United States: Data Protection

State legislatures are changing data privacy laws quickly while the federal framework is still unsettled. One thing is clear, which is that businesses are expected to understand which AI systems they use at any given moment, what data those systems rely on, how AI decisions impact people, and whether the appropriate legal safeguards are in place.

Los Angeles County has secured its first pre-litigation settlement with Walmart and Sam's Club over alleged pixel tracking of sensitive health-related purchases, marking a significant shift in privacy enforcement to the county level. The settlement includes substantial monetary penalties and permanent injunctions against undisclosed tracking practices. This case signals a new wave of local government privacy enforcement that could dramatically expand retailers' legal exposure beyond traditional class action

A Florida federal judge denied class certification and dismissed a pixel tracking lawsuit against an online veterinary pharmacy, ruling that plaintiffs lacked Article III standing because they had no privacy interest in the information collected. The decision provides important insights for e-commerce companies navigating the complex landscape of third-party pixel tracking technology and federal and state wiretapping laws.

California's CCPA risk assessment regulations create unexpected compliance obligations across common workplace technologies. From AI-powered hiring tools and dash cams to employee monitoring software...

A consolidated class action lawsuit against Otter.AI reveals how AI products that collect and train on user data face significant legal exposure under privacy statutes, unfair competition laws, and invasion of privacy torts. The case demonstrates that privacy policies alone may not shield companies from liability, particularly when they shift consent obligations to customers or obscure how user data trains AI systems.

On July 1, 2026, the amendments to Connecticut’s Data Privacy Act (“CTDPA”), Senate Bill 1295 (“SB 1295”), took effect, expanding the state comprehensive privacy law’s applicability and definition of “sensitive data.” Enacted in June 2025, SB 1295 is just one of many amendments to the CTDPA since the law’s passage in 2022.

A California appellate court has ruled that plaintiffs must demonstrate actual harm beyond mere statutory violations to pursue claims under the state's Automated License Plate Recognition law. The decision clarifies standing requirements and emphasizes the importance of implementing and publicly displaying ALPR privacy policies, while leaving open questions about what constitutes sufficient harm at the pleading stage.

A U.S. Supreme Court ruling has declared the FTC's statutory removal protections unconstitutional, potentially jeopardizing the European Commission's adequacy decision that enables EU-U.S. data transfers. This development could force companies to reconsider their data transfer strategies as European courts may challenge the independence of U.S. oversight authorities. The decision raises critical questions about the future of transatlantic data flows and the EU-U.S. Data Privacy Framework.

California businesses face an ongoing surge of privacy litigation targeting routine website analytics and advertising tools under CIPA, despite court rulings requiring plaintiffs to demonstrate actual harm. With proposed legislation SB 690 offering potential relief by eliminating certain private rights of action, companies must navigate an evolving legal landscape where the scope of decades-old wiretapping statutes applied to modern web technologies remains hotly contested.