Skip to main content

Explore our latest blog posts — Page 9

Cookie Banner Dark Patterns: The New Manipulation Tactics Regulators Are Targeting

Cookie Banner Dark Patterns: The New Manipulation Tactics Regulators Are Targeting

France's CNIL fined Google €200 million in September 2025 for a consent design that made cookie rejection harder than acceptance. The same month, SHEIN received €150 million — not for failing to show a banner, but for a banner that accepted a user's "Reject all" click while continuing to place cookies anyway. Sweden's Data Protection Authority fined ATG and Warner Music Sweden for manipulative banner designs. American Express received enforcement action in the UK after cookies continued firing after user withdrawal. These are not edge cases or giant-tech-only problems. Enforcement has shifted from warnings to immediate fines without prior notice. Dark pattern enforcement has become a distinct and growing enforcement category.

May 15, 2026
16 min read
Read
California vs EU AI Regulations: What Global Companies Need to Know

California vs EU AI Regulations: What Global Companies Need to Know

A US-headquartered SaaS company deploys an AI-powered hiring tool to customers in Germany, France, and California. The tool screens job applicants, assigns scores, and surfaces a ranked shortlist for hiring managers. In the EU, this system is a high-risk AI application under Annex III of the EU AI Act, subject to technical documentation requirements, conformity assessment, registration in the EU AI database, continuous post-market monitoring, and human oversight controls — all of which must be in place by August 2, 2026, with the Digital Omnibus proposal potentially extending some obligations to late 2027. In California, the same tool is covered by three separate regulatory instruments: the CPPA's ADMT regulations requiring pre-use notices and opt-out rights, the CRC's employment automated-decision system regulations requiring anti-bias testing and four-year record retention, and potentially the CPPA's risk assessment requirements if it crosses the CCPA applicability threshold. There is no single point of reference that resolves all of these obligations simultaneously.

May 12, 2026
18 min read
Read
AI System Classification Drift: Managing Dynamic Risk Under the EU AI Act

AI System Classification Drift: Managing Dynamic Risk Under the EU AI Act

Your internal analytics platform started as a reporting tool. Product managers used it to track feature adoption. Six months ago, the people operations team asked whether it could help with performance reviews. Engineering added a scoring module. The tool now produces numerical performance scores for individual employees that managers use to make promotion and termination decisions. Nobody formally reassessed the system's EU AI Act classification. As of August 2, 2026, it is operating as an unregistered high-risk AI system in the employment category under Annex III — without a risk management system, without technical documentation, without conformity assessment, and without human oversight controls. The penalties for non-compliance reach €15 million or 3% of global annual turnover.

May 6, 2026
18 min read
Read