Yet another CCPA settlement announced today—the fifth of the year, by my count, and a second from the CA DOJ. oag.ca.gov/news/press-r... Details: $530K civil penalty and injunctive terms with SlingTV, mostly concerning insufficient and overly burdensome opt-out procedures.

Hot off the presses: Issue brief by me and my colleague Justine on new regulations from @calprivacy.bsky.social concerning automated decisionmaking technology, risk assessments, and cybersecurity audits 🔗 fpf.org/wp-content/u...

📢 NEW: EPIC published a new report today that examines how state Attorneys General are advancing privacy enforcement across the U.S. (2020–2024). 220+ cases. 35 letters. 20 investigations. Read more: epic.org/state-ag-pri...

Added to my reading list: New report from EPIC on "State Attorneys General & Privacy: Enforcement Trends, 2020-2024" 🔗 epic.org/wp-content/u...

For all the #privacy academics out there: In case you missed it, submissions are open for FPF's annual Privacy Papers for Policymakers (PPPM) award! You have until Oct. 30 to submit the best privacy scholarship from the past year. ⏩ See details here: fpf.org/privacy-pape...

The Florida Attorney General filed a lawsuit alleging violations of the Florida Digital Bill of Rights. The prayer for relief includes civil penalties "up to $150,000 per violation," which is SIGNIFICANT. Read the complain here: s3.documentcloud.org/documents/26...

Even in the "off-season" for legislative tracking, California is keeping me busy. Governor Newsom signed several privacy bills today, including AB 566, requiring businesses that develop a browser to include a user-enabled setting to send an opt-out preference signal ⬇️ www.gov.ca.gov/2025/10/08/g...

Minnesota and New Hampshire joined the "Consortium of Privacy Regulators," according to CalPrivacy. The consortium now includes California, Colorado, Connecticut, Delaware, Indiana, New Hampshire, New Jersey, Minnesota, and Oregon.

It's an important day in state privacy law as both the Maryland Online Data Privacy Act and youth privacy amendments to the Colorado Privacy Act go into effect. ⏩ Looking to stay on top of all these state laws? See FPF's effective dates chart at fpf.org/statelaws.

Excited to share that I have been promoted to Senior Policy Counsel! Much like the state privacy law landscape, I've grown and evolved during my two years at FPF, and I'm excited to take on new responsibilities. As always, I'm grateful to my colleagues for their support and confidence in me.

The Massachusetts Data Privacy Act (S.2608) passed the Senate 40-0 today, with several adopted amendments.

The 2025 state legislative session is winding down but not over yet. Last week the Massachusetts Senate Committee on Ways & Means favorably reported a new comprehensive privacy bill, S.2608, as a substitute for S.2516. Read it here: malegislature.gov/Bills/194/S2... What changed between drafts?

Some personal news: I wanted to share that I recently relocated from Washington, DC back to Madison, WI, a city near-and-dear to my heart. I am extremely grateful to be continuing my role with FPF remotely, and I look forward to connecting with privacy and tech policy folks in Wisconsin!

One of many important privacy bills to follow in California this week as they approach the end of the legislative session:

Pleased to see my 2024 report on the state comprehensive privacy laws cited in this recent working paper by the U.N.'s International Labour Organization: www.ilo.org/sites/defaul...

We are days away from the Minnesota Consumer Data Privacy Act going into effect! Curious how this law fits into the broader state comprehensive privacy law landscape? Check out my blog post from when this law was signed last year: fpf.org/blog/the-nor...

Materials are published the the CPPA's July 24 board meeting: cppa.ca.gov/meetings/mat...

We are hiring a Privacy Counsel for TikTok's Americas Public Policy team! This is a great opportunity to work on a unique set of privacy issues at a pivotal moment for TikTok. lnkd.in/eYQgKxzb

Happening today: AEI and CDT are hosting a panel on "Federal Data Consolidation: Protecting Civil Liberties in the Digital Age" Livestream available here: cdt.org/event/federa...

The next CPPA board meeting is scheduled for Thursday, July 24. ⏩ The agenda includes discussion of and possible action on important ongoing rulemaking initiatives, including ADMT, risk assessments, cybersecurity audits, and the DROP requirements. ⏩ Agenda here: cppa.ca.gov/meetings/age...

FPF's recently updated effective dates chart is a one-stop-shop for key dates and links to existing privacy laws, enacted amendments, and broadly applicable sectoral laws (mostly health and youth privacy focused). ⏩ Find it here: fpf.org/wp-content/u...

Internship opportunity for Fall 2025: FPF recently launched The Hannah Schaller Memorial Internship by ZwillGen. This internship honors Hannah Schaller, who started her privacy career as a policy intern in the FPF D.C. Office. Learn more about the position and apply here: fpf.org/the-hannah-s...

California AG Bonta announced a new CCPA settlement today (the largest to date): oag.ca.gov/news/press-r...

In case you missed it, the Connecticut Data Privacy Act was amended yet again this year. The recently signed SB 1295 makes numerous changes to the law, including greatly expanded applicability, new consumers rights, and more. ⏩ You can read my coverage here: fpf.org/blog/the-con...

Lots of other important things happening today, but add this to your reading queue ⬇️

S.836, the Children and Teens’ Online Privacy Protection Act ("COPPA 2.0") was favorably reported out of the Senate Commerce committee today: ⏩ Bill Text www.congress.gov/119/bills/s8... ⏩ Amendment #1 www.commerce.senate.gov/services/fil... ⏩ Amendment #2 www.commerce.senate.gov/services/fil...

Interested in state policymakers' pivot towards substantive data minimization requirements tying the collection of personal data to what is necessary to provide or maintain a specific product or service requested by the consumer to whom the data relates? Read my latest report fpf.org/wp-content/u...

I'm excited to share a new a paper by me, "Data Minimization’s Substantive Turn: Key Questions & Operational Challenges Posed by New State Privacy Legislation." Read it here: fpf.org/blog/fpf-unv...

Looking forward to catching up with folks at the Privacy Law Scholars Conference in LA this week!

Last week, Montana Governor Gianforte signed SB 297, amending the Montana Consumer Data Privacy Act. Read my latest blog post breaking down what to know about the changes ⬇️ fpf.org/blog/amendme...

The California Privacy Protection Agency is holding a board meeting today. In advance of the meeting, the board shared updated text of the proposed regulations on cybersecurity audits, risk assessments, ADMT access and opt-out rights, and updates to existing regulations. cppa.ca.gov/meetings/mat...

I posted some key takeaways from today's CPPA Board Meeting on LinkedIn: www.linkedin.com/posts/jordan...

The CPPA Board meeting is back underway after their lunch break. The board left off on agenda item #3 (potential modifications to the draft regulations on risk assessments, ADMT, and cybersecurity audits).

Once again I ask why the California Privacy Protection Agency has an ordered agenda for meetings if they routinely jump around out of order. Going into the closed session right away? Perfectly fine! But then why is it Agenda Item #6? The numbers might as well be wingdings if they don't mean anything

New interactive resource from New America's Open Technology Institute on privacy concerns raised by DOGE activities. Potentially very helpful for explaining the risks to folks who aren't especially privacy-minded: Check it out: www.newamerica.org/oti/briefs/q...

Interesting findings from Consumer Reports and Wesleyan University on compliance with universal opt-out mechanisms (UOOMs): advocacy.consumerreports.org/press_releas...

Today's hearing in the House Judiciary Subcommittee on the Administrative State, Regulatory Reform, and Antitrust should be interesting, with Commissioner Bedoya adding to an already strong mix of speakers 🍿

The Utah Consumer Privacy Act's phantom "data minimization" requirement (it appeared in a prior draft, was taken out, but the enacted law left it in the section header) is the state privacy legislation equivalent of a Paper Town. Here it is popping up in a recent North Carolina bill:

Earlier this week, Rep. Lori Trahan (D-MA) released an RFI on potential updates to the Privacy Act of 1974. Responses are due April 30th. See details here: trahan.house.gov/news/documen...

The California Privacy Protection Agency announced a settlement with data broker Background Alert today. The order confirms something the AG asserted in a 2022 opinion: Inferences made from public information are personal information under the CCPA. Press release: cppa.ca.gov/announcement...

New York caused a stir last month when the legislature passed S929, the Health Information Privacy Act ("NYHIPA," or "HIPA" if you want to be maximally confusing). This is a broad consumer health privacy bill akin to Washington's My Health My Data Act. 1/3

It's heartening to see the ABA take such a principled stance in support of the rule of law: www.americanbar.org/news/abanews... It reminds me of RFK's address at the University of Georgia's Law Day ceremonies in 1961, which I recently revisited in "RFK: His Words for Our Times."

Minnesota Attorney General Keith Ellison released a report on the effects of artificial intelligence and social media on kids and teens. It's yet another reminder that youth privacy and online safety are major priorities for State AGs right now. ⏩ Read it here: www.ag.state.mn.us/Office/Repor...

Deadline tomorrow for Sheppard Mullin privacy fellowship: www.google.com/url?q=https:...

@futureofprivacy.bsky.social posted a redline that compares the current COPPA Rule to the one that the FTC just finalized. You can use it to see what this 2025 update removes, adds, or otherwise changes. Hint: The security section changed a lot! Find it here: fpf.org/resource/uno...

Today the New York Assembly voted 95-41 to pass the New York Health Information Privacy Act (S929 / A2124), which passed the Senate yesterday 49-10. legislation.nysenate.gov/pdf/bills/20... This bill is a consumer health privacy bill of similar scale and scope to Washington's My Health My Data Act.

Interesting article on a woman's attachment to her virtual "boyfriend." I'll be keeping an eye out for research on the effects of parasocial relationships with chatbots.

Not to be overshadowed by Texas, today California Attorney General Bonta's office released two advisory opinions on how existing California law applies to AI. One advisory is more general and another focuses on healthcare specifically. See the press release here: oag.ca.gov/news/press-r...

Big privacy news coming from Texas yet again: We finally have our first lawsuit filed by a state Attorney General to enforce a comprehensive privacy law! ⏩ Press Release: www.texasattorneygeneral.gov/news/release... ⏩ Complaint: www.texasattorneygeneral.gov/sites/defaul...

Wondering where the US may go on AI legislation this year? So is everyone else. Here is @julespolonetsky.bsky.social on the different paths we may take, and how state legislators are doing their homework on the topic www.techpolicy.press/2025-may-be-...