Law lags behind technology, but California is sprinting to keep up. In the last few months, the California legislature passed 19 AI-related bills, targeting everything from AI safety to election deepfakes. Governor Newsom vetoed the controversial AI...

Even if you’re familiar with Illinois’ Biometric Information Privacy Act (BIPA), you may not be familiar with its less (in)famous cousin, the Genetic Information Privacy Act (GIPA). But GIPA litigation presents an increasing risk to employers, insurers,...

The Washington Attorney General (“WA AG”) recently updated its My Health, My Data Act (“MHMDA”) FAQs to clarify that consumer health data (“CHD”) does not include the purchase of non-prescription medication, but does include inferences about a consumer’s health based on that purchase....

On March 31, 2024, most of Washington’s My Health, My Data Act (“MHMDA”) will go into effect for all in-scope business other than small businesses. As we’ve previously blogged, the geofencing provision went into effect last July. Notably,...

On January 15, 2023, New Jersey’s governor signed S332/A1971, making it the fourteenth state with a comprehensive consumer privacy law (yes, we count Florida in the tally!). The law takes effect on January 15, 2025, or...

On September 11, 2023, Delaware’s governor signed the Delaware Personal Data Privacy Act (“DPDPA”), the thirteenth U.S. state comprehensive privacy law. The law takes effect January 1, 2025 and mirrors other existing state privacy laws...

The California Superior Court in Sacramento has ruled that the regulations promulgated by the California Privacy Protection Agency (“CPPA”) under the amended California Consumer Privacy Act (“CCPA”—the amended act the “CPRA”) will not be enforceable...

On May 11, 2023, Tennessee’s governor signed the Tennessee Information Privacy Act (“TIPA”), the eighth U.S. state comprehensive privacy law. TIPA is very similar to the privacy laws of Virginia, Connecticut, and Indiana, which in turn drew...

Enacted on April 27, 2023, Washington’s “My Health, My Data” Act (the “Act”) creates significant compliance obligations for companies processing data in its scope. The expansive reach of the Act, coupled with a private right of action...

On May 1, 2023, Indiana became the seventh U.S. state to enact a consumer privacy law with the governor’s signing of Senate Bill 5. Effective January 1, 2026, the law mirrors other state privacy laws, including...