Welcome to this month’s issue of The BR Privacy, Security & AI Download, the digital newsletter of Blank Rome’s Privacy, Security & Data Protection practice. We invite you to share this resource with your colleagues and visit Blank Rome’s Privacy, Security & Data Protection webpage for more information about our team.
RECENT HIGHLIGHT
Blank Rome vice chair of artificial intelligence Sharon R. Klein, partners Philip N. Yannella and Rachel L. Schaller, and associate Gabrielle N. Ganze authored this alert discussing a recent California court ruling and pending legislation which could significantly narrow CIPA website-tracking claims, offering businesses potential relief from online privacy lawsuits.
Read More»
STATE & LOCAL LAWS & REGULATIONS
California Legislature Passes CIPA Amendment to Curb Pen Register Tracking Lawsuits: The California Legislature unanimously passed SB 690, a bill that would amend the California Invasion of Privacy Act (“CIPA”) to restrict the private right of action for pen register and trap-and-trace claims arising from website tracking technologies. The number of lawsuits brought under Section 638.51 of CIPA, which prohibits the use of pen register and trap-and-trace devices to record noncontent information in electronic communications, has grown significantly in recent years. Consumers have flooded federal courts with proposed class actions accusing retailers, hospitals, and other website operators of violating CIPA by deploying tracking pixels and similar technologies that transmit visitors’ personal information to third-party advertisers. Under SB 690, only the California Attorney General would be authorized to bring actions for violations of CIPA’s pen register provision related to online tracker conduct. The bill would also apply retroactively, eliminating pending covered claims filed within the previous two years. The bill passed the Assembly 66-0 and the Senate 40-0 on August 28, 2026, and now awaits Governor Newsom’s signature. See our client alert for more detail.
New Jersey Enacts Kids’ Privacy Law with Private Right of Action: New Jersey Governor Mikie Sherrill signed the New Jersey Kids Code Act (A4015), establishing the New Jersey Age-Appropriate Design Code. The law imposes strict privacy and design requirements on “covered online service providers,” which are entities conducting business in New Jersey with annual gross revenue exceeding $25 million or that process personal data of at least 25,000 consumers or households and whose online services are reasonably likely to be accessed by individuals under 18 years of age. Key provisions require covered providers to configure default privacy settings to the highest level for minors; restrict push notifications, including a ban during school hours and overnight; prohibit targeted advertising for certain products, such as narcotics and alcohol; ban the use of dark patterns; and impose strict data minimization and retention limits. Providers must also take “all reasonable steps” to prevent compulsive use resulting from covered design features, which include infinite scroll, auto-playing media, and gamification. Notably, the law creates a private right of action for injured minors, with courts authorized to award $5,000 per violation or treble damages, punitive damages for reckless or knowing violations, and attorney’s fees. The Attorney General also retains enforcement authority under the state’s consumer protection law. The law takes effect on September 1, 2027.
California Passes Bill Regulating Attorneys’ Use of Generative AI: The California Legislature passed SB 574, a bill that would impose new obligations on attorneys and arbitrators using generative AI. The bill prohibits attorneys from delegating the practice of law to generative AI and requires attorneys who use generative artificial intelligence ("AI") to assist in practice to take reasonable steps to verify the accuracy of all AI-generated outputs, including case and statutory citations, and to correct any erroneous or hallucinated content. Attorneys would be barred from entering confidential, personally identifying, or other nonpublic information into generative AI systems where access to such information is not restricted to the attorney and authorized persons. The bill also requires attorneys to disclose the use of generative AI for all documents submitted to the court. Additionally, the bill prohibits arbitrators from delegating any part of their decision-making process to generative AI tools. SB 574 further amends the Code of Civil Procedure to prohibit any filing from containing citations that the responsible attorney has not personally verified, including citations generated by AI. The bill awaits Governor Newsom’s signature.
NYC Bar Committee Publishes Policy Paper on AI Use in Legal Practice: The New York City Bar Association’s Emerging Companies and Venture Capital Committee published a policy paper concluding that AI tools “may assist legal work but cannot substitute for professional legal judgment,” and calling for a national framework governing AI use in legal practice to be built into the Model Rules of Professional Conduct. The paper recommends that lawyers adopt firm-wide protocols and risk assessments, train lawyers and staff, disclose AI use to clients where appropriate, monitor standing orders in relevant jurisdictions, and designate a technology ethics officer. The paper identifies key risks for legal professionals using AI, including malpractice liability from unverified AI outputs, data privacy and confidentiality concerns when client information is input into AI platforms, AI-generated misinformation and hallucinations, model bias, and intellectual property issues. It emphasizes that lawyers remain subject to duties of competence, confidentiality, supervision, candor, and communication when using AI tools, and must independently verify all AI-generated content. The paper provides an illustrative framework rating common legal documents by AI suitability, noting that standard documents such as nondisclosure agreements and board minutes are highly suited for AI assistance, while complex merger and acquisition agreements and shareholder agreements require significant human oversight.
CCPA Deletion Rights Expanded by California Legislature: The California Legislature sent several privacy bills to the Governor’s desk at the end of August. SB 923, the Expanding Privacy Rights Act, amends the California Consumer Privacy Act ("CCPA") to expand consumers’ right to delete personal information beyond data collected directly from them, requiring businesses to also delete personal information obtained from data brokers and other third parties. The bill, sponsored by California Privacy Protection Agency (“CalPrivacy”), also requires online-only businesses to provide an online method, such as a web form, for consumers to submit privacy requests. Separately, AB 1542 would generally prohibit the sale or sharing of sensitive personal information, including precise geolocation, biometric, and health data, to third parties.
California Passes Bill Banning Addictive Social Media Features for Minors: The California Legislature approved AB 1709, which would prohibit covered platforms from providing “addictive features,” including algorithmic feeds, autoplay, and infinite scroll, to users under 16 years of age. The bill requires covered platforms to implement reasonable measures to ensure minors are not offered addictive features and to verify user age pursuant to California’s Digital Age Assurance Act. Platforms that fail to comply face civil penalties of up to $50,000 per affected minor for knowing violations and $25,000 per affected minor for negligent violations, enforceable exclusively by the Attorney General or a local public prosecutor. The legislation also establishes an independent e-Safety Advisory Commission within the Department of Justice ("DOJ"), tasked with advising state government on age assurance technologies, harmful design features, and protections for minors online.
Colorado Attorney General Publishes Proposed Rules for Automated Decision-Making Technology and Chatbot Safety Laws: The Colorado Attorney General’s Office filed proposed rules implementing two recently enacted statutes governing AI-driven technologies. Senate Bill 26-189, which repeals and reenacts the original 2024 Automated Decision-Making Technology Act, regulates the use of automated decision-making technology (“ADMT”) in consequential decisions such as lending, employment, housing, education, and insurance. The proposed rules define key terms, including “midstream developer,” “deploy,” and “process,” and establish detailed requirements for adverse outcome disclosures and consumer rights. House Bill 26-1263, the Chatbot Safety Act, imposes obligations on operators of consumer-facing conversational AI services, including age assurance requirements, persistent AI-disclosure obligations, protections for minors against sexually explicit content and simulated emotional dependence, suicide and self-harm response protocols, and annual reporting to the Attorney General. Both laws take effect on January 1, 2027. The formal comment period for the proposed rules is open through October 26, 2026, with early comments encouraged by September 4, 2026, to inform a revised draft expected by September 23, 2026.
California Governor Announces First-in-the-Nation AI Cyber Defense Program: California Governor Gavin Newsom announced a first-in-the-nation initiative directing state agencies to establish an AI Cyber Defense Program to protect critical infrastructure against emerging AI-enabled cyber threats. The program, housed within the California Cybersecurity Integration Center, will leverage AI for vulnerability detection, network hardening, and incident response. Key directives include expanding access to advanced cybersecurity capabilities for local governments and critical infrastructure partners, including AI-enabled defenses, and designating an AI Cybersecurity Officer in every state agency. The initiative builds on California’s 2023 and 2026 Executive Orders on AI and follows recent disclosures by leading AI developers that advanced AI systems independently carried out sophisticated cyber operations during controlled testing, exposing novel risks. The program also responds to growing threats from foreign adversaries, including suspected Iran-linked cyber operations targeting municipal water systems in multiple states. The announcement comes amid federal cybersecurity funding reductions, including a proposed $707 million cut to the Cybersecurity and Infrastructure Security Agency in the Trump administration’s Fiscal Year 2027 budget, the end of federal funding for the Multi-State Information Sharing and Analysis Center, and the uncertain future of the State and Local Cybersecurity Grant Program.
Washington Attorney General Releases First-Ever Data Privacy Report: Washington Attorney General Nick Brown released the state’s inaugural Data Privacy Report, examining the data economy’s incentive structures and their impact on consumer privacy. The report identifies four core concerns: overcollection and secondary use of personal information, weak consent requirements and deceptive design practices, the collection and sale of sensitive data such as biometrics and precise geolocation, and limited consumer visibility into data broker practices. Drawing on the Attorney General Office’s 2025 Data Breach Report, which documented 209 breaches affecting over 8 million Washington residents, with more than 80 percent exposing Social Security numbers, and a statewide survey in which 83 percent of respondents reported having little or no control over their personal information, the report advances eight recommendations across three categories. Policy recommendations include requiring meaningful informed consent, establishing data minimization requirements, strengthening protections for biometric and geolocation data, and mandating data broker registration with a centralized deletion mechanism modeled on California’s DELETE Act framework. On the enforcement front, the report calls for clear, practical, and accountable enforcement mechanisms and increased privacy capacity within state agencies.
FEDERAL LAWS & REGULATIONS
FTC Proposes Enforcement Policy Statement on Personalized Pricing: The Federal Trade Commission (“FTC”) issued a proposed enforcement policy statement addressing personalized pricing, the practice of using consumers’ personal data to set individualized prices based on a company’s estimate of how much a consumer is willing to pay. While noting that Congress has not granted the FTC authority to ban personalized pricing outright, the agency warned that it “intends to enforce the law aggressively” against deceptive or unfair personalized pricing practices under Section 5 of the FTC Act. The proposed statement emphasizes that where consumers reasonably expect prices will not vary based on their personal data, businesses must provide clear and conspicuous disclosures, including the fact that a price is personalized, the basis for that personalization, and the types of data used. The FTC outlined illustrative scenarios raising Section 5 concerns, including a food delivery company charging more based on data suggesting a consumer cannot leave home, or a grocery chain increasing prices based on household composition data. The proposed statement also warns that data collection, use, or disclosure for personalized pricing without adequate disclosures or verified consumer consent may independently violate Section 5. The statement was approved by the agency’s two active Republican commissioners, and the public comment period was extended through September 25, 2026. The FTC’s action comes amid escalating state-level activity, with New York poised to become the fourth state to ban surveillance pricing practices, following Maryland, Connecticut, and New Jersey.
Senate Committee Advances Health Data Privacy Bill: The Senate Health, Education, Labor, and Pensions Committee voted 22–0 to advance the Health Information Privacy Reform Act (S. 3097) to the full Senate. The bill directs U.S. Department of Health and Human Services (“HHS”), in consultation with the FTC, to promulgate privacy, security, and breach notification standards for “applicable health information” not currently covered by the Health Insurance Portability and Accountability Act ("HIPAA"), including data generated by consumer wearables, health applications, and other consumer health technologies. The proposed standards must be at least equivalent to existing HIPAA protections. Key provisions include data minimization requirements; individual rights to access, amend, delete, and port health data; restrictions on the sale of health information without individual consent; and a prohibition on transferring applicable health information to government entities absent compulsory legal process. The bill also requires HHS to issue guidance within one year on the application of the HIPAA “minimum necessary” standard to data used for AI and machine learning and establishes unified national de-identification standards with contractual prohibitions on re-identification. Enforcement would follow the existing HIPAA civil penalty framework, with HHS and the FTC required to enter a memorandum of understanding to coordinate oversight. The bill’s preemption framework mirrors existing HIPAA preemption rules. The bill’s prospects in the full Senate and House remain uncertain.
NIST Releases Concept Paper on Human-Centered Cybersecurity Guidelines: The National Institute of Standards and Technology (“NIST”) released a concept paper and accompanying blog post announcing its intention to develop guidelines and resources for “human-centered cybersecurity” (“HCC”), an approach that prioritizes people’s needs, abilities, and limitations when designing and implementing cybersecurity policies, processes, and technologies. The initiative responds to evidence that a substantial percentage of cyber data breaches are attributable to the “human element,” including unintentional errors such as falling for social engineering schemes, system misconfigurations, and insecure workarounds driven by difficult-to-use security tools. NIST’s concept paper identifies several themes drawn from extensive stakeholder engagement, including the observation that technology-centric approaches alone have not sufficiently addressed these risks, that overreliance on awareness training creates unrealistic expectations, and that few existing cybersecurity frameworks explicitly incorporate HCC practices. Proposed outputs include integration of HCC principles into existing NIST publications, standalone guidance documents, case studies, quick start guides, and training modules for cybersecurity professionals and organizational decision makers.
Treasury Announces Quantum-Readiness Task Force: The U.S. Department of the Treasury announced the launch of the Quantum-Readiness Task Force, a public-private initiative to accelerate the financial sector’s transition to quantum-safe cryptography. The Task Force follows Executive Order 14412, establishing guidelines to strengthen cryptographic protections for sensitive data, critical infrastructure, and the digital economy, and builds on the G7 Cyber Expert Group’s roadmap for post-quantum cryptography transition. Treasury Secretary Scott Bessent stated that the Task Force will help ensure “our financial system remains strong, secure, and competitive as new technologies reshape the global landscape.” The initiative will operate through three workstreams: Sector Alignment & PQC Transition; Third-Party & Vendor Readiness; and Digital Assets and Emerging Technology Risk. The Task Force will convene government agencies, financial institutions, financial market infrastructures, and technology providers to identify critical cryptographic dependencies, improve cryptographic agility, promote interoperability, and strengthen operational resilience. The Treasury emphasized that while quantum computing holds transformational promise, it poses significant long-term risks to the cryptographic tools that protect financial data, payment systems, digital identities, and market infrastructure, making the transition to post-quantum cryptography essential for U.S. economic security.
U.S. LITIGATION
New Jersey Supreme Court Holds No Mental State Required for Actual Damages Under Daniel’s Law: The New Jersey Supreme Court unanimously held in Atlas Data Privacy Corp. v. We Inform, LLC that Daniel’s Law, N.J.S.A. 56:8-166.1, does not require proof of any mental state for the imposition of actual damages. Daniel’s Law protects certain public officials, including judges, prosecutors, and law enforcement officers, by prohibiting the disclosure of their home addresses and unpublished phone numbers after receiving a written takedown notice, with a 10-business-day compliance window. Data broker defendants had argued that the statute’s lack of a mens rea requirement rendered it unconstitutionally overbroad and a strict liability provision. The Court found that the Legislature deliberately omitted a mental state for actual damages, noting that the Legislature included a “willful or reckless disregard” requirement for punitive damages in the very next subsection and removed “reasonable person” language from the actual damages provision in a 2022 amendment. The Court also rejected the argument that the 10-day notice period functions as a negligence proxy. Importantly, the Court declined to rule on Daniel’s Law’s overall constitutionality.
Federal Court Declines to Block California’s Restrictions on Personalized Social Media Feeds for Minors: A U.S. District Court in the Northern District of California denied motions by several prominent social media companies for a preliminary injunction against enforcement of key provisions of California’s Protecting Our Kids from Social Media Addiction Act (the “Act”). The Act prohibits operators from providing minors with algorithmically personalized feeds without verified parental consent and imposes default time limits of one hour per day. The platforms argued that their personalized feeds constitute expressive speech protected by the First Amendment. The court rejected this argument, finding that predictive algorithms that reflect users’ past behavior back to them are not “expressive” but function as “a mirror that reflects back to users their own perceived interests.” The Court distinguished personalized feed algorithms from content moderation policies, which remain exempt under the Act, holding that content moderation carries a “moral valence” reflecting editorial judgment, whereas personalization merely “fills in the blank” based on user data. The Court also rejected arguments based on users’ right to receive information and vagueness challenges to the term “verified parent.”
U.S. ENFORCEMENT
DOJ Secures $400 Million Settlement with Social Media Provider over Children’s Privacy Violations: The DOJ announced a $400 million settlement with TikTok, ByteDance, and affiliated entities resolving litigation alleging violations of the Children’s Online Privacy Protection Act (“COPPA”). The settlement requires TikTok to pay $300 million immediately and an additional $100 million upon vacatur of a 2019 consent decree entered against TikTok’s predecessor, Musical.ly. The DOJ’s complaint, filed in 2024 on referral from the FTC, alleged that TikTok knowingly allowed children under 13 to create accounts; collected personal information, including e-mail addresses; and website activity data for targeted advertising without parental notice or consent, and made it difficult for parents to request deletion of their children’s accounts.
CalPrivacy Brings First Combined CCPA and Delete Act Enforcement Action Against Data Broker: CalPrivacy announced a first-of-its-kind enforcement decision against LocateSmarter, LLC (“LocateSmarter”), an Iowa-based data broker, marking the first action against a data broker under both the CCPA and the California Delete Act. CalPrivacy’s Board ordered LocateSmarter to pay $116,490 in combined administrative fines. Fines included $30,600 for failing to timely register as a data broker and $79,890 for CCPA violations. The investigation revealed that LocateSmarter collected and sold sensitive consumer personal information, including names, Social Security numbers, addresses, and employment data, through licensing agreements and data products, without timely registering with CalPrivacy as required by the Delete Act. CalPrivacy found that LocateSmarter’s opt-out form required consumers to submit the last four digits of their Social Security number and mailing address before exercising their right to opt out of the sale of their personal information, violating the CCPA’s data minimization requirements and its prohibition against requiring verifiable consumer requests for opt-out rights. CalPrivacy emphasized that requiring sensitive personal information to exercise opt-out rights could intimidate consumers and suppress exercise of their privacy rights. The stipulated order also requires LocateSmarter to modify its opt-out methods, register as a data broker, process consumer deletion requests through CalPrivacy’s Delete Request and Opt-out Platform (“DROP”), and provide updated CCPA training to all personnel handling consumer requests.
Vermont Joins Bipartisan Coalition of Privacy Regulators to Strengthen Data Privacy Efforts: Vermont Attorney General Charity Clark announced that the state has joined the Consortium of Privacy Regulators, a bipartisan coalition of state privacy regulators and Attorneys General formed to share expertise, resources, and enforcement strategies for addressing potential violations of state privacy laws. Vermont’s participation follows the enactment of the Vermont Data Privacy and Online Surveillance Act, a comprehensive consumer privacy law signed in June 2026, which takes effect in 2028. Attorney General Clark emphasized that the consortium will bolster her office’s ability to enforce the law and hold companies accountable for privacy violations. With Vermont’s addition, the consortium now includes CalPrivacy and the attorneys general from California, Colorado, Connecticut, Delaware, Indiana, New Hampshire, New Jersey, Maryland, Minnesota, Oregon, and Vermont. The growing coalition reflects a broader trend of coordinated multistate enforcement activity in the consumer privacy space.
Connecticut Attorney General Announces Settlement with Tax Preparation Company Over Improper Sharing of Taxpayer Data: Connecticut Attorney General William Tong announced a $275,000 settlement with TaxAct, a Texas-based online tax preparation company, resolving allegations that TaxAct improperly shared sensitive taxpayer data with this party providers of digital advertising tools. Between January 2018 and December 2022, TaxAct deployed third-party tracking technologies for internal analytics and marketing purposes, disclosing detailed financial information, including rounded adjusted gross income, tax refunds and taxes owed, number of dependents, and whether taxpayers claimed charitable contributions, investment income, or mortgage and student loan interest, to the third-party providers without informing taxpayers. TaxAct’s contract with such third-party providers imposed no limits on their ability to use or further share the data, despite TaxAct’s privacy notices promising to safeguard consumer information. In addition to the financial penalty, the settlement requires TaxAct to establish a review committee with written policies governing approval of third-party tracking technologies, implement a tag monitoring system to regularly scan its website for compliance, and undergo two independent third-party audits of its tracking compliance program.
Alabama Attorney General Launches Investigation into Frontier AI Model Provider Over AI-Driven Hacking Incident: Alabama Attorney General Steve Marshall issued a subpoena to OpenAI following a July 2026 incident in which an experimental OpenAI AI agent escaped a purportedly isolated testing environment, gained unauthorized access to the internet, and conducted a multi-day hacking intrusion targeting AI company Hugging Face. The agent reportedly executed over 17,000 “attacker actions” and accessed credentials for four separate online services before Hugging Face independently detected the intrusion and reported it to the FBI. OpenAI was reportedly unaware its agent had escaped until notified by Hugging Face. The Alabama investigation, conducted under the state’s Deceptive Trade Practices Act, seeks to determine whether OpenAI’s lack of adequate safeguards violated consumer protection laws. The subpoena demands extensive documentation, including all materials relating to the intrusion, safety measures in place during model testing, prior incidents of unauthorized model behavior, and internal policies governing AI model evaluations. Alabama’s action follows a multi-state coalition letter from 15 Attorneys General demanding that OpenAI cease advanced exploitation testing of its models until it can demonstrate adequate safety controls.
Pennsylvania Attorney General Files Lawsuit Against Social Media Company for Failures to Protect Children: Pennsylvania Attorney General Dave Sunday filed a Complaint for Declaratory and Injunctive Relief against Snap, Inc. (“Snap”) in the Philadelphia Court of Common Pleas, alleging that Snapchat deceives consumers about the safety and age-appropriateness of its platform. The complaint, brought under the Pennsylvania Unfair Trade Practices and Consumer Protection Law, alleges that Snap misrepresents the nature and frequency of mature content, including sexual material, drug references, and profanity, available to users as young as 13 by self-selecting inaccurate age ratings in app stores. The complaint further alleges that Snapchat is intentionally designed to be addictive through features such as Snapstreaks, infinite scrolling, push notifications, auto-play video, and ephemeral content, and that Snap fails to disclose these risks to consumers. The Attorney General also alleges that Snap’s Family Center parental controls are deceptively marketed as effective safety tools despite providing limited functionality. The Commonwealth seeks declaratory and injunctive relief, civil penalties, and costs.
FTC Finalizes Orders Settling “Active Listening” AI Marketing Charges: The FTC finalized consent orders requiring Cox Media Group (“CMG”), MindSift LLC (“MindSift”), and 1010 Digital Works LLC (“1010 Digital Works”) to pay a combined $930,000 to settle charges that they deceived customers about an AI-powered “Active Listening” marketing service. The FTC alleged that the three companies falsely claimed to offer a service that used a special algorithm to capture conversations from consumers’ smart devices and target localized advertisements accordingly. In reality, the marketing service was not based on voice data, and consumers had never opted into such targeting. The FTC further noted that, had the service functioned as advertised, the collection and use of consumers’ voice data without adequate consent would itself violate the FTC Act. Under the final orders, CMG must pay $880,000, while MindSift and 1010 Digital Works must each pay $25,000, with funds used to provide redress to affected CMG customers. Each respondent is also prohibited from making misrepresentations regarding the features of its marketing services, the collection and use of voice data, consumers’ consent to voice data collection, and geographic targeting capabilities. The orders impose 20-year recordkeeping and compliance monitoring obligations.
INTERNATIONAL LAWS & REGULATIONS
EDPB Requests Review of EU-U.S. Data Privacy Framework Following Trump v. Slaughter: The European Data Protection Board (“EDPB”) sent a letter to European Commissioner Michael McGrath urging the European Commission to “closely assess” the impact of the U.S. Supreme Court’s June decision in Trump v. Slaughter on the EU-U.S. Data Privacy Framework (“DPF”). The Supreme Court overruled Humphrey’s Executor v. United States, holding that the statutory for-cause removal protections afforded to FTC Commissioners are unconstitutional, and that executive officers are subject to presidential removal at will. The EDPB highlighted that the FTC’s adequacy decision underpinning the DPF explicitly relied on FTC independence, including that FTC Commissioners could only be removed for “inefficiency, neglect of duty, or malfeasance in office.” The ruling has significant implications for transatlantic data flows, as the DPF relies on the FTC as an independent supervisory authority to ensure an essentially equivalent level of data protection for European Economic Area data subjects. Privacy advocates, including NOYB’s Max Schrems, have characterized the ruling as creating a “clash at the constitutional level” and signaled plans to challenge the DPF before the Court of Justice of the European Union. Others, however, argue that the FTC has not retreated from its enforcement commitments and that the ruling does not necessarily undermine other transfer mechanisms such as standard contractual clauses and binding corporate rules.
EU AI Act Enforcement Begins with New Transparency Requirements: Beginning August 2, 2026, the European Commission’s AI Office, together with national authorities, began enforcing the EU Artificial Intelligence Act (“AI Act”). Under the new rules, chatbots and other interactive AI systems must disclose to users that they are interacting with AI rather than a human, and deepfakes, images, videos, or audio generated or altered using AI, must be labeled. AI-generated or altered content must also carry machine-readable marks to facilitate detection. The AI Office can now enforce rules applicable to providers of general-purpose AI (“GPAI”) models, including the most advanced models that may pose systemic risks. All GPAI providers must document certain information, implement a copyright policy, and publish a sufficiently detailed summary of training content. Enforcement also extends to prohibited AI practices, including systems that manipulate people, exploit vulnerabilities, or engage in unfair social scoring. Responsibility for enforcement is shared among the AI Office, national competent authorities, and the European Data Protection Supervisor. To support enforcement, the AI Office launched a Complaint Tool, a Whistleblower Tool, and a dedicated downstream provider reporting channel. Over 180 organizations have signed the Code of Practice on transparency of AI-generated content. Rules on high-risk AI systems have been postponed to December 2, 2027, and new prohibitions on non-consensual sexually explicit AI-generated content and child sexual abuse material will apply starting December 2, 2026.
Alberta Amends Health Information Act with New Privacy and AI Obligations: Recent amendments to Alberta’s Health Information Act (“HIA”) came into force in June 2026, introducing significant new compliance obligations relevant to custodians and health information services vendors. Among the key changes, the amendments create a new compliance pathway for privacy impact assessments (“PIAs”). While the HIA has required custodians to complete PIAs since 2001 for any new or changed administrative practice or information system involving individually identifying health information, the amendments now permit “information managers,” including AI scribe tools, electronic medical record systems, and virtual care vendors, to submit their information security policies directly to the Office of the Information and Privacy Commissioner of Alberta (“OIPC”) for review and comment. This change addresses a longstanding practical challenge: information security policies and safeguards are frequently implemented by vendors rather than the custodians to which the HIA applies. Under the amended requirements, an information manager’s security policy must address privacy, security, and confidentiality risks; describe the functions and capabilities of the relevant information system; and outline the system’s privacy, security, and confidentiality safeguards. The amendments also address shared health information, de-identification standards, and AI-specific provisions.
Australia Publishes Exposure Draft Bill for Second Wave of Privacy Act Reforms: The Australian Attorney General’s Department released an exposure draft of the Privacy Amendment (Personal Data Protection) Bill 2026 (the “Bill”) alongside a consultation paper seeking stakeholder feedback on approximately 40 proposed reforms to the Privacy Act 1988. The package represents the second major tranche of privacy reforms, following the passage of the Privacy and Other Legislation Amendment Act 2024. Key proposals include replacing existing obligations with a single “fair and reasonable” test for the collection, use, and disclosure of personal information, supported by legislated factors such as reasonable expectations, data minimization, genuine choice, and the best interests of children. The Bill would modernize core definitions, including “personal information,” “sensitive information,” and “consent,” and classify precise geolocation tracking data and genomic information as sensitive information. Other significant provisions include a right to erasure applicable to large digital platforms (organizations with $500 million or more in gross revenue or 2.5 million average monthly users), a mandatory 72-hour data breach notification period, formal controller-processor obligations, simplified direct marketing rules with opt-out requirements, and enhanced powers for the Office of the Australian Information Commissioner. The consultation period is open until September 18, 2026.
RECENT PUBLICATIONS & MEDIA COVERAGE
All Bets Are Off: Artificial Intelligence and the New Class Action Frontier
Blank Rome partner Daniel R. Saeedi will serve as a panel moderator at the American Bar Association Litigation Section’s 2026 Class Actions National Institute, being held October 29 through 30, 2026, in Las Vegas, Nevada.
© 2026 Blank Rome LLP. All rights reserved. Please contact Blank Rome for permission to reprint. Notice: The purpose of this update is to identify select developments that may be of interest to readers. The information contained herein is abridged and summarized from various sources, the accuracy and completeness of which cannot be assured. This update should not be construed as legal advice or opinion, and is not a substitute for the advice of counsel.