Privacy

Subscribe to Privacy via RSS

At its August 6–7, 2026, board meetings, the California Privacy Protection Agency (CalPrivacy) Board directed staff to prepare formal rulemaking to name Global Privacy Control (GPC) in the California Consumer Privacy Act (CCPA) regulations and tighten how opt-out preference signals must be honored. It also advanced separate rulemaking on data broker deletion audits and Delete Request and Opt-out Platform (DROP) rule amendments. Finally, the Board raised annual data broker registration and DROP access fees from $6,000 to $9,500 for 2027 and previewed its audit program.

Continue Reading CalPrivacy Authorizes Rulemaking on Opt-Out Signals, Raises Data Broker Fees, and Starts the Clock on DROP Amendment Comment Period

On June 10, 2026, the European Commission published a Code of Practice on marking and labeling of AI-generated content (the Code) following a public consultation that took place last year. The Code is divided into two sections:

  • Section 1 sets out provenance requirements applicable to providers offering generative AI systems.
  • Section 2 sets out transparency rules for AI-generated content applicable to deployers of AI tools, such as requirements to visibly label deepfakes and AI-generated text on matters of public interest.
Continue Reading EU Commission Publishes AI Transparency Code of Practice

On June 29, 2026, the U.S. Supreme Court issued its opinion in Trump v. Slaughter, where the six-Justice majority held that appointed agency officials who wield executive power are subject to presidential removal. In so holding, the Court overruled its 1935 decision in Humphrey’s Executor v. United States, 295 U.S. 602 (1935), which for nearly a century stood for the principle that Congress can create independent agencies whose leaders can only be removed for cause.

Continue Reading The FTC After Slaughter: What Businesses Need to Understand

On June 29, 2026, the Supreme Court of the U.S. (SCOTUS) held in Trump v. Slaughter that the U.S. President can dismiss members of the Federal Trade Commission (FTC) at will, rather than only for cause, overruling existing precedent regarding independent agencies. This decision of domestic constitutional law could also change the rules governing transfer of personal data from the European Economic Area (EEA, which includes the 27 European Union countries plus Iceland, Liechtenstein, and Norway) to the U.S.

Continue Reading SCOTUS Ruling Calls into Question EU-U.S. Personal Data Flows

On June 3, 2026, the European Commission (EC) released its first draft of a proposed Cloud and AI Development Act (Proposal or CADA), marking a significant step forward in the EU’s efforts to strengthen its digital infrastructure and reduce strategic dependence on non-EU cloud providers.

Continue Reading European Commission Publishes Proposal for Act to Reduce Reliance on Foreign Cloud and AI

Last month, the Connecticut legislature passed two bills that amend and expand the Connecticut Data Privacy Act (CTDPA): Senate Bill 4 (SB 4) and House Bill 5222 (HB 5222). SB 4 (which was signed into law on May 27, 2026) and HB 5222 (which amends parts of SB 4 and was signed into law on June 2, 2026) contain new requirements for businesses and data brokers operating in the Constitution State.

Continue Reading Connecticut Updates Its Data Privacy Act, Imposing Significant New Privacy Requirements

While the EU Artificial Intelligence (AI) Act has set forth a relatively uniform framework for AI regulation in the EU, U.S. AI regulation has so far primarily consisted of a patchwork of state laws—which continue to evolve at a rapid pace. Despite the Trump administration calling for Congress to pass AI legislation that would preempt overly burdensome state laws in its National Policy Framework for Artificial Intelligence, many states appear to be actively moving ahead with new legislation. Here are the top areas the states are targeting, followed by some key takeaways:

Continue Reading Recent AI Regulatory Developments in the United States