Keypoint: In its second non-data broker enforcement action for violations of the CCPA, the California Privacy Protection Agency entered into a stipulated final order with a retailer for a $345,178 administrative fine and...more
5/7/2025
/ California Consumer Privacy Act (CCPA) ,
California Privacy Protection Agency (CPPA) ,
Consent ,
Corporate Counsel ,
Data Collection ,
Enforcement Actions ,
Opt-Outs ,
Penalties ,
Personal Information ,
Privacy Laws ,
Retailers
Keypoint: If signed by the governor, the Arkansas bill will create new obligations for the collection and processing of personal information for Arkansas children and teens under 16 years of age, however, compliance may prove...more
Below is the thirteenth weekly update on the status of proposed state privacy legislation in 2025. As always, the contents provided below are time-sensitive and subject to change....more
Keypoint: It was a very active week with movement on numerous bills, in particular in Virginia, as well as new bills introduced across the country. Below is the fifth weekly update on the status of proposed state privacy...more
2/10/2025
/ Artificial Intelligence ,
Consumer Privacy Rights ,
Consumer Protection Laws ,
Data Brokers ,
Data Collection ,
Data Privacy ,
Data Protection ,
Minors ,
Online Safety for Children ,
Personal Data ,
Privacy Laws ,
Social Media ,
State Privacy Laws
Last week, the New York legislature passed the New York Health Information Privacy Act (S 929) (the “Act”). If signed into law, the Act will add New York to the list of states that have enacted consumer health data-specific...more
1/28/2025
/ Consumer Privacy Rights ,
Data Collection ,
Data Privacy ,
Data Protection ,
Department of Health and Human Services (HHS) ,
GLBA Privacy ,
Gramm-Leach-Blilely Act ,
Health Insurance Portability and Accountability Act (HIPAA) ,
New Legislation ,
New York ,
Privacy Acts ,
Privacy Laws ,
Regulatory Requirements ,
State Privacy Laws
On January 13, 2025, Texas Attorney General’s Office filed its first lawsuit enforcing the Texas Data Privacy and Security Act (“TDPSA”). The law went into effect on July 1, 2024. The complaint also states claims under Texas’...more
1/14/2025
/ Civil Monetary Penalty ,
Consent ,
Consumer Privacy Rights ,
Data Brokers ,
Data Collection ,
Data Privacy ,
Data Security ,
Data Sellers ,
Enforcement Actions ,
Geolocation ,
Insurance Industry ,
Personal Data ,
Privacy Laws ,
Right To Cure ,
Software Developers ,
State Attorneys General ,
State Privacy Laws ,
Texas ,
Third-Party
Keypoint: The proposed draft amendments modify the Colorado Privacy Act Rules to create a process for issuing opinion letters and interpretative guidance and to address the biometric and children’s privacy amendments passed...more
9/16/2024
/ Biometric Information ,
Colorado ,
Consent ,
Consumer Privacy Rights ,
Data Collection ,
Data Controller ,
Data Privacy ,
Minors ,
Opinion Letter ,
Proposed Amendments ,
State Privacy Laws
Keypoint: The appellate court ruled that the California Age-Appropriate Design Code Act’s impact assessment provision is unconstitutional and remanded the case back to the trial court to consider the constitutionality of the...more
8/21/2024
/ Appellate Courts ,
California ,
California Consumer Privacy Act (CCPA) ,
Corporate Counsel ,
Data Collection ,
Data Protection ,
Data Protection Impact Assessments (DPIAs) ,
First Amendment ,
Goods or Services ,
Impact Assessments ,
Minors ,
Online Marketplace ,
Popular ,
Unconstitutional Condition
Keypoint: Last week, Colorado passed children’s privacy and artificial intelligence bills, Vermont passed a consumer data privacy bill, Maryland’s consumer data privacy and AADC bills were signed into law, and Minnesota is on...more
5/13/2024
/ Artificial Intelligence ,
Biometric Information ,
Colorado ,
Consumer Privacy Rights ,
Cybersecurity ,
Data Brokers ,
Data Collection ,
Data Privacy ,
Data Protection ,
Legislative Agendas ,
Online Safety for Children ,
Privacy Laws ,
Proposed Legislation
Keypoint: In only its second public enforcement settlement, the California Attorney General announced a $375,000 fine along with injunctive relief.
On February 21, 2024, the California Attorney General announced that it had...more
Keypoint: It was a busy week for committee hearings as the 2024 session picked up speed heading into February.
Below is the second weekly update on the status of proposed state privacy legislation in 2024....more
2/5/2024
/ Biometric Information ,
Consumer Privacy Rights ,
Corporate Counsel ,
Data Brokers ,
Data Collection ,
Data Privacy ,
Data Protection ,
Health Insurance Portability and Accountability Act (HIPAA) ,
Online Safety for Children ,
Proposed Legislation ,
State Privacy Laws
Over the past few years, states have enacted numerous privacy laws, including broad consumer data privacy laws, children’s privacy laws, consumer health data privacy laws, and data broker laws. The enactment of so many...more
Keypoint: In the aftermath of the Supreme Court’s Dobbs decision, Washington legislators introduced legislation to enhance privacy protections for consumer health data.
In early March, lawmakers in Washington state’s House...more
3/13/2023
/ Biometric Information ,
California Consumer Privacy Act (CCPA) ,
Consumer Protection Act ,
Data Collection ,
Data-Sharing ,
Dobbs v. Jackson Women’s Health Organization ,
Families First Coronavirus Response Act (FFCRA) ,
Federal Trade Commission (FTC) ,
FERPA ,
GLBA Privacy ,
Health Care Providers ,
Health Insurance Portability and Accountability Act (HIPAA) ,
Personally Identifiable Information ,
Privacy Policy ,
SCOTUS
Keypoint: Last week lawmakers introduced a consumer privacy bill in Rhode Island and biometric privacy bills in Kentucky and Missouri; advanced consumer privacy bills out of committee in multiple states; and advanced a...more
2/27/2023
/ Algorithms ,
Automated Decision Systems (ADS) ,
Biometric Information ,
Corporate Counsel ,
Data Brokers ,
Data Collection ,
Data Privacy ,
Health Insurance Portability and Accountability Act (HIPAA) ,
Online Safety for Children ,
Proposed Legislation ,
State Privacy Laws
With state legislatures opening across the country, lawmakers in numerous states are introducing bills to regulate private entities’ processing of biometric information. These bills, many of which are similar to the Illinois...more
Update your bookmark, we just released our 2023 State Privacy Law Tracker. With state legislatures starting to open for the 2023 session, lawmakers are already introducing CCPA-like consumer privacy bills....more
Keypoint: As currently drafted, the ADPPA’s private right of action provides U.S. citizens with the opportunity to enforce their privacy rights but limits lawsuits to federal court and provides covered entities and service...more
8/2/2022
/ Arbitration Agreements ,
Consumer Privacy Rights ,
Cybersecurity ,
Data Collection ,
Data Privacy ,
Data Protection ,
Demand Letter ,
Federal Trade Commission (FTC) ,
Online Privacy Protection Act ,
Privacy Laws ,
Private Right of Action ,
Right To Cure
Keypoint: The California Privacy Protection Agency issued a first set of draft regulations that contain a number of notable provisions but do not address all of the CPRA’s rulemaking topics....more
5/31/2022
/ California Privacy Rights Act (CPRA) ,
Consent ,
Corporate Counsel ,
Data Collection ,
Draft Guidance ,
Notice of Proposed Rulemaking (NOPR) ,
Opt-Outs ,
Personal Information ,
Popular ,
Privacy Policy ,
Right to Delete ,
Sensitive Personal Information ,
Third-Party Service Provider
Keypoint: This week the Connecticut legislature passed a consumer data privacy bill.
Below is our sixteenth weekly update on the status of proposed state privacy legislation in 2022. Before we get to our update, we wanted...more
5/2/2022
/ Biometric Information ,
Consumer Privacy Rights ,
Corporate Counsel ,
Cybersecurity ,
Data Brokers ,
Data Collection ,
Data Privacy ,
Data Protection ,
Popular ,
Proposed Legislation ,
State Privacy Laws
Keypoint: This week the Connecticut Senate passed a consumer data privacy bill.
Below is our fifteenth weekly update on the status of proposed state privacy legislation in 2022. ...more
Keypoint: This week a new bill was introduced in Michigan; the Connecticut bill passed a second committee; Maryland and Kentucky legislatures adjourned without passing bills; Virginia Governor Youngkin signed three VCDPA...more
4/18/2022
/ Biometric Information ,
California Consumer Privacy Act (CCPA) ,
Consumer Privacy Rights ,
Cybersecurity ,
Data Brokers ,
Data Collection ,
Data Privacy ,
Data Protection ,
Popular ,
Proposed Legislation ,
State Privacy Laws
Keypoint: The VCDPA is now finalized in advance of its January 1, 2023 effective date.
On April 11, 2022, Virginia Governor Glenn Youngkin signed three Virginia Consumer Data Protection Act (VCDPA) amendment bills into...more
Keypoint: This week the Utah Governor signed the Utah Consumer Privacy Act, the Oklahoma House passed a bill, and a committee hearing was held in Rhode Island.
Below is our eleventh weekly update on the status of proposed...more
Keypoint: Starting in 2023, organizations that are subject to one or more of the laws will need to enter into contracts with recipients of personal information/data that address numerous statutory requirements....more
Keypoint: This week the Iowa House passed a bill, but it appears to have stalled in the Senate; Connecticut’s bill passed out of committee; Maryland advanced a work group bill out of the Senate and a biometric privacy bill...more
3/21/2022
/ Biometric Information ,
California Consumer Privacy Act (CCPA) ,
Consumer Privacy Rights ,
Corporate Counsel ,
Cybersecurity ,
Data Collection ,
Data Privacy ,
Data Protection ,
Popular ,
Proposed Legislation ,
State Privacy Laws