Here you can read some articles on Italian and international privacy, cybersecurity and data protection issues drafted by either Giulio Coraggio or the other authors of GamingTechLaw.
The EDPB consultation on the anonymisation and web scraping guidelines closes on 30 October 2026, and the companies with most at stake are those already relying on de-identified datasets or on scraped training data, because the final text will become the benchmark supervisory authorities apply when those datasets are challenged.
The new tracking pixel rules adopted by the Italian data protection authority become binding on 29 October 2026, requiring prior consent for the invisible images that report when a marketing email is opened, and companies that have not rebuilt their consent, withdrawal and identifier design by that date will be exposed to an authority that can verify the breach from outside the company, simply by receiving one of their emails.
When your own company’s AI agent is hacked, who is liable for what happens next? This is a question I expect to hear much more often as companies give AI agents access to internal systems, business applications, customer data and, increasingly, the ability to take actions without a human approving every step.
A cyber attack during holidays is not a harder technical problem than one in March, it is a harder decision-making problem. The systems fail in the same way, the forensics follow the same method, and the regulatory clocks run at the same speed. What changes is that the people named in the incident response plan are unreachable, the supplier that caused the incident is running on a skeleton crew, and whoever happens to be at the desk usually believes they have no authority to act.
