State Privacy Laws: How We Got Here And Where We Are Headed

Scott L. Vernick was quoted in The Legal Intelligencer article, "Did UPMC Data Breach Ruling Lock Plaintiffs Out of State Court?" on January 23, 2017.

California Governor Newsom has signed Senate Bill 574 into law, establishing the nation's first statutory framework governing how attorneys and arbitrators use generative AI in their professional practice. The legislation creates specific obligations around confidentiality protection, accuracy verification, and disclosure requirements that take effect January 1, 2027.

Although being challenged by an injunction filed on August 20, 2026, by a coalition of 17 states, California’s SB 54 Plastic Pollution Prevention and Packaging Producer Responsibility Act is now in effect, and companies that sell, distribute, import, or ship packaged products into California should be evaluating whether they have compliance obligations.

California's 2026 legislative session concluded with Governor Newsom signing several landmark privacy and AI bills into law, including comprehensive child safety measures, AI auditor oversight frameworks, and expanded data protection requirements. How will these new regulations reshape digital advertising, workplace AI deployment, and online platform obligations for businesses operating in California?

In the last few months, California and New Jersey enacted legislation to protect children online: California’s 13-bill package targets risks to children arising from emerging technologies, while New Jersey’s 3-bill package includes an age-appropriate design code. Despite their differences, these laws share a common focus on protecting children as technology evolves.

Meta Platforms has agreed to pay $17 billion over ten years to resolve multistate litigation alleging the company engineered Facebook and Instagram to addict minors while concealing the risks. Beyond the historic financial penalty, the settlement mandates sweeping platform changes including default usage limits, overnight lockouts, and parental controls for users under eighteen.

Federal and state regulators are intensifying scrutiny of healthcare and digital health companies over tracking technologies that share sensitive patient data with advertising platforms. Recent enforcement actions against major telehealth providers and healthcare systems reveal how common marketing practices can trigger significant legal liability under privacy laws, even for organizations not covered by HIPAA.

Multiple organizations have recently disclosed significant data breaches affecting thousands of individuals, with compromised information ranging from basic contact details to highly sensitive medical records and financial data. The incidents span various sectors including healthcare, insurance, and professional services, raising questions about the scope of exposure and potential remedies for affected individuals.

On September 15, the Federal Trade Commission ("FTC") issued a policy statement ("Statement") addressing the scope of its Health Breach Notification Rule ("Rule") on health apps and connected devices.

California's legislature has sent a comprehensive package of privacy, AI, and advertising bills to Governor Newsom's desk, with decisions due by September 30, 2026. The legislation addresses sensitive personal information protections, data broker obligations, AI-powered chatbot regulations, and digital replica rights, potentially reshaping how businesses handle consumer data and automated decision-making systems. Will these bills become law and set new national standards for technology regulation?

The U.S. House of Representatives has passed H.R. 5334, the Lindsey O. Graham Sanctioning Russia and Iran Act of 2026, which directs the President to impose tariffs of up to 500 percent on Russian imports and up to 100 percent on imports from countries that are significant purchasers of Russian energy. The bill includes provisions for Presidential waiver authority and a five-year sunset clause...

California's 2026 legislative session concluded with Governor Newsom signing several landmark privacy and AI bills into law, including comprehensive child safety measures, AI auditor oversight frameworks, and expanded data protection requirements. How will these new regulations reshape digital advertising, workplace AI deployment, and online platform obligations for businesses operating in California?

The Advisory Council on Historic Preservation has advanced a Notice of Proposed Rulemaking that would fundamentally restructure Section 106 of the National Historic Preservation Act, marking the most significant regulatory overhaul in over 20 years. The proposed changes would shift the consultation process from a multi-step framework to an agency-prepared report system, narrow the scope of protected properties, and grant federal agencies greater unilateral authority in resolving adverse effects.

On November 21, 2023, the Treasury Department, through the Financial Crimes Enforcement Network (FinCEN) and Office of Foreign Assets Control (OFAC)...

If you’re a dealer, an ad agency handling automotive accounts, or in-house counsel advising automotive clients, the Commission’s latest guidance on auto pricing transparency deserves a careful read. The guidance echoes familiar principles we’ve heard in other areas from federal and state regulators related to the expectation for all-in pricing, with important nuances unique to the auto industry.

Today, the European Union announced that it would close EU airspace to all Russian-owned, Russian registered, or Russian-controlled aircraft, including private aircraft owned by the Russian elite.

Today, the European Union imposed a ban on the provision of specialized financial messaging services, including SWIFT interbank messaging network services, to seven Russian banks.

Polymarket faces multiple lawsuits alleging deceptive influencer marketing practices, including undisclosed paid endorsements and staged betting videos on fake platform copies. A new class action complaint claims content creators filmed winning bets on simulated Polymarket websites built by the company, with some videos allegedly showing fabricated results that would have resulted in significant losses on the real platform.

California's S.B. 690 represents a significant bipartisan reform to the California Invasion of Privacy Act (CIPA), fundamentally altering the landscape for businesses facing privacy litigation. Governor Newsom's signature on September 30, 2026, removes the private right of action for violations involving pen registers and trap-and-trace devices, addressing what many viewed as abusive litigation tactics.

Delaware Governor Matt Meyer has signed H.B. 380, dramatically expanding the Delaware Personal Data Privacy Act to include stringent third-party contracting requirements, broader sensitive data protections, and lower jurisdictional thresholds. The amendments introduce California-style due diligence obligations for data disclosures, expand sensitive data categories to include neural data and financial information, and impose new profiling requirements that extend even to employment contexts. These changes po