On February 1, 2023, the FTC released guidance highlighting three data security practices that the agency increasingly views as essential for protecting consumer data. Complex data systems, the FTC argues, require “safety engineering” to reduce risk. One...

The Colorado Attorney General (AG) has recently issued two rounds of revisions to its comprehensive set of regulations implementing the Colorado Privacy Act (CPA) – the first on December 21, 2022, and the second on...

For the first time since 2007, the Federal Communications Commission (“FCC”) has proposed updating its breach notification rules for telecommunications carriers. On January 6, 2023—after nearly a year of internal deliberation—the FCC issued a Notice...

Today, the U.S. took a giant step toward resolving the “Schrems II” EU data transfer problem, possibly allowing the United States to earn a partial adequacy determination from the European Commission early next year. President...

California enacted the Age-Appropriate Design Code Act (AADC) last Thursday, September 15th– which will impose significant new child and teen safety requirements on a large variety of online services. The AADC goes into effect on...

The FTC sued data broker Kochava, Inc. in federal district court, alleging their sale and distribution of consumer geolocation data constitutes an unfair act or practice. In the complaint, the FTC takes issue with Kochava’s model of...