The latest legal news and analysis on data privacy laws.
19 articles
Florida's attorney general sued Netflix on September 9, 2026, alleging it sold data from known children without consent. What section 501.715 actually requires.
The Third Circuit affirmed dismissal in Santoro v. Tower Health. Patients had Article III standing for Meta Pixel claims, but the appeal failed on other grounds.
Governor Meyer signed Delaware HB 380 on September 2, 2026. The DPDPA threshold falls to 10,000 consumers and sensitive data expands from January 1, 2027.
Meta agreed to pay state attorneys general at least $12.1 billion, rising to $17.1 billion, over Instagram and Facebook's design for minors. Verified against official AG releases.
California SB 923 was enrolled and presented to Governor Newsom on September 2, 2026. Under article IV, section 10(b)(2) he has until September 30 to act.
California's privacy agency fined LocateSmarter $116,490 and Cybba $52,400 in August 2026; the LocateSmarter order is its first under both the CCPA and Delete Act.
As of August 1, 2026, California data brokers must access the DROP platform every 45 days to process consumer deletion requests under the Delete Act (SB 362). Here's what changed and what it means.
NJ Gov. Sherrill signed A5328 on June 30, 2026, banning sensitive-data sales and creating a data-broker registry with fees up to $1.5 million and $50,000 per-record penalties.
South Dakota's Genetic Data Privacy Act, SB 49, took effect July 1, 2026, requiring consent and privacy notices from DTC genetic testing companies.
On June 29, 2026, the Supreme Court held 6 to 3 in Trump v. Slaughter that FTC commissioners can be removed at will, overruling Humphrey's Executor (1935) and unsettling agency independence.
The FTC's order against data broker Kochava, final on June 26, 2026, bars it for 10 years from selling sensitive location data like health clinic visits without consent.
Arkansas Act 952 (HB 1717) took effect July 1, 2026, extending COPPA-style consent, targeted-ad, and data-rights rules to minors up to age 16. What to know.
Utah's Digital Choice Act (HB 418) is now in force as of July 1, 2026, requiring social media data portability and interoperability. What the law requires.
The FTC fined Amazon $2.25 million on June 30, 2026 for knowingly violating FCRA Section 609(e) by denying identity-theft victims the fraud records they are owed within 30 days.
Connecticut Public Act 25-113 takes effect July 1, 2026, lowering the CTDPA threshold to 35,000 consumers and adding neural data, AI-training disclosure, and under-18 protections.
Texas AG Paxton opened a data-breach investigation into Carnival and issued a Civil Investigative Demand on June 23, 2026. An investigation, not a finding.
Canada introduced Bill C-36, the Protecting Privacy and Consumer Data Act, on June 15, 2026 to replace its aging federal privacy law. Status: first reading.
The Data (Use and Access) Act 2025 reshapes UK GDPR, the DPA 2018 and PECR. Royal Assent on 19 June 2025, with key privacy rules in force from 5 February 2026.
The FTC's finalized 2025 order against data broker Mobilewalla bans selling sensitive location data and limits collection from ad auctions. What the order says.