Worldwide: Data Protection

Colorado's Department of Law has released proposed rules to implement the state's Automated Decision-Making Technology Act and Chatbot Safety Act, both effective January 1, 2027. These regulations would impose substantial compliance requirements on companies using AI tools for employment decisions, including mandatory human review processes, detailed disclosure obligations, and strict documentation standards. Organizations must evaluate whether to submit comments before the October 26, 2027 deadline and pre

Meta Platforms has agreed to pay $17 billion over ten years to resolve multistate litigation alleging the company engineered Facebook and Instagram to addict minors while concealing the risks. Beyond the historic financial penalty, the settlement mandates sweeping platform changes including default usage limits, overnight lockouts, and parental controls for users under eighteen.

The New Jersey Supreme Court's recent ruling on Daniel's Law has created a pivotal moment in the ongoing legal battle between public officials and data brokers.

Taft's latest compilation reveals over 60 state-level AI regulations now govern commercial applications, spanning healthcare notifications, chatbot disclaimers, risk assessments, and employment screening. Recent additions include Illinois's catastrophic risk framework for frontier AI models, Rhode Island's healthcare and companion app disclosure requirements, and Connecticut's broad algorithmic regulation affecting SaaS providers and social media platforms.

A federal court in California ruled that Ulta's privacy policy alone does not constitute valid consent under the California Invasion of Privacy Act for installing tracking technology on website visitors' browsers.

New Jersey has joined California, Maryland, and Vermont in attempting to regulate how businesses interact with children online. The law, the New Jersey Kids Code Act, was signed into law on August 11, 2026. It will go into effect on September 1, 2027, unless it is blocked or delayed.

The FTC has issued a proposed enforcement policy statement targeting personalized pricing practices, signaling heightened scrutiny of how businesses disclose and implement dynamic pricing strategies. While acknowledging it lacks authority to ban personalized pricing outright, the agency previews aggressive enforcement of practices that may violate Section 5 of the FTC Act through deception or unfairness.

New Jersey Governor Mikie Sherrill signed three measures addressing children's and teens' use of online services, with the New Jersey Age-Appropriate Design Code imposing comprehensive safety, privacy, data use, and design requirements on covered online service providers beginning September 1, 2027.

The Federal Trade Commission has issued a proposed enforcement policy statement targeting personalized pricing practices, signaling that businesses using consumer data to set individualized prices must provide clear disclosures or face potential Section 5 enforcement actions.