Usercentrics blog

The EU AI Act was adopted in March 2024, making it the world’s first comprehensive AI regulation. In March 2026, the European Parliament also approved the EU’s signature of the Council of Europe’s Framework Convention on Artificial Intelligence — the first legally binding international AI treaty. Usercentrics examines what these regulations include, who they affect, and what they mean for data privacy compliance.

Compliance with the Children’s Online Privacy Protection Act (COPPA) is required for any business handling the personal information of children under age 13 in the United States. This article discloses the key provisions of COPPA to help organizations take the necessary steps to achieve and maintain compliance and build trust with families.

The Children’s Online Privacy Protection Act (COPPA) is a U.S. federal law protecting the personal information of children under 13 online. This overview covers how COPPA defines personal information, who must comply, parental consent requirements, enforcement, and the FTC’s 2025 Rule amendments, the first major update to COPPA’s regulations in over a decade.

Collecting personally identifiable Information (PII) from users is the backbone of data analytics in most organizations. Depending on the business purpose, PII ranging from email addresses to health records can help deliver services, build relationships, and enable more personalized experiences. This guide provides a PII compliance checklist to help you protect user data and avoid regulatory fines from global data privacy regulations.

Usercentrics is opening its North American headquarters in New York City, marking a major step in its U.S. expansion. Already trusted by 2.4 million websites worldwide, the global consent and data privacy leader is now bringing its full suite — spanning cookie consent, server-side tracking, AI governance, and audience activation — to U.S. marketers and enterprises.

Every organization collects data. Far fewer have clear answers to the questions that follow: who’s responsible for it, what it can be used for, how long it should be kept, and what happens when something goes wrong. Data governance principles provide those answers, written down and enforced.

The General Data Protection Regulation has changed how organizations approach data processing, but one lawful basis continues to create challenges: legitimate interest. As the most flexible basis, and often also the most heavily scrutinized under Article 6(1)(f), it gives organizations room to process data while also requiring careful justification.

Using personal data in AI systems triggers GDPR protections and obligations. This guide breaks down what counts as processing, where risks exist, and how to build practical privacy and consent compliance into data collection, training, deployment, and governance.