CCPA Regs Made Final

Scott L. Vernick was quoted in The Legal Intelligencer article, "Did UPMC Data Breach Ruling Lock Plaintiffs Out of State Court?" on January 23, 2017.

California's 2026 legislative session concluded with Governor Newsom signing several landmark privacy and AI bills into law, including comprehensive child safety measures, AI auditor oversight frameworks, and expanded data protection requirements. How will these new regulations reshape digital advertising, workplace AI deployment, and online platform obligations for businesses operating in California?

California's legislature has sent a comprehensive package of privacy, AI, and advertising bills to Governor Newsom's desk, with decisions due by September 30, 2026. The legislation addresses sensitive personal information protections, data broker obligations, AI-powered chatbot regulations, and digital replica rights, potentially reshaping how businesses handle consumer data and automated decision-making systems. Will these bills become law and set new national standards for technology regulation?

Meta Platforms has agreed to pay $17 billion over ten years to resolve multistate litigation alleging the company engineered Facebook and Instagram to addict minors while concealing the risks. Beyond the historic financial penalty, the settlement mandates sweeping platform changes including default usage limits, overnight lockouts, and parental controls for users under eighteen.

On September 15, the Federal Trade Commission ("FTC") issued a policy statement ("Statement") addressing the scope of its Health Breach Notification Rule ("Rule") on health apps and connected devices.

Target announced the compromise payment card information taken in-store between November 27 and December 15, 2013

California's Senate Bill 690 eliminates the private right of action for pen register claims under CIPA when violations arise from website or mobile app tracking technologies, leaving enforcement solely to the Attorney General. The bill applies retroactively to claims filed after January 1, 2025, and awaits Governor Newsom's signature with an operative date of January 1, 2027.

In the last few months, California and New Jersey enacted legislation to protect children online: California’s 13-bill package targets risks to children arising from emerging technologies, while New Jersey’s 3-bill package includes an age-appropriate design code. Despite their differences, these laws share a common focus on protecting children as technology evolves.

Mossack Fonseca. Before April 2016, most of us had never even heard of a Panamanian law firm by that name.

In a groundbreaking enforcement action, Texas Attorney General Ken Paxton has filed a lawsuit against Allstate Corporation and its subsidiary Arity, alleging systematic violations of the Texas Data Privacy and Security Act (TDPSA) and other consumer protection laws.

California's 2026 legislative session concluded with fewer employment bills than in previous years, but several significant measures await Governor Newsom's decision by September 30. Key proposals address automated decision systems in employment, workplace surveillance restrictions, expanded bereavement leave, AI-driven workforce displacement notices, and modifications to last year's controversial "stay-or-pay" legislation.

The Department of Homeland Security has confirmed that Salvadoran Temporary Protected Status beneficiaries remain protected despite the September 9, 2026 expiration date, though no formal announcement has been made regarding the program's future. This development raises critical questions about employer obligations and the potential scenarios that may unfold, including termination with a 60-day notice period or an extension of the designation.

U.S. Citizenship and Immigration Services has issued Individual Notices permitting certain Salvadoran Temporary Protected Status beneficiaries to demonstrate continued work authorization through September 9, 2026. This development arrives weeks after most TPS-based Employment Authorization Documents expired, creating challenges for employers and employees navigating reverification procedures and compliance requirements.

The California Occupational Safety and Health Standards Board has approved significant revisions to California’s workplace first aid requirements for both construction and general industry. For general industry employers, the most notable change is the elimination of the longstanding requirement that first aid kit contents be approved by a consulting physician. Instead, employers may now comply by providing a first aid kit meeting ANSI/ISEA Z308.1-2021 Class A requirements.

In February 2016, China's General Office of the State Council issued its Opinion on Strengthening Management of the Service for Foreigners' Permanent Residency, setting out a framework for the development of less restrictive...

The Small Business Administration has proposed significant changes to size standards that determine whether companies qualify as small businesses for federal contracting purposes. Understanding these numerical thresholds and their implications is crucial for contractors navigating the government marketplace.

The EU Cyber Resilience Act introduces mandatory cybersecurity requirements for products with digital elements sold in the European market, establishing a comprehensive framework for hardware and software security. Starting September 11, 2026, manufacturers face new reporting obligations for actively exploited vulnerabilities and severe security incidents, with strict timelines ranging from 24 hours to one month depending on the type of report.

California lawmakers have sent Senate Bill 690 to Governor Gavin Newsom, teeing up a narrowing of website-tracking litigation under the California Invasion of Privacy Act (CIPA), who has until September 30 to sign or veto the legislation. If signed, the bill would eliminate private lawsuits asserting website-based “pen register” and “trap and trace” claims under Section 638.51 of CIPA. For businesses that have received demand letters or are defending lawsuits premised on routine website technologies—such as cookies, pixels, analytics tools, or similar tracking technology—the bill would offer relief from certain types of claims asserted under CIPA.

The EFAA creates an exception to the Federal Arbitration Act (“FAA’) by allowing a person alleging conduct constituting workplace sexual harassment or sexual assault to invalidate arbitration agreements and to pursue his or her claims in court. 9 U.S.C. §§ 401–02.

In Italy, at the moment, discussions on the future of the world of work generally focus on remote working, but the gradual introduction of the short (four-day) week for equal pay is the hottest topic on the minds of employers.