The EU Data Act, which entered into full effect on 12 September 2025, is one of the cornerstones of the EU’s digital strategy, yet it places considerable compliance challenges for companies falling within its scope.  Francesco Liberatore, Gorka Navea and Bartolomé Martín provide an overview of the act, its key practical compliance challenges and outline how its key provisions interact with other EU instruments, such as the GDPR, the Trade Secrets Directive, the DME and other complementary frameworks.

Access the alert here: EU Data Act in Full Effect | Publications | Insights & Events | Squire Patton Boggs.

Disclaimer: While every effort has been made to ensure that the information contained in this article is accurate, neither its authors nor Squire Patton Boggs accepts responsibility for any errors or omissions. The content of this article is for general information only, and is not intended to constitute or be relied upon as legal advice.

In case you missed it, below are recent posts from Privacy World covering the latest developments on data privacy, security and innovation. Please reach out to the authors if you are interested in additional information.

Germany Implements NIS2: Registration portal will open on January 6, 2026

2025 State Privacy Roundup: Key Trends and California Developments to Watch in 2026

2025 Mass Arbitration Year in Review

Extra Large PII-zza: Courts Allows California Privacy Class Action to Proceed for Use of AI Phone Call Assistant

California Federal Court Urges California Legislature to Clean Up “Total Mess” of State Wiretap Act, Dismisses Claim for Website Tracking

Federal Court Dismisses “Trap and Trace” Lawsuit for Plaintiff’s Lack of Injury

Federal Court Holds That Button-Click Data From Public Website Can Disclose Patient Status in Violation of the ECPA

Second Circuit Undercuts Plaintiffs’ Threats of Mass Arbitration Fees, Often Used In Asserting Privacy Claims

Attention Privacy World Readers!  Do you need CLE? We have some options for you!

Stay Ahead on Consumer Privacy News

Not a subscriber yet? Subscribe here to be among the first to receive timely updates on the fast-moving world of data privacy, security, and innovation—delivered straight to your inbox.

Looking for deeper insights and expert analysis? You can also subscribe here to our privacy attorneys’ marketing communications for thought leadership and rich content when you need a more comprehensive perspective.

With the official enactment of the NIS-2 Implementation Act, Germany has taken a major step toward modernizing its cybersecurity framework. Starting from 6 December 2025, stricter requirements will apply to both federal administration and thousands of private companies. This law revises the BSI Act (BSIG) and introduces comprehensive obligations for IT security and risk management. The NIS2 Directive  is the EU’s updated cybersecurity framework. It requires organizations to implement risk management measures, ensure incident reporting within an initial 24-hour timeline, strengthens supply chain security while introducing management accountability, including personal liability for non-compliance.

Who Is Affected?

The scope of regulation expands dramatically:

  • Around 29,500 entities will now fall under the supervision of the BSI (Bundesamt für Sicherheit in der Informationstechnik – Federal Office for Information Security), compared to 4,500 previously.
  • Newly regulated organizations include those in critical sectors that meet specific thresholds for staff, revenue, and balance sheet.
  • These entities are classified as “essential” or “important” facilities. Operators of KRITIS (Critical Infrastructure) automatically qualify as “essential.”

Key Obligations

Affected companies must comply with three core requirements:

  1. Register as NIS2 entities within three months.
  2. Report significant security incidents to the BSI within 24 hours at the latest (with an update within 72 hours and a final report within 30 days).
  3. Implement and document risk management measures.

The BSI has issued guidance on the mandatory management training in this regard.

Registration Timeline

The BSI has announced a two-step registration process:

  • Step 1: Create an account on Mein Unternehmenskonto (MUK).
  • Step 2: From January 6, 2026, register via the new BSI portal, which will also serve as the reporting platform for major security incidents.

Call to Action

Non-compliance with NIS2 can not only lead to severe fines up to €10 million or 2% of global annual turnover, andpersonal liability for non-compliance, but in practical terms, it can also pose significant risks to a company’s cybersecurity.

Disclaimer: While every effort has been made to ensure that the information contained in this article is accurate, neither its authors nor Squire Patton Boggs accepts responsibility for any errors or omissions. The content of this article is for general information only, and is not intended to constitute or be relied upon as legal advice.

Stay Ahead on Consumer Privacy News

Not a subscriber yet? Subscribe here to be among the first to receive timely updates on the fast-moving world of data privacy, security, and innovation—delivered straight to your inbox.

Looking for deeper insights and expert analysis? You can also subscribe here to our privacy attorneys’ marketing communications for thought leadership and rich content when you need a more comprehensive perspective.

The 2025 legislative cycle marked a pivotal year in US privacy law, defined not only by continued nationwide expansion into Artificial Intelligence (AI) governance, children’s and teen privacy and online safety, as well as emerging data categories, but by a major restructuring of California’s privacy enforcement infrastructure. California’s introduction of the Delete Request and Opt-out Platform (DROP) system, the nation’s first centralized, statewide platform for managing consumer deletion requests; combined with sweeping reforms to the Consumer Privacy Fund, will materially increase CalPrivacy and attorney general enforcement capacity on a recurring, self-replenishing basis. These developments accompany completion of a far-reaching rulemaking package that imposes detailed obligations for Data Protection Impact Assessments (DPIAs or risk assessments), cybersecurity governance and Automated Decision-Making Technology (ADMT). At the same time, states beyond California have enacted targeted statutory reforms addressing neurotechnology, data-broker practices and minors’ online safety, underscoring that – absent federal preemption – state-driven models will continue to shape the national privacy compliance landscape in 2026. By January 2026, there will be 20 state consumer privacy laws in effect, several with unique material obligations. We detail what enterprises need to be prepared for in 2026 and explain why we believe next year will be a watershed period for consumer privacy in the US.

Continue Reading 2025 State Privacy Roundup: Key Trends and California Developments to Watch in 2026

Mass arbitrations—where a plaintiffs’ firm brings dozens, hundreds, or thousands of identical claims against a business—is a mechanism increasingly relied upon by the plaintiffs’ bar in the past few years.  This is because mass arbitrations enable a plaintiffs’ firm to create settlement pressure by leveraging unavoidable arbitration fees borne by a business regardless of the merits of the claims filed.  Further powered by litigation funding, plaintiffs’ firms have used the mass arbitration device to bring vexatious claims and escape review of the merits or any downside risk.

Continue Reading 2025 Mass Arbitration Year in Review

A Domino’s customer may proceed in her putative class action for violations of the California Invasion of Privacy Act (CIPA) against ConverseNow for its provision of an AI virtual assistant that processes restaurant telephone orders. In Taylor v. ConverseNow Technologies, Inc., Case No. 25-cv-00990-SI, 2025 WL 2308483 (N.D. Cal. Aug. 11, 2025), the Court held that a communication software provider that could potentially improve its software with collection of communications was plausibly violating CIPA even though it had an agreement with the business receiving the communications. This ruling serves a cautionary note to both software companies and – because of potential aiding and abetting liability – companies that use those technologies.

Case Background

According to the complaint, ConverseNow provides AI voice assistants to clients like Domino’s to answer calls and process orders. Plaintiff Eliza Taylor alleged she called Domino’s to place a delivery order, was routed to ConverseNow’s virtual assistant without notice, and then provided personally identifiable information (including her payment information and delivery address). Taylor alleged “ConverseNow has the capability to use caller communications” to improve its products and develop new ones. Taylor brought claims under CIPA, seeking statutory damages for herself and a putative class.

CIPA is an anti-wiretapping statute that imposes criminal and civil penalties. Cal. Penal Code §§ 631(a), 632(a).  Section 631(a) prohibits, among other things, (1) unauthorized wiretapping, (2) intercepting the contents of any wireline communication, or (3) using or attempting to use any information so obtained. Section 637.2 authorizes a private right of action and imposes statutory damages of at least $5,000 per violation without requiring proof of actual damages.

Court Adopts Capability Test To Uphold CIPA Claims Against Software Provider

Critically, CIPA exempts parties to a conversation from liability. In other words, both Taylor and Domino’s could “intercept” communications with each other or use a tape recorder to record communications. ConverseNow moved to dismiss on this basis, arguing that its AI voice assistant was simply an extension of its client, Domino’s, who was a party to the conversation.

The Taylor Court disagreed and held that ConverseNow was an intercepting third party and not covered by the exemption for Domino’s. The Court discussed two different approaches adopted by California federal courts: the “extension” test and the “capability” test. 

Under the extension test, a software provider is not liable under CIPA where it is a tool used by a party to the communication (akin to a tape recorder) and does not use communication for the software provider’s own purposes. 

Under the capability test, whether the software provider did use the communication for the software provider’s own purposes is irrelevant; the inquiry is whether the software provider had the capability to use the communication for its own purposes. 

Citing “[a] growing number of district courts,” the Taylor Court adopted the capability test as the better interpretation of CIPA. Applying the capability test, the Court held that Taylor sufficiently alleged ConverseNow is a third party based on its capability and actual use of data from customers’ calls “to improve its own product.”

After concluding that ConverseNow was a third party to the conversation, the Court quickly disposed of the defendant’s other CIPA arguments. The Court found that there were sufficient allegations of “interception” because Taylor did not realize her phone call was connected to a party other than Domino’s. Taylor’s complaint also satisfied the intent element of CIPA because it alleged that ConverseNow’s business model depended on recording conversations. Finally, the Court held that plaintiff alleged a “confidential” conversation for purposes of a Section 632 claim by alleging disclosure of her personally identifiable information and personal financial information.

Conclusion

Not all decisions addressing CIPA claims have reached similar outcomes – many in fact have been dismissed. However, as this decision demonstrates, CIPA provides significant risk for software providers and website operators, particularly when it comes to training AI models using real human interactions. Moreover, all businesses using or developing AI-powered platforms to provide services to customers should also take this ruling under consideration. Although AI software providers may primarily offer tools for their customers to use, state wiretapping laws like CIPA can extend liability to providers themselves based on the software’s capabilities.  Given the proliferation of AI across industries  – and state efforts to regulate its use  – additional litigation activity is anticipated going into 2026. Privacy World will keep you in the loop on further developments in this space. Stay tuned.

Disclaimer: While every effort has been made to ensure that the information contained in this article is accurate, neither its authors nor Squire Patton Boggs accepts responsibility for any errors or omissions. The content of this article is for general information only, and is not intended to constitute or be relied upon as legal advice.

Stay Ahead on Consumer Privacy News

Not a subscriber yet? Subscribe here to be among the first to receive timely updates on the fast-moving world of data privacy, security, and innovation—delivered straight to your inbox.

Looking for deeper insights and expert analysis? You can also subscribe here to our privacy attorneys’ marketing communications for thought leadership and rich content when you need a more comprehensive perspective.

This fall, a federal court in California granted summary judgment in favor of a website operator for alleged violations of the California Invasion of Privacy Act (CIPA). In its decision, the Court emphasized that it was “virtually impossible” to apply CIPA to internet communications and urged the California legislature to “step up” and “speak clearly” about how internet activity should be treated under the statute in light of a deluge of claims that have been filed recently against website operators.

Continue Reading California Federal Court Urges California Legislature to Clean Up “Total Mess” of State Wiretap Act, Dismisses Claim for Website Tracking

Over the past year, there has been an explosion of lawsuits targeting website analytics and tracking tools. One recent decision brought businesses another victory in challenging lawsuits alleging violations of the California Invasion of Privacy Act’s (CIPA)’s prohibition against use of “pen registers” and “trap and trace devices.” Cal. Penal Code § 638.51. In a recent ruling, a federal judge in the Central District of California dismissed one such lawsuit, holding that the claim could not be asserted in federal court.

Continue Reading Federal Court Dismisses “Trap and Trace” Lawsuit for Plaintiff’s Lack of Injury

In early October, a federal court in the Northern District of Illinois refused to dismiss a privacy litigation brought against a healthcare website operator for claims under the Electronic Communications Privacy Act (ECPA). The court held that the plaintiff plausibly alleged that Defendant violated the Health Insurance Portability and Accountability Act (HIPAA) by revealing to a third party that she clicked on the login button to the healthcare provider’s patient portal, and, as a result, disclosed her individually identifiable healthcare information—even though no third-party data collection tools were installed on the patient portal itself. Hartley v. Univ. of Chi. Med. Ctr., Case No. 22-cv-5891, 2025 WL 2802317 (N.D. Ill. Oct. 1, 2025).  However, at the same time, the court dismissed certain claims arising out of Plaintiff’s use of a “find-a-physician feature,” rejecting the full scope of Plaintiff’s theories. On the balance, this decision unfortunately broadens the scope of potential liability under the ECPA and will likely result in ECPA suits being brought against website operators in the healthcare sector.

Continue Reading Federal Court Holds That Button-Click Data From Public Website Can Disclose Patient Status in Violation of the ECPA

Earlier this fall, the United States Court of Appeals for the Second Circuit undermined a strategy often used by the plaintiff’s bar in privacy claims: the threat of mass arbitration fees.  In a decision reversing the district court, the Second Circuit held that the petitioners cannot use the Federal Arbitration Act (FAA) to compel arbitration on the basis that a business failed to pay arbitration fees.  This decision adds to a growing body of precedent that courts cannot compel a business to pay arbitration fees, which as discussed previously here on Privacy World, can total in the thousands or millions of dollars in the event of mass arbitration.

Case Background

The case arose out of large-scale layoffs that took place at Twitter (now X Corp.) after its acquisition by Elon Musk in 2022.  Thousands of terminated employees who had signed arbitration agreements as part of their contracts brought arbitration actions against Twitter.

The employee argued that, under the applicable JAMS guidelines, a respondent business like Twitter must pay all arbitration fees other than the initial filing fees. Twitter argued that the arbitration fees should be split pro rata under the terms of the employment contracts.  JAMS sided with the employees and refused to appoint an arbitrator until the fees were paid.  The employees then filed a petition in the Southern District of New York under section 4 of the FAA seeking “an order compelling Twitter to pay all ongoing fees for their arbitrations.”  The district court sided with the employees and ordered Twitter to pay all of the disputed fees.  Twitter appealed.

Second Circuit Reverses Lower Court’s Ruling on Fees, Finding That a Contrary Holding Would Undermine Purpose, Goals of Arbitration

The Second Circuit reversed the district court’s ruling.  The Court started by recognizing that the FAA only allows a court to compel arbitration where there has been a “failure, neglect, or refusal” to arbitrate.  9 U.S.C. § 4.  The Court then cited a body of caselaw holding that procedural issues beyond arbitrability—including waiver, delay, and forum-specific defenses—”are presumptively not for the judge, but for an arbitrator, to decide.”  Putting these threads together, the Court reasoned that the payment of fees is merely a procedural issue that must be decided and enforced by an arbitration panel and not a “failure, neglect, or refusal” to arbitrate.  In reaching this result, the court cited the Third, Fifth, Ninth, and Eleventh Circuits which have reached similar conclusions.

Supporting its reasoning, the Second Circuit stated that the employees’ position would undermine “the twin goals of arbitration, namely, settling disputes efficiently and avoiding long and expensive litigation.”  Without the FAA, the employees’ remedies for non-payment is “to [ask] JAMS to use the tools available to it to resolve the procedural [issue] as it sees fit – even if that ultimately means terminating the arbitrations.”

This case gives businesses in the Second Circuit an extra line of defense when facing large fees from mass arbitration—and offers persuasive authority for defendants litigating in other forums.  

Even so, companies should stay vigilant and carefully review the language in existing arbitration agreements to make sure their potential exposure to mass arbitrations in the first place are minimized.  This is particularly so given the recent abuse of mass arbitration as a procedural mechanism by the plaintiff’s bar to bring frivolous or unsupported claims, particularly in the area of consumer privacy.

Privacy World will keep you in the loop on further developments in mass arbitration.  Stay tuned.

Disclaimer: While every effort has been made to ensure that the information contained in this article is accurate, neither its authors nor Squire Patton Boggs accepts responsibility for any errors or omissions. The content of this article is for general information only, and is not intended to constitute or be relied upon as legal advice.