Photo of Brianna Dally

Brianna Dally

Subscribe to Brianna Dally's Posts

Brianna provides comprehensive advice to clients across various industries on privacy and cybersecurity issues. Her work ranges from implementing information security and incident response programs to addressing complex compliance questions. Brianna has experience advising on compliance with regulations such as the New York Department of Financial Services (NYDFS) Cybersecurity Regulation and other insurance data security laws modeled on the NAIC Insurance Data Security Model Law.

Contact:Read more about Brianna Dally
Flag of the state Connecticut.

Key point: Connecticut’s new AI law adds to the growing complexity of state laws directed at commonly used automated employment decision tools.

On May 27, 2026, Connecticut Governor Ned Lamont signed SB 5 into law. Connecticut Senator James Maroney authored the bill, which covers several different areas involving the regulation of artificial intelligence (AI), including frontier models, chatbots, employment, and provenance. Lamont also signed into law a companion bill, SB 4, which amends Connecticut’s consumer data privacy law and establishes a data broker registration law. Altogether, the two bills significantly redefine the state’s privacy law and introduce requirements for the use of AI.

In the coming weeks, we will be posting articles analyzing several of the key aspects of these bills. In this first article, we analyze SB 5’s provisions as they relate to the use of automated employment decision technologies (AEDT).

Cybersecurity_682462080

Key Point: With the June 3, 2026, compliance deadline fast approaching, small firms subject to amended Regulation S‑P under the Gramm-Leach-Bliley Act (GLBA) should be in the final stages of updating their privacy and safeguards programs. In January 2026, the Securities and Exchange Commission (SEC) held an outreach event to help small firms comply with the amendments to Regulation S-P. This webinar was geared toward small firms in advance of the June 3, 2026, compliance deadline. The SEC highlighted new Regulation S-P compliance obligations, SEC exam team approaches moving forward, and held an examination workshop, which included an incident response tabletop discussion, review of a sample document request list, and a mock examination session.

On March 16, 2026, New York Attorney General (AG) Letitia James rallied in support of the “One Fair Price Package” — a pair of bills aimed at curbing algorithmic and surveillance pricing in New York. Together, the bills would prohibit the use of personalized algorithmic pricing based on consumer data, ban electronic shelf labels in large food and drug retailers, and create robust enforcement mechanisms and private rights of action. The announcement from New York comes shortly after New Jersey Governor Mikie Sherrill backed legislation to ban what she has called “surveillance” pricing, and after California Attorney General Rob Bonta announced an investigative sweep focused on businesses that use consumer data to individualize prices for their goods or services earlier this year.

Key Points: California Attorney General Rob Bonta announced a sweep concerning so-called “surveillance pricing” or “algorithmic pricing” The AG highlights potential CCPA privacy violations tied to the use of individualized pricing models based on a lack of transparency and failure to comply with the CCPA’s “purpose limitation” principle. Other regulators are likely to follow suit — now is the time to assess and mitigate potential compliance and enforcement risks.

On January 27, 2026, California Attorney General (AG) Rob Bonta announced an investigative sweep focused on businesses that use consumer data to individualize prices for their goods or services. Bonta framed the issue as follows:

“Consumers have the right to understand how their personal information is being used, including whether companies are using their data to set the prices that Californians pay, whether that be for groceries, travel, or household goods. We need to know whether businesses are charging people different prices for the same good or service — and if they’re complying with the law.”

The California Department of Justice (DOJ) is issuing written inquiries to businesses with substantial online operations in the retail, grocery, and hotel industries that leverage individualized pricing. It is requesting certain information on this issue, including details about:

  • Companies’ use of consumer personal information to set prices.
  • Policies and public disclosures regarding personalized pricing.
  • Any pricing experiments undertaken by companies.
  • Measures companies are taking to comply with algorithmic pricing, competition, and civil rights laws.

This post summarizes the basis for the California DOJ’s investigatory sweep, how it intends to apply California Consumer Privacy Act (CCPA) requirements, and how businesses can prepare for and mitigate the risk of these inquiries and potential enforcement actions.

Biometric-Data_1200x600_GettyImages-1311613664

In Part One of this FAQ series, we break down Virginia’s Senate Bill 754, Consumer Protection Act; prohibited practices, etc., reproductive or sexual health information (Act), which amends the Virginia Consumer Protection Act (VCPA). The law goes into effect on July 1. Overall, given the broad definitions used in the Act, the law likely regulates organizations that are not traditional health care companies, and goes beyond traditional health information.