Your cookie solution may be working, but your work here is not done.
With all the website tracking demand letters and litigation, it is not enough just to deploy an out-of-the-box cookie solution.
The recent wave of website and app
Privacy Compliance & Data Security
The Latest Developments in Global Data Privacy Law, and Data Breach Prevention and Response
The Privacy Compliance & Data Security blog, published by Fox Rothschild LLP, focuses on legal developments and regulatory enforcement related to data privacy, cybersecurity, and compliance with privacy laws such as the CCPA and GDPR. It covers topics including data breach liabilities, data processing agreements, biometric data regulations, data protection impact assessments, and the intersection of emerging technologies like AI with privacy law. The blog also addresses enforcement actions by regulators, state and federal privacy law updates, and practical compliance strategies for businesses handling personal and sensitive data.
Blog Authors
Latest from Privacy Compliance & Data Security
Can Legitimate Interest Be Used to Train AI Models Under the GDPR?
By Odia Kagan
Legitimate interest as a legal basis for training your AI is not res ipsa loquitur. It does not speak for itself.
In the age of AI, we often hear clients, and see privacy policies, refer to a “legitimate interest in…
It Wasn’t Me, It Was the AI Agent” May Not Avoid Liability Under New Senate Proposal
By Odia Kagan
“It wasn’t me, it was the AI agent” may not help companies avoid civil or criminal liability under a new bipartisan legislative proposal.
U.S. Senators Josh Hawley (R-Mo.) and Chris Murphy (D-Conn.) have announced the proposed AI Agent Accountability Act…
Biometric Consent Cannot Cure Excessive Data Collection: Lessons for U.S. Companies from a €2.59 Million GDPR Fine
By Odia Kagan
The Croatian data protection authority (AZOP) imposed a €2.59 million fine on a casino company for collecting fingerprints and photographs in violation of the GDPR. The authority found that the company violated the principle of data minimization by collecting four…
New California AI Law Requires Healthcare Providers to Keep Clinical Decision-Making Human
By Odia Kagan
California has enacted a new law requiring healthcare providers using artificial intelligence to keep clinical decision-making human.
AB 1979, signed by Governor Gavin Newsom on September 30, 2026, requires a health facility, clinic, physician’s office, or office of a…
California Enacts SB 690: What Happens to Website-Tracking Litigation Now?
By Odia Kagan
The new law eliminates private pen register claims against private actors involving websites and apps but does not end CIPA litigation. Plaintiffs are already pivoting to other causes of action.
On September 30, 2026, California Governor Gavin Newsom signed Senate…
California AB 1609 Requires Large Businesses to Disclose AI Customer Service Bots and Provide Human Support
By Odia Kagan
A new law signed by Governor Newsom, AB 1609, requires large private businesses to disclose when the customer service agent they are using is an AI bot and provide customers with timely access to quality customer service.
This joins…
California SB 923 Expands CCPA Deletion Rights: How It Compares to the DELETE Act and DROP
By Odia Kagan
On September 27, 2026, Governor Gavin Newsom signed SB 923, the Expanding Privacy Rights Act, which significantly expands the deletion right under the California Consumer Privacy Act. What does this mean for companies subject to the CCPA and how…
Texas Attorney General Issues Warning on CIPA Website Tracking Demand Letters
By Odia Kagan
With the growing wave of letters alleging violations of the California Invasion of Privacy Act (CIPA), Texas Attorney General Ken Paxton has issued a letter urging businesses and nonprofit organizations to exercise caution and seek legal guidance before taking action. …
What a German Court’s Ruling on a Public Facebook Profile Means for U.S. Data Brokers
By Odia Kagan
A recent decision from a German labor court offers an interesting perspective on the use of personal information collected from publicly available social media profiles. While the case arose in the context of employment litigation, the court’s reasoning has broader…