A federal court in Michigan significantly narrowed Michigan Attorney General (AG) Dana Nessel’s privacy and consumer protection case against Roku, Inc. (Roku) dismissing all non-Children’s Online Privacy Protection Act (COPPA) claims for lack of standing while allowing the state’s privacy
Key point: Five takeaways from March 2026 decisions: (1) Courts diverge on “purpose” requirement in ECPA’s crime-tort exception; (2) Courts consider ECPA exception outside the health care industry; (3) Contradictory statements in privacy policies can defeat consent even when tracking
Key point: Businesses operating generative artificial intelligence systems in Utah and Washington may be subject to new legal obligations, such as including provenance data in content created or altered using generative artificial intelligence.
In March, Utah’s Digital Content Provenance Standards
Key point: Last week, chatbot bills were signed into law in Oregon and Idaho, while a health care-related AI bill was signed into law in Tennessee.
Below is the 12th update on the status of proposed state AI legislation in
Key point: Last week, Maine’s consumer data privacy bill stalled in the House, while Kentucky’s legislature passed a bill to amend the commonwealth’s consumer data privacy law.
Below is the 12th update on the status of proposed state privacy legislation
Key point: Tennessee’s new law prohibits parties that develop or deploy AI systems from advertising or representing to the public that the AI systems can act as a qualified mental health professional.
On April 1, 2026, Tennessee Governor Bill Lee
Key point: Last week, four bills were signed into law in three states, two state legislatures passed chatbot bills, and eight bills crossed chambers.
Below is the 11th update on the status of proposed state AI legislation in 2026. These
Key point: Last week, Maine’s consumer data privacy bill passed the state’s House for a second time; consumer data privacy amendment bills advanced in Kentucky, New Hampshire, and Maryland; and bills crossed chambers in New Jersey (biometric) and Vermont (data
In Part 1 of this series, we outlined the basics of the California Consumer Privacy Act’s (CCPA) new cybersecurity audit requirement: who is covered, when audits are required, and the key obligations to keep in mind. In Part 2, we
Key point: Oklahoma becomes the 20th state to enact a broad consumer data privacy law.
On March 20, 2026, Oklahoma Governor Kevin Stitt signed SB 546 into law. In doing so, Oklahoma becomes the 20th state to enact a broadly
