Keypoint: Two California state court decisions have addressed motions to dismiss claims under the novel “pen registry” and “tap and trace” theories, but reached different outcomes after finding different policy considerations more important.

In July 2023, a Southern District of California District Court denied a motion to dismiss in Greenley v. Kochava, 2023 WL 4833466 (S.D. Cal. July 27, 2023), in which the plaintiff argued a SDK developer violated California laws that prohibited use of a “pen registry” and “tap and trace” device by building into the SDK code that forwarded location information to the SDK developer.

Keypoint: Maryland’s bill diverges from other Washington Privacy Act variants passed to date with unique data minimization, sensitive data, minor’s data privacy, and unlawful discrimination provisions (among others).

On April 6, 2024, the Maryland legislature passed the Maryland Online Data Privacy Act of 2024 (MODPA) (SB 541). A companion House bill (HB 567) also appears likely to pass before the legislature closes on April 8. Subject to the procedural formalities in the legislature, the bills will next head to Maryland Governor Wes Moore for consideration.

Assuming MODPA becomes law, Maryland will become the sixteenth state to pass broad consumer data privacy legislation. However, Maryland will be the first state to pass a Washington Privacy Act variant that contains unique provisions regarding data minimization, sensitive data, minor’s data privacy, and unlawful discrimination – among other provisions. In doing so, Maryland injects a new wrinkle into the state privacy law debate much like Washington did with last year’s My Health My Data Act. MODPA also contains a low threshold for applicability such that even smaller companies may need to comply with its provisions.

The below article analyzes MODPA’s contours, including some of its more notable provisions and deviations. We also have added MODPA to our chart providing a detailed comparison of the laws enacted to date. It should be noted that – as of the date of this article – the bills available on the legislature’s website have not yet been updated to reflect the final amendments although we have included those amendments in our analysis.

The Maryland legislature also passed Age-Appropriate Design Code Act companion bills (SB 571 / HB 603). We will provide a separate article analyzing those bills.

Keypoint: Last week, the Maryland legislature passed consumer data privacy and Age-Appropriate Design Code Act bills, the Kentucky Governor signed HB 15 into law, three bills advanced out of a California Assembly Committee, and there was movement with bills in Minnesota, Vermont, Louisiana, Illinois and Colorado.

Below is the eleventh weekly update on the status of proposed state privacy legislation in 2024.

Keypoint: Multiple decisions from the same judicial district come down differently on wiretapping claims while three courts in different states each reject VPPA-defendants’ arguments that the plaintiffs lacked Article III standing.

Welcome to the twelfth installment in our monthly data privacy litigation report. Not only does this month’s post mean we have been doing this for over a year now (and actually a little longer as there was at least one post that combined two months of updates into one post because, well, holidays), but more importantly we are releasing this post on the eve of heading to Washington, D.C. to attend the IAPP Summit. If you will be there, make sure to come and meet us!

We prepare these reports to provide updates on how courts in the United States have handled emerging data privacy trends. In this month’s post, we look at three decisions from the Southern District of California, each of which addressed nearly identical factual allegations and legal arguments but reached different conclusions. We also take a look at three VPPA decisions denying motions to dismiss regarding claims premised on the Meta Pixel that highlight how district courts are addressing Article III standing objections and the required specificity of a plaintiff’s allegations at the pleading stage.

If you are a Byte Back+ member, you will also see our coverage on recent lawsuits beyond the wiretapping and VPPA claims, including the recent trend of cases brought under pen registry laws and efforts against plaintiffs who have brought wiretapping claims in private arbitration rather than the public courts. Interested in learning more about Byte Back+? Click here.

There are many courts currently handling data privacy cases across the nation. Although illustrative, this update is not intended to be exhaustive. If there is another area of data privacy litigation about which you would like to know more, please reach out. The contents provided below are time-sensitive and subject to change. If you are not already subscribed to our blog, consider doing so to stay updated. If you are interested in tracking developments between blog posts, consider following us on LinkedIn.

Keypoint: Colorado policymakers outlined their privacy and AI priorities at a recent Husch Blackwell event.

In early March, Husch Blackwell hosted a discussion panel covering the 2024 legislative priorities of Colorado policymakers related to privacy and artificial intelligence. Attendees heard from Director of Legislative Affairs and Colorado Assistant Attorney General Jefferey Riester, as well as Colorado State Senate Majority Leader Robert Rodriguez. Discussions centered around their legislative priorities related to privacy and artificial intelligence, including the Colorado Privacy Act, SB 41 (children’s privacy), HB 1058 (biological data), and other impending bills on artificial intelligence.

The below article provides a summary of their remarks.

Keypoint: Kentucky is the fifteenth state to pass consumer data privacy legislation with a bill that largely tracks the Virginia Consumer Data Protection Act.

On March 27, 2024, the Kentucky legislature passed the Kentucky Consumer Data Protection Act (HB 15). The bill unanimously passed the House on February 20. The Senate passed the bill on March 11, but with two minor floor amendments. On March 27, the House unanimously concurred in the Senate floor amendments. The bill now heads to Kentucky Governor Andy Beshear. Assuming the bill becomes law, Kentucky will become the fifteenth state to enact consumer data privacy legislation.

The Kentucky bill largely tracks the Virginia Consumer Data Protection Act (VCDPA) but without this year’s VCDPA amendments relating to children’s data. For entities already complying with other non-California privacy laws, the Kentucky bill will not require any additional compliance burdens. The bill does contain small variations from the VCDPA, which we discuss below.

As with prior bills, we have added the Kentucky bill to our chart providing a detailed comparison of laws enacted to date.

Keypoint: Since our last update on US artificial intelligence (AI) legislation impacting the private sector, Utah enacted the first AI private sector bill of 2024, Oklahoma moved closer to passing an AI Bill of Rights, Connecticut’s bill advanced through a committee, and California lawmakers introduced two bills that would establish transparency requirements around generative AI and personal information used to train AI models.

Below is our third update on the status of pending US artificial intelligence (AI) legislation that would affect the private sector.