Massachusetts lawmakers are working to pass a long-awaited comprehensive data privacy law in the current legislative session. After years of debating and tabling different versions of Massachusetts-specific data privacy...more
Vermont’s new privacy law uses low applicability thresholds—pulling in companies that are not currently in scope under most state laws—while layering in new obligations around AI, profiling, health data and more....more
We have now had a bit of time to work with clients on the new Colorado Automated Decision-Making Technology in Consequential Decisions Bill (SB 26-189) (ADMT law” — replacing the CO AI Act). The sausage making and...more
On 15 May 2026, the UK Information Commissioner's Office (the ICO) updated both its brief guidance on using children's personal data (the Brief Guidance) and its detailed Children and the UK GDPR guidance (the Detailed...more
This edition of Hinshaw’s Privacy, Cyber, and AI Decoded highlights several newly enacted pieces of legislation in 2026 that businesses and our clients should include in their growing list of compliance planning, along with...more
The protection of children online, including the safeguarding of their personal data, has emerged as a key regulatory focus in the UK, with the Government facing sustained pressure to address concerns about children’s safety...more
The 2026 legislative cycle reveals that state privacy law is diverging along partisan lines. Red-state legislatures are pursuing frameworks that retain the Virginia architecture while easing compliance burdens through broader...more
Just over a year after Delaware’s privacy law took effect, state lawmakers are close to expanding its reach by passing a bill that could soon cover more businesses, narrow a key exemption, and expand the definition of...more
On May 29, 2026, Vermont’s legislature passed S71, the Vermont Data Privacy and Online Surveillance Act (the Act). The Act is now pending Vermont Governor Phil Scott’s signature....more
Effective July 1, 2026, the CTDPA’s existing applicability thresholds are reduced, resulting in the CTDPA covering businesses processing personal data of at least 35,000 Connecticut residents or selling personal data of at...more
Key point: Louisiana becomes the 22nd state — and third this year — to enact a consumer data privacy law, adopting a law similar to Texas’ law. On May 29, 2026, Louisiana Governor Jeff Landry signed the Louisiana Data...more
State privacy law continues to move quickly, and 2026 is no exception. While July 1, 2026, is the next major compliance milestone, it is not the only one. Several laws and amendments take effect on that date, with additional...more
On May 14 2026, the ICO published a blog post setting out five practical steps that organisations can take to strengthen their resilience against AI-powered cyber threats (the Article)....more
It has been a busy spring for data privacy in the Southeast. On April 17, 2026, Alabama Governor Kay Ivey signed the Alabama Personal Data Protection Act (HB 351). Weeks later, on May 11, 2026, Governor Kemp signed Georgia’s...more
On May 21, 2026, the Louisiana State Senate passed Senate Bill 386, which if signed by Louisiana’s governor, will become the Louisiana Data Privacy Act (the LDPA) and come into effect January 1, 2027....more
The Ninth Circuit recently issued a decision partially lifting a broad preliminary injunction staying enforcement of the California Age-Appropriate Design Code Act (“CAADCA”). As a result, portions of the law are now in...more
Emotionally intelligent AI “companions” are increasingly deployed in senior living and home care settings to address loneliness and improve engagement. While these tools may offer meaningful benefits, they routinely process...more
On 15 April 2026, the European Data Protection Board (EDPB) published draft Guidelines on the processing of personal data for scientific research (Guidelines), marking a significant step towards greater consistency in the...more
Key Takeaways Artificial intelligence has made significant inroads into the hiring process. Employers increasingly rely on AI-driven tools to screen resumes, analyze video interviews, administer automated assessments, and...more
Colorado Governor Jared Polis signed Senate Bill 189 (“SB 189”), a bill that repeals and replaces the 2024 Colorado AI Act with a narrower, more business-friendly framework focused on automated decision-making technology...more
L’Ontario devient la toute dernière province à mettre à jour sa législation en matière de protection de la vie privée et d’accès à l’information dans le secteur public. Le projet de loi 97, Loi de 2026 sur le plan pour...more
Ontario is the latest province to make updates to its public-sector privacy and freedom of information legislation. Ontario’s Bill 97, Plan to Protect Ontario Act (Budget Measures), 2026 (Bill 97) received royal assent on...more
Malaysia’s Personal Data Protection Commissioner (“PDPC”) has recently issued three new guidelines clarifying key concepts under the Personal Data Protection Act 2010 (“PDPA”), covering: • Data Protection Impact...more
Instagram now allows creators to tag products directly in Reels (short-form, vertical videos) using affiliate links and earn commissions on resulting purchases, marking parent company Meta’s most significant push into native...more
Service providers often receive or access a customer’s personal information when performing contracted services. In the employment context, service providers may include payroll processors, Human Resource Information System...more