CyberEyeQ Weekly Briefing — July 9, 2026

Supreme Court clears app-store age checks as seven deadlines hit in three weeks

The Supreme Court declined to block Texas's app-store age-verification law on Monday, the first appellate green light for device-level age checks in the United States — even as a federal judge in Nebraska enjoined that state's parallel mandate days earlier. Meanwhile China quietly promulgated mandatory annual data-security risk assessments, the EDPB reset the anonymisation bar, and seven hard deadlines land between today and August 2.

← Last week's briefing

United Kingdom · Financial · Due: 15 Jul 2026

S.I. 2025/1154 brings deferred payment credit into scope of section 189 of the Consumer Credit Act 1974 from 15 July. Lenders need FCA authorisation or a temporary permission, must run upfront affordability and creditworthiness checks, and fall under the Consumer Duty, section 75 protections and Financial Ombudsman Service jurisdiction. The temporary-permissions notification window closed on 1 July.

Action: Confirm authorisation or temporary-permission status for every BNPL lending entity, and verify affordability, refund and complaints flows meet Consumer Duty outcomes on day one.

France · Privacy · Due: 14 Jul 2026

CNIL Deliberation 2026-042 gave organisations three months from the 14 April publication date to tell recipients whose email addresses were collected earlier that tracking pixels are in use, and to offer an easy means to object. That window closes on or about 14 July, after which CNIL says it will verify compliance through its inspection powers. Transactional email and individual deliverability measurement tied to a requested service remain exempt.

Action: Send a pixel-use notice with an easy objection route to every French contact collected before 14 April 2026, and classify each email stream as transactional, consented or marketing.

United States · Cloud Security · Due: 28 Jul 2026

Under the Consolidated Rules for 2026, in effect since 4 July, FedRAMP retires the "Ready" designation on 28 July and will accept no new Ready submissions after that date. Existing Ready holders must move through the Ready Conversion path; a Temporary Rev5 Program Certification pipeline opens 10 August for eligible Class B and Class C providers. The 20x Class A pipeline opens 3 August, and CR26 becomes mandatory for every offering on 1 January 2027.

Action: File any remaining FedRAMP Ready package before 28 July and confirm eligibility for the Ready Conversion or Lost Sponsor route.

🇨🇳 China — Two registry-level gaps closed at once. Order No. 24 (Network Data Security Risk Assessment Measures) was promulgated 18 June and takes effect 20 August. Separately, CAC reopened consultation on a rewrite of the Administrative Measures for Internet Information Services adding a dedicated "intelligent information services" section covering AI applications, algorithmic push and AI-agent distribution; comments close 2 August.

🇪🇺 European Union — The Council gave final adoption to the Digital Omnibus on AI on 29 June, deferring stand-alone Annex III high-risk duties to 2 December 2027 and embedded high-risk to 2 August 2028; Official Journal publication is still pending. The Commission also presented an EU Action Plan on Cybersecurity and AI on 7 July, tying advanced-model evaluation to AI Act market entry.

🇬🇧 United Kingdom — Ofcom must publish its first statutory report on the use and effectiveness of age assurance by 25 July under section 157 of the Online Safety Act, covering the first year of the child-safety duties. The register of categorised services is also expected around July, triggering risk-assessment duties for Category 1 and 2A providers on publication.

🇺🇸 United States — CMS published the CY 2027 OPPS/ASC proposed rule on 7 July, proposing to pay 340B-acquired drugs at ASP−33.4% — an estimated $4.55B cut to Original Medicare drug payment — with comments closing 31 August. The House passed the KIDS Act (H.R. 7757) 267–117 on 29 June, folding in a federal SCREEN Act age-verification requirement.

🇰🇷 South Korea — The amended Network Act took effect 7 July, imposing illegal-content management duties, semi-annual transparency reports and user objection rights on large-scale service providers, with punitive damages up to 5× actual harm. Korea's PIPA overhaul follows on 11 September, adding an aggravated-violation tier of up to 10% of total turnover.

China · Data Security

On 18 June 2026 the Cyberspace Administration of China, together with MIIT and the Ministry of Public Security, promulgated the Network Data Security Risk Assessment Measures as Order No. 24. The 25-article instrument was adopted at the CAC's 12th office meeting on 1 June and takes effect on 20 August 2026. It implements the Data Security Law and the Network Data Security Management Regulations, and it is the first Chinese instrument to convert "risk assessment" from a principle into a dated, filed, auditable annual obligation with a named consequence for failure.

The mechanics are specific. Article 5 requires every important-data processor to conduct a risk assessment once a year, and to re-assess promptly whenever a material component changes; general data processors are encouraged, not required, to assess at least once every three years. Article 16 requires the resulting report to be filed with the competent authority within 20 working days of completion, defaulting to the provincial or national cyberspace authority where no competent department has been designated. Article 15 sets a three-year minimum retention period for the reports.

Two provisions deserve more attention than they are getting. Article 12 bars the same assessor — or any of its affiliates — from performing more than three consecutive annual assessments, and Article 11 prohibits sub-delegating the work. Together they import an auditor-rotation logic borrowed from financial audit into data security, which means multinationals cannot simply retain one consultancy indefinitely and must build a bench. Article 19 supplies the enforcement edge: authorities may order remediation and, on refusal, suspend important-data processing entirely. That is not a fine — it is an operational kill switch, and it is the reason this rule outranks most of what else landed this week. The threshold question, and the one almost nobody has answered internally, is whether any of your PRC entities actually process "important data" under the applicable sectoral catalogue. Here is what organisations need to do about it…

🔒 This analysis continues for CyberEyeQ Pro subscribers. Contact Us →

United States · Regulatory Frontline

Nine days apart, the American judiciary said two different things about the same idea. On 27 June, Judge John Gerrard preliminarily enjoined the age-verification and parental-consent core of Nebraska's LB 383, holding it likely violated the First Amendment rights of users and platforms alike. On 6 July, the Supreme Court declined to vacate the Fifth Circuit's stay protecting Texas's SB 2420, leaving app-store age categorisation and parental consent enforceable while the constitutional challenge proceeds. The distinction the courts appear to be drawing is not about age verification in the abstract but about where in the stack it sits: a duty imposed on the app store or device layer, several steps removed from expressive content, is surviving scrutiny that identical duties imposed directly on social platforms are not. Utah's app-store regime took effect 6 May and Louisiana's follows on 1 July 2027; the House meanwhile passed H.R. 7757 on 29 June, 267–117, folding a federal SCREEN Act age check into a COPPA expansion. If the store-layer/platform-layer line holds, the compliance burden for 2027 lands squarely on Apple, Google and the developers who publish through them — and the platform-level statutes that dominated 2024–25 legislative sessions become the losing branch of the tree.

CyberEyeQ — Actionable Regulatory Intelligence. This newsletter is for informational purposes only and does not constitute legal advice.