Privacy & Cybersecurity Law Blog

On October 29, 2026, a bipartisan coalition of attorneys general from 35 states and the District of Columbia announced that General Motors  agreed to pay $220 million to settle claims concerning its collection and sale of driver data through its Smart Driver program.

On November 6, 2026, the California Privacy Protection Agency (“CalPrivacy”) voted to advance proposed amendments to its regulations that would expand reporting requirements for opt-out preference signals and clarify that businesses must honor these signals before setting cookies or other tracking technologies.

On October 28, 2026, the Federal Trade Commission announced the agency had launched an inquiry into the use of personal information to set prices and employee compensation, issuing detailed requests for information to nine airlines, ride-sharing companies, and food-delivery firms.

On November 5 and 6, 2026, the California Privacy Protection Agency Board will hold a public meeting addressing consumer privacy rights and regulatory proposals.

California recently enacted AB 1979, which extends California’s Confidentiality of Medical Information Act to consumer-facing health care chatbots and limits how health care providers may use AI in clinical care.

Federal authorities arrested two U.S.-based facilitators and raided over 40 ‘laptop farms’ in Texas used by North Korean remote workers to generate more than $3 million for sanctioned weapons programs.

On October 21, 2026, Meta was ordered to pay New Mexico $25 billion after a jury found it violated state consumer protection laws through misleading statements about data privacy, misinformation, hate speech, community standards, and its oversight of app developers following the Cambridge Analytica matter.

On September 17, 2026, the European Data Protection Board adopted Guidelines 3/2025 on the interplay between the Digital Services Act and the EU General Data Protection Regulation.

The UK ICO published a report following its scrutiny of ten of the world’s largest artificial intelligence foundation model developers operating in the UK.

Portolano Cavallo reports that organizations have until October 29, 2026, to comply with the Italian Data Protection Authority’s guidelines on the use of tracking pixels in email communications.