International
Children’s privacy regulations globally are shifting away from notice-and-consent models toward outright access restrictions, age-appropriate design mandates, categorical advertising prohibitions, and app-store-level age verification, as illustrated by Australia’s December 2025 enforcement of its under-16 social media ban. In the United States, similar legislative efforts have faced significant First Amendment challenges that have stalled most state laws restricting minor access to social media and AI platforms, while age-appropriate design requirements inspired by California’s law have been enacted in several states. Several states, including Oregon, have enacted categorical bans on targeted advertising to known minors, while app-store-level age verification laws imposing age-signal obligations on app developers are also subject to active litigation. Companies operating consumer-facing digital services should map where minors interact with their products, review advertising practices involving teens, and prepare for the eventual downstream effects of age-signal regimes.
Since August 2, 2026, organizations have been subject to the transparency obligations set out in Article 50 of the EU AI Act. Article 50 introduces transparency requirements for providers and deployers in relation to certain AI system functionalities and use cases that may create transparency risks for individuals. Whilst much of the EU AI Act focusses on obligations on high-risk AI systems, Article 50 obligations may also apply to certain limited-risk systems. As a result, many organizations need to implement governance, disclosure, and content-labelling measures to ensure users are appropriately informed about the use of certain AI systems and AI-generated content.
Importantly, these obligations were largely unaffected by the implementation delays contained in the Digital Omnibus on AI (Regulation (EU) 2026/1744), except for the marking obligations contained in Article 50(2) of the EU AI Act, i.e. relating to AI systems that generate synthetic audio, image, video, or text content and that were placed on the market before August 2, 2026. Following the agreement reached between the Council and the European Parliament on May 7, 2026 (see the European Parliament procedure record), and formally adopted on June 29, 2026, the introduction of these marking obligations has been delayed until December 2, 2026.
On July 7, 2026, the European Data Protection Board (the “EDPB”) released draft Guidelines 02/2026 on Anonymisation. Once final, these guidelines will replace the former Article 29 Working Party’s Opinion 05/2014 on Anonymisation Techniques and reset how companies decide whether data has been anonymised sufficiently to fall outside the EU’s General Data Protection Regulation. The draft adopts a “relative” view of identifiability, following the EU Court of Justice’s decision in EDPS v. SRB: whether data counts as personal depends on who holds it and what that holder could realistically do to re-identify someone. The same dataset can therefore be personal data in one company’s hands and anonymous in another’s.
For a startup, this matters most where anonymised data is doing real work, such as training or fine-tuning AI models, sharing research datasets with partners, or building analytics products. Labelling data “anonymised” is not a one-time conclusion; it depends on context, recipient, and available re-identification tools. The guidelines are in draft form and open for public consultation until October 30, 2026, after which the EDPB will consider feedback and adopt a final version.
The Court of Justice of the European Union has clarified whether a health-related product counts as a “medical device” in the EU, which determines whether the heavy compliance obligations of the Medical Devices Regulation apply. In Case C-427/24, Diagramm Halbach, the Court held that the analysis has two parts: what the manufacturer says the product is for, drawn from labeling, instructions, and marketing, and whether the product objectively performs one of the specific medical functions the regulation lists, such as diagnosis, monitoring, or treatment of disease. Marketing claims should not be considered in isolation and may not pull a product into the regime if it does not actually perform a medical function, and equally a company cannot avoid the rules by staying quiet about an obvious medical use. For founders building software or AI-enabled health tools, the ruling sharpens the line between administrative or organizational features and functions that genuinely inform clinical decisions, and that distinction determines whether CE marking and conformity assessment are required before selling in the EU.
On April 15, 2026, the European Data Protection Board (EDPB) published its long-awaited draft Guidelines 1/2026 on the processing of personal data for scientific research purposes (the Guidelines), marking the most comprehensive regulatory statement to date on how the GDPR applies to scientific research activities.
For organizations in the life sciences sector, the Guidelines address long-standing areas of uncertainty — particularly around secondary use of data, broad consent, and transparency obligations — while signaling a clear shift toward stricter expectations on governance, purpose limitation, and accountability. The EDPB’s objective is clear: to promote a more consistent and workable framework across the EU, while maintaining robust safeguards. The public consultation closed on June 25, 2026, and the Guidelines remain in draft pending adoption of a final version.
England’s High Court has issued the UK’s first ruling in a copyright fight against an AI developer with an outcome that favors the AI industry. In Getty Images v. Stability AI, Getty (which licenses photos and video) alleged that Stability scraped millions of its images to train the Stable Diffusion image generator. During trial Getty dropped its main copyright claim because it could not show the training actually happened in the UK. Copyright is territorial, so no act in the UK means no UK infringement.
That left a narrower question: whether importing the already-trained model into the UK made it an “infringing copy” under the Copyright, Designs and Patents Act 1988. The court said no. A model’s weights are just numbers derived from statistics; they do not store or contain the underlying images, so supplying the model is not secondary infringement. Getty won only on a historic and limited trademark point about its marks appearing in outputs. The decision settles little about whether UK-based training would infringe, and Getty may appeal.
The UK’s Medicines and Healthcare products Regulatory Agency moved on several fronts in the first half of 2026, with the intention of developing a more innovation-friendly and AI-aware regime. The developments include a landmark program deepening regulatory cooperation between the UK and the United States, a regulatory “sandbox” for AI used as a medical device, meaning a supervised space where companies can test products with the regulator before full authorization, an evidence-gathering exercise on how AI in healthcare should be regulated, a consultation on a draft Rare Disease Therapies Regulatory Framework, and the largest package of UK clinical trial reforms in more than twenty years. For a founder building AI-enabled diagnostics, software, or therapeutics, this changes both the route to market and its timing: earlier regulator engagement is becoming possible, trial rules are being streamlined, and closer UK-US alignment may reduce duplicated work across the two markets.
On July 7, 2026, the European Data Protection Board published draft guidelines on web scraping for generative AI, aimed at giving practical guidance on how EU data protection law applies when personal information is pulled from the open internet to train models. The guidelines cover both organizations that do the scraping themselves, directly or through a contractor, and organizations that license or reuse datasets someone else already scraped. For any company buying a generative AI system trained on internet-sourced data, the guidelines, as drafted, do not shift the data protection responsibility away from the buyer. The EDPB’s public consultation on the draft remains open until October 30, 2026, so the text can still change before it is finalized.