WilmerHale Privacy and Cybersecurity Law RSS Feed

Key Takeaways on Healthcare Privacy in 2026

Mon, 06 Apr 2026 11:30:00 Z

WilmerHale Partner Kirk Nahra recently published the article, “Thinking About Healthcare Privacy in 2026,” in the April 2026 issue of Compliance Today, a publication of the Health Care Compliance Association.

Oklahoma Enacts Nation’s Twentieth State Comprehensive Privacy Law

Fri, 27 Mar 2026 13:00:00 Z

On March 16, the Oklahoma legislature passed SB 546, with Oklahoma Governor Kevin Stitt signing the bill into law on March 20. SB 546 is the twentieth state comprehensive law to be enacted and will take effect on January 1, 2027.

White House Releases National Policy Framework for Artificial Intelligence

Mon, 23 Mar 2026 16:30:00 Z

The White House’s National Policy Framework for Artificial Intelligence outlines a proposed unified approach to AI regulation, arguing that a patchwork of state laws hinders innovation and should largely be preempted by federal legislation.

Youth Sports Media Company to Pay $1.10 Million Fine in CPPA Enforcement Action

Thu, 19 Mar 2026 16:52:00 Z

CPPA fined PlayOn Sports $1.1M for CCPA tracking violations, reinforcing opt-out obligations and scrutiny of targeted ads and consent models.

California Attorney General Announces Largest CCPA Settlement

Mon, 09 Mar 2026 16:44:00 Z

On February 11th, California Attorney General Rob Bonta’s office (“CA AG”) announced a $2.75 million settlement—the largest settlement to date under the California Consumer Privacy Act (CCPA) —with the Walt Disney Company (“Disney”).

2025 Year in Review: California Shine the Light Request Trends

Thu, 05 Feb 2026 17:07:00 Z

Throughout 2025, we saw a noticeable uptick in requests from California residents invoking their rights under the state’s “Shine the Light” law, Cal. Civ. Code § 1798.83.

Year in Review: 2025 Artificial Intelligence-Privacy Litigation Trends

Mon, 02 Feb 2026 12:00:00 Z

In 2025, state and federal officials continued scrutinizing the data privacy aspects of artificial intelligence (AI) systems, with enforcement agencies focusing on deceptive marketing claims, opaque data use disclosures, and potential risks to children stemming from chatbots and AI enabled customer interaction tools.

US Supreme Court to Define Who Can Sue Under the Video Privacy Protection Act

Fri, 30 Jan 2026 11:30:00 Z

On Monday, January 26, the US Supreme Court agreed to take up a case about the breadth of the Video Privacy Protection Act.

Year in Review: The Top Ten US Data Privacy Developments from 2025

Wed, 28 Jan 2026 15:29:00 Z

In 2025, federal and state privacy activity grew through DOJ’s new Data Security Program and rising AI and child‑privacy laws, despite no new broad privacy bills.

2025 Year in Review: Web Tracking and the Wiretap Act Crime/Tort Exception

Wed, 28 Jan 2026 08:00:00 Z

Courts remain divided on whether the Wiretap Act’s crime/tort exception covers commercial web data capture, leaving an unsettled legal landscape entering 2026.

2025 Year In Review: Video Privacy Protection Act Litigation Trends

Fri, 23 Jan 2026 15:04:00 Z

Despite having been enacted decades ago – during the heyday of the neighborhood brick-and-mortar video store – the federal Video Privacy Protection Act remained as relevant as ever in 2025.

Kirk Nahra Authors an Article on "Privacy and Security Law for Business Lawyers"

Fri, 16 Jan 2026 14:00:00 Z

WilmerHale Partner Kirk Nahra examines the expanding and increasingly complex patchwork of U.S. privacy and security regulations in his recently published article, “Privacy and Security Law for Business Lawyers.”

Kirk Nahra Authors an Article on “Trying to Make Sense of Health Privacy”

Wed, 03 Dec 2025 15:46:00 Z

Kirk Nahra has authored an article, which analyzes the recently introduced Health Information Privacy Reform Act.

European Court of Justice to Review Challenge to EU-U.S. Data Privacy Framework

Mon, 01 Dec 2025 13:30:00 Z

The European Court of Justice will review a challenge to the EU-U.S. Data Privacy Framework, introducing uncertainty for companies that rely on the Framework for transatlantic data flows.

Two Circuits Narrowly Construe the Video Privacy Protection Act

Mon, 20 Oct 2025 16:00:00 Z

Recent federal appellate decisions have narrowed the scope of the Video Privacy Protection Act, with he Second Circuit limiting what counts as “personally identifiable information” and excluding complex data strings and social media identifiers from VPPA protection.

California Privacy Protection Agency Issues Largest Monetary Penalty to Date

Fri, 17 Oct 2025 15:22:00 Z

On September 30, the CPPA announced a $1.35 million settlement – the largest in the agency’s brief history – with Tractor Supply Company, signaling that the CPPA is an increasingly active regulator and that compliance with it should continue to be an area of priority for companies.

Transparency in Frontier Artificial Intelligence Act (SB-53): California Requires New Standardized AI Safety Disclosures

Wed, 01 Oct 2025 13:30:00 Z

California has passed a new AI safety law (“the Transparency in Frontier Artificial Intelligence Act” or “TFAIA”) that requires developers of powerful AI systems to publicly share how they manage safety risks.

Texas Expands and Modifies Data Broker Registration Law

Thu, 04 Sep 2025 16:00:00 Z

On June 20, 2025, the Texas governor signed two bills amending the Texas Data Broker Act (the “Act”) into law (SB 2121 and SB 1343).

AI and the EU Digital Markets Act

Mon, 18 Aug 2025 14:13:00 Z

AI is not yet a regulated 'core platform service' under the DMA but may be covered when integrated into such a service and in future revisions.

European Commission Releases Mandatory Template for Public Disclosure of AI Training Data

Wed, 13 Aug 2025 09:00:00 Z

The European Commission has introduced a mandatory template for providers of general-purpose AI (GPAI) models to publicly disclose detailed summaries of their training data. This requirement aims to enhance transparency and support copyright and data protection enforcement.

AI and GDPR: A Road Map to Compliance by Design - Episode 5: Using AI

Fri, 01 Aug 2025 09:30:00 Z

The use of AI requires organizations that act as controllers under the GDPR to determine the purposes and means of processing personal data.

AI and GDPR: A Road Map to Compliance by Design - Episode 4: The Deployment Phase

Thu, 31 Jul 2025 13:31:00 Z

AI deployment demands ongoing GDPR compliance, user rights support, and strong security to manage risks and ensure responsible real-world use.

AI and GDPR: A Road Map to Compliance by Design - Episode 3: The Development Phase

Wed, 30 Jul 2025 12:58:00 Z

AI development must respect GDPR: ensure data accuracy, enable user rights, and secure personal data with privacy-enhancing technologies.

AI and GDPR: A Road Map to Compliance by Design - Episode 2: The Design Phase

Tue, 29 Jul 2025 13:53:00 Z

AI design must embed GDPR safeguards—minimize and anonymize data, ensure transparency, and enable human oversight for responsible, lawful use.

AI and GDPR: A Road Map to Compliance by Design - Episode 1: The Planning Phase

Mon, 28 Jul 2025 10:00:00 Z

AI systems must align with GDPR: ensure lawful data use, assess risks, and apply safeguards from planning through deployment.

European Commission Issues Guidelines for Providers of General-Purpose AI Models

Thu, 24 Jul 2025 15:55:00 Z

EU issues GPAI guidelines under AI Act, detailing compliance for AI model providers, effective Aug 2, 2025, with focus on transparency and risk.

Artificial Intelligence and Abuse of Dominance in EU Law

Tue, 22 Jul 2025 11:00:00 Z

AI’s autonomy and inference abilities may complicate enforcement of EU competition law, especially under Article 102 TFEU on market dominance abuse.

Texas Enacts New AI Law

Mon, 21 Jul 2025 18:38:00 Z

On June 22, 2025, the Texas governor signed the Texas Responsible Artificial Intelligence Governance Act into law, making Texas the second state to pass comprehensive artificial intelligence regulation (with Colorado).

Another EU AI Act Milestone – Nearly Final Version of the General-Purpose AI Code of Practice Published

Wed, 16 Jul 2025 08:30:00 Z

On July 10, 2025, the European Commission released a nearly final version of the General-Purpose AI (GPAI) Code of Practice (Code) under Regulation (EU) 2024/1689 (AI Act).

AI and EU Merger Control

Tue, 15 Jul 2025 13:11:00 Z

The integration of AI into EU merger control presents challenges due to complex deal structures, limitations of revenue thresholds, and evolving regulatory responses, prompting authorities to consider new mechanisms and thresholds to ensure fair competition and effective oversight in digital markets.

California AG Issues Largest Monetary Penalty in Most Recent CCPA Enforcement Action

Tue, 08 Jul 2025 14:53:00 Z

On July 1, the California Attorney General announced a $1.55 million settlement – the largest penalty issued under the California Consumer Privacy Act (CCPA) to date – with Healthline, an online health and wellness knowledge platform.

New Jersey Announces Proposed Rules under the State’s Comprehensive Privacy Law

Tue, 24 Jun 2025 14:00:00 Z

On June 2, 2025, the New Jersey Division of Consumer Affairs, alongside the Office of the Attorney General, announced Proposed Rules to implement the New Jersey Data Privacy Act.

Arkansas Online Privacy Act Expands Privacy Protections for Children and Teens

Wed, 21 May 2025 13:10:00 Z

Arkansas's Governor signed HB 1717 into law, which will prohibit the collection of personal information of children or teens for the purposes of targeted advertising.

State Comprehensive Privacy Law Update – May 19, 2025

Mon, 19 May 2025 17:29:00 Z

This blog post discusses recent developments in state privacy laws, focusing on Massachusetts and New York’s proposed legislation.

State Comprehensive Privacy Law Update – May 2, 2025

Fri, 02 May 2025 12:00:00 Z

As the end of many states’ legislative sessions approaches, some state legislatures appear to be focused on pushing bills through the chambers before sessions come to a close. Notably, this includes bills in Alabama, Oklahoma and Arkansas.

Virginia Amends Consumer Protection Act to Protect Reproductive and Sexual Health Information

Mon, 21 Apr 2025 14:21:00 Z

On March 24, Virginia Governor Glenn Youngkin signed SB 754 into law. SB 754, which will take effect on July 1, 2025, amends the Virginia Consumer Protection Act to prohibit certain entities from, in connection with a consumer transaction, obtaining, disclosing, selling, or disseminating any personally identifiable reproductive or sexual health information without consumer consent.

State Comprehensive Privacy Law Update – April 18, 2025

Fri, 18 Apr 2025 14:06:00 Z

State legislatures are advancing existing privacy proposals, with Wisconsin introducing AB 172 and Minnesota proposing significant amendments to its privacy law.

2024 Year in Review: Data Breach Litigation

Wed, 09 Apr 2025 12:57:00 Z

This blog post examines the proliferation of data breach litigation in 2024, including standing issues post-TransUnion LLC v. Ramirez and guidance on attorney-client privilege from the District of New Jersey.

Kirk Nahra Authors an Article on The Current State of Health Care Privacy — It’s a Mess

Tue, 08 Apr 2025 16:15:00 Z

In the recent article, Why health care privacy is a mess — and why it isn't likely to get better soon, Partner Kirk Nahra discusses navigating the complex landscape of health care privacy — from HIPAA to modern challenges.

State Comprehensive Privacy Law Update – April 7, 2025

Mon, 07 Apr 2025 15:05:00 Z

This blog post summarizes the most notable updates with regard to state comprehensive privacy law proposals in the past two weeks.

Year-in-Review: 2024 TCPA Litigation

Thu, 03 Apr 2025 16:46:00 Z

The TCPA remains a key source of litigation, with trends in autodialer definitions, unsolicited ads, and a Supreme Court case.

Assessing Throughlines in the Trump Administration’s AI Regulatory Approach

Wed, 02 Apr 2025 14:00:00 Z

The Trump Administration has kicked off its second term with a heavy emphasis on AI, with notable impact on critical areas of continuity and change that industry should monitor as they develop their AI strategies.

Year in Review: 2024 AI Securities Litigation Trends

Mon, 31 Mar 2025 10:00:00 Z

This blog identifies trends in 2024 securities-related cases challenging statements about the use, development, or deployment of AI, key considerations to avoid pitfalls, and highlights select cases from 2024.

California’s Most Recent Privacy Developments: Location Data Investigative Sweep and a Continued Focus on Car Companies

Wed, 26 Mar 2025 12:52:00 Z

This blog post provides key takeaways for companies to consider as part of their CCPA compliance programs and summarizes key provisions from the press release and CPPA settlement.

State Comprehensive Privacy Law Update – March 21, 2025

Fri, 21 Mar 2025 18:18:00 Z

As we progress deeper into the 2025 legislative season, comprehensive privacy law proposals continue to progress through the legislative process.

Comprehensive AI Bill Poised for Governor’s Signature in Virginia

Thu, 20 Mar 2025 13:41:00 Z

Virginia's HB 2094 aims to prevent algorithmic discrimination by regulating high-risk AI systems. If signed, it will be effective July 1, 2026.

Artificial Intelligence and Anticompetitive Agreements in EU Law

Thu, 13 Mar 2025 16:13:00 Z

This blog post explores the role of AI in anticompetitive horizontal and vertical agreements under Article 101 of the Treaty on the Functioning of the EU, as well as how AI could assist regulators in enforcing competition law rules.

State Comprehensive Privacy Law Update – March 7, 2025

Fri, 07 Mar 2025 16:47:00 Z

This blog post reviews recent updates to state comprehensive privacy laws, including new bills from Arkansas, New Mexico, New York, Vermont and West Virginia.

Year in Review: 2024 Generative AI Litigation Trends

Fri, 07 Mar 2025 15:42:00 Z

Generative AI faced significant privacy-related litigation in 2024, with US companies encountering lawsuits and enforcement actions under various state and federal laws.

Year in Review: 2024 Web Tracking Litigation and Enforcement

Tue, 25 Feb 2025 17:54:00 Z

In 2024, numerous class action cases were filed across the US challenging the use of web tracking technologies like pixel systems, chatbots, and session replay, citing privacy violations.