Over the past 12 months, more regulatory attention has been focused on protecting children online. In the U.S., states like California and New Jersey have recently enacted legislation designed to protect children from the dangers of AI tools like chatbots and companions, along with requiring age-appropriate design codes for online services accessible to children. On the international stage, regulators across the pond are contemplating similar legislation.

The European Commission published the proposed EU KIDS Act on September 17, 2026 (the Proposed Act). This proposal reflects the EU’s continuing effort to strengthen protections for children online by harmonizing existing EU requirements. The Proposed Act’s stated aim is to avoid a fragmented regulatory landscape that increases compliance complexity and, in turn, may impede companies’ ability to effectively protect children in practice.

While the EU KIDS Act has not yet been enacted, businesses should begin to familiarize themselves with the Proposed Act as this draft, or a version close to it, may ultimately become law.

Continue Reading Smiling Faces and Safer Online Spaces: An Overview of the Proposed EU KIDS Act

Recent developments in Delaware, California, and Texas highlight a common theme that privacy compliance risk is becoming more operational and technical and more likely to arise from practices that may once have appeared routine. (1) Delaware has expanded the reach and substantive requirements of its comprehensive privacy law; (2) California continues its focus on data brokers by bringing a Delete Act action against a data broker; and (3) the Texas Attorney General has warned businesses about a surge in CIPA website tracking demand letters.

Continue Reading Quick Update: Delaware Privacy Act Amendments, CCPA Data Broker Enforcement, and Texas Warning on CIPA Demand Letters

In the last few months, California and New Jersey enacted legislation to protect children online: California’s 13-bill package targets risks to children arising from emerging technologies, while New Jersey’s 3-bill package includes an age-appropriate design code. Despite their differences, these laws share a common focus on protecting children as technology evolves.

This post summarizes the key provisions of these new laws.

Continue Reading New Laws Target Youth-Facing AI and Online Services

We have been writing about the California Invasion of Privacy Act (CIPA) for a while now. From demand letters flooding our clients’ inboxes to the wave of class action filings targeting standard website tracking tools, this 1967 wiretapping statute has proven uniquely susceptible to claims that bear little resemblance to the covert surveillance it was originally designed to prevent.

On August 28, 2026, the California Legislature unanimously passed Senate Bill 690, and for businesses that have been on the receiving end of pen register litigation, the bill represents the most significant relief to date.

Here is what you need to know.

Continue Reading CIPA Reform Makes Its Way To Governor’s Desk

We have all become accustomed to seeing pop-up notices on our video calls saying that an AI-powered technology is recording us. Sometimes the AI service even appears as a participant. Notwithstanding how commonplace these features have become, a recent decision from a federal court in California may signal that such call transcription services present a risk of class action lawsuits.

Continue Reading AI-Powered Call Transcription Tools Present Class Action BIPA Risk

You bought cyber insurance because you knew a serious cyber theft could threaten the business you have spent years building.

Your company paid premiums year after year, maintained payment controls, and worked to protect its systems and financial information. No CEO expects perfect security or expects every loss to be covered by insurance. But a company that buys coverage for computer fraud, funds-transfer fraud, and social engineering reasonably expects the policy to matter when criminals compromise company communications and divert a seven-figure payment.

Insurance is supposed to be the company’s financial backstop when prevention fails. The company did not buy an insurance policy to debate technical definitions after a loss. It bought the policy to keep a sophisticated theft from becoming an uninsured loss, an unpaid vendor obligation, and another crisis for management.

This is how quickly a routine vendor payment can become a cyber crisis.

Continue Reading When Your Cyber Insurer Sends You in Circles: A Hacked CFO Email, a Stolen Vendor Payment, and the Coverage Maze That Can Follow

This is the third installment in our coverage of the Anthropic/Department of War dispute. Our first alert addressed the Trump administration’s February 27 directives barring federal contractors from using Anthropic and its Claude platform, including Secretary Hegseth’s designation of Anthropic as a supply chain risk to national security and the resulting requirement that all DoW contractors sever commercial ties with the company. Our second alert covered the March 26 preliminary injunction, in which Judge Lin found Anthropic had demonstrated a likelihood of success on the merits and was suffering irreparable harm from the challenged actions. This post covers where things stand now following the latest Federal Court ruling.

The Ruling

On August 27, 2026, U.S. District Judge Rita F. Lin of the Northern District of California granted summary judgment largely in favor of Anthropic PBC, ruling that the DoW’s designation of the company as a supply chain risk to national security was “illegal and baseless.” In a 59-page order, Judge Lin concluded that the designation was not based on any credible threat, but was instead retaliation for Anthropic’s public criticism of the Trump administration’s position during contract negotiations over the use of its AI model, Claude.

Continue Reading Federal Court Rules Government’s Anthropic Supply Chain Designation Was Unlawful Retaliation: What Government Contractors Need to Know

In Mid-August, Taft published the latest edition of The Big Long List of U.S. AI Laws. The list now includes over 60 entries focused on the commercial regulation of AI by the states.

Persistent rumors to the contrary, AI law compliance is anything but a detail and triviality.

There is nothing particularly glamorous about notifying your job applicants of your AI, putting disclaimers on your chat bot, conducting risk assessments, disclosing data sources, developing policies, or ensuring contracting standards. But, increasingly, requirements such as these are required or advisable under law for a growing number of particular AI applications. Businesses which develop and deploy AI without considering the growing list of compliance issues carefully do so at their own risk.

Continue Reading Big Long List of AI Laws – Notable Updates

On August 2, 2026, the EU AI Act (the AI Act) entered a new implementation phase with two key developments: (i) the European Commission’s AI Office and Member State authorities began enforcing applicable AI Act requirements, including the rules for general-purpose AI (GPAI) models; and (ii) the AI Act’s Article 50 (transparency obligations) also took effect, requiring certain providers and businesses using AI to disclose when people are interacting with AI. Although the AI Act entered into force over two years ago, August 2026 marks a new chapter in its implementation. Businesses should expect increased regulatory oversight and scrutiny of AI developed, offered, or used in the EU.

Continue Reading Enforcement and Transparency Obligations Under the EU AI Act are Now in Effect

A new wave of comprehensive state privacy laws is on the horizon for 2026 and beyond. Alabama, Louisiana, Oklahoma, and Vermont have each enacted consumer data privacy statutes that will come online over the next few years, extending the patchwork and raising the stakes for multi‑state compliance programs.

Below, we provide the general thresholds for each law and a few additional key takeaways.

Continue Reading Coming Soon Near You: New Privacy Laws in Alabama, Louisiana, Oklahoma, and Vermont