Key point: Children’s privacy remained a hot topic during the 2025 state legislative session, with multiple states passing laws, adding to the growing patchwork of children’s privacy laws.
Analyzing the 2025 Children’s Privacy Laws and Regulations
2025 State Privacy Guide: Categories of Sensitive Data for US State Privacy Laws
Key point: Our new chart identifies and compares the definitions of sensitive data under the 19 state consumer data privacy laws.
California Privacy and AI Legislation Update: September 15, 2025
Key point: The California legislature closed its 2025 legislative session by passing 14 privacy and AI-related bills.
The California legislature closed for the year by passing numerous privacy and AI-related bills. The bills will next head to Governor Gavin Newsom, who will have 30 days to sign, approve without signing, or veto the bills. That is still a significant hurdle for the bills to clear, as last year, Newsom vetoed multiple privacy and AI bills. Below, we identify which of the bills passed and failed, and provide a summary for each of the bills that passed.
California Privacy Protection Agency Announces Multistate Sweep Targeting GPC Compliance
Key point: The investigative sweep is part of a growing multistate approach to privacy enforcement actions.
On September 9, the California Privacy Protection Agency (CPPA) announced that it has initiated a joint regulatory sweep in collaboration with attorneys general (AG) from California, Colorado, and Connecticut. The sweep will target businesses’ compliance with legal requirements associated with recognition of opt-out preference signals (OOPS) and universal opt-out mechanisms (UOOMs) that consumers can use to exercise their right to opt out of online tracking technologies (i.e., targeted advertising, sales, or sharing).
The Balancing Act: Tracking Technology Trends and Risk Mitigation Techniques
This article was republished on ALM’s Business Crimes Bulletin on September 30, 2025 and on Law.com on October 14, 2025.
Key point: Addressing the litigation and regulatory risks regarding tracking technologies requires a balanced approach between legal exposure and business impact, through a close and continuing collaboration between legal, technology, and business stakeholders.
U.S. companies face a massive wave of wiretapping law class action lawsuits and regulatory enforcement actions over online “tracking technologies.” Nearly every company with a website or app uses pixels, SDKs, cookies, session-replay technology, and chat/chatbot tools, putting them in the crosshairs. In California alone, plaintiffs have reportedly filed more than 1,800 lawsuits since 2022 under the state’s two-party consent wiretapping law (the California Invasion of Privacy Act (CIPA)). These laws carry statutory damages (e.g., up to $5,000 per violation under CIPA), which makes them an extremely attractive target for class action plaintiff attorneys. Plaintiffs’ attorneys have also issued thousands of demand letters, the settlement of which has helped build a war chest for funding further litigation.
2025 State Privacy Guide: US State Risk Assessment and Impact Assessment Requirements
Key point: Our new chart identifies and categorizes the numerous triggers for when companies must conduct risk assessment and impact assessment requirements under state privacy and AI laws.
California Privacy and AI Legislation Update: September 8, 2025
Key point: The California legislature heads into its final week with more than 20 privacy and AI bills still under consideration.
Over the last few weeks, we have been tracking and providing weekly updates on 32 privacy- and AI-related bills that crossed chambers prior to the legislative deadline. Below is an update on last week’s events.
Webinar: Navigating the New CCPA Regulations: Cybersecurity Audits, Insurance, and Changes to Existing CCPA Regulations – Part 2
At its July 24 meeting, the California Privacy Protection Agency Board authorized agency staff to finalize and submit to the Office of Administrative Law the rulemaking package for various new California Consumer Privacy Act (CCPA) regulations. Once effective, these regulations will significantly impact entities doing business in California.
2025 State Privacy Guide: Key Dates in US State Privacy and AI Laws
Key point: Our new tracker chart identifies state privacy and AI deadlines from 2025 to 2030.
Between consumer data privacy laws, AI laws, data broker laws, and children’s privacy laws, the number of deadlines companies must track has exploded. This includes deadlines that are often buried in laws and regulations, beyond just a law’s effective date. The new California Consumer Privacy Act (CCPA) regulations will add even more dates for companies to track, including new deadlines for risk assessments, cybersecurity audits, and automated decision-making technology.
California Privacy and AI Legislation Update: September 2, 2025
Key point: After the August 29 deadline for fiscal committees to report bills, four of the nine privacy-related bills and 17 of the 23 AI-related bills we have been tracking are still alive.