Big HIPAA Breaches Now Number 265

C-PACE lending has become an important and fast-growing sub-specialty in our hotel finance capabilities. We work with C-PACE providers/lenders and borrowers.

California has enacted a groundbreaking AI disclosure law requiring advertisers to clearly identify when synthetic performers appear in their marketing materials. The legislation, set to take effect in 2027, includes a private right of enforcement that could potentially open the door to class action litigation against brands using AI-generated performers without proper disclosure.

In a fax lawsuit involving allegations against AT&T Mobility LLC and AT&T Mobility National Accounts LLC ("AT&T") for violation of the Telephone Consumer Protection Act ("TCPA"),

The Citizens Broadband Radio Service, also known as CBRS, has drawn little media attention compared to 5G cellular, but it is starting to get some traction with carriers, ISPs, and enterprise customers.

On July 22, 2026, the Federal Communications Commission (FCC or Commission) adopted a Third Report and Order and Third Further Notice of Proposed Rulemaking (covered separately here) in which the Commission advances its ongoing efforts to secure the U.S.

On September 10, 2026, Governor Newsom signed SB 1119, known as Adam’s Law, substantially expanding California’s requirements for companion chatbots when used by children.

The Federal Communications Commission has unanimously approved sweeping changes to its Telephone Consumer Protection Act consent revocation rules, fundamentally altering how businesses must handle consumer opt-out requests for calls and texts. These new regulations replace the controversial 2024 "revoke all" rule with more flexible options that allow companies to designate exclusive opt-out methods while distinguishing between marketing and informational messages.

The Federal Communications Commission has adopted sweeping new restrictions targeting equipment containing components from entities on its Covered List, fundamentally reshaping how manufacturers, online marketplaces, and equipment modifiers must approach FCC compliance. These rules establish unprecedented prohibitions on logic-bearing hardware components, impose strict display requirements for e-commerce platforms, and clarify when existing authorizations can support equipment modifications.

FEMA and the FCC will conduct a nationwide test of the Emergency Alert System on November 17, 2026, requiring participation from all radio and television stations, cable systems, and satellite services. EAS Participants must file three separate forms through the EAS Test Reporting System, with specific deadlines ranging from October 30, 2026, through January 2027. Certain translator and repeater stations are exempt from the registration and filing requirements.

California's new Senate Bill 574 introduces statutory duties for attorneys using generative AI, including mandatory citation verification and court disclosure requirements starting January 1, 2027. The law raises critical questions about how these obligations extend to AI-assisted eDiscovery review and document summarization that feed into court filings.

California has enacted a groundbreaking AI disclosure law requiring advertisers to clearly identify when synthetic performers appear in their marketing materials. The legislation, set to take effect in 2027, includes a private right of enforcement that could potentially open the door to class action litigation against brands using AI-generated performers without proper disclosure.

On February 24, 2026, a coalition of Wisconsin Democrats introduced SB 1045, which proposes to legalize and regulate cannabis in the state while at the same time imposing new rules for intoxicating hemp products.

Virginia's Cannabis Control Authority has released its initial draft of adult-use marijuana regulations, outlining application fees, license caps, and the approval process for the state's anticipated July 2027 launch of recreational cannabis sales. While the draft provides crucial details on licensing requirements and ownership restrictions, significant questions remain about the application timeline and evaluation criteria that will determine which entities receive coveted permits.

Virginia will ring in the New Year with renewed momentum toward adult-use cannabis sales. After years of roadblocks following the legalization of adult-use cannabis possession and home cultivation in 2021...

Federal agencies warn that malicious cyber actors are exploiting internet-facing programmable logic controllers at water and wastewater utilities across multiple states, causing operational disruptions including boil water notices and manual operations. With attacks potentially linked to Iranian-affiliated threat actors, utilities face urgent pressure to implement basic cybersecurity measures while navigating evolving federal reporting requirements under CIRCIA and the Safe Drinking Water Act.

The FDA, in collaboration with federal partners, held a landmark public hearing on September 14, 2026, to gather input on the future therapeutic use of psychedelic drugs, drawing over 18,000 registered attendees. This hearing represents one of the earliest implementations of Executive Order 14401, which directs federal agencies to expedite research, review, and approval of psychedelic drugs for serious mental health conditions.

Section 337 prohibits the importation, sale for importation, and sale within the U.S. after importation of "articles that...infringe a valid and enforceable United States patent."

The DEA has opened new registration portals for medical marijuana manufacturers, distributors, and analytical labs, expanding beyond the dispensary registration that became available earlier this year. These applications require extensive business information and background disclosures, with fees ranging from $296 to $3,699, and may provide significant compliance and commercial benefits for cannabis businesses operating under state medical marijuana programs.

The Office of the Comptroller of the Currency has proposed new regulations that would impose Bank Secrecy Act and sanctions compliance requirements on permitted payment stablecoin issuers under its jurisdiction. This rulemaking, coordinated with FinCEN and OFAC, establishes anti-money laundering, counter-terrorism financing, and sanctions program standards for stablecoin issuers as part of the broader implementation of the GENIUS Act framework.

Recently, in Lorenzo v. Securities and Exchange Commission, No. 17-1077, the Supreme Court held that an investment banker had committed securities fraud by copying and pasting false statements.