In case you missed it, below are recent posts from Privacy World covering the latest developments on data privacy, security and innovation. Please reach out to the authors if you are interested in additional information.
Pen Register and Trap-and-Trace Claims Involving Websites and Apps Restricted to Enforcement by the California Attorney General as Governor Newsom Signs SB-690
Businesses with websites that employ cookies and other tracking technologies (collectively, “internet tracking technology”) can breathe a partial sigh of relief. The private right of action under the California Invasion of Privacy Act (“CIPA”), relating to violations of Section 638.51 “alleged to arise from conduct occurring on an internet website, online application, or mobile application,” will be eliminated as of January 1, 2027, as Governor Newsom signed SB-690 on September 30, 2026. The law is retroactive and will apply to all pending lawsuits that commenced after January 1, 2025. Only the California Attorney General will be able to bring pen register and trap-and-trace claims related to conduct occurring on websites, apps, and mobile apps.
However, SB-690 is not a total shield to CIPA claims arising from internet tracking technology, as it does not address other CIPA provisions such as wiretapping (Section 631) and eavesdropping (Section 632), which are frequently used by plaintiffs to target common internet tracking technology notwithstanding that these laws predate internet tracking technology and conflict with the way the newer California Consumer Privacy Act regulates them. In Governor Newsom’s signing statement, he specifically called on the California Legislature to address CIPA again next year to address CIPA’s “other decades-old statutes that are also susceptible to abuse by overly aggressive litigants,” while “ensur[ing] a fair balance between protecting private information and preventing rapacious litigation.”
Continue Reading Pen Register and Trap-and-Trace Claims Involving Websites and Apps Restricted to Enforcement by the California Attorney General as Governor Newsom Signs SB-690
The Future of the CA Age-Appropriate Design Code Act: What Remains, What’s Still Open to be Contested, and What Companies Must Consider for Minors’ Online Safety
Following unanimous votes by the California legislature and signature by the Governor, California enacted an Age-Appropriate Design Code Act (CAADCA) in September 2022 (codified at CA Civil Code Section 1798.99.28-32), as a measure purportedly “aimed at protecting the wellbeing, data, and privacy of children [under 18] using online platforms.” Industry group NetChoice soon turned to federal court and sought an injunction seeking to prevent the law from being enforced on the grounds, among others, that it violates the First Amendment and the dormant Commerce Clause of the United States Constitution and is preempted by other federal statutes addressing online child safety, including the Children’s Online Privacy Protection Act (COPPA).
Continue Reading The Future of the CA Age-Appropriate Design Code Act: What Remains, What’s Still Open to be Contested, and What Companies Must Consider for Minors’ Online Safety
California AG Issues Highest Fine to Date for CCPA Violations
In another settlement of a cookie-related state consumer privacy law enforcement action, California reinforces contract requirements for making personal information available and raises questions about the scope of purpose limitation requirements, especially where the nature of the data and/or its use could run counter to consumer expectations.
On July 1, 2025, the California Office of the Attorney General (OAG) announced a settlement against Healthline, which included the largest CCPA settlement to date – $1.55 million – and many “firsts” for public CCPA enforcement: the first involving a publisher, the first health information-related enforcement action, and the first time the purpose limitation principle has been invoked by California’s (or any other state’s) regulators in a public regulatory enforcement context. This enforcement action came just a week before Connecticut’s attorney general announced an $85,000 settlement under the Connecticut state privacy law explored in more detail here.
Continue Reading California AG Issues Highest Fine to Date for CCPA Violations
Privacy World Week in Review
In case you missed it, below are recent posts from Privacy World covering the latest developments on data privacy, security and innovation. Please reach out to the authors if you are interested in additional information.
In Narrow Vote California Moves Next Generation Privacy Regs Forward | Privacy World
Potential CCPA Fines “Significant”, California AG’s Office “Plotting” and Other Takeaways From Privacy Regulators during Privacy Summit in Los Angeles
Hundreds of lawyers and several privacy regulators from California, Washington State, Oregon, Colorado, Connecticut, and the Federal Trade Commission gathered in Los Angeles last week for the second annual California Lawyers Association Privacy Summit (“Summit”). Among many engaging sessions on pressing topics, the panels with privacy regulators stood out discussions on enforcement priorities and administrative fines and injunctions, along with punchy and newsworthy statements – including that they are “plotting” and that considering the typical investigation presents “hundreds or thousands of violations,” potential fines are “significant.”
Perhaps even more newsworthy is that due to a California Court of Appeal order laid down as the Summit wound down on Friday, the stay in enforcement of the CCPA regulations was lifted. This happened as many companies were treating March 29, 2024, the end of the stay period, as the effective and enforcement date of regulations promulgated under the CPRA’s amendments by the California Privacy Protection Agency. The appeals order also nullifies the year delay in effectiveness of issued CCPA regulations that the trial court had required, making almost certain that CCPA regulations on risk assessments, cybersecurity assessments, and automated decision-making and profiling will be promulgated and in effect sometime this year, perhaps as early as Q2 or Q3.
Will 2024 be the year of privacy enforcement? In view of signaling from California regulators and those in other jurisdictions, and in view of several upcoming effective dates and regulatory deadlines, ongoing enforcement by regulators in California and beyond, and an impending uptick in privacy enforcement, it just might be. Stay tuned for future posts on these issues. Keep reading for more detailed takeaways regarding the Summit.
Continue Reading Potential CCPA Fines “Significant”, California AG’s Office “Plotting” and Other Takeaways From Privacy Regulators during Privacy Summit in Los Angeles
Privacy World Week in Review
In case you missed it, below are recent posts from Privacy World covering the latest developments on data privacy, security and innovation. Please reach out to the authors if you are interested in additional information.
Connecticut Attorney General Report: CTDPA Enforcement Insights & Takeaways | Privacy World
California Attorney General Announces Industry Investigative Sweep into
2023 State Privacy Laws and Regulations Bring Extensive Data Protection Assessment Requirements
On January 1st of this year, the Virginia Consumer Data Protection Act (“VCDPA”) and amendments to the California Consumer Privacy Act (“CCPA”) went into effect. Later this year, the Colorado Privacy Act (“CPA”), Connecticut’s Public Act No. 22-15 (known as the “Connecticut Privacy Act” or “CTPA”), and the Utah Consumer Privacy Act (“UCPA”) will go into effect as well. Aside from the UCPA, these laws will obligate covered entities to document and assess certain processing activities in formal data protection assessments, which will be available to regulators. The purpose is to require companies to look critically at high-risk data processing activities and avoid unjustifiable risks and negative impacts on data subjects. Assessments can also serve the purpose of maintaining current data inventories and retention schedules and ensuring that processing is not inconsistent with the notified purposes at the time of collection.
Continue Reading 2023 State Privacy Laws and Regulations Bring Extensive Data Protection Assessment Requirements
The Bare Minimum and More: Complying with the Contracting Requirements under U.S. Privacy Laws
Part 1 of How to Approach DPAs in view of Final CCPA Regs: A Series
This is the first in our series of blog posts on top considerations for approaching data processing terms required under the state privacy laws that have, or will, come into effect this year, namely the California Consumer Privacy Act, as
Privacy World Week in Review
In case you missed it, below are recent posts from Privacy World covering the latest developments on data privacy, security and innovation. Please reach out to the authors if you are interested in additional information.
FTC Signals More Criminal Referrals for Negative Option Fraudsters | Privacy World