United States: IT and Internet

Retailers are rapidly expanding their use of biometric technologies—from facial recognition for loss prevention to palm-based payments—raising critical questions about privacy, data ownership, and regulatory compliance. As state laws diverge on how security versus marketing uses are treated, the distinction between these applications is becoming one of the most important lines for retailers to navigate.

Recent cyber campaigns reveal how attackers exploit trusted brands and platforms to deliver malware through fake websites and sponsored ads.

California's Comprehensive Data Access and Fraud Act (CDAFA) is emerging as a powerful tool in privacy litigation, but what exactly does this 1989 statute regulate? As plaintiffs increasingly leverage CDAFA claims against companies using third-party tracking scripts and cookies, courts are grappling with ambiguous statutory language while allowing disgorgement theories of injury to proceed—creating new litigation risks for businesses in the digital advertising space.