On October 6, 2026, the Colorado Department of Law released the newest draft of its Automated Decision-Making Technology (ADMT) and Conversational AI Service Rules (the “Revised Draft Rules“). This revised draft builds on the initial draft published on August 11, 2026, and provide updated guidance on the Colorado ADMT Act, previously known as the Colorado AI Act.

The Revised Draft Rules differ in notable ways from the initial draft. Perhaps most importantly, whereas the initial draft solicited input on the threshold issue of the definition of materially influence and de minimis. While the standard chosen is closer to the standard contained in the CCPA’s ADMT regulations, the Revised Draft Rules contain several important differences, including a rebuttable presumption. The Revised Draft Rules make other important changes to the consumer rights rules, including relating to adverse outcome contents, standards for reviewers, and how consumer rights are structured. 

The Colorado Attorney General will hold a public hearing on the Revised Draft Rules on October 26, 2026. Organizations subject to the Act should review the latest draft closely ahead of the hearing.

On September 30, 2026, Governor Gavin Newsom signed Senate Bill 690, the product of a multi-year push to curb abusive litigation under the California Invasion of Privacy Act (CIPA). As previously reported, SB 690 cleared the Senate and Assembly on August 28. The law eliminates the private right of action for alleged violations of Cal. Penal Code § 638.51, CIPA’s pen register and trap-and-trace provision. It takes effect January 1, 2027, and applies retroactively for two years.

The enactment has drawn plenty of enthusiasm, but the final law is far narrower than the original bill and is not expected to meaningfully reduce abusive CIPA litigation. Governor Newsom acknowledged as much in his signing message: “[A]dditional work in this area is needed, as CIPA contains other decades-old statutes that are also susceptible to abuse by overly aggressive litigants. I urge the Legislature to take this on next year to ensure a fair balance between protecting private information and preventing rapacious litigation.” The question now is whether the Legislature will answer that call in 2027.

On August 21, 2026, the California Court of Appeal issued a tentative ruling in Variety Media, LLC v. Superior Court (Case No. B350578), tackling a question businesses have been asking for years: does the California Invasion of Privacy Act’s (CIPA) pen register provision reach everyday website tracking tools like cookies and pixels?

At nearly the same moment, the California Legislature was finalizing Senate Bill 690, which would eliminate the private right of action under that same provision. Together, these developments might look like relief for businesses. They aren’t—at least not fully.

The Status of Senate Bill 690

The most significant of the two developments is the unexpected rise of amended SB 690. A broader bill was sidelined last year, but after a wave of demand letters—often from self-represented (pro se) claimants—threatening businesses with lawsuits over alleged pen register violations, the Legislature introduced an amended bill that would eliminate private lawsuits under CIPA’s pen register/trap-and-trace provision, leaving enforcement solely to the California Attorney General. The bill also includes a retroactivity provision reaching claims filed within two years before it takes effect.

SB 690 passed the Assembly Appropriations Committee 15-0 on August 13, cleared the Assembly on August 28, and was approved by the Senate that same day. It’s now undergoing final administrative review before heading to the Governor’s desk.

The Tentative Ruling in Variety Media

Just a week before amended SB 690 reached the Assembly floor, the California Court of Appeal issued a tentative ruling in Variety Media, holding that CIPA’s “pen register” definition is technology-neutral, meaning it can extend beyond telephone equipment to internet communications—a setback for businesses that have argued CIPA was never meant to reach cookies or analytics tools.

The ruling was not entirely unfavorable to businesses: the plaintiff still lost on the specific claim. The court held that a pen register must capture information about where a communication is headed, not where it originated. Because an IP address identifies the visitor’s device—the source, not the destination—the claim failed as pleaded.

That doesn’t end the case. Assuming the Court of Appeal finalizes its tentative ruling without material changes, which seems likely based on the bench’s commentary at the August 25 oral argument, the plaintiff will still have an opportunity to amend the complaint.

A Paradigm Shift for CIPA Litigation? Not Really

Businesses have been eager for clarity on how CIPA applies to common website tracking practices. If SB 690 passes, plaintiffs will lose the ability to bring pen register or trap-and-trace claims. But does that end the wiretap litigation wave? Unfortunately, no.

Before pen register theories became popular, plaintiffs pursued website tracking claims under a different CIPA provision, Section 631(a). Expect a quick pivot back to that theory if SB 690 becomes law. Businesses should also watch for new claims under other privacy statutes and common-law theories. The legal label may change, but the underlying exposure won’t disappear.

If SB 690 doesn’t pass, attention shifts to the final ruling in Variety Media. Either way, the impact on the overall litigation landscape will likely be marginal—trial courts will still have to work out, case by case, whether a company’s tracking tools meet the technical definition of a pen register or trap-and-trace device.

Bottom line: litigation risk tied to web tracking technologies is evolving, not disappearing. Businesses that wait for a final court opinion or the Governor’s signature before assessing their exposure are already behind. They should take stock of their tracking practices now, understand where their specific risk lies, and be ready to act—regardless of which legal theory plaintiffs pursue next.

On August 11, 2026, the California Privacy Protection Agency (CalPrivacy) announced a Final Stipulated Order between Iowa-based data broker LocateSmarter LLC and the agency, requiring LocateSmarter to pay $116,490 and change its privacy practices. This marks the agency’s first-ever CCPA decision against a data broker, and the first arising from both violations of the Delete Act and the CCPA. CalPrivacy alleged that the data broker failed to register under the state’s Delete Act and violated the CCPA by requiring consumers to provide unnecessary data to the data broker, including the last four digits of their Social Security numbers and mailing addresses before they could opt out of the sale of their personal data. 

The settlement arrives at a pivotal moment for data brokers. In January 2026, CalPrivacy launched its Delete Request and Opt-Out Platform (DROP), allowing consumers to submit a single deletion request covering its now 600-plus registered data brokers. Brokers were required to begin processing DROP requests by August 1. Further enforcement over deletion and disclosure obligations is expected.

The Stipulated Final Order noted that given LocateSmarter’s requirement to share part of the consumer’s social security number to submit an opt-out request, it was “no surprise that only a tiny fraction of consumers submitted a request to opt-out of sale/sharing….” In its press release, CalPrivacy’s executive director, Tom Kemp, stated that a substantial fine was imposed “even though a mere handful of consumers submitted requests to opt out, underscoring the need for businesses to take privacy rights seriously for each and every Californian.”

There are a few important takeaways for businesses that collect and sell consumer data. First, this action shows that CalPrivacy intends to enforce the Delete Act just as DROP is launching—a significant fact given some of the technical and operational challenges to using DROP. Further, CalPrivacy appears to be signaling that it will impose substantial penalties even when only a handful of consumers are directly affected. In other words, CalPrivacy is not focusing only on the biggest players with the largest amount of requests. Finally, even if not subject to the Delete Act, businesses should review their CCPA compliance more generally, as CalPrivacy may be signaling quick enforcement on upcoming issues like privacy risk assessments and cybersecurity audits.

On August 11, 2026, the Colorado Department of Law published its much anticipated Automated Decision-Making Technology (ADMT) and Conversational AI Service Rules (the “Draft Rules”). The ADMT Draft Rules provide guidance on the newly amended Colorado AI Act.

The Draft Rules – which were required to be written on an expedited basis by the amended Act – cover various different issues that will be critical to deployer and developer compliance. Because the Colorado Act applies to various data sets that are exempted under the CCPA’s ADMT rules, the Draft Rules will be  a driver of AI policy more generally.

The Colorado Attorney General’s Office now invites formal rulemaking comments from all members of the public regarding the Draft Rules, and a public hearing will be held on October 26.

On July 20, 2026, another California federal court denied class certification in a putative privacy class action involving a company’s cookie-based advertising platform. Lewis v. Magnite, Inc., 2:25-cv-03448-MWC-SSC (C.D. Cal. July 20, 2026). The plaintiffs alleged that Magnite secretly installed tracking cookies—called “khaos IDs”—on users’ browsers to collect data for targeted advertising. The claims included violations of the federal Wiretap Act (ECPA) and California Invasion of Privacy Act (CIPA), among other privacy-based claims.

Why the Court Said “No” to Class Certification

The court found multiple fatal flaws in the plaintiffs’ certification bid:

  • Individualized consent issues. Because putative class members visited different websites with different privacy policies and cookie disclosures, each person’s consent (or lack thereof) required individual analysis. The court noted that determining what each user saw, agreed to, and understood would overwhelm any common questions.
  • Inability to know who’s in the class. The defendant operated pseudonymously—it didn’t know who was behind any given tracking ID. Users could have multiple IDs (different browsers, different devices), or multiple people could share the same ID. Without a workable method to identify class members, the class fell apart.
  • Standing problems. The court emphasized that a bare statutory violation isn’t enough to confer standing under Article III. Plaintiffs couldn’t show how privacy harms could be evaluated class-wide, especially when the defendant’s records showed it collected pseudonymous data as opposed to names, addresses, or emails.
  • No damages roadmap. Plaintiffs failed to show how damages could be calculated on a class-wide basis, which the court held was a prerequisite under Comcast Corp. v. Behrend.

What This Means for Your Business

This decision underscores that class certification in tracking and cookie cases is far from automatic. Courts are scrutinizing whether plaintiffs can demonstrate classwide harm, identify class members, and overcome individualized consent defenses. For companies that rely on advertising technology, the case offers both reassurance and a roadmap:

  • Robust privacy disclosures matter. Varied, site-specific privacy policies and cookie banners can create individualized consent questions that defeat predominance.
  • Pseudonymous data is a defense. If your tracking technology collects pseudonymous identifiers rather than personally identifiable information, plaintiffs may struggle to show concrete harm or even identify who belongs in a class.
  • Leverage these arguments early. As we previously highlighted, when facing a demand letter or class action complaint, decisions like Lewis v. Magnite should shape your defense strategy from day one—potentially avoiding costly discovery or settlement pressure.

On July 1, 2026, the California Assembly’s Committee on Privacy and Consumer Protection passed SB 690, a bill that would amend the California Invasion of Privacy Act (CIPA) to cut off the flood of litigation that has hit companies across industries for the last several years.

By way of background, dozens of states have passed comprehensive privacy laws to regulate website cookies and pixels. Despite that, plaintiffs have increasingly turned to wiretapping and pen register laws like CIPA—statutes never designed for online tracking—to bring thousands of lawsuits and arbitrations in recent years. Indeed, some pro se plaintiffs and firms appear to be sending thousands of demand letters a week, with courts expressing concern that it is approaching vexatious conduct.

SB 690 was introduced in 2025 to add a “commercial purpose” exception to CIPA, clarifying that the use of cookies and pixels on commercial websites does not constitute unlawful wiretapping or eavesdropping, nor does it constitute as a pen register. SB 690 overwhelmingly passed the California Senate last year, then stalled, apparently due to political and lobbying pressure.

At the July 1, 2026 hearing, the committee amended SB 690 in two significant ways.

First, the committee narrowed the “commercial purpose” exception to cover only “conduct occurring on an internet website, online application, or mobile application.” Such conduct would no longer be subject to CIPA’s private right of action. Enforcement would shift exclusively to the California Attorney General.

Second, and more consequentially, the “commercial purpose” exception would apply retroactively: it would reach pending claims in any lawsuit commenced within two years before SB 690’s operative date of SB 690, if it passes.

The California legislature now enters summer recess. SB 690 is expected to move to the Appropriations Committee in August. The Privacy and Consumer Protection Committee vote is welcome news for the business community, but the bill still has a long way to go—and plenty of time for political and lobbying groups to mount a fight. In the meantime, companies should continue to balance statutory and regulatory compliance, business needs, and risk mitigation efforts, while tracking SB 690’s progress.

In recent years, a handful of pro se plaintiffs and plaintiffs’ firms have sent tens of thousands of demand letters to businesses, threatening class action lawsuits under the California Invasion of Privacy Act (CIPA) unless those businesses pay settlements averaging $10,000 to $25,000.

The demands typically assert claims under CIPA arising from businesses’ alleged use of common tracking technologies on their websites. One of the most prominent theories is based on Section 638.51 of CIPA, which prohibits the installation of “pen registers” or “trap and trace” devices without a court order. The viability of this legal theory has not been squarely addressed by any appellate court yet—though appeals are pending, including in Variety Media, LLC v. Superior Court—and thus trial courts have mostly allowed pen register claims to survive early motions to dismiss. This has only emboldened plaintiffs. By some estimates, plaintiffs’ firms asserting these claims have used CIPA allegations to collect over half a billion dollars in settlement payments from businesses.

Businesses rallied for reform, but early efforts at a legislative fix—known as Senate Bill 690—seemingly stalled.

Last night, however, the California Assembly’s Committee on Privacy and Consumer Protection held a meeting that gave businesses a glimmer of hope. A long line of local and national business associations and community members appeared at the meeting to voice their strong support for a revised version of SB 690, which is more narrowly focused on stemming the tide of demands asserting claims under CIPA’s pen register provision. As amended, the bill contemplates a retroactive elimination of Section 638.51’s private right of action. The bill received 10 votes, with the vote left open for absent committee members. The tone of the discussion appeared cautiously optimistic. Both proponents and opponents seemed to recognize that work remains to be done, but that the bill could reach a point that would be tolerable for both sides.

The legislature enters its summer recess on adjournment on July 2, 2026, and reconvenes on August 3, 2026. For SB 690 to have any meaningful impact this year, it will need to be passed into law before the legislature adjourns on August 31, 2026.

Wiretapping class actions based on websites’ use of common tracking technologies continue to rise. And because many courts have allowed these cases to survive motions to dismiss, businesses often feel pressure to settle early—even when they have strong defenses.

Much of that pressure comes from the threat of a class wide judgment reaching eight or nine figures. However, a trend is emerging that could affect whether businesses should decide to defend instead of settle: courts are showing increasing skepticism that wiretapping claims are as suitable for class treatment as plaintiffs’ lawyers suggest.

A federal court in the Northern District of California recently denied class certification in Ingraham v. Capital One Financial Corp., No. 24-cv-05985-TLT (N.D. Cal. June 16, 2026). The plaintiffs alleged that tracking technologies used on the defendant’s website enabled third parties to intercept users’ personal and financial data without consent. The plaintiffs’ claims survived an early motion to dismiss. But when it came time to certify a class, the court said no.

The Problem (for Plaintiffs): Too Many Individual Questions

To certify a class under Federal Rule of Civil Procedure 23(b)(3), plaintiffs must show that common questions “predominate” over individual ones. In internet tracking cases, that’s proving difficult. The Ingraham court identified three independent reasons why individual issues overwhelmed common questions:

1. Data transmission varied by user. Different tracking technologies collected different types of data. Browser settings and user behavior affected what was shared. Even the named plaintiffs couldn’t agree on what information had been transmitted about them.

2. Consent required case-by-case analysis. Consent is central to claims under the California Invasion of Privacy Act (CIPA) and the federal Electronic Communications Privacy Act (ECPA). But consent turns on each user’s subjective understanding of the disclosures—and class members were exposed to different privacy policies depending on factors like California residency.

3. Standing demanded individualized proof. Article III standing—the constitutional requirement that a plaintiff demonstrate actual injury—required a fact-intensive inquiry for each class member: what data was shared, how it was shared, for what purpose, and whether that data was truly private.

A Pattern Is Emerging

Ingraham is not an outlier. It joins Calhoun v. Google LLC (N.D. Cal. June 2025), which denied certification on consent grounds, and In re Meta Pixel Tax Filing Cases (N.D. Cal. Mar. 2026), which cited individualized standing and statute of limitations issues. A pattern is emerging: even where tracking claims survive dismissal, the individualized nature of consent, data transmission, and standing creates significant barriers to class treatment.

The Takeaway

Almost every day, a business is served with a demand letter or lawsuit asserting claims based on the business’s use of tracking technologies on its website. When deciding whether to litigate or settle, the Ingraham decision should factor into the risk-benefit analysis. Contrary to what plaintiffs’ lawyers may suggest, class certification is far from guaranteed in internet tracking cases—and that means plaintiffs have risk, too. They face the prospect of spending years litigating a case that, if not certified, may never be economically viable. A reasonable settlement should account for both the business’s and plaintiffs’ risks. For businesses that haven’t yet faced such litigation, Ingraham offers some reassurance, but it’s far from a free pass. Internet tracking claims regularly survive early motions to dismiss. And in most jurisdictions, a ruling on class certification won’t come until years into the litigation. Companies using third-party tracking tools should take proactive steps to avoid litigation in the first place: assess disclosure practices, evaluate what data is being shared, and work with qualified counsel to ensure privacy policies align with current legal expectations.

Federal prosecutors recently brought insider trading charges against numerous attorneys, who were previously employed at various prominent law firms. The indictments in United States v. Nourafchan, No. 1:26-cr-10115 (D. Mass. 2026) and United States v. Fejal, No. 1:26-cr-10133-LTS (D. Mass. Apr. 2026) allege that these attorneys tipped off third parties about confidential M&A deals brought in by their law firms, enabling the third parties to profit from securities trades based on the information.

As discussed in further detail below, these recent insider trading cases (1) may test the boundaries of the First Circuit’s ruling in United States v. Abdelaziz, No. 21-1878 (1st Cir. 2023), which held that disparate defendants unaware of one another cannot be charged in a single conspiracy; and (2) offer important lessons about insider threats, third-party risk management, and the limits of traditional cybersecurity programs in preventing misuse by trusted insiders.

The “Varsity Blues” Conspiracy Defense

The decision in United States v. Abdelaziz is relevant to a potential defense that the defendants and Nourafchan and Fejal could raise in response to the conspiracy allegations. In Abdelaziz, two parents were convicted at trial of conspiracy to commit fraud and bribery, among other claims, as part of the broader “Varsity Blues” prosecutions—a series of federal cases that were brought against parents who allegedly bribed college officials to secure admission for their children. The defendants in Abdelaziz were charged alongside numerous other parents based on allegations that they participated together in a single overarching conspiracy.

The First Circuit vacated the conspiracy convictions finding that the government failed to prove an overarching conspiracy. The First Circuit further held that similar conduct by individual, disparate defendants who were unaware of and indifferent to one another does not establish a single conspiracy, and that joining such defendants in one case created an unacceptable risk that the jury convicted them based on others’ conduct rather than their own.

Given that the cases in Nourafchan and Fejal are both before the same federal district court that administered the underlying trial in Abdelaziz and include conspiracy claims against defendants employed at different firms but who engaged in similar conduct, the defendants may attempt to rely on the First Circuit precedent in Abdelaziz as a defense. 

Insider Threats Are a Data Governance Issue

Regardless of whether a defense based on the First Circuit’s ruling in Abdelaziz is successful, the indictments in Nourafchan and Fejal also serve as an important lesson that unauthorized use of information does not always originate from phishing campaigns, ransomware incidents, or network intrusions by external threat actors.

Unauthorized disclosure by insiders poses many of the same risks as those that result from external compromises. For example, insider misuse can similarly expose key company information such as intellectual property, strategies, active litigation or regulatory investigations, trade secrets, financial information, and other confidential business records that could be used in a manner to harm a company and its reputation. For example, the alleged conduct in Nourafchan and Fejal has the potential harm to both the law firms and their clients—including through reputational damage, litigation exposure, and regulatory scrutiny.

Relatedly, the allegations in these cases are evidence that a law firm’s reputation, size, or brand is not a substitute for implementing third-party risk management controls to protect confidential information once it is shared. Instead of relying on a service provider’s reputation, companies should evaluate the actual access controls, monitoring capabilities, incident response procedures, and insider threat safeguards providers have implemented.

Conclusion

The significance of the insider trading allegations in Nourafchan and Fejal extends well beyond the criminal charges. On the legal front, these cases may test the reach of the First Circuit’s Abdelaziz ruling. On the operational front, the cases illustrate how information security failures can emerge not only from sophisticated external attacks, but also from individuals operating within systems that lack sufficiently granular access controls and monitoring mechanisms.