On August 11, 2026, the California Privacy Protection Agency (CalPrivacy) announced a Final Stipulated Order between Iowa-based data broker LocateSmarter LLC and the agency, requiring LocateSmarter to pay $116,490 and change its privacy practices. This marks the agency’s first-ever CCPA decision against a data broker, and the first arising from both violations of the Delete
Colorado Rewrites Its Landmark AI Law: Unpacking SB 26-189 and What It Means for Businesses
After attempting to amend its first-in-the-nation AI law for two years and three legislative sessions, on May 9, 2026, the Colorado legislature passed SB 26-189. It now awaits the governor’s signature and is expected to be signed into law, which will go into effect January 1, 2027.
California Issues Record $1.35M Fine Against Retailer for CCPA Violations
On September 30, 2025, the California Privacy Protection Agency (CPPA) issued a $1.35 million fine, the largest in the CPPA’s history, against Tractor Supply Company, the nation’s largest rural lifestyle retailer. The fine was issued based on allegations that the company violated its obligations under the California Consumer Privacy Act (CCPA). The CPPA coined its
The FTC Announces New Enforcement Actions Against Certain Businesses for Engaging in “Deceptive AI” Practices
- DoNotPay. The FTC brought suit against DoNotPay, which had claimed
CPPA’s Enforcement Update: New Regulations and Focus Areas
The California Privacy Protection Agency (“CPPA”) discussed at its July 16 meeting new enforcement focuses in addition to current goals. While the new focuses are largely in line with general trends, they also serve as a reminder that specific and nuanced compliance decisions can make a big difference.
As the CPPA has made clear in
2024 HIPAA Developments
Over the course of the past few months, the Office of Civil Rights (OCR) and the Office of the National Coordinator for Health Information Technology (ONC), both of which are divisions of the U.S. Department of Health and Human Services (HHS), have issued a series of new regulations and guidance related to the Health Insurance
California Attorney General Announces Settlement with DoorDash for CCPA and CalOPPA Violations
On February 21st, the California Attorney General (AG) Rob Bonta announced a settlement with DoorDash for violations of the California Consumer Privacy Act (CCPA) and the California Online Privacy Protection Act (CalOPPA) relating to its participation in a marketing co-operative. This action represents only the second public enforcement action since the CCPA went into effect
Ruling Delaying Enforcement of CPRA Regulations Raises Complicated Legal Questions
Shortly before the July Fourth holiday, the California Superior Court issued an important, but subtly complex ruling that pushes back the date when the California Privacy Protection Agency (CPPA) may begin enforcing the latest round of privacy regulations. These regulations were finalized in March 2023 and enforce provisions of the California Privacy Rights Act (CPRA)
FTC Challenge to Data Broker Precise Geolocation Sale Dismissed with Leave to Amend
In a ruling published May, 4, the Federal District Court of Idaho granted defendant data broker Kochava’s motion to dismiss a complaint filed by the Federal Trade Commission (“FTC”). In its complaint, the FTC alleged that Kochava’s sale of precise consumer geolocation data constituted an unfair act or practice in violation of Section 5 of
California Enforcement Sweep Targets Mobile Apps – With a Focus on Honoring “Permission Slip” App
On Friday, January 27, California Attorney General Rob Bonta announced an investigative sweep of businesses that provide mobile apps, issuing warning letters to those that AG Bonta alleges failed to comply with the California Consumer Privacy Act (CCPA). This sweep focused specifically on “popular retail, travel, and food service industry apps” that failed to comply