Privacy Legislation

Subscribe to Privacy Legislation via RSS
fatos-bytyqi-Agx5_TLsIf4-unsplash (1)

California has enacted three new laws governing employer use of artificial intelligence and automated tools in layoffs, workplace monitoring, discipline, and termination. These laws are separate from the California Consumer Privacy Act’s automated decisionmaking technology (ADMT) rules and apply more broadly to employers and public entities that are not covered by the CCPA. CCPA covered employers may need to integrate compliance with ADMT and Risk Assessment requirements (for sensitive personal information processing activities and automated decisionmaking technology).

Updates to Cal/WARN and workplace-surveillance requirements take effect January 1, 2027. The rules for automated discipline and termination decisions take effect July 1, 2027. Employers should use the remainder of 2026 to identify covered systems, assign responsibility, and update their processes and notices.

1. Cal/WARN Notices for AI-Related Job Displacement

Effective January 1, 2027, SB 951 adds disclosure requirements to the California Worker Adjustment and Retraining Notification Act (Cal/WARN). Cal/WARN generally requires 60 days’ advance notice of a covered mass layoff, relocation, or termination at a covered establishment. Violations may result in civil penalties of up to $500 per day, in addition to other remedies. If AI or automation causes all or a substantial part of a covered event by replacing or automating positions, the employer must add specified information to the notices to affected employees and the Employment Development Department (EDD).

Continue Reading California Just Expanded Regulation of Workplace AI Beyond CCPA ADMT

California has shut down one increasingly popular theory of website-tracking liability. With Governor Gavin Newsom’s signature, SB 690 amends the California Invasion of Privacy Act (“CIPA”) and eliminates the private right of action under Section 638.51 for pen-register and trap-and-trace claims involving websites, online applications, and mobile applications. Enforcement of Section 638.51 will now rest…

philipp-katzenberger-iIJrUoeRoCQ-unsplash (1)

If you weren’t quite sure about the EU Cyber Resilience Act, this is what it does:

The Cyber Resilience Act (CRA) Regulation establishes mandatory cybersecurity requirements for “products with digital elements” (PDEs) that are placed on the EU market, in the course of commercial activity, whether in return for payment or free of charge. The stated objectives are: 1) ensuring that manufacturers improve the security of PDEs; 2) a coherent cybersecurity framework for hardware and software producers; 3) enhancing transparency; and 4) enabling businesses and consumers to use products with digital elements securely.

What are PDEs?

PDEs are software or hardware products and their remote data processing solutions, including software or hardware components being placed on the market separately. Remote data processing  is processing at a distance for which the software is designed and developed by the manufacturer, or under the responsibility of the manufacturer, and the absence of which would prevent the PDE from performing one of its functions.

The scope is intended to cover products that have the ability to exchange digital information (not just respond or activate in response to a signal) and therefore may put it at risk. Further, software downloaded and installed or supplied to the user and that executes on the user’s system (e.g., a browser extension or mobile app downloaded from an app store) is in scope. Hardware and software provided by the same manufacturer in order for a product to function (e.g., drivers or interface apps), are together a PDE, even if supplied separately. But software that executes remotely and is only accessed by the user, is not necessarily a PDE (e.g., websites, unless they support the functionality of a PDE through remote processing).

From last Friday,  manufacturers of PDEs must report actively exploited vulnerabilities and severe security incidents using ENISA’s Single Reporting Platform. This is effectively first CRA deadline for manufacturers. The essential cybersecurity requirements — the ones most compliance programs are built around — don’t arrive until December 11, 2027, so we will not bore you with those here.

Continue Reading The EU Cyber Resilience Act’s Reporting Started last Friday, September 11. Here’s a Very, Very Brief Primer
tina-chelidze-DX2Fydl0W8E-unsplash

California lawmakers have sent Senate Bill 690 to Governor Gavin Newsom, teeing up a narrowing of website-tracking litigation under the California Invasion of Privacy Act (CIPA), who has until September 30 to sign or veto the legislation. If signed, the bill would eliminate private lawsuits asserting website-based “pen register” and “trap and trace” claims under Section 638.51 of CIPA. For businesses that have received demand letters or are defending lawsuits premised on routine website technologies—such as cookies, pixels, analytics tools, or similar tracking technology—the bill would offer relief from certain types of claims asserted under CIPA. Additionally, the bill would apply retroactively to pending claims in actions commenced within two years before its operative date, which is expected to be January 1, 2027, if the bill becomes law. 

The Impetus

The legislation responds to a surge of CIPA claims built on a statute originally designed for telephone-era wiretapping, not modern website traffic. Because CIPA carries statutory damages that can reach at least $5,000 per violation without proof of actual harm, even ordinary commercial web practices have created substantial litigation leverage for plaintiffs to demand large sums from website owners. SB 690 targets that specific theory by removing the private right of action for Section 638.51 claims.

Continue Reading California SB690 – A Bill That Significantly Narrows Website Tracking Claims – Sent to Governor’s Desk
karlis-reimanis-vbtU0qOiej4-unsplash

On July 20, 2026, the California Court of Appeal, Fourth Appellate District issued a notable decision in Mata v. Digital Recognition Network, Inc.,[1] which addresses the standing requirements for private claims under California’s Automated License Plate Recognition (“ALPR”) law. At the heart of the decision lies the question whether a violation of the…

When Colorado enacted the first comprehensive state AI law in 2024, it imported the conceptual architecture of the EU AI Act: a risk-based regime built on duties of care, risk management programs, and impact assessments. Two years later, and within a matter of weeks, the state has dismantled that legislation. On May 14, 2026, Governor Jared Polis signed Senate Bill 26-189, which repeals SB 24-205 and replaces it with a disclosure-and-rights framework focused on automated decision-making technology (“ADMT”). The new framework takes effect January 1, 2027.

The substance of the rewrite has been well-covered already. Less examined is how Colorado got here, and what the speed and direction of the pivot signal for the rest of the state AI regulatory landscape. The new bill was introduced and signed within two weeks of its introduction. The Governor’s AI Policy Working Group did the heavy lift in advance: roughly six months of stakeholder consultation produced the draft framework released on March 17, 2026. But the final two-week sprint reflects pressure to land the rewrite before the original AI Act’s June 30, 2026 effective date and amid escalating federal headwinds.

Continue Reading Colorado’s AI Reset: Two Weeks, a White House Callout, and a Pivot Away from the EU Model
thomas-lefebvre-gp8BLyaTaA0-unsplash

On July 24, 2025, the California Privacy Protection Agency (“CPPA”) unanimously voted to adopt a package of Proposed Regulations for the California Consumer Privacy Act (“CCPA”), marking a significant development in California privacy law. These cover Automated Decision-making Technology (“ADMT”), mandatory Cybersecurity Audits, Risk Assessments, and clarifications for the CCPA’s applicability to Insurance Companies. The package will move into its final review stage before formal enactment, once filed with the California Office of Administrative Law.

CCPA Steering Toward Operational Compliance

This is a clear signal that privacy compliance expectations in California are trending toward a more operational phase. The new rules are designed to give Californians greater control over how their personal information is used while pushing businesses toward higher levels of transparency and accountability, especially when automated decision-making and high-risk data processing is involved. For companies, this is more than just a theoretical update – it’s a clarion call to ensure these requirements are built into day-to-day governance, technology and process design, and vendor management practices.

Continue Reading California Privacy Protection Agency (CPPA) Finally Voted to Adopt Much Debated Update to CCPA Regulations: What Your Business Should Know

The UK’s Data (Use and Access) Act received Royal Assent last Thursday, June 19th, bringing into law some significant changes to the country’s post Brexit data protection framework, among an array of other, related rules (on matters ranging from financial conduct to smart meters and “underground assets,” which is more to do with…

joel-durkee-5HdF3ugOSxM-unsplash

On June 3, 2025, the California Senate unanimously passed Senate Bill 690 (SB 690), a bill that seeks to add a “commercial business purposes” exception to the California Invasion of Privacy Act (CIPA).

After multiple readings on the Senate floor, SB 690 passed as amended, and will now proceed to the California State Assembly. SB…

fatos-bytyqi-Agx5_TLsIf4-unsplash

California Senate Bill 690 (SB 690), introduced by Senator Anna Caballero, is continuing to proceed through the California state legislative process. The proposed bill would amend the California Invasion of Privacy Act (CIPA) by adding an exception to the statute which has the effect of permitting use of tracking technologies for “commercial business purposes.” CIPA…