Privacy Law and Privacy Regulations

New York's finalized rules for the Kids Online Safety Act establish comprehensive age assurance requirements that could reshape how digital platforms verify and protect young users. These regulations introduce specific technical standards and compliance obligations that extend beyond previous state-level attempts at child protection online. The framework may serve as a template for other jurisdictions considering similar protective measures for minors in digital spaces.

A new wave of comprehensive state privacy laws is on the horizon for 2026 and beyond. Alabama, Louisiana, Oklahoma, and Vermont have each enacted consumer data privacy statutes that will come online over the next few years, extending the patchwork and raising the stakes for multi‑state compliance programs.

The Department of Health and Human Services recently settled with Spencer Gifts following a 2021 ransomware attack that exposed employee health plan information, demonstrating that HIPAA compliance extends beyond traditional healthcare providers. Employer health plans are covered entities under HIPAA, requiring comprehensive risk assessments, security policies, and workforce training—obligations that many non-healthcare organizations may not realize apply to them.