On December 11, 2025, the CNIL fined an Israeli company €1 million for failing to comply with its GDPR obligations after providing personalized advertising services to an EU music-streaming platform. The service helped the platform to personalize and optimize marketing campaigns to promote its streaming services.
The CNIL held that the GDPR applied to the
The first Federal Rule focused specifically on multidistrict litigation—which has long been a staple of complex, high-stakes litigation—took effect on December 1, 2025, as part of the 2025 amendments to the Federal Rules of Civil Procedure.
On December 2, Greystar agreed to a $24 million settlement over allegations it misled renters by omitting mandatory fees from advertised monthly rents. This settlement underscores the FTC’s continuing scrutiny of “junk fees” and signals that the FTC may pursue rulemaking requiring greater transparency in rental fee advertising.
On December 16, 2025, the EU Commission unveiled its proposal for the Biotech Act. The proposal, which is only the first part of a bigger initiative for regulating biotechnologies, focuses primarily on the health sector. The Commission took the opportunity to broadly revise the Clinical Trial Regulation (“CTR”) – see our blog post here
In December 2025, the Spanish Agency for the Supervision of Artificial Intelligence (AESIA) published a set of detailed guidance documents and templates aimed at helping providers and deployers of high-risk AI systems under the EU AI Act comply with the relevant requirements of the law. The materials are also available in English.
On December 18, 2025, the UK Government passed the Employment Rights Bill, which will now be referred to as the Employment Rights Act 2025 (the “Act”). This represents the “biggest upgrade in employment rights for a generation” and introduces a wide-ranging suite of reforms to be implemented over the course of the next two years.
The European Commission (“Commission”) recently launched two stakeholder consultations under the EU AI Act. The first (see here), closing on 9 January 2026, relates to the copyright-related obligations for General Purpose AI (“GPAI”) providers under the AI Act and GPAI Code of Practice. The second (see here), closing on 6 January 2026,
The UK has published its first food safety guidance for cell-cultivated food products (“CCPs”). So far, the UK authorities have addressed two issues:
Introduction
On 16 December 2025, the European Commission (“Commission”) published its Proposal for a Regulation on establishing a framework of measures for strengthening the Union’s biotechnology and biomanufacturing sectors particularly in the area of health (“Biotech Act”) (see here). The Proposal follows a public consultation held between August 2025 and November 2025 (see here
In advance of the Indiana Consumer Data Protection Act’s (“Act”) effective date on January 1, 2026, the Indiana Attorney General released a Data Consumer Bill of Rights (“Bill of Rights”) that summarizes the rights created in the Act.