Since TransUnion LLC v. Ramirez, a reliable defense playbook in data privacy class actions has been to recast the plaintiff’s injury as a speculative future risk: no identity theft, no fraud, no out-of-pocket loss, and so no standing. In a published opinion issued October 9, 2026, the Ninth Circuit offered plaintiffs a different route.
I. Introduction
Earlier this year, the American Arbitration Association (“AAA”) published Mass Arbitration in Transition: What 2025 Data Reveals About a Shifting Landscape. This is the AAA’s second annual look at the mass arbitrations filed on its docket. At first glance, the headline number looks like good news for businesses: the AAA received approximately
On Friday the U.S. Court of Appeals for the Fifth Circuit revived a putative privacy class action alleging that an optical retailer disclosed customers’ health-related website activity to Meta Platforms, Inc. through the Meta Pixel without their knowledge or consent.
In its October 23, 2026, published decision in Rand v. Eyemart Express, L.L.C., the
As privacy regulation, AI governance, and cybersecurity requirements continue to evolve globally, members of Squire Patton Boggs’ Data Privacy, Cybersecurity & Digital Assets team will be speaking on legal developments at several upcoming webinars, conferences, and CLE programs. Explore the events and hot topics below. For many of these programs we can arrange free passes for clients and are noted below. We look forward to connecting with you!
Continue Reading Upcoming Speaking Engagements and CLE Opportunities with the SPB Data Team
As we flagged last month in our mid-year U.S. privacy roundup, the Delaware legislature recently passed House Bill 380 (“HB 380”), which amends the Delaware Personal Data Privacy Act (the “Act”) in ways that impose significant new, and in many ways complex and novel, requirements on controllers, processors and third parties. On September 2, 2026, Delaware Governor Matt Meyer signed House Bill 380 into law and thus amended what was already a fairly strict state consumer privacy law. These amendments significantly lower the volume-based thresholds for applicability, create new obligations for providers of “reports” used to make certain types of decisions and businesses that use that data, add new requirements for consumer rights, impose restrictions on profiling job applicants, employees and independent contractors, and require contracts with and obligations from third parties that receive personal data (e.g., sales), among many other changes. These amendments will become effective on January 1, 2027.
Businesses that are subject to the Act (of which there will be many more as a result of HB 380) should carefully review the amended Act to determine their new obligations, including the significant amendments discussed below. Financial institutions in particular should determine whether they must now comply with the Act, as the broad exemption for financial institutions subject to Title V of the Gramm-Leach-Bliley Act (the “GLBA”) has been replaced by a narrower exemption for only certain types of financial institutions and certain of their affiliates (see discussion below).
Continue Reading Amendments to Delaware’s Consumer Privacy Law Deepen the Morass of State Privacy Regulation
The Guidelines 03/2026 on web scraping in the context of generative AI, adopted by the European Data Protection Board “EDPB” for public consultation on 7 July 2026, are notable not only for what they require but for what they acknowledge. The document is unusually candid about three limitations: an epistemic one (the controller may not always know what it has collected), a technical one (what a model has learned cannot, today, be easily unlearned), and an institutional one (some of the assessments woven into the GDPR analysis sit, at least in part, with other authorities and courts). These acknowledgements are welcome, and they distinguish the text from more declaratory guidance. The tension is that the requirements built on top of them are not always adjusted accordingly, and that gap, between what the EDPB admits and what it nonetheless requires, is where the most interesting questions of the consultation lie.
Briefly, the Guidelines cover scraping performed by private entities, whether carried out in-house, commissioned from a third party or effected through the acquisition of pre-scraped datasets. They work through the familiar sequence: allocation of controller and processor roles, the core principles of Article 5 GDPR (purpose limitation, transparency, minimization, accuracy), the choice of legal basis, with legitimate interest under Article 6(1)(f) GDPR treated as the realistic candidate and consent all but discarded, and the treatment of special categories of data incidentally swept up in the collection, for which the EDPB adapts the CJEU’s GC & Others framework. Little of this structure will surprise anyone who has followed the Board’s recent work on AI. What rewards attention is how each of these familiar steps is made to function once the three limitations above enter the analysis.
Continue Reading Regulating the Irreversible: The EDPB’S Web Scraping Guidelines and the Limits of GDPR Orthodoxy
Privacy compliance has entered a new phase—one defined not only by high-profile enforcement actions but by the growing expectation that organizations implement and maintain mature information governance programs capable of validating true, system-level technical compliance rather than merely projecting the appearance of it. A spate of recent California enforcement actions makes clear that companies must be prepared to validate how privacy control’s function, including across systems, platforms, and data flows, making thoughtful, system-oriented self-assessment an increasingly important tool for aligning policy commitments with operational reality—before regulators do it for them. SPB helps client’s self-access, identify gaps and remediate issues under the cloak of privilege.
Continue Reading CalPrivacy Update: Shifting to Structural Compliance and Auditing
On January 18, during a luncheon fireside chat at the California Lawyers Association’s UCL Institute event in Los Angeles, Federal Trade Commission (“FTC”) Bureau of Consumer Protection Director Samuel Levine shared his insights on what data practices are of concern to him and to the FTC. Companies should take heed of his comments, the highlights
The UK Data Protection and Digital Information Bill (the Bill) received its second reading in the House of Lords on 19 December 2023. Although the Bill cleared that crucial milestone, the debate focused on the government’s last-minute introduction of sweeping powers enabling the Secretary of State to require banks and other financial service providers to monitor and to provide information from accounts into which benefits are paid. Although ostensibly intended to identify fraud, the Lords echoed the view expressed by campaigning group, Big Brother Watch, that it would be:
“wholly inappropriate for the UK Government to order private banks, building societies and other financial services to conduct mass, algorithmic, suspicionless surveillance and reporting of their account holders on behalf of the state”.
Continue Reading Government access to personal data in bank accounts: a compliance challenge for banks, and a threat to EU adequacy?
On January 16, Governor Murphy signed S332 (Sixth Reprint) into law, making New Jersey the 13th or 14th state (depending on if you count Florida) with a consumer privacy law on the books. We previously covered the now enacted law here. S332 applies to controllers and processors who conduct business in