Category:Privacy & Security
California’s Consumer Privacy Enforcement Is a Model for Other States
Most people click accept on a privacy notice without ever reading it. Meanwhile, the information companies collect about us, such as where we drive, what we watch, and what we search for, is shared and sold by more data brokers than ever. The growing practice of collecting and sharing the personal information of consumers has drawn the attention of state regulators. Specifically, in 2026, California’s Attorney General announced record penalties against Disney and General Motors under the state’s privacy law, the California Consumer Privacy Act (CCPA). As consumers’ personal information continues to be shared at a mounting pace, California’s enforcement of the CCPA shows why strong state enforcement of privacy laws is more important than ever, and why other states should follow its lead.
Swipe, Scan, Save: The Hidden Compliance Risks of Customer Loyalty Programs
It seems like every time you visit a store, you’re asked the question, “Do you have a rewards account?” Most do. They either scan a barcode or give their phone number to earn points, get discounts, or receive tailored offers. Although customers walk away with some savings, businesses end up with an even more valuable resource: data. What appears to be a simple transaction has become a sophisticated exchange of personal information, raising significant privacy and compliance issues involving consumer consent, transparency in data collection, third-party data sharing, and businesses’ obligations to protect personal information.
Flock Cameras and the Modern-Day Panopticon
In 2017, three Georgia Tech University graduates sought to create a dynamic automated license plate reader (ALPR) system to combat unsolved crimes in their community. Today, their company, Flock Safety, has rolled out more than 100,000 ALPRs in 6,000 communities across the United States. Additionally, as of August 9, 2026, the surveillance equipment company has solidified partnerships with nearly 5,000 law enforcement agencies. Partners of Flock Safety enjoy unfettered access to the company’s AI-powered database, where individual ALPRs record and upload traffic data into a searchable catalog of license plate numbers and other automobile identification markers, such as make, model, color, and even unique characteristics like scratches on automobiles. While ALPRs have historically been employed to regulate traffic safety and crime, Flock Safety has distinguished itself by allowing partnered law enforcement agencies the ability to provide government organizations access to data gathered on individuals across the country. Critics of the Flock Safety surveillance system note that the manipulation of such a sensitive compilation of data allows virtually any Flock Safety partner to surveil American citizens without a uniform system of compliance to regulate their access. Ultimately, the absence of federal regulation to restrain the authority of AI-powered ALPR systems allows both local law enforcement and federal agencies to abuse their access to these systems and violate the privacy of U.S. citizens.
Surveillance Pricing and Consumer Protection: Developing a Legislative Framework for Algorithmic Transparency
Surveillance pricing is an emerging practice whereby companies use highly complex algorithms, rooted in consumer data, to determine individual prices on goods and services. Rather than tailoring prices on market-wide supply and demand conditions, companies engaging in surveillance pricing individualize the cost of goods to consumer-specific behavior and characteristics. With this rampant form of price fixing affecting numerous markets—from rideshare services and hospitality to merchandise retailers—government regulation is necessary to prevent consumer discrimination.
The Government’s Block of Anthropic and the Future of AI Procurement
Governments around the world have increasingly turned to artificial intelligence (AI) as a tool for defense and national security. In the United States, that shift has come with its share of conflict. In early 2026, a dispute between the federal government and AI company Anthropic came to a head after the Trump administration moved to bar the Pentagon from using Anthropic’s Claude software. At its core, the standoff exposed a tension that is only going to grow more common: tech companies that want to set limits on how their products are used, versus a government that sees those limits as a threat to its own capabilities. The Department of Defense had previously brought Claude into certain internal tools and workflows. But Anthropic’s restrictions on military use created friction with agencies that wanted broader access to the software. When those disagreements proved unresolvable, the administration granted agencies six months to stop using Anthropic products entirely, turning what had been a contract dispute into one of the more public clashes between Washington and a tech company in recent memory.
The Shift from Lawmaking to Enforcement: State Privacy Regulation and Multi-State Coordination in 2026
The United States has reached a critical inflection point in data privacy regulation. Today, twenty states have adopted comprehensive privacy laws creating an increasingly complex array of regulatory requirements that interstate businesses must adhere to. Since the federal government has yet to enact universal privacy legislation and none coming in the foreseeable future, companies face mounting stress to navigate divergent state requirements while contending with a historic shift toward coordinated multi-state enforcement efforts.
Everything, Everywhere, All at Once: Data Privacy and Protection in a Post-Pandemic Reality
Today, the exponential growth and mass adoption of information technology tools and the constant exchange of user data presents an ongoing challenge for regulators seeking to protect data and privacy rights. Particularly from the Covid-19 pandemic onward, a dramatic increase in both demand and dependency has caused a tectonic shift across both public and private sectors. As a result of this ongoing IT and data revolution, the legal and regulatory landscape faces new opportunities and challenges, in terms of providing clarity and stability to regulated industries, entities, and individuals. One notable area of concern is data privacy and protection. Unfortunately, the U.S. Federal system currently lacks a centralized regulatory framework for protecting user data and privacy. However, other nations offer clear models, case studies from which the U.S. could greatly benefit. For example, the European Union’s General Data Protection Regulation, or GDPR, is an established, globally recognized regulatory framework. If adopted by U.S. regulators, the GDPR could provide clear regulatory guidance for individuals and entities seeking to navigate an increasingly high-risk era of data protection and management.
Navigating the Complex Landscape of Reproductive Healthcare Compliance
In the constantly evolving field of reproductive healthcare, compliance with regulatory standards is both challenging and vital. As legal frameworks shift and new technologies emerge, healthcare providers, law students, practitioners, and compliance professionals must stay informed to ensure adherence to the law. Several key compliance issues in reproductive healthcare, including privacy concerns raised by biometric technology as it is tied to employers, offer insights into the challenges and strategies for maintaining regulatory compliance.
Navigating Data Subject Rights Requests: Balancing Compliance with Mitigating Misuse
In the wake of heightened awareness around data privacy and protection, regulations like the General Data Protection Regulation (GDPR) in Europe and the California Consumer Privacy Act (CCPA) in the United States have emerged as trailblazers. These laws bestow significant rights upon individuals, allowing them to control and protect their personal data. At the heart of these regulations lies the concept of Data Subject Rights Requests (DSRR), also known by a similar name of Data Subject Access Requests (DSAR). This article offers strategies to combat the weaponizing DSRRs while complying with the requirements for legitimate requests.
The IRS-ICE Data Sharing Deal: A New Era of Regulatory Compliance Challenges
The Internal Revenue Service (IRS) is reportedly nearing an agreement to share limited taxpayer data with Immigration and Customs Enforcement (ICE), marking a significant departure in tax enforcement and immigration policy. This potential deal would allow ICE and the Department of Homeland Security (DHS) to verify whether names and addresses match filed tax records, purportedly to facilitate immigration enforcement efforts. However, this agreement raises concerns about taxpayer privacy, legal and corporate compliance, and potential declines in tax participation, which could undermine both federal revenue tax collection and trust in the tax system.