Privacy & Cybersecurity Law Blog

On April 22, 2026, the House Energy & Commerce Committee announced the introduction of and intention to advance the SECURE Data Act, to replace the patchwork of U.S. state consumer privacy laws with a single federal law.

As of April 22, 2026, organizations subject to the Children’s Online Privacy Protection Act (COPPA) must comply with the FTC’s 2025 amendments to the COPPA Rule.

On April 20, 2026, the California Privacy Protection Agency issued an invitation for preliminary comments on whether regulatory changes concerning notices and disclosures, and employee data, may be needed under the California Consumer Privacy Act and its implementing regulations.

On April 13, 2026, Kentucky Governor Andy Beshear signed into law HB 692, which amends the Kentucky Consumer Data Protection Act to add certain Smart TV data to the law’s definition of “sensitive data” effective July 1, 2027.

On April 17, 2026, Alabama Governor Kay Ivey signed into law the Alabama Personal Data Protection Act, taking effect on May 1, 2027, making Alabama the twenty-first state to enact a comprehensive consumer privacy law.

The California Privacy Protection Agency expects to conduct California Consumer Privacy Act compliance audits in 2026 as it builds out its newly created Audits Division, according Law360’s recent interview with the agency’s Executive Director, Tom Kemp.

On April 13, 2026, Virginia Governor Abigail Spanberger signed into law S.B. 388, which amends the Virginia Consumer Data Protection Act to prohibit the sale of geolocation data, effective July 1, 2026.

The U.S. Department of Health and Human Services’ Office for Civil Rights recently announced a settlement with health care software company MMG Fusion to resolve the company’s alleged noncompliance with the HIPAA Privacy, Security and Breach Notification Rules.

On March 25, 2026, New Jersey enacted a new law restricting health care facilities’ collection and disclosure of certain patient information, including immigration status, citizenship status, place of birth, Social Security number and individual taxpayer identification number.

On March 24, 2026, Washington Governor Bob Ferguson signed House Bill 2225, an Act regulating artificial intelligence companion chatbots.

On April 1, 2026, the U.S. Court of Appeals for the Seventh Circuit held that the 2024 amendment to Illinois’ Biometric Information Privacy Act, limiting damages, applies retroactively to pending cases.