Keypoint: Last week, the Utah legislature passed two bills prior to closing while Georgia’s Senate passed a consumer data privacy bill and the Arizona House passed a social media bill.
Below is the ninth weekly update on the status of proposed state privacy legislation in 2025. As always, the contents provided below are time-sensitive and subject to change.
Keypoint: Last week, consumer data privacy amendment bills crossed chambers in Montana and Kentucky, a social media bill crossed chambers in Colorado, and there were movements with numerous other bills.
Below is the eighth weekly update on the status of proposed state privacy legislation in 2025. As always, the contents provided below are time-sensitive and subject to change.
Keypoint: New York has amended its data breach notification law twice in the last 60 days to (1) add a 30-day deadline for notifying affected residents, (2) clarify that covered financial entities must still notify the New York Department of Financial Services (NYDFS) in accordance with existing NYDFS cybersecurity regulations, and (3) expand the prior definition of “private information” to include medical and health insurance information.
In the last sixty days, the New York legislature twice amended its data breach notification law. In the below article, we discuss the amendments and takeaways for covered businesses.
Keypoint: Last week, the Virginia legislature passed a VCDPA amendment, kid’s privacy bills crossed chambers in South Carolina and Utah, and lawmakers continued to introduce new bills on various topics.
Below is the seventh weekly update on the status of proposed state privacy legislation in 2025. As always, the contents provided below are time-sensitive and subject to change.
Keypoint: Virginia becomes the second legislature – after Colorado – to pass an algorithmic discrimination bill – although the bill still needs to get through the state’s Republican governor to become law.
On February 20, Virginia’s Democrat-controlled legislature passed the Virginia High-Risk Artificial Intelligence Developer and Deployer Act (HB 2094). The bill next
Keypoint: Five Takeaways from Privacy Litigation Decisions in January 2025
Welcome to the twentieth installment in our monthly data privacy litigation report. We prepare these reports to provide updates on how courts in the United States have handled emerging data privacy trends. After our expansive “holiday edition” post last month we are changing things up a bit with this month’s post. Instead of providing case summaries on multiple decisions we are providing five takeaways from cases in the past month. Our hope is this provides a more practical post for in-house counsel and business owners facing the quickly changing world of privacy litigation.
Do you find these posts helpful? Wish we would cover another privacy trend or provide more information? If so – we want to hear from you! Please reach out and let us know what you would like to see in future privacy litigation updates.
There are many courts currently handling data privacy cases across the nation. Although illustrative, this update is not intended to be exhaustive. If there is another area of data privacy litigation about which you would like to know more, please reach out. The contents provided below are time-sensitive and subject to change. If you are not already subscribed to our blog, consider doing so to stay updated. If you are interested in tracking developments between blog posts, consider following us on LinkedIn.
Keypoint: Last week saw a flurry of activity across numerous states, including bills advancing in Virginia, Oklahoma, Washington, Utah, and South Carolina, while lawmakers continued to introduce bills across the country.
Below is the sixth weekly update on the status of proposed state privacy legislation in 2025. As always, the contents provided below are time-sensitive and subject to change.
Keypoint: Almost one year after the law went into effect, the first My Health My Data class action lawsuit was filed in Washington.
On February 10, 2025, a class action lawsuit was filed against an online retailer under the Washington My Health My Data (MHMD) Act’s private right of action. The complaint also alleges violations of federal wiretapping and computerized communications laws. MHMD went into effect on March 31, 2024. Despite initial speculation that the law would lead to significant civil litigation, no lawsuits were filed under it until now.
In this post, we provide a brief summary of the complaint, including the factual allegations, causes of action, and damages sought.
Keypoint: It was a very active week with movement on numerous bills, in particular in Virginia, as well as new bills introduced across the country.
Below is the fifth weekly update on the status of proposed state privacy legislation in 2025. As always, the contents provided below are time-sensitive and subject to change.
Keypoint: It was another busy week with Virginia lawmakers advancing three bills and new consumer and children’s privacy bills introduced in multiple states.
Below is the fourth weekly update on the status of proposed state privacy legislation in 2025. As always, the contents provided below are time-sensitive and subject to change.