Privacy oversight expands

Privacy oversight widened in early April, with a global industry summit centered on artificial intelligence and regulators in China launching a national enforcement campaign. (iapp.org) (china-briefing.com) The International Association of Privacy Professionals held its 2026 Global Summit in Washington from March 30 to April 2, billing it as the world’s largest annual gathering of digital responsibility professionals. The conference agenda listed more than 70 breakout sessions on privacy, artificial intelligence governance, cybersecurity law, data transfers, vendor management, and online advertising. (iapp.org) A National Law Review summary of the event said the summit convened more than 15,000 privacy and digital responsibility professionals. Conference recaps from Alston & Bird and Hinshaw & Culbertson said regulators used the event to stress operational compliance, board oversight, children’s data, online tracking, and artificial intelligence systems that rely on older privacy controls. (newsbreak.com) (alston.com) (hinshawlaw.com) That focus reflects a shift from checking whether a company has a policy to checking whether the policy works in practice. Alston & Bird said regulators described enforcement as more coordinated across jurisdictions and more willing to look at executive and board accountability. (alston.com) China moved on a parallel track on April 2, when the Cyberspace Administration of China, the Ministry of Industry and Information Technology, and the Ministry of Public Security jointly announced 2026 special enforcement actions on personal information protection. China Briefing and Morrison & Morrison Law Chambers said the campaign is nationwide and targets unlawful or irregular handling of personal information. (china-briefing.com) (mmlcgroup.com) The campaign names concrete sectors and practices: apps and software development kits, online advertising, education, transportation, healthcare, and finance. The published summaries say regulators will look for forced consent, weak deletion options, opaque third-party sharing, excessive collection of location or contacts data, and limited ways to turn off personalized ads. (china-briefing.com) (mmlcgroup.com) In education, the campaign highlights parental consent and children under 14. In several sectors, the summaries say authorities will also restrict facial recognition as a default identity check when less intrusive options are available. (mmlcgroup.com) (china-briefing.com) China’s move did not come out of nowhere. Bird & Bird said 2025 already featured continuing special actions under Cyberspace Administration of China leadership, with the Ministry of Industry and Information Technology, public security agencies, and market regulators forming a more regular multi-agency enforcement mechanism after China’s Personal Information Protection Law took effect in November 2021. (twobirds.com) (practiceguides.chambers.com) The same trend shows up in the summit’s program: artificial intelligence was not treated as a separate compliance box. Hinshaw & Culbertson said speakers tied artificial intelligence to cookies, health data, children’s privacy, dark patterns, and website tracking claims, which means companies now face privacy review across product design, advertising, vendor contracts, and governance at the same time. (hinshawlaw.com) The through line from Washington to Beijing is narrower than it looks: regulators are asking who collects personal data, why they collect it, how long they keep it, and whether users can say no. In 2026, those questions are reaching more boardrooms, more product teams, and more agencies at once. (alston.com) (china-briefing.com)