US privacy regulation: state patchwork, federal financial privacy, enforcement surge, TAKE IT DOWN Act
Key Questions
What enforcement action did California take under the CCPA against GM?
California imposed a $12.75M settlement on GM for CCPA violations. This highlights growing enforcement scrutiny and lessons for H2 compliance readiness.
What does the TAKE IT DOWN Act require now that it is in effect?
The TAKE IT DOWN Act, effective June 2026, targets deepfake exploitation. The FTC has issued guidance for platform compliance with its provisions.
Which states recently enacted or advanced comprehensive privacy laws?
Louisiana became the 22nd state with its LDPA effective January 2027, while Oklahoma is the 23rd with its law effective January 2027. Vermont and others have also advanced similar measures.
What changes did Connecticut make to its privacy law?
Connecticut overhauled the CTDPA with lower thresholds, data broker registration requirements, a geolocation ban, and surveillance pricing disclosures. This adds to the state patchwork.
How are New York and California addressing surveillance pricing?
Both states are pushing bills to ban dynamic pricing based on personal data. New York would become the third state after Maryland and Connecticut to implement such restrictions.
What does Iowa's age verification law (HF 864) require?
Iowa's HF 864 took effect July 1 and adds to the state patchwork with age verification mandates. Privacy provisions rely on company promises, raising breach and over-logging risks.
What federal privacy bill is under consideration for minors?
A federal bill targeting minors up to age 16 is under consideration, with expanded consent and deletion obligations. Another comprehensive bill, the Protecting Privacy and Consumer Data Act, could reshape preemption debates.
What concerns has the CCIA raised about Delaware's privacy law?
The CCIA has flagged issues with Delaware HB 380's broad 'sale' definition, treatment of national origin as sensitive data, and compelled DPA disclosures. These could create national compliance challenges.
CA $12.75M GM CCPA; FTC Take It Down Act; WA privacy laws (eff. Jul 1, 2026); Alabama HB 351; Maryland surveillance pricing ban; Delaware HB 380/381; Louisiana 22nd state; Oklahoma 23rd state; Erie County biometric law; GUARD Financial Data Act. Supreme Court upholds FCC's power to fine telecoms for data privacy violations (8-1). Meta adds facial recognition 'NameTag' to smart glasses. Connecticut overhauls CTDPA. Massachusetts passes privacy law banning sale of precise location data with private right of action. NJ cure letters, NY DFS cyber guidance. CCIA raises concerns over Delaware HB 380. Federal privacy bill targeting minors under consideration. Iowa age verification law (HF 864) effective July 1. NY and CA push back on surveillance pricing. New federal comprehensive privacy bill introduced (Protecting Privacy and Consumer Data Act). TAKE IT DOWN Act now in full effect (June 2026). Louisiana enacts LDPA. New: Vermont signs comprehensive data privacy law—4th state in 2026. New York again attempts consumer health privacy law targeting non-HIPAA data.