The Cyberbeveiligingswet took force on 15 August 2026. Registration and breach reporting bind immediately; only the security-measure deadline runs 9 to 10 months out. Here is the real clock.
Germany's Bundeskartellamt has closed its four-year case against Apple's tracking framework with binding commitments. Apple must redesign iOS consent prompts within four months.
Apple cut its EU Core Technology Fee to a flat 5% commission, effective October 1, 2026. Here is what changed, why it matters, and what EU app businesses should do now.
Apple ended its three-year fee fight with Brussels on August 18, 2026. From October 1, every EU app publisher pays one of three flat rates instead of the old fee maze. Here is what to recalculate before the deadline.
Google paid $10 million in Spirit Airlines' bankruptcy for 100 million staff emails and HR records. The passenger data was protected. The employee data was not - and that gap is bigger in the US than it would be under GDPR.
Germany's antitrust regulator ruled Apple's own tracking-consent prompt was designed more favorably than the one it forces on other apps. Apple has four months to fix it, EU-wide.
The EU Right to Repair Directive became applicable on July 31, 2026, but there is no single text to comply with: 27 separate national laws carry it, with Croatia, Lithuania, Slovakia and Finland registered early and Germany passing its own version just five weeks before the deadline. A company's 'EU compliant' repair claim depends on which of the 27 it is actually built against.
France's Constitutional Council struck down the under-15 social media ban on August 14, 2026, citing two specific, fixable defects. France is also piloting the EU's own privacy-preserving age-verification app, built to fix exactly the gap the court cited.
Brussels cleared PIF's $55 billion take-private of Electronic Arts under merger rules and, eight days later, under the Foreign Subsidies Regulation. Neither filing mentions that PIF already owns the world's leading esports tournament operator.
The UK Supreme Court ruled 3-2 on July 27 that Bahrain cannot claim state immunity for a 2011 FinSpy hack of London-based activists. The spyware itself was built by a UK company.
The EU's top court ruled that geo-blocking only needs to be state-of-the-art, not VPN-proof. The case was about Anne Frank's diary. The consequence is a compliance bar that keeps moving.
The UK Supreme Court's July 27 ruling in Tesla v InterDigital revived a FRAND challenge to patent-pool pricing. The real precedent reaches every UK-patent SEP licensee, not just automakers.
Page 1 / 6
One considered note on infrastructure, governance, and measurement, most mornings. No theory.