Legal & Compliance — 2026年10月1日 月次レポート

On August 31, 2026, the FTC joined by 22 states filed suit against Amazon alleging deceptive and unfair practices through a secret ad surcharge scheme that inflated prices — the largest multi-state FTC action of the reporting period, extending the FTC's deception enforcement posture to platform-level pricing architecture [1].

On August 31, 2026, the European Commission designated ChatGPT as a Very Large Online Search Engine and Reddit and Roblox as Very Large Online Platforms under the Digital Services Act, extending enhanced DSA compliance obligations — including algorithmic transparency, risk assessments, and independent audits — to these platforms and establishing a template for how generative AI products may be regulated under the DSA framework [5].

On August 31, 2026, the SEC and CFTC adopted a joint final rule extending the 2024 Form PF amendments compliance date from October 1, 2026 to July 1, 2027, to allow consideration of a 2026 proposal that would modify or eliminate certain 2024 amendments. Private fund advisers should maintain implementation readiness as a fallback [10a].

As of September 11, 2026, manufacturers of products with digital elements are subject to mandatory incident reporting obligations under the EU Cyber Resilience Act: early warnings within 24 hours, full notifications within 72 hours, and final reports within 14 days or one month depending on incident type, submitted through ENISA's CRA Single Reporting Platform. Main substantive CRA obligations do not apply until December 11, 2027 [5b].

On September 9, 2026, the FTC rescinded the 2021 Policy Statement on Breaches by Health Apps and Other Connected Devices, continuing a pattern of policy statement withdrawals that narrows the FTC's enforcement theories alongside its August 7, 2026 announcement that it will no longer pursue disparate-impact discrimination claims [1].

On September 11, 2026, the Department of Justice completed the first-ever case before the United States Alien Terrorist Removal Court, removing an Afghan national after she conceded alien terrorist status — marking the operational activation of a previously dormant national security immigration enforcement mechanism [7].

On August 21, 2026, the Dutch Data Protection Authority announced a fine of €824,990,000 against Uber for infringing GDPR rules on solely automated decision-making affecting drivers — one of the largest GDPR enforcement actions recorded, signaling that GDPR Article 22 automated decision-making is a priority enforcement target for European data protection authorities [5].

On September 16, 2026, the SEC proposed rescinding Rule 14a-8, which has governed shareholder proposal rights for over 70 years, and reforming proxy solicitation rules. Commissioner Uyeda's statement confirmed the proposal would return shareholder proposal determinations to state law [4a]. Paul Weiss noted the rule will likely remain effective for most of the 2026-27 proxy season and that rescission could be challenged in courts [4h].

On September 17, 2026, the SEC issued an order creating time-limited exemptions for 'tokenized securities venues' (TSVs), enabling onchain trading of NMS stocks and exempting TSVs from the definition of 'exchange' under the Securities Exchange Act. The exemption is limited to five-year terms expiring September 17, 2031, requires permissioned access and OFAC compliance, is limited to AMM-based trading, and does not cover synthetic tokenization structures or decentralized protocols lacking an iden… 続きを読む

On September 17, 2026, the FTC announced three major enforcement outcomes: Amway and affiliates agreed to pay $225 million for unfair and deceptive MLM practices, FleetCor and its CEO agreed to pay $100 million for unauthorized fee charges, and Amazon agreed to accelerate and expand payments under its $2.5 billion Prime settlement — the largest single-week enforcement dollar volume of the current reporting period [1].

On September 17, 2026, Advocate General Spielmann opined in Groupe Canal+ (C-317/25) that consent for data use by unnamed 'partners' for direct marketing is invalid unless partner identities are known at the time of consent — a ruling with significant implications for data-sharing marketing arrangements across the EU [6].

The Irish Data Protection Commission announced on September 23, 2026 a €403,000,000 fine against Google following an inquiry into Google's processing of location data — one of the largest GDPR fines issued to date. The fine followed the EDPB's adoption of harmonized fining methodology on September 21, 2026, signaling that the harmonized methodology is already being applied in major enforcement actions [17].

The Delaware Court of Chancery issued Dodiya v. Franklin on August 26, 2026, the first opinion applying the 2025 DGCL Section 144 safe harbor amendments to a challenged merger. The court held both the director-approval and stockholder-vote safe harbors unavailable due to reckless process defects — specifically permitting a conflicted CEO to access transaction materials after his information leak was discovered — and a material proxy statement misstatement. Sidley Austin analysis confirmed the sa… 続きを読む

California enacted AB 1709 (signed September 10, 2026) restricting addictive features for users under 16 with civil penalties up to $50,000 per knowing violation per affected minor [5a]. The European Commission published a proposed EU KIDS Act on September 17, 2026 establishing tiered age-based access regimes and safety-by-design requirements for social media platforms [5c]. The simultaneous US state and EU legislative action creates a new cross-jurisdictional compliance obligation for platform … 続きを読む

Delaware Governor Matt Meyer signed House Bill 380 on September 2, 2026, significantly expanding the Delaware Personal Data Privacy Act effective January 1, 2027. The amendments lower the applicability threshold from 35,000 to 10,000 Delaware consumers, extend the Act to third parties that acquire personal data from controllers (a provision with no equivalent in other state consumer privacy laws), narrow the GLBA exemption, and add new profiling restrictions for job applicants and employees [5d]… 続きを読む

The OCC issued a new Cybersecurity Supervision Work Program bulletin on September 21, 2026, updating examiner guidance on cybersecurity assessment at OCC-supervised institutions. This followed the OCC's September 11 announcement of proposed revised third-party risk management guidance and an interagency statement on core service provider supervision for community banks — signaling that OCC examiners are being equipped with updated frameworks that will translate into more structured cybersecurity… 続きを読む

The European Data Protection Board adopted harmonized fining methodology and final guidelines on the interplay between the Digital Services Act and GDPR on September 21, 2026 [17]. The harmonized methodology was applied within two days in the Irish DPC's €403 million Google fine, signaling that GDPR enforcement is entering a more consistent and predictable — but also more aggressive — phase.

The Delaware Court of Chancery held in ATG Capital Opportunities Fund LP v. Lane that a board may not reject a director nomination notice based on disclosure requirements not explicitly stated in the corporation's advance notice bylaws. Vice Chancellor Will found that Empery Digital improperly rejected ATG Capital's nomination notice because the bylaws did not require disclosure of investor coordination or Bitcoin ETF short positions [4j].