State Law Updates

Subscribe to State Law Updates via RSS

A customer drives into a shopping center, parks, and leaves. Along the way, a camera captures the vehicle’s license plate. For the business, the system may serve a routine security or parking function. For plaintiffs’ lawyers, it may supply the foundation of the next privacy class action.

Litigation over automated license plate recognition (ALPR) is gaining momentum in California, where plaintiffs are challenging how businesses disclose and manage the plate data they collect. The developing cases matter to retailers, commercial property owners, parking operators, and hospitality businesses, including those headquartered elsewhere that operate California locations.…

California just closed the door on one legal theory driving thousands of CIPA website-tracking claims, but businesses still face real exposure under the statute’s other provisions.

For three years, businesses have faced a particular brand of privacy suit: claims that ordinary website cookies, pixels, and chat tools are illegal “pen registers” under California Penal Code…

Florida lawmakers are once again weighing whether to provide litigation protections to companies that invest in meaningful cybersecurity safeguards. A revised proposal now pending before the Florida Legislature seeks to strike a balance between encouraging proactive data security measures and preserving consumer remedies following a breach. Data incidents are commonly met with class action lawsuits…

Retailers. Banks. Healthcare systems. E-commerce platforms. Across industries, live chat, session replay software, and website analytics have become standard tools for customer engagement. These technologies help businesses respond to consumer inquiries in real time, improve website functionality, reduce cart abandonment, train customer service teams, and resolve disputes.

For companies operating nationally, the landscape is shifting…

In 2026, a wide range of California laws regulating the development, marketing, and use of artificial intelligence (AI) go into effect. Together, these bills impose new requirements on generative AI developers, frontier-model companies, healthcare-related AI tools, platforms distributing AI-generated content, and businesses that rely on algorithmic pricing. With the deadline to comply coming up quickly…

On May 12, 2025, the Federal Trade Commission’s Rule on Unfair or Deceptive Fees  took effect, thereby thrusting the United States’ primary regulator of unfair or deceptive practices once more into the spotlight. But the spotlight given to the FTC rule, which only applies to the short-term lodging and live-event ticketing industries, has obscured the…

If you run an ecommerce brand or handle marketing compliance, you’ve probably heard about Texas Senate Bill 140 (SB 140) and its potential impact on text message marketing. Earlier this month, a group of plaintiffs, including an industry association and two e-commerce companies, asked a federal court in Austin to block the state from enforcing…

A new Mississippi law, known as the Walker Montgomery Protecting Children Online Act, has prompted several companies to block Mississippi IP addresses from accessing their platforms. In fact, social media company Bluesky posted a response to the enactment of the law on its website. Bluesky explained the decision to make their app unavailable to Mississippi…

July 1 marked the official enforcement date of the Tennessee Information Protection Act (TIPA), the state’s comprehensive consumer privacy law. Signed into law in 2023, TIPA grants consumers specific rights concerning their personal information and regulates covered businesses and service providers that collect, use, share, or otherwise process consumers’ personal information. With all TIPA…

Introduction

On May 7, 2025, the Utah Artificial Intelligence Policy Act (UAIP) amendments will go into effect. These  amendments provide significant updates to Utah’s 2024 artificial intelligence (AI) laws. In particular, the amendments focus on  regulation of AI in the realm of consumer protection (S.B. 226 and S.B. 332), mental health applications (…

A recently introduced bill in the Florida Legislature would provide businesses operating in Florida, including health care providers, with a legal defense to data breach lawsuits if they maintain robust cybersecurity measures that meet government- and industry-recognized standards. Specifically, Florida House Bill No. 473 (H.B. 473), known as the Cybersecurity Incident Liability Act, was…