Privacy & Cybersecurity Law Blog

On August 12, 2026, President Trump issued a memorandum directing the creation of a federal program under which vetted U.S. companies may be authorized to conduct certain cyber operations against foreign cyber-enabled transnational criminal organizations under U.S. government control and oversight.

On August 11, 2026, New Jersey Governor Mikie Sherrill's signed the Kids Code Act,   imposing a range of privacy-by-default and safety-by-design obligations on online service providers whose services are reasonably likely to be accessed by minors.

The Federal Trade Commission, along with the Utah and California State Attorneys General, recently sued Hims & Hers Health, Inc., alleging that the telehealth company unlawfully shared consumers’ sensitive health information and engaged in deceptive billing and subscription cancellation practices.

Last month, the New York Attorney General released final rules implementing the Stop Addictive Feeds Exploitation for Kids Act, which takes effect on January 25, 2027.

On August 11, 2026, and August 13, 2026, the California Privacy Protection Agency (“CalPrivacy”) announced settlements with two data brokers, LocateSmarter LLC (“LocateSmarter”) and Cybba, Inc. (“Cybba”), respectively, resolving allegations that both companies failed to register as data brokers under California’s data broker law, the Delete Act.

On July 8, 2026, the European Data Protection Board adopted draft guidelines on anonymization and on web scraping in the context of generative AI, and finalized its guidelines on the processing of personal data through blockchain technologies.

On July 24, 2026, China’s cyberspace regulator issued an official Q&A clarifying cross-border data transfer requirements, including separate consent obligations, extensions for passed CAC security assessments and restrictions on overseas transfers of domestic job applicants’ resumes.

On July 14, 2026, Hawaii Governor Josh Green signed Senate Bill 3001 into law as Act 248, known as the Artificial Intelligence Disclosure and Safety Act.

On July 31, 2026, the European Data Protection Board sent a letter to the European Commission requesting it examine whether the U.S. Supreme Court’s decision in Trump v. Slaughter could affect the continued validity of the EU-U.S. Data Privacy Framework.

On July 22, 2026, the French Data Protection Authority published frequently asked questions on its recommendation regarding the use of tracking pixels in emails.