Special edition: the EDPB has opened a public consultation on draft guidance that challenges a common e-commerce habit, forcing customers to create an account to make a purchase. It explains why “contract necessity” usually does not fit one-time purchases, and why guest checkout is often the more privacy-protective default under the GDPR.

This week, the European Court of Justice agreed to review an appeal against the EU US Data Privacy Framework, raising fresh concerns over transatlantic data transfers. Meanwhile, the US Federal Trade Commission reached a settlement with edtech provider Illuminate Education after a major breach exposed millions of student records. These developments highlight growing scrutiny on cross-border data flows and the need for stronger protections for minors' data.

This week we review how regulation, innovation and risk continue to pull in opposite directions across global privacy. Europe is signalling a possible rollback of key digital rules, India is tightening data-collection obligations, and scrutiny over AI training-data practices is intensifying. Together these developments highlight the growing need for organisations to adapt quickly, refine governance, and prepare for regulatory shifts in both directions.