“It wasn’t me, it was the AI agent” may not help companies avoid civil or criminal liability under a new bipartisan legislative proposal. U.S. Senators Josh Hawley (R-Mo.) and Chris Murphy (D-Conn.) have announced the proposed AI Agent Accountability Act, which seeks to hold AI-agent operators and developers liable for hacking incidents. According to the senators’ announcement, the proposal would: Hold AI-agent operators liable. Operators could face criminal and civil liability under the Computer Fraud and Abuse Act (CFAA), including for knowingly…More

The Croatian data protection authority (AZOP) imposed a €2.59 million fine on a casino company for collecting fingerprints and photographs in violation of the GDPR. The authority found that the company violated the principle of data minimization by collecting four fingerprints without demonstrating that doing so was necessary. It also found that the company’s consent was invalid because multiple processing purposes were bundled together. What happened, and why does it matter for U.S.-based companies in the gaming industry and beyond? What…More

California has enacted a new law requiring healthcare providers using artificial intelligence to keep clinical decision-making human. AB 1979, signed by Governor Gavin Newsom on September 30, 2026, requires a health facility, clinic, physician’s office, or office of a group practice to take reasonable steps to ensure that a licensed healthcare provider, acting within the provider’s scope of practice, retains the ability to exercise independent professional judgment when patient care is informed by a clinical decision support system. The law also…More

The new law eliminates private pen register claims against private actors involving websites and apps but does not end CIPA litigation. Plaintiffs are already pivoting to other causes of action. On September 30, 2026, California Governor Gavin Newsom signed Senate Bill 690, significantly narrowing one of the theories driving California website-tracking litigation. The law limits private lawsuits alleging that tracking technologies used on websites and applications violate the pen register and trap-and-trace provisions of the California Invasion of Privacy Act, commonly…More

A new law signed by Governor Newsom, AB 1609, requires large private businesses to disclose when the customer service agent they are using is an AI bot and provide customers with timely access to quality customer service. This joins other existing obligations that may require disclosure of AI bot use, including: Consumer protection laws, if the use could be misleading. Existing bot disclosure laws in states such as Maine and Utah. Under the new California law, a “large private business,” meaning a business with…More

On September 27, 2026, Governor Gavin Newsom signed SB 923, the Expanding Privacy Rights Act, which significantly expands the deletion right under the California Consumer Privacy Act. What does this mean for companies subject to the CCPA and how does it compare to data brokers subject to the California DELETE Act?  What SB 923 Changes Beginning January 1, 2027, consumers will be able to request deletion of covered personal information that a business collected “from or about” them. This is a significant…More

With the growing wave of letters alleging violations of the California Invasion of Privacy Act (CIPA), Texas Attorney General Ken Paxton has issued a letter urging businesses and nonprofit organizations to exercise caution and seek legal guidance before taking action.     Paxton recommends any Texas business that received such a letter to: Consult with legal counsel experienced in privacy and website-tracking litigation before taking action. With the assistance of counsel, review their website’s use of pixels, cookies, analytics tools, and similar technologies. Monitor evolving state and…More

A recent decision from a German labor court offers an interesting perspective on the use of personal information collected from publicly available social media profiles. While the case arose in the context of employment litigation, the court’s reasoning has broader implications for organizations that collect and use publicly available information, including U.S.-based data brokers. The dispute arose after an individual pursuing a discrimination claim submitted an application for legal aid. In defending the lawsuit, the defendant reviewed the plaintiff’s publicly accessible…More

As lawyers increasingly incorporate generative AI into everyday practice, bar associations around the world are considering the same question: how do longstanding professional and ethics rules that have governed the practice of law for hundreds of years, apply when legal work is assisted by AI? A recent memorandum from the Ethics Committee of the Israel Bar Association offers a thoughtful framework. The overarching principle is straightforward: competence, confidentiality, diligence, supervision, and professional judgment remain fully applicable when lawyers use AI. If…More

A new decision from the Central District Court for Central District of California Judge Fred Slaughter in Reisberg v. Renaissance Learning may provide insight into what website and app tracking litigation could look like if California’s SB 690 becomes law and limits certain claims under CIPA, the California Wiretapping Law. The case involved Renaissance, a K-12 educational platform that schools required students to use. Plaintiffs, including children under 13, alleged that Renaissance collected and shared personal information through numerous third-party analytics,…More