Amendments To CCPA Signed Into Law This Week

Scott L. Vernick was quoted in The Legal Intelligencer article, "Did UPMC Data Breach Ruling Lock Plaintiffs Out of State Court?" on January 23, 2017.

California's 2026 legislative session concluded with Governor Newsom signing several landmark privacy and AI bills into law, including comprehensive child safety measures, AI auditor oversight frameworks, and expanded data protection requirements. How will these new regulations reshape digital advertising, workplace AI deployment, and online platform obligations for businesses operating in California?

California's legislature has sent a comprehensive package of privacy, AI, and advertising bills to Governor Newsom's desk, with decisions due by September 30, 2026. The legislation addresses sensitive personal information protections, data broker obligations, AI-powered chatbot regulations, and digital replica rights, potentially reshaping how businesses handle consumer data and automated decision-making systems. Will these bills become law and set new national standards for technology regulation?

On September 15, the Federal Trade Commission ("FTC") issued a policy statement ("Statement") addressing the scope of its Health Breach Notification Rule ("Rule") on health apps and connected devices.

Meta Platforms has agreed to pay $17 billion over ten years to resolve multistate litigation alleging the company engineered Facebook and Instagram to addict minors while concealing the risks. Beyond the historic financial penalty, the settlement mandates sweeping platform changes including default usage limits, overnight lockouts, and parental controls for users under eighteen.

Target announced the compromise payment card information taken in-store between November 27 and December 15, 2013

In the last few months, California and New Jersey enacted legislation to protect children online: California’s 13-bill package targets risks to children arising from emerging technologies, while New Jersey’s 3-bill package includes an age-appropriate design code. Despite their differences, these laws share a common focus on protecting children as technology evolves.

California's Senate Bill 690 eliminates the private right of action for pen register claims under CIPA when violations arise from website or mobile app tracking technologies, leaving enforcement solely to the Attorney General. The bill applies retroactively to claims filed after January 1, 2025, and awaits Governor Newsom's signature with an operative date of January 1, 2027.

Sources informed the Wall Street Journal that a definitive MasterCard settlement could be announced as soon as this week.

Every so often a law that was passed years ago quietly becomes a present-day compliance reality. Section 24220 of the 2021 Infrastructure Investment and Jobs Act is one of those laws.

On July 22, 2026, the Federal Communications Commission (FCC or Commission) adopted a Third Report and Order and Third Further Notice of Proposed Rulemaking (covered separately here) in which the Commission advances its ongoing efforts to secure the U.S.

California's Legislature has unanimously passed SB 690, a landmark reform that could eliminate thousands of pending class action lawsuits based on website tracking technologies under the California Invasion of Privacy Act. The bill removes the private right of action for pen register claims arising from routine web analytics tools, potentially reshaping the data privacy litigation landscape while companion bills simultaneously expand substantive privacy obligations.

The SEC's Division of Examinations has identified six critical areas where investment advisers commonly fall short in their annual compliance reviews, from timing failures to inadequate documentation and unimplemented corrective actions. Understanding these deficiencies is essential for advisers seeking to strengthen their compliance infrastructure and avoid examination risks.

The Trump administration has issued an executive order requiring enhanced interagency coordination and stricter oversight of the H-1B nonimmigrant visa program. Federal agencies must now review employers' workforce practices, including past and planned layoffs of U.S. workers, while strengthening enforcement mechanisms to prevent program abuse.

The Protect College Sports Act of 2026 (PCSA), introduced in the Senate on June 2, 2026, by Senators Ted Cruz (R-TX) and Maria Cantwell (D-WA) and joined by Senators Eric Schmitt (R-MO) and Chris Coons (D-DE), represents a comprehensive federal legislative effort to reshape the governance and economics of intercollegiate athletics...

Last week, the Trump administration and federal agencies announced several initiatives related to artificial intelligence (AI).

Unlocking Part 15 Spectrum for D2D: The FCC adopted an NPRM exploring rule changes to allow devices operating under Part 15 unlicensed rules (such as Wi-Fi and Bluetooth) to communicate directly with authorized satellites.

On August 25, 2026, the U.S. Department of Justice (DOJ or the Department) announced a $21.5 million settlement with Deloitte LLP and four affiliated entities (collectively, Deloitte), marking the second False Claims Act (FCA) settlement under the Department’s Civil Rights Fraud Initiative launched in May 2025.

The Court of Appeals for the Second Circuit affirmed the Tax Court holding that a partner must lack managerial control over a partnership before it can qualify for the “limited partner exception” from self-employment taxes.

Directs federal agencies to revise recreational fisheries management policies, modernize recreational fishing data collection, streamline permitting and marine access regulations, establish artificial reef programs and prioritize recreational fishing interests in federal ocean and coastal resource management decisions.