Recent enforcement activities in California and Connecticut highlight that states are ready and willing to actively enforce their comprehensive privacy laws. These recent actions – which continue the trend of states ramping...more
7/17/2025
/ California Consumer Privacy Act (CCPA) ,
Compliance ,
Connecticut ,
Consumer Privacy Rights ,
Corporate Counsel ,
Data Privacy ,
Enforcement Actions ,
Opt-Outs ,
Personal Data ,
Privacy Policy ,
Sensitive Personal Information ,
State Attorneys General ,
State Privacy Laws
State enforcement agencies are keeping the pressure on businesses, with two new enforcement actions announced this week in California and Texas. This activity signals to companies – both within and outside of the United...more
IAPP’s Global Privacy Summit in DC this week has featured panels with several state regulators charged with enforcing their state’s privacy laws, including regulators from California, Colorado, Connecticut, and Oregon. The...more
This week in our March Privacy Forecast, we discuss privacy and data security enforcement trends at the state and federal levels. Particularly as state privacy laws continue to expand and evolve, companies should understand...more
On March 12, 2025, the California Consumer Privacy Protection Agency (CPPA or Agency) announced a settlement with an auto manufacturer, marking the Agency’s first enforcement action under the California Consumer Privacy Act...more
Over the weekend, lawmakers unveiled the latest push for a federal privacy law – the American Privacy Rights Act (APRA). The bill was circulated as a discussion draft by Sen. Maria Cantwell (D-WA), Chair of the Senate...more
4/11/2024
/ California Consumer Privacy Act (CCPA) ,
California Privacy Protection Agency (CPPA) ,
Consumer Privacy Rights ,
Corporate Counsel ,
Data Privacy ,
Federal Trade Commission (FTC) ,
FTC Act ,
Government Entities ,
Minors ,
Nonprofits ,
Privacy Framework ,
Private Right of Action ,
Right to Delete ,
Right-To-Access ,
Small Business ,
Social Media ,
Third-Party Service Provider ,
Transparency
2024 has started off with a bang for state privacy law developments. Only two months into the new year, there has been significant enforcement activity in California and Connecticut – with the California Privacy Protection...more
On February 9, 2024, a California appellate court reversed a state trial court decision that delayed enforcement of California Privacy Rights Act (CPRA) regulations by one year. The CPRA—an approved ballot initiative that...more
The end of the year is a good time to revisit your organization’s privacy policy to ensure it is accurate and up to date. Notably, at least one state privacy law – the California Consumer Privacy Act (CCPA) – requires that a...more
On November 27, 2023, the California Privacy Protection Agency (CPPA) released draft regulations for automated decision-making technology (ADMT). While the CPPA has not officially begun the formal rulemaking process, the...more
11/30/2023
/ Artificial Intelligence ,
Automated Decision Systems (ADS) ,
California ,
California Consumer Privacy Act (CCPA) ,
California Privacy Protection Agency (CPPA) ,
COPPA ,
Data Profiling ,
Opt-In ,
Opt-Outs ,
Personal Information ,
Proposed Regulation ,
Risk Assessment
California continues to forge ahead on potential new privacy, cybersecurity, and artificial intelligence (AI) obligations, including through its California Consumer Privacy Act (CCPA) rulemaking process and by launching a new...more
9/14/2023
/ Artificial Intelligence ,
Audits ,
Automated Systems ,
California ,
California Consumer Privacy Act (CCPA) ,
California Privacy Protection Agency (CPPA) ,
California Privacy Rights Act (CPRA) ,
Cybersecurity ,
Data Protection ,
Executive Orders ,
Governor Newsom ,
Machine Learning ,
Recordkeeping Requirements ,
Risk Assessment ,
Training Requirements
California Attorney General Rob Bonta (California AG) recently announced that his office issued several inquiry letters to large California employers requesting information about their compliance with the California Consumer...more
On Friday, June 30, 2023, a California state superior court ruled that any California Privacy Rights Act (CPRA) regulation may not be enforced until one year after the regulation is promulgated. Practically speaking, this...more
March wrapped up with several significant state privacy developments. First, on March 28, Iowa Governor Kim Reynolds signed Senate File 262 (SF 262) into law, making Iowa the sixth state to adopt comprehensive data privacy...more
4/7/2023
/ California Consumer Privacy Act (CCPA) ,
California Privacy Rights Act (CPRA) ,
Consent ,
Consumer Privacy Rights ,
Data Collection ,
Data Privacy ,
New Legislation ,
Opt-Outs ,
Personal Information ,
Sensitive Personal Information ,
State Privacy Laws
At its February 3 meeting, the California Privacy Protection Agency (CPPA) Board took steps pursuant to the California Privacy Rights Act (CPRA) towards (1) finalizing its updated California Consumer Privacy Act (CCPA)...more
2023 already is a landmark year for privacy regulation. As of January 1, 2023, two new privacy laws are now in effect: (1) the California Privacy Rights Act (CPRA), which amends the California Consumer Privacy Act (CCPA), and...more
This post is the second of our series reviewing the Federal Trade Commission's (FTC) seventh annual “PrivacyCon." In yesterday’s overview, we summarized the discussions focused on consumer privacy and data security in areas...more
The California Attorney General (AG) made headlines in August by issuing a $1.2 million fine against online retailer Sephora to resolve allegations that the business violated the California Consumer Privacy Act (CCPA). This...more
On September 15, 2022, California Governor Newsom announced his signing of A.B. 2273, the California Age-Appropriate Design Code Act, which the legislature passed on August 30. The law – modeled after the United Kingdom...more
9/19/2022
/ California ,
California Consumer Privacy Act (CCPA) ,
COPPA ,
Data Profiling ,
Governor Newsom ,
New Legislation ,
Online Advertisements ,
Privacy Settings ,
Targeted Digital Advertising ,
Transparency ,
UK
On August 30, 2022, the California Legislature passed A.B. 2273, the California Age-Appropriate Design Code Act. The bill – which is modeled after the United Kingdom Information Commissioner’s Office code of practice for age...more
9/1/2022
/ Algorithms ,
California ,
California Consumer Privacy Act (CCPA) ,
COPPA ,
Data Profiling ,
Data Protection ,
Marketing ,
Online Advertisements ,
Privacy Settings ,
Private Right of Action ,
UK
Privacy In Focus®-
The last several years have seen major developments in state privacy laws. While Congress remains gridlocked on the federal privacy front, states enacted omnibus data privacy bills that will impact...more
1/19/2022
/ California ,
California Consumer Privacy Act (CCPA) ,
California Privacy Rights Act (CPRA) ,
CDPA ,
Colorado ,
Comment Period ,
Compliance ,
Consumer Privacy Rights ,
Corporate Counsel ,
Data Collection ,
Data Mapping ,
Data Privacy ,
Data Protection ,
Privacy Policy ,
Proposed Amendments ,
State Data Privacy Laws ,
State Privacy Laws ,
Third-Party ,
Virginia
On September 22, 2021, the California Privacy Protection Agency (CPPA or Agency)—the new agency established by the California Privacy Rights and Enforcement Act (CPRA)—released an Invitation for Preliminary Comments on...more
Companies subject to the California Consumer Privacy Act (CCPA) are required to update their online privacy policies “at least once every 12 months,” as detailed in the statute. For many companies that updated their CCPA...more
In March 2021, with the passage of the Consumer Data Protection Act (CDPA), Virginia took its place as the second state to enact comprehensive data privacy legislation. Virginia follows California, where voters recently...more
On March 15, 2021, the California Attorney General (AG) issued further amendments to the implementing regulations of the California Consumer Privacy Act (CCPA), clarifying how a business must facilitate a consumer’s exercise...more