United States: Privacy Protection

The Perfect Law Class Action Conference at NYU brought together practitioners and academics from Europe, Canada, and the United States to debate cutting-edge issues in class action litigation, with particular focus on privacy violations, securities fraud, and the transformative impact of artificial intelligence. The conference explored how Article III standing requirements are shaping privacy class actions, with detailed analysis of recent cases demonstrating the critical importance of pleading specific, se

With federal agencies pulling back on enforcement, state attorneys general are increasingly filling the regulatory gap through coordinated actions on consumer protection, antitrust, and privacy matters. Skadden partners examine which areas states are prioritizing and how this shift in enforcement landscape affects corporate compliance strategies and M&A transactions.

Enterprise AI creates legal risk throughout the AI lifecycle, beginning before deployment. Model selection, data pipelines, vendor relationships, AI-generated outputs, consequential decision-making, contracts, and governance can create intellectual-property, privacy, confidentiality, contractual, regulatory, and liability exposure. Artificial intelligence is rapidly reshaping real-money gaming, but its value proposition is inseparable from regulatory risk.

A federal district court in Oklahoma has departed from the previous consensus on the use of automated license plate reader (“ALPR”) technology by law enforcement, holding that a police officer violated the Fourth Amendment when he queried ALPR databases to obtain one month of a vehicle’s historical location records without a warrant.

California's Invasion of Privacy Act has driven website-tracking litigation for three years, but as courts and legislators narrow CIPA's reach, plaintiffs' firms are pivoting to federal statutes and other state laws. The same allegations about Google Analytics, Meta pixels, and tracking tools are now being reframed under the Electronic Communications Privacy Act, Video Privacy Protection Act, and Florida's Security of Communications Act, creating multistate exposure that CIPA reform does nothing to address.

Phia, the shopping app founded by Phoebe Gates and Sophia Kianni, faced allegations of cookie stuffing after Bloomberg discovered its browser extension was automatically placing affiliate tracking...

Businesses operating websites and mobile applications have faced a growing wave of lawsuits under the California Invasion of Privacy Act (CIPA), a 1967 statute enacted long before the modern internet. Plaintiffs increasingly argue that common website technologies—including cookies, pixels, and analytics tools—violate CIPA provisions originally aimed at wiretapping, eavesdropping, and pen registers.

Vermont's Attorney General has issued proposed rules for the state's Age-Appropriate Design Code Act, introducing sweeping restrictions on how digital products can interact with minors under 18. The rules would ban personalized feeds, autoplay, infinite scroll, and engagement-driven notifications for covered minors, while establishing a tiered age assurance framework that businesses must navigate. With the law taking effect January 1, 2027...

Privacy, cybersecurity, and technology regulation are evolving rapidly around the world, but not necessarily in the same direction or at the same pace. For multinational organizations, the challenge is not just understanding individual regulatory developments, but determining how overlapping requirements can be addressed across jurisdictions in a practical and coordinated way.