Patterns in E-Commerce
India's Consumer Protection Authority introduces "Prohibition and Regulation of Dark Patterns 2023 Guidelines" to combat deceptive e-commerce practices.
