Privacy & Cybersecurity Law Blog

The Centre for Information Policy Leadership at Hunton has published a report examining the extent to which the General Data Protection Regulation aligns with the newly updated Program Requirements of the Global Cross-Border Privacy Rules System.

The California Privacy Protection Agency (“CalPrivacy’) Board will hold its next public meeting over two days, Thursday, April 30, and Friday, May 1, 2026.

On April 22, 2026, the House Energy & Commerce Committee announced the introduction of and intention to advance the SECURE Data Act, to replace the patchwork of U.S. state consumer privacy laws with a single federal law.

As of April 22, 2026, organizations subject to the Children’s Online Privacy Protection Act (COPPA) must comply with the FTC’s 2025 amendments to the COPPA Rule.

On April 20, 2026, the California Privacy Protection Agency issued an invitation for preliminary comments on whether regulatory changes concerning notices and disclosures, and employee data, may be needed under the California Consumer Privacy Act and its implementing regulations.

On April 13, 2026, Kentucky Governor Andy Beshear signed into law HB 692, which amends the Kentucky Consumer Data Protection Act to add certain Smart TV data to the law’s definition of “sensitive data” effective July 1, 2027.

On April 17, 2026, Alabama Governor Kay Ivey signed into law the Alabama Personal Data Protection Act, taking effect on May 1, 2027, making Alabama the twenty-first state to enact a comprehensive consumer privacy law.

The California Privacy Protection Agency expects to conduct California Consumer Privacy Act compliance audits in 2026 as it builds out its newly created Audits Division, according Law360’s recent interview with the agency’s Executive Director, Tom Kemp.

On April 13, 2026, Virginia Governor Abigail Spanberger signed into law S.B. 388, which amends the Virginia Consumer Data Protection Act to prohibit the sale of geolocation data, effective July 1, 2026.

The U.S. Department of Health and Human Services’ Office for Civil Rights recently announced a settlement with health care software company MMG Fusion to resolve the company’s alleged noncompliance with the HIPAA Privacy, Security and Breach Notification Rules.