-
3 weeks ago | 
mondaq.com | Liisa M. Thomas |Kathryn Smith
The Belgian Data Protection Authority recently ruled that a Belgian government entity, FPSFinance, cannot transfer the personal data of "accidentalAmericans" to the IRS. According to the decision, thetransfers needed to cease for several reasons. The case was brought by a dual US-Belgian citizen, who, while aUS citizen by birth, did not reside in the US or otherwise have anysignificant connections to the US (i.e., an "accidentalAmerican").
-
1 month ago | 
mondaq.com | Kristi L. Thomas |Kathryn Smith |James O'Reilly
The FTC's settlement with Cleo AI gives some indicationas to what we might see from the agency in the coming months. TheFTC alleged, among other things, that CleoAI's actions violated Section 5 of the FTC Act. In particular,as reported in our sister blog, Cleo AI requiredpeople to enroll in a paid subscription plan, even though theymarketed their services as free. It also made it difficult forpeople to cancel their subscription and made it hard to stoprecurring charges.
-
1 month ago | 
mondaq.com | Liisa M. Thomas |Kathryn Smith |James O'Reilly
The California Privacy Protection Agency announced this month that it, along with sixother states, will be forming a new group called the"Consortium of Privacy Regulators." (The other states areColorado, Connecticut, Delaware, Indiana, New Jersey, and Oregon.)Members include the Attorneys General from these states, as well asCalifornia's privacy regulator (the CPPA).
-
1 month ago | 
jdsupra.com | Kathryn Smith |Liisa M. Thomas
[co-author: James O'Reilly]*The California Privacy Protection Agency announced this month that it, along with six other states, will be forming a new group called the “Consortium of Privacy Regulators.” (The other states are Colorado, Connecticut, Delaware, Indiana, New Jersey, and Oregon.) Members include the Attorneys General from these states, as well as California’s privacy regulator (the CPPA).
-
1 month ago | 
natlawreview.com | Tori Kutzner |Liisa M. Thomas |Kathryn Smith |Katharine Weber
In Briskin v. Shopify, Inc., No. 22-15815, 2025 U.S. App. LEXIS 9410 (9th Cir. Apr. 21, 2025), the United States Court of Appeals for the Ninth Circuit, sitting en banc, held that the Canada-based company Shopify, Inc.
-
1 month ago | 
mondaq.com | Liisa M. Thomas |Kathryn Smith
Listen to this postArkansas' second attempt at regulating minor's access tosocial media – in the form of the Social Media Safety Act (SB 689) – hasagain been struck down as unconstitutional. The court permanentlyenjoined the state from enforcing the law. It was a modifiedversion of Arkansas' 2023 SB 396, that was also blocked. The plaintiff in both challenges wasNetChoice, a group familiar to anyone following kids' socialmedia laws.
-
2 months ago | 
jdsupra.com | Kathryn Smith |Liisa M. Thomas
[co-author: James O'Reilly]The New York Attorney General recently entered into an assurance of discontinuance with Root Insurance Company following a 2021 data incident. According to the AG, the threat actors obtained people’s drivers’ license numbers by exploiting a website error on its car insurance application portal.
-
2 months ago | 
mondaq.com | Liisa M. Thomas |Kirstin Smith |Kathryn Smith
Virginia's Governor, Glenn Youngkin, vetoed a bill this weekthat would have regulated "high-risk" artificialintelligence systems. HB 2094, which narrowly passed the state legislature, aimed toimplement regulatory measures akin to those established by lastyear's Colorado AI Act. At the same time, Colorado's AI ImpactTask Force issued concerns about the Colorado law, which may thus undergomodifications before its February 2026 effective date.
-
2 months ago | 
jdsupra.com | Kathryn Smith |Liisa M. Thomas
[co-author: James O'Reilly*]Utah’s governor recently signed the first law which puts age restrictions on app downloads. The law (the App Store Accountability Act, SB 142), was signed yesterday (Wednesday, April 26, 2025). We anticipate that the law may be challenged, similar to NetChoice’s challenge to the Utah Social Media Regulation Act and other similar state laws. Once in effect, the law will apply to both app stores and app developers.
-
2 months ago | 
mondaq.com | Liisa M. Thomas |Kathryn Smith
Oregon's Attorney General released a new report this month, summarizing the outcomessince Oregon's "comprehensive" privacy law took effect six months ago. A six-month reportisn't new: Connecticut released a six month report in February of last year toassess how consumers and businesses were responding to its privacylaw. The report summarizes business obligations under the law, andhighlights differences between the Oregon law and other, similarstate laws.
