United States: Privacy Protection

California's Court of Appeal has issued a tentative ruling in Variety Media v. Superior Court addressing whether CIPA's pen register provision applies to website tracking technologies, while the state legislature simultaneously advances Senate Bill 690 to eliminate private enforcement of these claims.

Meta Platforms Inc. has entered into a landmark settlement with 52 attorneys general imposing comprehensive injunctive relief that will fundamentally reshape how its social media platforms serve teen users...

As artificial intelligence becomes increasingly embedded in consumer-facing products and services, questions of transparency, fairness, and accountability have moved to the forefront of regulatory concern.

A California company facing a CIPA violation demand letter over its use of Google Analytics 4 and HubSpot has taken the unprecedented step of filing a preemptive declaratory judgment action against serial litigant Vivek Shah. The case now tests whether federal courts will entertain such reverse actions when a plaintiff has sent hundreds of similar demand letters but hasn't yet filed the actual lawsuit.

In Episode 16 of The AI Arena, host Sean Shecter is joined by Ankura Consulting Senior Managing Directors Chuck Peruchini and John Schrader to examine the rapid rise of lower cost Chinese AI models, and what their growing capabilities could mean for businesses evaluating their usage.

A California federal court recently dismissed pixel tracking claims against a healthcare company for lack of Article III standing, finding that the plaintiff failed to demonstrate a concrete injury because the collected information was not sensitive or private. The decision adds to growing judicial skepticism toward pixel tracking lawsuits and provides important guidance for businesses using third-party tracking technologies on their websites.

The European Data Protection Board has released draft guidelines addressing a critical question for data controllers: when does anonymized information remain anonymous after transfer to third parties? These guidelines explore how recipient capabilities and available re-identification techniques can transform seemingly anonymous data into personal information subject to GDPR, introducing new assessment frameworks that could reshape data sharing practices across Europe.

The EU AI Act entered a critical new implementation phase on August 2, 2026, with enforcement authorities now actively overseeing compliance with transparency obligations and general-purpose AI model requirements. Businesses developing, offering, or deploying AI systems in the EU face increased regulatory scrutiny and must navigate complex disclosure requirements, including mandatory notifications when individuals interact with AI rather than humans.

Senate Bill (SB) 1130, legislation that would establish criminal penalties for certain uses of wearable recording devices, continues to move through the California legislature. I’ve had the honor of discussing this measure with staff of the bill’s sponsor, California State Senator Eloise Gómez Reyes, and anticipate there will be more efforts to enact laws seeking to impose measured responses to the privacy, security, and other challenges posed by the latest generation of AI-enabled wearables.