Operation Matryoshka Exposed What the DSA's Transparency Reports Are Not Built to Catch
Germany's Sept. 6 election ran into a Kremlin-linked fake-BBC campaign the DSA's annual risk reports were never designed to catch in real time.
2026-09-07Latest Analysis
Germany
platform transparency DSA reporting
The EU Should Stop Waiting for ASEAN to Converge on GDPR and Start Signing Bilateral Digital Trade Deals
A CEIAS analysis of ASEAN's incoming DEFA argues Brussels should pursue interoperability, not convergence, before the pa...
The Seattle Times and Newsday's OpenAI Suit Targets Acquisition, Not Just Use
The new copyright suit against OpenAI and Microsoft leans on paywall circumvention, the same acquisition question that j...
Ireland's DPC Is Converging on Bigger Fines, But Its Council Presidency Exposes a Structural Conflict Regulation Alone Can't Fix
As EU regulators align on GDPR penalties, 50 academics say Ireland can't fairly chair tech policy while housing the firm...
Brazil's Top Electoral Court Narrows Its Deepfake Ban to Content That Actually Deceives
TSE's 5-2 ruling ties illegal deepfakes to realism and intent, not mere AI use — a proportionate fix ahead of October's ...
Germany's Apple Tracking Settlement Fixes a Real Fairness Gap Without Banning the Tool
Bundeskartellamt closes its 4-year Section 19a case by making Apple's ATT commitments binding, not by outlawing tracking...
TikTok Shop Japan's 30x Growth Doesn't Solve Its China Data Problem — APPI Compliance Can't
TikTok Shop Japan's blowout first year highlights a gap in Japanese privacy law: local compliance can't neutralize China...
Germany's Digital Violence Bill Expands Platform Obligations While Leaving Two EU-Mandated Offenses Unwritten
Berlin's draft law adds account-suspension and ID-disclosure duties for platforms but still lacks a cyberharassment offe...
The Netherlands' NIS2 Law Arrived 22 Months Late but Gets the Board-Accountability Balance Right
The Cyberbeveiligingswet's immediate-effect design is defensible; its fine structure and lack of grace period are not.
Estonia's Blanket .ru Email Quarantine Is Proportionate — Because It's Narrower Than It Looks
Estonia now screens all .ru email to state institutions before delivery, a targeted defense against a documented rise in...
Sanders and Casar's Superintelligence Ban Answers a Real Accountability Gap With the Wrong Tool
A bill to outlaw AI that matches human cognition, with 20-year prison terms attached, targets a definition no lab can op...
Malaysia's Antitrust Chief Threatens Criminal Probes Over Data While Ruling Out DMA-Style Rules for Platforms
MyCC will use criminal information-gathering powers against uncooperative firms but rejects EU-style ex ante rules for d...
Rand Water Disclosed Its Cyberattack Because of a JSE Bond Rule, Not Any Cybersecurity Law
South Africa has no general duty for state entities to report cyberattacks — Rand Water spoke up only because it owes bo...
A Rejected $125,000 Pitch Reveals How NSO Group Sought Access Through Trump's Antisemitism Envoy
A rejected $125K pitch for access to Trump's antisemitism envoy shows NSO Group's blacklist relief must run through comp...
Five Years After the OECD Truce Collapsed, Digital Services Taxes Are Now a $3.6 Billion Annual Drag on US Firms
CCIA finds foreign DSTs cost US companies $13B since 2020 as the OECD's Pillar One deal that was supposed to replace the...
Ukraine's Voice-Enabled Diia.AI Outpaces Its Own Privacy Law
Diia.AI now takes spoken requests for government services, but Ukraine still lacks the independent privacy regulator its...
Taiwan's Rebranded ZKTeco Scanners Expose a Component-Level Gap in Its China-Tech Ban
A Taiwanese vendor resold Chinese ZKTeco biometric scanners to police and customs, showing brand-level bans miss white-l...
Egypt's Upper-6GHz Trial Signals a Licensed-Mobile Bet That Outruns Its Own Spectrum Plan
NTRA's 1.7 Gbps trial with Telecom Egypt and Huawei points toward exclusive mobile licensing of upper 6GHz years before ...
Thailand's New Cloud Localization Rule Carves Out Critical Infrastructure While Leaving Commercial Data Flows Open
Thailand's Sept 10 cloud rule localizes high-impact government and CII data, but leaves the PDPA's cross-border transfer...
China's 'Qinglang' AI Crackdown Shows Content-Labeling Rules Are Becoming the Real Enforcement Lever, Not Just Paperwork
CAC's four-month campaign removed 5.61 million pieces of AI content and hit 49,000 accounts, revealing how China enforce...
The G7's Post-Quantum Cryptography Advisory Gets the Sequencing Right — Funding It Is the Harder Problem
G7 and CISA urge immediate post-quantum migration over 'harvest now, decrypt later' risk, but the inventory-first approa...
Russia's Data-Center Seizure Decree Is Nationalization Risk Dressed Up as Drone Defense
Putin's Aug. 24 decree lets Moscow seize 'unprotected' data centers indefinitely — a warning for how not to regulate cri...
South Africa's New AI Supercomputer Shows US Export Controls Bending, Not Breaking, for Africa
A 400-GPU Nvidia cluster near Johannesburg reveals how sovereign compute in Africa now runs through Gulf integrators and...
Taiwan's Xiaohongshu Block Is About to Become Indefinite — and the Statute Behind It Has No Off-Ramp
A fraud-driven domain block on China's Xiaohongshu is set to renew for a second year with no compliance benchmark for li...
The €825 Million Uber Fine Shows GDPR's Automated-Decision Rule Has Teeth — But the Penalty Is Out of Proportion to the Fix
Dutch and French regulators fined Uber nearly €825M for auto-deactivating drivers without human review, testing GDPR Art...