Part 11: Legal and regulatory changes, 2025 to 2026

The legal and regulatory changes since 2025 that an OSINT practitioner should know about, with sources to take to counsel.

We are not lawyers, and the law here changes by the month. This Part lists the developments since 2025 that an OSINT practitioner should know about, with sources, so you can take the right questions to counsel.

European Union

  • AI Act prohibitions in force. Since 2 February 2025 the AI Act bans untargeted scraping of facial images from the internet or CCTV to build facial recognition databases. It also bans emotion recognition in workplaces and schools. The Commission’s guidelines narrow the scraping ban to databases used to recognise people, and the law-enforcement exception is tied to specific investigations.1 Obligations for general-purpose AI providers applied from 2 August 2025.
  • Deadlines moved. The “Digital Omnibus on AI”, adopted in mid-2026, pushed back the main high-risk obligations. Stand-alone systems now have until 2 December 2027 and AI embedded in regulated products until 2 August 2028. The requirement to mark AI-generated content under Article 50 applies from 2 December 2026.2
  • GDPR enforcement against scraping and facial recognition. The Dutch regulator fined Clearview AI €30.5 million in September 2024. Clearview lost its UK jurisdiction appeal in October 2025. The privacy group noyb filed a criminal complaint against Clearview’s executives in Austria the same month.34 The signal for OSINT is clear: face search over scraped images is now a legal exposure in Europe, whoever runs the service.
  • GDPR and AI training. Meta began training on EU users’ public posts on 27 May 2025 after a German court declined to stop it.5 Italy’s €15 million fine against OpenAI (December 2024) was overturned by a Rome court in March 2026, so do not cite it as standing.6

United Kingdom

  • The Data (Use and Access) Act 2025 received Royal Assent on 19 June 2025. Its main data-protection changes, including new rules on automated decision-making, took effect on 5 February 2026.7
  • Online Safety Act enforcement began in earnest in 2026, with Ofcom issuing its first fines. Ofcom also opened an investigation into X over Grok’s image generation in January 2026.8

United States

  • About 20 US states now have general consumer privacy laws in force. Colorado repealed and re-enacted its AI Act in May 2026 with a narrower scope, effective 1 January 2027.9 California’s SB 53 (frontier model transparency) took effect on 1 January 2026.
  • Executive Order 14365 (December 2025) set up a Justice Department task force to challenge state AI laws. It does not by itself invalidate any state law.10
  • Commercial data purchases. The Fourth Amendment Is Not For Sale Act passed the House in April 2024 and has not become law. FISA Section 702 lapsed in June 2026 after reauthorisation failed in the Senate.11
  • Chat logs as evidence. Part 5.3 covers the OpenAI preservation order and the production of 20 million conversations. There is no privilege for what you tell a chatbot.
  • AI-generated evidence. A proposed Federal Rule of Evidence 707 on machine-generated evidence was published for comment in 2025. In May 2026 the Advisory Committee declined to advance it and scheduled a conference for 15 October 2026. A separate proposal on authenticating suspected deepfakes is on its own track.12 Courts have sanctioned lawyers in more than 2,000 cases for fabricated AI citations.13

Standards and guidance

  • The Berkeley Protocol remains the reference for lawful, ethical open source investigation. It has not been revised since 2020 and does not address AI.14
  • GIJN’s guide to detecting AI-generated content (Part 7) is the most current practitioner guidance we know of.15
  • Telegram changed its privacy policy in September 2024 to allow disclosure of IP addresses and phone numbers to authorities on valid requests.16

What we do

  1. Collect the minimum personal data needed, record a lawful basis for holding it, and set a deletion date.
  2. Do not use face search engines on scraped images for anything that could reach a European court.
  3. Keep a chain of custody: who collected what, when, from where, and the hash of the file.
  4. Treat AI assistance as something that must be disclosed and reproducible if the work reaches litigation.
  5. Ask local counsel before cross-border collection, before any active engagement with a target, and before using commercial data brokers.

Footnotes

  1. Covington, Inside Privacy (June 2025). “European Commission guidelines on prohibited AI practices under the EU AI Act.” https://www.insideprivacy.com/artificial-intelligence/european-commission-guidelines-on-prohibited-ai-practices-under-the-eu-artificial-intelligence-act/. Accessed 2026-10-09.↩︎

  2. European Parliament Legislative Train. “Digital Omnibus on AI.” https://www.europarl.europa.eu/legislative-train/package-digital-package/file-digital-omnibus-on-ai ; White & Case (2026), https://www.whitecase.com/insight-alert/eu-agrees-digital-omnibus-deal-simplify-ai-rules. Accessed 2026-10-09.↩︎

  3. Autoriteit Persoonsgegevens (3 September 2024). “Dutch DPA imposes a fine on Clearview.” https://www.autoriteitpersoonsgegevens.nl/en/current/dutch-dpa-imposes-a-fine-on-clearview-because-of-illegal-data-collection-for-facial-recognition. Accessed 2026-10-09.↩︎

  4. Infosecurity Magazine (October 2025). “Clearview AI hit with criminal complaint.” https://www.infosecurity-magazine.com/news/clearview-ai-hit-with-criminal/. Accessed 2026-10-09.↩︎

  5. Taylor Wessing (May 2025). “Meta vs Verbraucherzentrale NRW.” https://www.taylorwessing.com/en/insights-and-events/insights/2025/05/meta-vs-verbraucherzentrale-nrw. Accessed 2026-10-09.↩︎

  6. Reuters via Freevacy (20 March 2026). “Italian court overturns €15m GDPR fine against OpenAI.” https://www.freevacy.com/news/reuters/italian-court-overturns-eur15m-gdpr-fine-against-openai/7241. Accessed 2026-10-09.↩︎

  7. The Data (Use and Access) Act 2025 (Commencement No. 2) Regulations 2026, SI 2026/82. https://www.legislation.gov.uk/uksi/2026/82. Accessed 2026-10-09.↩︎

  8. CNN (12 January 2026). “Indonesia and Malaysia block Grok.” https://edition.cnn.com/2026/01/12/business/indonesia-malaysia-grok-elon-musk-intl-hnk ; Ofcom (12 January 2026), https://www.ofcom.org.uk/online-safety/illegal-and-harmful-content/ofcom-launches-investigation-into-x-over-grok-sexualised-imagery ; The Register (26 January 2026), https://www.theregister.com/2026/01/26/ec_open_new_investigation_into/. Accessed 2026-10-09.↩︎

  9. Skadden (June 2026). “Colorado repeals and replaces its AI Act.” https://www.skadden.com/insights/publications/2026/06/colorado-repeals-and-replaces-its-ai-act. Accessed 2026-10-09.↩︎

  10. Paul Hastings (December 2025). “President Trump signs executive order challenging state AI laws.” https://www.paulhastings.com/insights/client-alerts/president-trump-signs-executive-order-challenging-state-ai-laws. Accessed 2026-10-09.↩︎

  11. Brennan Center for Justice (2026). “Section 702 of FISA: 2026 resource page.” https://www.brennancenter.org/our-work/research-reports/section-702-foreign-intelligence-surveillance-act-fisa-2026-resource-page. Accessed 2026-10-09.↩︎

  12. Redgrave LLP (2026). “Machine-generated evidence: Rules Advisory Committee hits pause on proposed FRE 707.” https://www.redgravellp.com/publication/machine-generated-evidence--rules-advisory-committee-hits-pause-to-consider-significant-revisions-to-proposed-federal-rule-of-evidence-707-addressing-evidence-generated-by-artificial-intelligence. Accessed 2026-10-09.↩︎

  13. Charlotin, D. “AI Hallucination Cases” database. https://www.damiencharlotin.com/hallucinations/. Counts of about 87 (May 2025) and 2,028 (9 September 2026) from the database and secondary reporting. Accessed 2026-10-09.↩︎

  14. OHCHR and UC Berkeley Human Rights Center (2022; first published 1 December 2020). Berkeley Protocol on Digital Open Source Investigations, HR/PUB/20/2. https://www.ohchr.org/sites/default/files/2024-01/OHCHR_BerkeleyProtocol.pdf ; UN Digital Library record, https://digitallibrary.un.org/record/3973652 ; project page, https://humanrights.berkeley.edu/programs-projects/tech-human-rights-program/berkeley-protocol-digital-open-source-investigations. Accessed 2026-10-09.↩︎

  15. van Ess, H., Global Investigative Journalism Network (1 September 2025, updated March 2026). “Reporter’s Guide to Detecting AI-Generated Content.” https://gijn.org/resource/guide-detecting-ai-generated-content/. Accessed 2026-10-09.↩︎

  16. Telegram. “Privacy Policy”, section 8.3 (changed 23 September 2024). https://telegram.org/privacy. Accessed 2026-10-09.↩︎