Tracking technology litigation continues to evolve and expand, driven by increasingly sophisticated data collection techniques, broader use of session replay, identity resolution, AI-driven profiling, and growing scrutiny from plaintiffs, regulators, and courts over whether companies are adequately disclosing, governing, and technically controlling how user data is collected, shared, and monetized. 

As lawsuits and regulatory scrutiny targeting “data brokers” continue to accelerate, understanding whether your organization fits within this increasingly broad industry space is a critical risk management priority. The stakes have never been higher for entities that collect, enrich, or license data to understand the evolving causes of action, damages theories, and defense strategies shaping this space.

On January 1, the California Delete Act went into effect establishing new requirements for entities that qualify as “data brokers” under the law. Beginning August 1, covered businesses will need to process deletion requests through the California Privacy Protection Agency’s (CalPrivacy) centralized mechanism — with fines of $200 per day

With state legislatures reconvening for 2026, numerous states are considering privacy and AI bills on a broad range of topics. In the AI space, these bills cover high-risk activities, chatbots, pricing, disclosures, provenance, employment, and health, among other topics. In the privacy space, these bills cover consumer data privacy, teen’s privacy, biometric privacy, consumer health data privacy, and data brokers.

In today’s rapidly evolving digital landscape and expanded threat landscape, financial institutions feel at war and are under increasing pressure to balance innovation, data privacy, and regulatory demands. AI is accelerating that complexity, reshaping how organizations manage sensitive information and comply with a rapidly shifting legal environment.