On March 24, Virginia Governor Glenn Youngkin signed SB 754 into law. SB 754, which will take effect on July 1, 2025, amends the Virginia Consumer Protection Act (VCPA) to prohibit certain entities from, in connection with a...more
While March featured a flurry of newly introduced comprehensive privacy bills, state legislatures now appear to be primarily focused on pushing existing proposals through the chambers. ...more
4/21/2025
/ Consumer Privacy Rights ,
Corporate Counsel ,
Data Privacy ,
Data Protection ,
New Legislation ,
Personal Data ,
Personal Information ,
Privacy Laws ,
Proposed Amendments ,
Proposed Legislation ,
Regulatory Requirements ,
State Privacy Laws
One of the main risks for a company in the event of a data breach is the threat of litigation. Data breach litigation continued to proliferate in 2024, as it has in prior years....more
4/9/2025
/ Appellate Courts ,
Article III ,
Attorney-Client Privilege ,
Common Law Claims ,
Corporate Counsel ,
Damages ,
Data Breach ,
Injury-in-Fact ,
Negligence ,
Standing ,
TransUnion LLC v Ramirez
The states bounced back from a somewhat quiet previous biweekly update with several noteworthy developments in the last two weeks. A total of five new state comprehensive privacy bills were introduced in Maine (LD 1224),...more
4/8/2025
/ Consumer Privacy Rights ,
Corporate Counsel ,
Data Privacy ,
Data Protection ,
Enforcement Authority ,
New Legislation ,
Privacy Laws ,
Proposed Legislation ,
Regulatory Requirements ,
State Attorneys General ,
State Privacy Laws
The Telephone Consumer Protection Act is a major source of consumer privacy litigation against companies that engage in telemarketing. This past year, there was little change in the status quo of what constitutes an...more
4/4/2025
/ Advertising ,
Auto-Dialed Calls ,
Class Action ,
Consumer Privacy Rights ,
Facebook Inc v Duguid ,
Faxes ,
FCC ,
McLaughlin Chiropractic Associates Inc v McKesson Corporation ,
Robocalling ,
SCOTUS ,
TCPA ,
Telemarketing ,
Unsolicited Advertisements ,
Unsolicited Faxes
Claims relating to statements about artificial intelligence (“AI”) have rapidly become a focal point in securities litigation. Similar to the past surge of “greenwashing” claims tied to climate change disclosures, in 2024 we...more
4/1/2025
/ Artificial Intelligence ,
Initial Public Offering (IPO) ,
Misleading Statements ,
Misrepresentation ,
Pending Litigation ,
Publicly-Traded Companies ,
Rule 10b-5 ,
Securities Act of 1933 ,
Securities Exchange Act ,
Securities Fraud ,
Securities Litigation ,
Shareholders
In a press release on March 10, 2025, California Attorney General (“California AG”) Rob Bonta announced an investigative sweep focusing on California Consumer Protection Act (“CCPA”) compliance within the location data...more
3/27/2025
/ California Consumer Privacy Act (CCPA) ,
Cookies ,
Data Collection ,
Enforcement Actions ,
Enforcement Priorities ,
Honda ,
Location Data ,
Opt-In ,
Opt-Outs ,
Privacy Laws ,
State Attorneys General ,
State Privacy Laws
As we progress deeper into the 2025 legislative season, comprehensive privacy law proposals continue to progress through the legislative process. In the weeks since our last update, Kentucky amended its comprehensive data...more
3/24/2025
/ Consumer Privacy Rights ,
Consumer Protection Laws ,
Data Privacy ,
Data Protection ,
Enforcement Actions ,
New Legislation ,
Privacy Laws ,
Proposed Amendments ,
Proposed Legislation ,
Sensitive Personal Information ,
State Privacy Laws
On February 20, the Virginia legislature passed the High-Risk Artificial Intelligence Developer and Deployer Act (HB 2094), a bill that aims to prevent algorithmic discrimination by imposing requirements on businesses that...more
As the legislative season continues, some states, like Georgia and Oklahoma, have continued to progress in the efforts to establish a comprehensive data privacy law while others, such as Alabama, Illinois, and Massachusetts,...more
3/10/2025
/ Artificial Intelligence ,
Consumer Privacy Rights ,
Cybersecurity ,
Data Privacy ,
Data Protection ,
Fair Credit Reporting Act (FCRA) ,
FERPA ,
GLBA Privacy ,
Health Insurance Portability and Accountability Act (HIPAA) ,
Personal Data ,
Privacy Laws ,
State Privacy Laws
Generative AI continued to be a hot topic for privacy-related litigation in 2024. In the US, companies using and deploying this technology saw themselves subject to lawsuits under various state and federal theories of...more
3/7/2025
/ Artificial Intelligence ,
CIPA ,
Consumer Privacy Rights ,
Consumer Protection Laws ,
Corporate Counsel ,
Data Privacy ,
Federal Trade Commission (FTC) ,
Machine Learning ,
Pending Litigation ,
Privacy Laws ,
State Attorneys General ,
State Privacy Laws ,
Unfair or Deceptive Trade Practices ,
Wiretapping
In 2024, plaintiffs across the United States filed various class action cases related to web tracking technology employed by companies to enhance user experience on their websites and to improve the efficacy of their...more
2/26/2025
/ Advertising ,
Bots ,
California Consumer Privacy Act (CCPA) ,
CIPA ,
Class Action ,
Consumer Privacy Rights ,
Cybersecurity ,
Data Collection ,
Data Privacy ,
Legal History ,
Privacy Laws ,
State Privacy Laws ,
Web Tracking ,
Wiretap Act
Many state governments are in the thick of their legislative sessions and we continue to see a steady wave of comprehensive data privacy bills introduced. Most notably last week, Alabama representatives introduced HB 283...more
The first class action complaint was filed under Washington’s My Health My Data Act (“MHMDA”) on February 10, 2025, more than a year after the law’s passage. When the law passed in April 2023, MHMDA was novel for its broad...more
2/21/2025
/ Amazon ,
Biometric Information ,
Class Action ,
Consent ,
Consumer Privacy Rights ,
Data Collection ,
Data Privacy ,
Mobile Apps ,
Personal Information ,
PHI ,
Privacy Laws ,
Software ,
State Privacy Laws ,
Wiretapping
Illinois’s Biometric Information Privacy Act (BIPA) continues to drive a wave of privacy-related litigation across the United States, though a 2024 amendment to the act—the first since BIPA’s enactment in 2008—may slow the...more
2/20/2025
/ Amended Legislation ,
Biometric Information ,
Biometric Information Privacy Act ,
Class Action ,
Damages ,
Data Privacy ,
Data Protection ,
Exemptions ,
Litigation Strategies ,
PHI ,
Privacy Laws ,
Statutory Damages
The Video Privacy Protection Act (“VPPA”), a federal statute enacted in 1988, is gaining new relevance in recent years as plaintiffs bring lawsuits with the goal of enforcing online privacy rights. 2024 saw a continuation of...more
2/13/2025
/ Class Action ,
Consumer Privacy Rights ,
Data Collection ,
Data Privacy ,
Disclosure Requirements ,
Personally Identifiable Information ,
Privacy Laws ,
Privacy Policy ,
Third-Party Risk ,
Third-Party Service Provider ,
Tracking Systems ,
Video Privacy Protection Act ,
Web Tracking ,
Websites
So far into 2025, we continue to see productivity from state legislatures addressing consumer privacy, with 19 new state comprehensive privacy bills introduced across 10 state legislatures. It is still early in the...more
On January 22, the New York state legislature passed Senate Bill S929, known as the New York Health Information Privacy Act (HIPA or the “Act”). The bill will next move to the New York governor for signature....more
On January 13, 2025, the California AG’s Office (“AGO”) issued two legal advisories regarding the application of existing California law to AI generally as well as the use of AI specifically in healthcare....more
1/30/2025
/ Artificial Intelligence ,
Automated Decision Systems (ADS) ,
Automated Systems ,
Data Privacy ,
Discrimination ,
Enforcement Actions ,
Health Care Providers ,
Health Insurance ,
Insurance Industry ,
Privacy Laws ,
State Attorneys General
In the final days of the Biden Administration, the U.S. Department of Health and Human Services Office for Civil Rights (“HHS OCR”) remained active in resolving a large number of investigations, reflecting the agency’s...more
While the California Consumer Privacy Act (CCPA) is most known for its extensive privacy compliance obligations, the law also provides for a limited private right of action for certain security-related breaches....more
State legislatures kept busy last year, passing seven new comprehensive privacy laws, and wrapping up 2024 with a total of nineteen state comprehensive laws imposed across the country....more
On January 8, the Department of Justice (DOJ) published its final Rule implementing Executive Order 14117 (EO), “Preventing Access to Americans’ Bulk Sensitive Personal Data and United States Government-Related Data by...more
On January 13, 2025, the Texas Attorney General (AG) announced a lawsuit against insurance company Allstate, and its subsidiary, Arity, for allegedly collecting, using and selling the geolocation and movement of Texan...more
1/22/2025
/ Allstate ,
Consent ,
Consumer Privacy Rights ,
Data Collection ,
Data Privacy ,
Enforcement Actions ,
Geolocation ,
Personal Data ,
Privacy Laws ,
State Attorneys General ,
State Privacy Laws ,
Statutory Violations
2024 was another year of substantial legislative and regulatory advances at the international, federal, and state levels with regard to data protection law. Artificial intelligence (AI) regulation continued to hurdle forward...more
1/16/2025
/ Artificial Intelligence ,
Consumer Privacy Rights ,
Corporate Counsel ,
Data Privacy ,
Data Protection ,
Department of Justice (DOJ) ,
Enforcement Actions ,
EU ,
Federal Trade Commission (FTC) ,
New Legislation ,
Privacy Laws ,
Proposed Legislation ,
State Attorneys General ,
State Privacy Laws