On April 21, 2025, Arkansas Gov. Huckabee Sanders signed the Arkansas Children and Teens' Online Privacy Protection Act (the Act) into law. Among other things, the Act prohibits operators of websites, online services, or apps...more
On June 2, 2025, Governor Murphy announced proposed regulations (the "Regulations") implementing and expanding on the requirements of the New Jersey Data Privacy Act (the "Act")...more
On June 2, Gov. Tina Kotek signed HB 2008 amending the Oregon Consumer Privacy Act (the Act) to increase protection both for personal data collected from consumers younger than 16 years of age and for all Oregonians' precise...more
Last May, Colorado Governor Jared Polis signed into law amendments to the Colorado Privacy Act ("CPA") that impose new obligations governing the collection, processing, retention, and disclosure of Coloradans' biometrics. The...more
On May 1, the California Privacy Protection Agency ("CPPA") board (the "Board") met to discuss revisions to proposed regulations relating to cybersecurity audits, risk assessments, and automated decision-making technologies...more
On April 22, 2025, the Federal Trade Commission ("FTC") published in the Federal Register its first major update to the Children's Online Privacy Protection Act Rule (the "COPPA Rule" or "Rule") since 2013. The COPPA Rule,...more
On May 10, 2024, Maryland Governor Wes Moore signed the Maryland Online Data Privacy Act of 2024 ("MODPA" or the "Act"), bringing the number of comprehensive state privacy laws to 18and establishing a new, more restrictive...more
5/16/2024
/ Consumer Privacy Rights ,
Data Privacy ,
Data Protection ,
Enforcement ,
Minor Children ,
Opt-Outs ,
Personal Data ,
PHI ,
Sensitive Personal Information ,
State Privacy Laws ,
Sunset Provisions
Legislation requires data brokers to register with the California Privacy Protection Agency and comply with a one-stop consumer deletion mechanism by 2026 -
The wave of data privacy legislation in California continues as...more
10/4/2023
/ Audits ,
California ,
California Privacy Protection Agency (CPPA) ,
Data Brokers ,
Data Deletion ,
Data Privacy ,
Data Protection ,
Data Security ,
Disclosure Requirements ,
Legislative Agendas ,
New Legislation ,
Personal Data ,
Regulatory Oversight ,
Reporting Requirements ,
State Legislatures
On Monday this week, Anna Gomez was formally sworn in as the FCC's fifth commissioner, bringing the Commission back to its full complement and giving Chairwoman Rosenworcel a third Democratic vote. The very next day,...more
Oregon becomes the 12th state with a comprehensive consumer data privacy law -
The Oregon Consumer Privacy Act (OCPA) became law on July 18, 2023. Oregon is the twelfth state to enact a comprehensive consumer data privacy...more
7/20/2023
/ Consumers ,
Data Collection ,
Data Privacy ,
Data Protection ,
Data Protection Acts ,
Data Security ,
Legislative Agendas ,
New Legislation ,
New Regulations ,
Oregon ,
Personal Data ,
Privacy Laws ,
State and Local Government ,
State Privacy Laws
The Texas Data Privacy and Security Act (TDPSA) became law on June 16, 2023. Texas becomes the 11th state to enact a comprehensive consumer data privacy law, joining California, Virginia, Colorado, Connecticut, Utah, Iowa,...more
7/7/2023
/ Biometric Information ,
Compliance ,
Consent ,
Data Privacy ,
Data Protection ,
Data Security ,
Fair Credit Reporting Act (FCRA) ,
Health Insurance Portability and Accountability Act (HIPAA) ,
Non-Discrimination Rules ,
Notice Requirements ,
Opt-Outs ,
Popular ,
Private Right of Action ,
Reporting Requirements ,
SBA ,
Sensitive Personal Information ,
Small Business ,
State Privacy Laws ,
Texas
The Connecticut legislature passed and the governor recently signed amendments to the Connecticut Data Privacy Act (CTDPA), the state's comprehensive consumer data privacy law, which goes into effect July 1, 2023. Some...more
7/3/2023
/ Confidential Information ,
Connecticut ,
Data Privacy ,
Email ,
Enforcement Actions ,
Minors ,
New Amendments ,
Personal Data ,
PHI ,
Sensitive Personal Information ,
Social Media
Montana is the ninth state to enact a comprehensive consumer data privacy law -
Montana Governor Greg Gianforte signed the Montana Consumer Data Privacy Act (MTCDPA) on May 19, 2023, after unanimous passage through the...more
INCDPA takes business-friendly approach to data privacy, following Virginia, Utah, and Iowa -
Indiana has become the seventh state to enact a "comprehensive" data privacy law, joining California, Virginia, Colorado,...more
On April 27, 2023, Washington Governor Jay Inslee signed into law the My Health My Data Act (the "Act"), which will regulate the collection, use, and disclosure of "consumer health data" ("Consumer Health Data" or "CHD"). The...more
5/2/2023
/ Business Associates ,
Covered Entities ,
Data Privacy ,
Data Protection ,
Data Security ,
Health Care Providers ,
Health Insurance Portability and Accountability Act (HIPAA) ,
OCR ,
Patient Privacy Rights ,
PHI ,
Private Right of Action
March 2023 was a consequential month for data privacy law. The California Office of Administrative Law (OAL) formally approved regulations issued by the California Privacy Protection Agency (CPPA) implementing the California...more
With the unanimous passage of Senate File 262 by the Iowa House and Senate and the Governor's signature Tuesday, the Hawkeye State joins California, Colorado, Connecticut, Virginia, and Utah as one of six states with a...more
3/31/2023
/ Consumer Privacy Rights ,
Corporate Counsel ,
Cybersecurity ,
Data Collection ,
Data Privacy ,
Data Protection ,
Data Security ,
New Legislation ,
Personal Information ,
Privacy Laws ,
Regulatory Reform ,
State Data Breach Notification Statutes ,
State Data Privacy Laws
The California Privacy Protection Agency ("CPPA" or "Agency") is seeking preliminary comments on proposed rulemaking for risk assessments and cybersecurity audits for higher-risk data processing activities, and consumer...more
The Colorado Attorney General's Office has published its much-anticipated proposed rules (Proposed Rules) implementing the Colorado Privacy Act (CPA), which, as we discussed in an earlier blog post, was enacted on July 7,...more
The Office of the California Attorney General (OAG) announced on August 24, 2022, a settlement with Sephora, Inc., as part of a recent enforcement sweep of online retailers. OAG alleged Sephora violated the California...more
The Federal Trade Commission (FTC) may have just taken its first steps towards the creation of generally applicable federal privacy and security rules. On Aug. 11, 2022, the FTC published an advance notice of proposed...more
Following the U.S. Supreme Court's decision in Dobbs v. Jackson Women's Health Organization overruling Roe v. Wade, businesses and organizations that process personal data—including those outside the health or reproductive...more
The California Privacy Protection Agency Board (the "CPPA Board") announced on May 27, 2022, that it would hold a public meeting on June 8 to discuss, among other things, a set of detailed proposed regulations to "Implement,...more
6/6/2022
/ California Consumer Privacy Act (CCPA) ,
Consumer Privacy Rights ,
Cybersecurity ,
Data Collection ,
Data Privacy ,
Data Protection ,
Data Security ,
Opt-Outs ,
Personal Information ,
Proposed Regulation ,
State Privacy Laws
Late last month, after two years of negotiation, the Connecticut legislature passed an omnibus data privacy bill, which the governor signed this week, making Connecticut the fifth state to enact comprehensive privacy...more
Update March 31, 2022: Utah Governor Spencer Cox signed the bill into law March 24, 2022.
With passage of the Utah Consumer Privacy Act (UCPA), Utah will become the fourth state to adopt omnibus consumer privacy...more