Last week, the California Legislature passed several bills that, if signed by the governor, will regulate how organizations develop, train, and use artificial intelligence (AI) models, systems, and applications. Of these...more
9/10/2024
/ Artificial Intelligence ,
Audits ,
Automated Decision Systems (ADS) ,
California ,
California Consumer Privacy Act (CCPA) ,
Compliance ,
Covered Providers ,
Cyber Attacks ,
Damages ,
Deep Fake ,
Disclosure Requirements ,
Employment Contract ,
Enforcement ,
Incident Response Plans ,
Machine Learning ,
Penalties ,
Proposed Legislation ,
Regulatory Reform ,
Reporting Requirements ,
Risk Assessment ,
Training ,
Transparency
On June 7, 2024, the New York Legislature passed two bills to protect children online. The Stop Addictive Feeds Exploitation (SAFE) for Kids Act, S7694A, prohibits social media platforms from providing defined "addictive...more
6/27/2024
/ Civil Monetary Penalty ,
COPPA ,
Damages ,
Data Collection ,
Data Selling ,
Data-Sharing ,
Enforcement ,
Minor Children ,
New Legislation ,
New York ,
Notification Requirements ,
Online Safety for Children ,
Parental Consent ,
Personal Data ,
Privacy Laws ,
Rulemaking Process ,
State Bans ,
State Privacy Laws ,
Third-Party
On May 25, 2024, Minnesota Governor Tim Walz signed the Minnesota Consumer Data Privacy Act (the "Act"), which takes effect on July 31, 2025, for most controllers and on July 31, 2029, for certain postsecondary educational...more
6/5/2024
/ Consumer Privacy Rights ,
COPPA ,
Data Collection ,
Data Controller ,
Data Protection ,
Data Security ,
Data Selling ,
Enforcement ,
Fair Credit Reporting Act (FCRA) ,
Gramm-Leach-Blilely Act ,
Health Insurance Portability and Accountability Act (HIPAA) ,
New Legislation ,
Opt-Outs ,
Personal Data ,
PHI ,
State Privacy Laws ,
Targeted Digital Advertising
On May 17, 2024, Virginia Governor Glenn Youngkin signed SB 361/HB 707 amending the Virginia Consumer Data Protection Act ("VCDPA") to provide heightened protections to consumers under 18 years of age, not just those under...more
6/3/2024
/ COPPA ,
Data Collection ,
Data Protection ,
Data Selling ,
Geolocation ,
Minor Children ,
Parental Consent ,
Personal Data ,
Privacy Laws ,
State Privacy Laws ,
Targeted Digital Advertising
On May 10, 2024, Maryland Governor Wes Moore signed the Maryland Online Data Privacy Act of 2024 ("MODPA" or the "Act"), bringing the number of comprehensive state privacy laws to 18and establishing a new, more restrictive...more
5/16/2024
/ Consumer Privacy Rights ,
Data Privacy ,
Data Protection ,
Enforcement ,
Minor Children ,
Opt-Outs ,
Personal Data ,
PHI ,
Sensitive Personal Information ,
State Privacy Laws ,
Sunset Provisions
On January 16, 2024, New Jersey Governor Phil Murphy signed into law Senate Bill 322 ("the Act"), making New Jersey the fourteenth state to enact a comprehensive consumer data privacy law, joining California, Virginia,...more
1/23/2024
/ Advertising ,
Consumer Privacy Rights ,
COPPA ,
Data Protection ,
Enforcement Actions ,
FERPA ,
Governor Murphy ,
Gramm-Leach-Blilely Act ,
Health Insurance Portability and Accountability Act (HIPAA) ,
New Jersey ,
New Legislation ,
Online Safety for Children ,
Opt-Outs ,
Personal Information ,
PHI ,
Privacy Laws ,
State Privacy Laws
Legislation requires data brokers to register with the California Privacy Protection Agency and comply with a one-stop consumer deletion mechanism by 2026 -
The wave of data privacy legislation in California continues as...more
10/4/2023
/ Audits ,
California ,
California Privacy Protection Agency (CPPA) ,
Data Brokers ,
Data Deletion ,
Data Privacy ,
Data Protection ,
Data Security ,
Disclosure Requirements ,
Legislative Agendas ,
New Legislation ,
Personal Data ,
Regulatory Oversight ,
Reporting Requirements ,
State Legislatures
On Monday this week, Anna Gomez was formally sworn in as the FCC's fifth commissioner, bringing the Commission back to its full complement and giving Chairwoman Rosenworcel a third Democratic vote. The very next day,...more
The CPPA kicked off a first round of rulemaking in May 2022 and finalized that set of rules in March of this year. At the latest California Privacy Protection Agency (CPPA) meeting, the CPRA Rules Subcommittee (Rules...more
8/18/2023
/ Artificial Intelligence ,
Audits ,
Automated Systems ,
California ,
California Privacy Protection Agency (CPPA) ,
California Privacy Rights Act (CPRA) ,
Criminal Justice Reform ,
Cybersecurity ,
Machine Learning ,
New Regulations ,
Personal Information ,
Popular ,
Privacy Laws ,
Risk Assessment ,
Rulemaking Process
Oregon becomes the 12th state with a comprehensive consumer data privacy law -
The Oregon Consumer Privacy Act (OCPA) became law on July 18, 2023. Oregon is the twelfth state to enact a comprehensive consumer data privacy...more
7/20/2023
/ Consumers ,
Data Collection ,
Data Privacy ,
Data Protection ,
Data Protection Acts ,
Data Security ,
Legislative Agendas ,
New Legislation ,
New Regulations ,
Oregon ,
Personal Data ,
Privacy Laws ,
State and Local Government ,
State Privacy Laws
The Texas Data Privacy and Security Act (TDPSA) became law on June 16, 2023. Texas becomes the 11th state to enact a comprehensive consumer data privacy law, joining California, Virginia, Colorado, Connecticut, Utah, Iowa,...more
7/7/2023
/ Biometric Information ,
Compliance ,
Consent ,
Data Privacy ,
Data Protection ,
Data Security ,
Fair Credit Reporting Act (FCRA) ,
Health Insurance Portability and Accountability Act (HIPAA) ,
Non-Discrimination Rules ,
Notice Requirements ,
Opt-Outs ,
Popular ,
Private Right of Action ,
Reporting Requirements ,
SBA ,
Sensitive Personal Information ,
Small Business ,
State Privacy Laws ,
Texas
The Connecticut legislature passed and the governor recently signed amendments to the Connecticut Data Privacy Act (CTDPA), the state's comprehensive consumer data privacy law, which goes into effect July 1, 2023. Some...more
7/3/2023
/ Confidential Information ,
Connecticut ,
Data Privacy ,
Email ,
Enforcement Actions ,
Minors ,
New Amendments ,
Personal Data ,
PHI ,
Sensitive Personal Information ,
Social Media
The final regulations implementing the California Privacy Rights Act of 2020 (CPRA) were set to go into effect on July 1, 2023. However, the Sacramento County Superior Court issued a ruling enjoining the California Privacy...more
The Florida Digital Bill of Rights (FDBR) was signed into law by Governor Ron DeSantis on June 6, 2023, making Florida the tenth state to enact a consumer data privacy law along with California, Virginia, Colorado,...more
6/9/2023
/ Biometric Information ,
Consent ,
Consumer Privacy Rights ,
COPPA ,
Data Collection ,
Data Protection ,
Data Retention ,
Data Selling ,
Disclosure Requirements ,
Enforcement ,
Facial Recognition Technology ,
Florida ,
New Legislation ,
Notice Requirements ,
Opt-Outs ,
Personal Information ,
Privacy Laws ,
Rulemaking Process ,
Sensitive Personal Information ,
Social Media
On May 18, 2023, the Federal Trade Commission (FTC) issued a policy statement warning that the proliferation of technologies that use or claim to use biometric information may bring risks with regard to consumer privacy and...more
6/2/2023
/ Biometric Information ,
Data Collection ,
Data Security ,
Deep Fake ,
Facial Recognition Technology ,
Federal Trade Commission (FTC) ,
Fingerprints ,
FTC Act ,
Innovative Technology ,
Section 5 ,
Unfair or Deceptive Trade Practices
Montana is the ninth state to enact a comprehensive consumer data privacy law -
Montana Governor Greg Gianforte signed the Montana Consumer Data Privacy Act (MTCDPA) on May 19, 2023, after unanimous passage through the...more
The Tennessee Information Protection Act (TIPA) passed unanimously through both houses of the Tennessee legislature and was signed by Governor Bill Lee on May 11, 2023. Tennessee joins seven states in enacting a comprehensive...more
5/16/2023
/ Biometric Information ,
Consumer Privacy Rights ,
Controlled Substances Act ,
COPPA ,
Fair Credit Reporting Act (FCRA) ,
FERPA ,
Gramm-Leach-Blilely Act ,
HCQIA ,
Health Insurance Portability and Accountability Act (HIPAA) ,
HITECH Act ,
New Legislation ,
NIST ,
Noncompliance ,
Personal Information ,
State Privacy Laws ,
Title V
INCDPA takes business-friendly approach to data privacy, following Virginia, Utah, and Iowa -
Indiana has become the seventh state to enact a "comprehensive" data privacy law, joining California, Virginia, Colorado,...more
On April 27, 2023, Washington Governor Jay Inslee signed into law the My Health My Data Act (the "Act"), which will regulate the collection, use, and disclosure of "consumer health data" ("Consumer Health Data" or "CHD"). The...more
5/2/2023
/ Business Associates ,
Covered Entities ,
Data Privacy ,
Data Protection ,
Data Security ,
Health Care Providers ,
Health Insurance Portability and Accountability Act (HIPAA) ,
OCR ,
Patient Privacy Rights ,
PHI ,
Private Right of Action
March 2023 was a consequential month for data privacy law. The California Office of Administrative Law (OAL) formally approved regulations issued by the California Privacy Protection Agency (CPPA) implementing the California...more
With the unanimous passage of Senate File 262 by the Iowa House and Senate and the Governor's signature Tuesday, the Hawkeye State joins California, Colorado, Connecticut, Virginia, and Utah as one of six states with a...more
3/31/2023
/ Consumer Privacy Rights ,
Corporate Counsel ,
Cybersecurity ,
Data Collection ,
Data Privacy ,
Data Protection ,
Data Security ,
New Legislation ,
Personal Information ,
Privacy Laws ,
Regulatory Reform ,
State Data Breach Notification Statutes ,
State Data Privacy Laws
The California Privacy Protection Agency ("CPPA" or "Agency") is seeking preliminary comments on proposed rulemaking for risk assessments and cybersecurity audits for higher-risk data processing activities, and consumer...more
The Colorado Attorney General's Office has published its much-anticipated proposed rules (Proposed Rules) implementing the Colorado Privacy Act (CPA), which, as we discussed in an earlier blog post, was enacted on July 7,...more
On August 29, 2022, the Federal Trade Commission (FTC) announced it had filed a complaint in Idaho federal district court against Kochava Inc., a data broker, seeking injunctive relief on account of alleged violations of...more
The Office of the California Attorney General (OAG) announced on August 24, 2022, a settlement with Sephora, Inc., as part of a recent enforcement sweep of online retailers. OAG alleged Sephora violated the California...more