The New York City Department of Consumer and Worker Protection has proposed rules that would require merchants using consumer-facing automated customer service systems to clearly and conspicuously notify consumers that they are interacting with an automated system, not a human. The disclosure would have to be provided at the beginning of the interaction and in the language being used for the interaction. This is similar to bot-disclosure requirements adopted in California, Maine, New Jersey and Utah. But the NYC proposal…More

Your cookie solution may be working, but your work here is not done. With all the website tracking demand letters and litigation, it is not enough just to deploy an out-of-the-box cookie solution. The recent wave of website and app privacy litigation is projected to result in $1.4 billion in settlements in 2026, according to a recent Privado.ai Website & App Privacy Litigation Report. First and foremost, you need to address the blocking or rejection of trackers through a functioning cookie solution. Reject…More

Legitimate interest as a legal basis for training your AI is not res ipsa loquitur. It does not speak for itself. In the age of AI, we often hear clients, and see privacy policies, refer to a “legitimate interest in the improvement of our product” as the legal basis for using input data to train AI models. Recent guidance from the European Data Protection Board and European data protection supervisory authorities indicates that legitimate interest can, indeed, be a legal basis under…More

“It wasn’t me, it was the AI agent” may not help companies avoid civil or criminal liability under a new bipartisan legislative proposal. U.S. Senators Josh Hawley (R-Mo.) and Chris Murphy (D-Conn.) have announced the proposed AI Agent Accountability Act, which seeks to hold AI-agent operators and developers liable for hacking incidents. According to the senators’ announcement, the proposal would: Hold AI-agent operators liable. Operators could face criminal and civil liability under the Computer Fraud and Abuse Act (CFAA), including for knowingly…More

The Croatian data protection authority (AZOP) imposed a €2.59 million fine on a casino company for collecting fingerprints and photographs in violation of the GDPR. The authority found that the company violated the principle of data minimization by collecting four fingerprints without demonstrating that doing so was necessary. It also found that the company’s consent was invalid because multiple processing purposes were bundled together. What happened, and why does it matter for U.S.-based companies in the gaming industry and beyond? What…More

California has enacted a new law requiring healthcare providers using artificial intelligence to keep clinical decision-making human. AB 1979, signed by Governor Gavin Newsom on September 30, 2026, requires a health facility, clinic, physician’s office, or office of a group practice to take reasonable steps to ensure that a licensed healthcare provider, acting within the provider’s scope of practice, retains the ability to exercise independent professional judgment when patient care is informed by a clinical decision support system. The law also…More

The new law eliminates private pen register claims against private actors involving websites and apps but does not end CIPA litigation. Plaintiffs are already pivoting to other causes of action. On September 30, 2026, California Governor Gavin Newsom signed Senate Bill 690, significantly narrowing one of the theories driving California website-tracking litigation. The law limits private lawsuits alleging that tracking technologies used on websites and applications violate the pen register and trap-and-trace provisions of the California Invasion of Privacy Act, commonly…More

A new law signed by Governor Newsom, AB 1609, requires large private businesses to disclose when the customer service agent they are using is an AI bot and provide customers with timely access to quality customer service. This joins other existing obligations that may require disclosure of AI bot use, including: Consumer protection laws, if the use could be misleading. Existing bot disclosure laws in states such as Maine and Utah. Under the new California law, a “large private business,” meaning a business with…More

On September 27, 2026, Governor Gavin Newsom signed SB 923, the Expanding Privacy Rights Act, which significantly expands the deletion right under the California Consumer Privacy Act. What does this mean for companies subject to the CCPA and how does it compare to data brokers subject to the California DELETE Act?  What SB 923 Changes Beginning January 1, 2027, consumers will be able to request deletion of covered personal information that a business collected “from or about” them. This is a significant…More

With the growing wave of letters alleging violations of the California Invasion of Privacy Act (CIPA), Texas Attorney General Ken Paxton has issued a letter urging businesses and nonprofit organizations to exercise caution and seek legal guidance before taking action.     Paxton recommends any Texas business that received such a letter to: Consult with legal counsel experienced in privacy and website-tracking litigation before taking action. With the assistance of counsel, review their website’s use of pixels, cookies, analytics tools, and similar technologies. Monitor evolving state and…More