Market Intelligence

In the age of AI, we often hear clients, and see privacy policies, refer to a “legitimate interest in the improvement of our product” as the legal basis for using input data to train AI models.

Beginning January 1, 2027, consumers will be able to request deletion of covered personal information that a business collected “from or about” them. This is a significant expansion from the current CCPA language that only applies to information collected “from” the consumer. This may include appended contact information, demographic data, marketing segments, identity-resolution data and other information used to enrich a consumer profile.

On September 30, 2026, California Governor Gavin Newsom signed Senate Bill 690, significantly narrowing one of the theories driving California website-tracking litigation. The law limits private lawsuits alleging that tracking technologies used on websites and applications violate the pen register and trap-and-trace provisions of the California Invasion of Privacy Act, commonly known as CIPA.

The Croatian data protection authority (AZOP) imposed a €2.59 million fine on a casino company for collecting fingerprints and photographs in violation of the GDPR. The authority found that the company violated the principle of data minimization by collecting four fingerprints without demonstrating that doing so was necessary.

California Governor Gavin Newsom has signed Senate Bill 690, eliminating the private right of action for certain claims under the California Invasion of Privacy Act's pen register provision. While the legislation aims to curb vexatious CIPA demand letters and complaints, questions remain about whether it will effectively end the flood of nuisance-value settlements that have plagued businesses for nearly five years.

California's expanded CCPA deletion right takes effect January 1, 2027, requiring businesses to delete personal information collected "from or about" consumers, including purchased profiles and third-party data. The critical question for general counsel is whether their deletion workflows can actually reach all records tied to a consumer, or if they're quietly leaving marketing profiles and vendor data in use while reporting completion to requesters.