On May 29, 2026, the Governor of Louisiana signed into law SB 386, the Louisiana Data Privacy Act (“LDPA”). Louisiana joins Alabama and Oklahoma as the third state to enact a comprehensive privacy law this year. The law will take effect on January 1, 2027.
Continue Reading Louisiana Enacts Comprehensive Privacy LawState Privacy
Illinois Department of Human Rights Seeks Public Comment on Draft AI Employment Regulations
Last month, the Illinois Department of Human Rights (“IDHR”) released draft regulations addressing employers’ use of AI in employment decisions and invited public comment. The IDHR will hold a hearing on the draft regulations on June 10, and the public comment period will close on June 29.
Background
HB…
Continue Reading Illinois Department of Human Rights Seeks Public Comment on Draft AI Employment RegulationsConnecticut Enacts Omnibus Privacy Law
By Lindsey Tonsager, Laura Kim, Bryan Ramirez & Clare Mathias on
Posted in Consumer Protection, State Privacy
On May 27, 2026, the Connecticut governor signed SB 4, an omnibus privacy law, which among other things, amends the Connecticut Data Privacy Act (“CTDPA”), establishes a data broker registry and accessible deletion mechanism, imposes restrictions on the use of price setting devices and surveillance pricing, and creates requirements for direct-to-consumer genetic testing companies.
Continue Reading Connecticut Enacts Omnibus Privacy LawAlabama Enacts Comprehensive Privacy Law
By Libbie Canter, Jayne Ponder & Irene Kim on
Posted in State Privacy
On April 17, 2026, the Governor of Alabama signed HB 351, Alabama Personal Data Protection Act (ALDPA), into law. The law resembles Connecticut’s data privacy statute, but omits certain requirements, such as a data protection impact assessment. Alabama follows Oklahoma as the second state to enact a comprehensive privacy…
Continue Reading Alabama Enacts Comprehensive Privacy LawSeventh Circuit Holds that BIPA Amendment Applies Retroactively
Posted in Data Privacy, State Privacy
On April 1, 2026, the Seventh Circuit in Clay v. Union Pacific Railroad Company held that an amendment to the Illinois Biometric Information Privacy Act (BIPA), limiting damages to a per-person basis, applies retroactively to cases pending when the amendment was enacted in 2024. This decision limits the potential statutory damages plaintiffs may obtain for pending BIPA cases.
Continue Reading Seventh Circuit Holds that BIPA Amendment Applies RetroactivelyOklahoma Enacts Comprehensive Privacy Law
By Lindsey Tonsager, Jayne Ponder & Clare Mathias on
Posted in State Privacy
- Scope and Applicability. OKDPA applies to controllers and processors that conduct business in Oklahoma or target Oklahoma residents and annually either (a)
CalPrivacy Fines PlayOn Sports for Insufficient Opt-Out Process
Posted in State Privacy
On February 27, 2026, CalPrivacy and PlayOn settled a CCPA claim for $1.1 million. PlayOn is a digital ticketing platform used by schools and other organizations for ticketing, streaming, fundraising, concessions, merchandise sales, and website management. The settlement resolves allegations that PlayOn unlawfully “sold” and “shared” users’ personal information without providing sufficient opt-outs and notice, in violation of the CCPA. This marks the agency’s first enforcement action involving students’ data privacy.
Continue Reading CalPrivacy Fines PlayOn Sports for Insufficient Opt-Out ProcessConnecticut Attorney General Releases 2025 CTDPA Enforcement Report
By Libbie Canter, Lindsey Tonsager, Jayne Ponder & Rosie Moss on
Posted in State Privacy
The Connecticut Office of the Attorney General (“OAG”) issued an updated Enforcement Report (“Enforcement Report”) under the Connecticut Data Privacy Act (“CTDPA”). The Enforcement Report discusses the OAG’s enforcement actions in 2025 and suggests some areas of focus from the regulator, summarized below.
Continue Reading Connecticut Attorney General Releases 2025 CTDPA Enforcement ReportNew Jersey Enacts Amendment to its Comprehensive Privacy Law
Posted in State Privacy
On his last day in office, January 20, 2026, former New Jersey Governor Phil Murphy signed an amendment to the New Jersey Data Privacy Act, A5017. The bill amends the state’s comprehensive privacy law to add new data- and entity-level exemptions and to expand the definition of de-identified data. The amendment took effect immediately.
Continue Reading New Jersey Enacts Amendment to its Comprehensive Privacy LawCalPrivacy Announces $45,000 Fine Against Data Broker for Delete Act Violations
Posted in State Privacy
On January 8, 2026, the California Privacy Protection Agency (“CalPrivacy”) announced an enforcement action against Rickenbacher Data LLC (d/b/a “Datamasters”), an information reseller, for failing to register as a data broker under the California Delete Act. Datamasters agreed to pay a $45,000 administrative fine, among other remedial measures. In November, CalPrivacy launched a Data Broker Enforcement Strike Force within its enforcement division to investigate violations of the law in the data broker industry, which builds upon a 2024 investigative sweep into data broker compliance.
Continue Reading CalPrivacy Announces $45,000 Fine Against Data Broker for Delete Act Violations