Key point: Colorado and Connecticut recently enacted laws regulating employers’ use of AI and automated decision-making tools in employment decisions—with notice obligations, anti-discrimination requirements, and civil penalties that will require employers operating in these states to reassess their AI-driven HR practices now. Meanwhile, Illinois paused its rulemaking efforts on the circumstances under which notice of the use of AI is required.
Key point: In response to the increasing number of state data privacy laws and to address a wave of claims under state wiretap laws, most businesses have spent the last several years posting online privacy notices, consent banners, marketing preference centers, and opt-out mechanisms. But the challenge today is no longer providing consumers with a way to exercise privacy rights. The challenge is to ensure those rights actually work.
Key Point: Several states have enacted their own ‘mini-TCPA’ laws—state-level variants of the federal Telephone Consumer Protection Act (TCPA) that impose additional restrictions on telemarketing—and the past year has brought notable enforcement and legislative developments at both the federal and state levels.
Key point: CISA’s virtual town hall meetings for CIRCIA rulemaking have been rescheduled for June 15-18, 2026.
On May 26, 2026, CISA announced the dates for the rescheduled CIRCIA rulemaking town hall meetings between June 15-18, 2026. The agency’s use of town halls is discretionary and is not mandated within the federal rulemaking process. CISA canceled the original events because of the DHS funding impasse, and the new meetings will be held virtually as described in the table below.
Key point: Whether your business runs a retail loyalty program, a restaurant rewards app, a software referral campaign, or an online sweepstakes, these programs often collect customer information, and that can trigger real privacy compliance obligations that are easy to overlook.
The Rules Vary by Program. Privacy Obligations Do Not.
Online promotional activities frequently involve the collection, use, and sharing of consumer personal information, and data privacy laws play an important role across all of them. Examples:
All these instances trigger compliance obligations—even if the activities feel informal or low-risk.
Key point: 2026 may be a pivotal year for organizations to monitor cyber incident reporting requirements—the voluntary sharing allowed under CISA 2015 remains available, but only through September, and regulations delineating who and how mandatory reporting requirements are managed under CIRCIA are coming.
In October 2023, California passed the Delete Act, which, in addition to requiring data brokers to register with the state, directed Cal Privacy (f/k/a the California Privacy Protection Agency or CPPA) to create a data deletion software tool by January 1, 2026. This deletion software tool, now called the Delete Request and Opt-Out Platform (DROP), allows California residents to submit a single request to require all registered data brokers to 1) delete their personal information, and 2) stop selling or sharing that information through one verified, government‑administered process, rather than contacting hundreds of companies individually.
Key point: The President’s latest Executive Order establishes the Genesis Mission and aspires to use AI to accelerate scientific discovery in sectors such as biotech, quantum, nuclear power, and semiconductors.