Privacy Litigation

Subscribe to Privacy Litigation

Texas has become the latest state to impose age-related privacy and safety restrictions on online service providers, joining Arkansas, California, Florida, and Utah. Signed by Governor Greg Abbott on June 13, 2023, the Securing Children Online through Parental Empowerment (SCOPE) Act is scheduled to go into effect on September 1, 2024, and will require digital service providers to “register” the age of potential users at account creation and implement a series of privacy and safety controls for known minors.…

Continue Reading Texas Becomes Latest State to Address Kids’ Privacy and Safety Online

This Update is the third installment of the ongoing series covering Washington state’s new My Health My Data Act. The original impetus for the act was the protection of reproductive rights, and it was signed into law alongside several other pieces of legislation focused on providing abortion and gender-affirming protections. However, because of the broad…

As detailed in Part 1 of this ongoing series, Washington Governor Jay Inslee signed the state’s My Health My Data Act into law on April 27, 2023. The act is a first-of-its-kind law that creates new privacy protections relating to the collection, sharing, and selling of “consumer health data.” Most of the provisions of the…

On April 27, 2023, Washington Governor Jay Inslee signed into law House Bill 1155, also known as the My Health, My Data Act. Its stated purpose is to protect “consumer health data” collected by entities not already subject to the federal Health Insurance Portability and Accountability Act, but one less obvious consequence of the Act…

Indiana Governor Eric Holcomb signed Senate Bill 5 on May 1 (effective January 1, 2026), making Indiana the seventh state to offer comprehensive privacy protections. Indiana’s new law appears to closely track Virginia’s omnibus privacy law. The law will apply to a person that conducts business in Indiana or produces products or services targeted to Indiana residents, and that meets either of the following requirements in a calendar year: (1) controls or processes the personal data of 100,000 consumers (defined as residents of Indiana “acting only for a personal, family, or household purpose”); or (2) controls or processes personal data of at least 25,000 consumers with more than 50% of annual gross revenue derived from the sale of personal data.

Similarly, both Tennessee and Montana appear to be imminently close to enacting their own state comprehensive privacy bills. The Tennessee and Montana legislatures each passed their own state bills on April 21, 2023, and each bill is expected to be signed into law by the respective governor soon.

Below, we look at some of the key similarities and differences between the new Indiana privacy law compared with the other six state omnibus privacy laws. We also highlight the key provisions of the Tennessee and Montana bills that are expected to be signed into law soon.…

Continue Reading Lucky Number 7…8 and 9?: Indiana Passes Privacy Law With Tennessee and Montana Hot on Its Heels

The recent dramatic growth of artificial intelligence technologies continues to be a focus of the Biden administration. The National Telecommunications and Information Administration, a federal agency within the U.S. Department of Commerce, recently issued a Request for Comment that seeks public comment on system accountability measures and policies for AI systems, including (1) the definition…

The Supreme Court unanimously ruled in two related cases, Axon Enterprise Inc. v. FTC (No. 21-86) and SEC v. Cochran (No. 21-1239), that federal district courts have jurisdiction to hear structural constitutional challenges to the adjudicative authority of the Federal Trade Commission and the Securities and Exchange Commission. 

As a consequence, in such challenges, respondents…

After years out of circulation, class-action lawsuits asserting claims under the Video Protection Privacy Act are now back in reruns. More than 100 putative class actions alleging violations of the VPPA have been filed against publishers that use the Meta pixel on their websites.

It remains to be seen whether these lawsuits will survive evaluation…

The Illinois Supreme Court recently opened the floodgates for class actions under the Illinois Biometric Information Privacy Act and created potentially massive and catastrophic exposure for Illinois businesses. In a close 4-3 ruling, the landmark decision in Latrina Cothron v. White Castle System Inc. holds that every individual scan or transmission of biometric data made…