The Digital Politics Tracker: October 2026

WELCOME TO THIS MONTH'S SYNOPSIS of the primary regulatory, legal and government documents that drove digital policymaking in October.

Thanks for all the feedback on this project. I've somewhat changed this month's edition to structure the entries around specific thematic storylines. It's not perfect. But hopefully it will help you piece together what's going on, and where. I also added specific Digital Politics editions to each bucket of entries to help make sense of what's going on.

Just like September's edition, this month was another milestone of regulatory ambition shifting toward the daily grind of everyday oversight. Authorities are increasingly specifying who must act, what systems must change and how compliance must be tested.

The European Union clarified its AI enforcement responsibilities. Regulators in Australia and Singapore tested platform systems, while in the United States, courts and agencies imposed or proposed consequences ranging from a $25 billion Meta penalty to access obligations in digital advertising and online search.

Governments also treated AI compute, communications infrastructure, public procurement and cross-border data arrangements as security policy.

Consultations on cloud switching, NFC access, children’s privacy and Microsoft’s market status in the United Kingdom may eventually alter competitive or safety conditions. But they have not done so yet. Whether those mechanisms change markets, products or user experiences remains to be seen.

AI governance leaves the principles stage

October’s AI events were less about declaring broad principles, and more about constructing the machinery that makes oversight work.

Europe clarified enforcement responsibilities, cited a quality-management standard and advanced criteria for independent evaluators of systemic-risk models. The UK paired model testing with incident preparedness and a healthcare sandbox. Japan established a new governance council. International bodies supplied voluntary practices for finance, privacy and human-rights risk assessments.

These measures differed sharply in legal force. But they shared a practical emphasis: institutions, evaluators, reporting channels, standards and sector-specific controls. The uncertainty is whether this expanding policy governance stack will produce measurable changes in deployed systems.

Evidence

Related Digital Politics

• Rethinking how AI should be governed — Explains why oversight must extend from frontier-model development to AI systems operating in the real world.

Platform oversight starts testing systems — and imposing consequences

Platform regulation moved closer to observable oversight. Australian and Singaporean regulators tested gaming services and app stores, while the European Commission connected its scams investigations to a formal Booking.com enforcement proceeding.

Courts and regulators also produced concrete consequences: Stripchat’s VLOP designation under the EU's Digital Services Act survived judicial review; Ofcom narrowed, but continued, its X investigation; and a New Mexico court imposed a $25 billion civil penalty on Meta.

Children’s protections remained central across the EU, Brazil and Canada. The instruments ranged from audits and guidance to litigation and enforcement. But the common thread was away from abstract duties toward evidence about product design, age ratings, reporting systems, fraud controls and corporate claims.

Evidence

Related Digital Politics

• Social media’s financial crime blind spot — Documents how financial-scam content aimed at children persisted across major platforms despite existing safety commitments.
• Platform governance goes to court — Examines litigation as a faster route to platform accountability than slow-moving online-safety rulebooks.

Digital competition shifts to access remedies

Competition authorities increasingly focused on the terms under which rivals obtained access to digital infrastructure. U.S. plaintiffs proposed search-syndication licenses in the Google case, while the US Federal Trade Commission sought nondiscriminatory access and data firewalls in the Publicis–LiveRamp transaction.

The UK's Competition and Markets Authority proposed company-specific interventions for Microsoft’s business-software ecosystem and Apple’s NFC functionality. The Netherlands’ antitrust regulator addressed cloud computing switching and interoperability under the EU's Data Act. Japan opened a large survey of transactions involving intellectual property, know-how and data.

None of these actions proved competition has improved. But they showed regulators favoring operational remedies — licensing, interoperability, switching and access rules — over structural breakups.

Evidence

Related Digital Politics

• Finally, a transatlantic win on tech — Connects U.S. and European Google antitrust findings while explaining how geopolitics complicates aligned enforcement.
• Europe is building AI fortresses, not AI engines — Assesses the UK’s company-specific digital competition regime as an alternative to the EU’s broader rulebook.

Digital sovereignty moves into infrastructure and procurement

The US proposed tighter controls for cross-border communications and device-testing laboratories, disrupted China-linked hacking infrastructure and ordered DeepSeek products to be removed from federal civilian systems. The EU deepened cyber cooperation with Ukraine and adopted a declaration supporting shared AI capacity and reduced technological dependencies.

South Korea began a data-protection equivalence review of the UK, while the Organization for Economic Cooperation and Development treated AI compute as critical infrastructure requiring physical, cyber and supply-chain safeguards. The EU–Canada dialogue added secure connectivity and high-performance computing to bilateral cooperation.

These showed governments using procurement, certification, incident cooperation, data-transfer decisions and infrastructure policy to manage technology dependencies they increasingly viewed as security risks.

Evidence

Related Digital Politics

• Europe is building AI fortresses, not AI engines — Explains the gap between Europe’s sovereign-AI infrastructure ambitions and their practical economic value.

Election integrity becomes an operating partnership

Two October events showed election-integrity policy being translated into operating reality. An advisory committee the UK's online safety regulator assembled an evidence-based account of online information threats to elections. It then linked that assessment to the regulator’s wider online-safety functions. South Africa’s Electoral Commission established a working partnership with major technology companies ahead of the November local elections, including training, public awareness and a route for assessed complaints to reach platforms or the Electoral Court.

The approaches are different. But both treat information threats as a coordination problem spanning regulators, election authorities and private platforms.

Evidence

Related Digital Politics

• Public security meets disinformation threats — Argues that national security and online-safety institutions must coordinate against digital information threats while protecting rights.
• Foreign interference: fighting the last war — Challenges conventional foreign-interference responses that remain focused on yesterday’s tactics.

Other

The remaining developments do not form part of October’s thematic storylines. They included a UK information governance enforcement action involving the police's use of a third-party retail-crime platform and the Council of the European Union’s negotiating mandate for simplifying parts of the EU's digital rulebook.

Evidence

What to watch

• Nov. 4, 2026 — South Africa: Electoral Commission: Local elections will test the country's Electoral Commission's new disinformation partnership and complaint-referral arrangement with Google, Meta, Microsoft, TikTok and Moxii Africa. This is the first near-term test of the election-integrity coordination storyline. Source.
• Nov. 6, 2026 — Netherlands: Authority for Consumers and Markets: Responses close on ACM’s draft guidance covering cloud switching, interoperability and customer rights under the EU Data Act. The outcome will shape the access-remedies storyline. Source.
• Jan. 20, 2027 — Canada: Office of the Privacy Commissioner: Consultation closes on the draft Children’s Privacy Code. The responses will inform whether Canada turns broad children’s privacy principles into more specific organizational expectations. Source.