Is this you? As a journalist, you can create a free Muck Rack account to customize your profile, list your contact preferences, and upload a portfolio of your best work.
Claim your profile
Articles by Elle Todd
Cancel culture: the small print arrives for the UK’s subscription rules
Some of this will feel familiar. The initial cooling-off period, durable-medium confirmations, and the digital content waiver build on the existing rules. The new risks lie in renewals, notices, and refunds. Full refunds for some breaches. Miss or botch a reminder and a customer who cancels may recover every payment made to you from the renewal payment linked to that failure, however much they’ve used your service (unless they sat on their hands for an unreasonably long time).
Proof of youth in the UK
On 29 October 2026, Ofcom announced four methods it considers capable of being highly effective age assurance (HEAA) to determine whether someone is over or under 16 years old. The purpose of this is to help inform the Government’s plan around the social media ban for U16s (see our previous article here for details of the proposals including in-scope services), with full implementation targeted for Spring 2027. What counts as HEAA according to Ofcom?
Reed Smith launches updated guide to AI in the entertainment & media industry
When Reed Smith first published the guide three years ago, many of the legal questions surrounding AI were only beginning to emerge. Since then, AI has moved quickly from emerging technology to widespread adoption across the entertainment & media industry, while the legal landscape has evolved significantly through new regulation, litigation and case law across multiple jurisdictions.
Data protection & privacy: European Union, United States & United Kingdom
The EU AI Act is now in force, with the AI Omnibus postponing high-risk requirements to December 2027 and August 2028, although Article 50 transparency obligations have applied since August 2026. The EDPB has confirmed legitimate interests may be available for AI training in appropriate cases, but only with a documented three-step assessment; its July 2026 draft guidelines on anonymisation and web scraping set out further practical standards and remain open for consultation until 30 October 2026.
Regulation of AI in the UK
Introduction Unlike the EU and some other parts of the world, the UK still does not have a single AI Act, with recent governments adhering to the pro-innovation, principles-based, and sector-led approach first set out in a 2023 white paper. AI continues to be regulated through existing laws: copyright, data protection, advertising, consumer protection, online safety, competition, and sector-specific rules. Those rules are applied by existing regulators rather than by one central AI regulator.
AI in film & television: From experimentation to industry standard
Authors Alex Mackay, Megan McWaters, Jamie Ryder, Elle Todd Authors Key takeaways AI is now embedded across the film and television production lifecycle, from script development to visual effects, localization, marketing, and all elements in between. The 2023 WGA and SAG-AFTRA agreements established the first comprehensive industry rules governing the use of generative AI, with informed consent, compensation, and human creative control at their core.
The EU KIDS Act has landed
The EU KIDS Act has landed On 17 September 2026, the European Commission published its proposal for the EU KIDS Act (the snappily named ‘Keeping Internet Digital Spaces Accountable and Trustworthy’ Act). The proposals are to restrict minors’ access to certain high-risk services and impose child-specific product-design rules across a range of digital products.
UK Major Minor Development
Governments around the world have been struggling with designing policies to protect minors from online harms for some time. We have seen a general shift now from protection of children in online spaces (with a focus on age-appropriate design and safety requirements focusing on assessments and governance and certain high risk elements) to prevention of children from accessing some of them.
Consent fatigue? ICO signals rethink of cookie rules for advertising
The Information Commissioner’s Office (ICO) has This builds on the recent changes already made to cookie rules under the Data (Use and Access) Act 2025, which softened rules on consent around certain analytics cookies but did not touch advertising cookies. What may be changing? Under regulation 6 PECR, organisations currently need consent to store or access information on a user’s device for advertising purposes, regardless of how that information is used.
UK Government gains a faster route to regulation on online safety for children
The UK Government has secured significant new powers to amend the Online Safety Act 2023 ("OSA") by way of secondary legislation, enabling it to move quickly, to impose restrictions on children's access to online services and restrict mobile phones in schools, similar to developments we have seen in other countries in recent years.
Online Safety: A comparison of key UK, EU, Singapore and UAE legislation
Three years on from our previous comparison of online safety provisions, we have taken the opportunity to update our comparison table. This table sets out a comparison between the European Union Digital Services Act (DSA), the UK’s Online Safety Act (OSA), the European Union Digital Markets Act (DMA), the UAE Child Digital Safety Law and the Singapore Broadcasting Act as of March 2026. To read the Online Safety Report, please download our PDF through the link below.
DMCC subscription rules delayed to spring 2027: Key takeaways from the consultation response
The Government has response to the public consultation on the hotly-debated subscription rules regime announced under the UK Digital Markets, Competition and Consumers Act 2024. New subscription rules are now expected to apply from Spring 2027, its second postponement, a full year after their original implementation date. A new renewal cooling-off right, which kicks in after free trials (and for some longer subscriptions contracts), cannot be waived.
UK Ramps Up Underage User Restrictions and Enforcement
The last two weeks have seen a flurry of activity in the UK concerning the processing of children’s data by certain online services. Not only have we seen the government launch of a pilot including blocks, time limits and curfews but we also saw the ICO and Ofcom publish a joint position paper on age assurance and 4Chan receive a fine for enabling child access to pornography.
PEGI launches “interactive risk categories”; overhauls age ratings for loot boxes, in-game spending, and communication features
In June 2026, PEGI’s new “interactive risk categories” will integrate monetisation mechanics, communication features, and engagement design into age classification framework for first time Games containing loot boxes will receive a minimum PEGI 16 rating; games with unrestricted communication features, PEGI 18, as UK and EU obligations develop in parallel Games companies should review monetisation, retention, and communication features now, ahead of PEGI’s implementation date in June
Reed Smith strengthens Entertainment & Media Industry Group in Paris with IP and IT partner Agathe Malphettes
With more than 15 years of experience, Malphettes brings extensive knowledge of intellectual property, IT law, cybersecurity, consumer law, and content regulation, with a strong international focus. Malphettes assists clients with the negotiation and drafting of complex IP and IT agreements.
European digital regulation: Key dates 2026
NIS2 (Germany) - 6 March 2026 The German NIS2 law will expand oversight of entities in critical sectors. Entities must register with the authority by 6 March 2026. Data Use and Access Act 2025 - 19 March 2026 UK Government required to publish a report on the use of copyright works in the development of AI systems and an economic impact assessment.
An audience with Ofcom on the UK Online Safety Act
With online safety being a hot regulatory topic, we were lucky to get some practical insights from three representatives of Ofcom, the UK regulator for online safety, at a recent in-person London event. The session was very helpful, including a demonstration of Ofcom’s new digital tool for compliance with illegal content safety duties.
European data protection board age assurance statement
Earlier this month, the European Data Protection Board (EDPB) dropped its latest statement on age assurance, listing 10 key principles to follow. The statement forms part of the EU Digital Services Act working group on child protection (see our latest Online Harms comparison table here).
UK Digital Markets, Competition and Consumers Act: Subscription and unfair commercial practice changes
Key takeaways Businesses need to carefully review their customer practices in light of new subscription rules and CMA’s enforcement powers New obligations around unfair practices aimed at cracking down on fake reviews and drip pricing As consumers we are now all too familiar with the importance of reviews and the convenience of subscription services, yet the frustration of uncovering hidden fees or grappling with subscription cancellations can be equally common.
Reed Smiths Adtech roundup Q1 2024
Find out more about Lexology or get in touch by visiting our About page. Register To view this article you need a PDF viewer such as Adobe Reader. If you can't read this PDF, you can view its text here. Go back to the PDF . As 2024 begins, we reflect on the past few months in the adtech world and look ahead to what this new year will bring.
2023 UK Data Protection and Privacy Case Law Update
Introduction 2023 was a tumultuous year in politics, global affairs and regulatory developments and we also saw various key new case law developments in data and privacy in the UK. This included one of the first cases to consider the “legal proceedings” exemption under the Data Protection Act 2018 and cases clarifying positions on representative actions and the calculation of damages in privacy and data proceedings.
Entertainment and Media Guide to AI: AI in the entertainment and media sector part 2- Gambling
Just as in the field of sports, the already data- and tech-rich domain of gambling has been exploring the increased use of AI for many years now, including use cases as diverse as fraud, player protection and profiling and personalization. In this section, we explore some of these trends and developments. AI has a significant presence in several areas of the gambling and sports betting industry, from addressing fraud and safety issues to use for automated betting and customer profiling.
Entertainment and Media Guide to AI:Legal issues of AI in the entertainment and media sector part 2-Data protection and privacy
Introduction Any discussion around privacy issues concerning AI quickly starts to read like an exam question in which potentially every single global worldwide privacy requirement comes into play for consideration. In many ways, privacy regulation is really put to the test with this rapidly developing technology, potentially even challenging whether it is appropriate for the job.
Webinar: European Data Strategies - A walk through new laws and bills
On Monday, January 29th, celebrate Global Data Protection Day with us as we bring you an exciting webinar highlighting the latest data protection laws and bills that might influence your business. Join Reed Smith attorneys Cynthia O’Donoghue, Elle Todd, Andreas Splittgerber, Aselle Ibraimova, Friederike Wilde-Detmering, Christian Leuthner, Joana Becker, and Florian Schwind and gain valuable insights and learn tips and tricks for successfully navigating the evolving landscape of data protection.
Consent requirements for targeted advertising compared
With new digital legislation in the EU adding to existing privacy rules and a flurry of decisions, the fundamental issue of when consent is and isn't required, is getting more confusing. In this attached simple comparison table we set out the different rules and explain the latest position. Click here to access the table
TCF 2.2 has arrived: what's changing?
In such a busy month with everyone focused on the latest with the EU AI Act, you may not have spotted that IAB Europe has launched its Transparency and Consent Framework 2.2. Readers will remember (read here to refresh your memory) that, back in February of last year, the adtech industry was rocked by a decision from the Belgian data protection regulator and many have been waiting to see what resulting changes this would bring.
Decoding dark pattern regulation
Whilst of course you won't find any laws with "dark pattern" in the title, regulators and governments around the world are nonetheless increasingly eager to be seen to legislate for them using a variety of rather ominous phrases and different legal routes. It's a complicated area spanning both existing and proposed rules and guidance across consumer, advertising, privacy and online harms regulations.
New Draft UK ICO Guidance on scope of the Children’s Code
The UK ICO's Age Appropriate Design Code (a.k.a the Children's Code) applies to all Information Society Service (ISS) providers that are “likely to be accessed by children in the UK”. This means an ISS cannot assume that the Code does not apply to them just because they don’t specifically direct or target the service at children, since they will still be caught where it is likely to be used by a significant number of children under the age of 18.
Digital Regulation key dates timeline - 2023
Digital regulations are constantly evolving, often making it difficult for international businesses to stay ahead of the game. Reed Smith brings you a timeline outlining key dates that you should be aware of in 2023 relating to digital regulatory updates across EU, UK, US and Asia. Timeline
Security, standards and scalability of data and privacy worldwide are patchy
Privacy law compliance has never been a simple task for the hospitality sector, with its large datasets of customers from all over the world, international operations, and marketing and loyalty programs. Many hospitality companies have invested millions in compliance efforts already. And as some laws reach maturity and others around the world are on the cusp of coming into force, what must the sector prioritize and focus on now?
EU-Cookie banner taskforce report: what you need to know
On the 18th of January, the EDPB published the adopted report of the work undertaken by the Cookie Banner Taskforce. The Cookie Banner Taskforce was established in September 2021 in accordance with article 70(1) (u) GDPR to coordinate the response to complaints concerning cookie banners filed with several supervisory authorities by the non-profit organization, NOYB, run by Max Schrems.
EU-Cookie banner taskforce report: what you need to know
On the 18th of January, the EDPB published the adopted report of the work undertaken by the Cookie Banner Taskforce. The Cookie Banner Taskforce was established in September 2021 in accordance with article 70(1) (u) GDPR to coordinate the response to complaints concerning cookie banners filed with several supervisory authorities by the non-profit organization, NOYB, run by Max Schrems.
Data, distress, and damage: UK data protection and privacy case law in 2022
As with our 2021 roundup, in this article we look beyond the fines and regulatory guidance to focus on the data protection and privacy developments in UK case law over the previous year. Whilst we may not have seen decisions as fundamental as 2021’s Lloyd v. Google [2021] UKSC 50 (Lloyd v.
Standard Confusing Clauses? | Lexology
By now, you can't have missed that the European Commission published two sets of new 'standard contractual clauses' (SCC) last week. They have now been published formally meaning that the existing international EU SCC can be used until 27 September 2021 and companies have until 27 December 2022 to move existing international EU SCC over.
Three years on from the implementation of the EU GDPR - Reed Smith tools and solutions to help with compliance
The EU General Data Protection Regulation (GDPR) came into effect on 25 May 2018. It became one of the leading pieces of legislation in the world to offer the highest levels of protection to the personal data of individuals. Many countries followed suit to raise the bar in how organisations handle personal data.
Comparing legal privilege when dealing with privacy issues in England and Wales and the United States
Skip to content
Schrems II: It is not all bad news for international data transfers
The Court of Justice of the European Union (CJEU) handed down its judgment on a case brought by privacy rights activist, Max Schrems (C-311/18, Data Protection Commissioner v. Facebook Ireland Limited, Maximillian Schrems) (Schrems II) yesterday, July 16, 2020. The case concerned the transfer of personal data to recipients in the United States via the EU Commission standard contractual clauses (SCCs) and questioned the validity of the EU-U.S. Privacy Shield (Privacy Shield).
Is GDPR Really a Two-Year Success Story?
Last month, the European Commission concluded that GDPR had been an “overall success” since its implementation two years ago, which I’m sure was a huge relief to a number of companies that have had to deal with the data privacy headaches over the last couples of years. Given the huge investment of resource from Member States, it might prove sensible to put on the brakes slightly as realistically, it’s just too early to tell whether GDPR has been a success.
In defense of Europe’s approach to AI
by Roch Glowacki and Elle Todd, Reed Smith 27 March 2020 Given its reputation as a regulatory trendsetter, it’s fair to say that the European Commission’s (EC) recent AI White Paper was highly anticipated, as a culmination of years of painstaking efforts to prove itself as an AI thought leader.
2020 could be a monumental year for adtech
With the California Consumer Privacy Act (CCPA) coming into effect on January 1 and the announcement on 14 January from Google that it will be phasing out third party cookies within the next two years, it seems that 2020 will be a significant year for the adtech industry as industry players react with solutions and strategies to adapt.
Key Points From The ICO's Draft Direct Marketing Code Of Practice
Mondaq Ltd requires you to register and provide information that personally identifies you, including your content preferences, for three primary purposes (full details of Mondaq’s use of your personal data can be found in our Privacy and Cookies Notice): Mondaq hopes that our registered users will support us in maintaining our free to view business model by consenting to our use of your personal data as described below. Mondaq has a "free to view" business model.
The ICO’s draft Direct Marketing Code of Practice: What you need to know
The UK Information Commissioner’s Office has published a draft Code of Practice on Direct Marketing, which is now out for consultation. Here we discuss the context for this and key takeaway points from its 120+ pages. Read more about this topic in our recent client alert.
Key takeaways from the ICO’s draft Direct Marketing Code of Practice
The UK Information Commissioner’s Office has published a draft Code of Practice on Direct Marketing, which is now out for consultation. Here we discuss the context for this and key takeaway points from its 120+ pages. Why is the ICO publishing this document? The ICO is required under the Data Protection Act 2018 to publish a statutory code of practice on direct marketing, so this is the ICO delivering on that requirement. It draws on the feedback from the call for views undertaken last year.
How to contend with new cookie rules and stay compliant
Even huge multi-nationals with large privacy teams struggle with the European rules around cookies – for SMEs, it’s a veritable minefield. There are so many questions to contend with: do you need a pop-up, how should it look, what precisely do you need opt-in consent for? It’s far from straightforward. Looking through examples on the internet can make it even more confusing for SMEs since there are so many different versions and approaches being used.
Are there any positives from the first year of GDPR?
The first anniversary of the General Data Protection Regulation (GDPR) arrives on 25 May 2019. Discussions about GDPR generally receive about as a positive a reception as Brexit, but are there any positives that companies can take after a year of living with the new rules? No one would suggest that preparing for GDPR was an easy or popular process. It wasn’t, and even consumers and regulators found it rather trying.
Low US GDPR opt in stats: you should see the EU ones! (via Passle)
As a free user, you can follow Passle and like posts. To repost this post to your own Passle blog, you will need to upgrade your account. For plans and pricing, please contact our sales team at sales@passle.net Sorry, you don't have permission to repost or create posts. Repost successful! Your repost is currently a draft. Review your repost and request approval. Something went wrong whilst reposting - please try again. Sorry - this is not an option.
Show More
loading
Actions
Is this you?
As a journalist, you can create a free Muck Rack account to customize your profile, list your contact preferences, and upload a portfolio of your best work.Get in touch with Elle
Contact Elle, search articles and posts on X, monitor coverage, and track replies from one place.
Learn more about Muck Rack