PrivacySignal
GDPR / Intl

EDPS Annual Report 2025: protecting people in a changing digital world

EDPS · · EU · GDPR & International

The European Data Protection Supervisor has published its Annual Report for 2025, covering a year the agency describes as focused on expanding its operational mandate across monitoring, enforcement, and advisory roles. The report is accompanied by an executive summary, a supervisory speech, and a press conference.

Why this matters: The EDPS is the watchdog for EU institutions — it oversees how bodies like the European Commission, Europol, and eu-LISA handle personal data. What it does, or does not do, shapes privacy standards across the bloc. Annual reports like this one are a paper trail. They show which institutions got scrutinized, which new powers the agency took on, and where it chose to act or hold back. If you want to know whether European data protection is getting stronger or softer in practice, this is one of the documents worth reading past the press release.

Who should care: Lawyers · Privacy officers · AI governance

This summary is AI-assisted and may contain errors. It is an original briefing to help you gauge significance quickly — not a reproduction of the source. Always read the linked original before relying on it. See our methodology.

Analysis

All analysis →

Weekly Editorial Analysis from Experts and Editors

Logged Is Not Authorized

Georgia law restricts police use of license plate data to law enforcement purposes. A new lawsuit alleges deputies searched a man's vehicle five times while he was suing their sheriff. Two recorded reasons were "info" and "37." The system accepted both.

· 6 min read Read →
Deep Signal · Part I of III

The Algorithm Said So

Federal rulemakers are deciding what to do when artificial intelligence produces the kind of conclusion that once required an expert. They disagree about how to regulate it. They also disagree about whether the problem has arrived.

· 10 min read Read →

Related stories

GDPR / Intl
EDPS · · EU

New episode of Newsletter Digest

The European Data Protection Supervisor released a newsletter digest episode covering data protection and digital policy developments from October, which coincided with European Cybersecurity Month.

Who should care: Lawyers · Privacy officers · AI governance · General readers · Policy

#gdpr#privacy Read original →
GDPR / Intl
Inside Privacy (Covington) · · International

CPPA Proposes Amendments to Opt-Out Preference Signal Regulations

California's privacy agency has proposed amendments to CCPA regulations on opt-out preference signals, explicitly naming the Global Privacy Control as a signal that businesses engaged in selling or sharing personal data are required to honor.

Who should care: Lawyers · Privacy officers · Compliance · General readers · Policy

#state-privacy#regulation#privacy Read original →
GDPR / Intl
EPIC · · US Federal

EPIC Comments to EDPB on Guidelines on Web Scraping for AI: Go Further

EPIC submitted comments to the European Data Protection Board urging it to strengthen its draft guidelines on web scraping for AI, arguing the current framework does not go far enough to protect personal data collected from the web.

Who should care: Lawyers · Privacy officers · AI governance · General readers · Policy

#gdpr#ai#privacy Read original →
GDPR / Intl
M Minnesota Attorney General's Office · · International

Attorney General Ellison wins $7.1M from General Motors for sharing drivers’ private data

Minnesota Attorney General Keith Ellison secured a $7.1 million settlement from General Motors over the automaker's sharing of drivers' private data. The action follows scrutiny of how GM collected and distributed sensitive driver information without adequate consent.

Who should care: Lawyers · Privacy officers · Compliance

#state-privacy Read original →
GDPR / Intl
ICO · · UK

ICO statement on Highly Effective Age Assurance

The UK's Information Commissioner's Office has issued a statement on highly effective age assurance, addressing standards or expectations around how online services verify users' ages. The ICO is the UK's data protection regulator and its statements carry significant weight for how platforms must operate.

Who should care: Lawyers · Privacy officers · AI governance