September 2026

Blogs_PrivacyCyberAI_OG_PrivacyLitigationReport

Key point: Four takeaways from August decisions: (1) a federal magistrate judge concluded CIPA § 631 does not apply to internet communications but that § 632 does; (2) a cookie banner that merely pointed to a privacy policy did not establish consent to third-party data sharing; (3) a banner that offers, but fails to honor, users a choice can supply the “confidential communication” element of a § 632 claim; and (4) a consent defense depends on whether the privacy policy actually describes the third-party disclosures that tracking technologies make.

Welcome to our monthly update on how courts across the U.S. have handled privacy litigation involving website tools such as cookies, pixels, session replay, and similar technologies. In this post, we cover decisions from August 2026. We are focusing on statutes that would not be impacted by the pending Senate Bill 690 (SB 690), which has passed the California Assembly and Senate and was sent to Governor Gavin Newsom for signature. Although SB 690 provides sweeping reform for defendants facing pen register and trap and trace claims under California law, it leaves §§ 631 and 632 untouched, along with every non-CIPA theory, including claims brought under the ECPA, CDAFA, and the California constitutional right to privacy, among them. The plaintiffs’ bar is widely expected to refocus on those theories, and the four takeaways from August decisions discussed below preview how that shift may play out, including where the fights over §§ 631 and 632 will occur, and why cookie banners and privacy policies will carry even more weight than they do today.

Cyber_1200x600_GettyImages-2156097092

The Securities and Exchange Commission’s (SEC) 2024 amendments to Regulation S-P are now fully in effect, with both compliance deadlines now behind us. For broker-dealers, investment advisers, private fund managers, and other covered institutions that worked hard to prepare incident response programs and other items necessary to meet their respective implementation deadlines, there’s no rest for the weary. Covered institutions should expect the SEC’s Division of Examinations to focus on whether firms have actually put their Reg S-P obligations into practice. According to the SEC’s Division of Examinations (Division) Fiscal Year 2026 Examination Priorities, the Division will examine whether firms have developed, implemented, and maintained policies and procedures in accordance with the rule’s new provisions that address administrative, technical, and physical safeguards for the protection of customer information. Now is the time for firms to assess their operational resiliency and the effectiveness of their programs in practice, not just on paper.

Delaware State Flag. Waving Fabric Satin Texture National Flag of Delaware 3D Illustration. Real Texture Flag of the State of Delaware in the United States of America. USA. High Detailed Flag

Key point: Delaware’s HB 380, signed into law on September 2, 2026, significantly expands the scope of the Delaware Personal Data Privacy Act (DPDPA), narrows the GLBA exemption for financial institutions, introduces direct obligations on third parties, and strengthens protections around sensitive data, profiling, and automated decision-making. The amendment takes effect January 1, 2027.