State Privacy

The California Civil Rights Council and the California Privacy Protection Agency have recently passed regulations that impose requirements on employers who use “automated-decision systems” or “automated decisionmaking technology,” respectively, in employment decisions or certain HR processes. On the legislative side, the California Legislature passed SB 7, which would impose…

Continue Reading Navigating California’s New and Emerging AI Employment Regulations

On August 29, the Oregon Department of Justice (DOJ) issued an enforcement report and press release covering its first year of enforcement of the Oregon Consumer Privacy Act (OCPA).  The OCPA took effect on July 1, 2024, and the cure period sunsets on January 1, 2026.  We previously summarized some of requirements in the OCPA here.  This blog summarizes notable takeaways from the enforcement report.

Continue Reading Oregon DOJ Publishes Enforcement Report on the Oregon Consumer Privacy Act

Earlier this month, the California Privacy Protection Agency (“CPPA”) filed a petition in Sacramento County Superior Court to enforce an investigative subpoena against Tractor Supply Company (“Tractor Supply”). 

Continue Reading California Privacy Protection Agency Asks Court To Enforce Its Subpoena Authority

On July 1, 2025, California Attorney General Bonta announced a $1.55 million settlement, pending court approval, related to allegations that Healthline.com, a website where consumers can read informational articles about medical and health topics, violated the California Consumer Privacy Act (“CCPA”) and the California Unfair Competition Law.

Continue Reading California Attorney General Announces $1.55M CCPA Settlement with Healthline.com

2025 has been another active year for children’s and teens’ privacy legislation.  This post recaps notable developments and trends thus far in 2025.  Our summaries from 2023 and 2024 can be found here and here.

App Store Laws

A new trend in 2025 has been legislation targeting app store…

Continue Reading State and Federal Developments in Minors’ Privacy in 2025

Following the approach taken by the Kentucky and Connecticut legislatures this spring, Oregon has amended its comprehensive privacy statute to implement changes to the law.  Specifically, the amendment extends the statutory cure period to July 1, 2026, but this extension is limited to certain controllers.  Beginning on January 1, 2026, the statute’s cure provision will only apply to controllers that are a “noncommercial educational broadcast station, as defined in 47 U.S.C. 397” and that (1) receive funding from the Corporation for Public Broadcasting and (2) distribute the entity’s journalism content without cost to recipients.   

Continue Reading Oregon Amends Its Comprehensive Privacy Statute

On June 2, 2025, the New Jersey Division of Consumer Affairs published draft regulations to implement the New Jersey Data Protection Act, which went into effect on January 1, 2025. The draft regulations propose detailed requirements, including for privacy notices, consent, and consumer rights. Interested parties may submit written…

Continue Reading New Jersey Division of Consumer Affairs Proposes Draft Regulations

On May 20, 2025, Nebraska Governor Pillen approved LB 383, which imposes a broad range of restrictions on minors’ access online.  In addition to a ban on artificial intelligence-generated child pornography, the law also requires parental controls over minor social media accounts.  Nebraska joins at least two other states that have passed bans on social media for minors without parental consent this year.

Continue Reading Nebraska Bans Minor Social Media Accounts Without Parental Consent