Worldwide: Data Protection

On May 15, 2026, a substantial revision of China’s Implementing Regulations of the Drug Administration Law (the Regulations or Implementing Regulations) took effect, introducing, among other items, a formal data protection framework. On the same day, China’s National Medical Products Administration (NMPA) issued the Implementing Measures for Drug Trial Data Protection (the Measures), giving operational effect to the Regulations’ data-protection article for the first time since China accepted the underlying obligation upon World Trade Organization (WTO) accession.

El 22 de julio de 2026 se publicó en la Gaceta Oficial de la Ciudad de México el Decreto por el que se adiciona el artículo 231 Bis al Código Penal para el Distrito Federal.

The Federal Trade Commission has proposed a groundbreaking policy statement that could fundamentally reshape how businesses use consumer data to set prices. The proposal identifies four specific practices that may violate Section 5 of the FTC Act, ranging from misrepresenting personalized pricing to obscuring the data used in pricing decisions. With implications extending from online retailers to brick-and-mortar stores, businesses must now evaluate whether their pricing practices align with the FTC's emerg

How can privacy, cybersecurity, and AI governance be transformed from mere compliance obligations into strategic assets that build customer confidence and competitive advantage? This podcast episode explores a framework for integrating these traditionally siloed disciplines into a unified approach that treats digital trust as part of the product itself. Drawing on insights from a new book and legal expertise, the discussion reveals why evidence-based confidence matters more than trust, and how governance bu

Alston & Bird's quarterly Digital Download examines the rapidly evolving intersection of privacy, cybersecurity, and data strategy, highlighting how AI-driven threats are reshaping breach costs, regulatory frameworks, and organizational defense strategies. From IBM's 2026 breach report showing record-high costs to new government initiatives like the White House's Gold Eagle clearinghouse, the landscape demands heightened vigilance and sophisticated governance approaches.

When Wayfair faced a CIPA lawsuit over tracking pixels allegedly sharing user browsing data with six social media platforms, the company deployed nearly a dozen creative legal defenses—from encryption arguments to First Amendment claims. The court systematically rejected almost every theory, yet Wayfair secured dismissal of one claim for an unexpected reason that had nothing to do with the merits.

A federal court in California dismissed a massive international class action lawsuit against Meta and WhatsApp after finding that plaintiffs relied on anonymous whistleblower claims without providing sufficient factual detail to support allegations that the company secretly accesses users' encrypted messages. While the court rejected most claims for failing to meet pleading standards, it also denied Meta's motion for sanctions and ruled that foreign users can pursue claims under U.S. privacy laws.

A California federal court dismissed an eight-count class action lawsuit against GNC Holdings, finding that the plaintiff failed to establish Article III standing for claims related to website tracking and data collection. The court examined whether collecting cookie IDs, device IDs, IP addresses, and browsing data from a customer who purchased a pre-workout supplement constituted a privacy injury sufficient to support claims under ECPA, CIPA, and other California statutes.

Companies have been very focused on tracking and cookie litigation in the US over the past several months, as we have previously written. But for multinationals, online tracking compliance should be a global focus.