Worldwide: Privacy

The Federal Trade Commission and state regulators have filed a complaint against Hims & Hers Health for allegedly sharing sensitive health information with advertising platforms and misrepresenting its practices. Meanwhile, HHS reached a settlement with OSF Healthcare System following a ransomware attack, and the European Commission published final guidance on the Cyber Resilience Act as AI Act amendments enter into force.

On June 8, 2026, four central agencies jointly published a revamped Good Clinical Practice (GCP) standard, effective Sept. 1, 2026. It is materially shorter than the standard it replaces, and that compression is the point: China’s GCP now incorporates International Council for Harmonisation (ICH) E6(R3) by reference rather than restating it, and it reallocates responsibility among sponsors, service providers, investigators, and sites in ways that may require contract amendments before the effective date.

On May 15, 2026, a substantial revision of China’s Implementing Regulations of the Drug Administration Law (the Regulations or Implementing Regulations) took effect, introducing, among other items, a formal data protection framework. On the same day, China’s National Medical Products Administration (NMPA) issued the Implementing Measures for Drug Trial Data Protection (the Measures), giving operational effect to the Regulations’ data-protection article for the first time since China accepted the underlying obligation upon World Trade Organization (WTO) accession.

New Jersey Governor Mikie Sherrill signed three measures addressing children's and teens' use of online services, with the New Jersey Age-Appropriate Design Code imposing comprehensive safety, privacy, data use, and design requirements on covered online service providers beginning September 1, 2027.

This content presents information about cookie usage and data privacy practices, explaining how cookies operate on the website and detailing user options for managing cookie preferences. It outlines the categories of cookies employed, their purposes, and references comprehensive privacy documentation for users seeking detailed information about data handling practices.

The Seventh Circuit has issued a landmark ruling that device manufacturers do not "possess" or "collect" biometric data under Illinois' BIPA when software creates and processes such data solely on a user's device.