“Surveillance pricing” describes the use of formulas, software or AI to set prices dynamically when those systems incorporate personal information (e.g., browsing history, purchase patterns, demographic profiles, device identifiers or inferred willingness to pay) to tailor prices to individual consumers. This practice is distinct from broader “algorithmic pricing,” which relies on market-wide inputs such as supply-and-demand conditions, inventory levels and timing without targeting individuals based on their personal data.

Surveillance pricing raises significant privacy and consumerprotection risks, as it may involve harvesting and extracting maximum value from individual consumers’ personal data, often without their knowledge or meaningful consent.

Read on to learn more about the legal landscape and concrete takeaways for businesses aiming to stay on the right side of privacy law.

On September 1, 2026, the U.S. Department of Justice (“DOJ”) announced a $2,042,518 False Claims Act (“FCA”) settlement with Honeywell Aerospace Inc. (“Honeywell Aerospace” or “Honeywell” or “the company”), resolving allegations that the company failed to comply with certain cybersecurity requirements in a contract with the U.S. Department of War (“DoW”). This settlement is the latest in a growing line of enforcement actions under DOJ’s Civil Cyber-Fraud Initiative and underscores the government’s continued willingness to use the FCA to hold defense contractors accountable for apparent failures to comply with cybersecurity-related requirements.

Read more

U.S. companies using AI models developed by companies based in the People’s Republic of China, including DeepSeek, Moonshot AI or MiniMax, should be aware of potential congressional scrutiny in this Congress and the next. Two House committees are conducting a joint investigation into the national security, cybersecurity and economic security implications of U.S. companies’ adoption of PRC-developed AI models, including low-cost, open-weight models and models accessible through application programming interfaces. The House panels have already expressed interest in investigating actions at Anysphere, Airbnb and DoorDash. Read on to learn more about expected congressional interest in corporate use of PRC-developed AI models.

Read more

California Senate Bill 690 (“SB 690”) continues to advance in the California state legislature. SB 690 seeks to limit litigation brought pursuant to the California Invasion of Privacy Act (“CIPA”) given the avalanche of website technology litigation, which continues unabashedly. While SB 690 has been scaled back since its first introducion in February 2025, it would still have a meaningful impact on businesses faced with these lawsuits.

Continue Reading California’s SB 690: Legislative Relief on the Horizon for Website Privacy Claims

The explosion of generative AI in the workplace has created a new and largely unaddressed category of litigation risk. In May 2025, a federal court in the Southern District of New York ordered OpenAI to preserve and segregate all ChatGPT output log data that would otherwise be destroyed under its default 30-day deletion policy, marking one of the first judicial orders to treat AI-generated content as electronically stored information subject to legal holds, i.e., the obligation to preserve potentially relevant evidence once litigation is reasonably anticipated. The order, issued over OpenAI’s objections grounded in user privacy and regulatory compliance, signals that courts will expect litigants to preserve AI artifacts with the same rigor applied to email, documents and structured data.

Read on for an analysis of how existing discovery rules already reach AI-generated content, the sanctions companies may face for failing to preserve it and the practical steps clients should take now to close the gap.

Read more

On July 20, 2026, the California Court of Appeal (Fourth Appellate District, Division One) issued its decision in Mata v. Digital Recognition Network, Inc., No. D084781, holding that standing to sue under California’s Automated License Plate Recognition (ALPR) statute (Civ. Code §§ 1798.90.5–1798.90.55) requires a showing of actual harm arising from a statutory violation instead of a bare technical violation or a plaintiff’s subjective privacy concerns.

Continue Reading California Court Rules Automated License Plate Recognition Law Requires Actual Harm

In February 2026, the California First District Court of Appeal held that, at the pleading stage, the plaintiff had sufficiently pled that a parking garage’s failure to publicly display an automated license plate recognition (“ALPR”) usage and privacy policy violated California Civil Code Section 1798.90.51(b).

Continue Reading California’s Automated License Plate Recognition Law Draws Increased Litigation Exposure

On July 13, 2026, the Department of War (DoW) announced the immediate suspension of all Cybersecurity Maturity Model Certification (CMMC) Phase II requirements, which had originally been scheduled to take effect Nov. 10, 2026, including the transition to mandatory third-party assessments by CMMC Third-Party Assessment Organizations for contractors handling Controlled Unclassified Information. The DoW simultaneously established a CMMC Reform Task Force charged with delivering a comprehensive report within 60 days recommending “realistic, scalable security measures” for the Defense Industrial Base.

The suspension aligns with Secretary of War Pete Hegseth’s Acquisition Transformation System directives and the broader “Arsenal of Freedom” initiative. Critically, the action does not relieve contractors of their underlying obligations to protect federal data, which includes the current DFARS 252.204-7012 (Safeguarding Covered Defense Information and Cyber Incident Reporting) and the NIST SP 800-171 Rev. 2 security controls upon which the CMMC Phase II requirements are based.

Read more

Across the healthcare industry, providers are increasingly relying on AI-assisted billing tools to automate medical coding, prior authorization workflows, and the submission of claims to Medicare, Medicaid and other federal payors. The efficiency gains can be substantial, as can the heightened False Claims Act (FCA) exposure these systems can create. As AI continues to develop and becomes more widely integrated into healthcare billing, relators and prosecutors are likely to explore new avenues for evaluating, and litigating, how these tools are deployed, monitored and overseen.

Like every billing system, AI-assisted billing tools can make mistakes. However, AI-assisted systems can scale those mistakes across thousands of claims, and the records those systems generate may make it easier for the government or relators to argue that a provider’s submission of those claims violated the FCA.

Read more

On June 4, 2026, Reps. Jay Obernolte and Lori Trahan released a discussion draft of the Great American Artificial Intelligence Act. The proposal has generated significant attention, but many organizations may be overestimating its practical significance for day-to-day operations. The bill is directed primarily at developers of “frontier” AI models, so its requirements will not apply. Nonetheless, the bill has sparked conversation. It incorporates multiple bipartisan bills on AI, its drafters wrote an op-ed calling on the U.S. to create a national framework covering AI, and the U.S. House Democratic Commission on AI and the Innovation Economy released a statement that the draft “does not meet the enormity of the moment.” Read on to learn more about the discussion draft, which companies should view as a planning signal rather than a reason to pause or modify governance efforts.

Read more