In the final days of California’s 2026 legislative session, California Governor Gavin Newsom signed a series of privacy legislation spanning consumer privacy rights, data broker activities, digital platform design, and civil remedies for website privacy litigation. Governor Newsom also vetoed
On October 1, 2026, the U.S. Cybersecurity and Infrastructure Security Agency (“CISA”) submitted a draft of the Final Rule implementing the Cyber Incident Reporting for Critical Infrastructure Act of 2022 (“CIRCIA”) to the Office of Information and Regulatory Affairs (“OIRA”)
Governor Gavin Newsom of California signed over 20 AI-related bills into law in the final days of September. Several of these bills address topics such as frontier model and generative AI oversight, AI transparency, and new requirements for use of
On September 30, Governor Gavin Newsom signed SB 690, a significant new law aimed at curbing the wave of lawsuits and demand letters asserting “pen register” claims under the California Invasion of Privacy Act (“CIPA”). The legislation eliminates the private
On September 30, California Governor Gavin Newsom signed three laws that will regulate the use of AI in the employment context, starting in the new year. Below, we briefly summarize these developments, which we discuss in greater detail in our
On September 9, 2026, the U.S. Federal Bureau of Investigation (“FBI”) announced the publication of the FBI Cyber Strategy (the “Strategy”). The Strategy, which “provides a roadmap for defending the American people and the nation’s critical infrastructure in cyberspace,” is
Recently, California Governor Gavin Newsom signed a sweeping set of laws related to minors’ privacy and safety, including new laws that restrict covered platforms from providing certain features to users under 16, impose a duty of care on social media
On September 17, 2026, the European Commission (the “Commission”) published its proposal for a new EU framework on child safety online (the “KIDS Act”). The proposed Regulation aims to introduce EU-harmonized age-based account restrictions, safety-by-design rules, and age-assurance obligations across
On September 8, 2026, Kenya’s Office of the Data Protection Commissioner (“ODPC”) published new Guidance Notes for Cross-border Data Transfers (“Guidance”), providing organizations with more detailed guidance on the application of Kenya’s rules governing transfers of personal data outside the
