Worldwide: Privacy Protection

The California Invasion of Privacy Act has spawned an assembly line of lawsuits targeting common website features like chatbots and cookies, with plaintiffs claiming statutory damages of $5,000 per violation even without actual harm. California's legislature has passed S.B. 690 to curb these claims, while new federal legislation seeks to provide broader relief by barring CIPA and similar state law claims related to digital commerce activities.

As AI-powered hiring tools become more widespread, it is important to remember that some states have acted early and their laws should be reflected in an organization’s governance, risk...

Courts are addressing new challenges in protecting confidential information when AI tools are used in litigation. Recent rulings establish frameworks for disclosure requirements, usage restrictions, and contractual safeguards that parties must consider when deploying AI platforms to process sensitive case materials.

Vivek Shah's latest legal defeat demonstrates how courts are scrutinizing CIPA claims when plaintiffs fail to establish concrete privacy injuries. The ruling in Shah v. Drexel Chemical Co. examines what constitutes actual harm when a plaintiff alleges website tracking violations based on generic search terms and routine metadata. This case provides critical guidance on the evidentiary threshold required to survive a motion to dismiss in privacy litigation.

New York Attorney General Letitia James has released final rules for the Stop Addictive Feeds Exploitation (SAFE) for Kids Act. The law was signed in 2024, but the effective date was triggered by the release of these rules.

California's State Legislature has passed five major privacy bills addressing private litigation restrictions, expanded deletion rights, children's online safety, sensitive data protections, and user privacy settings. These measures, now awaiting Governor Newsom's signature, could fundamentally reshape how businesses handle consumer data and face privacy-related lawsuits in the state.

California's Court of Appeal has issued a tentative ruling in Variety Media v. Superior Court addressing whether CIPA's pen register statute applies to website tracking technologies, while the state legislature simultaneously passed SB 690 that would restrict who can bring such claims. The ruling provides crucial technical distinctions about what qualifies as a pen register under CIPA, potentially reshaping how website tracking litigation proceeds in California.

Washington Attorney General Nick Brown released the state's first Data Privacy Report, examining how the modern data economy incentivizes personal information collection and retention. The report catalogs resulting harms and recommends that lawmakers strengthen privacy protections, enforcement, and public education while highlighting Washington's continued lack of a comprehensive consumer privacy statute despite inspiring other states' privacy laws.

California lawmakers have sent Senate Bill 690 to Governor Gavin Newsom, teeing up a narrowing of website-tracking litigation under the California Invasion of Privacy Act (CIPA), who has until September 30 to sign or veto the legislation. If signed, the bill would eliminate private lawsuits asserting website-based “pen register” and “trap and trace” claims under Section 638.51 of CIPA. For businesses that have received demand letters or are defending lawsuits premised on routine website technologies—such as cookies, pixels, analytics tools, or similar tracking technology—the bill would offer relief from certain types of claims asserted under CIPA.