As the 2026 legislative session came to a close, California passed a wide-ranging assortment of privacy and artificial intelligence (AI)-related bills. In total, Governor Gavin Newsom signed over two dozen privacy and AI bills into
Continue Reading California Enacts Over Two Dozen Key Privacy and AI Bills into Law in 2026 Legislative Session
At its August 6–7, 2026, board meetings, the California Privacy Protection Agency (CalPrivacy) Board directed staff to prepare formal rulemaking to name Global Privacy Control (GPC) in the California Consumer Privacy Act (CCPA) regulations and tighten how opt-out preference signals must be honored. It also advanced separate rulemaking on data broker deletion audits and Delete Request and Opt-out Platform (DROP) rule amendments. Finally, the Board raised annual data broker registration and DROP access fees from $6,000 to $9,500 for 2027 and previewed its audit program.
Continue Reading CalPrivacy Authorizes Rulemaking on Opt-Out Signals, Raises Data Broker Fees, and Starts the Clock on DROP Amendment Comment Period
On June 10, 2026, the European Commission published a Code of Practice on marking and labeling of AI-generated content (the Code) following a public consultation that took place last year. The Code is divided into two sections:
On June 29, 2026, the U.S. Supreme Court issued its opinion in Trump v. Slaughter, where the six-Justice majority held that appointed agency officials who wield executive power are subject to presidential removal. In so holding, the Court overruled its 1935 decision in Humphrey’s Executor v. United States, 295 U.S. 602 (1935), which for nearly a century stood for the principle that Congress can create independent agencies whose leaders can only be removed for cause.
Continue Reading The FTC After Slaughter: What Businesses Need to Understand
On June 29, 2026, the Supreme Court of the U.S. (SCOTUS) held in Trump v. Slaughter that the U.S. President can dismiss members of the Federal Trade Commission (FTC) at will, rather than only for cause, overruling existing precedent regarding independent agencies. This decision of domestic constitutional law could also change the rules governing transfer of personal data from the European Economic Area (EEA, which includes the 27 European Union countries plus Iceland, Liechtenstein, and Norway) to the U.S.
Continue Reading SCOTUS Ruling Calls into Question EU-U.S. Personal Data Flows
On June 3, 2026, the European Commission (EC) released its first draft of a proposed Cloud and AI Development Act (Proposal or CADA), marking a significant step forward in the EU’s efforts to strengthen its digital infrastructure and reduce strategic dependence on non-EU cloud providers.
Continue Reading European Commission Publishes Proposal for Act to Reduce Reliance on Foreign Cloud and AI
Last month, the Connecticut legislature passed two bills that amend and expand the Connecticut Data Privacy Act (CTDPA): Senate Bill 4 (SB 4) and House Bill 5222 (HB 5222). SB 4 (which was signed into law on May 27, 2026) and HB 5222 (which amends parts of SB 4 and was signed into law on June 2, 2026) contain new requirements for businesses and data brokers operating in the Constitution State.
Continue Reading Connecticut Updates Its Data Privacy Act, Imposing Significant New Privacy Requirements