APRA Cancellation, Rhode Island’s Privacy Act, and CPPA’s International Cooperation

In an active summer on the privacy front, we share a few recent updates:

Cancellation of APRA House Markup

On the morning of June 27, 2024, as congressional staffers and audience members prepared to hear the latest updates on the American Privacy Rights Act (APRA), the House Committee on Energy and Commerce announced that it was canceling its meeting to mark up and vote on the latest draft of the APRA. The next steps are unclear.Continue Reading A Midsummer State Privacy Law Update

The end of Maryland’s legislative session has ushered in one of the year’s most ambitious and comprehensive consumer privacy laws. Maryland Governor Wes Moore officially signed into law the Maryland Online Data Privacy Act (MODPA) on May 9, 2024. Set to take effect on October 1, 2025, this law not only expands the online protections consumers have come to expect from state privacy laws, but it also introduces additional measures designed to protect consumer data, including, among other things:

  • Increased protections for processing sensitive data.
  • Protections for consumer health data.
  • New standards for processing biometric data.
  • Increased protections for treatment of youth data.
  • New limitations for loyalty programs.
  • Heightened data minimization standards.

Continue Reading A New Privacy Paradigm: Understanding Maryland’s Trailblazing Approach to Online Privacy

Minnesota’s governor signed the Minnesota Consumer Data Privacy Act (MNCDPA or the Act) into law at the end of May, making Minnesota the 18th state to enact a comprehensive consumer privacy law. The MNCDPA will take effect for most covered entities on July 31, 2025. The law provides a 30-day cure period, which will sunset on January 31, 2026, six months after the Act’s effective date. Entities that violate the Act are subject to injunction and civil penalties of up to $7,500 per violation. Like most other state privacy laws, the MNCDPA does not include a private right of action and will be enforced solely by the attorney general.Continue Reading Minnesota’s Unique Spin on Consumer Data Privacy

Introduction

The Maryland Age-Appropriate Design Code Act (SB 571 / HB 603) (MD AADC) was signed into law on May 9, 2024, with an October 1, 2024, effective date. The law is the second of its kind in the United States, following the California Age-Appropriate Design Code Act (CA AADC), which was passed in 2022 and is currently enjoined on constitutional grounds pending appeal in the U.S. Court of Appeals for the Ninth Circuit. Similar to the CA AADC (and the U.K.’s AADC), the MD AADC provides for privacy and safety requirements for children under age 18. Notably, the MD AADC also includes changes seemingly directed at surviving constitutional challenges under U.S. law. We have outlined the major differences between the two U.S. AADCs below.Continue Reading Maryland’s Enactment of the Age-Appropriate Design Code Act

This year, the blossoming of spring is accompanied by a pair of noteworthy California Privacy Protection Agency (CPPA) updates. First, on March 8, the CPPA and staff convened to discuss new draft regulations related to automated decision-making technology (ADMT) and risk assessments, as well as updates to existing California Consumer Privacy Act (CCPA) regulations. Second, on April 2, the Enforcement Division of the CPPA released its first-ever “Enforcement Advisory,” which “share[s] observations from the [CPPA’s] Enforcement Division to educate and encourage businesses to comply with the law.”Continue Reading CPPA Board Updates Timing for Regulations, and Enforcement Division Releases Enforcement Advisory: Focus on Data Minimization!

On Friday, February 9, as the country collectively packed up and prepared to head home for Super Bowl weekend, the Third Appellate District of the California Appellate Court issued an Order granting the California Privacy Protection Agency the ability to immediately enforce regulations implementing the California Privacy Rights Act, which were finalized in March 2023.

Building off of the momentum from last year’s torrent of new comprehensive state privacy laws, 2024 has begun with a bang as two more states have now entered the picture. On January 16, 2024, New Jersey became the latest state to enact comprehensive privacy legislation with the New Jersey Data Privacy Act (NJDPA). New Hampshire’s state legislature quickly followed suit by passing Senate Bill 255 and it is currently awaiting finalization before becoming law.Continue Reading Two New States Enter the Privacy Fray

After a flurry of legislative activity across the United States related to kids’ privacy and safety online, in recent weeks, federal courts in Arkansas and California have enjoined two notable state laws. A federal court in Arkansas preliminarily enjoined the Arkansas Social Media Safety Act (AR SMSA) on August 31, the day before the statute was scheduled to take effect for social media platforms in scope. The U.S. District Court for the Western District of Arkansas found that the plaintiff, NetChoice, LLC, is likely to succeed on the merits of its constitutional challenges.

Less than three weeks later, on September 18, the U.S. District Court for the Northern District of California also preliminarily enjoined California’s Age-Appropriate Design Code (CA AADC), holding that NetChoice is likely to succeed in showing that 10 CA AADC requirements violate the First Amendment.Continue Reading Federal Courts Preliminarily Enjoin Arkansas Social Media Safety Act and California Age-Appropriate Design Code

One of the most litigated state telemarketing laws in the country has been significantly pared down. On May 2, 2023, the Florida legislature passed a bill to amend the Florida Telephone Solicitation Act (FTSA), Fla. Stat. § 501.059. The bill was presented to Florida Governor Ron DeSantis on May 16 and was signed into law on May 25. In this post, we cover the origins of the FTSA, its prior scope, and how the amendments modify the law. This amendment should significantly curtail lawsuits filed under the FTSA against companies that use technology to assist in placing calls to consumers.Continue Reading Florida Significantly Narrows the FTSA