The Hintze Law team continues to monitor global privacy and data security developments to provide timely, practical insights for clients. Below is a summary of key updates from August and September 2026.
For developments in AI, please see our latest Global AI Updates.
If you’d like to receive email alerts for our blog posts, visit our blog page to sign up.
US Privacy Updates
CalPrivacy Brings First Action Against Data Broker Under CCPA and Delete Act
CalPrivacy announced its first action against a data broker under both the CCPA and Delete act.
The California Privacy Protection Agency (CPPA) has issued its first enforcement decision under both the California Consumer Privacy Act (CCPA) and the Delete Act. The decision requires LocateSmarter LLC, an Iowa-based data broker, to pay $116,490 for failing to register as a data broker and for requiring California residents to provide a partial Social Security number before exercising their opt-out rights.
This marks the first enforcement action taken against a data broker under the CCPA. According to the decision, LocateSmarter collected personal information outside of a direct relationship and sold it to third parties thereby meeting the definition of a data broker. However, it failed to register with the CCPA by the January 31, 2026, deadline. The company also required consumers to disclose the last four digits of their Social Security numbers and their full name and mailing address in order to submit opt-out requests.
CalPrivacy Fines VA-Based Data Broker in DELETE Act Enforcement Action
On September 1, 2026, CalPrivacy announced a fine of $36.4K for SalesIntel Research, Inc. a Virginia-based data broker, based on failure to timely register under the DELETE Act. Like the recent Cybba decision, the order is limited to SalesIntel's failure to register by January 31, 2025, for data broker activities in 2024 (SalesIntel timely registered for its 2025 activities). Also, like Cybba and other recent data broker enforcement actions, CalPrivacy quotes heavily from the defendant's own website and client testimonies to establish it as a data broker (e.g., citing product copy that SalesIntel can provide "[e]very contact['s]... verified email, mobile direct dial, title, seniority, and full org chart context", including California residents).
In addition to the statutory fine for late registration, the order also requires Cybba to comply with other provisions of the DELETE Act, such as disclosing the required metrics related to CCPA requests in its privacy policy.
CalPrivacy Shares DROP Results So Far
On August 25, 2026, CalPrivacy announced that over 500,000 California residents have successfully registered for DROP. While the press release is focused on encouraging even more consumers to register, it also includes some interesting stats on DROP results to date:
"654 data brokers are now part of the system, and since the August 1, 2026 deadline for brokers to begin processing requests, approximately 25% have already reported that they processed deletion requests.
99.9% of consumers have already had their profile deleted by at least one broker, and the typical California DROP user has already had their information removed by over 40 brokers."
CCPA Amendment SB 923 Passed into Law
On September 27, 2026, California's passed into law SB 923. SB 923 amends CCPA's right to delete and is sponsored by CalPrivacy. For an official redline of how the bill amends CCPA, see here. Specifically, SB 923 makes the following changes, effective January 1, 2027:
Creates a third-party data deletion safe harbor aligned with several other states, which clarifies what complying with a deletion request looks like for data collected from a source other than the consumer.
Clarifies legislative intent about the scope of a consumer's right to delete.
CCPA Amendment Regarding Sensitive Data Vetoed By Governor
On September 27, 2026, California's governor vetoed AB 1542. If passed, AB 1542 would have amended CCPA to prohibit businesses, service providers, and contractors from "selling"/"sharing" SPI to third parties. The governor’s letter cites concerns of unintended consequences from removing consumers from the decision process and implementation and enforcement costs not included in the 2026 Budget Act.
California Passes Pixel-Related CIPA Reform
On September 30, 2026, California passed into law SB 690. SB 690 would somewhat restrict the private right of action in California’s wiretap law (“CIPA”), effective January 1, 2027. This amendment would partially limit CIPA’s private right of action, so that alleged violations of CIPA’s pen register/tap-and-trace restrictions arising from conduct “occurring on an internet website, online application, or mobile application” could only be prosecuted by the California AG. This would also negate “any [such private,] pending claim in an action commenced [on or after January 1, 2025].”
California Passes Online Addictive Features Bill
On September 10, 2026, California passed AB 1709, repealing and replacing the Age Appropriate Design Code. The law prohibits “a covered platform, as defined, from providing an addictive feature, as defined, to a user who is under 16 years of age and [requires] a covered platform to implement reasonable measures to ensure that users under 16 years of age are not offered or provided any addictive feature on the covered platform.“Addictive feature” = addictive feed, autoplay, and any features defined by regulation.
“Covered platform” = “an internet website, online service, online application, or mobile application… that offers users or provides users with an addictive feature as a significant part of the service provided by that internet website, online service, online application, or mobile application.” This does not include businesses limited to e-commerce or cloud storage functions
It relies on the California Digital Age Assurance Act for age verification and creates a state advisory commission in the DOJ dedicated to online safety. The law takes effect January 1, 2027, and authorizes the Attorney General to adopt further regulations.
California Legislature Passes Workplace Bathroom Surveillance Law
On September 30, 2026, California passed AB 1331 which restricts employers from monitoring employees in workplace bathrooms and establishes certain employee rights regarding workplace surveillance tools when they enter a bathroom. Similar to the other workplace privacy bills, AB 1883 and SB 947, AB 1331 authorizes enforcement by the Labor Commissioner and public prosecutors and provides for penalties of up to $500 per violation.
California Passes Automated Decision Systems in Employment Contexts Bill
On September 30, 2026, California passed SB 947, which will regulate certain aspects of automated decision systems (“ADS”) in employment contexts.
Key requirements include:
Prohibitions on certain uses of ADS, including preventing compliance with federal, state, or local labor and employment, safety/health, or civil rights laws/regs, inferring protected characteristics and using predictive behavior analysis to make employment-related decisions.
Employers may not rely solely on ADS when making disciplinary or termination decisions. Human review and corroborating evidence are required.
Employees may request a description of the employee’s data used by the ADS in connection with a disciplinary or termination decision.
Employers that primarily rely on ADS for these decisions must provide a prescriptive post-use notice explaining the role of the system and the employee's rights.
The law enters into effect on July 1, 2027, and enforceable by both the Labor Commissioner and public prosecutors.
California Legislature Passes Amendment to California Digital Age Assurance Act
On September 10, 2026, California passed AB 1856, which would amend the California Digital Age Assurance Act ("DAA") already set to take effect on January 1, 2027.
AB 1856 (official redline here) would make some potentially major changes.
Scoping changes: The definitions would be amended to somewhat limit DAA's scope.
Definition of "user" deleted: The term "user" is no longer defined. Previously, it was defined as "a child that is the primary user of the device."
Fewer software components are "applications": The definition of "application" now explicitly provides a software component is only an "application" if it itself is offered to consumers through a covered application store.
This suggests that mods/open source software is not an "application" (see below too).
Open-source systems no longer in scope: The definition of "operating system provider" now explicitly excludes OS providers like Linux and SteamOS.
Substantive requirements changes: This bill would also:
Expand the baseline age-data-sharing requirement for operating systems to include not just covered application stores, but also "developer[s]."
Require covered application stores to facilitate age-data-sharing between users and developers.
Prohibit regulated entities from "prompt[ing] the user to change the user's age information."
Collection data minimization; a person may not "request a signal with respect to a particular user... from [certain regulated entities] if not required to do so by [law]."
Modify the standard of "actual knowledge of the age range of the user" -- e.g., by defining what is "clear and convincing information" about age range.
California Amends Insurance Information and Privacy Protection Act,
On September 27, 2026, California passed SB 354, amending the Insurance Information and Privacy Protection Act.
Entering into effect on July 1, 2028, the law provides standards for the collection, processing, and disclosure of consumers’ personal information by licensees, surplus line insurers, reinsurers, and their third-party service providers. Its requirements include:
Breach notification
Data minimization
Disclosure of data practices regarding consumers’ personal information through a privacy notice, including the categories of personal information that are processed or shared, the categories of sources, and the recipients of data.
Permitting consumers to choose whether to opt in to the sharing of their personal information by licensees, surplus line insurers, or reinsurers for purposes other than insurance transactions in certain circumstances.
Permitting individual consumers to request access to their personal information to verify or dispute the accuracy of the information.
Informing consumers of the reasons for adverse underwriting decisions.
Connecticut AG settles with TaxAct over pixel data sharing
On August 19, 2026, TaxAct agreed to pay a $275,000 fine to Connecticut to settle allegations that it improperly shared sensitive taxpayer data with Meta and Google. TaxAct also has agreed to specific compliance obligations, including creating a review committee and developing internal policies and procedures governing pixel technologies and tracking practices that include a tag monitoring system.
Connecticut AG's office investigated TaxAct's data sharing practices and alleges that it found TaxAct disclosed detailed financial information to Meta and Google for analytics and marketing purposes without appropriate contractual limitations on the ad platforms’ use of the data. The AG alleges that the data sent to Meta and Google included rounded adjusted gross income, rounded tax refunds and/or taxes owed, and certain types of income and deductions, including number of dependents and whether taxpayers made charitable contributions, or had investment income or mortgage or student loan interest.
The AG also alleged that individuals were not provided proper notice of the data sharing and instead promised to safeguard their customer's privacy and prohibit sharing of their data with third parties.
Ohio AG Leads Class Action Lawsuit Against Roblox
On August 10, 2026, the Ohio AG announced that it had filed a motion for lead-plaintiff status in a case on behalf of the Ohio Public Employees Retirement System and the State Teachers Retirement System of Ohio against Roblox.
The motion alleges that the Ohio funds have the "largest financial interest” in the relief sought by the class due to their loss of more than $21.5 million incurred from Roblox Corporation common stock. This loss was allegedly fueled by the alleged misrepresentation of the "platform as a safe space for children while failing to implement basic protections against online predators."
Washington AG Issues Privacy Report
On August 14, 2026, Washington Attorney General Nick Brown released the state’s first-ever AG Data Privacy Report. While the report carries no direct regulatory weight and creates no immediate compliance duties, it establishes the Attorney General's legislative agenda ahead of upcoming sessions.
Key recommendations from the report include:
Strict Data Minimization: Shifting away from standard "notice-and-choice" frameworks toward requiring explicit consumer consent for any data processing beyond what is necessary to deliver a requested service. Collection, usage, and retention limits are modeled after standards in states like California, Colorado, Connecticut, and Oregon.
Prohibition on Dark Patterns: Banning deceptive user interfaces that manipulate choice. Citing California Privacy Protection Agency (CPPA) guidance on choice symmetry, the report targets design patterns that pair prominent "Accept All" prompts with hidden or multi-step opt-out paths.
Closing Statutory Exemptions: Recommending legislative updates to narrow existing privacy exceptions, specifically extending biometric protections to cover photo, video, and audio data, while expanding precise location privacy beyond health and license plate reader applications.
Data Broker Transparency: Supporting statutory mechanisms like HB 2483 to require annual state registration for data brokers, mandatory security safeguards, public disclosures, and centralized deletion and opt-out mechanisms for consumers (e.g., DROP).
FTC Announces That It Will No Longer Bring Claims Based On Disparate-Impact
On August 7, 2026, the Federal Trade Commission announced a policy statement clarifying that the Commission will not pursue claims based on disparate-impact or “unfair discrimination” theories.
The policy statement follows President Donald Trump’s issuance of an executive order last year on “Restoring Equality of Opportunity and Meritocracy” that set forth “the policy of the United States to eliminate the use of disparate-impact liability in all contexts to the maximum degree possible to avoid violating the Constitution, Federal civil rights laws, and basic American ideals.”
FTC Seeks Input on Personalized Pricing
On August 19, 2026, the FTC announced that it is seeking public comment on its enforcement policy statement regarding personalized pricing. The proposed enforcement policy addresses a number of aspects of personalized pricing–prices that are set in part based on personal data–and theories for potential liability under the FTC Act.
The policy statement notes that the FTC intends to conduct aggressive enforcement against personalized pricing practices that violate the FTC Act or other laws enforced by the Commission. The FTC further notes that, where consumers reasonably expect that prices for a product or service will not vary based on their personal data, businesses that engage in personalized pricing should clearly and conspicuously disclose that the price is personalized, the basis for the personalization, and the types of data on which it is based. It indicates that a failure to make these disclosures is likely to constitute an unfair or deceptive act or practice. It also suggests that consent may be required before personal data can be used for personalized pricing.
Wyden Letter to State Attorneys General Regarding the Use of GeoIP to Determine Whether to Honor GPC
On August 3, 2026, US Sen. Ron Wyden urged 10 state Attorneys General and the CPPA to provide clearer guidance on how businesses should honor Global Privacy Control (GPC) signals. In a recent letter, Wyden criticized the use of GeoIP to determine whether to honor a GPC signal, arguing that IP-based geolocation is often inaccurate and, even when accurate, does not determine a consumer's state residency. He also criticized the lack of transparency when businesses disregard GPC signals, noting that users are often only notified when a signal is honored.
Wyden pointed to commitments from several consent management platforms (CMPs), including OneTrust, Ketch, and TrustArc, to implement features such as residency self-certification, location correction tools, and notices when a GPC signal is disregarded. In his view, these developments demonstrate that alternatives to GeoIP-based filtering are commercially feasible. He ultimately called on regulators to issue coordinated guidance clarifying that businesses should honor GPC signals from state residents regardless of physical location, IP address, or VPN use, and to establish a bipartisan multistate AG task force focused on GPC enforcement.
If regulators follow through, the letter could signal a continued move toward more coordinated privacy enforcement, a trend already emerging through multistate privacy enforcement initiatives like the Consortium of Privacy Regulators.
White House Authorizes Vetted Private Companies to Conduct Offensive Cyber Operations Against Foreign Criminal Groups
On August 12, 2026, President Trump signed a National Security Presidential Memorandum directing the National Coordination Center to stand up a program authorizing vetted U.S. companies to conduct surveillance and disruptive cyber operations against foreign cyber-enabled transnational criminal organizations.
Despite the "hack back" framing in press coverage, the memorandum creates no self-help right: participating companies must contract with the Department of Justice or the Department of Homeland Security, obtain written approval for each operation, and may be required to post a bond of at least $1 million, and the Computer Fraud and Abuse Act (CFAA) is unchanged. Operating procedures are due by approximately October 11, 2026.
IAPP US Data Privacy Litigation Report 2026
On August 17, 2026, IAPP has published its US Data Privacy Litigation Report for 2026. The Report covers 8 categories:
Breach of contract and warranties
CIPA
Federal Wiretap Act
VPPA
CCPA's private right of action
Biometrics and consumer health data
Daniel's Law (re public officials' privacy)
Shareholder actions
This report analyzes the significance of private litigation and class-action lawsuits in contesting privacy violations in the U.S., tracking the trends and distilling compliance insights.
State AGs Announce $17.1 Billion Settlement with Meta
On August 26, 2026, Connecticut AG Tong announced a $17.1 billion multistate settlement with Meta Platforms, Inc. Meta must pay $12.19 billion over 10 years, which increases to the full $17.1 billion if TikTok, YouTube and Snapchat agree to comparable safety terms and monetary relief in their own enforcement actions.
In addition to monetary relief, Facebook must also implement the following safety features:
Robust age assurance to determine if a user is U13 or U18
Prohibit teen users' access to Meta's platforms from 12:00 a.m. to 6:00 a.m. by default
A combined 2-hour daily limit by default across Facebook and Instagram for teen users, this daily limit decreases to 1-hour if Snapchat, TikTok, and YouTube adopt comparable terms.
Disable notifications for teen users during school hours
Implement "productive pauses" after 15 minutes of continuous use and again at 60 and 90 minutes"
Providing teen users with the ability to select a "non-personalized feed" as their default home feed within 4 months of the settlement's effective date.
Disabling teen users' ability to see the number of likes and reactions by default
Disabling teen users from applying cosmetic filters to their content
The attorneys general of Alabama, Alaska, American Samoa, Arizona, Arkansas, California, Colorado, Connecticut, Delaware, District of Columbia, Georgia, Hawaii, Idaho, Illinois, Indiana, Iowa, Kansas, Kentucky, Louisiana, Maine, Maryland, Massachusetts, Michigan, Minnesota, Mississippi, Missouri, Montana, Nebraska, Nevada, New Hampshire, New Jersey, New York, North Carolina, North Dakota, Northern Mariana Islands, Ohio, Oklahoma, Oregon, Pennsylvania, Puerto Rico, Rhode Island, South Carolina, South Dakota, Tennessee, Utah, Vermont, Virginia, Washington, West Virginia, Wisconsin, and Wyoming also joined the settlement.
Sixth Circuit Grants Rehearing En Banc Regarding FCC's 2023 Data Breach Order
On July 31, 2026, the Sixth Circuit granted the petition for rehearing en banc regarding Ohio Telecom Ass'n v. FCC. The case is a consolidation of challenges brought by industry groups (Ohio Telecom Association, Texas Association of Business, CTIA, NCTA, and USTelecom) regarding the FCC's 2023 Data Breach Reporting Requirements.
The 2023 data breach requirements were issued by the FCC after an initial 2016 FCC order on privacy and data security requirements was voided by Congress pursuant to the Congressional Review Act (CRA). The previous decision, issued in 2025, upheld the FCC's 2023 data breach reporting requirements, holding that the FCC had the authority to issue the data breach rules under Section 201(b) of the Communications Act. The 2025 decision also held that the 2023 FCC rules were not barred by the rejection of the 2016 FCC order, as the 2023 rules were not "substantially the same" as the 2016 order rejected by Congress.
The granting of the petition for rehearing vacates the previous decision and judgment of the court, the mandate is stayed, and the case is restored to the docket as a pending appeal. Argument is scheduled for October 21, 2026.
Seventh Circuit Dismisses BIPA Claim Against Samsung Related to On-Device Processing Claims
Samsung was sued in a class action lawsuit where the plaintiff’s alleged Samsung’s photo grouping feature violated Illinois Biometric Information Privacy Act (BIPA). The district court had dismissed the claim (for failure to state a claim) and plaintiffs appealed to the Seventh Circuit Court of Appeals. On August 7, 2026, the Seventh Circuit agreed with the lower court and dismissed plaintiffs’ claims.
The decision turned on whether Samsung was “in possession” of the biometric identifiers generated by Samsung's face grouping technology. Samsung’s defense was that the processing occurred on device and therefore they were not “in possession” of and did not “collect, capture, or otherwise obtain” biometric identifiers or information.
“The question before us is whether Plaintiffs have sufficiently alleged that, by preinstalling the Gallery App on its devices and allowing its use, Samsung (1) is “in possession of” Plaintiffs’ biometric data as that phrase appears in BIPA § 15(a) or (2) “collect[ed],” “capture[d],” “or otherwise obtain[ed]” Plaintiffs’ biometric data within the meaning of BIPA § 15(b). 740 Ill. Comp. Stat. 14/15(a), (b).2”
In its analysis, the court reviewed the “ordinary and popular” meanings of these terms and concluded:
“From these Illinois decisions, we too conclude that the words “possession,” “collect,” “capture,” and “obtain,” as they appear in BIPA § 15(a) and (b), all require the subject company to have or have obtained some degree of “control” over the biometric data in question…Although Plaintiffs describe how Samsung provided users with the products (the phones and tablets) and software (the App) to record, create, and save facial bio metric data on the individual devices, they allege nothing from which we can reasonably infer that Samsung itself controlled the data…For their part, Plaintiffs point out that the Gallery App gives users the ability to back up their photos to Samsung’s cloud servers. From this, they argue, one could reasonably infer that the associated facial geometry data (like the photographs themselves) are also backed up to Samsung’s cloud servers. But this is not necessarily so, and Plaintiffs do not provide any plausible support for this theory.”
California Legislature Sends Pixel-Related CIPA Reform Bill to Governor
On September 12, 2026, California’s SB 690 became law without veto, narrowing the private right of action in California’s wiretap law (“CIPA”), effective January 1, 2027. Specifically, this amendment would somewhat restrict the private right of action in California’s wiretap law (“CIPA”), effective January 1, 2027. Specifically, this amendment would:
Partially remove CIPA’s private right of action, so that alleged violations of Cal. Pen. Code sec. 638.51 arising from conduct “occurring on an internet website, online application, or mobile application” could be prosecuted only by the California AG.
Negate “any [such private,] pending claim in an action commenced [on or after January 1, 2025]”
SB 690 is a direct response to the rise in CIPA lawsuits based on allegedly unlawful use of pixels and other tracking technologies online, especially coming from plaintiff-bar attorneys - though many such lawsuits allege unaffected CIPA provisions. If enacted, this amendment will somewhat decrease the volume of pixel-related lawsuits.
However, SB 690 would likely also result in additional privacy-related complaints going to the California AG, increasing the risks of high-profile, high-consequence investigations. Additionally, it leaves the private right of action intact for claims under the wiretapping (§ 631), eavesdropping (§ 632), and recording (§ 632.7) provisions. Plaintiffs are likely to shift lawsuits to those later provisions.
CalPrivacy DELETE Act Enforcement Advisory
On September 3, 2026, CalPrivacy issued Enforcement Advisory 2026-01, highlighting data brokers who provide incorrect information in their annual registration with California’s data broker registry.
From the press release: “CalPrivacy has issued Enforcement Advisory 2026-01highlighting data brokers who provide incorrect information in their annual registration with California’s data broker registry. The advisory stresses that data brokers are liable to pay a fine for each day incorrect information appears in the registry, observing that the Enforcement Division has brought multiple enforcement actions over reporting errors.[*] … If consumers think a business provided incorrect information with its data broker registration, they should report it via the agency’s complaint form.”
Governor Vetoes Amendment to CCPA Limiting Disclosures of Sensitive Data
On September 27, 2026, California's governor vetoed AB 1542, which would have amended CCPA to prohibit businesses, service providers, and contractors from "selling"/"sharing" sensitive personal information to third parties, with exceptions for specific disclosures.
The governor’s letter cited concerns with a categorical ban on such disclosures and potential unforeseen implementation and enforcement costs.
CT AG investigating MediaLab.AI's Kik app for unfair, deceptive practices, privacy law violations
On September 8, 2026, Connecticut's AG announced that his office has sent a civil investigative demand (CID) for information about MediaLab. AI's Kik app. The CID includes requests for details related to data processing, content moderation, and age assurance practices. In the press release, the AG describes the app as popular with minors for sharing texts, private chats, photos, and videos and calls the Kik app a "predator's paradise."
“Kik is a parent’s worst nightmare—a cesspool of sexual abuse, exploitation and bullying, with no meaningful age verification or barriers or protections.” said Attorney General Tong. “Our investigation demands detailed answers from MediaLab regarding their unacceptable record on child safety and privacy. We just forced Meta to overhaul its platform and pay $17.1 billion for hurting our kids, and we’ve put TikTok, YouTube and Snap on notice. Our investigation into Roblox is active and ongoing. One by one, we are taking on these toxic apps and we are going to use the full weight of our law enforcement authority to hold Big Tech accountable and protect our kids online.”
CT AG Reminds Consumers of Privacy Rights Entering into Effect
On September 16, 2026, the Connecticut AG published a reminder that, under amendments entering into effect on October 1, 2026, additional privacy rights, "related to artificial intelligence, Facial Recognition Technology (FRT), genetic data privacy, surveillance pricing, and data brokers, as well as through recent amendments to the Connecticut Data Privacy Act (“CTDPA”)” are entering into effect.
Under SB4, the AG highlighted the following rights and requirements:
Limitations on surveillance pricing as well as disclosure requirements for businesses using personal data in price setting;
Limitations on and disclosure requirements for the use of FRT, including requiring that companies post clearly legible signage alerting consumers that FRT is in use on the premises and providing them with a conspicuous hyperlink or quick response code directing them to the company’s facial recognition technology policy;
Limitations and consent obligations for Direct-to-Consumer Testing Companies that are collecting consumer’s genetic data, including providing consumers with a property right and exclusive control over the collection, use, retention, maintenance, disclosure, and destruction of the sample and result;
Further limitations on what is considered publicly available information as well as expanded consumer data deletion rights related to consumer profiles generated from publicly available information;
A ban on the sale of consumer’s precise geolocation data; and
The creation of a data broker registry which requires data brokers to register with the Connecticut Department of Consumer Protection by January 1, 2027.
Under SB5, the AG highlighted the Connecticut Artificial Intelligence Responsibility and Transparency Act (“CART Act”) with the following rights and requirements:
Chatbots and Kids
o Companies that offer chatbots to children must put a protocol in place to detect and address chats indicating a risk of self-harm;
o Chatbot platforms must offer parental controls;
o Chatbots are prohibited from sending harmful communications to children;
o Chatbots cannot encourage children towards physical violence, substance abuse, or disordered eating; and
o Companies that offer chatbots to children cannot allow their chatbots to engage in romantic or sexual interactions with children or use manipulative engagement mechanics to keep them using the platform.
AI and Employment
o Employers must provide written notice when using AI to make a decision that impacts terms, privileges, or conditions of employment; and
o Employers are prohibited from using AI to discriminate against employees, and any such discrimination is considered employment discrimination that is also violative of the Connecticut Fair Employment Practices Act.
New Biometric Law for Erie County, NY
In April 2026, Erie County, NY passed a law banning the collection, use, and sale of biometric identifiers in commercial settings.
Businesses that previously collected biometric data are obligated to notify Erie County Division of Consumer Protection (within 30 days of the law's effective date) and destroy the biometric data in a secure manner. Penalties include up to $5,000 per day for violations left uncured after the 30-day cure period. The law became effective on June 5, 2026.
Delaware Enacts Major Amendments to Its Privacy and Breach Notification Laws
On September 2, 2026, Delaware enacted HB 380 and HB 381. HB 380 substantially amends the Delaware Personal Data Privacy Act (DPDPA); HB 381 amends Chapter 12B, Subtitle II, Title 6 of the Delaware Code, the state's computer security breach statute.
HB 380 broadens the DPDPA considerably, with the following expansions in scope:
The applicability threshold drops from 35,000 to 10,000 consumers (or 5,000 where more than 20% of gross revenue comes from selling personal data).
Third parties that acquire personal data from a controller are now in scope and carry standalone duties under a new § 12D-107A.
"Sensitive data" expands to reach national origin, health treatment or status, neural data, financial account information, government identifiers, and inferences drawn from any of these.
The data protection assessment threshold falls from 100,000 to 50,000 consumers, and profiling that feeds automated decisions with legal or similarly significant effects now requires a separate documented impact assessment.
HB 380 also eliminates the entity-level Gramm-Leach-Bliley Act (GLBA) exemption and replaces it with narrower carve-outs for insurers, chartered banks, credit unions and savings associations engaged in financial activities as described in the GLBA, and registered securities firms.
HB 380 does not exempt employment data across the board, so personal data in the employment-context loses its exemption for profiling and generating reports in connection with decisions that produce legal or similarly significant effects.
HB 380 introduces new obligations as well:
Sensitive data may not be disclosed in a sale unless: strictly necessary to provide a product or service the consumer requested; clear and conspicuous notice identifying the specific categories, purpose, and recipients; consumer consent; and a consent record retained five years.
Controllers disclosing a report for use in a decision producing legal or similarly significant effects must provide adverse action notice, an explanation of the data relied on, and an option for human review — a Fair Credit Reporting Act-style overlay on the privacy law.
Controllers must conduct documented due diligence on third-party recipients of personal data and enter contracts with those recipients with specified terms.
HB 381 requires AG notice within 60 days where affected residents cannot be identified within that window, folds AG notice and social media publication into substitute notice, and narrows the safe harbor for HIPAA- and GLBA-regulated entities so that following a regulator's breach procedures satisfies only the 60-day timing rule rather than the whole chapter.
Organizations should reassess their DPDPA applicability against the lower thresholds, inventory sensitive data including inferences, build consent capture and five-year retention for any sensitive-data sale, map third-party data flows and reevaluate third-party due diligence and contract requirements, and assess AI hiring and workforce tools, which lose the employment-data exemption when used for profiling or shared with third-party decision vendors. Incident response teams should revisit their response plans for compliance with the updated 60-day notice deadline.
FTC Rescinds 2021 Policy Statement on Health App and Connected Devices Breaches
On September 9, 2026, the FTC announced that it had rescinded the 2021 Policy Statement on Breaches by Health Apps and Other Connected Devices, citing that the 2024 update to the Health Breach Notification Rule rendered it unnecessary and in accordance with President Trump's directive to agencies to eliminate unnecessary rules and obsolete guidance.
Louisiana AG Sues Snap and Discord
On August 27, 2026, the Louisiana Attorney General announced a lawsuit against Snap, Inc. and Discord. The suits allege violations of the Louisiana Unfair Trade Practices Act (LUTPA), negligence and public nuisance, and unjust enrichment. The alleged violations are centered around harm to minors on the platforms while the platforms marketed themselves as safe for children. The suits are also seeking a TRO and preliminary injunction to prohibit engaging in any activity in violation of LUTPA, representing that the platforms have adequate safety features, and failing to implement reasonable measures designed to protect minors from harm.
Texas Judge Grants Partial Summary Judgment Against TikTok
On September 10, 2026, the Texas AG announced that its motion for partial summary judgment against TikTok had been granted. The District Court held that Texas met its burden to establish that:
1. TikTok's claim that it would remove video content that violated its Community Guidelines, but instead categorizing it as "hard to find" violated the Texas Deceptive Trade Practices Act; and
2. "Restricted Mode [i.e., the mode designated for minors] was not functioning in the way it was marketed and exposed users to a high volume of content that should have been filtered out."
The trial against TikTok for relief and penalties is expected to be set for next month.
City of Seattle Bans Surveillance Pricing in Grocery Stores
On September 22, 2026, the Seattle City Council passed the Fair Pricing and Transparency Ordinance banning the use of algorithmic pricing in grocery stores. nThe ordinance also requires mandatory disclosures of pricing and discounts. It now heads to Mayor Wilson's desk for signature.
"Covered retailers" are defined as a delivery service provider, a mixed-use grocery business, or a grocery business that has 20 or more retail locations globally, including but not limited to chains and integrated enterprises. "Delivery service provider" is defined as an organization that employes 100+ employees worldwide and facilitates delivery or online ordering services from a grocery business, mixed-use grocery business, or warehouse to a consumer in Seattle, regardless of where the business is located. Specifically exempted are convenience stores, food marts, and farmer's markets.
NYDFS Guidance on Cybersecurity Risk Assessments
On September 10, 2026, the NY Department of Financial Services issued Guidance on How to Conduct and Use Risk Assessments Required by the DFS Cybersecurity Regulation to the entities covered under the Banking Law, the Insurance Law or the Financial Services Law. The guidance clarifies the existing requirements under the Cybersecurity Regulation (23 NYCRR Part 500) following the Department’s review of common gaps in risk assessments.
The guidance highlights the following requirements for more dynamic, data-driven assessments which are integrated into broader enterprise governance processes:
Covered Entities must designate a Chief Information Security Officer (“CISO”) or a Senior Officer to oversee the Risk Assessment process and must ensure that the results of risk assessments are communicated to senior management.
While a specific methodology is not required, Covered Entities are recommended to adopt “a clear and repeatable methodology for identifying, analyzing, and prioritizing actions to address cybersecurity-related risks” and to periodically review the methodology for appropriateness for their organization.
Covered entities should consider the full range of internal and external factors that could affect their cybersecurity risk profile, including emerging risks, third-party and supply chain risk, and cyber interdependency and concentration risk. The department notes that entities are “required to maintain an accurate and current asset inventory.”
Covered Entities must retain documents showing “how cybersecurity risks were identified, assessed, and addressed through the Risk Assessment process,” including evidence and reasoning support conclusions and decisions.
Covered Entities should track risks and remediations over time for better visibility into the status of identified risks over time.
Covered Entities should integrate risk assessments into broader cybersecurity programs and update them at least annually or whenever there is a material change to their risk.
Global Updates
Apple to Change Language of Consent Management Pop-ups in the EU
On August 17, 2026, an investigation by Germany's Federal Cartel Office found Apple's consent management phrasing in its App Tracking Transparency framework steers users away from data sharing with third party-developers but had more favorable consent prompts for its own apps. Apple has four months to implement the changes.
Brazil's ANPD Announces Investigation into Discord
On August 7, 2026, Brazil's data protection authority, the ANPD, announced that it has launched an investigation into Discord. The investigation focuses on Discord's possible failures in implementing measures required by the ECA Digital Act, including the absence of age verification measures, failures to remove violating content, and failure to make required regulatory reports. Discord had five business days to present information on existing mechanisms for compliance with the ECA Digital.
Brazil's ANPD Fines TikTok $153.7 million real for failures in protecting children's and teen's data
On August 25, 2026, the Brazilian ANPD issued a fine to ByteDance for violations of the LGDP. The sanction includes the $153 million fine and the requirement to delete the data collected irregularly. The violations were identified both in access to TikTok without account registration and with account registration, and in both instances the data of children and teens were being processed without adequate legal basis. In response to the ANPD sanctions, ByteDance has committed to implementing a compliance plan to improve the protection of children and teens on TikTok.
Dutch DPA fined Uber $966M for automated driver suspensions that violated GDPR
On August 21, 2026, the Dutch privacy regulator fined Uber $966m for allegedly automating driver suspensions, with no warning or human involvement. Uber allegedly violated driver’s rights not to be subject to automated decision-making that has significant consequences and the right to be informed.
Indian High Court Recognizes Right to be Forgotten
On July 27, 2026, the High Court of Karnataka issued an order in Writ Petition No. 22456 of 2025. The petitioner requested the search engine deindexing of court records following her 2019 acquittal, which the court granted, holding that Article 21 of the Constitution grants a right to be forgotten.
Australian Privacy Law Reforms Proposed
On August 31, 2026, Australia published its initial proposals for the second wave of Privacy Act reforms. Proposed updates include an expanded definition of personal information, a new “fair and reasonable” test, new “trading” prohibition, simplified collection and notice requirements, updated breach notification requirements, right to erasure, and controller-processor distinctions. Feedback on the proposal is due by September 18, 2026. Legislation containing these proposals is likely to be introduced before the end of the year.
Discord Implements Youth Safety Measures Globally
On September 23, 2026, Discord implemented its age assurance and youth protections globally, publishing an accompanying blog post and placing users as Teens, Adults, or Unconfirmed. Discord internally estimates user age by connected communities, servers, and games; general activity levels, and account history and age.
Following backlash to Discord's use of Persona for its ties to Peter Thiel, Discord shifted to k-ID for Facial Age Estimation and ID document scan + selfie and now also provides age checking through credit card check, AgeKey, Google Wallet, and the Apple/Google Play Store. The safety page also discloses how each method works, what data is involved, and what's retained by whom.
The blog summarize the protections for teen accounts, including restrictions on messages from unfriended users, content filtering, and restrictions on profile details--all enabled by default and the first two only able to be adjusted by a confirmed adult.
As industry best practices for age assurance developed, businesses should be aware of methods and safeguards implemented by firms such as Discord and Roblox and determine whether those practices are appropriate for their risk profiles.
EDPB Announces Guidelines on Administrative Fines
On September 21, 2026, the EDPB announced that it adopted guidelines on the application of the power to impose administrative fines, replacing the WP29 guidelines on the application and setting of administrative fines and complement the previously adopted guidelines, The press release provides a 5-step methodology:
1. "The DPA checks if the infringement can lead to a fine, by finding support either directly in the GDPR or in national law.
2. The DPA determines whether the party under investigation may be fined for the infringement in question. Whether the controller or the processor is liable depends on who is bound by the breached provision.
3. The DPA assesses whether the infringement has been committed intentionally or negligently, since a culpable infringement is a condition for the imposition of a fine.
4. The DPA assesses possible aggravating and mitigating factors. If the infringement is minor, there will generally be no fine and a reprimand may be issued instead; if it is not minor, there is a strong presumption that a fine should be imposed.
5. The DPA assesses whether imposing an administrative fine would be effective, proportionate and dissuasive. In doing so, the DPA may consider whether, in the specific case, there is a reason to deviate from the standard approach."
The EDPB also announced it had adopted the final version of its guidelines on the interplay between the Digital Services Act (DSA) and the GDPR, following public consultation.
Netherlands Makes Publication of Data Protection Sanctions a Statutory Default
Effective September 1, 2026, GDPR sanctions by Netherlands Autoriteit Persoonsgegevens (AP) are required to be publicly disclosed. The Netherlands enacted the Verzamelwet gegevensbescherming (Data Protection Omnibus Act) on June 10, 2026 (Stb. 2026, 154), amending the Uitvoeringswet AVG, the Dutch General Data Protection Regulation (GDPR) implementing statute.
The Autoriteit Persoonsgegevens (AP) already published sanction decisions, but did so under its own disclosure policy. The amendment converts that practice into a legal obligation covering fines, orders subject to a penalty payment, and processing bans. The AP has said it will apply the same approach to sanctions under the Dutch police data and judicial data statutes.
EU Cyber Resilience Act Vulnerability and Incident Reporting Began in Effect
EU Cyber Resilience Act (CRA) was adopted on October 23, 2024 and entered into force on December 10, 2024. Its Article 14 reporting obligations became effective September 11, 2026, ahead of the Regulation's general application date of December 11, 2027.
Manufacturers of products with digital elements must report actively exploited vulnerabilities and severe incidents on a timeline: an early warning within 24 hours of becoming aware, a detailed notification within 72 hours, and a final report within 14 days of a corrective measure being available for vulnerabilities or within one month of the 72-hour report for incidents. Reports go to the Computer Security Incident Response Team (CSIRT) coordinator in the member state of main establishment, defined as where product cybersecurity decisions are predominantly taken, and reach the EU Agency for Cybersecurity (ENISA) simultaneously.
Two points are worth noting. Although Article 69(2) grandfathers products placed on the market before December 11, 2027, from most CRA requirements, Article 69(3) expressly excludes Article 14 from that exemption. The reporting duty therefore applies to the entire supported catalogue, not just current product lines. Second, ENISA's Single Reporting Platform is the sole permitted channel, with no email or national portal alternative; ENISA's platform FAQ states that at launch it will accept only mandatory reports under Article 14 and under Article 24, which covers open-source software stewards. Voluntary reporting under Article 15 is not available initially.
Organizations should confirm which CSIRT coordinates for their main establishment, identify who holds the 24-hour clock, and check that vulnerability intake covers legacy products still supported.
European Commission Unveils EU Kids Act
On September 17, 2026, the European Commission published more information about the proposed EU Kids Act, which will be organized around four pillars:
Social media delay: ban under 13, parental account creation control for 13-14, 15+ can create own accounts but other safety measures apply
Safety-by-design: feature restrictions on addictive features, harmful content, AI chatbots, and online chat/profile capabilities
Privacy-preserving age assurance: age verification for both new and existing users once rules go into force
Effective enforcement: burden of proof on very large online platforms to demonstrate services are "safe by design" with an ex-ante report, 90-day fast track investigations
The proposal will now go to the EU Parliament and Council for review and launch of the legislative process.
Irish DPC Fines Google 403 Million Euro Over Location Data
On September 21, 2026, the Irish Data Protection Commission fined Google €403 million following its inquiry into Google’s processing of location data in “Web & App Activity”, “Location History” and “Location Accuracy” between May 25, 2018 and February 4, 2020.Data Protection Commission fines Google €403 million following Inquiry into Google’s processing of l…
The decision found that Google had infringed the GDPR regarding:
“The lawfulness and fairness of its processing of location data in Web & App Activity and Location History,
Its accountability obligations under the GDPR by failing to be able to demonstrate compliance with the lawfulness, fairness and transparency principle regarding its processing of personal data in Location Accuracy;
Its transparency obligations in respect of all three features referred to above; and
Its retention of location data in Web & App Activity and Location History.”
Hintze Law PLLC is a Chambers-ranked and Legal 500-recognized, boutique law firm that provides counseling exclusively on AI, privacy, and data security. Hintze attorneys and data consultants support technology, ecommerce, advertising, media, retail, healthcare, and mobile companies, organizations, and industry associations in all aspects of AI, privacy, and data security.