The temperature of legal risk continues to rise for companies who provide online interactive features such as social media or mobile applications to minors, particularly in the 11th Circuit states of Georgia, Florida, and Alabama. On October 14, 2026, the U.S. Court of Appeals for the Eleventh Circuit vacated and reversed[1] a preliminary injunction on a Florida social media law, House Bill 3 of 2024 (more on the law below).

The decision comes alongside two related developments in the Eleventh Circuit. A day later on October 15, the Eleventh Circuit vacated a preliminary injunction[2] against a Georgia social media law, Senate Bill 351 of 2024, and returned the case to the district court. Meanwhile, Alabamaʼs House Bill 161 of 2026 is scheduled to take effect January 1, 2027. These laws share a child protection objective, but their coverage, age thresholds, and compliance requirements differ substantially.

Continue Reading Eleventh Circuit Developments: Decisions on Florida and Georgia Social Media/Minor Laws and New Alabama Law
anthropic image

On September 25, 2026, the U.S. Court of Appeals for the D.C. Circuit (D.C. Circuit) ruled that the Department of War (DoW) reasonably concluded Anthropic poses a supply chain risk under the Federal Acquisition Supply Chain Security Act (FASCSA).

Continue Reading D.C. Circuit Rules Pentagon Can Exclude Anthropic from Supply Chain

Since Vermont became the first state to regulate data brokers comprehensively, numerous states have followed suit. Substantial, dedicated regulation now exists in California, New Jersey, Oregon, Texas, and Vermont. Enforcement is growing.

Companies whose services involve selling, trading, or otherwise providing data about individuals with whom they do not have a direct relationship should carefully consider the applicability of these laws.

Continue Reading A Survey of Compliance Requirements for Data Brokers

Generative artificial intelligence is no longer on the sidelines of litigation.

Used thoughtfully, it can sharpen how attorneys manage complex matters, accelerate routine tasks, synthesizing disparate record evidence to identify common themes, patterns, and connections, and enhance trial readiness without compromising legal judgment. Used carelessly, it can hallucinate citations, expose proprietary information, and hand opposing counsel privileged content on a silver platter.

The upside is real. So is the downside.

Continue Reading Beyond the Prompt: The AI Sandwich and Other Practice Tips for Litigators

Over the past 12 months, more regulatory attention has been focused on protecting children online. In the U.S., states like California and New Jersey have recently enacted legislation designed to protect children from the dangers of AI tools like chatbots and companions, along with requiring age-appropriate design codes for online services accessible to children. On the international stage, regulators across the pond are contemplating similar legislation.

The European Commission published the proposed EU KIDS Act on September 17, 2026 (the Proposed Act). This proposal reflects the EU’s continuing effort to strengthen protections for children online by harmonizing existing EU requirements. The Proposed Act’s stated aim is to avoid a fragmented regulatory landscape that increases compliance complexity and, in turn, may impede companies’ ability to effectively protect children in practice.

While the EU KIDS Act has not yet been enacted, businesses should begin to familiarize themselves with the Proposed Act as this draft, or a version close to it, may ultimately become law.

Continue Reading Smiling Faces and Safer Online Spaces: An Overview of the Proposed EU KIDS Act

Recent developments in Delaware, California, and Texas highlight a common theme that privacy compliance risk is becoming more operational and technical and more likely to arise from practices that may once have appeared routine. (1) Delaware has expanded the reach and substantive requirements of its comprehensive privacy law; (2) California continues its focus on data brokers by bringing a Delete Act action against a data broker; and (3) the Texas Attorney General has warned businesses about a surge in CIPA website tracking demand letters.

Continue Reading Quick Update: Delaware Privacy Act Amendments, CCPA Data Broker Enforcement, and Texas Warning on CIPA Demand Letters

In the last few months, California and New Jersey enacted legislation to protect children online: California’s 13-bill package targets risks to children arising from emerging technologies, while New Jersey’s 3-bill package includes an age-appropriate design code. Despite their differences, these laws share a common focus on protecting children as technology evolves.

This post summarizes the key provisions of these new laws.

Continue Reading New Laws Target Youth-Facing AI and Online Services

We have been writing about the California Invasion of Privacy Act (CIPA) for a while now. From demand letters flooding our clients’ inboxes to the wave of class action filings targeting standard website tracking tools, this 1967 wiretapping statute has proven uniquely susceptible to claims that bear little resemblance to the covert surveillance it was originally designed to prevent.

On August 28, 2026, the California Legislature unanimously passed Senate Bill 690, and for businesses that have been on the receiving end of pen register litigation, the bill represents the most significant relief to date.

Here is what you need to know.

Continue Reading CIPA Reform Makes Its Way To Governor’s Desk

We have all become accustomed to seeing pop-up notices on our video calls saying that an AI-powered technology is recording us. Sometimes the AI service even appears as a participant. Notwithstanding how commonplace these features have become, a recent decision from a federal court in California may signal that such call transcription services present a risk of class action lawsuits.

Continue Reading AI-Powered Call Transcription Tools Present Class Action BIPA Risk

You bought cyber insurance because you knew a serious cyber theft could threaten the business you have spent years building.

Your company paid premiums year after year, maintained payment controls, and worked to protect its systems and financial information. No CEO expects perfect security or expects every loss to be covered by insurance. But a company that buys coverage for computer fraud, funds-transfer fraud, and social engineering reasonably expects the policy to matter when criminals compromise company communications and divert a seven-figure payment.

Insurance is supposed to be the company’s financial backstop when prevention fails. The company did not buy an insurance policy to debate technical definitions after a loss. It bought the policy to keep a sophisticated theft from becoming an uninsured loss, an unpaid vendor obligation, and another crisis for management.

This is how quickly a routine vendor payment can become a cyber crisis.

Continue Reading When Your Cyber Insurer Sends You in Circles: A Hacked CFO Email, a Stolen Vendor Payment, and the Coverage Maze That Can Follow