5 Trends To Watch: 2025 U.S. Data Privacy & Cybersecurity

California Governor Newsom has signed Senate Bill 574 into law, establishing the nation's first statutory framework governing how attorneys and arbitrators use generative AI in their professional practice. The legislation creates specific obligations around confidentiality protection, accuracy verification, and disclosure requirements that take effect January 1, 2027.

Although being challenged by an injunction filed on August 20, 2026, by a coalition of 17 states, California’s SB 54 Plastic Pollution Prevention and Packaging Producer Responsibility Act is now in effect, and companies that sell, distribute, import, or ship packaged products into California should be evaluating whether they have compliance obligations.

Connecticut’s Governor has signed into law Public Act No. 26-64, “An Act Concerning Consumer Privacy and Protection,” which introduces substantial new compliance obligations for businesses that operate as data brokers...

Scott L. Vernick was quoted in The Legal Intelligencer article, "Did UPMC Data Breach Ruling Lock Plaintiffs Out of State Court?" on January 23, 2017.

California Governor Gavin Newsom has signed several significant privacy bills that will reshape how businesses handle consumer data, including expanded deletion rights under the CCPA, shortened data broker response cycles, and sweeping new insurance sector privacy requirements. While one landmark bill banning the sale of sensitive personal information was vetoed, the approved legislation requires companies to update their deletion workflows...

California's 2026 legislative session concluded with Governor Newsom signing several landmark privacy and AI bills into law, including comprehensive child safety measures, AI auditor oversight frameworks, and expanded data protection requirements. How will these new regulations reshape digital advertising, workplace AI deployment, and online platform obligations for businesses operating in California?

Legal risk intensifies for companies offering online interactive features to minors across Georgia, Florida, and Alabama as the Eleventh Circuit vacates preliminary injunctions against state social media laws. With Florida's HB 3 and Georgia's SB 351 now enforceable and Alabama's HB 161 set to take effect January 1, 2027, businesses face divergent compliance requirements including age verification, parental consent mechanisms, and account deletion protocols.

In the last few months, California and New Jersey enacted legislation to protect children online: California’s 13-bill package targets risks to children arising from emerging technologies, while New Jersey’s 3-bill package includes an age-appropriate design code. Despite their differences, these laws share a common focus on protecting children as technology evolves.

Meta Platforms has agreed to pay $17 billion over ten years to resolve multistate litigation alleging the company engineered Facebook and Instagram to addict minors while concealing the risks. Beyond the historic financial penalty, the settlement mandates sweeping platform changes including default usage limits, overnight lockouts, and parental controls for users under eighteen.

California is poised to enact a one-stop global deletion request option that all "data brokers" operating in the State would be required to follow.

The U.S. Department of State has released the October 2026 Visa Bulletin, marking the start of fiscal year 2027 with significant changes to employment-based immigrant visa categories. How will the advancement of priority dates, particularly the substantial four-year leap for mainland China-born EB-5 investors in the Dates for Filing chart, impact eligible applicants seeking adjustment of status benefits?

The Department of Homeland Security has not issued formal determinations for Temporary Protected Status designations for Ukraine and Sudan despite the October 19, 2026 expiration date, creating uncertainty for employers navigating Form I-9 compliance and employment authorization documentation. USCIS states that affected individuals retain TPS protections and work authorization, but has not updated operational guidance to explain how employers should document continued employment eligibility or handle

U.S. consulates across India have begun cancelling and automatically rescheduling H-1B and H-4 visa appointments (often 90 to 120 days later)...

Following a federal court order in Medani v. Trump, the U.S. Department of State has resumed issuing Diversity Immigrant Visas after a nine-month pause that began in December 2025. DV-2026 selectees now face a critical deadline of September 30, 2026, to complete their visa processing or permanently lose their opportunity for permanent residence through the diversity visa lottery program.

The Federal Trade Commission is exploring whether digital platforms should bear greater responsibility for preventing impersonation ads that falsely pose as legitimate businesses or government agencies. Through an Advance Notice of Proposed Rulemaking, the agency seeks public input on potential amendments to its existing Impersonation Rule, examining how ad-optimization tools and platform practices...

The U.S. Department of State's November 2026 Visa Bulletin brings forward movement in several family-sponsored and employment-based immigrant visa categories, with significant advances for certain countries and preference levels. USCIS has confirmed that applicants in all preference categories may use the Dates for Filing chart to determine eligibility for adjustment of status applications, potentially allowing earlier filing for those whose priority dates fall before the applicable cut-off dates.

California's Climate Corporate Data Accountability Act (SB 253) establishes a November 10, 2026 deadline for Scope 1 and Scope 2 greenhouse gas emissions reporting, affecting U.S.-formed entities with over $1 billion in revenue that meet California's "doing business" test—regardless of physical presence in the state. The law carries penalties up to $500,000 per reporting year for non-compliance, with mandatory program fees and future Scope 3 reporting requirements on the horizon.

The European Commission has published draft guidelines interpreting the AI Act's transparency obligations, establishing when and how organizations must disclose AI-generated content, deepfakes, and automated interactions. These guidelines clarify that deepfake labeling applies regardless of intent to deceive, that AI systems must identify themselves at the point of interaction, and that the editorial review exception for AI-generated text requires substantive human oversight with clear accountability.

On Oct. 7, 2026, at 18:00 UTC, the Internet Corporation for Assigned Names and Numbers (ICANN) will publish every new generic top-level domain (gTLD) application proceeding in the 2026 new gTLD Round, including who applied...

The U.S. District Court for the District of Columbia has preliminarily enjoined the Department of War from enforcing WuXi AppTec's Section 1260H designation, finding the agency misread its evidence on state and military affiliation. However, this ruling does not close alternative pathways to biotechnology company of concern (BCC) designation under the BIOSECURE Act, and earlier supply-chain restrictions continue to drive near-term compliance decisions with a critical June 30, 2027 deadline for sub-tier supp