Regulators Set New Cybersecurity, Privacy and AI Priorities
Summary
A global regulatory roundup covers cybersecurity guidance, AI and data-protection oversight, DMA enforcement, alleged exposure of AI conversation metadata, and warnings about heightened cyber threats.
Key points
- The European Commission reported DMA enforcement outcomes including fines against Meta and Apple, and opened investigations into cloud services and potential competition issues.
- France’s CNIL outlined breach-response duties when a cloud subcontractor is attacked: the processor should promptly notify affected clients, while controllers assess notification and individual-notice obligations.
- Spain’s AEPD asked European data-protection authorities to examine research alleging that trackers on some AI services transmitted conversation URLs, titles, or user identifiers to third parties.
- Canada’s federal guidance on agentic AI recommends bounded permissions, human accountability, action logging, prompt-injection protections, and the ability to pause or disable agents.
- NIST reported progress on post-quantum cryptography and cybersecurity work on AI, software, hardware, and infrastructure; its migration timeline anticipates deprecating quantum-vulnerable algorithms after 2030 and requiring quantum-resistant algorithms by 2035.
- New York DFS urged regulated entities to strengthen vulnerability management, access controls, monitoring, resilience, and third-party oversight, warning that frontier AI could accelerate vulnerability discovery and exploitation.
- The OECD warned that fragmented cybersecurity regulations can increase compliance burdens and complicate cross-border incident reporting and response.
Article Details
- Event Type
- Regulatory and policy developments on cybersecurity, data protection, and AI governance, including DMA enforcement, cyber-threat guidance, and a reported study of AI conversation metadata exposure.
- Impact
- The European Commission fined Meta EUR 200 million over its consent-or-pay model and Apple EUR 500 million over App Store steering restrictions. An IMDEA Networks study reported that some AI services transmitted conversation URLs, titles, identifiers, or other metadata to third-party trackers; it described possible exposure risks, not a confirmed breach of all affected conversations. DFS issued recommendations for regulated entities facing heightened cyber threats, including risks it said frontier AI models could amplify. The CNIL subcontractor breach is an educational scenario, not a reported real incident.
People
Vendors
Alphabetin 2025. The report confirms that, by the end of 2025, seven gatekeepers remained subject to the DMA: Alphabet, Amazon, Apple, Booking, ByteDance, Meta and Microsoft, covering 23 core platform services.AmazonThe report confirms that, by the end of 2025, seven gatekeepers remained subject to the DMA: Alphabet, Amazon, Apple, Booking, ByteDance, Meta and Microsoft, covering 23 core platform services.Amazon Web ServicesOn 18 November 2025, the Commission opened two market investigations into whether Amazon Web Services and Microsoft Azure should be designated as gatekeeper services under the DMA, despite not meeting the standardAnthropicIs Leaking Your Conversations.” The study examined generative AI services, including Perplexity, Anthropic’s Claude, xAI’s Grok, and OpenAI’s ChatGPT. It reports that some services embedded third-party analyticsAppleconfirms that, by the end of 2025, seven gatekeepers remained subject to the DMA: Alphabet, Amazon, Apple, Booking, ByteDance, Meta and Microsoft, covering 23 core platform services.Bookingthat, by the end of 2025, seven gatekeepers remained subject to the DMA: Alphabet, Amazon, Apple, Booking, ByteDance, Meta and Microsoft, covering 23 core platform services.ByteDanceby the end of 2025, seven gatekeepers remained subject to the DMA: Alphabet, Amazon, Apple, Booking, ByteDance, Meta and Microsoft, covering 23 core platform services.Datadogtitles, user identifiers, email hashes, or other metadata to third parties such as Google, Meta, TikTok, Datadog, Intercom, and others.Googlechoice screens, and dropped the requirement that users create or use a Gmail account to access Google services such as Android, YouTube or Google Play.Intercomidentifiers, email hashes, or other metadata to third parties such as Google, Meta, TikTok, Datadog, Intercom, and others.Metaend of 2025, seven gatekeepers remained subject to the DMA: Alphabet, Amazon, Apple, Booking, ByteDance, Meta and Microsoft, covering 23 core platform services.Microsoftseven gatekeepers remained subject to the DMA: Alphabet, Amazon, Apple, Booking, ByteDance, Meta and Microsoft, covering 23 core platform services.Microsoft AzureNovember 2025, the Commission opened two market investigations into whether Amazon Web Services and Microsoft Azure should be designated as gatekeeper services under the DMA, despite not meeting the standardOpenAIThe study examined generative AI services, including Perplexity, Anthropic’s Claude, xAI’s Grok, and OpenAI’s ChatGPT. It reports that some services embedded third-party analytics or advertising trackers thatPerplexityYour AI Assistant Is Leaking Your Conversations.” The study examined generative AI services, including Perplexity, Anthropic’s Claude, xAI’s Grok, and OpenAI’s ChatGPT. It reports that some services embeddedTikTokpage titles, user identifiers, email hashes, or other metadata to third parties such as Google, Meta, TikTok, Datadog, Intercom, and others.xAIYour Conversations.” The study examined generative AI services, including Perplexity, Anthropic’s Claude, xAI’s Grok, and OpenAI’s ChatGPT. It reports that some services embedded third-party analytics or advertising
Products
Androidand dropped the requirement that users create or use a Gmail account to access Google services such as Android, YouTube or Google Play.App Store500 million for restrictions affecting app developers’ ability to steer users to offers outside Apple’s App Store. The Commission found that Apple’s rules prevented developers from fully informing users aboutChatGPTexamined generative AI services, including Perplexity, Anthropic’s Claude, xAI’s Grok, and OpenAI’s ChatGPT. It reports that some services embedded third-party analytics or advertising trackers that transmittedClaudeLeaking Your Conversations.” The study examined generative AI services, including Perplexity, Anthropic’s Claude, xAI’s Grok, and OpenAI’s ChatGPT. It reports that some services embedded third-party analytics orFacebookdecision against Meta under Article 5(2) DMA in relation to its “consent or pay” model for Facebook and Instagram. The Commission found that Meta’s model did not give users the required option to choose aGoogle Playthat users create or use a Gmail account to access Google services such as Android, YouTube or Google Play.GrokConversations.” The study examined generative AI services, including Perplexity, Anthropic’s Claude, xAI’s Grok, and OpenAI’s ChatGPT. It reports that some services embedded third-party analytics or advertisingInstagramdecision against Meta under Article 5(2) DMA in relation to its “consent or pay” model for Facebook and Instagram. The Commission found that Meta’s model did not give users the required option to choose a lessiOSApple’s obligations under Article 6(7) DMA. These decisions set conditions for interoperability between iOS and connected devices such as smartwatches, headphones and other wearables, and also set rules for Apple’sMicrosoft WindowsApple applications, including Safari and the App Store, to be uninstalled. Microsoft changed Windows-related settings to make it easier for users to set and use a default browser. Alphabet continued to rollPerplexityYour AI Assistant Is Leaking Your Conversations.” The study examined generative AI services, including Perplexity, Anthropic’s Claude, xAI’s Grok, and OpenAI’s ChatGPT. It reports that some services embeddedSafarieasier to change default settings on iOS, and allowed certain pre-installed Apple applications, including Safari and the App Store, to be uninstalled. Microsoft changed Windows-related settings to make it easier forYouTubethe requirement that users create or use a Gmail account to access Google services such as Android, YouTube or Google Play.
Tools
Countries
Canada🇨🇦 Canada Issues Guidance on Agentic AI Use in Federal GovernmentDenmarkOn 21–22 May 2026, the data protection authorities of Denmark, the Faroe Islands, Finland, Iceland, Norway, Åland, and Sweden met in Stockholm for their annual Nordic Meeting and signed the Stockholm Declaration. TheFinlandOn 21–22 May 2026, the data protection authorities of Denmark, the Faroe Islands, Finland, Iceland, Norway, Åland, and Sweden met in Stockholm for their annual Nordic Meeting and signed the Stockholm Declaration. TheFranceIcelandOn 21–22 May 2026, the data protection authorities of Denmark, the Faroe Islands, Finland, Iceland, Norway, Åland, and Sweden met in Stockholm for their annual Nordic Meeting and signed the Stockholm Declaration. TheNorwayOn 21–22 May 2026, the data protection authorities of Denmark, the Faroe Islands, Finland, Iceland, Norway, Åland, and Sweden met in Stockholm for their annual Nordic Meeting and signed the Stockholm Declaration. TheSpain🇪🇸 Spain Approves Draft Organic Law on AI Governance and Human OversightSweden2026, the data protection authorities of Denmark, the Faroe Islands, Finland, Iceland, Norway, Åland, and Sweden met in Stockholm for their annual Nordic Meeting and signed the Stockholm Declaration. The NordicUnited KingdomUnited StatesThe OECD maps several existing efforts to improve coherence. At the domestic level, the United States has used instruments such as the NIST Cybersecurity Framework and federal cyber incident reporting reforms to reduce
Industries
Artificial intelligenceSpain’s Council of Ministers approved the draft Organic Law on the proper use and governance of artificial intelligence, sending it to the Congress of Deputies. The bill is intended to adapt Spanish law to the EU AICloud Computingthe DMA’s existing obligations are effective in addressing unfair or anti-contestable practices in cloud computing. The investigation covers issues such as interoperability obstacles, restricted access to data, tyingFinancial ServicesOn 21 May 2026, the New York State Department of Financial Services (“DFS”) issued two related industry letters for entities regulated under DFS supervision. The first sets out measures that regulated entities shouldHealthcareTelecommunicationsCommissioner of Canada (OPC), the Copyright Board of Canada, and the Canadian Radio-television and Telecommunications Commission (CRTC).