Lindsey Tonsager, Jenna Zhang, and Irene Kim of Covington and Burling summarize some recent bills signed into law. From their article: Companion Chatbots. Adam’s Law (SB 1119) requires operators of a “companion chatbot” to determine the age of users consistent with the Digital Age Assurance Act and imposes a series of obligations before making a...

Source

Derek Kravitz reports: Nearly every time you buy something online or sign up for a loyalty program, you leave behind personal information that can be collected, shared, and sold among companies including advertisers, retailers, and data brokers. This kind of information is sometimes used to charge consumers more for a range of products and services,...

Source

Samantha Rupe reports: The Center for Reproductive Rights has filed a lawsuit challenging Oklahoma abortion laws on behalf of two women who were denied abortion care after receiving fatal fetal diagnoses. Magon Hoffman and Sheena Hamlin said they were forced to leave Oklahoma to obtain care after learning their pregnancies would not result in surviving...

Source

Meghan O’Connor and Candice Andalia of Quarles write: California is drawing a hard line: artificial intelligence may schedule a therapy appointment, but it may not conduct one. Licensed professionals who allow AI to make independent therapeutic decisions, interact directly with patients, or detect emotions and mental states may face fines of up to $10,000 per...

Source

Odia Kagan of FoxRothschild writes: If a user sets a privacy preference, an operating system or app cannot change that setting without the user’s explicit consent, says new bill, AB 2561, that passed the California legislature. A “Privacy setting” means any user-configurable option within an application’s privacy, or similarly labeled, menu that governs the application’s...

Source

Dan Cooper, Jadzia Pierce, Kristof Van Quathem, Atli Stannard, Anna Sophia Oberschelp de Meneses, Diego Bonomo, John Bowers, Sam Jungyun Choi, and Laura Schukraft of Covington and Burling write: In recent months, children’s online safety and privacy have moved to the top of the EU’s digital agenda. The European Commission is expected to outline its...

Source

Joseph J. Lazzarotti of JacksonLewis writes: On September 2, 2026, Delaware’s Governor signed House Bill (HB) 380 and HB 381. HB 380 amends the Delaware Personal Data Privacy Act (DPDPA), which was enacted in 2023 and became effective January 1, 2025. HB 381 separately amends Delaware’s computer security breach notification law. In short, what changes...

Source

Nicholas Boyle, Claire Kermond, and Alexandra Moore of White & Case write: On August 31, 2026, the Australian Government released a Privacy Reform – Consultation Paper (the Consultation Paper) and an exposure draft of the Privacy Amendment (Personal Data Protection Bill) 2026 (Exposure Draft) detailing proposed changes to the Privacy Act 1988 (Cth) (the Privacy...

Source

Christopher Brown reports: The California Legislature passed a bill to eliminate the right to file private lawsuits under a provision of the California Invasion of Privacy Act, partly stemming a recent wave of litigation. The bill, SB 690, passed the state Assembly by a vote of 66 to 0 Aug. 28 and then returned for a...

The California Privacy Protection Agency announced some good news on LinkedIn: Good news! CalPrivacy sponsored bill SB 923 (Becker), also known as the Expanding Privacy Rights Act, officially passed the California Legislature. The bill will expand the right to delete to cover all personal information collected about a consumer no matter the source of the...

Kelly Sandberg of Troutman Amin’s CIPAWorld writes: In the case of Emily Rodriguez v. Accident Fund Holdings, Inc., the Central District of California granted Defendant Accident Fund Holdings’(AFHI’s) motion to dismiss Plaintiff Emily Rodriguez’s (Plaintiff’s) second amended complaint containing claims of California invasion of privacy and the common law tort of intrusion upon seclusion. Emily Rodriguez v....

Jude Joffe-Block reports: Maryland has passed some of the strictest data privacy provisions in the country. But privacy and civil rights advocates say commercial data brokers are violating state law by collecting and selling Marylanders’ geolocation data, as well as selling information to federal immigration authorities. A coalition of privacy and civil rights groups filed a consumer...

Joseph J. Lazzarotti of JacksonLewis writes: Senate Bill (SB) 1130, legislation that would establish criminal penalties for certain uses of wearable recording devices, continues to move through the California legislature. I’ve had the honor of discussing this measure with staff of the bill’s sponsor, California State Senator Eloise Gómez Reyes, and anticipate there will be...

Charles Lane reports: A bill that would restrict private businesses in New York City from using facial recognition on customers has won the backing of Mayor Zohran Mamdani’s administration and a majority of the City Council, sponsors and supporters said Friday. Advocates and lawmakers announced the momentum at a rally outside Madison Square Garden, whose owner,...

Jennifer C. Everett, Jane B. Lucas, Angela T. Burnette, Jennifer Pike, and Sara Pullen of Alston & Bird write: In November 2025, Senator Bill Cassidy, (R-LA) introduced the Health Information Privacy Reform Act (HIPRA), legislation aimed at closing gaps in federal health data protections for health information that is not covered under the Health Insurance Portability...

Jadzia Pierce and Virginie de France of Covington and Burling write: On August 14, 2026, the French Constitutional Council (the “Constitutional Council”) struck down Article 1 of France’s Act to protect minors from the risks posed by the use of social media (the “Act”), which would have barred minors under the age of fifteen from...

Benjamin H. Weiss reports: The Trump administration has spent tens of millions of dollars building out the ability of immigration enforcement agents to collect DNA samples from detainees, a program that has so far collected genetic records from millions of people and deposited them in a federal criminal database. But experts say the effort, which...

David Stauss writes: On August 11, 2026, New Jersey Governor Mikie Sherrill signed the New Jersey Kids Code Act (A 4015), which adopts the New Jersey Age-Appropriate Design Code, into law. The privacy advocacy group Electronic Privacy Information Center (EPIC) previously applauded the law’s passage, which it described as protecting “kids online by prohibiting invasive data practices,...

Libbie Canter, Elizabeth Brim, and Clare Mathias of Covington and Burling write: The Illinois Governor recently signed SB 2886, which expands the scope of the state’s Genetic Information Privacy Act (“GIPA”) to include “biomarker testing” and “biomarker.” GIPA currently regulates the collection, use, and disclosure of genetic testing information. The bill defines “biomarker” as “a characteristic...

Cassandre Coyer reports: California’s privacy agency hit data broker LocateSmarter LLC with a $116,490 penalty for making it difficult for online users to opt out of the sale of their personal information. Tuesday’s fine marks the agency’s first action for violations of both the state’s privacy and data broker laws: the California Consumer Privacy Act...