Lindsey Tonsager, Jenna Zhang, and Irene Kim of Covington and Burling write: On July 28, 2026, the New York Office of the Attorney General released final rules (the “Rules”) implementing the Stop Addictive Feeds Exploitation (SAFE) for Kids Act, which goes into effect on January 25, 2027. The SAFE for Kids Act requires online “addictive social media...

Lindsey Tonsager, Jenna Zhang, and Natalie Maas of Covington and Burling write: Consistent with recent years, 2026 has proved to be a busy year for children and teens’ privacy legislation. This post recaps notable developments and trends thus far in 2026. Our mid-year and end-of-year recaps for 2025 can be found here and here. App Marketplace Laws Two...

Charmian Aw, Ciara O’Leary, and Florence Seow of Hogan Lovells Cadwalader write: Singapore’s Personal Data Protection Commission (“PDPC”) has issued its final Advisory Guidelines on Use of Personal Data in Generative AI (“Guidelines”), marking a significant development in Singapore’s AI governance framework. The Guidelines provide long-awaited clarity on how the Personal Data Protection Act 2012...

Joseph J. Lazzarotti of JacksonLewis writes: If you have heard of CIPA, BIPA, GIPA, or TCPA litigation, you may have an idea of where this post is headed. These acronyms reference federal and state laws that permit a private right of action for certain privacy-related claims, affording successful plaintiffs with statutory remedies. In a recent case, Bartholomew...

Joke Bodewits and Julian B. Flamant of Hogan Lovells Cadwalader write: On 13 July 2026, the Dutch Data Protection Authority (“AP”) published a practical self-assessment tool (“Tool”) and corresponding guidance document (“Guidance”) on generative AI systems. The Guidance outlines the AP’s expectations under the General Data Protection Regulation (“GDPR”) across the generative AI lifecycle, while...

Chris Liotta reports: Lawmakers voted to extend a key cyberthreat sharing law for another decade, attaching the long-stalled reauthorization to Washington’s annual defense policy bill. The U.S. House of Representatives narrowly approved its $1.15 trillion fiscal year 2027 national defense authorization act in a 216-212 vote Wednesday, including a provision that would reauthorize the Cybersecurity Information...

Source

Mirandah Davis-Powell reports: T-Mobile failed to properly notify customers of a data breach in which 40 million people had sensitive personal information stolen and sold on the dark web, a King County Superior Court judge ruled Friday. The Washington attorney general’s office filed the civil lawsuit against the Bellevue-based company in January 2025. The lawsuit alleged that T-Mobile...

Source

From Hunton.com: On July 6, 2026, Illinois Governor JB Pritzker signed Senate Bill 315, the Artificial Intelligence Safety Measures Act (the “Act”), into law, making Illinois the third state, after California and New York, to enact comprehensive safety and transparency requirements for developers of the largest AI systems. The  Act positions Illinois as an aggressive player...

Matthew Dalton reports: A man kidnapped a 16-year-old girl at knifepoint in 1998 from the streets of La Rochelle, a port city in western France. He drove her to a wooded area and raped her, leaving her traumatized but alive. Over the next decade, four other girls and young women were sexually assaulted in similar settings...

Libbie Canter, Jayne Ponder, and Rosie Moss of Covington and Burling write: On June 16, 2026, the Delaware General Assembly passed HB 380, which would amend the Delaware Personal Data Privacy Act (DPDPA). The bill is currently awaiting the Delaware governor’s signature, and if signed, the amendments would take effect on January 1, 2027. The amendment...

“License plate numbers themselves generally are not understood to be “personal information from a motor vehicle record” subject to the DPPA, but private companies using ALPR data may match license plates with DMV records to identify vehicle owners for parking, tolling, collection or enforcement-related notices, creating another use case in which DPPA risk may arise.”...

David Wildstein reports: Gov. Mikie Sherrill’s administration is trying to walk back the impact of a new state law that could shut off political campaigns’ access to key voter-targeting data, a move aimed at preventing the shutdown of a database relied upon by Democratic and Republican candidates, political parties, and advocacy groups. A senior Sherrill administration official,...

Suzanne Smalley reports: The European Parliament has voted to bring back a rule giving big tech permission to scan users’ messages to hunt for child sexual abuse material (CSAM), a process that critics call Chat Control. Thursday’s vote occurred the day before summer recess and was the product of an unusual legislative procedure requiring an...

Privacy law scholar Neil Richards writes: A privacy right that you can’t enforce isn’t really a right – and that’s how Big Tech likes it. Massachusetts is close to passing a meaningful privacy law with a private right of action. So Woodrow Hartzog and I, along with 16 other privacy and technology legal scholars (with...

Julia Conley writes: Opponents of a bill that is purported to protect children online said Monday night, after the legislation passed in the US House, that laws are “urgently” needed to stop Big Tech companies from preying on kids’ vulnerabilities. “The KIDS Act is not that piece of legislation,” said Rep. Pramila Jayapal (D-Wash.), who was one of 117 lawmakers who voted against the Kids Internet...

A newly enacted law is causing shock waves. David Stauss of Stauss Law writes: The risks and costs of being a data broker in the United States just went up — again. On 30 June 2026, Gov. Mikie Sherrill, D-N.J., signed A 5328 into law, making New Jersey the seventh state to enact a data broker law,...

Jessca S. Kang, Catherine C. Smith, and Derek A. McKee of K&L Gates LLP write: Washington state has significantly expanded its Fair Chance Act through legislation enacted during the 2025 legislative session (EHB 1747), which is now codified at RCW 49.94 (Amended Fair Chance Act). Signed by Governor Bob Ferguson, the Amended Fair Chance Act imposes substantially...

Libbie Canter, Elizabeth Brim, and Clare Mathias of Covington and Burling write: In what continues to be a busy year for genetic privacy developments, Rhode Island has joined the growing number of states regulating direct-to-consumer (“DTC”) genetic testing with its recently enacted genetic privacy law, S 2203. With S 2203, Rhode Island is the fifth...

Hunton Andrews Kurth notes: As of June 19, 2026, organizations subject to UK data protection law are required to implement a mechanism or procedure whereby individuals can make complaints relating to their personal data. The new requirements were introduced by the Data (Use and Access) Act 2025. Individuals must first raise their complaint with the...

David Stauss of Stauss Law writes: Key point: Our new chart compares the data broker laws of California, Connecticut, Nevada, Oregon, Texas, and Vermont, covering applicability standards, registration and disclosure obligations, consumer rights, and penalties. State data broker laws are proliferating, and they vary widely in scope and structure. Connecticut recently passed a data broker...