On July 20, 2026, Pennsylvania Governor Josh Shapiro signed into law Senate Bill 992 (“SB 992”), which significantly amends the Pennsylvania Telemarketer Registration Act (the “Act”), 73 P.S. §§ 2241 et seq. The legislation has important implications for companies that engage in telemarketing, SMS/text message marketing, customer outreach campaigns, and other consumer-facing communications with Pennsylvania
In case you missed it, below are recent posts from Privacy World covering the latest developments on data privacy, security and innovation. Please reach out to the authors if you are interested in additional information.
Businesses with websites that employ cookies and other tracking technologies (collectively, “internet tracking technology”) can breathe a partial sigh of relief. The private right of action under the California Invasion of Privacy Act (“CIPA”), relating to violations of Section 638.51 “alleged to arise from conduct occurring on an internet website, online application, or mobile application,” will be eliminated as of January 1, 2027, as Governor Newsom signed SB-690 on September 30, 2026. The law is retroactive and will apply to all pending lawsuits that commenced after January 1, 2025. Only the California Attorney General will be able to bring pen register and trap-and-trace claims related to conduct occurring on websites, apps, and mobile apps.
However, SB-690 is not a total shield to CIPA claims arising from internet tracking technology, as it does not address other CIPA provisions such as wiretapping (Section 631) and eavesdropping (Section 632), which are frequently used by plaintiffs to target common internet tracking technology notwithstanding that these laws predate internet tracking technology and conflict with the way the newer California Consumer Privacy Act regulates them. In Governor Newsom’s signing statement, he specifically called on the California Legislature to address CIPA again next year to address CIPA’s “other decades-old statutes that are also susceptible to abuse by overly aggressive litigants,” while “ensur[ing] a fair balance between protecting private information and preventing rapacious litigation.”
Continue Reading Pen Register and Trap-and-Trace Claims Involving Websites and Apps Restricted to Enforcement by the California Attorney General as Governor Newsom Signs SB-690
On July 22, 2026, the Cyberspace Administration of China (CAC) and the Ministry of Public Security jointly issued the Provisions on Simplified Measures for Personal Information Protection by Small-Scale Personal Information Handlers (the “Provisions”), which will take effect on September 1, 2026.
The Provisions are designed to reduce compliance burdens for smaller businesses, while maintaining baseline personal information protection requirements. They introduce a series of streamlined compliance measures for qualifying entities in China.
Continue Reading China Introduces Simplified Personal Information Protection Regime for Small-Scale Personal Information Handlers
One of our own is helping shape the conversation. Alan Friel, Partner, and contributing author to our blog, will serve as a featured speaker in an upcoming live CLE webinar tackling one of the most rapidly developing areas of digital privacy regulatory enforcement and litigation.
In the first hour of the webinar, “Cookie Banner
The Colorado AI Act (SB24-205) is effectively frozen just weeks before its June 30, 2026 effective date, following a stay in enforcement of the law by a Magistrate Judge in the District of Colorado on April 27, 2026.
By way of background, on April 9, xAI filed suit in federal court seeking to enjoin
Recently, the United States Court of Appeals for the Seventh Circuit, in a unanimous decision, prevented plaintiffs from imposing massive liability on a company accused of violating the Illinois Biometric Information Privacy Act (“BIPA”) and held that Illinois’ 2024 amendment decreasing BIPA damages applies retroactively.
Continue Reading Seventh Circuit Holds Amendment Decreasing BIPA Exposure Applies Retroactively
On March 20, 2026, Oklahoma Governor Stitt signed the first new comprehensive state privacy law of 2026. The “Act relating to data privacy” is in force on January 1, 2027. In this post, we compare the new Oklahoma privacy law to the other 20 state consumer privacy laws already in force below.
Continue Reading Oklahoma’s New Privacy Law Sweeps In
Following unanimous votes by the California legislature and signature by the Governor, California enacted an Age-Appropriate Design Code Act (CAADCA) in September 2022 (codified at CA Civil Code Section 1798.99.28-32), as a measure purportedly “aimed at protecting the wellbeing, data, and privacy of children [under 18] using online platforms.” Industry group NetChoice soon turned to federal court and sought an injunction seeking to prevent the law from being enforced on the grounds, among others, that it violates the First Amendment and the dormant Commerce Clause of the United States Constitution and is preempted by other federal statutes addressing online child safety, including the Children’s Online Privacy Protection Act (COPPA).
Continue Reading The Future of the CA Age-Appropriate Design Code Act: What Remains, What’s Still Open to be Contested, and What Companies Must Consider for Minors’ Online Safety
In its press release relating to the Court of Justice of the European Union (CJEU) judgment of 10 February 2026 in Case C-97/23 P, the CJEU has confirmed that the action brought by an organization against a Binding Decision of the European Data Protection Board (EDPB) is admissible.
With this decision, the CJEU has clarified that organizations have a right of direct appeal against binding decisions of the EDPB on which a national authority’s decision against them is based.
Continue Reading EDPB Binding Decisions Can Be Challenged Directly by Organizations Before EU Courts