Key point: Four takeaways from August decisions: (1) a federal magistrate judge concluded CIPA § 631 does not apply to internet communications but that § 632 does; (2) a cookie banner that merely pointed to a privacy policy did not establish
The Securities and Exchange Commission’s (SEC) 2024 amendments to Regulation S-P are now fully in effect, with both compliance deadlines now behind us. For broker-dealers, investment advisers, private fund managers, and other covered institutions that worked hard to prepare incident
Key point: Delaware’s HB 380, signed into law on September 2, 2026, significantly expands the scope of the Delaware Personal Data Privacy Act (DPDPA), narrows the GLBA exemption for financial institutions, introduces direct obligations on third parties, and strengthens protections
Key point: SB 690 passes the California legislatures and eliminates the private right of action for website-based pen register and trap-and-trace claims and reaches back two years, but it leaves CIPA §§ 631 and 632 and the federal Wiretap Act
Key Point: In a significant ruling for the AI industry, the Ninth Circuit vacated a preliminary injunction against Perplexity AI, holding that Amazon was unlikely to succeed on its Computer Fraud and Abuse Act (CFAA) and California Comprehensive Data Access
Key Points
Key Points
Key point: Plaintiffs in Virginia have focused on a rarely tested state privacy statute with statutory damages that imposes notice-and-consent obligations on retailers that share or sell in-store customer data.
Most retailers have spent the last several years building their
Key Point: A multistate coalition of 42 state AGs reached a landmark $150 million settlement with 23andMe over a 2023 data breach affecting 6.9 million customers, marking the largest AG multistate settlement involving consumer genetic data to date. This resolution
Key points: Troutman Pepper Locke’s Regulatory Investigations, Strategy + Enforcement (RISE) and Privacy + Cyber + AI practice groups worked with the firm’s innovation team using AI to collect and curate five years of data concerning state AG activities and
