November 2025

The UK’s antitrust and consumer agency—the Competition and Markets Authority (CMA)—has announced its first enforcement actions under the country’s new consumer protection regime. On November 18, 2025, the CMA opened eight investigations into various pricing practices, issued advisory letters to 100 businesses across 14 sectors, and published new price transparency guidance. The actions send a clear message: the CMA is ready to deploy its new, enhanced powers to tackle business practices that it believes are the most harmful to consumers.Continue Reading Price Check: The UK’s New Consumer Protection Push

On November 19, 2025, the EU Commission (Commission) published a set of legislative proposals to introduce more flexibility into a number of EU digital regulations, including:

  • the Digital Omnibus, which amends a number of provisions of the General Data Protection Regulation (GDPR) and the ePrivacy Directive, as well as the Data Act; and
  • the AI Omnibus, which focuses on the AI Act (jointly, the Omnibus Proposals).

Continue Reading The EU Omnibus Proposals Intend to Introduce More Flexibility in the GDPR, AI Act, and Other EU Digital Regulations

On November 6, 2025, the California, Connecticut, and New York Attorneys General (collectively, the “Attorneys General”) announced a settlement with Illuminate Education, Inc. to resolve allegations that the company violated state privacy laws following a student data breach. The settlement marks the first enforcement actions under the California K-12 Pupil Online Personal Information Protection Act (KOPIPA, formerly known as SOPIPA) and Connecticut’s Student Data Privacy Law, and also constitutes the second major enforcement action under New York Education Law § 2-d.Continue Reading EdTech Provider Agrees to $5.1 Million Settlement with Three State Attorneys General over Student Data Breach