Since Vermont became the first state to regulate data brokers comprehensively, numerous states have followed suit. Substantial, dedicated regulation now exists in California, New Jersey, Oregon, Texas, and Vermont. Enforcement is growing.

Companies whose services involve selling, trading, or otherwise providing data about individuals with whom they do not have a direct relationship should carefully consider the applicability of these laws.

Continue Reading A Survey of Compliance Requirements for Data Brokers

Generative artificial intelligence is no longer on the sidelines of litigation.

Used thoughtfully, it can sharpen how attorneys manage complex matters, accelerate routine tasks, synthesizing disparate record evidence to identify common themes, patterns, and connections, and enhance trial readiness without compromising legal judgment. Used carelessly, it can hallucinate citations, expose proprietary information, and hand opposing counsel privileged content on a silver platter.

The upside is real. So is the downside.

Continue Reading Beyond the Prompt: The AI Sandwich and Other Practice Tips for Litigators

Over the past 12 months, more regulatory attention has been focused on protecting children online. In the U.S., states like California and New Jersey have recently enacted legislation designed to protect children from the dangers of AI tools like chatbots and companions, along with requiring age-appropriate design codes for online services accessible to children. On the international stage, regulators across the pond are contemplating similar legislation.

The European Commission published the proposed EU KIDS Act on September 17, 2026 (the Proposed Act). This proposal reflects the EU’s continuing effort to strengthen protections for children online by harmonizing existing EU requirements. The Proposed Act’s stated aim is to avoid a fragmented regulatory landscape that increases compliance complexity and, in turn, may impede companies’ ability to effectively protect children in practice.

While the EU KIDS Act has not yet been enacted, businesses should begin to familiarize themselves with the Proposed Act as this draft, or a version close to it, may ultimately become law.

Continue Reading Smiling Faces and Safer Online Spaces: An Overview of the Proposed EU KIDS Act

Recent developments in Delaware, California, and Texas highlight a common theme that privacy compliance risk is becoming more operational and technical and more likely to arise from practices that may once have appeared routine. (1) Delaware has expanded the reach and substantive requirements of its comprehensive privacy law; (2) California continues its focus on data brokers by bringing a Delete Act action against a data broker; and (3) the Texas Attorney General has warned businesses about a surge in CIPA website tracking demand letters.

Continue Reading Quick Update: Delaware Privacy Act Amendments, CCPA Data Broker Enforcement, and Texas Warning on CIPA Demand Letters

In the last few months, California and New Jersey enacted legislation to protect children online: California’s 13-bill package targets risks to children arising from emerging technologies, while New Jersey’s 3-bill package includes an age-appropriate design code. Despite their differences, these laws share a common focus on protecting children as technology evolves.

This post summarizes the key provisions of these new laws.

Continue Reading New Laws Target Youth-Facing AI and Online Services

We have been writing about the California Invasion of Privacy Act (CIPA) for a while now. From demand letters flooding our clients’ inboxes to the wave of class action filings targeting standard website tracking tools, this 1967 wiretapping statute has proven uniquely susceptible to claims that bear little resemblance to the covert surveillance it was originally designed to prevent.

On August 28, 2026, the California Legislature unanimously passed Senate Bill 690, and for businesses that have been on the receiving end of pen register litigation, the bill represents the most significant relief to date.

Here is what you need to know.

Continue Reading CIPA Reform Makes Its Way To Governor’s Desk

We have all become accustomed to seeing pop-up notices on our video calls saying that an AI-powered technology is recording us. Sometimes the AI service even appears as a participant. Notwithstanding how commonplace these features have become, a recent decision from a federal court in California may signal that such call transcription services present a risk of class action lawsuits.

Continue Reading AI-Powered Call Transcription Tools Present Class Action BIPA Risk

You bought cyber insurance because you knew a serious cyber theft could threaten the business you have spent years building.

Your company paid premiums year after year, maintained payment controls, and worked to protect its systems and financial information. No CEO expects perfect security or expects every loss to be covered by insurance. But a company that buys coverage for computer fraud, funds-transfer fraud, and social engineering reasonably expects the policy to matter when criminals compromise company communications and divert a seven-figure payment.

Insurance is supposed to be the company’s financial backstop when prevention fails. The company did not buy an insurance policy to debate technical definitions after a loss. It bought the policy to keep a sophisticated theft from becoming an uninsured loss, an unpaid vendor obligation, and another crisis for management.

This is how quickly a routine vendor payment can become a cyber crisis.

Continue Reading When Your Cyber Insurer Sends You in Circles: A Hacked CFO Email, a Stolen Vendor Payment, and the Coverage Maze That Can Follow

This is the third installment in our coverage of the Anthropic/Department of War dispute. Our first alert addressed the Trump administration’s February 27 directives barring federal contractors from using Anthropic and its Claude platform, including Secretary Hegseth’s designation of Anthropic as a supply chain risk to national security and the resulting requirement that all DoW contractors sever commercial ties with the company. Our second alert covered the March 26 preliminary injunction, in which Judge Lin found Anthropic had demonstrated a likelihood of success on the merits and was suffering irreparable harm from the challenged actions. This post covers where things stand now following the latest Federal Court ruling.

The Ruling

On August 27, 2026, U.S. District Judge Rita F. Lin of the Northern District of California granted summary judgment largely in favor of Anthropic PBC, ruling that the DoW’s designation of the company as a supply chain risk to national security was “illegal and baseless.” In a 59-page order, Judge Lin concluded that the designation was not based on any credible threat, but was instead retaliation for Anthropic’s public criticism of the Trump administration’s position during contract negotiations over the use of its AI model, Claude.

Continue Reading Federal Court Rules Government’s Anthropic Supply Chain Designation Was Unlawful Retaliation: What Government Contractors Need to Know

In Mid-August, Taft published the latest edition of The Big Long List of U.S. AI Laws. The list now includes over 60 entries focused on the commercial regulation of AI by the states.

Persistent rumors to the contrary, AI law compliance is anything but a detail and triviality.

There is nothing particularly glamorous about notifying your job applicants of your AI, putting disclaimers on your chat bot, conducting risk assessments, disclosing data sources, developing policies, or ensuring contracting standards. But, increasingly, requirements such as these are required or advisable under law for a growing number of particular AI applications. Businesses which develop and deploy AI without considering the growing list of compliance issues carefully do so at their own risk.

Continue Reading Big Long List of AI Laws – Notable Updates