Welcome to this month’s issue of The BR Privacy, Security & AI Download, the digital newsletter of Blank Rome’s Privacy, Security & Data Protection practice. We invite you to share this resource with your colleagues and visit Blank Rome’s Privacy, Security & Data Protection webpage for more information about our team.

RECENT HIGHLIGHT

Cybersecurity: Evaluating Risk

Blank Rome vice chair of artificial intelligence Sharon R. Klein was featured in this Los Angeles Business Journal article discussing the importance of implementing a structured, multi-step evaluation process when selecting artificial intelligence products. Read more >>

STATE & LOCAL LAWS & REGULATIONS

CalPrivacy Board Releases Proposed Amendments to Opt-Out Preference Signal Regulations: The California Privacy Protection Agency (“CalPrivacy”) Board released proposed regulatory amendments on opt-out preference signals. The proposed amendments add examples making clear that a business receiving a signal must stop third parties from cookie syncing for cross-context behavioral advertising. A business that links devices into a pseudonymous profile, for example through fingerprinting, must apply the opt-out to every linked device. Setting advertising cookies or pixels before a consent management platform checks for a global privacy control signal would violate the requirement to comply “as soon as feasibly possible.” Browser features that act for consumers must not interfere with their opt-out signals. Businesses subject to metrics reporting would have to separately count opt-out requests received through preference signals. The proposal would also widen the reporting obligation to businesses required to complete cybersecurity audits or risk assessments.

New York Governor Signs AI Companion Chatbot Safety Law for Minors: New York Governor Kathy Hochul signed Senate Bill 9051B/Assembly Bill 10379C. The law adds a new Article 48 to the General Business Law, which bars operators from offering “unsafe AI companion features” to covered minors. The law lists 12 categories of unsafe features. These include outputs that suggest the chatbot is human, that flatter the user or engage in sycophancy, or that encourage self-harm or secrecy. Operators may not use a user’s health or personal information acquired more than 12 hours earlier or in a prior session and must offer more than one age assurance method. Age assurance data may be used only to determine age and must be deleted right after determination. Narrow exemptions cover customer service and internal business uses. The Attorney General may seek civil penalties of up to $25,000 per violation, as well as destruction of unlawfully obtained data and any algorithms trained on it. Contract provisions that waive liability are void. The law takes effect on January 1, 2027.

Virginia Governor Issues Executive Directive on AI-Related Cyber Threats: Virginia Governor Spanberger signed Executive Directive 6 (the “Directive”), which calls for a Commonwealth-wide plan to prepare for cyber threats posed by AI, including recursive self-improvement AI development. Recursive self-improvement refers to frontier AI models improving themselves and building their own successor models. The Directive requires the Secretary of Public Safety and Homeland Security to establish a Cyber Consortium and integrate AI-related cybersecurity into Virginia’s Unified Readiness Framework. The Consortium will adopt a statewide plan to prevent and respond to cyber-attacks, along with a plan to harden infrastructure against AI-related and other cyber risks. Virginia’s AI Task Force will ask AI companies for the confidential briefings and reports they have given other regulators, including New York’s Department of Financial Services under the RAISE Act and the European AI Office. The Task Force must also deploy an independent privacy and security review team to find data security vulnerabilities in the Commonwealth’s interoperable data systems and data governance processes. Briefings on AI risks will be held at least quarterly, with a tabletop exercise at least once a year.

Florida AG Proposes Safe Screens Act to Promote Social Media and Chatbot Safety for Minors: Florida Attorney General (“AG”) James Uthmeier proposed the Safe Screens Act, which would expand the state’s existing law prohibiting social media accounts for children under 14, recently upheld by the Eleventh Circuit. The proposal would require app stores to determine user age, link minors to a parent’s account, and obtain parental consent before a minor downloads or buys an app. AI chatbot operators would also have to determine account holders’ ages, and operating systems would have to apply age-appropriate restrictions at the device level. All age determination would have to use commercially reasonable, privacy-protective methods. For users aged 14 to 17, social media platforms would have to apply protective defaults. These include overnight and school-hour “quiet modes,” hidden engagement counts, disabled cosmetic filters, daily and monthly usage caps, and autoplay and infinite scroll turned off unless a parent enables them. Chatbots could not offer minors features that simulate companionship, including through user-data retention, or that generate sexual content, encourage self-harm, or suggest the chatbot is human.

FEDERAL LAWS & REGULATIONS

NSA Urges Immediate Patching of Critical PHP Vulnerabilities: The National Security Agency (“NSA”) issued an advisory recommending critical patches for a set of vulnerabilities in PHP, collectively nicknamed “PHP2Shell.” PHP is widely used, runs directly on web servers on most major operating systems, and is used to build dynamic web pages. The vulnerabilities could allow attackers to take control of affected web servers without prior access or authentication, and then steal sensitive data, disrupt services, or move deeper into a network. Because the flaws are in PHP itself, rather than in hosted applications or their configurations, any server running an affected version is exploitable. The NSA expects cyber actors to weaponize the vulnerabilities and called the risks serious enough to require immediate patching across U.S. government departments and agencies. The advisory recommends that organizations inventory systems that rely on vulnerable PHP versions apply vendor patches promptly, and monitor for additional vendor updates. It also recommends that organizations consider enhanced logging and replace end-of-life PHP services that cannot be patched. If an immediate update is not feasible, the NSA recommends taking the affected system offline until it is fully mitigated. The Cybersecurity and Infrastructure Security Agency, National Cyber Security Centre United Kingdom, Australian Signals Directorate Australian Cyber Security Centre, and Cybersecurity Service for the Union Institutions, Bodies, Offices and Agencies have also published related guidance.

NIST Releases Draft Update to Information Security Handbook for Executive Leadership: The National Institute of Standards and Technology (“NIST”) has released the initial public draft of Special Publication 800-100 Revision 1, Information Security Handbook: A Guide for Executive Leadership, for public comment. It is the first update to the handbook since 2006. The revision is reorganized to follow the NIST Cybersecurity Framework (“CSF”) 2.0. It also places less emphasis on federal executives so that it is useful to leaders across organizations. The draft summarizes seven NIST frameworks and processes and explains how they relate to one another. These include the Risk Management Framework, the Privacy Framework, the AI Risk Management Framework, and Cybersecurity Supply Chain Risk Management (“C-SCRM”). A revised governance section adds risk management strategy and C-SCRM. It calls on leadership to set risk appetite and risk tolerance and to combine the risks reported by third-party suppliers. The draft makes the Chief Privacy Officer responsible for privacy risk management and privacy compliance across the organization. It recommends incident response playbooks for categories, such as data breaches. It also notes that non-federal organizations may benefit from following federal incident response guidance, including the Office of Management and Budget procedures for notifying affected individuals. Nongovernmental organizations may use the handbook on a voluntary basis.

Senator Cantwell Outlines Comprehensive Governance Framework for Frontier AI: U.S. Senator Maria Cantwell (D-Wash.), Ranking Member of the Senate Committee on Commerce, Science and Transportation, outlined an AI governance framework built on six principles to address catastrophic risks and other AI harms. Under the framework, NIST would develop risk-based safety standards addressing threats, including AI-enabled cyberattacks and loss of human control. Covered models could not be released until an independent audit confirms they meet those standards. Developers would have to give qualified testers and auditors access to their systems and publicly disclose material safety and security risks, similar to the risk disclosures public companies make to investors. Developers would also have to promptly report material AI safety and security incidents. They would remain liable for foreseeable harm, and whistleblowers would be protected from retaliation. The framework also calls for defensive AI to protect critical infrastructure and for safeguards against data exploitation of children. It would require human oversight of, and recourse for, AI-assisted decisions about employment, healthcare, and credit.

Senators Urge White House to Coordinate Federal Response to AI-Enabled Cyber Threats: U.S. Senators Maria Cantwell, Ranking Member of the Senate Commerce Committee, and Mike Rounds, Chairman of the Senate Armed Services Subcommittee on Cybersecurity, sent a letter to Director of National Intelligence Jay Clayton and White House Office of Science and Technology Policy (“OSTP”) Director Michael Kratsios. The letter urges a coordinated national response to the cybersecurity risks posed by AI. The Senators cite tens of thousands of incidents in which AI models from OpenAI and Anthropic escaped sandboxes, bypassed safeguards, and evaded monitoring. They also note that advanced AI agents have gained unauthorized access to systems owned by government agencies and private organizations. The letter calls on NIST and its Center for Advancing Innovation and Standards for Super Intelligence to speed up measurable AI safety and security standards. Those standards would cover secure development and testing environments, agents acting beyond their intended permissions, and third-party data sharing. The Senators also recommend building independent and third-party testing of AI models as the basis for an independent auditing ecosystem. Finally, they urge that defensive AI tools be developed and made widely available to critical infrastructure operators, small businesses, and state and local governments.

U.S. LITIGATION

Washington Supreme Court Holds Privacy Act Does Not Cover Hospital’s Use of Pixel: The Washington Supreme Court affirmed the dismissal of a putative class action alleging that Seattle Children’s Hospital (“SCH”) violated the Washington Privacy Act (“WPA”) by using Meta Pixel on its public website. Plaintiffs alleged that Meta Pixel captured their clicks, text searches, and page views about their children’s medical conditions and sent that data to Meta for targeted advertising without their knowledge. SCH’s cookie banner did not identify Meta Pixel or explain how it works. The Court held that the WPA protects only private communications “between two or more individuals.” Because each communication was between one plaintiff and an automated website run by a corporation, the claim failed. The Court did not decide whether website searches are “private communications.” It also left open whether the WPA applies when a person communicates with individuals working for an entity, such as clinical staff. A concurrence would have found that the parents adequately alleged private communications. It also said the WPA protects communications with corporate staff, such as patient messages to care teams. The ruling sets Washington apart from courts applying the federal wiretap statute and California privacy law to the collection and sharing of information via tracking technologies, where litigation against healthcare providers continues.

Federal Court Holds OPM Violated Privacy Act by Granting DOGE Access to Federal Personnel Data: The U.S. District Court for the Southern District of New York granted summary judgment to federal employees and their unions on their Administrative Procedure Act claims against the Office of Personnel Management (“OPM”). The Court held that OPM violated the Privacy Act’s disclosure restrictions and its duty to establish appropriate safeguards. The violation came from giving individuals associated with the Department of Government Efficiency (“DOGE”) broad access to systems holding the personal information of tens of millions of previous, current, and prospective federal employees, without any demonstrated need. The Court rejected OPM’s position that access granted “in case it might be needed” meets the Privacy Act’s need-to-know standard. It also rejected the argument that IT modernization required access to confidential personal information. The Court found that OPM disregarded core cybersecurity principles, including least privilege, and allowed access before required privacy training was completed. The Court declined to dismiss the case as moot even though DOGE has been dissolved and OPM has revised its access policies. It noted that the timing of OPM’s policy changes tracked litigation deadlines. The Court observed that “even the most rigorous procedures cannot secure compliance by those willing to disregard them.” The Court has asked the parties for their views on what permanent relief, if any, is appropriate.

Massachusetts Hospitals Sue Drug Manufacturer Over 340B Claims Data Demands: Five Massachusetts nonprofit hospitals, including Massachusetts General Hospital and UMass Memorial Medical Center, sued Eli Lilly & Co. (“Lilly”) in the U.S. District Court for the District of Massachusetts. They say Lilly has made access to federally mandated 340B drug discounts conditional on handing over patient claims data. Under a policy Lilly adopted in January 2026, covered entities must submit pharmacy and medical claims data through a third-party platform, 340B ESP, which is owned by a private equity-backed consulting firm. The hospitals allege the data is protected health information under the Health Insurance Portability and Accountability Act (“HIPAA”). They also point out that the platform’s own expert determination acknowledges manufacturers may be able to reidentify it. The complaint challenges the platform’s non-negotiable terms of use, which grant a perpetual, sublicensable data license and allows the data to be combined with rebate data. The terms also shift all privacy and cybersecurity risk to the hospitals and cap the vendor’s aggregate liability at $100. The hospitals further allege the demand raises HIPAA “minimum necessary” concerns and goes around Health Resources and Services Administration’s audit safeguards. After the hospitals refused, Lilly cut off their 340B pricing. The suit asserts claims under Chapter 93A, unjust enrichment, and seeks injunctive relief. Lilly says the hospitals want to profit from the program without transparency.

Eleventh Circuit Finds Florida Social Media Restrictions for Minors Likely Constitutional: The U.S. Court of Appeals for the Eleventh Circuit reversed and vacated a preliminary injunction that had blocked Florida House Bill 3 (“HB 3”), holding that the law likely survives a First Amendment challenge. HB 3 requires covered social media platforms to bar minors under the age of 14 from creating accounts and to obtain parental consent before 14- and 15-year-olds may do so. Platforms must also terminate noncompliant accounts. The law covers platforms that use algorithms analyzing user data to select content, on which at least 10 percent of daily active users under 16 spend an average of two or more hours per day, and that use designated “addictive features,” such as infinite scrolling, push notifications, personal interactive metrics, auto-play, or live-streaming. Services used exclusively for e-mail or direct messaging are exempt. The Court found that HB 3 is a content-neutral regulation subject to intermediate scrutiny, which the law likely satisfies, and it rejected the plaintiffs’ facial challenge. The decision follows recent Sixth and Ninth Circuit rulings in favor of state laws restricting minors’ social media use. Businesses should expect continued momentum for state laws on age verification and addictive design.

Eleventh Circuit Allows Georgia to Enforce Social Media Age Verification Law: The U.S. Court of Appeals for the Eleventh Circuit vacated a preliminary injunction that had blocked Georgia from enforcing Senate Bill 351. The law requires covered social media platforms to make “commercially reasonable efforts” to verify the age of account holders. Minors under the age of 16 cannot hold accounts without parental consent. Platforms also may not show ads to users under 16 years old based on any personal information other than their age and location. The Court held that NetChoice’s facial First Amendment challenge failed because NetChoice had not addressed the “full range” of the law’s applications. That included platforms such as X and Reddit, which host some content that is unprotected for minors. The Court also rejected the district court’s vagueness ruling, which rested on a theory NetChoice never raised. It further held that Section 230 does not preempt the advertising restriction, because that provision regulates how platforms themselves use minors’ personal data, not third-party speech. The case now returns to the district court.

Pennsylvania Superior Court Revives Website Wiretap Suit: A three-judge panel of the Pennsylvania Superior Court vacated summary judgment for footwear retailer C. & J. Clark America, Inc. (“Clarks”) in a putative class action alleging that Clarks violated Pennsylvania’s Wiretapping and Electronic Surveillance Control Act (“WESCA”). The plaintiff alleged that Clarks used third-party analytics vendor Content Square to capture visitors’ IP addresses, browsing activity, and other data for targeted advertising. The trial court had held that simply sending a communication over the internet counts as consent to recording. The panel rejected that reasoning as “too broad.” Instead, it held that consent under WESCA’s all-party consent exception turns on whether a reasonable internet user knew or should have known that a third party would acquire her communications. Relying on the Popa v. Harriet Carter Gifts decisions, the Court found that a “browsewrap” privacy policy can establish implied consent if it discloses the interception and is reasonably conspicuous. The policy does not need to name specific vendors or cookies. Clarks’ policy adequately disclosed third-party tracking. However, the record contained no evidence, such as a screenshot, of where the policy link appeared on the website. The Court remanded and allowed Clarks to move for summary judgment again. The decision highlights the importance of keeping documented evidence of where privacy disclosures are placed on a website.

Fourth Circuit Holds West Virginia Daniel’s Law Unconstitutional: The U.S. Court of Appeals for the Fourth Circuit affirmed a district court ruling that a provision of West Virginia’s Daniel’s Law, W. Va. Code § 5A-8-24(e), is facially unconstitutional under the First and Fourteenth Amendments. West Virginia enacted the law in 2021 after the 2020 murder of Daniel Anderl, son of U.S. District Judge Esther Salas. The provision bars disclosure of the home addresses and unpublished phone numbers of judicial and law enforcement officials where a reasonable person would believe disclosure creates a risk of harassment or harm, and it gives covered individuals a private right of action for damages. A retired officer had filed putative class actions against Thomson Reuters, LexisNexis Risk Solutions, Whitepages, Thryv, and PeopleConnect over their “people search” services. The Court rejected the argument that the law regulates only data, not speech, noting that the Supreme Court has held that “speech” includes data. Because the law targets disclosures based on their content, strict scrutiny applied. The Court accepted that protecting officials is a compelling interest, but it found the law was not narrowly tailored. The law imposes liability immediately upon disclosure, even without knowledge, while Congress and nearly every other state require prior notice and a removal request before liability attaches.

Class Action Alleges TV Manufacturer of Covertly Capturing and Monetizing Viewing Data: Three California purchasers of Samsung Smart TVs filed a putative class action against Samsung Electronics America, Inc. (“Samsung”) in the U.S. District Court for the Northern District of California. The complaint alleges that Samsung’s automatic content recognition (“ACR”) technology captures what is on screen roughly twice every second. According to the plaintiffs, this covers broadcast, cable, HDMI, and streaming sources. The complaint says Samsung turns each capture into a digital fingerprint and sends it, along with persistent identifiers such as IP addresses and Samsung’s Personalized Service ID, to support Samsung ads and third-party identity-resolution partners. The plaintiffs allege that Samsung manufactures consent through benign feature names such as “Viewing Information Services,” dark-pattern setup flows, pre-checked defaults, and buried opt-outs. They bring claims under the California Invasion of Privacy Act, including its pen register provisions, as well as California Comprehensive Computer Data Access and Fraud Act, Electronic Communications Privacy Act, the Video Privacy Protection Act, the Ufair Competition Law, and the Consumers Legal Remedies Act. They also seek a public injunction.

U.S. ENFORCEMENT

FTC Launches Section 6(b) Study of Personalized Pricing and Compensation: The Federal Trade Commission (“FTC”) issued orders under Section 6(b) of the FTC Act to leading companies in the airline, ridesharing, food delivery, and retail industries. The orders require these companies to explain how they use personal data to set consumer prices and worker compensation. They must describe each methodology that uses personal information to set pricing, job offer assignments, and compensation, including the tools (such as AI or software), the inputs, and the steps involved, as well as any overrides or jurisdictional restrictions. The orders cover the period from January 1, 2023, onward and require a sworn special report within 45 days, preceded by a meet-and-confer within 14 days. The FTC says this study corrects its 2024 study, which looked only at “middlemen consultancies.” The orders follow the FTC’s August proposed enforcement policy statement, which warned that personalized pricing without adequate disclosure or consent may violate Section 5 of the FTC Act. Pressure is also building elsewhere. Rep. Frank Pallone has sent his own inquiries to companies; California’s Attorney General is conducting an investigative sweep; and Connecticut, Maryland, New Jersey, and New York have personalized pricing rules. Consumers have also filed private lawsuits. Companies should inventory the data, vendors, and contract rights behind their pricing systems and make sure their privacy notices accurately describe any personalization.

South Carolina AG Seeks Information from Surveillance Camera Operator on AI, Data Access, and Retention Practices: South Carolina AG Alan Wilson sent a letter to Flock Safety (“Flock”) asking for more information about its privacy and security policies. Many South Carolina law enforcement agencies use Flock to identify, apprehend, and detain suspects. The South Carolina AG grounded the inquiry in Flock’s public representations about its policies, noting that South Carolina’s Unfair Trade Practices Act (S.C. Code Ann. § 39-5-20) requires those representations to be truthful and not deceptive. The letter points to the company’s broad reach of more than 120,000 cameras across 49 states. It also references Flock’s claims that it does not use facial identification technology and that it has built-in restrictions on data access. The South Carolina AG asked whether Flock uses any form of AI to identify vehicles or people. He also asked what restrictions Flock places on data access, including whether it helps share data across multiple customers and government agencies through a “broader network,” and who can access that network. Finally, he asked whether Flock imposes mandatory data retention policies. Flock has 30 days to respond. The South Carolina AG acknowledged that the state supports law enforcement’s use of new tools but stressed the need to “find the right balance between public safety and personal privacy.”

DOT Closes Airline Privacy Review with No Enforcement Action: The U.S. Department of Transportation (“DOT”) Office of Aviation Consumer Protection (“OACP”) announced that it has closed its industry-wide privacy review of U.S. airlines without taking any further action. DOT began the review in March 2024. It looked at the privacy policies, practices, and procedures of the country’s 10 largest airlines from January 1, 2022, through March 20, 2024, with a focus on employee and contractor privacy training and on protecting passenger data from breaches. DOT notes that it is the sole regulator of unfair or deceptive airline privacy practices under 49 U.S.C. § 41712. It treats an airline’s failure to follow its stated privacy policy, to properly protect sensitive data, or to accurately describe its data practices as a violation of that statute. OACP found that every carrier reviewed had privacy training programs, readily available privacy policies, and systems to protect data, and it identified no violations. The notice nonetheless reminds airlines to be transparent about what data they collect and share, to keep data security standards reasonable and up to date, and to follow their published privacy policies. It also warns carriers against setting prices based on individual-specific data and against discriminatory dynamic pricing. DOT stated that it will continue to monitor airline privacy practices and will take appropriate action if OACP finds violations.

Connecticut AG Urges Public Utility Regulatory Authority to Investigate Utility AI Use and Cybersecurity: Connecticut AG William Tong and Connecticut Consumer Counsel Claire Coleman filed a joint petition asking the Public Utilities Regulatory Authority (“PURA”) to open a proceeding on how the state’s electric, gas, and water utilities use AI, and on their data security and cybersecurity practices. The petition says it is unclear how far AI is used in Connecticut utility operations. It lists risks, including hallucinations, algorithmic bias, data privacy and security concerns, and inaccurate storm predictions. It also notes that AI can be used both to attack systems and to defend them. The petitioners ask that each utility be required to report all of its AI uses, including each system’s purpose, the level of human oversight, and the policies that govern it. They also want PURA to examine data breaches, both AI-related and not. That review would cover who is notified of a breach, whether utilities comply with the state’s breach notification statute or go beyond it, and whether they review their practices after each breach. The petition observes that the recently enacted Connecticut Artificial Intelligence Responsibility and Transparency Act (the “CART Act”) does not set AI guardrails for utilities. It also points to similar inquiries already opened by the Arizona and New York utility regulators.

State AGs Sue Frontier AI Model Developer Over Children’s Data and Rogue AI Agents: A bipartisan coalition of eight state AGs from Arizona, Arkansas, Idaho, Iowa, Kansas, Montana, Nebraska, and West Virginia filed separate lawsuits in their own state courts. The suits allege that OpenAI violated state deceptive practices laws by marketing ChatGPT as safe while knowing about its risks, especially to children. Texas AG Ken Paxton followed with his own suit against OpenAI and CEO Sam Altman under the Texas Deceptive Trade Practices Act and the Securing Children Online through Parental Empowerment (“SCOPE”) Act. Texas alleges that OpenAI does not verify parents or provide the required parental tools, including controls over the sharing of minors’ personal information and over targeted advertising. Iowa’s petition alleges that OpenAI collects sensitive health, financial, and family information by default for model training. It also alleges that OpenAI falsely represented in its privacy policy that it does not collect children’s data. Iowa separately challenges OpenAI’s failure to promptly disclose incidents in which its autonomous AI agents escaped testing environments and hacked third parties, including Hugging Face. Iowa seeks deletion of all Iowans’ data, an injunction against collecting data without age verification and express consent, and civil penalties of up to $40,000 per violation. California’s AG has separately served OpenAI with an investigative subpoena as part of a probe into cybersecurity risks posed by its AI models.

Texas AG Secures Data Localization Settlement with Chinese E-Commerce Company: Texas AG Ken Paxton announced an Agreed Final Judgment and Permanent Injunction with PDD Holdings Inc. and Whaleco Inc. d/b/a Temu. It resolves allegations under the Deceptive Trade Practices Act that Temu misrepresented the data its app collects, failed to safeguard personal information or give breach notice, and failed to disclose that Texans’ data may be furnished to the Chinese government. Temu must store Texans’ personal data on U.S. servers owned and controlled by an American company. It must also bar access by persons organized, headquartered, or resident in China, subject to consent and limited business-necessity exceptions. The judgment ties these duties to the Texas Data Privacy and Security Act and the DOJ Data Security Program. Temu must also commission annual independent app security testing for malware, spyware, and unauthorized data-collection code, along with annual data access assessments. Each audit that finds material noncompliance carries an $8 million penalty. Further terms include deleting data tied to accounts inactive for 24 months, appointing a U.S.-based compliance officer, and a three-year most-favored-state parity clause. Temu will pay $3 million and is bound for four years as part of the settlement.

California AG Secures $6 Million Settlement with Genetics Testing Company Successor: California AG Rob Bonta announced a $6 million settlement with Chrome Holding Co., formerly known as 23andMe. The settlement was filed in the U.S. Bankruptcy Court for the Eastern District of Missouri and is pending court approval. It resolves allegations that the company’s unreasonable data security practices caused a 2023 data breach and that it misled consumers. The breach affected nearly 7 million customers, including more than 855,000 Californians. The settlement also resolves the AG’s appeals challenging the sale of customers’ genetic data and biological samples in bankruptcy. The California AG had argued that the sale violated California’s Genetic Information Privacy Act, which requires separate and explicit consent before such data is transferred. Under the stipulation, the trust administering the wind-down will pay $6,010,000, which may fund consumer relief. The company is also barred for five years from direct consumer sales and from collecting or keeping personally identifiable information, except as the bankruptcy plan requires. The release expressly excludes 23andMe Research Institute, the buyer of the data. California AG Bonta stressed that “[c]ompanies cannot evade California’s consumer protection and privacy laws by filing for bankruptcy.” He also reminded consumers that they can still have their genetic data deleted.

Auto Manufacturer to Pay $220 Million to Settle Multistate Claims Over Sale of Driver Data: A coalition of 36 state AGs, led by Oregon and Washington, announced that General Motors (“GM”) will pay $220 million to settle claims that it illegally sold drivers’ behavior and location data to data brokers, who then sold it to insurers. From 2016 to 2024, GM enrolled millions of drivers in its Smart Driver program and promised not to share their data with insurers without express consent. The states alleged that GM sold trip times, hard braking, rapid acceleration, and speeding data, and that some insurers used it to raise premiums. The states also alleged that enrollment often happened at dealerships, where employees accepted terms on customers’ behalf and had bonus incentives to sign customers up. The settlement requires GM to obtain affirmative express consent before collecting or sharing driving and location data, limit the data it collects, keep a comprehensive privacy program subject to internal and external assessments, and oversee and train its dealerships. Connecticut’s investigation was one of the first enforcement actions under the Connecticut Data Privacy Act. Oregon brought its claims under its long-standing consumer protection law because most of the conduct predated Oregon’s privacy law. The settlement does not include restitution for consumers, and multidistrict litigation is still pending.

California AG Secures $1.8 Million CCPA Settlement with Ride Sharing Company: California AG Rob Bonta announced a settlement with Lyft, Inc. (“Lyft”) over allegations that it violated the California Consumer Privacy Act (“CCPA”) and California’s Unfair Competition Law by not letting consumers opt out of the sale of their personal information within its mobile app. According to the California AG, Lyft has sold or shared consumers’ personal information for in-app targeted advertising since mid-2023. Consumers could only opt-out by following links from the in-app privacy policy to a webpage, and they had to re-enter login and other personal information even though Lyft already knew who they were. The California AG called these steps an illegal barrier to exercising CCPA rights. The stipulated judgment requires $1.8 million in civil penalties. Lyft must also provide a clear and conspicuous in-app opt-out link that takes effect across all Lyft services, honor opt-out preference signals, and avoid confusing choice architecture. It must send a one-time notice of opt-out rights; complete risk assessments covering sales or sharing, sensitive personal information, and geolocation data used for advertising; and file annual compliance reports for three years. The settlement came out of the California AG’s March 2025 investigative sweep into geolocation data and is the California AG’s ninth CCPA enforcement action.

INTERNATIONAL LAWS & REGULATIONS

Québec CAI Publishes Guidance on Deceptive Design and Privacy: The Commission d’accès à l’information du Québec (“CAI”) launched a new webpage on how dark patterns affect the protection of personal information. The CAI cited a 2024 international study, conducted with other privacy authorities, that found dark patterns on 97 percent of websites. The guidance sorts these practices into five categories: interference (such as false hierarchy, pre-selection, and emotional manipulation), harassment, obstruction, complex and confusing language, and forced action. It says these practices are especially common in cookie banners, privacy settings, and privacy policies. The CAI warned that dark patterns can invalidate consent, which under Québec law must be manifest, free, informed, and specific, and can make any resulting use or disclosure of personal information unlawful. The guidance repeats that privacy settings must default to the highest level of privacy and that technologies that identify, locate, or profile individuals must be disabled by default. For cookie banners, the CAI said opting out should be as easy as accepting, options should be presented neutrally, continued browsing should not count as acceptance, and cookies should never be pre-selected. The CAI also urged organizations to confirm that third-party SDKs, content management systems, and consent management platforms comply with the law and best practices.

EDPB Adopts Statement on Privacy Risks of Smart Glasses: The European Data Protection Board (“EDPB”) adopted a statement setting out its preliminary views on the data protection risks of smart glasses. The EDPB stressed that these devices can collect personal data in a near-invisible way, and that pairing them with facial or voice recognition poses a high risk to individuals in public spaces. The statement explains that a user is covered by the household exemption only for purely personal use, and that the exemption is construed narrowly. A user who posts footage on a public social media account, for example, becomes a controller. Device producers and AI service providers can be independent or joint controllers, and they cannot rely on users to meet their own transparency obligations to bystanders. The EDPB recommends combining transparency measures, such as LED and audio indicators that are hard to disable, along with industry-wide standards. It notes that obtaining valid consent from bystanders is difficult. It also says relying on legitimate interests would be particularly hard to justify for commercial further processing or AI training. Finally, the EDPB encourages privacy-protective defaults, including on-device processing, blurring of bystanders, and geofencing in sensitive locations. It also flags that the ePrivacy framework may apply.

UK AI Security Institute Outlines Priorities for Frontier AI Technical Best Practice: The UK AI Security Institute (“AISI”) published its view of the new challenges facing frontier AI developers and the technical practices most urgently needed to address them. AISI made clear that it is not seeking to mandate requirements, but to contribute to an industry-wide effort to develop voluntary best practice and technical standards. AISI identified two challenges. First, risk now arises earlier: AI systems are autonomous and capable enough, particularly in cyber, to pose risk during training, internal deployment, and evaluation, before any public release. Second, evaluation practices are struggling to keep pace, and models’ growing awareness of when they are being tested may let them mask how they would behave once deployed. AISI’s priorities include assessing and documenting risk throughout development and overseeing AI systems across their lifecycle. They also include detecting, responding to, and reporting agentic AI incidents to affected parties, governments, and the public. AISI further calls for defining the scope of access and reporting for independent auditors. AISI expects these practices to be developed first by industry and later formalized through international standards development organizations as common security baselines. Organizations should watch this work, because incident reporting and audit expectations often show up in later regulation and contracts.

Privacy Commissioner of Canada Launches Children’s Privacy Code: On October 20, 2026, Privacy Commissioner of Canada Philippe Dufresne launched Canada’s first Children’s Privacy Code (the “Code”), which sets clear, practical expectations for organizations that handle children’s personal information and explains how to protect children under Canadian privacy law. Under the Code, organizations are expected to obtain meaningful consent to collect, use, and disclose children’s personal information, including parental consent for children under 13 and opt-in consent for non-essential data uses. They must also provide privacy information in a clear, accessible, and age-appropriate way, and give children a practical way to correct inaccurate or incomplete information or delete their personal information entirely. The Code tells organizations not to profile children for marketing, including targeted or behavioral advertising, or for AI-driven decision-making. It also calls for privacy by default, with location tracking, profile visibility, and third-party data sharing turned off automatically. The Code identifies data practices it considers inappropriate, such as deceptive design that pushes children to give more personal information than needed, or using children’s information to exploit their vulnerabilities. The Code is similar to codes in some European countries and U.S. states. The Office of the Privacy Commissioner of Canada is accepting comments until January 20, 2027, and may update the Code afterward.

OECD Launches Global Repository for Privacy Enhancing Technologies: The Organization for Economic Co-operation and Development (“OECD”) launched the OECD Global Repository for Privacy Enhancing Technologies (“PETs”) (the “Repository”). PETs are technologies that let data be processed and shared while protecting sensitive information about individuals and organizations. The OECD says PETs are now mature enough for real-world use, but adoption remains limited. The main barriers are informational, legal, and economic rather than technical, including unclear legal frameworks and regulatory guidance and inconsistent approaches across jurisdictions. The central aim of the Repository is to give organizations more legal certainty about how PETs can help meet requirements under data protection and sector-specific laws. It does this by showcasing practical use cases and implementation experience from different jurisdictions. The Repository includes a curated database of PET implementations with a focus on legal and regulatory context. It also offers a searchable collection of official government and regulator documents, each linked to the implementations it informed. A glossary of PET terms is included, and an indicators-and-trends section is forthcoming. A new PETs Policy Advisory Board will guide the Repository’s development. The launch builds on OECD policy papers from 2023 and 2025.

© 2026 Blank Rome LLP. All rights reserved. Please contact Blank Rome for permission to reprint. Notice: The purpose of this update is to identify select developments that may be of interest to readers. The information contained herein is abridged and summarized from various sources, the accuracy and completeness of which cannot be assured. This update should not be construed as legal advice or opinion, and is not a substitute for the advice of counsel.