Listen to this post

The Pentagon wants commercial AI, and AI companies want the Pentagon’s business. But the terms that make or break these deals are often about data, security, and rights, not algorithms.  That demand runs deep across U.S. defense customers and the defense industrial base, and AI companies are increasingly eager to supply it, directly or through primes, subcontractors, vendors, or technology partners.  These transactions raise consequential legal issues that extend well beyond model performance, bias, or weapons-system integration.  For privacy, security, product, IP, and government contracting teams, the early questions are practical but high-stakes: where the solution will run, what government or contractor data it will touch, whether Controlled Unclassified Information (CUI) will enter the company’s environment, whether prompts and outputs will be retained or reused, and what rights a government or defense customer may seek in AI-related deliverables.

The use case and contracting path both matter. AI sold into the defense market may support logistics, cyber, training, procurement, or other mission-support functions, or it may be integrated into, support, or influence weapons systems, where additional weapons-system rules may apply. Obligations may also depend on how the solution is acquired, including through the General Services Administration (GSA) Multiple Award Schedule, a governmentwide contracting program available to federal agencies. GSA has proposed a rule on basic safeguarding of AI systems and intellectual property rights that, if finalized and included in an applicable procurement, could add obligations related to government data, incident reporting, oversight, and downstream providers as well as potentially broad government ownership of modifications, customizations, configurations, and other broadly defined “Custom Development,” without corresponding rights for the AI provider. Companies should treat both use case and contracting path as threshold diligence questions.

Deployment is equally important. Companies should map where the application runs; where training, tuning, and inference occur; and where prompts, outputs, logs, and customer data are processed or stored. Requirements will differ depending on whether the solution is deployed in a defense agency or prime contractor environment, a customer-controlled environment, or provider-hosted SaaS. Even where the solution runs outside the provider’s environment, the company may still receive Controlled Unclassified Information (CUI) through proposals, implementation, support, or contract administration. Depending on the contract and flowed-down requirements, that may require a segregated environment aligned with NIST SP 800-171, Defense Federal Acquisition Regulation Supplement (DFARS) incident reporting obligations, and potentially Cybersecurity Maturity Model Certification (CMMC) requirements.

Customer data needs a sharp definition. Contracts should clearly address whether government, prime contractor, or subcontractor data may be used to train, fine-tune, or improve the provider’s model or service. For GenAI tools, customer data may appear in prompts, outputs, logs, or telemetry; even if the provider is not “training” on that data, it may still be processing or retaining information subject to enhanced obligations.

Not every “data rights” clause is about privacy or data processing. In defense contracting, data rights address government license and use rights in software, technical data, documentation, outputs, and other deliverables. These clauses can affect product strategy, IP protection, and valuation, so legal teams should identify them early and involve relevant stakeholders before accepting customer or flowed-down terms.

The practical takeaway: before negotiating defense-related contracts or supplier terms, companies should map the data flows, classify the data, confirm the contracting path and applicable flowdowns, and review privacy, cybersecurity, AI governance, government contracting, and data rights issues together.

Listen to this post

California has shut down one increasingly popular theory of website-tracking liability. With Governor Gavin Newsom’s signature, SB 690 amends the California Invasion of Privacy Act (“CIPA”) and eliminates the private right of action under Section 638.51 for pen-register and trap-and-trace claims involving websites, online applications, and mobile applications. Enforcement of Section 638.51 will now rest solely with the California Attorney General’s Office. The legislation responds to a wave of lawsuits alleging that commonplace tools – including cookies, pixels, and other tracking technologies – operate as pen registers by capturing information about users’ online activity.

Limitations on Scope

But the relief is narrower than many businesses initially anticipated. The version introduced in February 2025 would have created a “commercial business purposes” exception not only for Section 638.51 claims, but also for claims under Section 631, CIPA’s wiretapping provision, and Section 632, which governs the recording of confidential communications. That broader language did not survive. Private claims under Sections 631 and 632 therefore remain intact, as does Section 638.51’s substantive prohibition and the Attorney General’s enforcement authority.

Other Avenues for Plaintiffs 

SB 690 narrows the battlefield; it does not end the fight. Sections 631 and 632 still carry statutory-damages exposure of $5,000 per violation. Plaintiffs may also turn to the federal Electronic Communications Privacy Act, the Video Privacy Protection Act, and state wiretap laws.  Our tracking technology litigation heatmap reflects which jurisdictions are experiencing increased filings, notably including Florida and Pennsylvania. Complaints based exclusively on Section 638.51 are the clearest candidates for dismissal, but those cases represent only a subset of the broader CIPA litigation landscape.

Effective Date and Retroactivity 

The amendment takes effect January 1, 2027, and reaches back two years, potentially sweeping in claims filed since the beginning of 2025. Courts may soon have to decide how that retroactivity provision applies to pending cases. The measure’s practical effect will also turn on how quickly the plaintiffs’ bar pivots to surviving CIPA theories under Sections 631 and 632, or to alternative federal and state statutes.

Key Considerations and Action Items

For businesses, they should reassess the procedural posture of each pending matter, preserve arguments concerning SB 690’s retroactive application, and keep website-tracking compliance on the active governance agenda rather than a one-time fix. Regular audits of website technologies, consent and disclosure practices, vendor contracts, data flows, and document oversight remain essential. SB 690 removes one private enforcement route, but it does not necessarily condone the underlying conduct. Website-tracking litigation under CIPA will continue, the next round will simply be fought on a different front.

If you have questions about website tracking technology considerations or any other privacy-related matters, please contact the authors or anyone on our Tracking Technology Litigation & Counseling team.

philipp-katzenberger-iIJrUoeRoCQ-unsplash (1)
Listen to this post

If you weren’t quite sure about the EU Cyber Resilience Act, this is what it does:

The Cyber Resilience Act (CRA) Regulation establishes mandatory cybersecurity requirements for “products with digital elements” (PDEs) that are placed on the EU market, in the course of commercial activity, whether in return for payment or free of charge. The stated objectives are: 1) ensuring that manufacturers improve the security of PDEs; 2) a coherent cybersecurity framework for hardware and software producers; 3) enhancing transparency; and 4) enabling businesses and consumers to use products with digital elements securely.

What are PDEs?

PDEs are software or hardware products and their remote data processing solutions, including software or hardware components being placed on the market separately. Remote data processing  is processing at a distance for which the software is designed and developed by the manufacturer, or under the responsibility of the manufacturer, and the absence of which would prevent the PDE from performing one of its functions.

The scope is intended to cover products that have the ability to exchange digital information (not just respond or activate in response to a signal) and therefore may put it at risk. Further, software downloaded and installed or supplied to the user and that executes on the user’s system (e.g., a browser extension or mobile app downloaded from an app store) is in scope. Hardware and software provided by the same manufacturer in order for a product to function (e.g., drivers or interface apps), are together a PDE, even if supplied separately. But software that executes remotely and is only accessed by the user, is not necessarily a PDE (e.g., websites, unless they support the functionality of a PDE through remote processing).

From last Friday,  manufacturers of PDEs must report actively exploited vulnerabilities and severe security incidents using ENISA’s Single Reporting Platform. This is effectively first CRA deadline for manufacturers. The essential cybersecurity requirements — the ones most compliance programs are built around — don’t arrive until December 11, 2027, so we will not bore you with those here.

Continue Reading The EU Cyber Resilience Act’s Reporting Started last Friday, September 11. Here’s a Very, Very Brief Primer
tina-chelidze-DX2Fydl0W8E-unsplash
Listen to this post

California lawmakers have sent Senate Bill 690 to Governor Gavin Newsom, teeing up a narrowing of website-tracking litigation under the California Invasion of Privacy Act (CIPA), who has until September 30 to sign or veto the legislation. If signed, the bill would eliminate private lawsuits asserting website-based “pen register” and “trap and trace” claims under Section 638.51 of CIPA. For businesses that have received demand letters or are defending lawsuits premised on routine website technologies—such as cookies, pixels, analytics tools, or similar tracking technology—the bill would offer relief from certain types of claims asserted under CIPA. Additionally, the bill would apply retroactively to pending claims in actions commenced within two years before its operative date, which is expected to be January 1, 2027, if the bill becomes law. 

The Impetus

The legislation responds to a surge of CIPA claims built on a statute originally designed for telephone-era wiretapping, not modern website traffic. Because CIPA carries statutory damages that can reach at least $5,000 per violation without proof of actual harm, even ordinary commercial web practices have created substantial litigation leverage for plaintiffs to demand large sums from website owners. SB 690 targets that specific theory by removing the private right of action for Section 638.51 claims.

Continue Reading California SB690 – A Bill That Significantly Narrows Website Tracking Claims – Sent to Governor’s Desk
glenn-carstens-peters-npxXWgQ33ZQ-unsplash (1)
Listen to this post

The California Court of Appeal, Second Appellate District, has issued its tentative ruling in Variety Media, LLC v. Superior Court, the closely watched writ proceeding that asks whether the pen register provisions of the California Invasion of Privacy Act (“CIPA”) apply to common website tracking technologies. The tentative decision would grant Variety’s petition in part and direct the trial court to sustain Variety’s demurrer with leave to amend. The court’s reasoning cuts in both directions. The panel would hold that CIPA’s pen register statute reaches internet communications, rejecting the threshold defense that has anchored many motions to dismiss. But it would also hold that a pen register captures only metadata identifying the destination of an outgoing communication, and that a website visitor’s IP address identifies the source of a communication rather than its destination. Under that construction, the complaint before the court fails to state a claim.

Background

Penal Code section 638.51 prohibits installing or using a pen register without a court order or the user’s consent. Over the past three years, plaintiffs and pro se litigants have filed hundreds (if not thousands) of lawsuits, arbitration demands, and pre-suit letters alleging that cookies, pixels, analytics tools, and similar technologies are unlawful pen registers because they collect visitors’ IP addresses and device information. Trial courts have divided on whether the statute, enacted with telephone surveillance in mind, reaches these tools at all. No California appellate court has answered the question in a published decision.

Continue Reading California Court of Appeal Tentatively Holds That Collecting a Website Visitor’s IP Address Alone Does Not Constitute Pen Register Activity Under CIPA
Listen to this post

On August 11, 2026, the Colorado Department of Law released a single set of proposed rules  substantially building out two 2026 statutes: the Automated Decision-Making Technology Act (“ADMT Act”) and the Conversational Artificial Intelligence Service Operator Requirements (the “Chatbot Safety Act”). Both laws take effect January 1, 2027, and the proposed rules would become effective the same day. The Rules are not yet final – for covered organizations and interested parties the weeks until September 4 are the time to submit comments to be considered for a redraft – and there is a specific ask to help shape the definition of covered ADMT.

The Automated Decision-Making Technology & Conversational Artificial Intelligence Services Rules (“Rules”) clarify open terms and add operational obligations, and they signal that Colorado’s revised AI framework may demand significantly more compliance infrastructure than the statutes alone suggest.

Continue Reading Colorado Releases Proposed Rules for Its AI and Chatbot Safety Laws: These Create More Operational Work than the Statutes Suggest
erwi-I2FbhiFGl7Y-unsplash
Listen to this post

Senior United States District Judge William H. Orrick, sitting in the Northern District of California, denied a motion to dismiss last week in an Automated License Plate Recognition (“ALPR”) matter, McGinty v. Reimagined Parking LLC, d/b/a Imperial Parking.[1] Judge Orrick held that the plaintiff plausibly alleged actionable harm based on his “right to know” about the use of ALPR systems in two garages. The order follows Bartholomew v. Parking Concepts, Inc.[2] and the guidance of Mata v. Digital Recognition Network, Inc.,[3] concluding that the California Supreme Court would likely recognize violation of a consumer’s “right to know” as actionable harm under California’s ALPR law if presented with the question.

The decision is significant because it marks the first time a federal judge adopted the state-court trajectory created in Bartholomew and Mata. Bartholomew treated the alleged failure to make required ALPR disclosures in an ALPR Privacy Policy as an actionable injury to a consumer’s right to know under the law. Though Mata did not deal with the failure to present an ALPR Privacy Policy, the decision in Mata did offer further guidance on how courts should analyze asserted ALPR harms.

Continue Reading Federal Court Follows Bartholomew Reasoning in Denying Motion to Dismiss ALPR Lawsuit
Listen to this post

Seyfarth Synopsis: On Thursday 30 July, the European Commission issued a press release advising that EU AI Act enforcement begins this SUNDAY, 2 August 2026, when the Act’s transparency rules start to apply. Chatbots and other interactive AI systems need to be ready to identify themselves. Deepfakes and AI generated content needs to be labelled. There are limited exceptions.

The EU AI Act’s Article 50 transparency obligations apply broadly, with the stated goal of reducing the risks of impersonation, deception, misinformation and manipulation at scale and fraud and mitigating the potential detrimental effects of AI generated or manipulated content and interactions. Organizations (and in some cases, individuals) using chatbots, generative AI, deepfake functionality, emotion recognition, biometric categorization, or AI-generated public-interest content should assess whether disclosures, labeling, or content-marking requirements apply without delay. The principal exception is a short implementation period for the Article 50(2) machine-readable marking requirement. Under the EU’s Digital Omnibus reforms, providers of certain generative AI systems already placed on the EU market before August 2, 2026 have until December 2, 2026 to implement those marking measures, while the remaining Article 50 transparency obligations continue to take effect on August 2, 2026. Noncompliance carries fines of up to €15 million or 3% of total worldwide turnover.

Continue Reading European Commission Press Release: EU AI Act Transparency Enforcement Starts This Sunday! Do You Know Who Your Chatbots Are? We Break Down the Commission’s Guidelines on Transparency Below
karlis-reimanis-vbtU0qOiej4-unsplash
Listen to this post

On July 20, 2026, the California Court of Appeal, Fourth Appellate District issued a notable decision in Mata v. Digital Recognition Network, Inc.,[1] which addresses the standing requirements for private claims under California’s Automated License Plate Recognition (“ALPR”) law. At the heart of the decision lies the question whether a violation of the ALPR statute with no articulated resulting harm other than the subjective belief that the plaintiff’s privacy has been invaded confers standing to sue under the ALPR law.  The California Court of Appeal said no.

The Allegations

Mata alleges that Digital Recognition Network (“DRN”) collected and stored license plate images and related date, time, and location information from vehicles in public places. However, it was undisputed by the parties that DRN actually had a ALPR privacy policy in place and made the policy publicly available. Rather, Mata alleged that DRN’s implemented privacy policy was done “to maintain the appearance of adhering” to the law and that DRN “does not really mean what it says in the policy.” It was further undisputed that Mata’s ALPR data was never accessed without authorization, was only ever accessed by his own attorneys in connection with the litigation, and he suffered no physical or monetary harm.  Instead, Mata’s alleged harm theory was what he called a “collection-based invasion of privacy” harm – namely, the harm he suffered arose from the very collection of ALPR data that the ALPR law specifically permits.

The Court’s Conclusion: Actual Harm is Required

Looking to the statutory text and the legislative history of the ALPR law, the Court held that Mata’s alleged harm was not enough to confer standing. In so doing, it agreed with Bartholomew v. Parking Concepts, Inc.,[2] where the Fifth Appellate Division of the California Court of Appeal “rejected the plaintiff’s argument ‘that harm results from any violation of the ALPR law’ and held that standing ‘require[s] harm beyond a mere statutory violation.” Conversely, in dicta it indicated skepticism towards Bartholomew’s holding that the absence of a publicly displayed ALPR policy was sufficient to confer standing under a “right to know” theory of harm at the pleading stage. Significantly, however, the Mata court did not reach that question as one of the key differentiators between the matters was that DRN undisputedly implemented and displayed its ALPR policy, while the defendant in Bartholomew allegedly did not have one posted at all.

Take Aways & Action Items

For companies that operate or use ALPR systems, Mata is a helpful standing decision, but not a catch-all or safe harbor. The ruling solidifies that being able to demonstrate an implemented ALPR privacy policy that is adequately publicly displayed will make it more difficult for plaintiffs to pursue claims under the law. Under Mata, plaintiffs will be forced to allege policy or procedural deficiencies connected to the ALPR law’s requirements. Plaintiffs will also need to demonstrate actual harm resulting from those violations, such as unauthorized access, improper use, inadequate security, over-retention, or other tangible consequences flowing from alleged noncompliance.

Companies using or receiving ALPR information in California should continue to treat ALPR compliance as a priority. Recommended steps include confirming whether the organization is an ALPR operator or end-user; maintaining a current, publicly available ALPR usage and privacy policy; reviewing vendor and customer agreements for appropriate limits on collection, access, use, sharing, retention, security, audit rights, and deletion; and documenting operational compliance through training, access controls, retention schedules, and incident response procedures. These facts may be central to defending future claims following the decisions in Mata and Bartholomew.

[1] Mata v. Digital Recognition Network, 2026 WL 2085579 (July 20, 2026)

[2] Bartholomew v. Parking Concepts, Inc., 118 Cal.App.5th 438 (Feb. 5, 2026)

Listen to this post

The handbrake has been pulled on aspects of the EU’s AI Act (Act), with key workplace rules, particularly those on high-risk systems, pushed back from August 2, 2026, to December 2, 2027. 

The delay may feel welcome for multinational employers keeping up with the spread of AI adoption across their organization, but it is an opportunity to get the groundwork done. 

The European Commission in late May published draft guidelines on the classification of high-risk AI systems (Guidelines, https://bit.ly/4vDtgOV) for the Act. This is the clearest indication yet of how EU workplace AI tools will be treated, using many real examples.

 To function efficiently across borders, business must incorporate these rules into their global compliance framework for legal, HR, talent acquisition, procurement, IT, data, compliance and operations. 

The extra months are useful runway, because HR, recruitment, performance management and workforce allocation tools will require the full gamut of “high-risk” systems compliance. Global employers need time to work this into a matrix of other global rules — including in multiple US jurisdictions (e.g., California, Colorado, Connecticut, New York), Canada, Korea’s Basic AI Act, the updated UK GDPR and emerging rules elsewhere. 

Below is a pragmatic look at what use cases trigger the Act, and what global employers need to do from governance, procurement, data protection and employee relations perspectives. 

Continue Reading Workplace AI — How Employers Should Prepare for the New EU AI Act Deadline