Halloween is nearly here. The costumes are out, the candy bowls are full, and somewhere a tracking pixel is quietly watching a visitor fill an online shopping cart. For businesses, 2026 has brought plenty of tricks and a few treats in data privacy and cybersecurity: new state laws, historic enforcement, fresh rules for artificial intelligence, and even some legislative relief for businesses facing website tracking lawsuits. Before you settle in with a bag of fun-size candy bars, here are five developments every business should know about.

1. Website Tracking Lawsuits: California’s SB 690 Sends Some Ghosts Packing

In our August 19, 2026, post, we reported that California Senate Bill 690 was advancing through the legislature to rein in the “avalanche” of lawsuits under the California Invasion of Privacy Act (CIPA). Many of those suits claim that collecting routine data such as IP addresses or device identifiers turns a website into an illegal “pen register” or “trap-and-trace device.” On September 30, 2026, Governor Newsom signed SB 690 into law. Under the new law, individuals can no longer sue over website and app-tracking claims under CIPA’s pen-register provision. Only the California Attorney General can bring those claims. The law takes effect January 1, 2027, and also reaches back to pending lawsuits filed within the two years before that date.

Now the less sweet part. SB 690 does not touch CIPA’s wiretapping and eavesdropping provisions, Sections 631 and 632. Plaintiffs’ firms have also signaled they will challenge the law’s retroactive reach on constitutional grounds. Meanwhile, the money in these cases remains real: in June 2026, a federal court approved a $3.85 million class settlement involving trackers on the Los Angeles Times website and apps.

Takeaway: Ask counsel to reassess any pending pen-register claims or demand letters now. Inventory every pixel, chat widget, and session-replay tool on your sites. Keep your consent banners and privacy disclosures in place, because wiretapping claims can still come knocking.

2. The State Privacy Law Patchwork: More Patches, Smaller Thresholds

Our January 28, 2026, Data Privacy Day post marked the arrival of comprehensive privacy laws in Indiana, Kentucky, and Rhode Island on January 1, 2026. That brought the number of states with such laws in effect to twenty. The patchwork has grown and shifted since then. Here is a roundup of the key changes since our January post:

  • New Jersey: Amendment banning the sale of sensitive data, effective June 30, 2026
  • Connecticut: Amendment lowering coverage thresholds, effective July 1, 2026. Amendment banning the sale of precise geolocation data and adding facial recognition and genetic data rules, effective October 1, 2026.
  • Maryland: Amendment banning the sale of personal data to government entities involved in civil immigration enforcement, effective July 1, 2026.
  • Virginia: Amendment banning the sale of precise geolocation data, effective July 1, 2026. 
  • New Hampshire: Amendment banning the sale of children’s personal data, effective January 1, 2027.
  • Delaware: Amendment lowering the coverage threshold from 35,000 to 10,000 consumers, effective January 1, 2027.
  • Louisiana: New comprehensive privacy law, effective January 1, 2027.
  • Oklahoma: New comprehensive privacy law, effective January 1, 2027.
  • Alabama: New comprehensive privacy law, effective May 1, 2027.
  • Vermont: New comprehensive privacy law, effective January 1, 2028.

The new privacy laws largely follow the familiar state privacy framework, but they have key differences that companies should review.

Takeaway: If you concluded last year that a state law didn’t apply to you, check again. Lower thresholds are pulling mid-sized companies into coverage. Map where your customers live, update your privacy notices, and confirm that your website honors browser settings that automatically tell sites a visitor is opting out, where state law requires it.

3. State Attorneys General Are Ramping Up Privacy Enforcement

In March, we reported that the California Privacy Protection Agency (CalPrivacy) was entering an “aggressive new phase” of enforcement, with more than 100 active investigations underway. California has also issued its first fines against data brokers that failed to register under the Delete Act, a law that requires data brokers to register with the state. But the enforcement wave reaches well beyond California. State attorneys general accelerated privacy enforcement in 2026, relying on both comprehensive privacy statutes and general consumer protection laws, even in states without a dedicated privacy law. In May, the Texas Attorney General settled with LG Electronics over smart TVs that used “automated content recognition” technology, which identifies what is playing on the screen, to collect viewing data. LG agreed to stop collecting that data without informed consent and to give users a simple way to opt out.

On September 24, 2026, a bipartisan coalition of 44 attorneys general announced a $2.3 million settlement with Laboratory Corporation of America (“Labcorp”) over a 2019 data breach at its debt collector, American Medical Collection Agency (“AMCA”). The AMCA breach potentially exposed the personal information of more than 27.5 million people nationwide, including 10.2 million Labcorp patients. The breach happened at the vendor, but the data belonged to Labcorp’s patients, and the states held Labcorp responsible. As Pennsylvania’s Attorney General put it, companies can delegate tasks to vendors, but “data security is a non-delegable duty.” The settlement requires Labcorp to strengthen its vendor management, including an incident response plan that covers internal reporting of vendor security events.

On July 14, 2026, a coalition of 42 attorneys general announced a settlement with the bankruptcy trustee for 23andMe. The settlement resolves claims arising from the company’s 2023 data breach, which compromised the genetic data of 6.9 million customers worldwide. The states’ investigation found that 23andMe used unreasonable data security practices. The settlement gives the states $150 million in allowed claims in the bankruptcy, but only $18 million is being paid now. Consumers keep the right to have their data deleted. California reached its own $6 million settlement with the company, now called Chrome Holding Co., on October 19, 2026, which is pending court approval.  

Takeaway: Regulators are comparing what companies say about their data practices with what their products actually do. Audit your privacy notices against your real data flows and pay close attention to location and other sensitive data, as well as any products used by minors. And don’t forget your vendors: if they lose your customers’ data, regulators may come knocking at your door.

4. AI Rules: The Robots Must Now Introduce Themselves

Our earlier AI coverage focused on federal proposals: the White House’s March 2026 legislative recommendations, which call for a national standard that would preempt state AI laws, and the June 2026 discussion draft of the Great American AI Act. In the meantime, the states are moving faster.

In May 2026, Colorado replaced its original AI law with the Automated Decision-Making Technology Act (SB 26-189) and enacted the Chatbot Safety Act (HB 26-1263). Both laws take effect January 1, 2027. The ADMT Act covers AI tools that play a meaningful role in important (“consequential”) decisions about people, such as decisions about access to jobs, loans, housing, or insurance. The ADMT Act requires businesses that use such technology to provide a written disclosure when use of the tool contributes to an “adverse outcome” for a consumer, such as a denied application, and directs the Attorney General to adopt rules implementing that requirement. The Attorney General’s proposed rules require that the written disclosure occur within 30 days. The Chatbot Safety Act imposes several duties on consumer-facing chatbots, including estimating users’ ages, disclosing that users are talking to AI, protecting minors, and filing annual reports. The Colorado Attorney General released proposed rules implementing both statutes on August 11, released revised interim drafts on October 6, and held a rulemaking hearing on October 26, 2026. The rules for both statutes are not yet final.

Connecticut’s new AI law, Public Act 26-15—also known as the Connecticut Artificial Intelligence Responsibility and Transparency (CART) Act—began phasing in on October 1, 2026. Its provisions governing AI companion chatbots, which include telling users they are interacting with AI, take effect on January 1, 2027.

In California, CCPA regulations that took effect January 1, 2026, added rules for automated decision-making technology, along with risk assessment and cybersecurity audit requirements. Risk assessment attestations are due by April 1, 2028.

Takeaway: Inventory where you use AI, especially in hiring, lending, housing, insurance, and customer-service chatbots. Build processes for giving notices and explaining adverse decisions. Review your AI vendor contracts so you know what your tools are actually doing.

5. Kids, COPPA, and Age Checks: The FTC Offers a Treat, Not a Free Pass

In February 2026, the Federal Trade Commission announced it will not bring enforcement actions under the COPPA Rule, which implements the federal Children’s Online Privacy Protection Act, against certain operators that collect, use, and disclose personal information solely to determine a user’s age through age verification. The FTC also signaled that it intends to review the COPPA Rule to address age verification mechanisms. In October 2026, an FTC consumer protection official said the agency is “not softening” its COPPA enforcement and is making it a priority. COPPA still requires parental consent before businesses collect, use, or disclose personal information from children under 13. State attorneys general can enforce it as well.

Takeaway: If you deploy age verification, keep the data you collect strictly limited to that purpose. If your product reaches children, assume both federal and state regulators are watching.

Don’t Let Your Compliance Program Become a Ghost Story

The good news: with a little preparation, none of these developments needs to be frightening. Inventory your trackers, recheck which state laws apply to you, audit your AI tools, and make sure your privacy promises match your practices. Then you can enjoy the candy. For more, browse our other 2026 posts on the Password Protected blog, including:

Happy Halloween, and may your data stay safely locked in the crypt.

“Surveillance pricing” describes the use of formulas, software or AI to set prices dynamically when those systems incorporate personal information (e.g., browsing history, purchase patterns, demographic profiles, device identifiers or inferred willingness to pay) to tailor prices to individual consumers. This practice is distinct from broader “algorithmic pricing,” which relies on market-wide inputs such as supply-and-demand conditions, inventory levels and timing without targeting individuals based on their personal data.

Surveillance pricing raises significant privacy and consumerprotection risks, as it may involve harvesting and extracting maximum value from individual consumers’ personal data, often without their knowledge or meaningful consent.

Read on to learn more about the legal landscape and concrete takeaways for businesses aiming to stay on the right side of privacy law.

On September 1, 2026, the U.S. Department of Justice (“DOJ”) announced a $2,042,518 False Claims Act (“FCA”) settlement with Honeywell Aerospace Inc. (“Honeywell Aerospace” or “Honeywell” or “the company”), resolving allegations that the company failed to comply with certain cybersecurity requirements in a contract with the U.S. Department of War (“DoW”). This settlement is the latest in a growing line of enforcement actions under DOJ’s Civil Cyber-Fraud Initiative and underscores the government’s continued willingness to use the FCA to hold defense contractors accountable for apparent failures to comply with cybersecurity-related requirements.

Read more

U.S. companies using AI models developed by companies based in the People’s Republic of China, including DeepSeek, Moonshot AI or MiniMax, should be aware of potential congressional scrutiny in this Congress and the next. Two House committees are conducting a joint investigation into the national security, cybersecurity and economic security implications of U.S. companies’ adoption of PRC-developed AI models, including low-cost, open-weight models and models accessible through application programming interfaces. The House panels have already expressed interest in investigating actions at Anysphere, Airbnb and DoorDash. Read on to learn more about expected congressional interest in corporate use of PRC-developed AI models.

Read more

California Senate Bill 690 (“SB 690”) continues to advance in the California state legislature. SB 690 seeks to limit litigation brought pursuant to the California Invasion of Privacy Act (“CIPA”) given the avalanche of website technology litigation, which continues unabashedly. While SB 690 has been scaled back since its first introducion in February 2025, it would still have a meaningful impact on businesses faced with these lawsuits.

Continue Reading California’s SB 690: Legislative Relief on the Horizon for Website Privacy Claims

The explosion of generative AI in the workplace has created a new and largely unaddressed category of litigation risk. In May 2025, a federal court in the Southern District of New York ordered OpenAI to preserve and segregate all ChatGPT output log data that would otherwise be destroyed under its default 30-day deletion policy, marking one of the first judicial orders to treat AI-generated content as electronically stored information subject to legal holds, i.e., the obligation to preserve potentially relevant evidence once litigation is reasonably anticipated. The order, issued over OpenAI’s objections grounded in user privacy and regulatory compliance, signals that courts will expect litigants to preserve AI artifacts with the same rigor applied to email, documents and structured data.

Read on for an analysis of how existing discovery rules already reach AI-generated content, the sanctions companies may face for failing to preserve it and the practical steps clients should take now to close the gap.

Read more

On July 20, 2026, the California Court of Appeal (Fourth Appellate District, Division One) issued its decision in Mata v. Digital Recognition Network, Inc., No. D084781, holding that standing to sue under California’s Automated License Plate Recognition (ALPR) statute (Civ. Code §§ 1798.90.5–1798.90.55) requires a showing of actual harm arising from a statutory violation instead of a bare technical violation or a plaintiff’s subjective privacy concerns.

Continue Reading California Court Rules Automated License Plate Recognition Law Requires Actual Harm

In February 2026, the California First District Court of Appeal held that, at the pleading stage, the plaintiff had sufficiently pled that a parking garage’s failure to publicly display an automated license plate recognition (“ALPR”) usage and privacy policy violated California Civil Code Section 1798.90.51(b).

Continue Reading California’s Automated License Plate Recognition Law Draws Increased Litigation Exposure

On July 13, 2026, the Department of War (DoW) announced the immediate suspension of all Cybersecurity Maturity Model Certification (CMMC) Phase II requirements, which had originally been scheduled to take effect Nov. 10, 2026, including the transition to mandatory third-party assessments by CMMC Third-Party Assessment Organizations for contractors handling Controlled Unclassified Information. The DoW simultaneously established a CMMC Reform Task Force charged with delivering a comprehensive report within 60 days recommending “realistic, scalable security measures” for the Defense Industrial Base.

The suspension aligns with Secretary of War Pete Hegseth’s Acquisition Transformation System directives and the broader “Arsenal of Freedom” initiative. Critically, the action does not relieve contractors of their underlying obligations to protect federal data, which includes the current DFARS 252.204-7012 (Safeguarding Covered Defense Information and Cyber Incident Reporting) and the NIST SP 800-171 Rev. 2 security controls upon which the CMMC Phase II requirements are based.

Read more

Across the healthcare industry, providers are increasingly relying on AI-assisted billing tools to automate medical coding, prior authorization workflows, and the submission of claims to Medicare, Medicaid and other federal payors. The efficiency gains can be substantial, as can the heightened False Claims Act (FCA) exposure these systems can create. As AI continues to develop and becomes more widely integrated into healthcare billing, relators and prosecutors are likely to explore new avenues for evaluating, and litigating, how these tools are deployed, monitored and overseen.

Like every billing system, AI-assisted billing tools can make mistakes. However, AI-assisted systems can scale those mistakes across thousands of claims, and the records those systems generate may make it easier for the government or relators to argue that a provider’s submission of those claims violated the FCA.

Read more