The large wave of cookie wiretapping lawsuits does not seem to be subsiding, but a plaintiff-favorable outcome is far from assured.
A new decision by the US District Court in Delaware dismisses a claim based on the plaintiff’s failure to
Latest from Privacy Compliance & Data Security
Pennsylvania AG’s Lawsuit Against Snap Highlights Growing Risks for Companies with Child and Teen Audiences
New lawsuit by the PA Attorney General against Snap (fka Snapchat) provides some potential lessons to companies that have child or teen audiences for their services.
1. Mind your Marketing:
Regulators pay special attention to the content of marketing of
Connecticut’s New Data Broker Law (SB 4): What Businesses Need to Know
Connecticut has enacted a sweeping new data broker law (SB 4, as amended by HB 5222), making it one of a growing number of states to regulate the collection, sale, and licensing of third‑party personal data. Effective October 1, 2026,
Colorado’s PTFA Litigation Wave: Liability for Listing Cell Phone Numbers Without Consent and Why It Puts Data Brokers at Risk
If you list cellphone numbers in a directory for a commercial purpose without consent, you could be liable under the Colorado Prevention of Telemarketing Fraud Act, Colo. Rev. Stat. § 6-1-304(4)(a)(I). A new class action filed in federal court in
New York Set to Ban Key AI Companion Chatbot Features for Minors in First‑of‑Its‑Kind Law
New York just is set to become the first state in the US to outright prohibit certain AI companion features for minors. The bill has passed both houses and is headed to the Governor.
Unsafe AI Companion Features
The law
Vermont Amends Its Data Broker Law: What Do You Need to Know?
Last week, Governor Phil Scott signed Act 138, amending Vermont’s data broker law. The operative provisions go into effect January 1, 2027.
So what should companies be focusing on?
Different Scope
The law revises several core definitions that determine
CIPA Personal Jurisdiction: Nationwide Call Recording and Analytics Deployment Fails “Express Aiming” Test in Central District of California
A nationwide call recording and analytics service, uniformly deployed nationwide, that merely operates in California is not sufficient, standing alone, to establish specific personal jurisdiction under the California Invasion of Privacy Act (CIPA), according to a recent decision from the
Data Minimization Under Scrutiny: Hungarian DPA Decision Signals Risk for U.S. Employers
A recent decision by Hungary’s Data Protection Authority (NAIH) offers a deceptively modest outcome, a €5,000 fine, but sends a much stronger signal on the evolving expectations around data minimization under the GDPR and ultimately, the US State Privacy laws.
GDPR Processing Begins at the Data Request: What a Spanish Supreme Court Decision Signals for U.S. Privacy Compliance
Data processing begins even before the data is received. A recent ruling of the Supreme Court of Spain clarifies the scope of GDPR obligations and the implications extend to the United States as well.
In STS 1590/2026 (Judgment No. 390/2026,
When AI Meets the FCRA: What the Eightfold Class Action Means for Employers and HR Technology Providers
An estimated 87% of companies now using AI-driven tools in their recruitment processes, and that figure has nearly doubled in just two years. AI-powered platforms can ingest millions of candidate profiles, enrich them with publicly available data, and deliver algorithmically