On July 23, 2026, New Jersey Governor Mikie Sherrill signed A4085 (the Fair Price Protection Act) into law, which prohibits companies from charging consumers different prices for groceries based on their personal data. New Jersey will join New York, Connecticut, and Maryland in imposing prohibitions and requirements on the use
Continue Reading New Jersey Enacts Ban on Surveillance PricingState Privacy
California Legislature Advances Bill Targeting Wave of CIPA Pen Register Lawsuits
On July 1, 2026, a California legislative committee advanced amendments to SB 690 that would eliminate private suits asserting website-based “pen register” claims under the California Invasion of Privacy Act (“CIPA”), leaving enforcement exclusively to the California Attorney General. The amendments come amid a surge of lawsuits and demand letters challenging the use of website technologies under the pen register provision, which the committee described as a “poster child for abusive lawsuits.” According to the committee analysis, “[b]ecause the potential liability can be staggering,” businesses often settle quickly, thereby “encouraging vexatious litigants to continue blasting out demand letters.”
Continue Reading California Legislature Advances Bill Targeting Wave of CIPA Pen Register LawsuitsState Comprehensive Privacy Law Round-Up: Several States Amend Their Privacy Statutes
In recent weeks, several state legislatures have amended their state comprehensive privacy laws. Some of these amendments have already been enacted into law, while others have passed their state legislature and await the governor’s signature.
Continue Reading State Comprehensive Privacy Law Round-Up: Several States Amend Their Privacy StatutesDelaware General Assembly Passes HB 380, an Amendment to the Delaware Personal Data Privacy Act
On June 16, 2026, the Delaware General Assembly passed HB 380, which would amend the Delaware Personal Data Privacy Act (DPDPA). The bill is currently awaiting the Delaware governor’s signature, and if signed, the amendments would take effect on January 1, 2027. The amendment would impose the following:
Continue Reading Delaware General Assembly Passes HB 380, an Amendment to the Delaware Personal Data Privacy ActVermont Data Privacy Bill Signed into Law
On June 16, 2026, the Vermont Governor signed into law the Vermont Data Privacy and Online Surveillance Act, making Vermont the fourth state to enact a comprehensive data privacy law this year. The law will take effect on January 1, 2028.
Continue Reading Vermont Data Privacy Bill Signed into LawLouisiana Enacts Comprehensive Privacy Law
On May 29, 2026, the Governor of Louisiana signed into law SB 386, the Louisiana Data Privacy Act (“LDPA”). Louisiana joins Alabama and Oklahoma as the third state to enact a comprehensive privacy law this year. The law will take effect on January 1, 2027.
Continue Reading Louisiana Enacts Comprehensive Privacy LawIllinois Department of Human Rights Seeks Public Comment on Draft AI Employment Regulations
Last month, the Illinois Department of Human Rights (“IDHR”) released draft regulations addressing employers’ use of AI in employment decisions and invited public comment. The IDHR will hold a hearing on the draft regulations on June 10, and the public comment period will close on June 29.
Background
HB…
Continue Reading Illinois Department of Human Rights Seeks Public Comment on Draft AI Employment RegulationsConnecticut Enacts Omnibus Privacy Law
On May 27, the Connecticut governor signed SB 4, an omnibus privacy law, followed a week later by two clean-up bills, HB 2222 and HB 5563 (collectively “SB 4”). SB 4, among other things, amends the Connecticut Data Privacy Act (“CTDPA”), establishes a data broker registry and accessible deletion mechanism, imposes restrictions on surveillance pricing, and creates requirements for direct-to-consumer genetic testing companies.
Continue Reading Connecticut Enacts Omnibus Privacy LawAlabama Enacts Comprehensive Privacy Law
On April 17, 2026, the Governor of Alabama signed HB 351, Alabama Personal Data Protection Act (ALDPA), into law. The law resembles Connecticut’s data privacy statute, but omits certain requirements, such as a data protection impact assessment. Alabama follows Oklahoma as the second state to enact a comprehensive privacy…
Continue Reading Alabama Enacts Comprehensive Privacy LawSeventh Circuit Holds that BIPA Amendment Applies Retroactively
On April 1, 2026, the Seventh Circuit in Clay v. Union Pacific Railroad Company held that an amendment to the Illinois Biometric Information Privacy Act (BIPA), limiting damages to a per-person basis, applies retroactively to cases pending when the amendment was enacted in 2024. This decision limits the potential statutory damages plaintiffs may obtain for pending BIPA cases.
Continue Reading Seventh Circuit Holds that BIPA Amendment Applies Retroactively