Weekly briefing · November 10, 2026

EU withdrawal button is live; Chile and new AI bans are next

Two EU consumer rules already apply to anyone selling online to EU customers, and three dates land in the next few weeks: the EU AI Act bans on 2 December, Chile's privacy law on 1 December (a delay bill is pending) and India's consent-manager rules on 13 November. New US state privacy laws and a New York chatbot law start on 1 January 2027. Each item below says what to check in your own product.

1. New lawEuropean Union, Germany, France

   EU online shops need a withdrawal button

   Since 19 June 2026, Directive (EU) 2023/2673 (new Article 11a of the Consumer Rights Directive) requires traders to offer a withdrawal function online. It must be labelled "withdraw from contract here" (or something just as clear), stay available throughout the withdrawal period, lead to a short form and a "confirm withdrawal" step, and be followed by a confirmation on a durable medium such as email.

   What it means for your app: If you sell to EU consumers who have a right to withdraw, cancelling by emailing support is no longer enough on its own. The button is only needed where a withdrawal right exists, so digital content that the buyer agreed to start straight away can be an exception.

   Check: Log in as a customer and look for a withdrawal button that is easy to find, takes only a few fields and sends a confirmation email.

   Directive (EU) 2023/2673, EUR-Lex Free fix: Make subscriptions easy to understand and cancel Read more
2. New lawEuropean Union, Germany, France

   EU bans vague "eco-friendly" claims

   Directive (EU) 2024/825 has applied since 27 September 2026. Generic environmental claims such as "eco-friendly" or "green", sustainability labels that aren't based on a certification scheme or set by public authorities, and "carbon neutral" claims based on offsetting are now banned practices. So are misleading statements about software updates.

   What it means for your app: This reaches landing pages and app store copy. A "green hosting" or "carbon neutral" badge on your site is now a claim you have to be able to back with a recognised scheme.

   Check: Search your site and store listings for "eco", "green", "sustainable" and "carbon neutral", and check what stands behind each one.

   Directive (EU) 2024/825, EUR-Lex Read more
3. DeadlineEuropean Union, Germany, France

   New EU AI Act bans start 2 December

   Regulation (EU) 2026/1744 (the Digital Omnibus on AI, in force since 27 July 2026) adds two bans to Article 5 from 2 December 2026: AI that generates or manipulates realistic intimate images of an identifiable person without their explicit consent, and AI that generates child sexual abuse material. The same date ends the grace period for generative AI systems already on the market before 2 August 2026 to mark their output under Article 50(2).

   What it means for your app: If your app lets users generate or edit images or video of people, missing safeguards could put it in scope. If it generates text, images, audio or video, the output needs a machine-readable mark.

   Check: List every place your product generates or edits images of people, and note what blocks intimate or abusive requests and how outputs are marked.

   Regulation (EU) 2026/1744, EUR-Lex Free fix: Tell people when they're talking to AI Read more
4. DeadlineChile

   Chile's data law starts 1 December, a delay is pending

   Chile's data protection law (Law 21,719) is due to start on 1 December 2026. The Senate approved a bill to postpone it on 28 October 2026 and it is now in the Chamber of Deputies. Law firms report a new start of 15 October 2027, which we have not read in the bill text, so 1 December 2026 stands until a postponement is published.

   What it means for your app: If you have users in Chile, plan around 1 December and treat any delay as a bonus. The core work (privacy notice, legal basis, user rights, security) is the same either way.

   Check: Open your privacy notice and check it names the legal basis for each use of data and explains how a person in Chile can see, correct or delete theirs.

   Law 21,719, BCN LeyChile Free fix: Let people download their data Read more
5. DeadlineIndia

   India's consent-manager rules apply from 13 November

   Under the Digital Personal Data Protection Rules, 2025 (gazetted 13 November 2025), Rule 4 on registering and running consent managers applies one year later, on 13 November 2026. The main duties for businesses, such as notices, security and breach reporting, apply from May 2027.

   What it means for your app: Most start-ups won't run a consent manager, but the registered ones can start acting for Indian users. May 2027 is the date to build towards for notices, consent and breach reporting.

   Check: Check that your consent screens say what each use of data is for and that a user can withdraw consent as easily as they gave it.

   DPDP Rules 2025, Gazette of India (MeitY) Read more
6. New lawLouisiana, Oklahoma, Alabama

   Three more US state privacy laws: Louisiana, Oklahoma, Alabama

   Louisiana (Act 502) and Oklahoma (SB 546) apply from 1 January 2027, Alabama (HB 351) from 1 May 2027. Louisiana covers businesses with over $25 million in yearly revenue, or data on 75,000 or more consumers. Oklahoma sets 100,000 consumers, or 25,000 with over half of revenue from selling data. Alabama sets more than 25,000 consumers, or over 25% of revenue from selling data. Attorneys general enforce all three.

   What it means for your app: A growing app can cross these thresholds without noticing. All three give people rights to access, correct, delete and opt out of sale and targeted ads, and require a privacy notice and consent for sensitive data.

   Check: Count your users by state, and check your privacy notice and opt-out link work for residents of these states.

   Louisiana Act 502 (SB 386), enrolled text Free fix: Respect the Global Privacy Control signal Read more
7. New lawNew York

   New York limits AI chatbot features for minors from 1 January

   New York signed S.9051-B on 28 October 2026 (Article 48 of the General Business Law). From 1 January 2027, AI chatbots and companions available in New York can't use unsafe features with minors, such as posing as human, flattery or encouraging secrecy, and must check age using more than one method. The Attorney General can seek up to $25,000 per violation.

   What it means for your app: It covers general-purpose chatbots, not only companion apps. A support bot or AI tutor inside your product may be in scope if minors can use it.

   Check: If your product has a chatbot, check whether it can claim to be human, and whether you know or ask the age of people using it.

   Governor of New York, signing announcement Free fix: Tell people when they're talking to AI Read more
8. New lawUnited Kingdom

   UK subscription rules planned for 1 January 2027

   Draft Consumer Subscription Contracts (Cancellation and Information) Regulations 2026 were laid in October 2026. They would come into force on 1 January 2027 and apply to subscription contracts made on or after that date. They are still a draft until Parliament approves them.

   What it means for your app: If you sell subscriptions or free trials to UK customers, expect clearer pre-contract information, renewal reminders and an easy way to cancel. Wording may still change before the rules are made.

   Check: Walk through your trial and renewal flow: can someone cancel online in about as few steps as it took to sign up, and do you remind them before they are charged?

   Draft regulations, legislation.gov.uk Free fix: Make subscriptions easy to understand and cancel Read more

General information, not legal advice. Whether a rule applies depends on where you operate, who your users are and the size of your business.