Privacy

Subscribe to Privacy via RSS
Cybersecurity_1073242516

California’s latest legislative session delivered a wave of privacy developments, with Governor Gavin Newsom signing a broad set of measures affecting consumer rights. But one proposal did not make it across the finish line: AB 1542, which would have prohibited the sale or sharing of sensitive personal information with third parties. This article examines the governor’s veto of AB 1542 and what it means for the direction of privacy policy and for businesses and consumers subject to California law.

CA_StateFlag_1200x600_GettyImages-1481930014
  • California’s Senate Bill 354 enacted the California Insurance Information and Privacy Protection Act (CIIPPA), replacing the original Insurance Information and Privacy Protection Act and becoming operative July 1, 2028.
  • The CIIPPA applies to insurance department licensees, surplus line insurers, reinsurers, and their third-party service providers, while excluding HIPAA-covered
…
Delaware State Flag. Waving Fabric Satin Texture National Flag of Delaware 3D Illustration. Real Texture Flag of the State of Delaware in the United States of America. USA. High Detailed Flag

Key point: Delaware’s HB 380, signed into law on September 2, 2026, significantly expands the scope of the Delaware Personal Data Privacy Act (DPDPA), narrows the GLBA exemption for financial institutions, introduces direct obligations on third parties, and strengthens protections around sensitive data, profiling, and automated decision-making. The amendment takes effect January 1, 2027.

Privacy_1200x600_GettyImages-1952157610

Key Points

  • OCR’s proposed 2025 HIPAA Security Rule update has a projected finalization date of July 2027, moved from the original May 2026 target and classified as a “long-term action” in the OMB Unified Agenda.
  • The 2024 Change Healthcare ransomware attack — the largest protected health care data breach in U.S. history — has renewed pressure on OCR to modernize the HIPAA Security Rule’s cybersecurity requirements.
  • A coalition of more than 100 health care organizations, led by CHIME, sent a December 2025 letter to HHS Secretary Robert F. Kennedy Jr. urging full withdrawal of the proposed Security Rule update, citing its deregulatory inconsistency and compliance burden.
  • Prior HIPAA rulemaking history — including the 2013 Omnibus Rule and the court-vacated 2024 Reproductive Health Care Privacy Rule — suggests finalization in revised or consolidated form is more likely than adoption of the proposed rule as written.
The Virginia state flag waving along with the national flag of the United States of America

Key point: Plaintiffs in Virginia have focused on a rarely tested state privacy statute with statutory damages that imposes notice-and-consent obligations on retailers that share or sell in-store customer data.

Most retailers have spent the last several years building their privacy compliance programs around the major comprehensive state privacy laws, such as Virginia’s Consumer Data Protection Act (CDPA), California’s Consumer Privacy Act (CCPA), and their counterparts in a dozen other states. A recent lawsuit filed in the Eastern District of Virginia is a reminder that older, narrower statutes can carry just as much litigation risk, and that the plaintiffs’ bar is actively looking for the next viable theory.

The statute at issue is the Virginia Personal Information Privacy Act (VPIPA). It has been on the books for decades. Until recently, however, it had produced exactly one lawsuit. That may be changing.

Privacy_1200x600_GettyImages-1347310666

Key points: Troutman Pepper Locke’s Regulatory Investigations, Strategy + Enforcement (RISE) and Privacy + Cyber + AI practice groups worked with the firm’s innovation team using AI to collect and curate five years of data concerning state AG activities and actions related to privacy, security, and AI. This Regulatory…

The Florida state flag waving along with the national flag of the United States of America

On June 26, 2026, Florida Attorney General (AG) James Uthmeier and Roku, Inc. announced a negotiated resolution of Florida’s enforcement action filed under the Florida Digital Bill of Rights (FDBR). Under the agreement, Roku will enhance its child protection features by giving parents greater control over their children’s streaming experience.

Data_1200x600_GettyImages-1196044470

On June 30, 2026, New Jersey enacted legislation A5328 (P.L.2026, c.25), which will expose a broad swath of U.S. companies to data broker registration fees ranging from $5,000 to $1.5 million annually. The new legislation is not limited to data brokers in the conventional sense. It applies generally to any company that sells or licenses personal data of New Jersey residents, including those with direct customer relationships. Much of the law takes effect immediately, so companies should begin reviewing the requirements now to comply.