Privacy Law and Privacy Regulations

The California Supreme Court's decision in J.M. v. Illuminate Education has fundamentally altered the requirements for data breach claims under the state's Confidentiality of Medical Information Act. This ruling creates new exposure for companies by eliminating the need to prove unauthorized viewing of medical data, while simultaneously clarifying which entities fall under the statute's jurisdiction.

California's Digital Age Assurance Act (DAAA) is set to fundamentally reshape how operating system providers and app developers handle age verification, with its January 1, 2027 effective date rapidly approaching. The law creates a comprehensive system where operating systems collect age information and provide age-band signals to developers, effectively eliminating the ability for companies to claim ignorance about whether their users are children.

Businesses operating websites and mobile applications have faced a growing wave of lawsuits under the California Invasion of Privacy Act (CIPA), a 1967 statute enacted long before the modern internet. Plaintiffs increasingly argue that common website technologies—including cookies, pixels, and analytics tools—violate CIPA provisions originally aimed at wiretapping, eavesdropping, and pen registers.