The roundup is produced by Digital Policy Alert, an independent repository of policy changes affecting the digital economy. If you have feedback or questions, please contact Maria Buza.

Overview. The roundup serves as a guide for navigating global digital policy based on the work of the Digital Policy Alert. To ensure trust, every finding links to the Digital Policy Alert entry with the official government source. The full Digital Policy Alert dataset is available for you to access, filter, and download. To stay updated, Digital Policy Alert also offers a customizable notification service that provides free updates on your areas of interest. Digital Policy Alert’s tools further allow you to navigate, compare, and chat with the legal text of AI rules across the globe.

Drawing from Digital Policy Alert’s daily monitoring of developments in the G20 countries, it summarizes the highlights of August 2026 in four core areas of digital policy.

• Content moderation, including the European Commission’s designation of ChatGPT as a very large online search engine and Reddit and Roblox as very large online platforms under the Digital Services Act, the French Constitutional Council’s decision finding unconstitutional provisions of a bill restricting social media access for children under 15, Brazil’s enforcement actions concerning Discord’s compliance with child-safety obligations, and United Kingdom Ofcom’s expansion of its investigations into Chat-Avenue and Teen-Chat.
• AI regulation, including the entry into force of the EU AI Act's transparency rules and the AI Office's enforcement powers over general-purpose AI models, South Korea's adoption of AI Ethics Principles, Saudi Arabia's approval of the International Centre for Artificial Intelligence Research and Ethics, and Turkey's AI Action Plan.
• Competition policy, including the European Commission's approval of six digital infrastructure and technology mergers, Germany's Federal Cartel Office closing its investigation into Apple's App Tracking Transparency Framework, and Turkey's Competition Authority approving the Warner Bros. Discovery-Paramount Skydance acquisition.
• Data governance, including Brazil's National Data Protection Authority fine of R$ 153.7 million against ByteDance's TikTok, China's consultation on Regulations on Protection of Personal Information by Large-Scale Personal Information Processors, Japan's administrative guidance to KDDI following a breach affecting 12.2 million people, and Canada's Federal Court application against Google over search de-listing obligations.

Content moderation

Europe

The European Commission designated ChatGPT as a very large online search engine under the Digital Services Act (DSA), classifying it as a hybrid search service because it can respond to user queries by searching the web. At the same time, Reddit and Roblox were designated as very large online platforms, as they enable users to disseminate third-party content to the public. As a result, the three services must comply with the DSA's additional obligations by the end of January 2027. These include assessing and mitigating systemic risks posed by illegal content, protecting minors, safeguarding users' physical and mental well-being, upholding fundamental rights, ensuring the integrity of electoral processes, and maintaining public security.

At the member state level in Austria, a bill was introduced in the Austrian National Council to establish a blocking regime for prohibited online gambling offers, with fines of up to €1 million. A bill regulating digital commercial influence was introduced to Belgium's Parliament, which would require hosting providers to operate illegal-content reporting mechanisms, publish transparency reports, prioritize notices from trusted flaggers, and comply with new consumer-protection and fair-marketing obligations. Regarding enforcement in Hungary, the Competition Authority fined the e-commerce platform eMAG HUF 225 million for failing to fulfill earlier commitments to support Hungarian businesses.

The French Constitutional Council found the provisions of the bill banning minors under 15 from accessing social media unconstitutional. The Council held that the ban was disproportionate to its objective of protecting minors and that the age-verification requirement lacked sufficient legal safeguards for the processing of personal data.

In Italy, the Communications Regulatory Authority's supplementary guidelines on communication campaigns against gambling disorders entered into force. The guidelines establish rules for advertising across digital channels, including short-form social media videos and automated messages to registered players, and distinguish responsible gambling communications from prohibited promotional advertising.

In Russia, a bill requiring the labeling of content generated or modified using large foundation AI models was introduced in the State Duma. If adopted, the Government would subsequently determine the format, content, and procedure for applying the labels.

In Turkey, amendments to the Commercial Advertising and Unfair Commercial Practices Regulation entered into force, expanding the existing rules to cover advertising by social media influencers and consumer reviews. The amendments introduce disclosure requirements for AI-generated advertisements, require influencer advertisements to be clearly labeled, and prohibit profiling-based targeted advertising directed at children and AI-generated deepfake endorsements.

The United Kingdom Parliament's Culture, Media and Sport Committee requested information from Snap, Meta, YouTube and TikTok on their practices for identifying and removing dangerous driving content. The platforms were asked to provide data on UK-originated content, views, removals, detection methods and barriers to faster removal.

Furthermore, the Office of Communications (Ofcom) issued a notice to online services clarifying that existing child-safety and illegal-content duties under the Online Safety Act remain in force alongside the Government’s plans to ban social media use by children under 16. Ofcom stated that the proposed ban would not replace or suspend these obligations and confirmed that it would continue to oversee compliance. Finally, Ofcom expanded its investigations into the providers of Chat-Avenue and Teen-Chat over the reporting of child sexual exploitation and abuse content.

Asia and Australia

Australia's Interactive Gambling Amendment (Gambling Reform) Bill received royal assent, covering content moderation authority governance, content moderation regulation, fair-marketing requirements, and age-verification requirements for wagering advertising. The Bill restricts advertising across television, radio, online and sports venues, establishes a global opt-out register for gambling advertisements and limits direct marketing to certain categories of users. Parliament also adopted the News Media Bargaining Charge Bill 2026, imposing a 2.75% charge on large platforms' Australian digital advertising revenue, with the companion News Media Bargaining (Administration) Bill and Treasury Laws Amendment (News Media Bargaining) (Consequential) Bill introduced to the House of Representatives.

Regarding enforcement, the eSafety Commissioner accepted an enforceable undertaking from Roblox, requiring tools to prevent adult-child contact without consent, restricting forum posting for unverified users, making private profiles the default, and improving reporting mechanisms.

China's Cyberspace Administration closed consultation on the Anti-Cyber Violence Law, covering content moderation regulation, content moderation authority governance, and user rights, which would require platforms to establish monitoring and rumor-refutation mechanisms for cyberbullying. The State Administration for Market Regulation and Ministry of Commerce also closed consultation on amendments to the E-commerce Law, covering content moderation regulation and content moderation authority governance.

In India, the Securities and Exchange Board opened a consultation on a revised Advertisement Code for Online Bond Platform Providers, and the Ministry of Road Transport and Highways issued a directive on voluntary tipping-feature compliance, prohibiting misleading prompts suggesting that payment improves ride confirmation or driver acceptance.

Regarding enforcement, the Central Consumer Protection Authority fined Flipkart ₹5 lakh for unfair trade practices, and the Delhi High Court ordered stakeholders to convene on OTT accessibility for persons with disabilities.

Regarding enforcement in Indonesia, the Ministry of Communication and Digital Affairs investigated Meta over WhatsApp account deactivations and requested accelerated account recovery, and separately demanded the delisting of Hornet from app stores over the dating app's association with LGBTIQ+ content and its failure to register as an electronic system provider.

Japan's Ministry of Economy, Trade and Industry, together with several other ministries, requested that X Corp, TikTok, Meta, LINE Yahoo, and Google strengthen measures against deepfake-enabled impersonation-fraud advertisements, including implementing advertiser identity verification, transparency measures, and removal procedures for impersonation fraud advertisements, with implementation reports due by October 16.

In South Korea, a bill amending the Network Act to prohibit fraudulent manipulation of search rankings and reviews was introduced to the National Assembly.

Americas

In Brazil, the National Data Protection Authority (ANPD) adopted an order requiring digital platforms with over 1 million users under 18 to publish their first semi-annual transparency report by mid September 2026. The reports must cover content moderation, complaints, child-data protection, parental consent, and safety and risk assessments.

Regarding enforcement, several authorities advanced cases against Discord over child-safety compliance. The ANPD opened investigations into the platform's age-assurance mechanisms and its handling of self-harm and suicide-related content, and ordered it to suspend live-streaming functionality. The Federal Public Prosecutor's Office separately opened proceedings to examine Discord's age-verification mechanisms and content moderation practices. At the same time, the Federal Attorney General's Office filed a lawsuit seeking R$ 500 million in damages. Additionally, the ANPD notified Google Play Store, App Store, Copilot, Claude, DeepSeek, Gemini, ChatGPT, Meta AI and Perplexity that it would begin monitoring their safeguards against the generation, editing or manipulation of non-consensual intimate content. The companies must respond within 10 working days to questions concerning the filters, blocking mechanisms and detection systems they employ to prevent or identify such content. Finally, ANPD approved ByteDance’s compliance plan for TikTok concerning the processing of minors’ data and directed further monitoring of the processing of advertising and device identifiers as part of its supervision of the plan.

Artificial Intelligence

Europe

In the European Union, the AI Act’s transparency rules entered into force, requiring certain AI systems, including chatbots and other interactive systems, to inform users when they are interacting with AI and when content has been generated or altered by AI. AI-generated or manipulated images, videos and audio must be labeled and include machine-readable markings to facilitate detection. The AI Office’s powers to supervise and enforce obligations on providers of general-purpose AI models also became applicable. Following amendments introduced by the Digital Omnibus on AI Regulation, the AI Office has exclusive competence over AI systems where the model and system are developed by the same provider, as well as where the system provider is part of the same undertaking as the general-purpose AI model provider. At the member state level, Poland and Hungary implemented legislation designating AI market surveillance authorities.

Germany's Federal Office for Information Security consulted on its AI Audit and Assurance Assessment Architecture, a modular audit framework intended to support compliance with the AI Act and Cyber Resilience Act.

The President of Turkey signed a circular bringing the AI Action Plan 2026–2030 into force, establishing four strategic axes and 16 priority actions. The plan establishes the National Artificial Intelligence Board as the main coordination body and provides for sector-specific supervision, technical security assessments, and a separate ethics board. It also introduces risk-based requirements, including impact assessments and model cards for high-impact AI systems, as well as regulatory sandboxes in at least five priority sectors.

Asia and Australia

In Australia, the Prudential Regulation Authority and Securities and Investments Commission issued joint guidance on frontier AI resilience for financial entities. Further, the Department of Industry, Science and Resources published a report on risks and controls for multi-agent systems, and South Australia announced a Royal Commission into artificial intelligence policy and regulation. Additionally, Australia and Vietnam adopted a joint statement on science, technology, and innovation connectivity, including a memorandum of understanding on digital economy cooperation and the ongoing development of bilateral guidelines for responsible AI use.

China's National Cybersecurity Standardization Technical Committee consulted on AI Browser Security Practice Guidelines and AI agent interaction security requirements. The Committee separately opened a consultation on a national standard for the cybersecurity of government information systems covering AI procurement. Furthermore, China and Indonesia established a working group for AI cooperation and technology transfer, covering AI development, technology transfer, and critical minerals for semiconductor production.

Japan's Cabinet Office presented the final draft of a Principle Code on intellectual property protection and transparency for generative AI, requiring developers to disclose training methods and respond to rights-holder inquiries on a comply-or-explain basis.

Saudi Arabia's King approved the Basic Statute of the International Centre for Artificial Intelligence Research and Ethics, tasked with supporting AI research and development, promoting awareness of AI ethics, providing recommendations, and building capacity in AI research and ethics across UNESCO member states. The National Cybersecurity Authority closed consultation on draft AI Cybersecurity Guidelines covering recommendations for generative and agentic AI systems across all lifecycle stages, and addressing governance, defense, resilience, and third-party cybersecurity risks.

In South Korea, the National Assembly adopted a bill amending the Personal Information Protection Act to permit the use of lawfully collected personal data for AI development subject to Commission oversight, and a bill amending the AI Basic Act to establish designation and management systems for high-risk AI models was introduced to the National Assembly. Further, the Government adopted Artificial Intelligence Ethics Principles, establishing guidelines for AI providers and users covering human-centeredness, privacy protection, fairness, accountability, safety, reliability, and transparency.

Americas

In Argentina, a bill was introduced in the Chamber of Deputies that would require a prominent AI identification label and, during electoral periods, platforms to detect and remove prohibited AI-generated content. The bill would also grant individuals digital likeness rights.

Competition

Europe

The European Commission approved six digital infrastructure and technology mergers without conditions. These included the creation of an AI data center joint venture by ACS AIID, Telefónica, Banco Santander and SETT, the acquisition of Ebury Partners by Centerbridge and Santander, the acquisition of Randstad’s Digital Solutions Business by LTM, the linked acquisitions of Telenor Connexion and BLDNG.ai by Verdane, the acquisition of data center operator atNorth by CPPIB and Equinix, and the creation of a data center joint venture by Khazna and Eni. The Commission also closed a consultation as part of its evaluation of the Regulation on markets in crypto-assets.

At the member state level, the Austrian Federal Competition Authority opened an investigation into online food delivery platforms following a sector inquiry that identified potentially anti-competitive practices. The Dutch Competition Council approved Uber's merger with Dantaxi subject to commitments to divest part of Dantaxi's business, and found that Wolt abused its dominant position and referred the case to court for a fine. Finally, the Netherlands Authority for Consumers and Markets issued a draft decision to make Bol’s commitments on self-preferencing and the use of seller data binding, following an investigation into its buy-box algorithm.

The French Directorate General for Competition, Consumer Affairs and Fraud Prevention fined the online retailer Boohoo €2.33 million over deceptive pricing practices.

Germany's Federal Government submitted a draft bill to amend the Act Against Restraints of Competition to raise the merger-control turnover thresholds by 14-50% and widen the broadcaster cooperation exemption from the cartel prohibition. Regarding enforcement, the Federal Cartel Office approved Apple’s commitments on its App Tracking Transparency Framework and closed the proceedings. Apple will harmonize consent dialogues for its own and third-party apps, remove differences in wording and design, and simplify consent requests for third-party providers. The commitments apply for seven years and will be implemented within four months under trustee monitoring. Additionally, the Federal Financial Supervisory Authority fined Wise €16,000 over fee-transparency violations.

In Italy, the Competition Authority consulted on clauses in Perplexity AI’s Terms of Service, including provisions on changes to prices and services, liability limitations, account suspension and mandatory arbitration. Further, the Authority approved the acquisition of a 51% stake in PagoPA by Istituto Poligrafico e Zecca dello Stato, subject to governance conditions preventing informational advantages for co-owner Poste Italiane.

In Turkey, a bill to regulate the foreign digital accommodation platforms was introduced in the Grand National Assembly. The bill would cap platform commission fees at 17%, restrict ranking-based retaliation against service providers, and require platforms to register and appoint a representative. It would also establish procedures for blocking non-compliant platforms. Furthermore, regarding enforcement, the Competition Authority approved the acquisition of Warner Bros. Discovery by Paramount Skydance subject to film-licensing and distribution commitments specific to the Turkish market.

The United Kingdom Government announced plans to conduct a consultation and issue policies regarding potentially misleading pricing practices, including the use of previous prices, discounts, and recommended retail prices. It will consider whether such practices should be prohibited under the Digital Markets, Competition and Consumers Act. Regarding enforcement, the Competition and Markets Authority approved the anticipated acquisition of Warner Bros. Discovery by Paramount Skydance, finding no realistic prospect of a substantial lessening of competition, and opened investigations into Virgin Atlantic and Trainline over alleged drip pricing.

Asia and Australia

Regarding enforcement in Australia, the Competition and Consumer Commission closed consultation on its draft determination authorizing the Google-Epic Games app store settlement, which would cap Google Play service fees at 10-20% depending on transaction type and alternative payment option provisions, with implementation required by September 30 2026. Separately, the Federal Court found that eHarmony engaged in misleading conduct on pricing, renewal, and cancellation.

In China, the Ministry of Justice determined that the EU's foreign subsidies investigation into JD constituted improper extraterritorial jurisdiction, and prohibited Chinese entities from assisting its enforcement.

Japan's Fair Trade Commission closed consultation on amendments to its merger-review guidelines, expanding the horizontal-merger framework to platform and multi-sided markets and addressing data foreclosure in vertical mergers.

Regarding enforcement in South Korea, the Fair Trade Commission announced an inquiry into transaction practices between major online platforms and vendors in the delivery, open-market, and accommodation sectors, citing a 330% rise in related disputes since 2021.

Americas

In Brazil, the Tribunal of the Administrative Council for Economic Defense (CADE) partially accepted Itaú Unibanco’s request to clarify an earlier decision. CADE confirmed that Itaú had 30 days to comply with the required changes, including explaining transaction refusals to customers and digital wallet providers. It also clarified that failure to comply would result in a daily fine of R$ 250, 000, rather than a fine for each refused transaction.

Africa

In South Africa, the Competition Commission opened a consultation on the Association of Comms and Technology's exemption application to allow mobile operators to coordinate infrastructure planning in underserved areas. Additionally, the Competition Commission approved the acquisition of NCR Atleos by The Brink's Company without conditions, and recommended conditional approval of Capitec Bank's acquisition of Walletdoc, subject to third-party access commitments for Capitec Pay.

Data governance

Europe

In Germany, a bill amending the Federal Data Protection Act was introduced to Parliament, institutionalizing the Data Protection Conference with binding resolution powers and a "one-for-all" principle to avoid duplicate supervisory reviews. The Federal Commissioner for Data Protection separately adopted a declaration on the EU-wide cookie-consent management rules introduced by the Digital Omnibus.

In Italy, the Data Protection Authority issued a warning to RTI Spa and prohibited its further use of a journalist’s personal data in AI-generated deepfake videos. The Authority found that the videos attributed fabricated statements to the journalist without clearly indicating that they had been artificially generated. The prohibition took immediate effect.

In the United Kingdom, the Department for Science, Innovation and Technology and the Department for Digital, Culture, Media and Sport opened a call for evidence on the impact and effectiveness of the Telecommunications (Security) Act. The Information Commissioner’s Office also published an update on its Children’s Code strategy, covering enforcement action against Reddit and MediaLab, age assurance measures and reviews of children’s privacy in mobile gaming and age-assurance services.

Asia and Australia

In Australia, the Interactive Gambling Amendment (Gambling Reform) Bill, which received royal assent, included a data protection requirement, and the Australian Signals Directorate issued guidance on frontier AI cyber threat considerations, recommending that organizations assess vulnerability to AI-enabled attacks and implement priority oversight areas ranging from immediate actions, including securing attack surfaces, to longer-term strategies such as modernizing systems with secure-by-design principles.

In China, the measures for network data security risk assessment entered into force, requiring processors of important data to conduct annual risk assessments, while encouraging general data processors to conduct assessments every three years. Further, the Cyberspace Administration published guidance clarifying Personal Information Protection Law obligations on consent and security safeguards. The Administration also opened a consultation on Regulations on Protection of Personal Information by Large-Scale Personal Information Processors, including provisions on data protection, cross-border data transfer, data localization, and cybersecurity. It would cover entities processing data on 10 million or more people, and include provisions on data-export security assessments, data localization, and an external-majority oversight committee. Additionally, the National Cybersecurity Standardization Technical Committee opened a consultation on national standards on cybersecurity incident collaboration, method for assessing the maturity of cybersecurity technologies and AI security capabilities, security technical requirements and test evaluation methods for industrial control network monitoring in network security technology, basic requirements for security management of industrial control systems in cybersecurity technology, desktop and cloud security technical requirements, technical specification for mobile communication signal jammers in network security technology and data security capability maturity model.

Regarding enforcement in Japan, the Personal Information Protection Commission issued administrative guidance to KDDI and affected internet service providers following a breach exposing the authentication information of over 12.2 million people, including 7.6 million plaintext passwords.

In South Korea, bills were introduced to the National Assembly to require notification of compensation details when personal data is transferred for a fee and to strengthen physical security measures for personal information systems. Amendments to the Enforcement Decree restructuring the data portability framework for large-scale employment platforms entered into force. Additionally, the Personal Information Protection Commission opened consultations on a Personal Information Disclosure Response Manual and amended cross-border certification guidelines.

Americas

In Brazil, a law addressing sexual violence against children and adolescents entered into force, establishing offenses for acts committed in digital environments and using artificial intelligence. It allows police and prosecutors to request connection logs or subscriber data directly from internet access and application providers without prior judicial authorization when a child is at risk during an online undercover operation, provided that the request is reported to a judge within 48 hours.

Regarding enforcement, the National Data Protection Authority fined ByteDance R$ 153.7 million for processing the personal data of children and adolescents without a valid legal basis and for failing to comply with certain principles of the General Data Protection Law. The Authority also ordered the deletion of data on adolescents aged 13 to 18 whose legal representation is not regularized within 60 working days, with a daily fine of R$137,081 for non-compliance.

In Canada, the Office of the Privacy Commissioner filed an application with the Federal Court seeking an order requiring Google to de-list certain personal information from name-based search results. The application follows the Commissioner’s finding that Google continued to display media articles about an individual despite a recommendation to de-list the content.