Coblentz partners Jennifer Scharre and Frank Busch presented the Continuing Education of the Bar (CEB) MCLE program “When Capacity Becomes a Catch-22: Defining Your Clients’ Due Process Rights After Herren” on Monday, October 5, 2026.

During this webinar, Jennifer and Frank discussed key facts of the Herren case and problems arising from it, as well as the use of conservatorship proceedings, Probate Code section 17200 petitions, and potential legislative fixes. They also highlighted the risks for estate planning attorneys and offered practical solutions to navigate capacity disputes and elder abuse allegations.

For more details and to access the CEB CLE recording, please visit the CEB website linked here.

By Lindsay Gehman and Saachi S. Gorinstein

GenAI is changing how brands and marketing agencies create, edit, distribute, and scale influencer content. GenAI tools can:

• Draft and edit captions, scripts, and talking points.
• Generate or modify images, video, and audio.
• Clone voices and create digital replicas of real people.
• Create virtual influencers with no corresponding human identity.
• Produce consumer reviews and testimonials at scale.

These capabilities raise a recurring question for brands and agencies: when must consumers be told that AI was used to create or modify influencer content? There is currently no general FTC rule requiring disclosure solely because AI was used. However, existing consumer protection law applies regardless of whether content is created by a human, an AI system, or both, and AI-specific disclosure obligations are emerging in state law, platform policies, and the EU AI Act. Under federal law, the more useful question is whether the use of AI changes what consumers are likely to believe about the advertisement, particularly its source, its authenticity, or the experience of the person making the endorsement.

The answer depends heavily on how AI is used. This article examines three categories:

• AI-assisted real influencers. A real influencer remains the speaker and source of the endorsement, while GenAI helps create or modify the content (see AI-Assisted Real Influencers).
• AI replicas of real influencers. AI creates content depicting an identifiable real person saying or doing something the person did not actually record, such as through voice cloning, digital replicas, or synthetic video (see AI Replicas of Real Influencers).
• Fully synthetic influencers. AI creates the influencer itself, resulting in a fictional persona that may have a realistic appearance, voice, personality, and social media presence without any corresponding human identity (see Fully Synthetic Influencers).

Each category raises different transparency concerns, but the analysis begins with familiar advertising law: what the advertisement communicates to a reasonable consumer, and whether that communication is truthful and not misleading. This article then offers a framework for assessing AI transparency across all three categories (see Assessing AI Transparency) and practical strategies for managing risk (see Managing Risk).

Key Rules at a Glance

The legal framework for AI-generated influencer content is discussed in detail in GenAI in Advertising and Influencer Marketing: The Legal Framework (2026 Update). In summary, the authorities that most often drive the analysis are:

• FTC Act Section 5. An advertisement is deceptive if it is likely to mislead reasonable consumers about something material, judged by its net impression. Objective claims must be substantiated before they are made, including claims suggested or drafted by AI (15 U.S.C. § 45(a)(1); FTC Policy Statement on Deception, appended to Cliffdale Assocs., Inc., 103 F.T.C. 110, 174 (1984)).
• Endorsement Guides. Endorsements must reflect the honest opinions and experience of the endorser, an endorser who is represented as using a product must be a bona fide user, and material connections must be disclosed clearly and conspicuously. The Guides apply to virtual influencers, and advertisers, endorsers, and intermediaries such as agencies may all be liable (16 C.F.R. §§ 255.0(b), 255.1(a)–(f), 255.5).
• Consumer Reviews and Testimonials Rule. Businesses may not create or disseminate reviews or testimonials that misrepresent that the reviewer exists, used the product, or had the experience described, and violations may result in civil penalties (16 C.F.R. § 465.2).
• State AI disclosure laws. New York requires advertisements that include AI-generated synthetic performers to disclose that fact (N.Y. Gen. Bus. Law § 396-b), and California prohibits using undisclosed bots to mislead people about their artificial identity in order to incentivize a purchase (Cal. Bus. & Prof. Code §§ 17940 to 17943).
• Rights of publicity and digital replica laws. State laws restrict unauthorized commercial use of a person’s name, likeness, or voice, and several states limit the enforceability of vague digital replica provisions in contracts (see, for example, Cal. Lab. Code § 927; N.Y. Gen. Oblig. Law § 5-302).
• Platform policies and the EU AI Act. Major platforms require labels for realistic AI-generated or altered content, and the EU AI Act requires disclosure of deepfake content (Article 50(4), Regulation (EU) 2024/1689).

AI-Assisted Real Influencers

AI assistance involving real influencers is likely the most common category. A real influencer remains the source of the endorsement, while GenAI may be used to:

• Draft, rewrite, or translate captions and scripts.
• Generate alternative versions of an approved post.
• Retouch photographs or video, or generate or modify backgrounds.
• Modify the influencer’s appearance or voice.
• Generate portions of a video.
• Develop product claims or talking points.

Legal Risks

There is no general FTC rule requiring an influencer to disclose AI use merely because AI helped draft or edit content. However, these uses vary substantially in their legal significance.

Key risks include:

• Undisclosed material connections. A paid relationship remains a material connection that generally must be clearly and conspicuously disclosed, whether or not AI was used to create the post (16 C.F.R. § 255.5(a)). Disclosing the sponsorship does not cure a false or misleading claim in the advertisement (16 C.F.R. § 255.1(a); FTC, .com Disclosures: How to Make Effective Disclosures in Digital Advertising (Mar. 2013)).
• AI-generated claims. GenAI can produce confident statements that are unsupported or incorrect. For example, an AI tool asked to turn approved talking points into a script may add that “clinical research proves” the product improves a condition by 40% when no such research exists. That a claim originated with AI does not reduce the advertiser’s substantiation obligation. The same risk arises when an influencer runs approved claims through a GenAI tool to put them in the influencer’s “own voice,” which can introduce new numbers, studies, or comparisons that were never approved. Influencers who make unsupported claims that go beyond their personal experience may also be liable (16 C.F.R. § 255.1(e)).
• Altered product demonstrations. An AI edit that adjusts lighting presents a different issue than an edit that makes a skincare product appear to eliminate wrinkles that remain visible in the original footage. The question is whether the modification creates a materially different impression about the influencer, the product, or its results. Long before GenAI, the Supreme Court upheld the FTC’s position that an undisclosed simulated demonstration offered as visual proof of a product claim is deceptive (FTC v. Colgate-Palmolive Co., 380 U.S. 374 (1965) (undisclosed mock-up in a shaving cream commercial)). The UK Advertising Standards Authority has applied similar reasoning to beauty filters in influencer advertising (ASA Rulings on Skinny Tan Ltd and We Are Luxe Ltd t/a Tanologist Tan (Feb. 3, 2021)).
• Altered appearance. The Endorsement Guides treat as deceptive an image that misrepresents a material attribute of the endorser, such as using a photograph that exaggerates the results the endorser achieved (16 C.F.R. § 255.1(g)). AI edits to an influencer’s appearance raise the same concern when the alteration relates to the product’s claimed effect.
• Platform labeling. Realistic AI alterations may trigger platform labeling requirements even where the law does not. Platform policies typically distinguish between realistic synthetic content, which must be labeled, and productivity uses such as drafting scripts or captions, which generally need not be.

AI Replicas of Real Influencers

Voice cloning, generative video, and digital replicas can create content depicting an influencer saying or doing things the influencer never recorded. The resulting advertisement may be difficult for consumers to distinguish from genuine content. For example, a brand might generate a video in which an influencer appears to say, “I’ve used this product every day for six months, and it completely transformed my skin,” although the influencer never recorded the statement or used the product for six months.

Legal Risks

The central FTC concern is not that the content is artificial, but whether consumers are likely to attribute synthetic statements, conduct, opinions, or experiences to the real person depicted. Key issues include:

• Two distinct disclosure questions. A sponsorship disclosure, such as #ad, tells consumers about the commercial relationship. It does not tell consumers that the influencer never recorded the video, spoke the words, or had the experience portrayed.
• False attribution. An endorsement must reflect the endorser’s honest opinions and experience, and an advertiser may not use an endorsement to convey a representation that would be deceptive if made directly (16 C.F.R. § 255.1(a)). An endorsement may not be reworded in a way that distorts the endorser’s opinion or experience (16 C.F.R. § 255.1(b)), and if the advertisement represents that the influencer uses the product, the influencer must have been a bona fide user (16 C.F.R. § 255.1(c)). AI makes false attribution more convincing but does not change the underlying deception principle.
• Statements after the relationship changes. A replica can continue generating content long after the original campaign. An advertiser may use a celebrity endorsement only while it has good reason to believe the endorser continues to hold the views presented, and may continue representing that an endorser uses a product only while it has good reason to believe the endorser remains a bona fide user (16 C.F.R. § 255.1(b), (c)). A replica that keeps praising a product after the influencer has stopped using it, or after the relationship has ended, raises both endorsement and publicity concerns.
• Disclosure of synthetic content. There is no general FTC rule requiring every synthetic image, voice, or video used in advertising to carry an AI label, and no FTC rule squarely addresses the authorized use of a real influencer’s replica. The FTC’s proposal to extend its Impersonation Rule to individuals has not been finalized and would principally address unauthorized impersonation. The risk is greater where a reasonable consumer would believe that the real influencer personally recorded the content, made the statement, demonstrated the product, or experienced the claimed result.
• Consent is not substantiation. An influencer’s approval of synthetic content cannot convert an experience that never occurred into a genuine first-person endorsement.
• Publicity and replica laws. Unauthorized replicas may violate state right of publicity and digital replica laws and support Lanham Act false endorsement claims (see, for example, Tenn. Code Ann. § 47-25-1101 et seq.; 15 U.S.C. § 1125(a)(1)(A); Waits v. Frito-Lay, Inc., 978 F.2d 1093 (9th Cir. 1992)). State publicity claims have proven viable against AI voice clones (Lehrman v. Lovo, Inc., No. 1:23-cv-08269, 2025 WL 1902547 (S.D.N.Y. July 10, 2025)). Even where the influencer has signed an agreement, vaguely drafted replica provisions may be unenforceable in some states (see Cal. Lab. Code § 927; N.Y. Gen. Oblig. Law § 5-302; 815 ILCS 550/1 et seq.). A general grant of rights to use an influencer’s name, image, likeness, voice, and content may not clearly extend to a replica that generates new statements the influencer never made.
• EU disclosure. Replica content in campaigns that reach the EU may require deepfake disclosure under the EU AI Act (Article 50(4), Regulation (EU) 2024/1689).

Fully Synthetic Influencers

A virtual influencer may have a realistic appearance, name, voice, personality, social media presence, and apparent life story without corresponding to any real person. The persona may post, interact with followers, express opinions, and promote products much like a human creator. The more realistic the persona, the less obvious its synthetic nature may be, particularly when it speaks in the first person about apparent personal experiences.

Legal Risks

Virtual influencers raise two distinct deception questions:

• Identity. Whether consumers understand that the influencer is synthetic rather than a real person.
• Experience. Whether the advertisement represents or implies that an actual product experience occurred when it did not.

For example, a virtual influencer post stating, “I’ve been using this product for six months, and my skin has never looked better. #ad,” discloses the sponsorship. Even if the persona is clearly identified as AI-generated, neither disclosure creates an actual six-month product experience.

Key issues include:

• Fabricated experiences. The Consumer Reviews and Testimonials Rule prohibits testimonials that materially misrepresent the testimonialist’s existence, use of the product, or experience (16 C.F.R. § 465.2). Brands should not use AI to create fictional customer reviews or use a synthetic persona to convey a first-person experience in a way that suggests a real person had it. A useful test is whether a human influencer who never used the product could truthfully make the same statement. If not, a synthetic influencer should not make it either.
• Reported experience and summaries. A synthetic persona that reports what actual customers say, rather than claiming its own experience, shifts the analysis from the endorser’s honesty to substantiation. The underlying reviews must be genuine and representative, and the presentation must not distort what consumers think of the product (16 C.F.R. § 255.2(d)). Brands that use AI to summarize verified reviews should retain the underlying data and a record of how the summary was produced.
• Material connections. Virtual influencers can be endorsers under the Endorsement Guides, so material connection disclosure obligations apply (16 C.F.R. §§ 255.0(b), 255.5).
• Identity disclosure. There is no FTC rule requiring every virtual influencer to be labeled as AI-generated, but omitting that information may be more significant where an advertisement depends on consumers believing the persona is human. New York now requires advertisements that include a synthetic performer to disclose that fact conspicuously, where the advertiser has actual knowledge of the synthetic performer’s use (N.Y. Gen. Bus. Law § 396-b (effective June 9, 2026)). A photorealistic virtual influencer in a campaign reaching New York audiences is likely to fall within the law. California’s BOT Act may apply where the persona’s interactions with followers are automated, though perhaps not where human operators write the posts (Cal. Bus. & Prof. Code §§ 17940 to 17943).
• Placement of disclosures. A disclosure that appears only in a profile or bio may not shape the overall impression of a post that users encounter through recommendations, sharing, or search. The Endorsement Guides state that a material connection disclosure placed only on a profile page is not clear and conspicuous, and similar reasoning applies to AI disclosures (16 C.F.R. § 255.0(g)(9); FTC, Disclosures 101 for Social Media Influencers (Nov. 2019); FTC, .com Disclosures: How to Make Effective Disclosures in Digital Advertising (Mar. 2013)).
• Resemblance to real people. A persona described as fictional can still implicate a real person’s rights if its face, voice, or mannerisms evoke an identifiable individual. Courts have long held that deliberately imitating a distinctive voice or evoking a celebrity’s identity to sell a product can violate the right of publicity, even without using the person’s actual image or recording (see, for example, Midler v. Ford Motor Co., 849 F.2d 460 (9th Cir. 1988)). Prompts instructing an AI tool to create a persona that resembles a particular person may later serve as evidence of intent.
• Substantiation. Objective product claims made by a synthetic influencer remain advertising claims that require substantiation.

Assessing AI Transparency

A rule requiring disclosure whenever AI is used does not fit the range of technologies in influencer marketing. A more useful analysis considers whether AI:

• Creates or simulates a real person’s statements or experience.
• Creates a fictional person or persona.
• Would lead a reasonable consumer to believe that a human personally said, did, experienced, or endorsed what the advertisement portrays.
• Materially alters a product demonstration or other evidence supporting an advertising claim.
• Would, if not disclosed, leave consumers with a materially different understanding of the advertisement.
• Triggers a state, platform, or foreign disclosure requirement regardless of the deception analysis.

These questions reflect a distinction between:

• AI assistance. Technology helps a human create content while the human remains the actual source of the relevant experience, opinion, or communication.
• AI authenticity substitution. Technology creates an apparent experience, opinion, speaker, or endorsement that does not actually exist.

The distinction is not absolute. A modest editing function can become significant depending on what it changes. However, the distinction focuses attention on the element of influencer marketing that AI most directly affects: authenticity.

Managing Risk

Internal AI Policies

Brands and agencies should consider adopting AI policies that:

• Identify approved AI tools and permitted uses, including uses by influencers and agency personnel.
• Classify uses by risk, distinguishing AI assistance from replicas and synthetic personas.
• Prohibit prompts that reference a real person by name or seek to imitate an identifiable person’s appearance or voice unless the person has consented in writing.
• Require human review of AI-generated consumer-facing content for factual accuracy, unsupported claims, hallucinations, and misleading implications, and compare AI output against a library of approved, substantiated claims.
• Require heightened review of AI edits to product demonstrations and influencer appearance, focusing on whether an edit changes what consumers are likely to believe about the product or its results.
• Add a question to creative review asking whether AI was used to create, modify, translate, or personalize the content, and how.
• Track state, platform, and foreign disclosure requirements by campaign and jurisdiction.
• Retain prompts, outputs, and approval records, which may be needed to substantiate claims or respond to a challenge.

Influencer Briefs and Agreements

Influencer briefs and agreements should:

• Address AI use expressly, including whether influencers may use GenAI to expand or rephrase approved talking points, and require review of any new claims the AI introduces. A practical rule is that AI may change the tone of approved claims but not their substance.
• Prohibit modifying content after approval, including through AI tools, without resubmitting it for review.
• Require influencers to confirm that first-person statements reflect their actual experience with the product.
• Address digital replica rights expressly and separately from general name, image, and likeness grants, including whether AI training, voice cloning, and synthetic content are permitted, what may be generated and for which campaigns, statements the replica may never make, approval rights, duration, post-termination use, retention or deletion of models and training data, and compensation. Provisions should include a reasonably specific description of intended uses, and brands should consider confirming that the influencer was represented by counsel, consistent with applicable state law (see, for example, Cal. Lab. Code § 927; N.Y. Gen. Oblig. Law § 5-302; 815 ILCS 550/1 et seq.).
• Allocate responsibility for platform labeling and state law disclosures.

Agency Agreements

Agencies may be liable as intermediaries for their roles in creating or disseminating deceptive endorsements (16 C.F.R. § 255.1(f)). Agency agreements should require the agency to disclose its use of AI tools for the brand’s work, route all AI-generated or AI-modified content through the brand’s legal review, comply with the brand’s AI policy, and allocate liability for AI-generated claims and unauthorized likeness or voice use through representations, warranties, and indemnities.

Replica and Synthetic Content Review

Before publishing replica or synthetic influencer content, brands and agencies should consider:

• Whether the influencer actually made the statements attributed to the influencer.
• Whether the influencer had the product experience portrayed, and still holds the views and uses the product as represented.
• Whether the synthetic content introduces claims or opinions beyond those the influencer actually expressed.
• Whether a reasonable consumer would understand the content to be a genuine recording or the persona to be a real person.
• Whether a synthetic persona resembles an identifiable real person.
• Where any AI disclosure is placed, and whether it will travel with the post when it is shared or recommended.
• Whether first-person statements by a virtual influencer, such as “I use this every morning” or “this worked for me,” describe experiences that do not exist.

Monitoring and Response

The Endorsement Guides expect advertisers to monitor their endorsers’ compliance and to remedy problems when they are discovered (16 C.F.R. § 255.1(d)). Monitoring should extend to content after it is approved, because AI tools make post-approval edits easy. If problematic AI-generated content is published, brands should remove it while preserving the post, prompts, outputs, and related communications, determine how the content was created and approved, assess whether corrective statements are needed, review agency and influencer contract remedies, and update their processes to prevent recurrence.

• Add a question to creative review asking whether AI was used to create, modify, translate, or personalize the content, and how.
• Track state, platform, and foreign disclosure requirements by campaign and jurisdiction.
• Retain prompts, outputs, and approval records, which may be needed to substantiate claims or respond to a challenge.

Conclusion

In the first two articles in this series, “AI, Influencers, and Liability: What Marketing Agencies Need to Know Before Deploying AI Tools” and “GenAI in Advertising and Influencer Marketing: The Legal Framework (2026 Update),” we explained that the key legal question for brands and agencies is not simply whether AI is being used in influencer marketing, but how it is being used. The three categories examined in this article bear that out. Each raises a different question: whether a real influencer remains the source of the experience and opinion, whether AI is putting words and conduct in a real person’s mouth, or whether a fictional persona is presenting a first-person experience that never happened. The common thread is the line between AI assistance, where a human remains the source of the experience or opinion, and AI authenticity substitution, where technology creates an experience, opinion, speaker, or endorsement that does not exist.

Federal law still does not require disclosure solely because AI was used, but the FTC applies existing deception, substantiation, and endorsement principles fully to AI-generated content. Endorsements must reflect genuine opinions and experiences, claims must be substantiated whether or not AI drafted them, and the Consumer Reviews and Testimonials Rule gives the FTC a civil penalty remedy for fabricated testimonials, including those delivered through a synthetic persona. At the same time, New York now requires disclosure of synthetic performers in advertising, states continue to expand digital replica protections and limit vague replica provisions in contracts, platforms require labels for realistic AI content, and the EU AI Act’s deepfake disclosure requirements now apply.

Brands and agencies should classify each use of AI by risk and adopt policies to match. Influencer agreements should address digital replica rights expressly and separately from general name, image, and likeness grants. A replica should not attribute statements or experiences to a real influencer that the influencer did not actually make or have, and a synthetic persona should not make a first-person claim that a human who never used the product could not truthfully make. Post-approval edits should be controlled, records of prompts and outputs retained, and state, platform, and EU requirements tracked campaign by campaign.

Those that evaluate AI based on what it does and how consumers will understand the result, rather than simply whether it was used, will be better positioned to use GenAI effectively while minimizing legal and reputational risk.

For further information and assistance, contact Lindsay Gehman or Saachi Gorinstein.

To view a PDF version of this article, please click here.

Join Scott Hall and members of the Coblentz Data Privacy Team on Tuesday, November 17, 2026 for a timely discussion of the latest developments shaping the privacy, cybersecurity, and AI landscape and what they mean for your business. 

Learn practical steps to manage risk and gain insight into:

• Emerging state and federal AI developments
• New and amended consumer privacy laws
• Enforcement trends involving children’s and sensitive data
• Key privacy litigation and regulatory developments

To register, please click here.

Date: Tuesday, November 17

Time: 10:00am – 11:00am PST

Format: Join us via webinar

CLE Information: This program is eligible for 1.0 Technology in the Practice of Law California MCLE credit. CLE is earned by both viewing and listening to this program for no less than 60 minutes. Dial-in only participants will not earn credit. Virtual attendance will be tracked and logged. CLE certificates of attendance will be made available via email in the days following the presentation. For those barred in jurisdictions outside California, please check your local bar rules to determine if you are eligible for MCLE credit from your state bar association.

By Scott Hall and Meaghan Henderson

States continued to adopt more targeted privacy requirements in 2026, including new restrictions on precise geolocation and sensitive personal data and expanded requirements for data brokers. These laws are important even for businesses that have already determined whether they are subject to each state’s comprehensive privacy law because some requirements apply based on the type of data or activity involved rather than traditional consumer-volume or revenue thresholds.

Recent developments in Vermont, Maryland, Virginia, and New Jersey illustrate this broader shift toward regulating specific categories of data and data-processing activities.

Vermont Expands Data Broker Requirements

Vermont expanded its data broker requirements in 2026, adding new disclosure and financial requirements for registered data brokers.

The amendments expand required registration disclosures to include certain sensitive-data practices and disclosures to government bodies, law enforcement, foreign actors, and generative AI developers.

These requirements may be particularly relevant for data brokers that maintain detailed consumer profiles or provide personal information to multiple types of recipients. The specific inclusion of disclosures to generative AI developers also illustrates the increasing overlap between state privacy and AI regulation.

Vermont’s amendments also require registered data brokers to maintain a $20,000 bond for liabilities arising under the law.

Businesses that buy, sell, or license personal information should determine whether they qualify as a data broker under Vermont law and, if so, confirm that their registration disclosures and financial requirements reflect the amendments.

Maryland Expands Its Definition of Precise Geolocation

Maryland expanded the definition of precise geolocation information under its privacy law.

The definition now includes information identifying the location of a consumer, mobile device, or vehicle within a radius of 1,750 feet.

Businesses that collect location information should review whether data they previously treated as general location information may now fall within Maryland’s definition of precise geolocation information and become subject to additional restrictions.

Virginia Prohibits the Sale of Precise Geolocation Information

Virginia has adopted a more direct restriction on precise geolocation data by prohibiting businesses from selling or offering to sell precise geolocation information.

Businesses that collect location information should therefore understand not only whether they collect precise geolocation data, but also how that information moves through advertising, analytics, vendor, and other third-party relationships.

The Maryland and Virginia developments demonstrate the growing importance of treating location information as a distinct category when conducting data inventories and reviewing third-party data flows.

New Jersey Prohibits Sale of Sensitive Personal Data

New Jersey has taken an even broader approach to sensitive information by prohibiting the sale of sensitive personal data.

Significantly, the prohibition applies regardless of the number of New Jersey consumers whose information a company processes. A business may therefore fall outside the applicability thresholds of New Jersey’s comprehensive privacy law and still be subject to the sensitive-data sale prohibition.

As we discussed in our separate article on New Jersey’s new data broker law, the restriction applies broadly to sensitive information, including certain health, financial, biometric, precise geolocation, and other sensitive personal data.

What Businesses Should Do Now

These developments reinforce the need to look beyond the applicability thresholds of state comprehensive privacy laws. Businesses should:

• Map sensitive and location data. Identify sensitive personal data, precise geolocation information, biometric data, and other specially regulated information and understand how that information is used, sold, licensed, and shared.
• Review data sales and third-party disclosures. Determine whether advertising, analytics, licensing, or other data-sharing arrangements involve information subject to state-specific restrictions.
• Review data broker requirements separately. Businesses that buy, sell, or license personal information should evaluate data broker laws on a state-by-state basis rather than assuming their status under one state’s law determines their obligations elsewhere.
• Do not rely solely on comprehensive-law thresholds. Identify requirements that apply based on the type of data or processing activity even where the business does not otherwise meet a state’s general privacy-law thresholds.

The growing number of targeted state requirements means that a traditional state-by-state applicability analysis may not capture all of a business’s privacy obligations. Businesses should increasingly consider both where they operate and the specific types of data and processing activities involved.

Fall Privacy Webinar – November 17, 2026

Join Scott Hall and members of the Coblentz Data Privacy Team on Tuesday, November 17, 2026 for a timely discussion of the latest developments shaping the privacy, cybersecurity, and AI landscape and what they mean for your business. Learn practical steps to manage risk and gain insight into emerging state and federal AI developments; new and amended consumer privacy laws; enforcement trends involving children’s and sensitive data; and key privacy litigation and regulatory developments. RSVP for the webinar here.

If your company needs assistance with any privacy issues, Coblentz Data Privacy & Cybersecurity attorneys can help. Please contact Scott Hall at shall@coblentzlaw.com for further information or assistance.

By Scott Hall and Meaghan Henderson 

Connecticut amended its comprehensive privacy law in 2026, lowering the Connecticut Data Privacy Act’s (CTDPA) applicability thresholds and expanding requirements for sensitive data, artificial intelligence, profiling, automated decision-making, facial recognition, precise geolocation, and consumer rights, setting the state near the forefront of U.S. privacy laws.

Businesses that previously determined the CTDPA did not apply, as well as businesses that have not recently revisited their Connecticut privacy programs, should reassess their obligations under the new, more stringent standards.

More Businesses Will Be Subject to the CTDPA

The amendments lower the CTDPA’s general applicability threshold from 100,000 to 35,000 consumers.

They also replace the prior alternative threshold, which applied to businesses that processed the personal data of at least 25,000 consumers and derived more than 25% of gross revenue from the sale of personal data, with broader triggers tied to offering personal data for sale and processing sensitive personal data.

Sensitive Data and Consumer Protections Expand

Connecticut expands the types of information subject to heightened protections and the rights available to consumers. The amendments expand the definition of sensitive personal data and consumer access rights to include certain inferences generated from personal data and raise the age threshold for certain processing of minors’ data from 16 to 18 years old.

Under these amendments, businesses may no longer sell sensitive personal data without consent and are prohibited from selling the personal data of minors under 18, regardless of consent.

The amendments also narrow the definition of publicly available information and expand deletion rights for certain information obtained from public sources. Among other changes, information created by combining personal data with publicly available information, certain genetic data, and information posted where a consumer has a reasonable expectation of privacy may no longer qualify as publicly available. Consumers may also request deletion of publicly available information that is combined to create a publicly accessible consumer profile or made available for sale, as well as inferences generated from that information.

New Requirements for AI, Profiling, and Automated Decision-Making

Like California, Connecticut continues to expand its regulation of AI, profiling, and automated decision-making.

The amendments add a new disclosure requirement relating to artificial intelligence and expand consumer rights involving profiling and automated decision-making. These changes are relevant to businesses using AI and automated systems that generate inferences or other information about individuals or use those outputs in decisions affecting individuals.

Facial Recognition and Precise Geolocation Face Additional Restrictions

Separate Connecticut amendments effective October 1, 2026 add requirements relating to facial recognition technology and precise geolocation information.

The amendments restrict the sale of precise geolocation data and add protections addressing facial recognition technology. Businesses that collect or use this information may therefore have additional obligations depending on how the information is collected, used, disclosed, or sold and should pay particular attention to any new obligations that may arise.

Assessment Requirements Expand

Connecticut’s amended assessment requirements apply to processing activities created on or after August 1, 2026.

The amendments require assessments for certain processing activities, including activities involving sensitive data, profiling, automated decision-making, or other higher-risk processing. Businesses already conducting privacy, data protection, or AI assessments under other state laws may be able to leverage those processes to satisfy Connecticut’s requirements.

What Businesses Should Do Now

Businesses that operate in Connecticut or process Connecticut residents’ personal data should:

• Recheck applicability. Determine whether the lower thresholds or new applicability triggers bring the business within the scope of the CTDPA.
• Review sensitive and higher-risk data. Identify sensitive data, precise geolocation information, facial recognition information, and inferences collected or generated by the business.
• Review AI, profiling, and automated decision-making. Identify relevant activities and determine whether they trigger additional disclosure, consumer-rights, or assessment requirements.
• Review notices and consumer-rights procedures. Confirm that existing notices and procedures address the amended requirements, including changes relating to inferences and other newly regulated information.
• Review assessment requirements. Identify new or planned processing activities that require assessments and determine whether existing assessments can be leveraged.

Fall Privacy Webinar – November 17, 2026

Join Scott Hall and members of the Coblentz Data Privacy Team on Tuesday, November 17, 2026 for a timely discussion of the latest developments shaping the privacy, cybersecurity, and AI landscape and what they mean for your business. Learn practical steps to manage risk and gain insight into emerging state and federal AI developments; new and amended consumer privacy laws; enforcement trends involving children’s and sensitive data; and key privacy litigation and regulatory developments. RSVP for the webinar here.

If your company needs assistance with any privacy issues, Coblentz Data Privacy & Cybersecurity attorneys can help. Please contact Scott Hall at shall@coblentzlaw.com for further information or assistance.

By Scott Hall and Meaghan Henderson

On September 2, 2026, Delaware amended its comprehensive privacy law, the Delaware Personal Information Privacy Act (DPDPA), by signing House Bill 380 (HB 380) into law. HB 380, which goes into effect on January 1, 2027, marks the most significant revision to the DPDPA since its enactment in 2023.

HB 380 lowers the law’s applicability thresholds, narrows certain exemptions, creates new obligations for businesses that receive personal information from covered companies, and expands requirements governing sensitive information, profiling, and automated decision-making.

Businesses that previously determined the DPDPA did not apply, as well as businesses with existing Delaware privacy programs, should review their practices to determine whether the amended law changes their obligations.

More Businesses Will Be Subject to the DPDPA

HB 380 substantially lowers the DPDPA’s applicability thresholds:

• The general threshold decreases from 35,000 to 10,000 consumers annually.
• The threshold for businesses deriving more than 20% of gross revenue from the sale of personal information decreases from 10,000 to 5,000 consumers.
• Certain third parties that receive personal information from a controller may now be subject to the DPDPA without a minimum consumer threshold.

Financial Institution and Other Exemptions Are Narrowed

HB 380 narrows certain exemptions, including:

• The GLBA financial-institution exemption is narrowed. HB 380 replaces the broad entity-level exemption with more targeted exemptions for specified financial entities and activities, bringing Delaware closer to California’s approach. Information subject to the GLBA remains exempt, but the exemption no longer automatically extends to all affiliates and subsidiaries.
• The employee-information exemption is narrowed. Personal information used in connection with certain profiling and reports in the employment context will now be subject to the DPDPA.

Businesses that previously relied on an entity-level exemption should confirm that the exemption continues to apply after January 1, 2027.

Expanded Protections for Sensitive Information

HB 380 expands the definition of sensitive data to include the following categories, bringing it closer to the CCPA’s definition of sensitive personal information:

• Inferences used to reveal or identify sensitive characteristics, including health conditions, religious beliefs, racial or ethnic origin, sexual orientation, or immigration status;
• Neural information;
• Certain financial account credentials; and
• Certain government-issued identification numbers.

Controllers must obtain consent before processing sensitive information, and the processing must be reasonably necessary and proportionate to the purposes disclosed to the consumer.

Sales of sensitive data are also subject to additional restrictions. A permitted sale must be strictly necessary to provide or maintain a product or service requested by the consumer, and the controller must provide clear and conspicuous notice, obtain express consent, and maintain a record of that consent for five years.

New Vendor Due Diligence and Contracting Requirements

HB 380 adds requirements for businesses that disclose personal information to third parties:

• Controllers must enter into contracts with covered third parties that limit their use of personal information and include specified privacy protections, including audit and remediation rights.
• Controllers must conduct reasonable due diligence, including questionnaires and, where appropriate, additional measures based on the sensitivity of the data and the nature of the processing.
• Third parties must cooperate with those diligence efforts and provide information needed for the controller’s assessment.
• A third party without a required contract may not further process the personal data it receives and must comply with applicable contractual and diligence requirements.

Businesses should review vendor-management and contracting processes for relationships involving disclosures of personal information to third parties.

Profiling and Automated Decision-Making

HB 380 expands requirements for profiling and automated decision-making:

• New requirements apply to certain “reports,” including recommendations, summaries, automated decisions, and other communications based on personal information or profiling.
• Where a report is provided to a third party for use in a decision producing legal or similarly significant effects, the controller may need to ensure that the third party provides adverse-action notice, identifies the personal data relied upon, provides information about consumer rights, and offers human review where technically feasible.
• The right to opt out of profiling used in connection with automated decisions producing legal or similarly significant effects is expanded by removing the current “solely” automated-processing limitation.

These provisions may be relevant to businesses using AI or other automated tools in employment, financial services, insurance, housing, and other contexts involving significant decisions about individuals.

Assessment Requirements Also Expand

HB 380:

• Lowers the threshold for information protection assessments from 100,000 to 50,000 consumers; and
• Requires a separate impact assessment for profiling used in furtherance of automated decisions producing legal or similarly significant effects.

The profiling assessment must address, among other things, intended use, foreseeable harms and mitigation, data inputs and outputs, performance and transparency, post-deployment monitoring, and safeguards.

Businesses already conducting privacy or AI impact assessments under other state laws should determine whether those processes can be adapted to address Delaware’s requirements.

Other Changes to Consumer Rights and Privacy Practices

HB 380 makes several additional changes, including:

• Consumers generally will be entitled to identify the specific third parties that received their personal information, rather than only categories of third parties.
• Controllers must stop processing information subject to withdrawn consent within 15 days.
• Controllers must obtain consent from minors ages 13 to 18 before processing their personal information for profiling.
• Privacy notices must be reasonably particular to the product or service offered to the consumer, which may require businesses with materially different products or services to reconsider using a single general notice.

What Businesses Should Do Before January 1, 2027

Businesses operating in Delaware or processing Delaware residents’ personal information can use the remainder of 2026 to:

• Recheck applicability. Reevaluate the lower consumer thresholds, new third-party provisions, and existing exemptions.
• Identify sensitive information and inferences. Determine whether systems generate newly covered sensitive information and whether consent mechanisms remain sufficient.
• Review third-party relationships. Identify relevant disclosures and update contracts and diligence procedures.
• Inventory profiling and automated decision-making. Identify systems that may trigger the new requirements.
• Review assessment requirements. Determine whether existing or planned processing requires an information protection or profiling impact assessment and whether assessments prepared for other states can be leveraged.
• Update privacy notices and consumer-rights procedures. Confirm that notices, opt-out mechanisms, consent processes, and rights-request procedures address the amendments.

Fall Privacy Webinar – November 17, 2026

Join Scott Hall and members of the Coblentz Data Privacy Team on Tuesday, November 17, 2026 for a timely discussion of the latest developments shaping the privacy, cybersecurity, and AI landscape and what they mean for your business. Learn practical steps to manage risk and gain insight into emerging state and federal AI developments; new and amended consumer privacy laws; enforcement trends involving children’s and sensitive data; and key privacy litigation and regulatory developments. RSVP for the webinar here.

If your company needs assistance with any privacy issues, Coblentz Data Privacy & Cybersecurity attorneys can help. Please contact Scott Hall at shall@coblentzlaw.com for further information or assistance.

By Scott Hall and Meaghan Henderson

Less than a decade after California enacted the California Consumer Privacy Act (CCPA) in 2018, privacy legislation has spread to nearly half of the United States. With Alabama, Louisiana, Oklahoma, and Vermont joining the list this year, 24 states now have their own comprehensive consumer privacy laws, with at least three more regulating privacy through more targeted legislation.

With privacy a clear legislative priority across the country, businesses should expect privacy compliance to remain an increasingly important operational and legal issue. But the growing number of laws is not the only challenge.

Although the four new laws generally follow the framework established by existing state privacy laws, they differ in important ways. Businesses with multistate privacy programs should consider whether those differences require updates to their existing notices, consumer-rights procedures, data inventories, and risk-assessment processes.

Oklahoma Consumer Data Privacy Act, effective January 1, 2027

Oklahoma’s law applies to businesses that operate in Oklahoma or target its residents and either:

• control or process the personal data of at least 100,000 consumers; or
• control or process the personal data of at least 25,000 consumers and derive more than 50% of gross revenue from the sale of personal data.

“Consumer” excludes individuals acting in a commercial or employment context, and “sale” is limited to exchanges for monetary consideration only. The law also exempts financial institutions and data subject to the GLBA, HIPAA-covered entities, and business associates, nonprofits, and higher education institutions.

Consumers receive familiar rights to access, correct, and delete personal data and opt out of targeted advertising, sales, and certain profiling. Businesses must obtain consent before processing sensitive data and conduct data protection assessments for certain higher-risk processing. Comparable assessments prepared for other state laws may be used.

There are, however, several differences businesses should note. Oklahoma requires authentication for consumer rights requests, including opt-out requests, and does not require businesses to recognize universal opt-out mechanisms. Its definition of personal data also expressly includes pseudonymous data when it is used with additional information that reasonably links the data to an identified or identifiable individual. And while the law generally excludes photographs and audio or video recordings from its definition of biometric data, that exclusion does not apply when data generated from those materials is used to identify a specific individual.

The Oklahoma Attorney General has exclusive enforcement authority. Businesses receive 30 days to cure alleged violations, and statutory damages may reach $7,500 per violation.

Alabama Personal Data Protection Act, effective May 1, 2027

Alabama’s law applies to Alabama businesses, or businesses targeting Alabama residents, that:

• control or process the personal data of more than 25,000 consumers, excluding data processed solely for payment transactions; or
• derive more than 25% of gross revenue from the sale of personal data.

The law also exempts businesses with fewer than 500 employees that do not sell personal data, among other entity- and data-level exemptions.

The law provides familiar consumer rights, including access, correction, deletion, and copies of their personal data, as well as opt-outs from targeted advertising, sales of personal data, and certain profiling. Businesses must obtain consent to process sensitive data. Alabama also provides additional protections for minors: businesses generally must obtain consent before using the personal data of consumers ages 13 through 15 for targeted advertising or selling that data.

However, Alabama differs from the other new laws in several respects. Its definition of a “sale” is broader than monetary consideration, but it generally does not treat certain disclosures or transfers for analytics or marketing services as sales of personal data. Alabama’s law also does not require formal data protection assessments, does not require businesses to recognize universal opt-out signals, and does not provide a consumer right to appeal a decision on a rights request.

Enforcement is limited to the Alabama Attorney General, with a 45-day cure period that does not sunset. 

Louisiana Data Privacy Act, effective January 1, 2027

Louisiana’s law applies to businesses that operate in Louisiana or target its residents and meet any one of the following thresholds:

• annual gross revenue exceeding $25 million;
• annually processing, buying, receiving, selling, or commercially sharing the personal information of at least 75,000 Louisiana consumers, households, or devices; or
• deriving at least 50% of annual revenue from the sale of consumer personal information.

Because the revenue threshold applies independently of the amount of personal information processed, the law may reach some businesses, including certain B2B companies, that would not otherwise expect to fall within a state comprehensive privacy law.

As with Oklahoma and Alabama, the law provides familiar consumer rights, including access, correction, deletion, portability, and opt-outs from targeted advertising, sales of personal data, and certain profiling. Although Louisiana does not provide consumers with the right to revoke consent, businesses must obtain consent before processing sensitive data and must conduct data protection impact assessments for certain higher-risk processing. Similar to Oklahoma, Louisiana also permits businesses to rely on comparable assessments prepared to comply with other state privacy laws.

There are several other Louisiana-specific requirements to be aware of. The law requires authentication for consumer rights requests, including opt-outs, and requires recognition of universal opt-out mechanisms. The privacy policy must also include specific disclosures if a business sells sensitive personal data or biometric personal data. Unlike Texas, Louisiana does not expressly include certain pseudonymous data within the definition of personal data.

The law is enforceable only by the Louisiana Attorney General and provides a 30-day cure period, although that cure period sunsets on July 31, 2027. 

Vermont Data Privacy and Online Surveillance Act, effective January 1, 2028

Vermont’s law is broader in several respects than the other state privacy laws enacted in 2026. It applies to Vermont businesses that:

• control or process the personal data of at least 35,000 consumers;
• control or process the sensitive data of at least 3,000 consumers; or
• offer for sale the personal data of at least 3,000 consumers.

Vermont also provides narrower exemptions than many other states, including no blanket nonprofit exemption and a narrower financial-institution exemption.

Consumers receive the familiar rights to access, correct, delete, and obtain copies of personal data and to opt out of targeted advertising, sales, and certain profiling. Vermont goes further, however, by providing additional rights relating to profiling and automated decisions, including rights in certain circumstances to question a profiling result, obtain information about the reasons for the decision, and review the personal data used. Businesses must also conduct data protection assessments for certain higher-risk processing and separate impact assessments for certain profiling used to make decisions with legal or similarly significant effects.

The law also contains several requirements that businesses should flag for their existing compliance programs. Vermont uses a broader definition of biometric data that does not require the data to be processed for purposes of uniquely identifying an individual. Its definition of publicly available information is also narrower and generally excludes information aggregated into a consumer profile and inferences derived from that profile. In addition, privacy policies must disclose whether the business collects, uses, or sells personal data to train large language models.

Vermont provides additional protections for minors and consumer health data. Businesses generally may not sell personal data or use it for targeted advertising when they have actual knowledge, and willfully disregard, that a consumer is between 13 and 17 years old. The law’s consumer health data requirements are particularly broad because they apply without a minimum processing threshold and restrict, among other things, access to consumer health data, certain geofencing around health care facilities, and sales of consumer health data without consent.

The Vermont Attorney General has exclusive enforcement authority. Businesses receive 60 days to cure violations during the first 18 months after the law takes effect.

Common Requirements and Important Differences

The four laws generally follow the now-familiar state privacy framework: covered businesses must provide privacy notices, honor consumer rights, and address sensitive data, targeted advertising, sales of personal information, and certain profiling.

The laws differ in important ways that may require updates to existing multistate privacy programs.

Applicability thresholds vary substantially, from Oklahoma’s 100,000-consumer threshold and Alabama’s 25,000-consumer threshold to Louisiana’s $25 million revenue threshold and Vermont’s separate thresholds for personal data, sensitive data, and data offered for sale. The states also take different approaches to nonprofit and small-business exemptions, universal opt-out mechanisms, authentication of consumer rights requests, and the treatment of pseudonymous and biometric data.

The laws also differ in their assessment requirements. Louisiana, Oklahoma, and Vermont require data protection assessments for specified higher-risk processing, and Vermont separately requires impact assessments for certain profiling activities. Alabama does not require formal data protection assessments. Businesses should also consider whether existing assessments can be used to satisfy the requirements of multiple states.

Finally, businesses should not assume that a single privacy program will address all four laws without modification. Vermont in particular adds requirements relating to profiling, minors, consumer health data, biometric data, and disclosures concerning the use of personal data to train large language models. These differences reinforce the need to review existing privacy notices, consumer-rights procedures, data inventories, assessment processes, and other compliance controls as new state laws take effect.

The continued expansion of state privacy laws makes a consistent multistate framework increasingly valuable, but meaningful differences among states still require businesses to evaluate their practices state by state.

Fall Privacy Webinar – November 17, 2026

Join Scott Hall and members of the Coblentz Data Privacy Team on Tuesday, November 17, 2026 for a timely discussion of the latest developments shaping the privacy, cybersecurity, and AI landscape and what they mean for your business. Learn practical steps to manage risk and gain insight into emerging state and federal AI developments; new and amended consumer privacy laws; enforcement trends involving children’s and sensitive data; and key privacy litigation and regulatory developments. RSVP for the webinar here.

If your company needs assistance with any privacy issues, Coblentz Data Privacy & Cybersecurity attorneys can help. Please contact Scott Hall at shall@coblentzlaw.com for further information or assistance.

Join Lindsay Gehman on Monday, November 2, 2026 for the ANA Masters of Advertising Law Conference in Huntington Beach, California.

Lindsay will moderate the panel “The Intersection of AI and Influencer Marketing.” This session will explore how artificial intelligence is rapidly reshaping influencer campaigns—from AI-powered creator selection, audience analytics, and campaign optimization to generative copy, virtual influencers, synthetic endorsements, and digital replicas. Drawing on Coblentz’s Creative Services and Artificial Intelligence capabilities, this panel will examine the business opportunities and legal risks emerging at this intersection, including FTC endorsement and testimonial rules, disclosure obligations, right-of-publicity concerns, intellectual property ownership, contract allocation of risk, and practical governance strategies for brands, agencies, platforms, creators, and technology providers.

Lindsay will be joined by Melanie Full (Associate General Counsel, GALLO), Laura Slezinger Jenkins (Senior Counsel, Marketing & Intellectual Property, Airbnb Inc.), and Laura Protzmann (Attorney, NAD & AIBBB National Programs).

For more details and to register, please visit the Association of National Advertisers’ website linked here.

 

By Scott Hall and Katie Berens

The U.S. Court of Appeals for the Ninth Circuit recently issued a novel ruling that an agentic AI tool did not trigger liability under the Computer Fraud and Abuse Act (CFAA) and the California Comprehensive Computer Data Access and Fraud Act (CDAFA)—statutes that often appear as companion claims in privacy cases involving unauthorized access to computers, devices, or data.

On August 4, 2026, in Amazon.com Services, LLC v. Perplexity AI, Inc., No. 26-1444, the Ninth Circuit vacated the trial court’s award of a preliminary injunction to Amazon, holding that Amazon was unlikely to succeed on the merits of its CFAA and CDAFA claims because it could not show Perplexity’s agentic AI tool “accessed” Amazon computers, a requirement of both statutes.

While the Court expressly limited its narrow ruling, this first-of-its-kind decision offers a glimpse into how courts may approach agentic AI issues in similar contexts, and raises broader questions about when agentic AI may trigger liability for statutory or other privacy-related violations.

Background

This case involved Perplexity’s AI-enabled web browser, Comet, which it developed and publicly released. Comet runs locally on a user’s machine and includes an AI agent (which the Court refers to in its opinion as “the Assistant”) that performs tasks at the user’s direction, including online shopping.[1]

Amazon allegedly told Perplexity, prior to Comet’s release, that its AI products would not be allowed to access the Amazon.com store.[2] After Perplexity released Comet, Amazon detected that the Assistant was shopping its store on behalf of Comet users, and Amazon again informed Perplexity that the Assistant was not authorized to use the store or make purchases for its customers.[3]

Amazon then filed suit against Perplexity for violations of the CFAA and the CDAFA and moved for a preliminary injunction to prohibit the use of Perplexity’s agentic web browser AI tool on Amazon’s website.[4] Amazon claimed that Perplexity violated the CFAA, a federal anti-hacking statute, and its California state-law analogue, the CDAFA.[5] Both are criminal statutes that provide a private right of action for civil claims. The CFAA prohibits intentionally accessing and obtaining information from computers without authorization, and makes relief available to plaintiffs who have suffered damage or loss of at least $5,000 per year as a result of a violation.[6] The CDAFA similarly prohibits knowingly accessing without permission any computer system or network, but it does not impose a minimum loss threshold.[7]

Amazon claimed that by way of the Assistant, Perplexity’s servers had accessed Amazon’s servers without Amazon’s authorization.[8] Perplexity countered that its own computers never gained “access” to any Amazon computer or server, because when the user deploys the Assistant, any Amazon data is first transmitted to the user’s computer—and any “intent” would belong to the user, not Perplexity, as the Assistant is computer software.[9]

The Court Rejects Amazon’s Argument

The Court ruled in favor of Perplexity, vacating the preliminary injunction and concluding that Amazon was unlikely to succeed on the merits because it failed to show that Perplexity “accessed” Amazon’s servers as required under the CFAA and the CDAFA.[10] The Court determined that the evidence did not support Amazon’s argument that Perplexity itself directly communicated with Amazon’s servers, as it is the user who controls the Assistant to carry out shopping tasks on Amazon.com.[11] It further explained that the plain language of the CFAA does not allow for “access” by the Assistant, as “access” only applies to a person—and “[h]owever advanced the Assistant currently is, it is a tool, not a person for statutory purposes.”[12]

The Court reiterated that agentic AI is an emerging technology, and that this decision does not “establish a new legal regime governing agentic AI”—nor does it address the potential for liability in other contexts such as tort claims.[13] It also acknowledged that “[t]he legal understanding of agentic AI will doubtless change as AI technology grows increasingly sophisticated.”[14] However, this case represents an early marker in what is sure to become a hotly contested issue going forward.

Key Takeaways

As the Court noted, this ruling is limited and does not insulate agentic AI developers or deployers from potential liability under these statutes or other laws, nor from claims based on violations of a website’s terms of service.

It does, however, provide a novel illustration of a court conducting a piecemeal analysis of how an agentic AI tool operates to determine liability, including an examination of who controls—and may ultimately be responsible for—the actions that the agent undertakes. As this case shows, each outcome may depend on highly factual questions, including how the tool is built and whether the agent is acting only on behalf of the user.

As the law evolves to keep pace with the rapid advancement of agentic AI, companies should stay informed about key judicial decisions and legislative activity and their potential implications for the AI tools that they develop and deploy.

Fall Privacy Webinar – November 17, 2026

Join Scott Hall and members of the Coblentz Data Privacy Team on Tuesday, November 17, 2026 for a timely discussion of the latest developments shaping the privacy, cybersecurity, and AI landscape and what they mean for your business. Learn practical steps to manage risk and gain insight into emerging state and federal AI developments; new and amended consumer privacy laws; enforcement trends involving children’s and sensitive data; and key privacy litigation and regulatory developments. RSVP for the webinar here.

If your company needs assistance with any privacy issues, Coblentz Data Privacy & Cybersecurity attorneys can help. Please contact Scott Hall at shall@coblentzlaw.com for further information or assistance.

[1] Amazon.com Services, LLC v. Perplexity AI, Inc., 184 F.4th 1083, 1087–88 (9th Cir. 2026).

[2] Id. at 1088.

[3] Id.

[4] Id.

[5] Id.; 18 U.S.C. § 1030; Cal. Penal Code § 502.

[6] 18 U.S.C. § 1030(a)(2), (g).

[7] Cal. Penal Code § 502. For more information on the recent rise in CDAFA claims in the privacy context, including with regard to website tracking technologies, see our prior article here.

[8] Id. at 1089–90.

[9] Id. at 1089.

[10] Id. at 1090–91.

[11] Id. at 1091.

[12] Id.

[13] Id. at 1092.

[14] Id.

San Francisco voters will consider ten local measures on November 3, 2026. Four of them — Propositions A, D, E, and F — would amend the City Charter in ways that affect land use entitlement and development. These proposals, largely developed out of SPUR’s 2025 Charter for Change report, would not amend the Planning Code or change the substantive standards for development approvals, but would reallocate authority over the City bodies that process, condition, and enforce those approvals and certain real property transactions.

This post addresses these measures in four general categories:

• How future land use policy reaches the ballot
• Appointing and removing department heads and commissioners who oversee entitlements
• City requirements that can be amended by ordinance rather than Charter amendments
• How the City approves contracts and certain real property transactions

Future Land Use Policy at the Ballot 

Proposition D: Changes to Ballot Measure Process

Proposition D would raise the signature threshold for citizen initiative ordinances from 2 to 8 percent of registered voters (from roughly 10,600 to 42,500 signatures). The threshold to qualify for a special election would rise from 10 percent of votes cast for Mayor to 10 percent of registered voters (from roughly 39,000 to 53,100 signatures). It would also require a majority of the Board of Supervisors — six members rather than four — to place an ordinance or declaration of policy on the ballot, eliminate the Mayor’s unilateral authority to do so, and allow proponents to withdraw a qualified initiative up to 102 days before the election.

Why it matters. San Francisco land use policy has frequently been set by initiative ordinances qualified at the 2 percent threshold. Unlike the legislative process, which allows for consensus-building, adjustment prior to adoption, and later amendment, an ordinance approved by voter-qualified measure can generally be changed only by another vote. Proposition A separately authorizes the Board to amend a short list of specified initiative ordinances, but voter-adopted land use ordinances would remain amendable only by the voters unless those ordinances provide otherwise. The net effect is a higher barrier to legislating land use at the ballot, without loosening existing voter-adopted controls.

Mayoral Authority Over Planning, Building Inspection, and Public Works

Proposition F: Changes to Executive Branch Management

Under the current Charter, a commission generally nominates at least three candidates for a department head position, the Mayor appoints from that list, and the commission holds removal authority. Critics say this split blurs accountability: the Mayor appoints the Planning Director, for example, but removal authority rests with the Planning Commission.

Proposition F would convert six departments to full mayoral appointment, including Planning, the Department of Building Inspection (DBI), and Public Works. It would also amend the Charter to authorize the Mayor to “appoint and remove” department heads and delete the provision that makes removal the commission’s duty. The Budget and Legislative Analyst calculates that the Mayor’s sole appointment authority would increase from five to eleven department heads, and removal authority would increase from five to twenty-seven.

Proposition F would also change commissioner tenure. Today, most board and commission members may be removed only for official misconduct. Under the measure, most would serve at the pleasure of the appointing authority — either the Mayor or Board of Supervisors.

Finally, the Mayor could transfer duties between executive branch departments or merge departments, effective 30 days after notice unless disapproved by the Board of Supervisors. Charter-assigned duties may be transferred but not eliminated. The measure excludes the transfer of duties of certain officers and entities, including the City Administrator, Controller, Board of Appeals, Port, and Airport.

Why it matters. In January 2026, the Mayor announced a plan to combine Planning, DBI, and the Permit Center into a single organization. Because DBI and the Building Inspection Commission (BIC) are established in the Charter, DBI’s administrative and information technology functions can move into Planning this fiscal year, but its Charter-mandated core services and BIC oversight must remain intact.

If Proposition F passes, the Mayor could move DBI’s core services into a fully integrated permitting department and oversight now performed by the BIC could be transferred to the Planning Commission.  Review that now runs separately through Planning and DBI, each with its own process and timeline, could then be coordinated within one organization rather than managed by applicants across departments.

Moving City Requirements From the Charter to the Administrative Code

Proposition A: Charter Changes Affecting Various City Departments and Commissions

Proposition A is the Board of Supervisors’ cleanup measure, sponsored by Supervisor Mandelman. The measure, which would change more than 130 Charter provisions, is largely housekeeping intended to simplify and modernize the Charter.

Among other things, it would move multiple Charter sections into the Administrative Code, where the Board could amend, consolidate, or eliminate them by ordinance without returning to the voters.

Consistent with the Commission Streamlining Task Force’s work, Proposition A would also eliminate the Sanitation and Streets Commission and the Public Works Commission, leaving the Department of Public Works without a separate oversight commission. It also removes the requirement that the Planning Department consult the City Administrator in preparing area and neighborhood plans that implement the General Plan, to help streamline the process.

Why it matters. San Francisco’s Charter covers a great deal of operational detail — commission composition, hearing procedures, reporting obligations — that most jurisdictions place in the municipal code, so even a minor procedural fix requires a citywide ballot measure. Proposition A’s transfers are modest and mostly outside the land use bodies, but they establish a template: moving provisions to the Administrative Code allows the Board to make changes through the legislative process, where a proposal can be noticed, heard, amended, and revisited if it does not work as intended.

Contracts and City Real Property

Proposition E: City Administrator’s Authority and Changes to City Contracting

Proposition E would extend the City Administrator’s term from five years to ten and centralize procurement authority in that office. The City Administrator would have exclusive authority to introduce most procurement-related ordinances, along with authority over procurement rules and regulations and direction of citywide information technology. Notably, “procurement” excludes development agreements and agreements for the acquisition, disposition, or lease of real property, and the City Administrator’s exclusive introduction power does not extend to ordinances on contractor wage and benefit standards, local business utilization, or project labor agreements.

The measure would also raise the dollar thresholds that determine which contracts, leases, and contract amendments must come to the Board of Supervisors for approval — for example, from $10 million to $25 million in anticipated City expenditures, and from $1 million to $4.5 million in anticipated revenue to the City — and would adjust those thresholds for inflation every five years beginning in 2032. Amendments would require Board approval only if they increase the amount by 50 percent or more. Transactions below the thresholds would be handled and approved administratively. However, leases with a term of ten years or more and any sale or other transfer of City-owned real property would still require Board approval regardless of dollar amount.

Proposition A also includes a provision, effective only if Proposition E passes, authorizing the City Administrator to conduct long-term real estate strategic planning and to negotiate and manage acquisitions, leases, and conveyances of real property owned, controlled, or used by the City. That authority would remain subject to Board approval requirements and would not apply to the Airport, Port, Public Utilities Commission, or Municipal Transportation Agency.

Why it matters. Higher thresholds mean fewer City contracts and smaller leases reach the Board of Supervisors, which shortens approval timelines for parties contracting with the City and removes a public hearing step.

If approved, these measures would leave the land use entitlement process itself intact while changing who within City government decides, and how quickly those decisions can be made or revisited.

The Coblentz Real Estate Team advises developers, owners, and investors on San Francisco land use approvals and City transactions. Please contact us with questions about how these measures may affect a particular project or transaction.