Data Privacy Laws News
The latest legal news and analysis on data privacy laws.
35 articles
Lyft to Pay $1.8M in California CCPA Opt-Out Settlement
California settled CCPA claims against Lyft on October 29, 2026: $1.8 million in civil penalties, a required in-app opt-out, and notice to California users.
Montana Attorney General Sues GM and OnStar Over Driving Data
Montana's AG sued GM and OnStar on October 16, 2026 over driver data sold to insurers. The state is not among the 36 jurisdictions in the $220M settlement.
Fourth Circuit Strikes Down West Virginia Daniel's Law Disclosure Ban in Data Broker Suits
The Fourth Circuit held W. Va. Code 5A-8-24(e) facially unconstitutional on Oct. 27, 2026, affirming dismissal of five data broker class actions.
FTC Orders Nine Companies to Report on Personalized Pricing
The FTC issued Section 6(b) study orders on October 28, 2026 to Delta, United, JetBlue, Uber, Lyft, DoorDash, Instacart, Target and Walmart. Not enforcement.
Character.AI Bankruptcy: State AGs Warn on Private Chat Data
A coalition of 39 states and DC filed a notice on October 14, 2026 in the Character.AI bankruptcy, seeking privacy protections for chat data in any sale.
$2.7M BCHP Data Breach Settlement Also Binds IT Vendor XTIUM
New York and Connecticut secured $2.7M from Boston Children's Health Physicians and XTIUM on Oct 16, 2026. What the assurance requires, and by when.
Frontier to Pay Connecticut $625,000 Over 2024 Data Breach
Connecticut's $625,000 Frontier breach settlement: what it requires, and why it is not the separate $5.64M class settlement, whose claim window closed in 2025.
Texas Temu Settlement Requires US Data Storage, China Limits
Texas settled its DTPA suit against Temu on October 15, 2026. The agreed judgment puts Texans' personal data on US-owned servers and limits access from China.
Ninth Circuit Finds Standing to Sue Over Health Data Disclosure
On October 9, 2026 the Ninth Circuit held in Black v. IEC Group, No. 25-5952, that plan members whose entrusted health data was disclosed have standing to sue, not that they win.
Four State AGs File TP-Link Lawsuits Over Router Claims
Florida, Iowa, Montana and Nebraska sued TP-Link Systems on October 6, 2026 over router security and Vietnam sourcing claims. Allegations are unproven; no ban is sought.
LinkedIn Wins Permanent Injunction in Fake-Account Scraping Suit
A federal judge entered a consent judgment permanently barring ProAPIs, Netswift and Rehmat Alam from scraping LinkedIn data after a fake-account mill lawsuit.
Newsom Vetoes AB 1542 as California CCPA Deletion Bills Advance
Newsom vetoed AB 1542 on September 27, 2026, rejecting a CCPA ban on selling sensitive personal information, while AB 883 tightens data broker deletion.
California Makes Companies Tell the AG Before Handing Over Abortion Records
California AB 1930, Chapter 468, was signed September 26, 2026. New Civil Code 1798.309 requires seven business days notice to the Attorney General before producing records.
44 State AGs Settle With Labcorp Over 2019 AMCA Data Breach
44 state attorneys general settled with Labcorp for $2,287,455 over the 2019 AMCA breach. The money goes to the states, not consumers, and no claim form exists.
California Repeals the Age-Appropriate Design Code and Replaces It With a New Kids' Privacy Law
California AB 2246, Chapter 187, repeals the Age-Appropriate Design Code Act and enacts a new Civil Code title with no DPIA requirement and doubled penalties.
FTC Rescinds 2021 Health App Breach Policy Statement
The FTC rescinded its 2021 policy statement on health app data breaches Sept. 9, 2026, but the Health Breach Notification Rule itself remains fully in force.
Florida Sues Netflix Over Children's Data Under State Privacy Law
Florida's attorney general sued Netflix on September 9, 2026, alleging it sold data from known children without consent. What section 501.715 actually requires.
Third Circuit Affirms Dismissal of Tower Health Pixel Suit
The Third Circuit affirmed dismissal in Santoro v. Tower Health. Patients had Article III standing for Meta Pixel claims, but the appeal failed on other grounds.
Delaware Signs HB 380: DPDPA Privacy Overhaul Effective 2027
Governor Meyer signed Delaware HB 380 on September 2, 2026. The DPDPA threshold falls to 10,000 consumers and sensitive data expands from January 1, 2027.
Meta Reaches Deal With State AGs Over Teen Safety, Up to $17.1B
Meta agreed to pay state attorneys general at least $12.1 billion, rising to $17.1 billion, over Instagram and Facebook's design for minors. Verified against official AG releases.
California Lawmakers Pass SB 923: CCPA Delete-Right Expansion, Explained
California SB 923 was enrolled and presented to Governor Newsom on September 2, 2026. Under article IV, section 10(b)(2) he has until September 30 to act.
CalPrivacy Fines Two Data Brokers Under CCPA and Delete Act
California's privacy agency fined LocateSmarter $116,490 and Cybba $52,400 in August 2026; the LocateSmarter order is its first under both the CCPA and Delete Act.
California's Delete Act Deletion Mandate Takes Effect: Data Brokers Must Now Process DROP Requests Every 45 Days
As of August 1, 2026, California data brokers must access the DROP platform every 45 days to process consumer deletion requests under the Delete Act (SB 362). Here's what changed and what it means.
New Jersey Enacts a Sweeping New Data Broker Law (A5328), Banning Sensitive-Data Sales
NJ Gov. Sherrill signed A5328 on June 30, 2026, banning sensitive-data sales and creating a data-broker registry with fees up to $1.5 million and $50,000 per-record penalties.