Alongside California and Colorado, Utah has emerged as one of the most active states in regulating the deployment and use of artificial intelligence ("AI"). Diverging from Colorado's approach, Utah first enacted laws in 2024...more
During the final days of the California legislative session, which ended on August 31, 2024, the California legislature passed several privacy bills, described below, that would amend the California Consumer Privacy Act...more
On September 4, 2024, the California Privacy Protection Agency ("CPPA") announced that it issued an Enforcement Advisory ("Advisory") providing guidance on how to avoid using prohibited "Dark Patterns" to obtain consent from...more
Last week, the California Legislature passed several bills that, if signed by the governor, will regulate how organizations develop, train, and use artificial intelligence (AI) models, systems, and applications. Of these...more
9/10/2024
/ Artificial Intelligence ,
Audits ,
Automated Decision Systems (ADS) ,
California ,
California Consumer Privacy Act (CCPA) ,
Compliance ,
Covered Providers ,
Cyber Attacks ,
Damages ,
Deep Fake ,
Disclosure Requirements ,
Employment Contract ,
Enforcement ,
Incident Response Plans ,
Machine Learning ,
Penalties ,
Proposed Legislation ,
Regulatory Reform ,
Reporting Requirements ,
Risk Assessment ,
Training ,
Transparency
In a major change to a law that produced extraordinarily high damages claims and settlements, the Illinois General Assembly amended the Biometric Information Privacy Act (BIPA) to substantially reduce potential liability for...more
On May 17, Colorado Governor Jared Polis signed into law the Colorado Artificial Intelligence Act (SB 205)("CAIA"), a measure passed out of the legislature on May 8 and now scheduled to become effective February 1, 2026. The...more
5/21/2024
/ Affirmative Defenses ,
Algorithms ,
Artificial Intelligence ,
Automated Decision Systems (ADS) ,
Bias ,
Corporate Counsel ,
Disclosure Requirements ,
Documentation ,
Duty to Report ,
Enforcement ,
Intellectual Property Protection ,
New Regulations ,
NIST ,
Risk Management ,
Transparency ,
Websites
Washington's My Health My Data Act (Act), which imposes substantial new obligations on the collection and use of broadly defined "consumer health data" (CHD), went into effect March 31, 2024. Everyone that conducts business...more
On January 16, 2024, New Jersey Governor Phil Murphy signed into law Senate Bill 322 ("the Act"), making New Jersey the fourteenth state to enact a comprehensive consumer data privacy law, joining California, Virginia,...more
1/23/2024
/ Advertising ,
Consumer Privacy Rights ,
COPPA ,
Data Protection ,
Enforcement Actions ,
FERPA ,
Governor Murphy ,
Gramm-Leach-Blilely Act ,
Health Insurance Portability and Accountability Act (HIPAA) ,
New Jersey ,
New Legislation ,
Online Safety for Children ,
Opt-Outs ,
Personal Information ,
PHI ,
Privacy Laws ,
State Privacy Laws
On November 27, 2023, the California Privacy Protection Agency (CPPA) released draft regulations mandating notice, opt-out, and information access requirements for companies using automated decision-making technology (ADMT)...more
12/8/2023
/ Artificial Intelligence ,
Automated Decision Systems (ADS) ,
Business Entities ,
California ,
California Consumer Privacy Act (CCPA) ,
California Privacy Rights Act (CPRA) ,
Criminal Justice Reform ,
Cybersecurity ,
Employer Liability Issues ,
Financial Services Industry ,
Healthcare ,
Machine Learning ,
New Rules ,
Notice Requirements ,
Opt-Outs ,
Regulatory Agenda ,
Technology Sector ,
Transparency
In January, we wrote about how new comprehensive state consumer data privacy laws, such as the California Consumer Privacy Act ("CCPA"), apply to healthcare providers. At the time five states had enacted such laws:...more
The U.S. District Court for the Northern District of Illinois, Eastern Division, issued an order on June 30, 2023, that may substantially alter the risk exposure for entities sued for violations of the Illinois Biometric...more
Oregon becomes the 12th state with a comprehensive consumer data privacy law -
The Oregon Consumer Privacy Act (OCPA) became law on July 18, 2023. Oregon is the twelfth state to enact a comprehensive consumer data privacy...more
7/20/2023
/ Consumers ,
Data Collection ,
Data Privacy ,
Data Protection ,
Data Protection Acts ,
Data Security ,
Legislative Agendas ,
New Legislation ,
New Regulations ,
Oregon ,
Personal Data ,
Privacy Laws ,
State and Local Government ,
State Privacy Laws
The Washington Attorney General's (AG's) office released an FAQ that clarifies some important provisions of Washington's new My Health My Data Act (HB 1155)(MHMD), which was signed into law by Governor Jay Inslee on April 27,...more
The Texas Data Privacy and Security Act (TDPSA) became law on June 16, 2023. Texas becomes the 11th state to enact a comprehensive consumer data privacy law, joining California, Virginia, Colorado, Connecticut, Utah, Iowa,...more
7/7/2023
/ Biometric Information ,
Compliance ,
Consent ,
Data Privacy ,
Data Protection ,
Data Security ,
Fair Credit Reporting Act (FCRA) ,
Health Insurance Portability and Accountability Act (HIPAA) ,
Non-Discrimination Rules ,
Notice Requirements ,
Opt-Outs ,
Popular ,
Private Right of Action ,
Reporting Requirements ,
SBA ,
Sensitive Personal Information ,
Small Business ,
State Privacy Laws ,
Texas
The Florida Digital Bill of Rights (FDBR) was signed into law by Governor Ron DeSantis on June 6, 2023, making Florida the tenth state to enact a consumer data privacy law along with California, Virginia, Colorado,...more
6/9/2023
/ Biometric Information ,
Consent ,
Consumer Privacy Rights ,
COPPA ,
Data Collection ,
Data Protection ,
Data Retention ,
Data Selling ,
Disclosure Requirements ,
Enforcement ,
Facial Recognition Technology ,
Florida ,
New Legislation ,
Notice Requirements ,
Opt-Outs ,
Personal Information ,
Privacy Laws ,
Rulemaking Process ,
Sensitive Personal Information ,
Social Media
On April 27, 2023, Washington Governor Jay Inslee signed into law the My Health My Data Act (the "Act"), which will regulate the collection, use, and disclosure of "consumer health data" ("Consumer Health Data" or "CHD"). The...more
5/2/2023
/ Business Associates ,
Covered Entities ,
Data Privacy ,
Data Protection ,
Data Security ,
Health Care Providers ,
Health Insurance Portability and Accountability Act (HIPAA) ,
OCR ,
Patient Privacy Rights ,
PHI ,
Private Right of Action