The Data (Use and Access) Act 2025 (DUAA)[i] continues to introduce changes to the UK data protection landscape. One of the most visible developments is the formal transition of the UK’s data protection regulator from the Information Commissioner’s Office to the Information Commission[ii].

Despite the legal name change, organisations should not expect the familiar “ICO” brand to disappear. The regulator has confirmed that it will continue to operate as the Information Commission’s Office (ICO) and remain widely known by that acronym.

For many organisations, the change may initially appear to be little more than a rebrand. However, a more significant governance change sits behind the new name. Under the previous regime, the regulator was led by a single Information Commissioner. The DUAA replaces that structure with an Information Commission Board and a chief executive officer (CEO)[iii]. The Board is responsible for oversight, strategic direction, challenge and accountability, while the CEO oversees the day-to-day management and operation of the organisation.

The governance reforms also sit within a much broader package of changes introduced by the DUAA. While the transition from the Information Commissioner’s Office to the Information Commission is one of the most visible changes, organisations are already implementing a number of more substantive operational reforms. Most notably, the DUAA has introduced a new right for individuals to complain directly to controllers about alleged infringements of the UK GDPR, together with new obligations on organisations to establish accessible complaints processes, acknowledge complaints within prescribed timeframes and investigate and respond to concerns appropriately. These requirements form part of a wider emphasis on accountability, transparency and demonstrable compliance across the UK’s data protection framework.

As a result, many organisations are already reviewing privacy notices, data subject rights procedures, complaints handling processes and broader governance arrangements to ensure they remain aligned with the evolving regulatory landscape. Against that backdrop, the regulator’s new governance structure should be viewed as one element of a broader programme of reform rather than a standalone rebrand.

Importantly, the regulator’s core powers, responsibilities and functions remain unchanged. The Information Commission continues to oversee compliance with data protection, e-privacy and freedom of information legislation, publish guidance, investigate complaints and take enforcement action where appropriate. From a practical perspective, organisations should not expect any immediate change in the way they interact with the regulator.

That said, the transition provides a useful opportunity to review privacy and data governance documentation. Many policies, notices, contracts and internal procedures refer specifically to the Information Commissioner’s Office or the Information Commissioner. While those references are unlikely to create immediate compliance concerns, organisations may wish to update them over time to reflect the new statutory framework.

In particular, organisations should consider reviewing:

  • Privacy notices
  • Data protection policies
  • Data processing and data sharing agreements
  • Records of processing activities
  • Internal compliance procedures
  • Standard contractual templates

The governance reforms introduced by the DUAA are intended to modernise the regulator’s structure and bring it more closely into line with other UK regulatory bodies. Whether the new arrangements ultimately influence regulatory priorities, decision-making or enforcement activity remains to be seen.

For now, the key takeaway is straightforward: the ICO has a new legal identity and governance structure, but its role as the UK’s data protection regulator remains largely unchanged. However, the move should not be viewed in isolation. It sits alongside a wider programme of DUAA reforms that are already reshaping organisational privacy compliance frameworks and accountability obligations. As organisations continue to work through these changes, updating references to the regulator may be a small but worthwhile part of a broader compliance review.

For a summary of all the changes introduced by the DUAA, read our previous articles:

Disclaimer: While every effort has been made to ensure that the information contained in this article is accurate, neither its authors nor Squire Patton Boggs accepts responsibility for any errors or omissions. The content of this article is for general information only, and is not intended to constitute or be relied upon as legal advice.

[i] https://www.legislation.gov.uk/ukpga/2025/18/contents

[ii] https://ico.org.uk/about-the-ico/media-centre/news-and-blogs/2026/09/ico-welcomes-transition-to-new-information-commission-and-marks-new-chapter-with-manchester-head-office-opening/

[iii] https://ico.org.uk/about-the-ico/who-we-are/the-information-commission-board/

On July 20, 2026, Pennsylvania Governor Josh Shapiro signed into law Senate Bill 992 (“SB 992”), which significantly amends the Pennsylvania Telemarketer Registration Act (the “Act”), 73 P.S. §§ 2241 et seq. The legislation has important implications for companies that engage in telemarketing, SMS/text message marketing, customer outreach campaigns, and other consumer-facing communications with Pennsylvania residents.

Effective October 18, 2026, SB 992 modernizes Pennsylvania’s nearly three-decade-old telemarketing law by expanding its coverage beyond traditional telephone calls to text messages, voicemails, ringless voicemails, and certain automated communications. The law also introduces new consent, opt-out, calling-hour, and compliance obligations that may increase regulatory and litigation risk for businesses operating in Pennsylvania.

Expanded Scope of Pennsylvania’s Telemarketing Law

Among the most significant changes, SB 992 broadens the Act’s coverage beyond traditional telemarketing calls. The law replaces the term “telephone solicitation call” with the broader term “telephone solicitation,” which now encompasses:

  • Telephone calls;
  • Voicemails;
  • Ringless voicemails;
  • Text messages (SMS and similar messaging technologies).

The expansion aligns Pennsylvania’s telemarketing framework more closely with evolving communication technologies and reflects increased regulatory scrutiny of text message marketing and automated outreach practices.

New Consent Standard for Telemarketing and Text Message Marketing

SB 992 also establishes a new statutory consent standard. To qualify as valid consent, a consumer’s agreement must:

  • Be signed by the consumer;
  • Identify the telephone number that may be contacted;
  • Clearly and conspicuously disclose that the consumer agrees to receive telephone solicitations, including robocalls and text messages; and
  • State that consent is not a condition of purchasing property, goods, or services.

Importantly, communications sent to consumers who have provided valid consent generally fall outside the Act’s definition of “telephone solicitation.”

Businesses should evaluate whether their current online lead-generation forms, website disclosures, SMS marketing programs, customer intake processes, and consent records satisfy these new statutory requirements.

New Compliance Obligations and Enforcement Risk

SB 992 imposes several operational requirements on businesses conducting telephone solicitations in Pennsylvania.

Among other things, the law:

  • Prohibits telephone solicitations on Sundays;
  • Restricts solicitations between 7:00 p.m. and 9:00 a.m.;
  • Requires businesses to honor text message opt-out requests using common keywords such as “STOP,” “QUIT,” “CANCEL,” or “UNSUBSCRIBE”;
  • Strengthens restrictions on caller ID spoofing and misleading caller identification practices; and
  • Prohibits unfair or deceptive acts used to obtain a consumer’s consent.

The potential exposure for noncompliance is significant.  A violation of the Act constitutes a violation of Pennsylvania’s Unfair Trade Practices and Consumer Protection Law (“UTPCPL”), 73 P.S. § 2246(a). Businesses may face enforcement actions by the Pennsylvania Attorney General, including civil penalties of up to $1,000 per willful violation.  The law also creates potential exposure to private litigation under the UTPCPL, including claims for actual damages or $100 plus attorneys’ fees.  73 P.S. § 201-9.2(a).

Key Takeaways for Businesses

With the October 18, 2026 effective date approaching, businesses should take proactive steps to assess their telemarketing and consumer communications compliance programs. In particular, companies should review:

  • Consent collection and recordkeeping practices;
  • SMS and text message marketing programs;
  • Website lead-generation forms and disclosures;
  • Calling and outreach procedures;
  • Opt-out mechanisms and suppression processes;
  • Vendor and marketing service provider agreements; and
  • Use of artificial intelligence, automated dialing technologies, prerecorded messages, and other automated communication tools.

Because Pennsylvania’s new requirements overlap with federal telemarketing laws, including the Telephone Consumer Protection Act (TCPA), businesses should carefully evaluate how their existing compliance programs address both federal and state obligations.

Squire Patton Boggs’ Data Disputes team has significant experience defending consumer privacy and telemarketing claims and in helping businesses navigate the overlapping requirements of federal and state telemarketing laws. Stay tuned to Privacy World to be kept in the loop on further developments.

When the first state consumer privacy law – California Consumer Privacy Act (CCPA) – passed, it applied to employees, but before it went into effect in 2020, 2019’s Assembly Bill 25 created a temporary exemption. By January 1, 2023, however, the exemption expired and the CCPA applied fully to personal information collected from or about employees and job applicants, including the CCPA’s anti-retaliation and anti-discrimination requirements. Last year, the CCPA’s Automated Decision-Making Regulations were finalized, with some special treatment applied to the HR context, as explained below. Other state legislatures, however, have mostly (but not completely, as discussed below) avoided extending their consumer privacy laws to employees and job applicants.

Continue Reading US Employers Face Evolving State Obligations for Human Resources AI / ADMT Use

In case you missed it, below are recent posts from Privacy World covering the latest developments on data privacy, security and innovation. Please reach out to the authors if you are interested in additional information.

Pen Register and Trap-and-Trace Claims Involving Websites and Apps Restricted to Enforcement by the California Attorney General as Governor Newsom Signs SB-690

New Podcast: State AG Perspectives on AI, Algorithms and Enforcement

Upcoming Speaking Engagements and CLE Opportunities with the SPB Data Team

Amendments to Delaware’s Consumer Privacy Law Deepen the Morass of State Privacy Regulation

U.S. AI Law –  2026 Midyear State Update

Stay Ahead on Consumer Privacy News

Not a subscriber yet? Subscribe here to be among the first to receive timely updates on the fast-moving world of data privacy, security, and innovation—delivered straight to your inbox.

Looking for deeper insights and expert analysis? You can also subscribe here to our privacy attorneys’ marketing communications for thought leadership and rich content when you need a more comprehensive perspective.

Businesses with websites that employ cookies and other tracking technologies (collectively, “internet tracking technology”) can breathe a partial sigh of relief. The private right of action under the California Invasion of Privacy Act (“CIPA”), relating to violations of Section 638.51 “alleged to arise from conduct occurring on an internet website, online application, or mobile application,” will be eliminated as of January 1, 2027, as Governor Newsom signed SB-690 on September 30, 2026. The law is retroactive and will apply to all pending lawsuits that commenced after January 1, 2025. Only the California Attorney General will be able to bring pen register and trap-and-trace claims related to conduct occurring on websites, apps, and mobile apps.

However, SB-690 is not a total shield to CIPA claims arising from internet tracking technology, as it does not address other CIPA provisions such as wiretapping (Section 631) and eavesdropping (Section 632), which are frequently used by plaintiffs to target common internet tracking technology notwithstanding that these laws predate internet tracking technology and conflict with the way the newer California Consumer Privacy Act regulates them. In Governor Newsom’s signing statement, he specifically called on the California Legislature to address CIPA again next year to address CIPA’s “other decades-old statutes that are also susceptible to abuse by overly aggressive litigants,” while “ensur[ing] a fair balance between protecting private information and preventing rapacious litigation.”

Continue Reading Pen Register and Trap-and-Trace Claims Involving Websites and Apps Restricted to Enforcement by the California Attorney General as Governor Newsom Signs SB-690

State attorneys general are increasingly shaping the regulatory landscape for organizations that rely on technology, data and artificial intelligence. In the latest episode of Squire Patton Boggs’ Antitrust Amplified podcast, antitrust partner Lauren Briggerman sits down with representatives from the California Department of Justice and the District of Columbia Attorney General’s Office to discuss evolving state enforcement priorities.

While the conversation focuses on antitrust enforcement, it addresses issues that are highly relevant to privacy, cybersecurity and compliance professionals. Topics include algorithmic pricing investigations, AI-driven technologies, coordination among state attorneys general and practical compliance considerations for businesses deploying algorithmic tools.

As regulators continue to examine technology-enabled business practices through multiple enforcement lenses, organizations should be aware of the growing convergence of antitrust, privacy, consumer protection and AI governance considerations.

Listen to the full podcast: Attorneys General on Antitrust in the US: Perspectives from the States

Stay Ahead on Consumer Privacy News

Not a subscriber yet? Subscribe here to be among the first to receive timely updates on the fast-moving world of data privacy, security, and innovation—delivered straight to your inbox.

Looking for deeper insights and expert analysis? You can also subscribe here to our privacy attorneys’ marketing communications for thought leadership and rich content when you need a more comprehensive perspective.

As privacy regulation, AI governance, and cybersecurity requirements continue to evolve globally, members of Squire Patton Boggs’ Data Privacy, Cybersecurity & Digital Assets team will be speaking on legal developments at several upcoming webinars, conferences, and CLE programs. Explore the events and hot topics below. For many of these programs we can arrange free passes for clients and are noted below. We look forward to connecting with you!

Continue Reading Upcoming Speaking Engagements and CLE Opportunities with the SPB Data Team

As we flagged last month in our mid-year U.S. privacy roundup, the Delaware legislature recently passed House Bill 380 (“HB 380”), which amends the Delaware Personal Data Privacy Act (the “Act”) in ways that impose significant new, and in many ways complex and novel, requirements on controllers, processors and third parties.  On September 2, 2026, Delaware Governor Matt Meyer signed House Bill 380 into law and thus amended what was already a fairly strict state consumer privacy law. These amendments significantly lower the volume-based thresholds for applicability, create new obligations for providers of “reports” used to make certain types of decisions and businesses that use that data, add new requirements for consumer rights, impose restrictions on profiling job applicants, employees and independent contractors, and require contracts with and obligations from third parties that receive personal data (e.g., sales), among many other changes. These amendments will become effective on January 1, 2027.

Businesses that are subject to the Act (of which there will be many more as a result of HB 380) should carefully review the amended Act to determine their new obligations, including the significant amendments discussed below.  Financial institutions in particular should determine whether they must now comply with the Act, as the broad exemption for financial institutions subject to Title V of the Gramm-Leach-Bliley Act (the “GLBA”) has been replaced by a narrower exemption for only certain types of financial institutions and certain of their affiliates (see discussion below).

Continue Reading Amendments to Delaware’s Consumer Privacy Law Deepen the Morass of State Privacy Regulation

In this second of a three-part series on US data law updates, we cover state laws related to development and deployment of artificial intelligence (AI) systems.

In Part I, we focused on the trend of more restrictive state consumer privacy laws. In this Part II, we review how state AI laws are focused on the most potentially harmful uses of AI systems. While state legislatures enacted a steady stream of new and amended consumer privacy laws during Q1 and Q2, legislative activity on AI and AI-related laws accelerated during May through  August. This Part II focuses on some of the more significant developments during this period.  

Continue Reading U.S. AI Law –  2026 Midyear State Update

As AI becomes more powerful, the questions facing businesses become more complex. How do you govern AI responsibly? How do you manage emerging risks? And how do you seize the opportunities without losing control? In this video series, our lawyers and industry professionals share their perspectives on the issues shaping the future of AI and its impact on organizations around the world.

In our first episode, international affairs advisor Matthew Kirk speaks with partner Tanvi Mehta Krensel about the role of in-house counsel in evaluating, deploying and governing AI across multinational organizations.

Watch the video here.

Disclaimer: While every effort has been made to ensure that the information contained in this article is accurate, neither its authors nor Squire Patton Boggs accepts responsibility for any errors or omissions. The content of this article is for general information only, and is not intended to constitute or be relied upon as legal advice.