Lindsey Tonsager, Jenna Zhang, and Irene Kim of Covington and Burling write: On July 28, 2026, the New York Office of the Attorney General released final rules (the “Rules”) implementing the Stop Addictive Feeds Exploitation (SAFE) for Kids Act, which goes into effect on January 25, 2027. The SAFE for Kids Act requires online “addictive social media...

Seen on FourthAmendment.com, a decision from the Eastern District of New York: “The government seeks a warrant to search two cellular phones that have been in its possession for more than two months since the time to execute a prior search warrant lapsed. In United States v. Smith, 967 F.3d 198 (2d Cir. 2020), the...

Dhruv Mehrotra reports: On March 13, 2025, Hugo Moreno-Mendez arrived at the McLennan County Probation Department in Waco, Texas, expecting a routine probation check-in. Instead, Immigration and Customs Enforcement officers were waiting to arrest him. According to a criminal complaint reviewed by WIRED, officers drove Moreno-Mendez to a nearby ICE field office. There, one deportation officer after another...

Lindsey Tonsager, Jenna Zhang, and Natalie Maas of Covington and Burling write: Consistent with recent years, 2026 has proved to be a busy year for children and teens’ privacy legislation. This post recaps notable developments and trends thus far in 2026. Our mid-year and end-of-year recaps for 2025 can be found here and here. App Marketplace Laws Two...

Charmian Aw, Ciara O’Leary, and Florence Seow of Hogan Lovells Cadwalader write: Singapore’s Personal Data Protection Commission (“PDPC”) has issued its final Advisory Guidelines on Use of Personal Data in Generative AI (“Guidelines”), marking a significant development in Singapore’s AI governance framework. The Guidelines provide long-awaited clarity on how the Personal Data Protection Act 2012...

Jill Canfield and Tyler R. Bridegan of Womble Bond Dickinson write: The California Invasion of Privacy Act (CIPA), a 1967 penal code law originally designed to protect the privacy rights of California residents, has become the basis for a recent surge in demands and lawsuits. Plaintiffs’ attorneys are suing companies across the country for using...

Joseph J. Lazzarotti of JacksonLewis writes: If you have heard of CIPA, BIPA, GIPA, or TCPA litigation, you may have an idea of where this post is headed. These acronyms reference federal and state laws that permit a private right of action for certain privacy-related claims, affording successful plaintiffs with statutory remedies. In a recent case, Bartholomew...

This is a fascinating piece on the incident and legal issues. Leave yourself time to read it all. Sam Liles writes: A story moving through privacy circles right now has a clean, alarming shape: federal agents forced a man to unlock his phone at the border, it self-destructed using a privacy feature, and now the...

The Federal Trade Commission, joined by Utah and California, by and through Los Angeles County Counsel, today sued Hims & Hers alleging that the telehealth provider shared consumers’ sensitive health information about medical conditions with third-party advertising platforms despite claiming its services maintain consumers’ privacy and deceives users about its billing and cancellation practices. In...

Jackson Healy reports: The Trump administration has ended its push to force the University of Pennsylvania to release a list of the names and personal contact information of Jewish people on campus, according to court documents filed Thursday. While tied to an ongoing federal inquiry into on-campus antisemitism accusations, the Equal Employment Opportunity Commission’s now-dropped subpoena against...

Zack Whittaker reports: A U.S. magistrate judge last month denied to issue a search warrant allowing federal agents to snoop on the phones of “thousands of uninvolved, unsuspecting individuals” across Ohio in an effort to identify a suspected criminal’s device, a rare rebuke by a court blocking the use of a cell-site simulator. In the ruling,...

Joke Bodewits and Julian B. Flamant of Hogan Lovells Cadwalader write: On 13 July 2026, the Dutch Data Protection Authority (“AP”) published a practical self-assessment tool (“Tool”) and corresponding guidance document (“Guidance”) on generative AI systems. The Guidance outlines the AP’s expectations under the General Data Protection Regulation (“GDPR”) across the generative AI lifecycle, while...

Suzanne Smalley reports: The United Kingdom’s Supreme Court ruled Monday that Bahrain can’t hide behind state immunity to block a lawsuit filed by two dissidents alleging the government infected their devices with spyware. Saeed Shehabi and Moosa Mohammed allege Bahrain secretly installed FinSpy spyware on their laptops, likely in 2011. Government agents then spied on...

By Amanda Seitz, Maia Rosenfeld, and Darius Tahir Jul 27, 2026 A tiny federal agency tasked with protecting the public from injuries caused by lawn mowers and coffeemakers is demanding that some of the nation’s biggest health systems turn over detailed, personally identifiable medical records of all patients who seek help at their emergency rooms....

Legal intern Suzanne Castillo was the principal author of this post by Sophia Cope on EFF: The Fourth Circuit issued a disappointing opinion in U.S. v. Belmonte Cardozo, a case in which EFF filed an amicus brief, alongside the national ACLU, its Maryland, North Carolina, South Carolina, and Virginia affiliates, and the National Association of Criminal Defense...

Zack Whittaker reports: The U.S. Justice Department is prosecuting an American for allegedly providing U.S. border authorities with a passcode that wiped the contents of his phone, according to an indictment and media reports. This is thought to be the first known case in the United States where federal prosecutors have charged someone for the...

Joseph Cox reports: A leaked document shows the spread of surveillance and investigative capabilities that Immigration and Customs Enforcement (ICE) officials have access to agency wide, from location data harvested from smartphones, to facial recognition apps that can reveal someone’s identity, to tools that let the agency stay anonymous online and approach people undercover. The...

Noah Shachtman reports: Madison Square Garden owner James Dolan has insisted that the face-recognition system and array of surveillance cameras deployed at his venues is “very, very useful for security”—a big reason why MSG “is the most secure venue in the country.” On the night of July 2, security in and around the Garden was particularly intense. Roughly 130 cops...

From Hunton.com: On July 6, 2026, Illinois Governor JB Pritzker signed Senate Bill 315, the Artificial Intelligence Safety Measures Act (the “Act”), into law, making Illinois the third state, after California and New York, to enact comprehensive safety and transparency requirements for developers of the largest AI systems. The  Act positions Illinois as an aggressive player...

Matthew Dalton reports: A man kidnapped a 16-year-old girl at knifepoint in 1998 from the streets of La Rochelle, a port city in western France. He drove her to a wooded area and raped her, leaving her traumatized but alive. Over the next decade, four other girls and young women were sexually assaulted in similar settings...