INTERNATIONAL 

UNITED STATES OF AMERICA

7. House of Representatives approves ‘Take It Down Act’ to Tackle Non-Consensual Deepfakes [7]

On April 30, 2025, the U.S. House passed the Take It Down Bill (“Bill”), following earlier Senate approval. The Bill now awaits the President’s signature. It criminalizes the publication of Non-Consensual Intimate Imagery (“NCII”) i.e., sexually explicit or intimate images of individuals that are shared or distributed without their consent, whether they are real or digitally manipulated using AI. This includes deepfake pornography, revenge porn, or the leaking of private images—often causing serious emotional, reputational, and safety consequences for victims.

The Bill introduces a legal obligation for online platforms to remove NCII content within 48 hours of a verified report. Failure to comply may result in civil penalties enforced by the FTC under existing laws governing deceptive or unfair trade practices. In cases involving intentional or malicious distribution, criminal penalties may also apply under related federal statutes.

Further, victims are entitled to restitution, and courts may order forfeiture of related assets. Exceptions apply for disclosures made in good faith for legal, medical, or public interest reasons. The Bill aims to ensure faster removal of harmful content and stronger protections against digital exploitation.

The Bill is expected to directly impact social media companies, image-hosting sites, and messaging platforms, requiring them to develop prompt and effective content moderation processes. The Bill marks a turning point in how legislatures are responding to the risks posed by AI-generated abuse and digital exploitation. By requiring swift takedowns and introducing consequences for inaction, the law increases accountability in the tech ecosystem. It also sets a precedent for other jurisdictions exploring legal tools to protect users against emerging forms of online harm.

8. Disclosure Obligations for Crypto Assets Clarified[8]

On April 10, 2025, the SEC issued a statement entitled Offerings and Registration of Securities in Crypto Asset Markets (“Statement”) outlining guidance on the application of federal securities laws to offerings and registrations involving crypto assets. This initiative aims to enhance clarity and consistency in disclosures related to crypto asset securities.​

The Statement emphasizes that issuers whose operations involve crypto assets—whether through networks, applications, or investment contracts—must adhere to existing disclosure requirements under federal securities laws i.e., the Securities Act, 1933 and the Securities Exchange Act, 1934. This includes providing comprehensive information about the nature of the crypto assets, the rights and obligations they confer. Statement also calls for transparent disclosure of associated risks—such as governance mechanisms, reliance on key third parties, and susceptibility to changes in protocols. Additionally, the SEC urges issuers to address technological and regulatory uncertainties surrounding the crypto ecosystem.

This initiative is part of the SEC’s broader efforts to ensure investor protection and promote informed decision-making in the evolving digital asset landscape. This development follows the formation of the SEC’s Crypto Task Force by Acting Chairman Mark T. Uyeda, which seeks to establish a comprehensive regulatory framework for crypto assets. The Statement underscores the importance of transparency and investor protection in the rapidly evolving crypto market.

9. California proposes Central Platform to Simplify Data Deletion from Data Brokers[9]

On April 25, 2025, CPPA released draft regulations titled the Regulations to Establish the Delete Request and Opt-Out Platform (DROP) (“Draft Regulations”) under the California Delete Act ,2023 (“Delete Act”). The Draft Regulations aims to give consumers a single, convenient way to request the deletion of their personal data from all registered data brokers, eliminating the need to contact each broker individually.

Under the Draft Regulations, data brokers would be required to access the ‘DROP’ system at least once every 45 days to check for and act on deletion requests. If a user’s personal information matches more than 50% of key identifiers (such as name, date of birth, and zip code), the broker must delete the data. If there is no match, the request must still be stored for compliance tracking purposes.

The Draft Regulations set out how data brokers should standardize data fields to improve matching accuracy. Beginning in 2028, data brokers will be subject to third-party audits every 3 years to ensure they are complying with the requirements of the Delete Act and the DROP system.

The Draft Regulations are open for public feedback till June 10, 2025.

10. Florida Bar recommends Cybersecurity Incident Response Plans for Legal Professionals[10]

On March 27, 2025, the Florida Bar Committee on Cybersecurity and Privacy Law (“Committee”) issued Recommendation 25-1(“Recommendation”), encouraging all members and their associated law firms to voluntarily adopt and annually maintain an Incident Response Plan (“IRP”) tailored to their practice. The Recommendation highlights growing cybersecurity risks and the need for structured preparation within the legal profession.

The Committee advises that all legal practices—regardless of size—should maintain clear procedures to detect, manage, and respond to cyber incidents. Suggested steps include mapping out the types of data handled by the firm, regularly assessing cybersecurity readiness, and clearly outlining roles, responsibilities, and communication protocols in the event of a breach.

Although not mandatory, the Recommendation is intended to assist law fraternity to protect sensitive client and business information, maintain operational continuity, and fulfil ethical obligations in an increasingly digital legal environment.

This highlights how privacy and cybersecurity obligations are expanding across all sectors—including the legal industry itself. As regulations evolve and digital threats increase, law firms are expected not only to protect client data but also to demonstrate proactive risk management. Implementing an IPR is becoming a core element of legal and ethical compliance in today’s privacy-conscious landscape.

11. Google held Liable for Violation of Anti-trust Regulations[11]

The U.S. District Court for the Eastern District of Virginia held Google LLC (“Google”) liable for violations of anti-trust laws in United States et al. v. Google LLC, (No. 1:23-cv-00108). The case, originally filed in 2020, alleged that Google secured its position by entering into agreements with device manufacturers (such as Apple Inc.), browser companies etc., to set ‘Google Search’ as the default option—limiting user choice and ultimately restricting rival search engines from fair competition.

The court found that these agreements were designed not for better performance but to exclude competitors and entrench Google’s monopoly. This conduct, the court held, breached Section 2 of the Sherman Antitrust Act, 1890. A separate proceeding will determine the remedies, which may include restrictions on how Google negotiates default placements or more significant structural changes.

This ruling could reshape how dominant digital platforms operate, especially in how they negotiate default service agreements that affect user access and market competition.

EUROPEAN UNION

12. Meta and Apple Liable for Breach of Digital Competition Laws[12]

On April 23, 2025, the European Commission (“Commission”) issued its first formal findings concluding that both Meta Platforms Ireland Limited (“Meta”) and Apple Inc.(“Apple”) breached core obligations as outlined in DMA.

It was observed that Apple had restricted app developers from informing users about alternative payment options outside the App Store. These “anti-steering” limitations were held to violate Article 5(4) of the DMA, which requires gatekeepers to allow businesses to communicate freely with their users. As a result, Apple faces a significant fine and is required to remove the offending restrictions.

In a separate finding, Meta was found to have violated Article 5(2) of the DMA through its “Consent or Pay” model, which gave users of Facebook and Instagram a binary choice: either accept extensive personal data processing for targeted ads or pay a monthly fee to opt out. The Commission held that this model did not offer users a real alternative and undermined the principle of freely given consent under EU law. As such, the Commission has imposed a fine of Euro 500 million on Apple and Euro 200 million on Meta for the violations.

13. Mobile Application Privacy Guidelines updated to clarify Developer Obligations [13]

On April 8, 2025, the French Data Protection Authority published an updated version of its Recommendations on Mobile Applications (the “Guidelines”), aimed at assisting developers ensure their mobile applications comply with data protection requirements. Originally adopted in 2024, the Guidelines are intended to address the specific risks mobile environments pose to user privacy, including issues around consent, transparency, and data minimisation.

The April 2025 revision includes technical corrections and clarifications in response to stakeholder feedback, such as refinements on how consent should be collected for accessing device features (such as location or contact lists), clearer explanations on distinguishing between technical and tracking cookies, and added examples to support transparency obligations in user interfaces.

With increasing scrutiny of data practices, companies should actively adhere to such guidelines to ensure they are meeting regulatory expectations. In particular, businesses must ensure they implement precise consent mechanisms, avoid unnecessary data access, and offer users clear, accessible information about how their data is processed.

UNITED KINGDOM

14. Cyber Governance Code of Practice released[14]

On April 8, 2025, the Government released the Cyber Governance Code of Practice (“Guidelines”) aimed at assisting company boards and senior leadership to effectively manage cyber risks. Developed in collaboration with the National Cyber Security Centre and industry stakeholders, the Guidelines provides practical guidance to ensure that cyber security is treated as a key governance priority rather than just a technical issue.

The Guidelines outlines five core principles for effective oversight i.e., identifying and protecting critical digital assets; aligning cyber risk management with overall business strategy; promoting accountability and cyber awareness among leadership; preparing for and responding to cyber incidents; and regularly reviewing the effectiveness of cyber governance measures. The Guidelines are voluntary but strongly encouraged, especially for directors of larger or digitally dependent organizations. It is supported by a wider toolkit and training materials to help boards translate high-level principles into actionable governance practices. By promoting board-level engagement in cyber security, the initiative seeks to strengthen organizational resilience and mitigate growing digital threats.

15. Court clarifies Employer’s Liability for Personal Data stored on Work Devices[15]

In Eamon McShane v. Data Protection Commission & Health Service Executive [2025 IEHC 191], the Irish High Court rejected a challenge against the DPC for dismissing a complaint that alleged the Health Service Executive (“HSE”) was responsible for a breach of personal data stored on a work-issued phone. The applicant, a fire prevention officer, claimed that his personal email and cryptocurrency accounts were compromised following a major cyberattack on the HSE in 2021. The applicant believed the breach was linked to his work phone, which he had used for both work and personal matters.

The DPC declined to investigate further, finding that the HSE was not the “data controller” of the personal (non-work) data stored on the phone, as its use was unauthorised and contrary to the HSE’s ICT policy. The court upheld this view, holding that the DPC had lawfully and proportionately limited its investigation based on the scope of the complaint, which focused solely on personal data outside the employer’s control. It found no legal error or irrationality in the decision and refused to order a fresh investigation.

The decision underscores the need for companies to implement clear, enforceable policies on personal use of work devices and to regularly communicate these to employees. To mitigate risk and uphold GDPR compliance, employers should ensure they maintain control over how personal data is processed on corporate equipment. This includes monitoring usage boundaries, securing consent where needed, and clearly defining their role as data controllers in internal protocols.

OTHERS

16. China – CAC Cracks Down on Online Abuse of Minors’ Images [16]

CAC has launched a major enforcement drive to curb the misuse of children’s images online. Over 11,000 social media accounts have been penalized for exploiting minors. Some accounts deliberately created scripted, exaggerated, or emotionally manipulative videos involving children—often depicting fake abuse, forced crying, or overdramatized hardship—to attract views and monetization. Further, videos and photos of minors were widely shared without proper consent, including sensitive moments like medical visits or school incidents, violating children’s right to privacy.

The CAC has urged platforms to strengthen moderation systems and enable stricter “minor protection” settings. Authorities also flagged a concerning trend where adults pose as children to spread misleading or damaging content, prompting renewed focus on proactive monitoring.

This move reinforces growing regulatory expectations around child protection in digital media. Platforms and content creators operating in China should closely review their content policies, moderation tools, and advertising models to avoid legal risk and ensure responsible treatment of minors in online environments.