If your business recently received a demand letter accusing your website of violating California’s wiretapping law, you’re not alone. On September 17, 2026, Texas Attorney General Ken Paxton issued a consumer alert warning Texas businesses and nonprofits about a surge in demand letters alleging violations of the California Invasion of Privacy Act (CIPA). The letters
Demand letters and copycat lawsuits are piling up on the desks of in-house counsel and business owners around the country, all making the same claim: that an ordinary website is secretly running an illegal wiretap. We’ve watched California Invasion of Privacy Act (CIPA) claims climb sharply over the past several months. The playbook is easy
A year ago, Congress put online platforms on the clock. On May 19, 2025, President Trump signed the Take It Down Act into law, creating a new federal framework aimed at stopping the online spread of nonconsensual intimate imagery, such as real images, AI-generated “deepfakes,” and other harmful content circulated across websites, social-media platforms, messaging
As in years past, the government continued its efforts to combat cybersecurity threats utilizing the False Claims Act (FCA). Overall, 2025 saw the highest FCA recoveries amount to date — over $6.8 billion in recoveries were awarded. With the ongoing Civil Cyber-Fraud Initiative, the focus remained on companies’ noncompliance with cybersecurity controls and allegations of
Florida lawmakers are once again weighing whether to provide litigation protections to companies that invest in meaningful cybersecurity safeguards. A revised proposal now pending before the Florida Legislature seeks to strike a balance between encouraging proactive data security measures and preserving consumer remedies following a breach. Data incidents are commonly met with class action lawsuits
Age verification requirements have rapidly moved from a niche policy concept to a central feature of the U.S. regulatory landscape. Over the last two years, and accelerating sharply in 2025, states have increasingly adopted laws that require online services to confirm a user’s age before allowing access to certain types of
In 2026, a wide range of California laws regulating the development, marketing, and use of artificial intelligence (AI) go into effect. Together, these bills impose new requirements on generative AI developers, frontier-model companies, healthcare-related AI tools, platforms distributing AI-generated content, and businesses that rely on algorithmic pricing. With the deadline to comply coming up quickly
With the U.S. Department of Justice’s Data Security Program (DSP) now in full effect, companies that handle sensitive personal data, operate across borders, or rely on global vendor ecosystems face an increasingly complex compliance environment. The DSP restricts certain data transactions involving individuals and countries of concern, imposes new
A new Mississippi law, known as the Walker Montgomery Protecting Children Online Act, has prompted several companies to block Mississippi IP addresses from accessing their platforms. In fact, social media company Bluesky posted a response to the enactment of the law on its website. Bluesky explained the decision to make their app unavailable to Mississippi
During the 2024 legislative session, the Colorado General Assembly passed Senate Bill 24-205, which is known as the Colorado Artificial Intelligence Act (CAIA). This law will take effect on February 1, 2026, and requires developers and deployers of a high-risk AI system to protect Colorado residents (“consumers”) from risks of algorithmic discrimination. Notably, the Act
In this week’s installment of our blog series on the U.S. Department of Health and Human Services’ (HHS) HIPAA Security Rule updates in its January 6 Notice of Proposed Rulemaking (NPRM), we are exploring the justifications for the proposed updates to the Security Rule. Last week’s post on the updates related to Vulnerability Management, Incident