Data Law Trends 2026 (Freshfields)

Summary

• The day after his inauguration, President Trump announced a $500 billion private sector investment project in AI infrastructure.p.10
• US companies including Microsoft, Nvidia and Google pledged over £150 billion of investment in the UK during the September 2025 visit.p.12
• The UK Online Safety Act duty to protect users from illegal content applied from 17 March 2025, and the duty to protect children from 25 July 2025.p.13
• The US Federal Trade Commission reached a $20 million settlement with Cognosphere, LLC over allegations that its mobile game failed to obtain parental consent.p.21
• South Korea fined two Chinese e-commerce platforms the equivalent of $930,000 and $1.43 million for unlawful cross-border data transfers.p.26
• In the UK, statements on AI in annual reports rose by 12%, and the proportion of S&P 500 companies disclosing board oversight of AI jumped more than 84%.p.29
• Among FTSE 100 companies, only 7% of boards retain full oversight of AI, 19% delegate it to audit or risk committees and 16% have dedicated AI committees.p.30

Key insights

1. Collective privacy claims have become a primary driver of complex, high-stakes legal battles in Germany, the Netherlands, England and Wales, and the US.p.5
2. Following the Supreme Court's 2021 Lloyd v Google decision, opt-out representative data claims in England and Wales have become more difficult.p.7
3. In July 2025, the Court of Appeal held that 'multiple of investment' litigation funding agreements are enforceable.p.8
4. Deregulatory moves under the Trump administration are in direct tension with the EU's enforcement-driven digital strategy.p.10
5. Australia's social media ban for children was set to take force in December 2025, and the European Commission is seeking advice on a ban for children under 16.p.18
6. Executive Order 14117 and PADFAA have redefined US export restrictions on bulk data transfers and data brokerage.p.23
7. In 2024, 89% of S&P 500 companies had not expressly disclosed the assignment of AI oversight to the full board or a committee.p.30
8. Divergent approaches in the US, EU, UK and APAC mean businesses need proactive, flexible and geopolitically aware strategies.p.15