As an attorney focused on technology transactions and counseling, I approach new technologies with both curiosity and caution. Like many lawyers, I tend to be skeptical until I fully understand how something works. But at this point, I’m convinced: AI is here to stay, and it’s already reshaping how work gets done across industries, including legal services. Clients are asking us to explore how AI can enhance efficiency, and we are actively pursuing responsible AI adoption, mindful of professional rules and the protection of client information. As part of that process, I have been testing different ways to put AI to work for clients.
For this experiment, I chose a task that’s both practical and challenging: identifying key trends in privacy enforcement and litigation relevant to digital advertising. While I’m familiar with recurring themes in recent cases, the sheer volume of information makes it difficult to compare and synthesize. My hypothesis: AI offers a way to cut through that noise, especially when directed to focus on specific sources. Indeed, AI seems perfectly suited to the task.
I asked AI to analyze three categories of material:
- Recent Federal Trade Commission (FTC) privacy actions
- Recent California Invasion of Privacy Act (CIPA) and related cases involving tracking tools (e.g., pixels, software development kits (SDKs))
- State attorney general and privacy agency enforcement actions and settlements (e.g., California Privacy Protection Agency enforcement)
Within each category, I first had AI locate relevant materials, then I confirmed we were aligned on the sources. For example, in the state enforcement category, I expected AI to locate cases including DoorDash, Tilting Point Media and Healthline Media. For FTC actions, I looked for it to turn up the FTC cases I was familiar with, including GoodRx, BetterHelp, Mobilewalla, Gravy Analytics, Premom, Flo Health, Kochava, InMarket and X-Mode. And for litigation, I similarly confirmed it found recent CIPA cases I am aware of. I made sure AI had access to the primary sources – the actual official complaints, orders and settlement agreements – not just third-party summaries. I wanted the analysis to be grounded in the original/official documents.
This was the tricky part. It required some back-and-forth, and it reminded me of the familiar phrase “garbage in, garbage out.” The idiom holds true with respect to the use of AI, regarding both the data used to train the AI and the prompts used. I spent a decent amount of time on this process, and I think it highlights the fact that while AI can be a powerful tool for legal research and analysis, it’s not a substitute for human intelligence just yet. Using AI effectively requires skill, especially in crafting precise prompts and guiding the tool toward relevant sources. The quality of the output depends heavily on the clarity of the input and the reliability of the data AI is working with. Humans still need to vet the results. This is especially true in the practice of law, where we have ethical obligations related to competency, candor and honesty, as the American Bar Association and several state bars have made clear in various opinions, guidance and statements concerning the ethical use of AI in legal practice. In sum, AI can accelerate the process of identifying patterns and surfacing insights, but it still needs a human to steer the ship, interpret the results and apply legal judgment.
Once I confirmed that we were on the same page about what I wanted it to look for and what sources I wanted it to consider, I asked AI to identify the top three themes or takeaways from all these cases and materials. And I specifically asked for actionable learnings. So, how did it do? Below is the resulting output.
****
Top 3 Privacy Enforcement and Litigation Themes Impacting Digital Advertising (2023-2025)
- Data Sharing with Ad Tech Vendors Requires Contractual and Technical Controls
Takeaway: Regulators expect businesses to have contracts, data flow maps and technical safeguards in place and to conduct appropriate due diligence when sharing data with third parties.
Actionable Steps:
- Conduct due diligence before onboarding vendors that receive or process personal data, especially those involved in advertising, analytics or cross-context behavioral tracking.
- Ensure data processing agreements are in place with all AdTech vendors.
- Use privacy-enhancing technologies and other architectural approaches (e.g., aggregation or pseudonymization) where possible to limit direct third-party access to raw personal data.
- Regularly review and audit vendor data flows and configurations to ensure ongoing compliance with contractual and legal obligations.
- Location and Health Data Are Treated as Highly Sensitive
Takeaway: Sharing or monetizing location or health-related data without robust safeguards is a high-risk practice.
Actionable Steps:
- Use precise geolocation or health data for advertising only if necessary and after confirming that affirmative, informed, opt-in consent has been obtained.
- Conduct due diligence on data providers and partners to ensure they are also obtaining valid consent and not passing along sensitive data in violation of privacy laws.
- Review whether your data practices could trigger Health Insurance Portability and Accountability Act (HIPAA) Rules, the FTC Health Breach Notification Rule or state health privacy laws, such as Washington’s My Health My Data Act, which imposes strict consent and data handling requirements for “consumer health data,” even outside HIPAA contexts.
- CIPA, Various Wiretap Laws and Other Legal Theories Are Fueling a Wave of Class Actions Targeting Tracking Technologies
Takeaway: Plaintiffs are aggressively targeting companies for using pixels, SDKs, session replay technologies, chatbots and email tracking technologies under a growing array of theories, including breach of state and federal wiretap and privacy laws, common law causes of action (e.g., intrusion upon seclusion, invasion of privacy, breach of contract), and state unfair or deceptive acts or practices laws. These lawsuits often allege that companies unlawfully intercept or disclose user communications without proper consent.
Actionable Steps:
- Ensure proper vetting of all tracking and recording technologies for legal compliance prior to use.
- Ensure clear, conspicuous notice is provided, and prior consent is obtained when necessary, before deploying tools that capture user interactions, especially if data is shared with third parties.
- Review vendor relationships to confirm whether third-party providers are using collected data for their own purposes, which could disqualify them from the “party to the communication” exception under wiretap laws.
- Monitor litigation trends and update risk assessments for tools such as Meta Pixel, Google Analytics, and session replay software.
***
It’s worth noting that some additional back-and-forth was required to produce that answer – it wasn’t the first response I received. But this was limited to some minimal tweaking and refinement, and it was much less than was required in the initial setup. I should also mention that, although not included here, I requested specific examples/citations from the materials be provided with the answer. Trust but verify! I would say in this case AI has done a fairly good job. This aligns with what I expected, and these points all make good sense to me. Although there is nothing shocking in these results, the exercise helped me confirm my own take on learnings from these recent cases. And it helped me ensure I wasn’t missing any major takeaways. But in my mind, the result is almost less important than the process. I think the process of defining clearly what I was looking for, identifying the universe of relevant materials and vetting the results in and of itself was valuable.
Of course, there is probably one more question you’re wondering about: Did I use AI to write this article????
[View source.]
