Worldwide: Privacy

California has amended its Invasion of Privacy Act to eliminate private lawsuits under the pen register and trap-and-trace provision for website tracking technology, effective January 2027 with retroactive application. While this provides relief from certain digital tracking claims, companies still face exposure under CIPA's wiretapping and eavesdropping provisions, as well as other federal and state laws.

Cyber threats are no longer isolated incidents affecting a single company. Today’s attacks are often part of sophisticated campaigns by nation-state actors and organized criminal enterprises— with consequences that can extend across industries, critical infrastructure, and the broader economy.

As companies navigate evolving privacy regulations and AI governance requirements, in-house legal teams face critical questions about demonstrating compliance in practice. This four-part series examines the practical challenges of meeting California's new cybersecurity audit requirements, managing automated decision-making technology compliance deadlines, and overseeing AI vendors and agentic AI systems after deployment.

All 50 States, as well as the District of Columbia, Guam, Puerto Rico, and the U.S. Virgin Islands, have data breach laws that require organizations to notify individuals affected by data breaches that involve personal identifying information. Under this umbrella of laws, certain states have specific requirements dictating how and when consumers must be notified.

Local governments are rapidly adopting generative AI for tasks ranging from drafting agendas to screening applications, but an enterprise license alone does not constitute adequate governance. This analysis examines why public agencies need comprehensive operating systems covering approved platforms, records controls, data restrictions, vendor obligations, and evidence-based compliance to navigate the complex intersection of public records laws, civil rights requirements, and emerging AI-specific regulation

California Governor Gavin Newsom signed Senate Bill 690 into law, fundamentally altering the California Invasion of Privacy Act by eliminating private lawsuits for pen register and trap and trace device violations on digital platforms. The legislation applies retroactively for two years and signals a shift in how California addresses privacy litigation against businesses using website tracking technologies.