Usercentrics blog

The EU’s Digital Omnibus is two separate files. The AI Omnibus, which postponed AI Act high-risk deadlines, became Regulation (EU) 2026/1744 in July 2026. The Data Omnibus (GDPR, ePrivacy, NIS2, DORA) is still in negotiation: the Council agreed its mandate on 21 October 2026, but the Parliament has not adopted a position, and nothing in it is law.

The Commission’s Digital Omnibus proposal aims to simplify EU privacy rules without weakening user choice. The Council agreed its negotiating position on 21 October 2026, but the Parliament has not adopted its own, and nothing is law yet. For businesses, consent and CMPs remain essential.

The EU’s Digital Omnibus proposal could reshape GDPR obligations, from redefining personal data and simplifying cookie consent to easing DSAR burdens and streamlining breach reporting. The Council agreed its negotiating position on 21 October 2026, but nothing is law yet. Here’s what the proposed changes mean for your compliance approach and how to stay prepared as the package evolves.

Canada’s data privacy law has been active since 2000, through big changes in digital markets and business and personal reliance on the internet. PIPEDA has been updated multiple times, and is again due for an overhaul. Learn about PIPEDA compliance requirements, the 10 Fair Information Principles, how PIPEDA compares with the GDPR, and the OPC’s new Children’s Privacy Code.

Four August 2026 court decisions on the California Invasion of Privacy Act (CIPA) show courts reading cookie banners and privacy policies together, then comparing both with what a website actually does. Where the three diverge, consent arguments may weaken. This article summarizes the decisions, sets out what courts now appear to expect, and outlines practical steps for privacy and legal teams.

The UK’s Data (Use and Access) Act 2025 (DUAA) is now in force, with most provisions commenced on February 5, 2026, the complaints requirement on June 19, 2026, and the ICO’s governance reforms on September 30, 2026. This guide covers the key privacy compliance changes for businesses. Those include the new recognised legitimate interests lawful basis, updated cookie and PECR rules, automated decision-making reform, expanded ICO enforcement powers, and fines now aligned with UK GDPR levels of up to four percent of global annual turnover.

Managing Google Tag Manager cookie consent and GDPR compliance is important for businesses operating in the EU, UK, and Switzerland. Here’s what you need to know about Google Tag Manager, cookie consent, and the GDPR.

Enforcement of data privacy regulations is ramping up in the United States as more such laws come into force. We look at six class action lawsuits filed in California and dig into the alleged violations, how consent management was involved, and how companies can achieve better data and privacy compliance.

There are exciting opportunities ahead for web developers who adapt to the Digital Markets Act (DMA). Learn about the role of web developers in enabling DMA compliance for clients, and how Usercentrics can equip you with the tools and resources you need.

Originally a 1967 wiretapping law, CIPA is now central to a surge of U.S. privacy litigation targeting websites that deploy cookies, pixels, and session replay tools without prior user consent. We look at CIPA’s legal framework, key sections, how it differs from the CCPA, compliance, penalties, and how a consent management platform can reduce exposure.