Retail Industry Leaders Association Testifies On Cybersecurity And Protecting Consumer Data

California's 2026 legislative session concluded with Governor Newsom signing several landmark privacy and AI bills into law, including comprehensive child safety measures, AI auditor oversight frameworks, and expanded data protection requirements. How will these new regulations reshape digital advertising, workplace AI deployment, and online platform obligations for businesses operating in California?

California's Senate Bill 690 eliminates the private right of action for pen register claims under CIPA when violations arise from website or mobile app tracking technologies, leaving enforcement solely to the Attorney General. The bill applies retroactively to claims filed after January 1, 2025, and awaits Governor Newsom's signature with an operative date of January 1, 2027.

California Senate Bill 690 has passed, amending the California Invasion of Privacy Act by eliminating the private right of action for Section 638.51 claims. Kristine Argentine and Paul Yovanic Jr. discuss the implications of this legislative change and what businesses should expect when the amendment takes effect on January 1, 2027.

A recent Seventh Circuit decision is a reminder of BIPA’s financial institution GLBA exceptions. In that case, the court held that a vendor to GLBA-regulated entities was exempt from Illinois’ biometric law.

California's Legislature has unanimously passed SB 690, a landmark reform that could eliminate thousands of pending class action lawsuits based on website tracking technologies under the California Invasion of Privacy Act. The bill removes the private right of action for pen register claims arising from routine web analytics tools, potentially reshaping the data privacy litigation landscape while companion bills simultaneously expand substantive privacy obligations.

Delaware Governor Matt Meyer has signed H.B. 380, dramatically expanding the Delaware Personal Data Privacy Act to include stringent third-party contracting requirements, broader sensitive data protections, and lower jurisdictional thresholds. The amendments introduce California-style due diligence obligations for data disclosures, expand sensitive data categories to include neural data and financial information, and impose new profiling requirements that extend even to employment contexts. These changes po

California's Senate Bill 690 represents a pivotal legislative response to the explosion of website-tracking lawsuits under the California Invasion of Privacy Act, specifically targeting claims brought under the pen-register provision that have generated thousands of cases since 2022. While the bill would eliminate private plaintiffs' ability to pursue these particular claims involving digital tracking technologies, it leaves other CIPA provisions intact and raises questions about how the litigation landscap

New York Attorney General Letitia James has released final rules for the Stop Addictive Feeds Exploitation (SAFE) for Kids Act. The law was signed in 2024, but the effective date was triggered by the release of these rules.

California's State Legislature has passed five major privacy bills addressing private litigation restrictions, expanded deletion rights, children's online safety, sensitive data protections, and user privacy settings. These measures, now awaiting Governor Newsom's signature, could fundamentally reshape how businesses handle consumer data and face privacy-related lawsuits in the state.

On September 2, 2026, Delaware’s Governor signed House Bill (HB) 380 and HB 381. HB 380 amends the Delaware Personal Data Privacy Act (DPDPA), which was enacted in 2023 and became effective January 1, 2025. HB 381 separately amends Delaware’s computer security breach notification law.

How can multinational corporations effectively navigate the complex landscape of tax disputes across multiple European jurisdictions? This analysis examines strategic approaches and procedural considerations...

The SEC has proposed a comprehensive modernization of federal transfer agent rules that would expressly permit the use of blockchain technology as a master securityholder file. The proposal introduces technology-neutral language alongside new reporting requirements for distributed ledger technology usage and tokenized securities activity.

As federal climate disclosure rules face rescission and state-level mandates remain largely stalled, California's SB 253 greenhouse gas reporting requirement stands as the sole advancing framework, creating a fragmented compliance landscape where multistate companies must navigate divergent regulatory trajectories. With the SEC's 2024 climate rules stayed and proposed for elimination, and California's Air Resources Board finalizing implementation mechanics for November 2026 reporting deadlines, the operatio

The Ninth Circuit Court of Appeals vacated a preliminary injunction against Perplexity AI, determining that when an AI agent acts at a user's direction, it is the user—not the AI company—who "accesses" computer systems under federal and California computer fraud statutes. This landmark appellate decision addresses how existing computer-access laws apply to agentic artificial intelligence and has significant implications...

A federal court has struck down New York's Climate Change Superfund Act, which sought to recover $75 billion from fossil fuel companies based on historical emissions. The ruling found the Act preempted by the Clean Air Act, marking the first judicial decision on state climate superfund legislation and establishing that EPA's rescission of the endangerment finding does not alter preemption analysis.

The European Commission has adopted final Guidelines on exclusionary abuses of dominance under Article 102 TFEU, introducing a "workable effects approach" that narrows presumptions while expanding guidance on objective justifications and recognizing sustainability benefits as valid efficiencies for the first time. These Guidelines replace the 2008 Enforcement Priorities Guidance and are expected to significantly impact enforcement practices across EU Member States and beyond, particularly for digital market

In a recent PTAB decision, Director Squires addressed whether Microsoft's IPR petition should proceed despite Sandpiper CDN's discretionary denial request. The ruling hinged on two critical factors: the novelty of Microsoft's art citations and Sandpiper CDN's failure to disclose its own commonly assigned prior art during patent prosecution. This case provides important guidance on how patent owners' prosecution conduct can impact discretionary denial outcomes at the Patent Trial and Appeal Board.

The European Commission has proposed replacing the EU's three core procurement directives with a single, directly applicable Regulation that would fundamentally reshape how companies compete for public contracts across Member States. The reform introduces mandatory quality criteria thresholds, embeds ESG considerations as evaluation factors, and establishes new security and European-preference provisions that could restrict participation based on ownership, supply chain exposure, and strategic dependencies.

Early decisions about a start-up's legal structure can dramatically affect tax outcomes and financial returns as the company grows and reaches liquidity events. Understanding the Qualified Small Business Stock (QSBS) exemption and implementing proper structuring from the outset can significantly enhance returns for both founders and investors.

California's Air Resources Board has opened its voluntary reporting platform for the first cycle of greenhouse gas emissions disclosure under SB 253, establishing November 10, 2026 as the deadline and clarifying that companies may submit existing reports rather than creating new CARB-specific documents. The guidance addresses critical implementation questions including consolidated reporting mechanics, fee assessment structures, and first-year enforcement discretion for entities without established data col