Key point: California’s new Digital Age Assurance Act will likely create significant compliance challenges for many businesses.
On October 13, 2025, California Governor Gavin Newsom signed AB 1043 — the Digital Age Assurance Act — into law. In doing so,
Key point: Courts are concluding that not all data breaches should result in a lawsuit. Businesses need to consider causation and damages when responding to an incident and take steps to determine if there is no evidence of harm or
Key point: All businesses struggle with cybersecurity risks presented by their service providers. New guidance from the NY DFS applies to all DFS regulated entities, but the guidance would assist any business in any industry in addressing these risks.
On
Key point: Our new chart identifies and analyzes several remaining provisions in U.S. state consumer data privacy laws that are not already covered in our prior charts.
In our next comparison chart of U.S. state consumer data privacy laws, we
2025 was another incredibly active year in state privacy and AI laws with states enacting numerous new laws and amending existing laws and regulations. Enforcement also picked up speed and intensity. Combined, this activity created an ever-increasing and complex patchwork
Key point: California’s expansion of its antitrust law — targeting algorithmic pricing and lowering the bar for litigation — signals a major shift in how companies must approach algorithmic pricing tools and compliance.
On October 6, 2025, Governor Gavin Newsom
Key point: Of the 15 privacy and AI-related bills passed by the California legislature in the 2025 session that we have been tracking, Governor Gavin Newsom signed 10 into law and vetoed five.
Throughout the 2025 legislative session, we tracked
Key Point: California’s existing breach notification statute was amended to include more decisive guidelines for reporting to individuals and regulators.
On October 5, 2025, California Governor Gavin Newsom signed SB-446 into law, which bill sponsor Sen. Melissa Hurtado (D-CA) indicates
This article was republished in ALM’s Cybersecurity Law & Strategy Newsletter on October 31, 2025.
Key point: The rules provide further guidance to controllers subject to the law’s children’s privacy protections.
On October 9, 2025, the Colorado attorney general’s (AG)
Key point: A federal district court judge rejected the claim that the disclosure law violates the First Amendment.
On October 8, 2025, a judge for the U.S. District Court for the Southern District of New York granted the New York
