EMEA privacy changes accelerate across UAE, UK and EU

The UAE is moving toward a more developed privacy regime after the UAE Artificial Intelligence and Data Authority was formally established on 14 June 2026. The new body consolidates three entities and could help advance long-awaited Executive Regulations under the onshore PDPL. New child digital safety rules prohibit collecting personal data from under-13s without verified parental consent, restrict advertising using children’s data and set social media account requirements at 15+ years, with added protections for 15- to 16-year-olds.

UK policy remains focused on children’s online safety and practical compliance. On 15 June 2026, the government announced plans to ban social media platforms from offering services to under-16s after a consultation that received more than 116,000 responses. Further default protections for 16 and 17 year-olds include overnight curfews from midnight to 6am and limits on addictive design features. The ICO also issued final consumer IoT guidance and confirmed new complaint-handling duties under the Data (Use and Access) Act 2025.

EU developments include EDPB consultations launched on 8 July 2026 on anonymisation and web scraping for generative AI, with both consultations ending on 30 October 2026. The Council of the EU adopted the Digital Omnibus on AI on 29 June 2026, revising several AI Act timelines and adding a ban on AI practices involving non-consensual intimate imagery and CSAM.