UK law
ICO updates on action improving cookie compliance across top UK websites
The ICO has provided an update on its work to tackle cookie compliance, which it says has brought the vast majority of the UK’s most used websites into compliance with rules on the use of advertising cookies. The ICO focused on three key areas of compliance: whether non-essential advertising cookies were stored on users’ devices before users could exercise their choice to accept or reject them; whether rejecting non-essential advertising cookies was as easy as accepting them; and whether any non-essential advertising cookies were placed even though a user had not consented to them. The ICO sent letters to website operators highlighting their shortcomings in compliance and, where this did not lead to change, opened investigations and, in 17 cases, issuing preliminary enforcement notices. The ICO is continuing with action in relation to the 21 websites that have still not passed its testing criteria. It says it is committed to upholding cookie compliance and will continue to periodically test the UK’s top 1,000 websites, with the aim of making sure that they meet legal requirements.
Ofcom publishes first-year analysis of online safety risk assessments under Online Safety Act 2023
Ofcom has published a report about risk assessment records from the first year of online safety duties under the Online Safety Act 2023. It received 104 risk assessment records under its enforcement programmes. The report says that there are various problems regarding the way in which providers conducted illegal content risk assessments and children’s risk assessments and maintained records. Ofcom has identified five areas for improvement: assessing all kinds of illegal and harmful content, improving analysis of features and functionalities, demonstrating confidence in controls, basing decisions on relevant evidence and implementing appropriate risk governance. Ofcom has indicated it will take enforcement action where necessary improvements have not been made by providers of in-scope services.
EU law
Meta commits to give EU users choice on personalised ads under DMA
The European Commission has acknowledged Meta’s undertaking to offer users in the EU an alternative choice of Facebook and Instagram services that would show them less personalised ads, to comply with the Digital Markets Act (DMA). The Commission says that Meta will give users the effective choice between: consenting to share all their data and seeing fully personalised advertising, and opting to share less personal data for an experience with more limited personalised advertising. Meta will present these new options to users in the EU in January 2026. This follows a close dialogue between the Commission and Meta after the Commission found Meta in breach of the Digital Markets Act and issued Meta a non-compliance decision related to user choice in April 2025. Once implemented, the Commission will seek feedback and evidence from Meta and other relevant stakeholders on the impact and uptake of this new ad model.
European Commission accepts TikTok’s commitments on advertising transparency under the Digital Services Act
TikTok has committed to providing advertising repositories that ensure full transparency around ads on its services, as required by the Digital Services Act (DSA). TikTok has submitted binding commitments that address all the concerns raised by the Commission in its investigation and preliminary findings from May 2025. TikTok will provide the full content of the advertisement as it appears in users’ feeds, including the URLs in the link provided in the ad. TikTok will update its repository more quickly, ensuring information is available within a maximum of 24 hours. It will also provide the targeting criteria selected by advertisers, along with aggregated user data (including gender, age group and member state where the users who were reached are located), enabling researchers to investigate how ads are targeted and delivered. In addition, it will introduce additional search options and filters, allowing users to find advertisements more easily. The DSA requires platforms to maintain an accessible and searchable repository of the ads running on their services. These repositories are critical for regulators, researchers, and civil society to detect scams, advertisements for illegal or age-inappropriate products, fake advertisements, and coordinated information operations, including in the context of elections. TikTok must implement the commitments as soon as possible, and by the latest within deadlines agreed with the Commission, varying from two to maximum 12 months depending on the specific commitment. The Commission says that it will carefully monitor TikTok’s compliance with the binding commitments the platform has offered under article 71 of the DSA, as well as with its other obligations under the DSA.
Council of the EU endorses regulation for AI gigafactories and expanded quantum research
The Council has agreed on an amendment to the Regulation that sets the framework for the activities of the European High-Performance Computing Joint Undertaking (EuroHPC JU). The amendment aims to establish AI gigafactories in Europe and create a dedicated quantum pillar in the activities of the EuroHPC JU. The proposed Council regulation outlines the framework for establishing and operating AI gigafactories, while allowing flexibility for partners to achieve their best possible results. It sets clear rules for funding and procurement and includes protection measures for start-ups and scale-ups. The amended regulation also allows for unused EU funds to be redirected to AI Gigafactory projects and facilities, and for the creation of multi-site gigafactories across multiple countries. The Council also introduced in the text safeguards for third-country participation and updates to the governance structure of the EuroHPC Joint Undertaking to reflect its expanded role. Additionally, the agreement transfers quantum research and innovation activities from the Horizon Europe research and innovation framework programme to EuroHPC JU activities with the aim of strengthening efforts.
AI Office preparing guidelines to support implementation of AI Act
The AI Office is preparing guidelines aimed at ensuring a smooth implementation of the AI Act. In the context of the implementation of the AI Act and the proposed Digital Omnibus, the Commission is working on initiatives designed to support compliance with the rules and meet stakeholder needs. The AI Office is currently preparing a set of guidelines to provide clear and practical instructions on how to apply the AI Act, alongside other relevant EU legislation.
European Commission seeks feedback on draft implementing act to establish AI regulatory sandboxes under AI Act
The Commission seeks feedback on the rules for AI regulatory sandboxes as required by the AI Act. The AI Act offers the possibility for (prospective) providers to develop, train, validate and test their innovative AI system for a limited time under regulatory supervision in a controlled framework set up by a competent authority. This can also be done where appropriate in real-world conditions. AI regulatory sandboxes will support the objective of the AI Act to foster AI innovation and support compliance with the AI Act. The Commission will adopt an implementing act to set out the common rules for the establishment and operation of AI regulatory sandboxes as mandated by the AI Act. The consultation ends on 6 January 2026.
