Incoming Data Protection Laws May Affect Your Business

Scott L. Vernick was quoted in The Legal Intelligencer article, "Did UPMC Data Breach Ruling Lock Plaintiffs Out of State Court?" on January 23, 2017.

California Governor Newsom has signed Senate Bill 574 into law, establishing the nation's first statutory framework governing how attorneys and arbitrators use generative AI in their professional practice. The legislation creates specific obligations around confidentiality protection, accuracy verification, and disclosure requirements that take effect January 1, 2027.

California's 2026 legislative session concluded with Governor Newsom signing several landmark privacy and AI bills into law, including comprehensive child safety measures, AI auditor oversight frameworks, and expanded data protection requirements. How will these new regulations reshape digital advertising, workplace AI deployment, and online platform obligations for businesses operating in California?

Although being challenged by an injunction filed on August 20, 2026, by a coalition of 17 states, California’s SB 54 Plastic Pollution Prevention and Packaging Producer Responsibility Act is now in effect, and companies that sell, distribute, import, or ship packaged products into California should be evaluating whether they have compliance obligations.

In the last few months, California and New Jersey enacted legislation to protect children online: California’s 13-bill package targets risks to children arising from emerging technologies, while New Jersey’s 3-bill package includes an age-appropriate design code. Despite their differences, these laws share a common focus on protecting children as technology evolves.

Meta Platforms has agreed to pay $17 billion over ten years to resolve multistate litigation alleging the company engineered Facebook and Instagram to addict minors while concealing the risks. Beyond the historic financial penalty, the settlement mandates sweeping platform changes including default usage limits, overnight lockouts, and parental controls for users under eighteen.

On September 15, the Federal Trade Commission ("FTC") issued a policy statement ("Statement") addressing the scope of its Health Breach Notification Rule ("Rule") on health apps and connected devices.

Multiple organizations have recently disclosed significant data breaches affecting thousands of individuals, with compromised information ranging from basic contact details to highly sensitive medical records and financial data. The incidents span various sectors including healthcare, insurance, and professional services, raising questions about the scope of exposure and potential remedies for affected individuals.

Federal and state regulators are intensifying scrutiny of healthcare and digital health companies over tracking technologies that share sensitive patient data with advertising platforms. Recent enforcement actions against major telehealth providers and healthcare systems reveal how common marketing practices can trigger significant legal liability under privacy laws, even for organizations not covered by HIPAA.

California's legislature has sent a comprehensive package of privacy, AI, and advertising bills to Governor Newsom's desk, with decisions due by September 30, 2026. The legislation addresses sensitive personal information protections, data broker obligations, AI-powered chatbot regulations, and digital replica rights, potentially reshaping how businesses handle consumer data and automated decision-making systems. Will these bills become law and set new national standards for technology regulation?

State-law class actions targeting automatic renewal and subscription practices are accelerating, creating significant litigation risk for companies that rely on recurring revenue models. Recent settlements demonstrate that even technical compliance failures can lead to seven-figure exposure, with California, Illinois, and Virginia statutes driving the most aggressive litigation.

The Department of Justice's 2026 National Health Care Fraud Takedown charged 455 defendants in connection with $6.5 billion in alleged fraud schemes, marking an unprecedented scale of enforcement action. This whole-of-government approach leverages advanced data analytics and international cooperation to combat healthcare fraud across Medicare, Medicaid, and other federal programs. The enforcement action demonstrates heightened scrutiny of providers, aggressive asset forfeiture, and a focus on cases involvin

Federal and state regulators are intensifying scrutiny of healthcare and digital health companies over tracking technologies that share sensitive patient data with advertising platforms. Recent enforcement actions against major telehealth providers and healthcare systems reveal how common marketing practices can trigger significant legal liability under privacy laws, even for organizations not covered by HIPAA.

The White House has released a National Artificial Intelligence Legislative Framework and new executive orders aiming to establish a single, nationwide standard for AI regulation...

On July 8, the United States Court of Appeals for the Eighth Circuit vacated the Federal Trade Commission's Negative Option Rule, also referred to as the...

This bulletin discusses and advises about the recent flurry of activity from the Trump Administration directing a freeze on the expenditure of certain federal funds. We summarize the current status of the now.

The FTC’s proposed August 2026 enforcement policy makes AI-driven personalized pricing a key enforcement focus, warning that businesses may violate Section 5 if they use consumer data to tailor prices without clearly disclosing the practice and the data behind it.

The SEC has proposed Regulation Crypto Assets, its most comprehensive digital asset framework to date, establishing exemptions for startups and fundraising while introducing an Investment Contract Safe Harbor that could formally determine when crypto assets are no longer subject to securities laws. As regulators shift from enforcement-focused approaches to clearer rulemaking, agencies continue targeting fraud and misconduct, signaling that compliance remains critical even as the regulatory landscape evolves

The U.S. Senate has unanimously banned its members, officers and staff from trading on prediction markets, responding to concerns about insider trading and public trust, but the rule largely formalizes restrictions...

Crafting an AI Governance policy best suited for your business requires careful consideration of the types of AI, how AI will be used, current and future legislation...