- Revisit pending claims and demands. SB 690 may offer new grounds to challenge pending pen register claims, but its effect depends on when the action was filed and what other claims are asserted. Companies facing these claims or demand letters should consult counsel on next steps.
- Know what your trackers
Online Privacy
From Data Brokers to DNA: Connecticut Enacts Sweeping Privacy Amendments
By Judith Rubin & Jonathan Mollod on
On May 27, 2026, Connecticut Governor Ned Lamont signed Senate Bill 4, now Public Act No. 26-64 (the “Act”),[1] significantly expanding the Connecticut Data Privacy Act (CTDPA).
The Act creates a California Delete Act-style, but Connecticut-specific, data broker registration and deletion-mechanism regime. It also restricts the sale, sharing, transfer, and provision of access to precise geolocation data;[2] imposes facial recognition transparency requirements; adds surveillance-pricing prohibitions and disclosure obligations; narrows the CTDPA’s “publicly available information” exclusion; adds rules for certain employment-related processing and profiling decisions; expands consumer deletion rights; and regulates direct-to-consumer (DTC) genetic testing companies.
At a high level, the Act adds compliance obligations for data brokers, CTDPA controllers and processors, retailers, third-party delivery services, and DTC genetic testing companies.[3]
These amendments follow shortly after the July 1, 2026 effective date for separate CTDPA amendments enacted in 2025 through SB 1295, which expanded coverage thresholds, added profiling impact assessment obligations, and imposed minors-related requirements. Companies should thus treat SB 4 as part of a broader 2026 Connecticut compliance cycle, rather than a standalone update.
Ninth Circuit Reviews Website Tracking Class Actions and the Reach of California’s Privacy Law
Key Takeaways:
- The Ninth Circuit court of appeals reviewed three separate proposed class actions against Papa John’s International Inc., Converse Inc., and Bloomingdale’s, all centered on whether certain website tracking activities violated the California Invasion of Privacy Act (CIPA).
- The plaintiffs in these cases alleged that companies unlawfully used technologies like “session replay” software and chatbots to monitor website visitors’ interactions, intercepting their information and transmitting it to third parties without consent, thereby violating CIPA Section 631.
- The court assessed how CIPA, an older wiretapping law, applies to modern website tracking like session replay and chatbots, focusing on definitions of “interception” and “contents.”
The PowerSchool Breach: A Privacy Lesson on Third-Party Risk Exposure
By David Fioccola, Aaron Francis & Courtland Cuevas on
Key Takeaways:
- Ed tech company PowerSchool’s recent breach exposed the data of approximately 60 million students and 10 million educators.
- Hacker gained access via a compromised employee password and remained undetected for nine days.
- Sensitive personal data, including Social Security numbers and medical histories, was potentially compromised, raising a number of legal and regulatory concerns.
- The breach underscores the urgent need for stronger third-party oversight and security requirements.
Now Trending: The TikTok Dox
By Jeff Warshafsky, Aaron Francis & Logan White Levy on
- Plaintiffs are persistently crafting creative legal theories to target tracking technologies.
- One new approach is to characterize tracking technologies as “pen registers” or “trap and trace devices” used in violation of CIPA § 638.51.
- The TikTok Analytics software is at issue in many of these new claims, and
HHS-OCR Withdraws Appeal Following Unlawful Declaration of Online Tracking Technologies Bulletin
On August 29, 2024, the Office for Civil Rights of the United States Department of Health and Human Services (“HHS-OCR”) withdrew its appeal of an order by the United States District Court for the Northern District of Texas’ (“District Court”) declaring unlawful and vacating a portion of an HHS-OCR Bulletin…
Bidding Farewell, For Now: Google’s Ad Auction Class Certification Victory
By Aaron Francis on
A federal judge in the Northern District of California delivered a blow to a potential class action lawsuit against Google over its ad auction practices. The lawsuit, which allegedly involved tens of millions of Google account holders, claimed Google’s practices in its real-time bidding (RTB) auctions violated users’ privacy rights. But U.S. District Judge Yvonne Gonzalez Rogers declined to certify the class of consumers, pointing to deficiencies in the plaintiffs’ proposed class definition.
HHS Bulletin: Covered Entities’ Disclosure of PHI Collected via Online Tracking Technologies Falls under HIPAA
By Ryan P. Blaney, Danielle Brooks & Jonathan Mollod on
On December 1, 2022, the Office for Civil Rights (OCR) of the U.S. Department of Health and Human Services (HHS) issued a Bulletin to highlight the obligations of HIPAA-covered entities and business associates when using “online tracking technologies,” or what OCR describes as “script or code on a website or mobile…