A new wave of comprehensive state privacy laws is on the horizon for 2026 and beyond. Alabama, Louisiana, Oklahoma, and Vermont have each enacted consumer data privacy statutes that will come online over the next few years, extending the patchwork and raising the stakes for multi‑state compliance programs.
Below, we provide the general thresholds for
On 29 July 2026, the UK’s Medicines and Healthcare products Regulatory Agency (“MHRA”) (the regulatory authority with responsibility for enforcing UK medical device rules) published new guidance on ambient voice technology-enabled products (“AVTs,” also known as ambient scribing tools) (“AVT Guidance”). The AVT Guidance is intended to clarify (and essentially overrule) a decision by NHS
California’s Delete Request and Opt-Out Platform (DROP) requirements went into effect on August 1, 2026, marking a meaningful operational shift for regulated data brokers and a clear reminder that enforcement of the Delete Act is no longer theoretical.
Separately, several other states have advanced their own data broker frameworks. New Jersey introduced an aggressive data
On August 5, 2026, Julia Jacobson, Partner (New York), and Joel Schwarz, Managing Partner, The Schwarz Consulting Group LLC, will present “Privacy and Online Safety Laws for Minors: Navigating Evolving Compliance, Business, and Technology Challenges.” This Strafford webinar will review the growing body of laws focused on the privacy and safety of minors
On August 2, 2026, the European Commission (EC), acting through its European AI Office (EU AI Office), became formally entitled to exercise its powers to investigate and enforce the EU AI Act obligations imposed on providers of general-purpose artificial intelligence (GPAI) models, as well as rules on prohibited AI practices. These powers are significant and
After I was asked the same question 3x in one day, and it’s one of the most common questions I get, I opted to make it today’s newsletter topic.
Drumroll please ….
What privacy framework should we adopt? NIST? ISO? Another one?
I want to say up front that frameworks are genuinely useful. We created
Seyfarth Synopsis: On Thursday 30 July, the European Commission issued a press release advising that EU AI Act enforcement begins this SUNDAY, 2 August 2026, when the Act’s transparency rules start to apply. Chatbots and other interactive AI systems need to be ready to identify themselves. Deepfakes and AI generated content needs to be labelled.
If you have heard of CIPA, BIPA, GIPA, or TCPA litigation, you may have an idea of where this post is headed. These acronyms reference federal and state laws that permit a private right of action for certain privacy-related claims, affording successful plaintiffs with statutory remedies. In a recent case, Bartholomew v. Parking Concepts
For much of the past two years, discussions regarding generative artificial intelligence (AI) in professional services seems to have focused on lawyers, and perhaps for good reason. Courts have sanctioned attorneys who submitted briefs containing fabricated case citations. In response to these and other mishaps, several state bars issued ethics opinions often applying existing professional