In a press release on March 10, 2025, California Attorney General (“California AG”) Rob Bonta announced an investigative sweep focusing on California Consumer Protection Act (“CCPA”) compliance within the location data...more
3/27/2025
/ California Consumer Privacy Act (CCPA) ,
Cookies ,
Data Collection ,
Enforcement Actions ,
Enforcement Priorities ,
Honda ,
Location Data ,
Opt-In ,
Opt-Outs ,
Privacy Laws ,
State Attorneys General ,
State Privacy Laws
In 2024, plaintiffs across the United States filed various class action cases related to web tracking technology employed by companies to enhance user experience on their websites and to improve the efficacy of their...more
2/26/2025
/ Advertising ,
Bots ,
California Consumer Privacy Act (CCPA) ,
CIPA ,
Class Action ,
Consumer Privacy Rights ,
Cybersecurity ,
Data Collection ,
Data Privacy ,
Legal History ,
Privacy Laws ,
State Privacy Laws ,
Web Tracking ,
Wiretap Act
Many state governments are in the thick of their legislative sessions and we continue to see a steady wave of comprehensive data privacy bills introduced. Most notably last week, Alabama representatives introduced HB 283...more
The first class action complaint was filed under Washington’s My Health My Data Act (“MHMDA”) on February 10, 2025, more than a year after the law’s passage. When the law passed in April 2023, MHMDA was novel for its broad...more
2/21/2025
/ Amazon ,
Biometric Information ,
Class Action ,
Consent ,
Consumer Privacy Rights ,
Data Collection ,
Data Privacy ,
Mobile Apps ,
Personal Information ,
PHI ,
Privacy Laws ,
Software ,
State Privacy Laws ,
Wiretapping
The Video Privacy Protection Act (“VPPA”), a federal statute enacted in 1988, is gaining new relevance in recent years as plaintiffs bring lawsuits with the goal of enforcing online privacy rights. 2024 saw a continuation of...more
2/13/2025
/ Class Action ,
Consumer Privacy Rights ,
Data Collection ,
Data Privacy ,
Disclosure Requirements ,
Personally Identifiable Information ,
Privacy Laws ,
Privacy Policy ,
Third-Party Risk ,
Third-Party Service Provider ,
Tracking Systems ,
Video Privacy Protection Act ,
Web Tracking ,
Websites
On January 13, 2025, the Texas Attorney General (AG) announced a lawsuit against insurance company Allstate, and its subsidiary, Arity, for allegedly collecting, using and selling the geolocation and movement of Texan...more
1/22/2025
/ Allstate ,
Consent ,
Consumer Privacy Rights ,
Data Collection ,
Data Privacy ,
Enforcement Actions ,
Geolocation ,
Personal Data ,
Privacy Laws ,
State Attorneys General ,
State Privacy Laws ,
Statutory Violations
On December 3, 2024, the Federal Trade Commission (FTC) announced two enforcement actions against large data aggregator companies, Mobilewalla, Inc. (“Mobilewalla”) and Gravy Analytics Inc. (“Gravy Analytics”), for alleged...more
On October 24, 2024, the Supreme Judicial Court of Massachusetts issued its highly anticipated decision in Vita v. New England Baptist Hospital, rejecting a plaintiff’s attempt to pin Wiretap Act liability on two hospitals...more
Perhaps no use case better exemplifies the rapidly evolving privacy law landscape in the US than the legal framework surrounding companies’ use of cookies, pixels, and other web trackers.
Gone are the days where marketing...more
10/29/2024
/ Consumer Privacy Rights ,
Cookie Banners ,
Cookies ,
Data Collection ,
Data Privacy ,
Kohls ,
Privacy Laws ,
State Privacy Laws ,
VPPA ,
Web Tracking ,
Wiretapping
The Federal Trade Commission (FTC) has been actively flexing its authority as a privacy regulator in recent months. The agency has been especially focused on identifying data practices it views to be “unfair”, thereby...more
9/9/2024
/ Consent Order ,
Consumer Privacy Rights ,
Cookies ,
Data Collection ,
Data Privacy ,
Enforcement Actions ,
Federal Trade Commission (FTC) ,
FTC Act ,
Marketing ,
Misrepresentation ,
Security and Privacy Controls ,
Third-Party Service Provider ,
Web Browsers ,
Web Tracking
On March 11, the Kentucky Senate passed the Kentucky Consumer Data Protection Act (KCDPA or the “Act”) (House Bill 15) by a unanimous 35-0 vote. Upon House concurrence and the governor’s signature, the Act would become the...more
2023 was an active year for data protection-related litigation. Plaintiffs continued to advance creative theories of liability against businesses, using both older and more established privacy laws (such as the Telephone...more
On January 9, 2024, the Federal Trade Commission (FTC) issued its first ever prohibition on the use, sale and disclosure of sensitive location data against X- Mode Social and Outlogic (“X-Mode”), a location data broker. Only...more
2/12/2024
/ Data Brokers ,
Data Collection ,
Data Deletion ,
Data Processors ,
Data Retention ,
Enforcement Actions ,
Federal Trade Commission (FTC) ,
Informed Consent ,
Location Data ,
Location Privacy ,
Sensitive Personal Information
This post is part of a series of articles we are doing on 2023 data protection litigation trends.
2023 saw a rise in class action litigation related to internet tracking technology employed by companies to enhance user...more
This post is part of a series of articles we are doing on 2023 data protection litigation trends.
Since its enactment in 2008, Illinois’s Biometric Information Privacy Act (BIPA) has produced a wave of privacy-related...more
2/1/2024
/ Biometric Information ,
Biometric Information Privacy Act ,
Class Action ,
Compliance ,
Consent ,
Corporate Counsel ,
Data Collection ,
Data Privacy ,
Employer Liability Issues ,
Employment Litigation ,
Exemptions ,
Fingerprints ,
Health Care Providers ,
IL Supreme Court ,
PHI ,
Privacy Laws ,
Private Right of Action ,
State Privacy Laws ,
Statute of Limitations ,
Statutory Damages ,
Statutory Violations ,
Third-Party Liability
2023 marked a pivotal moment in US data privacy and cybersecurity, characterized by substantial regulatory and legislative advances at the international, federal, and state levels. The Federal Trade Commission (FTC) took a...more
1/8/2024
/ Artificial Intelligence ,
Breach Notification Rule ,
California Privacy Protection Agency (CPPA) ,
Compliance ,
Consumer Financial Protection Act (CFPA) ,
Consumer Financial Protection Bureau (CFPB) ,
Cybersecurity ,
Data Collection ,
Data Privacy ,
Data Security ,
Enforcement Authority ,
Gramm-Leach-Blilely Act ,
Health Insurance Portability and Accountability Act (HIPAA) ,
International Data Transfers ,
OCR ,
PHI ,
Rulemaking Process ,
Safeguards Rule ,
Securities and Exchange Commission (SEC) ,
State Privacy Laws
Earlier this year, Texas and Oregon each passed a data broker registration law, joining California and Vermont to double the number of states that have enacted such legislation. Texas Governor Greg Abbott signed SB 2105 into...more
Governor Gavin Newsom in California recently signed several bills into law that may have a significant impact on your company’s privacy compliance obligations. These new laws amend and build on existing California privacy...more
The Massachusetts Gaming Commission recently approved regulations to ensure data privacy and security for sports betters in the Commonwealth. On August 8, 2023, the commissioners approved 205 CMR 257, Sports Wagering Data...more
On June 27, the Federal Trade Commission (FTC) announced an enforcement action against Publishers Clearing House (PCH) in connection with the company’s long-running sweepstakes promotions. Though the FTC’s complaint alleges a...more
7/18/2023
/ Advertising ,
CAN-SPAM Act ,
Consumer Privacy Rights ,
Contests & Promotions ,
Data Collection ,
Data-Sharing ,
Enforcement Actions ,
Federal Trade Commission (FTC) ,
Misrepresentation ,
Personal Data ,
Privacy Policy ,
Sweepstakes ,
Targeted Digital Advertising
On June 30, the Delaware legislature passed the Personal Data Privacy Act (“the Act”). The Act now moves to the Delaware Governor’s desk for consideration and, if signed into law, will make Delaware the seventh state this...more
7/11/2023
/ Advertising ,
Advertising to Minors ,
Consumer Privacy Rights ,
Corporate Counsel ,
Data Collection ,
Data Controller ,
Data Privacy ,
Data Processors ,
Minors ,
Notice Requirements ,
Opt-Outs ,
Pending Legislation ,
Personal Data ,
Sensitive Personal Information ,
State Privacy Laws ,
Unfair or Deceptive Trade Practices
On June 5th, the Federal Trade Commission (FTC) announced a settlement with Microsoft over alleged violations of the Children’s Online Privacy Protection Act (COPPA) for its data practices involving its Xbox live product. ...more
6/21/2023
/ Amazon ,
Compliance ,
COPPA ,
Data Collection ,
Data Retention ,
Enforcement Actions ,
Federal Trade Commission (FTC) ,
Microsoft ,
Minors ,
Parental Consent ,
Personal Information ,
Popular ,
Xbox
On June 5, the Nevada state legislature passed an amended version of Senate Bill 370 (“SB 370”), a bill imposing new requirements on the collection, use, and sale of consumer health data. The bill has been delivered to...more
On May 28, 2023, the Texas legislature reached an agreement (by conference committee) on the Texas Data Privacy and Security Act (the Act), setting the stage for Texas to become the tenth state with a comprehensive privacy...more
On May 18, the Federal Trade Commission (FTC) issued a policy statement warning about the increased use of consumers’ biometric information and related marketing of technologies that use biometric information. The agency...more
5/23/2023
/ Biometric Information ,
Biometric Information Privacy Act ,
California Consumer Privacy Act (CCPA) ,
Data Collection ,
Data Privacy ,
Data Protection ,
Facial Recognition Technology ,
Federal Trade Commission (FTC) ,
FTC Act ,
Policy Statement ,
Protected Class ,
Section 5 ,
State Privacy Laws ,
Unfair or Deceptive Trade Practices