How can mobile privacy guidance help solve IoT transparency challenges? This article translates established mobile privacy principles—including layered notices, just-in-time disclosures, and privacy by design—into practical best practices for connected devices and AI-enabled products.
California's proposed CCPA cybersecurity audit regulations require certain businesses to conduct independent annual audits and executive certifications. This guide explains who is covered, what must be audited, and how to build a compliant cybersecurity governance program.
New York's Synthetic Performer Disclosure Law requires advertisers to disclose when commercial advertisements use AI-generated synthetic performers. This article explains who the law applies to, its key requirements, exceptions, penalties, and practical compliance considerations.
A practical guide to California's ADMT regulations, including when Article 11 applies and how businesses can comply with its disclosure, opt-out, access, and governance requirements.
California's Delete Act transforms data broker regulation into a comprehensive operational compliance framework. Learn who qualifies as a data broker and how to comply with registration, disclosure, deletion, audit, and ongoing governance obligations.
The Disney CCPA settlement signals a shift from formal compliance to architectural compliance. Learn why opt-out rights must function across accounts, devices, services, and ad-tech ecosystems—not just exist on paper.
2025 saw an unprecedented expansion of state privacy laws. Explore the latest developments in AI governance, biometrics, children's privacy, and emerging data regulations across the United States.
A practical analysis of CalPrivacy's ROR Partners decision, explaining why custom audiences, inferred profiles, and behavioral segments can constitute the sale of personal information and trigger California's data broker registration requirements.
California's first major CCPA enforcement action against Tractor Supply signals a new era of operational privacy compliance. This article examines the CPPA's findings, the extension of CCPA obligations to job applicants, and the practical lessons for businesses.
What qualifies as "personal data" under the GDPR and "personal information" under the CCPA? This comparative guide explains why both laws adopt intentionally broad definitions and debunks common myths about public, hashed, pseudonymous, and household data.
In 2023, U.S. states accelerated the evolution of privacy law, enacting new comprehensive statutes while expanding regulation of AI, children's privacy, biometrics, genetic data, and consumer rights. This roundup examines the year's most significant legislative developments.
2022 marked the year state privacy laws gained unstoppable momentum. This roundup examines new comprehensive privacy statutes, the CPPA's groundbreaking rulemaking, and the expanding patchwork of state laws reshaping privacy compliance across the United States.
Surveillance
Smart cities promise efficiency, but are existing privacy laws keeping pace? This article examines how U.S. federal and state privacy laws apply to smart cities, surveillance technologies, municipalities, and vendors—and why stronger community oversight remains essential.
Privacy
2021 marked the year state privacy laws became a national movement. This roundup examines the expansion of comprehensive privacy statutes, the rise of genetic and biometric privacy laws, and the growing convergence of consumer privacy rights across the United States.
CCPA
California voters faced a pivotal privacy decision in 2020. This article examines the proposed California Privacy Rights Act (CPRA), its sweeping amendments to the CCPA, the creation of the California Privacy Protection Agency, and what Proposition 24 meant for the future of U.S. privacy law.
CCPA
Learn how the CCPA defines personal information through its four statutory building blocks, including identifiers, inferences, household data, IP addresses, anonymous data, and key compliance considerations for businesses.
EU
Data protection is a fundamental right in the European Union, distinct from the right to privacy. This article explores its constitutional foundations, tracing its development from national constitutions to the EU Charter of Fundamental Rights and the jurisprudence of the CJEU.
Data Protection Law
From Convention 108 to the GDPR, this article traces the evolution of European data protection law, explaining its history, constitutional foundations, core principles, and global influence. It shows why data protection is a distinct legal discipline built on accountability and transparency.
Adequacy Decisions
Could California one day obtain its own EU adequacy decision? Written before the CCPA's enactment, this article explores whether California could develop a comprehensive privacy framework capable of supporting unrestricted transfers of personal data from Europe.
CCPA
Explore early CCPA readiness through a PwC executive survey examining business preparedness, compliance gaps, enforcement risks, and the operational challenges organizations faced before California's privacy law took effect.
Op-ed
If lawmakers expect businesses to be accountable for how they collect and use personal data, should political campaigns be held to the same standard? This opinion piece argues that meaningful privacy regulation must apply equally to politicians and the private sector.
Data Retention
Learn how to build a practical data retention program under the GDPR, including retention schedules, legal justifications, anonymization strategies, and best practices for defensible data lifecycle management.
CCPA
Should California have included whistleblower protections in the CCPA? This article explores the provision removed during legislative negotiations, compares it with HIPAA and the GDPR, and argues that protecting privacy professionals is essential to meaningful compliance.
Data Protection
Modern data protection law did not begin with the GDPR. This article traces its origins from the first European laws regulating automated data processing through Convention 108 and the recognition of data protection as a fundamental right in the European Union.