Search results for: california consumer privacy act

This fall, a federal court in California granted summary judgment in favor of a website operator for alleged violations of the California Invasion of Privacy Act (CIPA). In its decision, the Court emphasized that it was “virtually impossible” to apply CIPA to internet communications and urged the California legislature to “step up” and “speak clearly” about how internet activity should be treated under the statute in light of a deluge of claims that have been filed recently against website operators.

Continue Reading California Federal Court Urges California Legislature to Clean Up “Total Mess” of State Wiretap Act, Dismisses Claim for Website Tracking

Did we miss you November 20th for our Navigating the App Store Age Verification Laws webinar? Not to worry! See link below to the recording

Watch Kyle Fath, Partner (Los Angeles), for a webinar discussion with Hailun Ying (Head of PrivSec Legal, Roblox), Amy Lawrence (Head of Legal, Chief Privacy Officer, SuperAwesome) where we dove into the burning topics that are (or should be) top of mind for app stores and companies that own or operate mobile apps.

Click here to watch full webinar.

December 3, 2025, at 10:00 am – 5:00 pm ET

National Business Institute is holding a live webinar “Business Data Privacy and Cybersecurity Tool Kit” on December 3rd. Join Julia Jacobson, Partner (New York) and Matthew Flora, Managing Director for the Ankura Consulting Group, LLC, for the following sessions:

II. Identifying Vulnerabilities: Business Data Audits 11:00 am ET

VI. Breach Response and Incident Reporting: What to Do First and Next 2:45 pm ET

For more information, click here.

December 8, 2025, at 1:00 pm ET

Join Alan Friel, Partner (Los Angeles) and Lydia de la Torre, Of Counsel (Palo Alto) on the panel for “Essential Elements of a Privacy Notice for Connected Devices” at PLI California (455 Market Street, San Francisco) as part of PLI’s Advanced Internet of Things 2025: Deeper Dive, Practical Wisdom program.

January 7, 2026, at 1:00 pm ET

Join Alan Friel, Partner (Los Angeles), Kyle Fath, Partner (Los Angeles), and Jennifer Oliver, Shareholder with Buchanan Ingersoll & Rooner PC for “New California Cybersecurity and Data Privacy Laws,” a Strafford Live CLE Webinar.

For more information click here

February 20, 2026 at 10:00 am – 1:15 pm ET

Join Julia Jacobson, Partner (New York) and the National Business Institute for a live webinar discussion on “Data Security: A Business Attorney’s Guide“. Julie will be speaking at the following sessions:

I. “Core Data Security Concepts and Current Laws” 10:00 am ET

IV. “Breach Response and Litigation” 12:30 pm ET

For more information, click here.

Stay Ahead on Consumer Privacy News

Not a subscriber yet? Subscribe here to be among the first to receive timely updates on the fast-moving world of data privacy, security, and innovation—delivered straight to your inbox.

Looking for deeper insights and expert analysis? You can also subscribe here to our privacy attorney’s marketing communications for thought leadership and rich content when you need a more comprehensive perspective.

We have previously covered the recent changes to the California Consumer Privacy Act (CCPA) regulations, and summarized the changes companies need to make to be 2026-ready under them and other state consumer privacy laws that have recently or will soon become effective.  In a recent guidance document, CalPrivacy highlights “seven things businesses should know and prepare for,” which are:

Continue Reading CalPrivacy Highlights Regulatory Changes for 2026

The California Consumer Privacy Act (CCPA) requires that privacy notices be updated annually, and that the detailed disclosures it proscribes be in those notices reflect the 12-month period prior to the effective (posting) date. Interestingly, failure to make annual updates was one of several alleged CCPA violations that resulted in a recent $1.35 Million administrative civil penalty by the California Privacy Protection Agency (CPPA) against retailer Tractor Supply Company. Also, three more state consumer protection laws go into effect on January 1, 2026, which will require notice and consumer rights intake changes, if applicable. Additionally, new and amended CCPA regulations will bring new obligations for businesses starting the first of the year that need to be addressed between now and then. Also recommended is a general checkup with particular attention to enforcement priorities.

Continue Reading Your Year-end U.S. Privacy “To Do” List – don’t wait until the holiday crush to become 2026-ready

On September 25, the California Privacy Protection Agency (CPPA) Board advanced OAL-approved updates to the California Consumer Privacy Act (CCPA), the process of which we covered in detail here and here, that include long-awaited regulations on cybersecurity audits, risk assessments, and automated decision-making technology (ADMT). The CPPA Board also approved a $1.35 Million settlement with Tractor Supply Company, officially announced this week. At last week’s meeting, staff reported that there were hundreds of investigations and enforcement actions in progress, many of which were at a stage that the applicable businesses were not yet aware that they are a target. 2026 will bring new privacy obligations for businesses and greater repercussions for half-baked compliance efforts.

Continue Reading California Privacy Agency Rolls Out New Regulations and Approves $1.35 Million Penalty in Latest CCPA Enforcement Action

Date: September 10, 2025 at 12:00 PM EDT

Format: Live Video

Duration: 1 Hour

Description: With limited federal regulation on consumer protection, data privacy, and AI, states are stepping in, creating a patchwork of laws that vary widely in scope and enforcement. While California and Colorado set high standards, other states like Maryland, Minnesota, and Oregon are introducing even stricter measures. Additional laws around consumer health data, data brokers, and child/teen online safety further complicate the landscape.

This panel will explore key differences and overlaps in state laws, highlight enforcement trends, and offer practical strategies for enterprises to implement privacy programs across states and globally. Attendees will receive comparison charts to support compliance efforts.

Continue Reading State Privacy and AI Law Updates – A Live Legal Briefing You Won’t Want to Miss

On June 30, 2025, the California Civil Rights Council (CRC) secured final approval for regulations addressing employment discrimination resulting from the use of artificial intelligence and other algorithms it collectively refers to as Automated-Decision Systems. Shortly after that, on July 24, 2025, the California Privacy Protection Agency Board approved its own long-anticipated regulations on cybersecurity audits, privacy risk assessments and automated decision-making technology, also covering human resources applications, under the California Consumer Privacy Act (CCPA). The CRC regulations are effective October 1, 2025. The CCPA regulations are likely to also become effective on that date, but obligations will phase in over time. Read our latest insight on our website to learn how to prepare.

Disclaimer: While every effort has been made to ensure that the information contained in this article is accurate, neither its authors nor Squire Patton Boggs accepts responsibility for any errors or omissions. The content of this article is for general information only and is not intended to constitute or be relied upon as legal advice.

Announcing the July 31, 2025, effectiveness of Minnesota’s strict consumer privacy law (CPL), the Act’s author said in a press release that he will be personally making requests to a “long list of ‘data brokers’ … [to] provide a timely ‘test case’ that we can use to measure compliance….”  Until January 31, 2026, businesses will have 30 days to cure violations.

Continue Reading Minnesota’s Comprehensive Privacy Law Takes Effect – and Enforcement Efforts Begin Immediately

On July 24, the California Privacy Protection Agency Board unanimously voted to approve the May 9 draft of its proposed edits and additions to regulations under the California Consumer Privacy Act (CCPA), which we broke down in detail here.  There were 575 pages of comments from 70 commentators regarding that last set of changes, but staff concluded that no further changes were appropriate in response to these comments and the Board agreed.  So now, a final package will be prepared and presented to the Office of Administrative Law (OAL) to confirm the regulations are consistent with the CCPA and administrative procedures.  That package will include more detailed explanation of why rejected comments were rejected, with the goal of providing guidance especially regarding interpretation issues.  Assuming OAL approval, key implementation dates will be:

Continue Reading New California Privacy Regulations Passed by Board

In another settlement of a cookie-related state consumer privacy law enforcement action, California reinforces contract requirements for making personal information available and raises questions about the scope of purpose limitation requirements, especially where the nature of the data and/or its use could run counter to consumer expectations. 

On July 1, 2025, the California Office of the Attorney General (OAG) announced a settlement against Healthline, which included the largest CCPA settlement to date – $1.55 million – and many “firsts” for public CCPA enforcement: the first involving a publisher, the first health information-related enforcement action, and the first time the purpose limitation principle has been invoked by California’s (or any other state’s) regulators in a public regulatory enforcement context. This enforcement action came just a week before Connecticut’s attorney general announced an $85,000 settlement under the Connecticut state privacy law explored in more detail here.

Continue Reading California AG Issues Highest Fine to Date for CCPA Violations