The states bounced back from a somewhat quiet previous biweekly update with several noteworthy developments in the last two weeks. A total of five new state comprehensive privacy bills were introduced in Maine (LD 1224),...more
4/8/2025
/ Consumer Privacy Rights ,
Corporate Counsel ,
Data Privacy ,
Data Protection ,
Enforcement Authority ,
New Legislation ,
Privacy Laws ,
Proposed Legislation ,
Regulatory Requirements ,
State Attorneys General ,
State Privacy Laws
In a press release on March 10, 2025, California Attorney General (“California AG”) Rob Bonta announced an investigative sweep focusing on California Consumer Protection Act (“CCPA”) compliance within the location data...more
3/27/2025
/ California Consumer Privacy Act (CCPA) ,
Cookies ,
Data Collection ,
Enforcement Actions ,
Enforcement Priorities ,
Honda ,
Location Data ,
Opt-In ,
Opt-Outs ,
Privacy Laws ,
State Attorneys General ,
State Privacy Laws
On February 20, the Virginia legislature passed the High-Risk Artificial Intelligence Developer and Deployer Act (HB 2094), a bill that aims to prevent algorithmic discrimination by imposing requirements on businesses that...more
Generative AI continued to be a hot topic for privacy-related litigation in 2024. In the US, companies using and deploying this technology saw themselves subject to lawsuits under various state and federal theories of...more
3/7/2025
/ Artificial Intelligence ,
CIPA ,
Consumer Privacy Rights ,
Consumer Protection Laws ,
Corporate Counsel ,
Data Privacy ,
Federal Trade Commission (FTC) ,
Machine Learning ,
Pending Litigation ,
Privacy Laws ,
State Attorneys General ,
State Privacy Laws ,
Unfair or Deceptive Trade Practices ,
Wiretapping
On January 22, the New York state legislature passed Senate Bill S929, known as the New York Health Information Privacy Act (HIPA or the “Act”). The bill will next move to the New York governor for signature....more
On January 13, 2025, the California AG’s Office (“AGO”) issued two legal advisories regarding the application of existing California law to AI generally as well as the use of AI specifically in healthcare....more
1/30/2025
/ Artificial Intelligence ,
Automated Decision Systems (ADS) ,
Automated Systems ,
Data Privacy ,
Discrimination ,
Enforcement Actions ,
Health Care Providers ,
Health Insurance ,
Insurance Industry ,
Privacy Laws ,
State Attorneys General
State legislatures kept busy last year, passing seven new comprehensive privacy laws, and wrapping up 2024 with a total of nineteen state comprehensive laws imposed across the country....more
On January 13, 2025, the Texas Attorney General (AG) announced a lawsuit against insurance company Allstate, and its subsidiary, Arity, for allegedly collecting, using and selling the geolocation and movement of Texan...more
1/22/2025
/ Allstate ,
Consent ,
Consumer Privacy Rights ,
Data Collection ,
Data Privacy ,
Enforcement Actions ,
Geolocation ,
Personal Data ,
Privacy Laws ,
State Attorneys General ,
State Privacy Laws ,
Statutory Violations
2024 was another year of substantial legislative and regulatory advances at the international, federal, and state levels with regard to data protection law. Artificial intelligence (AI) regulation continued to hurdle forward...more
1/16/2025
/ Artificial Intelligence ,
Consumer Privacy Rights ,
Corporate Counsel ,
Data Privacy ,
Data Protection ,
Department of Justice (DOJ) ,
Enforcement Actions ,
EU ,
Federal Trade Commission (FTC) ,
New Legislation ,
Privacy Laws ,
Proposed Legislation ,
State Attorneys General ,
State Privacy Laws
On December 5, the Colorado AG’s Department of Law (“Department”) completed its most recent round of rulemaking and adopted a new set of rule amendments for the Colorado Privacy Act (“CPA”). On December 17, the adopted rules...more
On September 18, the Texas Attorney General (AG) announced a settlement agreement with Pieces Technologies, Inc. (“Pieces”), a Dallas-based healthcare artificial intelligence (AI) research and development firm, resolving...more
10/10/2024
/ Artificial Intelligence ,
Corporate Counsel ,
Enforcement Actions ,
False Statements ,
Hospitals ,
Med Tech ,
Misleading Statements ,
PHI ,
Research and Development ,
Settlement ,
State Attorneys General ,
Unfair or Deceptive Trade Practices
On June 18, the California Attorney General (“AG”) and Los Angeles City Attorney announced a settlement with Tilting Point Media, the maker of a mobile app game called “SpongeBob: Krusty Cook-Off,” resolving allegations that...more
6/28/2024
/ California Consumer Privacy Act (CCPA) ,
COPPA ,
Enforcement Actions ,
Online Safety for Children ,
Opt-In ,
Parental Consent ,
Popular ,
Privacy Policy ,
Settlement ,
State Attorneys General ,
Website Design
This post is part of a series of articles we are doing on 2023 data protection litigation trends.
While the California Consumer Privacy Act (CCPA) is most known for its onerous privacy compliance obligations, the law also...more
3/4/2024
/ California Consumer Privacy Act (CCPA) ,
Class Action ,
Consumer Privacy Rights ,
Corporate Counsel ,
Data Breach ,
Data Privacy ,
Data Protection ,
Enforcement Actions ,
Personal Information ,
Private Right of Action ,
Right To Cure ,
Security and Privacy Controls ,
State Attorneys General ,
Statutory Damages ,
U-Haul ,
Wells Fargo
On February 21, the California Attorney General (“AG”) announced a settlement with DoorDash, an online food delivery service, to resolve allegations that the company violated the California Consumer Privacy Act (CCPA) and...more
3/1/2024
/ Advertising ,
California Consumer Privacy Act (CCPA) ,
CalOPPA ,
Civil Monetary Penalty ,
Compliance ,
Consumer Privacy Rights ,
Data Selling ,
Data-Sharing ,
DoorDash ,
Enforcement Actions ,
Enforcement Priorities ,
Personal Information ,
Sephora ,
State Attorneys General ,
Statutory Violations ,
Stipulated Judgment ,
Third-Party
On February 1, Connecticut Attorney General (AG) William Tong released a report detailing the AG’s initial efforts to enforce the Connecticut Data Privacy Act (CTDPA or “the Act”) and providing recommendations on how the Act...more
2/13/2024
/ Consumer Privacy Rights ,
Data Privacy ,
Enforcement Authority ,
Enforcement Priorities ,
Gramm-Leach-Blilely Act ,
Health Insurance Portability and Accountability Act (HIPAA) ,
Information Reports ,
Privacy Policy ,
State Attorneys General ,
State Data Breach Notification Statutes ,
State Privacy Laws
This post is part of a series of articles we are doing on 2023 data protection litigation trends.
2023 saw a rise in class action litigation related to internet tracking technology employed by companies to enhance user...more
On January 8, 2024, the New Jersey Assembly and Senate passed Senate Bill 332 (S. 332, or the “Act”), and it was signed into law by Governor Phil Murphy on January 16. This makes New Jersey the first state to enact a...more
1/18/2024
/ California Consumer Privacy Act (CCPA) ,
California Privacy Rights Act (CPRA) ,
Data Processors ,
Data Protection ,
Effective Date ,
Enforcement ,
Enforcement Authority ,
Exemptions ,
Governor Murphy ,
Minors ,
New Legislation ,
Opt-Outs ,
Prior Express Consent ,
Privacy Laws ,
Sensitive Personal Information ,
State Attorneys General ,
State Privacy Laws
On June 30, 2023, the Washington Attorney General (AG) published a series of Frequently Asked Questions (FAQs) related to the My Health My Data Act (MHMDA). As we discussed previously, the MHMDA will impose new requirements...more
On February 17, 2023, the state attorneys general of Pennsylvania and Ohio reached a settlement with Ohio-based DNA Diagnostics Center (“DDC”) for a 2021 data breach that affected 2.1 million individuals nationwide and...more
2/23/2023
/ Clinical Laboratories ,
Cybersecurity ,
Data Breach ,
Electronic Protected Health Information (ePHI) ,
Enforcement Actions ,
Federal Trade Commission (FTC) ,
Health Care Providers ,
Health Insurance Portability and Accountability Act (HIPAA) ,
Laboratories ,
Material Misstatements ,
PHI ,
Settlement ,
State Attorneys General ,
Statutory Violations
On September 30, the Colorado Attorney General’s Office (“Colorado AG’s Office”) released proposed rules (the “Proposed Rules”) for the Colorado Privacy Act (CPA), which goes into effect on July 1, 2023. The Proposed Rules...more
On August 24, 2022, California Attorney General Rob Bonta (“CA AG”) announced a $1.2 million settlement with Sephora, Inc. (“Sephora”), marking the first announced enforcement action under the California Consumer Privacy Act...more
State Attorneys General settle with Wawa, Inc. for 2019 data breach that compromised approximately 34 million payment cards used by consumers.
On July 26, 2022, Acting New Jersey Attorney General Matthew J. Platkin...more
In the first of its kind “opinion” from the California Office of the Attorney General (“OAG”), the agency addressed the question of whether a consumer’s “right to know” what personal information a business holds about the...more
The California Consumer Privacy Act (CCPA) may seem like old news, especially now that Virginia and Colorado have also passed comprehensive privacy laws, but businesses must continue to pay attention to California if they...more
The Colorado AG recently provided guidance on data security best practices. Companies doing business in Colorado, especially those subject to the Colorado Privacy Act, should be paying attention to what is required under...more