Many businesses have opted to deploy website cookie banners in response to the barrage of litigation under the California Invasion of Privacy Act (“CIPA”).

California's legislature has passed SB 690, a bill that would eliminate private lawsuits under Section 638.51 of the California Invasion of Privacy Act for website tracking technologies like cookies and pixels. The legislation includes a retroactivity provision affecting pending claims filed within two years before its effective date, potentially reshaping the landscape of privacy litigation that has generated hundreds of lawsuits against businesses using common website analytics tools.

The surge of lawsuits under Section 638.51 of California’s Invasion of Privacy Act (CIPA)—which governs “pen registers” and “trap and trace devices”—has burdened online businesses over the past two years.

At a time when many organizations are seeing a rise in strategic, and sometimes even outright abusive, data subject access requests (“DSARs”), the Court of Justice of the European Union’s (“CJEU’s”) 19 March 2026...

The Federal Trade Commission has launched a new public comment period on potential updates to its Negative Option Rule governing subscriptions and auto-renewals.

A consolidated class action lawsuit against Otter.AI reveals how AI products that collect and train on user data face significant legal exposure under privacy statutes, unfair competition laws, and invasion of privacy torts. The case demonstrates that privacy policies alone may not shield companies from liability, particularly when they shift consent obligations to customers or obscure how user data trains AI systems.

The Federal Trade Commission (FTC) announced a $10 million settlement with Disney, addressing allegations that the company failed to correctly label its child-directed videos on YouTube, which resulted in unlawful collection of children's personal information.

CMPs are sold as compliance solutions, but plaintiffs’ counsel and regulators increasingly treat them as evidence. When the CMP says one thing and the site does another, that isn’t just a configuration glitch..

The UK has introduced mandatory reporting requirements for child sexual exploitation and abuse content detected on online platforms, while the EU has unveiled a privacy-preserving age verification app...

The European Commission has launched a privacy-preserving age-verification app designed to help platforms comply with the Digital Services Act, but Member States are simultaneously implementing divergent national age...

New York's finalized rules for the Kids Online Safety Act establish comprehensive age assurance requirements that could reshape how digital platforms verify and protect young users. These regulations introduce specific technical standards and compliance obligations that extend beyond previous state-level attempts at child protection online. The framework may serve as a template for other jurisdictions considering similar protective measures for minors in digital spaces.

Generative AI is transforming privacy litigation economics by enabling pro se litigants to mass-produce lawsuits targeting common website technologies like cookies, analytics, and tracking tools. These AI-assisted plaintiffs can replicate existing legal theories without needing clients or legal representation, fundamentally changing the cost-benefit calculus for businesses facing privacy claims. Understanding your website's technology stack and litigation exposure has become critical as this new wave of aut

California's new CCPA cybersecurity audit regulations present unique compliance challenges for businesses processing consumer data. Companies with over $100 million in annual revenue face 2027 deadlines requiring careful scoping decisions, timing considerations, and strategic planning around internal versus external audit resources.

The Supreme Court has issued its landmark decision in Chatrie v. United States, addressing whether law enforcement's use of geofence warrants to obtain cell phone location data from Google constitutes a Fourth Amendment search. This ruling extends the Court's 2018 Carpenter decision and raises critical questions about the constitutional limits of reverse warrants and the third-party doctrine in the digital age.

The EU's e-Evidence Package introduces a direct cross-border framework allowing authorities to compel electronic evidence from service providers through binding Production and Preservation Orders. U.S. companies offering cloud, communications, or data-driven services to EU users face immediate operational obligations including appointing EU representatives, meeting shortened response windows, and navigating potential conflicts with U.S. law.

The UK Information Commissioner's Office has finalized its guidance on storage and access technologies, expanding compliance requirements beyond traditional cookies to include tracking pixels, device fingerprinting, and web storage. Organizations must now navigate stricter consent standards and three new narrow exceptions introduced by the Data (Use and Access) Act 2025, while facing significantly increased enforcement penalties of up to £17.5 million or 4% of annual worldwide turnover.

Model Context Protocol (MCP) servers are transforming how AI agents interact with enterprise systems, creating new governance challenges that organizations must address.

On September 10, 2026, Governor Newsom signed SB 1119, known as Adam’s Law, substantially expanding California’s requirements for companion chatbots when used by children.

As businesses prepare for automated decision-making requirements taking effect in 2027 across California, Colorado, and Connecticut, widespread misconceptions persist about the scope, applicability, and technical requirements of these regulations. This analysis examines ten common myths about ADM laws—from the false belief that no real AI laws exist in the U.S.

Agentic AI systems combine large language models with real-world tools and infrastructure access, creating unprecedented security risks that traditional red-teaming methods fail to address. When autonomous agents can execute code, manage credentials, and take actions across cloud services without human oversight, the vulnerability surface expands exponentially—and the agent itself can become an unwitting accomplice in its own compromise. This analysis reveals how adversarial testing of these systems r