United States: Privacy Protection

California Senate Bill 690 eliminates private lawsuits under Penal Code § 638.51 for alleged pen register violations involving website tracking technologies, while leaving other privacy claims intact. The legislation addresses aggressive litigation tactics but does not create broad exemptions for commercial website activity or amend California's wiretapping provisions. Businesses must understand both the relief provided and the significant limitations of this narrow reform.

The Perfect Law Class Action Conference at NYU brought together practitioners and academics from Europe, Canada, and the United States to debate cutting-edge issues in class action litigation, with particular focus on privacy violations, securities fraud, and the transformative impact of artificial intelligence. The conference explored how Article III standing requirements are shaping privacy class actions, with detailed analysis of recent cases demonstrating the critical importance of pleading specific, se

With federal agencies pulling back on enforcement, state attorneys general are increasingly filling the regulatory gap through coordinated actions on consumer protection, antitrust, and privacy matters. Skadden partners examine which areas states are prioritizing and how this shift in enforcement landscape affects corporate compliance strategies and M&A transactions.

A federal court rejected TikTok's attempt to use two prior nationwide class action settlements—totaling over $93 million—to dismiss new privacy claims brought by minors alleging violations of the Children's Online Privacy Protection Act. The ruling hinged on whether the current plaintiffs were demonstrably members of the earlier settlement classes based solely on the pleadings, raising critical questions about the scope and enforceability of broad settlement releases in successive privacy litiga

A federal district court in Oklahoma has departed from the previous consensus on the use of automated license plate reader (“ALPR”) technology by law enforcement, holding that a police officer violated the Fourth Amendment when he queried ALPR databases to obtain one month of a vehicle’s historical location records without a warrant.

California's Invasion of Privacy Act has driven website-tracking litigation for three years, but as courts and legislators narrow CIPA's reach, plaintiffs' firms are pivoting to federal statutes and other state laws. The same allegations about Google Analytics, Meta pixels, and tracking tools are now being reframed under the Electronic Communications Privacy Act, Video Privacy Protection Act, and Florida's Security of Communications Act, creating multistate exposure that CIPA reform does nothing to address.

California's Digital Age Assurance Act (DAAA) is set to fundamentally reshape how operating system providers and app developers handle age verification, with its January 1, 2027 effective date rapidly approaching. The law creates a comprehensive system where operating systems collect age information and provide age-band signals to developers, effectively eliminating the ability for companies to claim ignorance about whether their users are children.

Businesses operating websites and mobile applications have faced a growing wave of lawsuits under the California Invasion of Privacy Act (CIPA), a 1967 statute enacted long before the modern internet. Plaintiffs increasingly argue that common website technologies—including cookies, pixels, and analytics tools—violate CIPA provisions originally aimed at wiretapping, eavesdropping, and pen registers.

Vermont's Attorney General has issued proposed rules for the state's Age-Appropriate Design Code Act, introducing sweeping restrictions on how digital products can interact with minors under 18. The rules would ban personalized feeds, autoplay, infinite scroll, and engagement-driven notifications for covered minors, while establishing a tiered age assurance framework that businesses must navigate. With the law taking effect January 1, 2027...