By Peter Wang and Hunter Moss

California has joined the growing number of states adopting their own premerger-notification regimes. On February 10, 2026, Governor Newsom signed SB 25, the California Uniform Antitrust Premerger Notification Act, requiring certain parties making federal Hart-Scott-Rodino (HSR) filings to submit a copy of that filing to the California Attorney General.[1] The law applies to premerger notifications filed on or after January 1, 2027.[2]

For dealmakers, the significance is practical. California’s new law does not replace HSR and does not create a separate California waiting period or state clearance requirement. But it does add another filing obligation for certain HSR-reportable transactions, gives California earlier visibility into qualifying deals, and creates a fresh issue that both buyers and sellers should address early in transaction planning.

What Does the New Law Require?

SB 25 requires a person filing under the federal HSR Act to submit an electronic copy of the HSR filing to the California Attorney General within one business day after the federal filing if either of two statutory triggers is met. The first trigger is met if the filing person has its principal place of business in California.[3] The second trigger is met if the filing person, or a controlled entity, has California annual net sales of the goods or services involved in the transaction equal to at least 20% of the HSR filing threshold.[4]

The documents required to be filed depend on which trigger is met. If the filing obligation is based on the filer’s principal place of business in California, the filer must provide both the HSR form and the additional documentary material. If the filing obligation is based only on the California sales test, the filer initially submits the HSR form and then provides the additional documentary material only if the Attorney General requests it, in which case the documents must be submitted within seven business days. The statute also authorizes filing fees and civil penalties, including up to $25,000 per day after notice and a three-business-day cure period.[5]

Which Deals are Covered?

 SB 25 does not apply to every merger or acquisition. It applies only where a party is already required to file under the federal HSR Act. For 2026, the FTC announced that the adjusted federal size-of-transaction threshold is $133.9 million, effective February 17, 2026. Because California’s sales trigger is pegged to 20% of the HSR filing threshold, the current California benchmark is roughly $26.8 million in annual California net sales of the goods or services involved in the transaction, although that figure will change as the HSR thresholds are adjusted.[6]

In practical terms, the law is most relevant where a transaction is already large enough to trigger HSR and one or both filing parties has a meaningful California nexus. That nexus may be based on headquarters, California operations, or California sales tied to the relevant goods or services. Because the statute applies to the filing “person,” the analysis should be made carefully for each of the filing parties in a transaction.

Why Both M&A Buyers and Sellers Should Care

For buyers, SB 25 is another execution and diligence issue. It should now be part of the early antitrust and closing analysis for transactions where HSR may be required and there is a California nexus. Buyers will want to understand whether the law applies, whether California document production may be required, and whether the transaction could attract additional state-level attention.

For sellers, the law can be just as important. Sellers planning on negotiating a sale may want to identify early whether the company’s California footprint could make SB 25 relevant to any likely bidders or to the seller itself. Evaluating the applicability of SB 25 early on in the process would help inform process planning, diligence preparation, document management, and discussions around timing and regulatory obligations. Sellers also have a strong interest in avoiding preventable timing friction late in the process, especially when HSR compliance and filings are already on the path to closing.

In short, SB 25 is not just a buyer-side filing issue. It is also an issue during the sale process for companies seeking to position themselves for a smooth transaction.

How Should Parties Build SB 25 into Deal Planning?

The right time to analyze California’s new law is not when the HSR form is nearly complete. Getting ahead of the filing requirements is important – the parties should consider their California obligations early on when building the transaction timetable and identifying regulatory workstreams.

For buyers, that means assessing early on whether the buyer or target has a California principal place of business or sufficient California sales in the relevant goods or services to trigger the filing. For sellers, that means understanding whether the company’s California profile is likely to matter in a future HSR-reportable transaction and being prepared to respond adeptly if a buyer or its counsel raises the issue. For both sides, early analysis can improve coordination around filing timing, document preparation, and allocation of regulatory responsibilities.

A Note for Advertising and Creative-Services Transactions  

The law may be particularly relevant in service-heavy sectors such as advertising, marketing, digital media, and related creative-services businesses. One reason is that the California sales test refers to California annual net sales of the “goods or services involved in the transaction” – understanding what falls under this definition may be more of a challenge to analyze. The law’s language is easier to apply in a business selling discrete products than in a services business with multiple offerings, bundled work, retainer relationships, media buying, creative production, strategy, and platform or subscription revenue.

The potential ambiguity of applicability matters for both sides of a deal. Buyers evaluating an agency platform or creative-services business may need to understand how California revenue maps onto the service lines implicated by the transaction. Sellers in those sectors may likewise benefit from understanding in advance how their California client base or service mix could affect the regulatory analysis in a sale process.

Why the Law May Matter for Food, Beverage, and Wine Deals  

The new law is relevant to transactions in the food, beverage, and wine sectors, where California often plays an outsized commercial role. For branded products businesses, the California sales analysis may be more straightforward than in some services sectors because the relevant products involved in the transaction may map more directly onto product sales by state.

That can matter for both buyers and sellers. A buyer evaluating a beverage brand, winery, food manufacturer, or distribution business may want to test California revenue early in diligence. A seller in those sectors should also understand before going to market whether California product sales or operations could make SB 25 part of the transaction landscape. Even where one side of the deal is headquartered elsewhere, California may still be important because of production, brand identity, distribution, or consumer demand.  

How California Compares with HSR 

HSR remains the primary federal merger-notification regime. California’s law does not replace HSR, and it does not create a separate California approval requirement. Instead, SB 25 is derivative of HSR: if there is no HSR filing, there is no California filing under this statute.

California’s law is also generally described as “non-suspensory,” meaning that it does not independently impose a separate California waiting period before closing. But that does not make it insignificant. It still gives the California Attorney General earlier notice of certain transactions and adds another compliance step that parties must address alongside HSR.

How California Fits into the Broader State-Law Trend 

California is the third state, after Washington and Colorado, to adopt a mini-HSR law modeled on the Uniform Antitrust Premerger Notification Act. That broader trend is important because it suggests that merger-control compliance may increasingly require a state-by-state lens, not just a federal one.

For active buyers, that may mean more multijurisdictional filing analysis. For potential sellers, it means that regulatory preparedness has become part of transaction readiness. In either case, California’s adoption of SB 25 is a reminder that state-level merger oversight continues to expand.

What Should Companies Do Now?  

Companies that are likely to be involved in HSR-reportable transactions should begin treating California nexus as an early merger-planning issue. Buyers should consider whether the target or the buyer itself may trigger the California filing, while sellers should consider whether their California footprint may affect how a future transaction is structured, timed, and diligenced. Both sides should be prepared to coordinate California filing obligations with the federal HSR process.

As state-level merger-control regimes continue to expand, early planning can help parties avoid unnecessary delay, reduce last-minute filing issues, and better allocate regulatory risk in transaction documents. For both buyers and sellers, the most effective approach is to evaluate these issues early – before the HSR filing is underway and before timing assumptions are baked into the deal process.

California’s new law may not create a separate state waiting period, but it does create a new compliance obligation for certain HSR-reportable deals. For both companies pursuing acquisitions and preparing for a sale, that means state-level merger-control analysis is becoming a more important part of transaction planning. Thoughtful counsel can help parties identify these issues early, integrate them into the deal timeline, and manage the regulatory process with greater predictability and ease.

If your company needs assistance, Coblentz’s Corporate attorneys can help. Please reach out to Peter Wang at pwang@coblentzlaw.com or Hunter Moss at hmoss@coblentzlaw.com for further information or assistance.

 

 

[1] Governor Newsom Signs Legislation 2.10.26, https://www.gov.ca.gov/2026/02/10/governor-newsom-signs-legislation-2-10-26/.

[2] SB 25, Uniform Antitrust Pre-Merger Notification Act, Section 16787.

[3] Id. at Section 16782(a)(1).

[4] Id. at Section 16782(a)(2).

[5] Id. at Section 16785.

[6] Federal Trade Commission, Current Thresholds, https://www.ftc.gov/enforcement/premerger-notification-program/current-thresholds.

By Scott Hall and Phillip Wiese 

The Third Circuit recently added to the growing body of wiretapping law addressing the use of session replay technology in In re BPS Direct, LLC; Cabela’s LLC Wiretapping Litig., 2026 WL 1280969 (May 11, 2026). Expanding on its prior decisions, the court held that in certain circumstances, data collected through session replay technology could give rise to a concrete injury sufficient for standing to pursue claims under wiretapping laws including the Electronic Communications Privacy Act (ECPA).

The Third Circuit’s decision is a departure from its prior decision in Cook v. GameStop, Inc.[1] and from Ninth Circuit authority that as to session replay software, consumers have no reasonable expectation of privacy.[2] In light of the Third Circuit’s decision, going forward, online retailers should tread carefully when using session replay to collect analytics on their websites because there may be different risk profiles in different jurisdictions.

Session Replay Technology and Plaintiffs’ Allegations

Session replay technology allows businesses to collect and understand how website visitors browse and interact with their websites. Depending on how it is configured, the software may collect anonymized mouse movements, clicks, keystrokes, scrolls, and text inputs and interactions that can be used to improve website functionality and user experience. Plaintiffs claim that the aggregated data can be combined with user identifiers to create “fingerprints” of a user, and, in some circumstances, can be matched to specific visitors, particularly when the visitor provides identifying information on the website.

Here, eight plaintiffs brought suit against retailers Bass Pro Shops and Cabela’s (together, BPS) for the retailers’ use of session replay technology without their consent. They claimed that the session replay providers (e.g., Microsoft, Quantum Metric, and Mouseflow) created fingerprints of their specific visiting sessions and were able to specifically identify each plaintiff. Crucially, only two plaintiffs alleged that they made any purchases on the websites. The remaining plaintiffs only visited the websites but made no purchases and entered no personally identifying information into the site. Plaintiffs alleged violations of the ECPA and the Computer Fraud and Abuse Act.

Plaintiffs Who Made Purchases Had Standing

BPS successfully moved to dismiss the complaint at the trial court on the basis that the plaintiffs lacked standing to bring their claims. To assert standing, plaintiffs needed to allege, among other things, that they suffered an injury in fact. In determining whether this element is satisfied, courts often look to traditional common law harms to provide the basis for standing in wiretap and privacy actions like this one. The district court compared the plaintiffs’ wiretap claims to the torts of public disclosure of private facts and intrusion upon seclusion and found the plaintiffs’ claims lacking.

Drawing upon two prior decisions,[3] the district court determined, and the Third Circuit agreed, that plaintiffs lacked standing to show an injury under the public disclosure of private facts tort. As to the plaintiffs who did not make a purchase, information allegedly collected was not sensitive or identifiable. As to the plaintiffs who did make purchases, the credit card information and other identifiable information was not publicly disclosed because it remained internal between BPS and its session reply providers.

With respect to the intrusion upon seclusion analysis, the Third Circuit reached a different conclusion from the district court for the two purchasing plaintiffs. For the plaintiffs who did not make a purchase, the court held that “clicks, scrolls, and searches for outdoor products” were not private or worthy of protection because plaintiffs entered no personal or sensitive information. But for the two plaintiffs who purchased products, the analysis was different. By submitting their credit card information to BPS, those two plaintiffs entered “personal or sensitive” information, and thus were injured in a manner similar to intrusion upon seclusion. The Third Circuit determined those two plaintiffs had standing, and their privacy claims against BPS could proceed past the pleading stage, reversing the district court’s dismissal of the claims and remanding for further proceedings.

This decision, and its holding that session replay could run afoul of wiretapping laws, is in direct tension with Popa, where the Ninth Circuit found the purported harm caused by session replay technology was not analogous to the traditional harms for public disclosure of private facts or intrusion upon seclusion. Although the plaintiff in Popa did not allege her credit card information was collected by the session replay technology, she did allege that it captured her mailing address. Notably, California district courts have held that there is no expectation of privacy for credit card information collected by session replay technology. It remains to be seen whether the Ninth Circuit decision would have come out differently had credit card information been at issue.

Key Takeaways

While the Third Circuit confirmed that, in general, there are no issues with session replay technology, companies may still face exposure if they collect “personal and sensitive” information, such as financial or health care data. Going forward, companies may consider the following steps:

• Confirm that session replay tools are configured to mask, redact, or avoid capturing sensitive information fields, including credit card numbers, social security numbers, and any other health or financial data. This may create a successful defense at the motion to dismiss or summary judgment phases.
• Consider disabling session replay on pages where users input “personal and sensitive” information into the website, including social security numbers, credit card information, government identification information, or other financial or health information.
• Continue to assert standing defenses where available, but where “personal and sensitive” information is allegedly captured, develop other non-standing arguments in their responsive pleadings, including consent and whether protected communications were actually intercepted.

If your company needs assistance with any privacy issues, Coblentz Data Privacy & Cybersecurity attorneys can help. Please reach out to Scott Hall or Phillip Wiese for further information or assistance.

 

[1] 148 F.4th 153 (3d Cir. 2025).

[2] Popa v. Microsoft Corp., 143 F.4th 784 (9th Cir. 2025).

[3] Barclift Keystone Credit Servs., LLC, 93 F.4th 136 (3d Cir. 2024); Cook, 148 F.4th 153.

By Scott Hall and Leeza Arbatman

The privacy litigation landscape in California continues to grow in complexity, with plaintiffs advancing new theories of liability based on the use of website tracking technologies. Although California Invasion of Privacy Act (“CIPA”) claims under California Penal Code §§ 631 and 638.51 remain the dominant privacy theories in this space, plaintiffs are increasingly asserting claims under the California Comprehensive Computer Data Access and Fraud Act, California Penal Code § 502 (“CDAFA”).

Background

CDAFA is the California analog to the federal Computer Fraud and Abuse Act, 18 U.S.C. § 1030 (the “CFAA”). The CFAA, an anti-computer-hacking statute, prohibits intentionally accessing and obtaining information from computers without authorization. Congress enacted the CFAA in 1986 when computer hacking was a growing problem. The statute provided only criminal penalties until 1994, when it was amended to add a private right of action, and then amended further throughout the 1990s and 2000s, most notably following 9/11. As a federal statute, CFAA focuses on interstate issues and activity that jeopardizes national security. CDAFA focuses only on conduct within California.

CDAFA was enacted in 1989 and prohibits 13 categories of activity. Broadly speaking, it penalizes knowingly accessing computers without permission to alter or damage data, wrongfully acquiring or retaining unauthorized access to computers to take or make use of data, and related conduct. Like its federal analog, it creates a private right of action for any “owner or lessee of a computer or computer system” that “suffers damage or loss by reason of a violation of [the CDAFA].”[1] CDAFA does not define “damage or loss,” but expressly allows compensatory damages for “any expenditure reasonably and necessarily incurred by the owner or lessee to verify that a computer system, computer network, computer program, or data was or was not altered, damaged, or deleted by the access.”[2] Unlike the CFAA, which imposes a $5,000 loss threshold for civil claims, CDAFA contains no comparable minimum.

Despite the overlap in purpose between the CFAA and CDAFA, courts have recognized important differences between the two statutes. Notably, in United States v. Christensen, the Ninth Circuit explained that the CFAA criminalizes unauthorized access to data, while CDAFA criminalizes the unauthorized taking or use of data. 828 F.3d 763, 789 (9th Cir. 2015). In other words, CFAA focuses on whether permission was given for any access, whereas CDAFA focuses on knowing access (whether authorized or not) that becomes unlawful as a result of taking or using data without authorization. An example of the former is someone logging into another person’s computer using a password they stole. Even if no data was taken or used, such access could lead to CFAA liability. An example of the latter is a website owner knowingly obtaining access to a user’s geolocation data that the user permitted them to access, but then sharing that data with third parties without permission. Even though the collection was permissible, the distribution was not, potentially leading to CDAFA liability.

Under CDAFA, “access,” broadly speaking, means gaining entry to, causing input to or output from, or communicating with a computer system or network.[3] The fact that a third-party technology was the one that actually collected the data does not mean that the website where the collection occurred cannot be held liable. If the website owner caused a third-party application to output user data, that constitutes knowing access and use.

In the recent wave of CDAFA tracking technology litigation, plaintiffs are asserting that defendants violate CDAFA by placing third-party tracking technologies on their websites, which obtain information about website users without their consent. Because plaintiffs have not consented to the collection or use of their data by these third parties, plaintiffs claim this is the type of unauthorized taking or use that CDAFA makes unlawful.

The “Without Authorization” Requirement

To state a CDAFA claim, plaintiffs must plead that the defendant “either acted without authorization or exceeded its authorization.”[4] To have “authorization” means to be “specially recognized or admitted” to have access to that data.[5]

Historically, courts have interpreted acting “without permission” under CDAFA to require that the defendant accessed a computer, network, or website in a manner that overcame technical or code-based barriers.[6] Under this interpretation, a website does not act “without permission” merely by sharing information about users with third parties where no technical barriers prevented the website or third-party tracking technology from accessing that information.

After Christensen, however, some courts have taken a broader approach, holding that overcoming technical or code-based barriers is sufficient to show that someone acted without permission, but not necessary.[8]

These recent interpretations make it easier for CDAFA claims to survive the pleading stage and have led to a growing number of CDAFA suits because there is no need to show a plausible circumvention of a technical barrier; a plaintiff must simply allege that data was plausibly taken or used without permission.

Consent

As with other privacy statutes, consent of the user to the data collection is an important consideration. Some courts have applied the defense narrowly in the CDAFA context. To rely on the consent defense, these courts have held that the website must “explicitly notify users of the practice at issue.”[9] Accordingly, consent has been limited to the specific disclosures provided, which courts have held should have only one plausible interpretation. In other words, if the disclosure “does not specifically and unambiguously inform the user of the data collection practices,” the consent defense may fail.[10]

At the same time, some courts have found general consent to be viable, recognizing the limits on how far CDAFA can be stretched. Under this reasoning, website owners do not have a duty “to disclose how permissions will be exercised,” especially in light of the Supreme Court’s decision in Van Buren v. United States, 593 U.S. 374 (2021), where the Court clarified that the CFAA does not attach to authorized uses of computer databases even when a defendant had “obtained information from the database for an improper purpose.”[11] Since CFAA authorization is a “gates-up-or-down inquiry,” meaning that “one either can or cannot access a computer,”[12] companies can argue that by extension, under CDAFA, if a plaintiff has given a website permission to collect their data, they cannot then argue that the subsequent use of that data for particular purposes exceeds the authorization originally granted.[13]

Ownership Interest

CDAFA also requires the plaintiff to have the required ownership or possessory interest in the computer or data at issue.[14] “[O]wnership is often linked to the entity who created the property at issue. For instance, where a plaintiff drafts emails or technical documents that are stored in a third-party’s servers and then accessed by a defendant without authorization, a CDAFA claim is cognizable because the plaintiff author retains some ownership interest in the data at issue.”[15]

That ownership theory becomes more difficult where the plaintiff asserts an interest in data collected or generated by someone else. As one court explained, “where a plaintiff’s personal data (e.g., financial information, health data) is collected or generated by a third-party, and stored by a third-party, the plaintiff may retain some form of interest—for example, a privacy interest, but cannot necessarily claim an ownership interest in that data under the CDAFA.”[16] So, under this theory, website owners that collect and store third-party information can argue that any plaintiffs suing under CDAFA do not have the type of ownership interest in such data that permits recovery under the statute.

Damage or Loss

Courts have also dismissed CDAFA claims where the alleged website tracking does not amount to the kind of access or use that CDAFA prohibits, meaning plaintiffs suffered no cognizable damage or loss. For example, courts may find that the installation of web tracking technologies on a website does not equate to trackers being installed on a user’s own device or that the alleged data collection occurred on the user’s own device rather than on the website the plaintiff was browsing (thus defeating any claim that there was unauthorized access of the plaintiff’s computer).[17]

Plaintiffs have tried to frame their injury as the loss of the ability to control their data, the loss of the value of their data because it has been disseminated to third parties, and the loss of the ability to protect their data. Courts have rejected these damages theories, finding that damages or loss under CDAFA should be understood as damages to the underlying computer system or data on that computer, rather than the data that a plaintiff generates when on a defendant’s website.[18] Plaintiffs have had some success by alleging that the company unjustly profited from the use of their data by selling it to third parties or using it for targeted advertising.[19] That said, other courts have rejected this theory as well, explaining that disgorgement could be viable if plaintiffs alleged an intent to personally sell their data, but that such an allegation would contradict related invasion of privacy claims that are often asserted in conjunction with CDAFA.[20]

Takeaways

CDAFA claims are likely to become a more common companion to CIPA and pen-register theories in website tracking litigation. Plaintiffs will try to frame pixels, cookies, session-replay tools, and other commonplace tracking technologies as code that knowingly accesses their data and takes or uses it without authorization. They will assert that they have suffered damages either because the value of their data has been diminished, they lost control of their data, or the defendant has been unjustly enriched by accessing and profiting from their data.

As these new privacy liability theories play out, businesses should be proactive about protecting themselves from becoming the target of one of these lawsuits. Consent remains important: companies should use clear and specific consent banners, avoid placing non-essential cookies and tracking technologies before authorization, and ensure that their privacy policies and related disclosures accurately describe the technologies in use and the types of tracking occurring. If sued, businesses should consider whether the plaintiff consented to the collection or use of their data, the alleged tracking actually accessed the plaintiff’s computer, the plaintiff maintained the required ownership interest in the data, and the alleged injury is a cognizable damage or loss under CDAFA.

If your company needs assistance with any privacy issues, Coblentz Data Privacy & Cybersecurity attorneys can help. Please contact Scott Hall at shall@coblentzlaw.com for further information or assistance.

 

 

[1] Cal. Pen. Code § 502(e)(1).
[2] Id.
[3] Cal. Pen. Code § 502(b)(1).
[4] Wendover Prods., LLC v. Paypal Inc., 2025 WL 3251667, at *4 (N.D. Cal. Nov. 21, 2025).
[5] See hiQ Labs, Inc. v. LinkedIn Corp., 31 F.4th 1180, 1195–96 (9th Cir. 2022).
[6] See, e.g., In re Facebook Priv. Litig., 791 F. Supp. 2d 705, 715 (N.D. Cal. 2011), aff’d, 572 F. App’x 494 (9th Cir. 2014); Sunbelt Rentals, Inc. v. Victor, 2014 WL 4274313 (N.D. Cal. Aug. 28, 2014).
[7] See In re Facebook Priv. Litig., 791 F. Supp. 2d at 715.
[8] See, e.g., Greenley v. Kochava, Inc., 684 F. Supp. 3d 1024, 1049 (S.D. Cal. 2023); Esparza v. Kohl’s Inc., 723 F. Supp. 3d 934, 945 (S.D. Cal. 2024).
[9] Greenley, 684 F. Supp. 3d at 1048 (citing Brown v. Google LLC, 525 F. Supp. 3d 1024, 1063).
[10] Id.
[11] Wendover Prods. LLC v. Paypal Inc., 2025 WL 3251667, at *5 (N.D. Cal. Nov. 21, 2025) (citing Van Buren, 593 U.S. at 396).
[12] Van Buren, 593 U.S. at 390.
[13] Wendover Prods. LLC, 2025 WL 3251667, at *5 (plaintiffs admit “that PayPal uses the very same permissions it was granted to carry out the challenged conduct”—since neither CFAA nor CDAFA impose any duty “to disclose how permissions will be exercised,” plaintiffs fail to demonstrate PayPal has acted without authorization).
[14] Cal. Penal Code § 502(e)(1).
[15] In re Cap. One Fin. Corp., 2025 WL 1570973, at *14 (E.D. Va. June 2, 2025).
[16] Id. (cleaned up).
[17] See, e.g., Allison v. PHH Mortg., 2026 WL 899438, at *7 (N.D. Cal. Mar. 27, 2026).
[18] See, e.g., Doe v. Cnty. of Santa Clara, 2024 WL 3346257, at *9 (N.D. Cal. July 8, 2024); Doe v. Meta Platforms, Inc., 690 F. Supp. 3d 1064, 1082 (N.D. Cal. 2023); Cottle v. Plaid Inc., 536 F. Supp. 3d at 461, 487-88 (N.D. Cal. 2021).
[19] See, e.g., Tsering v. Meta Platforms, Inc., 2026 WL 89320, at *5 (N.D. Cal. Jan. 12, 2026) (citing Smith v. Rack Room Shoes, Inc., 2025 WL 2210002, at *3 (N.D. Cal. Aug. 4, 2025)).
[20] See, e.g., Dellasala et al. v. Samba TV, Inc., 2026 WL 1138358, at *8-9 (N.D. Cal. Apr. 21, 2026); Doe v. Tenet Healthcare Corp., 789 F. Supp. 3d 814, 844-45 (E.D. Cal. 2025).

By Scott Hall and Phillip Wiese

Plaintiffs have continued to file privacy litigation at a furious pace, asserting claims under the California Invasion of Privacy Act (CIPA), the federal Video Privacy Protection Act (VPPA), and, increasingly, the federal Electronic Communications Privacy Act (ECPA). Plaintiffs have paid particular attention to the healthcare and financial services spaces, focusing on purported collection of sensitive personal information, but suits against other consumer retailers and service providers have not slowed either. These suits remain centered on modern tracking technologies like pixels, session replay tools, cookies, and embedded analytics software.

Case law on these issues remains in flux, although suits are beginning to trickle up to the appellate level for review. With respect to the VPPA, the Supreme Court is set to hear a case about how broadly the definition of “consumer” should be interpreted. Additionally, the Ninth Circuit attempted to clarify Article III standing in CIPA and ECPA claims, but lower courts have split when applying its holding. And the California federal court/state court divide continues to deepen when determining if cookies and pixels are covered by the CIPA pen register and trap and trace law. Against this backdrop of uncertainty, the California legislature is weighing whether to amend CIPA through SB 690, but there has been no movement at this point in the legislative cycle.

Supreme Court Grants Certiorari in VPPA Case

In January 2026, the Supreme Court agreed to hear Salazar v. Paramount Global, arising from the Sixth Circuit, to settle a circuit split about whether the VPPA requires that a “consumer” subscribe to audiovisual goods or services from a video tape service provider.

The VPPA prohibits a “video tape service provider” from disclosing any personally identifiable information about a “consumer.” A “video tape service provider” is someone that rents, sells, or delivers “prerecorded video cassette tapes or similar audio visual materials.” A “consumer” is “any renter, purchaser, or subscriber of goods or services from a video tape service provider.”

The plaintiff alleged that he watched video content on a college sports news site, 247Sports.com, and that his Facebook ID and video-viewing history were disclosed to Facebook by Paramount Global, the sports news site’s parent company. This disclosure, he claimed, violated the VPPA because 247Sports.com was a video tape service provider and improperly disclosed to Facebook the videos he watched on the website.[1]

The Sixth Circuit disagreed, holding that the plaintiff was not a “consumer” under the statute because while he subscribed to the 247Sports.com newsletter, that was separate from the subscription of audiovisual materials on the website. The Sixth Circuit split from the Second Circuit, which held the opposite, that newsletter subscriptions were sufficient to be a “consumer” under the VPPA, even if the newsletter had no audiovisual content.[2]

The case is likely to be heard during the Court’s 2026/2027 term and if the Court adopts the narrow definition of consumer, the result could significantly slow future VPPA litigation.

Ninth Circuit Clarifies Standing Issues with Respect to Statutory Wiretap Claims

The Ninth Circuit limited Article III standing in privacy cases in its August 2025 decision Popa v. Microsoft Corp., 153 F.4th 784 (9th Cir. 2025). In that case, the plaintiff alleged that while browsing for pet food on a pet supply website, her browsing activity was captured by Microsoft’s session replay technology. Her claims for violation of Pennsylvania’s Wiretapping and Electronic Surveillance Control Act (WESCA) and intrusion upon seclusion were dismissed by the trial court for lack of Article III standing.

The Ninth Circuit affirmed the trial court, concluding that the plaintiff failed to allege a “concrete” injury to support her claim and that a bare statutory violation of WESCA did not satisfy the tests set forth in Spokeo and TransUnion.[3] Drawing upon TransUnion, the Ninth Circuit analyzed whether the plaintiff alleged an injury bearing “a close relationship to a harm traditionally recognized as providing a basis for a lawsuit in American courts.”[4] The Ninth Circuit analogized the plaintiff’s claim to the common law torts of intrusion upon seclusion and public disclosure of private facts, both of which require that any intrusion or disclosure be “highly offensive to a reasonable person,” and found plaintiff’s claims to be lacking.[5] Notably, the plaintiff did not identify any “embarrassing, invasive, or otherwise private information collected by” Microsoft’s software.[6] Plaintiff instead pleaded that the technology gathered her pet-store preferences and her street name, none of which was protected or highly offensive. Rather, the interactions were more similar to “a store clerk’s observing shoppers in order to identify aisles that are particularly popular or to spot problems that disrupt potential sales.”[7] The court noted that the result may differ in other circumstances if a greater volume of data is collected from across the internet and used to create user profiles.

Companies were quick to invoke Popa to dismiss claims, but the district courts continue to be split on the issue. Some courts have applied Popa broadly, finding that the disclosure of website browsing data was not highly offensive:

• Garcia v. Blackhawk Network, Inc., 2026 WL 925028 (C.D. Cal. Apr. 1, 2026) (Staton, J.), holding that “informing a third party about Plaintiff’s interactions with [a] website” was not embarrassing, invasive, or otherwise private;
• Maghoney v. Dotdash Meredith, Inc., 2026 WL 497402 (S.D. Cal. Feb. 23, 2026) (Battaglia, J.), holding that searches for allegedly sensitive health-related terms on a public-facing website were not highly offensive; and
• Khamooshi v. Politico LLC, 2025 WL 2822879 (N.D. Cal. Oct. 2, 2025) (Kim, M.J.), holding that browsing activity, geolocation data, and “device fingerprints” were not sufficiently embarrassing, invasive, or otherwise private to support Article III standing.

Other courts distinguish Popa by finding the type of data and sheer volume of data allegedly collected cross the “highly offensive” line:

• Harris v. iHeartMedia, Inc., 2026 WL 247875 (N.D. Cal. Jan. 29, 2026) (Lee, J.), holding that the plaintiff had standing because the data was allegedly used to create a “cradle-to-grave profile” of his web browsing activities across the internet;
• Shah v. MyFitnessPal, Inc., 2026 WL 216334 (N.D. Cal. Jan. 27, 2026) (Pitts, J.), holding that plaintiffs had standing because they were allegedly told that sensitive information would not be shared with third parties even though it later was shared; and
• Semien v. PubMatic Inc., 2026 WL 216333 (N.D. Cal. Jan. 27, 2026) (Illston, J.), holding that plaintiffs’ allegations that the defendant compiled detailed user profiles by tracking interactions across numerous websites and collected sensitive personal information without consent was sufficient to confer standing.

This decision may not be the panacea companies hoped for, but it, at minimum, increases the burden for plaintiffs at the pleading stage and provides a new line of attack in these challenging CIPA cases.

Divide Grows Between California State and Federal Courts in Pen Register, Trap and Trace Suits

There also appears to be a growing split between state and federal courts in California over whether tracking technology, including cookies and pixels, are pen registers or trap and trace devices that can form the basis of a CIPA section 638.51 claim. Interestingly, both state and federal courts ground their analysis in the statutory text and the legislative history yet reach conflicting results.

Section 638.51 prohibits using a pen register or trap and trace device without a court order. The state court decisions interpreting this section typically draw on the language from section 638.52 to limit the definition of pen register and trap and trace to telephone lines.[8] This cross-referenced language demonstrates that pen registers and trap and trace devices are separate from software or technology that operates on a computer or other device.[9] State courts also refer to the legislative history of section 638.51 that described the purposes as allowing law enforcement officers to monitor telephonic communications after obtaining a court order.[10]

While federal courts are obligated to interpret California laws like CIPA the same way the California Supreme Court would, there are no California Supreme Court or Court of Appeals decisions interpreting section 638.51, leaving the federal courts to apply their own standard. The federal courts have, by and large, found that sections 638.50 and 638.51 lack any limitation to telephone, and thus the legislature intended the law to apply broadly to include “evolving privacy threats.”[11] This broad statutory language, these courts hold, “is consistent with the California Legislature’s stated intent to protect privacy interests.”[12]

These conflicting decisions have led to confusion and uncertainty for companies trying to comply with CIPA. For now, section 638.51 liability may depend on the forum in which a suit is filed and the preferences of the individual judge.

No Update on California Wiretap Law Amendment

Meanwhile, plaintiffs and defendants alike continue to watch the California legislature to see whether it will pass legislation to amend CIPA. SB 690, which was introduced in February 2025 but advanced to the 2026 legislative session, would significantly curb the ongoing deluge of CIPA litigation. Specifically, the bill would exempt from CIPA liability the use of recording or tracking technologies that serve a “commercial business purpose,” targeting the near-ubiquitous pixels, cookies, and other website tracking technology.

SB 690 garnered strong support in 2025, but there has been no action thus far in the legislative cycle.

Until either the legislature or appellate courts provide clearer guidance, companies should continue to treat website tracking litigation as an active and evolving risk area. Regular review of tracking technologies, consent flows, vendor contracts, and privacy disclosures remains important, especially for businesses operating in sensitive sectors or using tools that collect data across multiple websites or services.

If your company needs assistance with any privacy issues, Coblentz Data Privacy & Cybersecurity attorneys can help. Please contact Scott Hall at shall@coblentzlaw.com or Phillip Wiese at pwiese@coblentzlaw.com for further information or assistance.

 

 

[1] Salazar v. Paramount Global, 133 F.4th 642 (6th Cir. 2025).
[2] Salazar v. National Basketball Ass’n, 118 F.4th 533 (2d Cir. 2024).
[3] Spokeo, Inc. v. Robins, 578 U.S. 330 (2016); TransUnion LLC v. Ramirez, 594 U.S. 413 (2021).
[4] Popa, 153 F.4th at 789.
[5] Id. at 791.
[6] Id.
[7] Id.
[8] An order authorizing installation of a pen register or trap and trace device must specify: “(1) The identity, if known, of the person to whom is leased or in whose name is listed the telephone line to which the pen register or trap and trace device is to be attached. . . . [and] (3) The number and, if known, physical location of the telephone line to which the pen register or trap and trace device is to be attached . . . .” Cal. Pen. Code § 638.52(d) (emphasis added).
[9] See Schallert v. Orkin LLC, 2025 WL 4332757, at *4 (L.A.S.C. Dec. 15, 2025).
[10] Id.; see also Rodriguez v. Ink America Int’l Grp. LLC, 2025 WL 4034985, at *4 (L.A.S.C. Dec. 10, 2025) (holding that the lack of reference to website tracking technology when the law was amended in 2016 and 2022 confirms that the legislature made a “deliberate choice not to sweep ordinary website analytics” into the law’s provisions); Schallert v. Palo Alto Networks, Inc., 2026 WL 54028, at *2 (L.A.S.C. Mar. 6, 2026) (same).
[11] See Fregosa v. Mashable, Inc., 2025 WL 2886399, at *5 (N.D. Cal. Oct. 9, 2025).
[12] Walsh v. Dollar Tree Stores, Inc., 2025 WL 2939229, at *18 (N.D. Cal. Oct. 16, 2025) (quoting Shah v. Fandom, Inc., 754 F. Supp. 3d 924, 930 (N.D. Cal. 2024)).

By Scott Hall and Phillip Wiese

The Ninth Circuit recently issued a decision partially lifting a broad preliminary injunction staying enforcement of the California Age-Appropriate Design Code Act (“CAADCA”). As a result, portions of the law are now in effect and create ongoing obligations for businesses that provide online services, products, or features “likely to be accessed by children.” Those provisions are described below.

By way of background, the California legislature in 2022 enacted the California Age-Appropriate Design Code Act (“CAADCA”), which established certain standards to protect children’s privacy online. Importantly, the law defined a child as anyone under 18 years old. This creates a separate age threshold from the CCPA, which imposes certain obligations for children under 13 and under 16 years old. Practically since the CAADCA was enacted, the law has faced legal challenges and has been preliminarily enjoined by courts, but as a result of the recent Ninth Circuit decision, the preliminary injunction as to the entire law has been lifted and portions of the law are now in effect.

Although litigation is ongoing and the implementation of the law continues to develop, the CAADCA imposes the following obligations for businesses:

• Estimate the age of child users or apply a “high level” of privacy protection to all users;
• Set privacy settings for children to the highest level by default;
• Use age-appropriate language for privacy policies aimed at children;
• Allow parents to monitor the child’s online activity and provide a signal to the child when being tracked;
• Provide tools to help users exercise their privacy rights;
• Minimize and limit the usage of personal information collected to estimate a child’s age; and
• Not process a child’s precise geolocation by default or absent a signal that the geolocation is being collected.

There are also a number of provisions that are not in effect and remain subject to the Ninth Circuit’s preliminary injunction:

• Businesses are not presently required to conduct Data Protection Impact Assessments (“DPIA”) for any product or service likely to be accessed or used by children. The Ninth Circuit held that this was a violation of First Amendment rights.
• There are a number of prohibitions in the CAADCA on collecting or using children’s personal information (1) that the business knows “is materially detrimental to the physical health, mental health, or well-being of a child” or (2) absent a compelling reason that the collection or use “is in the best interests of children.” The Ninth Circuit held that the quoted language was unconstitutionally vague and those prohibitions are not enforceable.

In addition to the evolving legal landscape in California, other state legislatures have started drafting their own child privacy laws. Similar laws have been enacted in Arkansas, Colorado, Louisiana, Maryland, Mississippi, Montana, Nebraska, New York, Texas, Utah, and Vermont, although no two laws are the same. And while legal challenges have been raised with respect to many of these laws, the focus on children’s privacy rights remains clear. We expect these laws to be the focus of state regulators and privacy advocates for the foreseeable future.

If your company needs assistance with any privacy issues, Coblentz Data Privacy & Cybersecurity attorneys can help. Please contact Scott Hall at shall@coblentzlaw.com or Phillip Wiese at pwiese@coblentzlaw.com for further information or assistance.

By Scott Hall and Saachi Gorinstein

California’s data broker regulations continue to evolve, raising important compliance questions for businesses that compile and license personal data, including what constitutes a data broker and what obligations attach to those businesses. Those questions are often not straightforward, especially where personal information is collected through publicly available databases. Companies operating in B2B data markets should review and assess their obligations under the California Consumer Privacy Act (CCPA) and California’s Data Broker Law as updated by SB 362 and SB 361.

SB 362 and SB 361 amended California’s Data Broker Law by adding new obligations for businesses that qualify as data brokers: SB 362 (the “Delete Act”) established a centralized deletion mechanism and new operational requirements, including the Delete Request and Opt-out Platform (“DROP”) system, while SB 361 (the “Defending Californians’ Data Act”) expanded registration disclosure and transparency obligations.

When Does a Business Qualify as a Data Broker?

A “data broker” is a business that knowingly collects and sells personal information about consumers with whom it does not have a direct relationship. This definition incorporates key terms from the CCPA, including “personal information” and “sale.”

A critical threshold issue is whether the data being collected and sold qualifies as “personal information.” “Sale,” here and under the CCPA, means to sell, rent, disclose, make available, or otherwise disseminate a consumer’s personal information in exchange for monetary or other valuable consideration. And “personal information” is information that identifies, relates to, or could reasonably be linked with a consumer or a consumer’s household.

The CCPA excludes certain publicly available information from the definition of personal information, including information lawfully made available from federal, state, or local government records, certain information made available to the general public by the consumer or from widely distributed media, and certain information made available by a person to whom the consumer disclosed the information, if the consumer has not restricted it to a specific audience.

As a result, a business that collects and sells only publicly available information may not be handling “personal information” for purposes of the data broker definition. However, there is no categorical exemption for businesses that rely on public records. The analysis turns on whether the data retains its status as publicly available information or is transformed through the business’s aggregation, enhancement, or licensing practices.

For companies that compile professional contact data from licensing boards or government registries, this distinction can be outcome-determinative. While the CCPA excludes certain publicly available information from the definition of personal information, the analysis may become more complex where that data is aggregated, enhanced, or combined with other sources, raising questions as to whether the resulting dataset continues to qualify as publicly available information.

Do Data Brokers Have to Delete Public Record Data?

An important nuance is that DROP changes how consumers submit deletion requests, but it does not eliminate existing statutory limitations on consumer rights under the CCPA.

Upon receiving a DROP request, a data broker must delete the consumer’s personal information in its possession. Critically, however, under the CCPA, publicly available information is excluded from the definition of personal information for certain purposes. As a result, CCPA consumer rights, including the right to deletion, generally do not apply to such information.

CalPrivacy guidance reinforces this point, stating that businesses may deny consumer requests, including deletion requests, where the information at issue is “publicly available information” or otherwise exempt from the CCPA. More broadly, data brokers may retain personal information if an applicable CalPrivacy deletion exception applies. These exceptions include, among others, completing transactions, security and fraud prevention, legal compliance, and internal operational uses. When an exception applies, the business must limit use of retained data to the purpose justifying retention.

At the same time, businesses should avoid treating this as a blanket exemption. Whether information qualifies as publicly available is a fact-specific inquiry, particularly where data is aggregated, enhanced, or combined with other datasets. If a business holds both exempt publicly available information and non-exempt personal information about a consumer, the non-exempt data may still need to be deleted in response to a request.

In addition, even where a deletion request is denied, other obligations may still apply. For example, if a business sells or shares personal information, it must still inform consumers of their right to opt out of such sale or sharing.

Accordingly, while DROP introduces new operational requirements for processing deletion requests, it does not expand the scope of what information must ultimately be deleted under the CCPA. Depending on the volume and type of data collected, this process could take time, so businesses may want to start categorizing their data now, ahead of the August 1 deadline to begin processing deletion requests.

“Direct Relationship” Interpretation

The Data Broker Law also requires that the business lack a “direct relationship” with consumers. The recent Delete Act regulations add crucial context defining a direct relationship as one in which the “consumer has intentionally interacted with a business for the purpose of accessing, purchasing, using, requesting, or obtaining information about the business’s products or services.”

This definition is important for businesses that collect data through indirect or passive means, including third-party tracking technologies, data append services, or third-party datasets. A business should not assume that collecting data directly from a consumer necessarily creates a direct relationship. The consumer’s interaction must be intentional and directed to the business’s own products or services.

Even with this definition, important questions remain. For example, businesses may still need to assess how the concept applies in attenuated B2B contexts, whether particular interactions with individual business representatives are sufficient, and how data obtained outside a first-party interaction should be treated. These issues require careful, fact-specific analysis.

2026 Compliance Timeline and Requirements

While determining whether a company is a data broker can be complicated, once that determination has been made, the compliance timeline and requirements are more straightforward. Businesses that qualify as data brokers face several key obligations beginning in 2026:

• Registration: Data brokers must register annually with CalPrivacy (formerly the CPPA) by January 31 following each year in which they meet the definition.
• DROP System: As part of registration, businesses must create an account on CalPrivacy’s Delete Request and Opt-Out Platform (DROP), which took effect on January 1, 2026. Then, beginning August 1, 2026, data brokers must access the DROP system at least once every 45 days and process verified deletion requests through it, subject to statutory exceptions. While this obligation does not affect whether the Company must register for 2026, it is a new material operational compliance requirement after registration.
• Metrics Reporting: By July 1 each year, data brokers must publish detailed metrics in their privacy policies regarding consumer requests, including the number of requests received, fulfilled, and denied, and response times.
• Audits: Starting January 1, 2028, data brokers must undergo independent third-party audits every three years and maintain audit records for six years.

SB 362 and SB 361 expand disclosure and operational requirements, including more detailed reporting on the categories of personal information collected and consumer request handling.

Enforcement Risk and Prior-Year Exposure

CalPrivacy has made data broker compliance a clear enforcement priority. The agency has conducted enforcement sweeps and entered into settlements with data brokers for violations of the Delete Act, signaling increased scrutiny.

Failure to comply with registration requirements can result in:

• Administrative fines of $200 per day of non-compliance;
• Payment of unpaid registration fees; and
• Recovery of CalPrivacy’s investigative and enforcement costs.

Separate penalties may apply for failure to comply with deletion requirements, including fines of $200 per day per unfulfilled deletion request.

In addition, CalPrivacy and the California Attorney General may seek civil penalties of up to $2,663 per violation and $7,988 per intentional violation, including for violations involving minors. Importantly, these penalties may apply not only to current violations, but also to prior-year conduct within the applicable statute of limitations.

Key Takeaways

For B2B businesses that license or monetize data, several takeaways emerge:

• Public record sourcing does not automatically resolve data broker status.
• Whether data qualifies as “publicly available” under the CCPA is a critical threshold issue.
• The meaning of “direct relationship” requires careful, fact-specific legal analysis.
• 2026 introduces significant new operational obligations, including DROP-based deletion workflows.
• Enforcement is active, and non-compliance carries meaningful financial and operational risk.

Given these developments, businesses should evaluate their data practices now to determine whether they may qualify as data brokers and to prepare for upcoming registration and compliance requirements.

If your company needs assistance with any privacy issues, Coblentz Data Privacy & Cybersecurity attorneys can help. Please contact Scott Hall at shall@coblentzlaw.com for further information or assistance.

 

By Scott Hall

Artificial intelligence regulation has entered a new phase. What started as policy conversations about innovation, ethics, and voluntary guardrails is now a real compliance issue centered on privacy, transparency, discrimination risk, and accountability for automated outcomes. For businesses, the question is no longer just whether to use AI, but how to use it responsibly, lawfully, ethically, and efficiently, while building trust with consumers.

California remains one of the key states to watch. The state has continued to expand its privacy framework in ways that directly affect AI systems, including through the CPPA’s finalized rules on automated decision-making technology, risk assessments, and cybersecurity audits, as well as statutes addressing AI disclosures, training-data transparency, and synthetic content. Those developments are important —not just because of California’s market power, but because they reflect a broader regulatory instinct: treating AI as part of the privacy and consumer protection landscape, especially when automated tools rely on personal information.

At the same time, federal AI policy has become more unsettled. Rather than moving toward one comprehensive federal law, the national approach has continued to shift with changing administrations, executive branch priorities, and agency agendas. President Trump recently issued a “National Policy Framework for Artificial Intelligence” intended to preempt state law and address seven objectives that, in many ways, directly contradict the AI framework set out by the Biden administration and states that have already implemented AI regulations. In particular, rather than tighten restrictions on AI systems, the Trump framework would avoid broad content standards with the goal of avoiding excessive litigation. Even if the framework is not enacted, the uncertainty leaves businesses in an awkward position. Less federal oversight does not necessarily mean lower risk. In practice, it often means less uniformity, more uncertainty, and greater pressure to track what states, regulators, and private plaintiffs are doing without a lot of central guidance.

This reality helps explain why states continue to move aggressively to fill the gap. Some are adopting broad, risk-based AI frameworks. Others are focusing on narrower but still important issues, such as chatbot disclosures, profiling, health-related uses, insurance determinations, and AI tools used in employment decisions. The regulatory picture is developing issue by issue and sector by sector, rather than through a single national standard. That legal and regulatory patchwork—which is familiar in the privacy landscape—is harder for businesses to manage, but it is quickly becoming the reality for AI.

One notable theme is that states are increasingly using existing legal frameworks to address AI risk, rather than waiting for entirely new AI statutes. In employment, for example, states are starting to apply discrimination principles directly to automated hiring and screening tools. In privacy, states are using profiling, sensitive-data, and transparency rules to reach AI systems that make or support consequential decisions. That means companies must not only monitor new AI laws, but also consider how older laws may apply to the new technologies they are using.

We are also likely to see different rules for different AI uses. Not every AI-enabled tool will draw the same level of scrutiny. Consumer-facing tools that support routine tasks are likely to face lighter oversight than systems used for underwriting, hiring, eligibility, diagnosis, or other decisions that can significantly affect individuals. That risk-based approach is consistent with both the EU model and California’s Automated Decision-making Technology (ADMT) rules, which focus more closely on significant decision-making contexts. For companies, the practical takeaway is that compliance efforts should be prioritized based on use case, not just on whether a tool is labeled “AI.”

Globally, the EU AI Act remains the leading comprehensive model, with obligations tied to risk classification and substantial requirements for high-risk and general-purpose AI systems. Other jurisdictions are taking different approaches, but the overall direction is the same: more formal governance and more regulatory interest in documentation, transparency, and accountability. For companies operating across borders, that means AI compliance cannot be treated solely as a U.S. state-law issue. It increasingly requires a governance structure that can respond to different legal triggers while maintaining a consistent baseline of documentation and control.

We can also expect regulators to dig deeper into how AI works in practice. They want to know what data a system uses, how its outputs are reviewed, whether human oversight is real or just nominal, and whether the system creates privacy, fairness, or transparency concerns. As a result, AI governance is starting to look a lot like privacy compliance: inventorying systems, documenting use cases, assessing risk, limiting data use, testing for problems, and putting controls in place that can be defended later. Accountability in how AI is actually used matters more than simply having a policy on paper. It is also worth noting that enforcement risk is not limited to agency action. As AI becomes more embedded in decision-making, private plaintiffs are also testing new theories in private litigation, including through discrimination claims for AI use in employment and hiring decisions, or wiretapping claims for AI notetaking tools or other online services.

Ultimately, AI regulation is not emerging through just one statute, one agency, or one theory of liability. It is developing through privacy law, consumer protection, sector-specific regulation, administrative rulemaking, state legislation, and private litigation, often all at once. In the U.S., California remains one of the clearest signals of where this is heading, but it is not alone. Businesses adopting AI should expect questions not just about what the technology can do, but about what data is used, how it is governed, whether and how humans remain accountable, and whether AI use matches reasonable expectations of privacy and fairness. As AI becomes embedded in business operations, companies will be best positioned to manage risk when governance is built into everyday decision-making and workflows, rather than addressed only after problems arise.

If your company needs assistance with any privacy issues, Coblentz Data Privacy & Cybersecurity attorneys can help. Please contact Scott Hall at shall@coblentzlaw.com for further information or assistance.

Navigating the Evolving Legal Landscape of Data Privacy, Cybersecurity, and AI

By Scott Hall, Phillip Wiese, Leeza Arbatman, Kat Gianelli, and Saachi Gorinstein

Download a PDF version of this report here.

Privacy, cybersecurity, and AI regulation continue to be front and center in all aspects of business operations. Two additional states, Oklahoma and Alabama, have recently passed comprehensive consumer privacy laws, increasing the patchwork enforcement framework across the country, while federal laws continue to be proposed but may not be any closer than before.

At the same time, regulators have accelerated enforcement actions against companies that do not comply with state laws, and privacy litigation continues to flood dockets with claims for violations of the California Invasion of Privacy Act (CIPA) and the Video Privacy Protection Act (VPPA). Companies are also facing increased regulatory scrutiny over the collection and use of health data and minors’ data, while also navigating uncertain waters with respect to the intersection of artificial intelligence governance and consumer privacy.

Our 2026 Spring Privacy Report examines key developments shaping the privacy, cybersecurity, and AI landscape this year, along with practical considerations for businesses. View the full report here.

Summer Privacy Webinar – June 16, 2026

Please join Scott Hall and the Data Privacy team on Tuesday, June 16, 2026 for our Summer Privacy Webinar, where we will discuss these developments in greater detail. RSVP for the webinar here.

If your company needs assistance with any privacy issues, Coblentz Data Privacy & Cybersecurity attorneys can help. Please contact Scott Hall at shall@coblentzlaw.com for further information or assistance.

By Hannah Withers and Hannah Jones

In 2025, three federal district courts in California addressed the same open question and reached a similar conclusion: that under California’s Fair Employment and Housing Act (“FEHA”), California employers may be required to engage in the interactive process and potentially provide reasonable accommodations to caretaker employees who are not disabled themselves, but who request accommodations to care for other disabled persons. This requirement goes beyond the prohibition of discriminating against employees because they are associated with disabled individuals and has practical implications for how employers need to evaluate leave requests, schedule modifications, and other accommodations sought by employee caregivers.

This Is Only About Disability Accommodations Under FEHA, Not The Federal ADA

This development is specific to California’s FEHA and it does not arise under the federal Americans with Disabilities Act (“ADA”). The distinction stems from how the two statutes are structured.

Under the ADA, the prohibition relating to discriminating against an employee for “association” with someone who is disabled appears only in the anti-discrimination provision, not in the accommodation provisions. Federal courts have therefore consistently held that the ADA does not require accommodation of a non-disabled employee based on associational disability.

FEHA arguably allows a different approach. California Government Code Section 12926(o) defines the statute’s list of protected characteristics, including “physical disability” and “mental disability,” to encompass “a perception that the person is associated with a person who has, or is perceived to have, any of those characteristics.” Some Courts have interpreted this definition to apply to the entirety of FEHA’s unlawful practices provisions, including Section 12940(m), which requires employers to make reasonable accommodation for “the known physical or mental disability of an applicant or employee,” and Section 12940(n), which requires employers to engage in an interactive process to determine effective reasonable accommodations for “an employee or applicant with a known physical or mental disability.” However, although that interpretation is not universally accepted and remains subject to further judicial clarification, employers should be aware that courts are extending the accommodation requirement this way.

The Backstory: Castro-Ramirez and the Unresolved Question of Associational Disability Accommodation

This issue has been percolating for years. In 2016, the California Court of Appeal in Castro-Ramirez v. Dependable Highway Express, Inc., 2 Cal. App. 5th 1028, held that FEHA supports a cause of action for associational disability discrimination. But the court expressly declined to decide whether FEHA also requires employers to accommodate employees based on an associational disability, suggesting only that Section 12940(m) “may reasonably be interpreted to require accommodation based on the employee’s association with a physically disabled person.” In the years that followed, a handful of unpublished decisions concluded the opposite, reasoning that the accommodation provisions do not expressly incorporate the broader definition of disability from Section 12926(o). Meanwhile, in late 2020 and early 2021, the Fair Employment and Housing Council itself issued a Request for Public Input on this very question, signaling that even the regulatory body overseeing FEHA viewed the issue as unsettled.

The 2025 Trilogy: Acosta, Head, and De Wit

In 2025, three federal district courts in California squarely confronted the open question and each concluded that FEHA does require accommodation and interactive process engagement for associational disability claims.

Acosta v. NAS Insurance Services, LLC (C.D. Cal.)

In Acosta, the plaintiff requested reduced hours, a flexible schedule, and full-time remote work to care for her son, who had been diagnosed with a severe developmental delay. Her employer denied every request, telling her that “accommodations are for employees who have a disability, and do not extend to dependents of employees for whom the employee is a caretaker.” She alleged she was eventually constructively terminated. The court denied the employer’s motion to dismiss, including claims for failure to engage in the interactive process and failure to provide reasonable accommodation under FEHA, holding that Sections 12940(m) and (n) “embrace employees perceived to be associated with a person who is disabled” and rejecting the argument that ADA precedent should control.

Head v. Costco Wholesale Corporation (N.D. Cal.)

In Head, a Costco employee exhausted his FMLA/CFRA leave and Costco’s one-year leave policy while caring for his wife, who had cancer. When told he must return to work or resign, he resigned and Costco later declined to rehire him after his wife passed away. The court denied the motion for summary judgment on the failure to accommodate and interactive process claims, allowing them to proceed on an associational disability theory.

De Wit v. Amazon.com Services, LLC (C.D. Cal.)

In De Wit, the plaintiff took intermittent leave to care for his mother, who suffered from dementia, and was terminated after a disputed leave calculation resulted in negative unpaid time off under Amazon’s attendance policy. The court granted summary judgment for Amazon on the facts, but agreed that claims for failure to accommodate and engage in the interactive process may be brought on an associational disability theory. The court emphasized that Amazon had approved multiple leave requests, communicated with the employee, and applied its policies consistently, which were facts that supported its defense despite recognizing the viability of the legal theory.

What This Means for Employers

These decisions are not binding on California state courts as the California Supreme Court has not yet addressed the issue. However, this case trend suggests that at least some courts may be receptive to associational disability claims based on a failure to accommodate or engage in the interactive process. In this developing landscape, employers confronting caregiving-related requests may face increased scrutiny regarding whether any individualized assessment or interactive process occurred, even as the scope of any obligation remains unsettled.

If you have questions about how these developments may affect your workplace policies or about a specific accommodation request, please contact any member of the Coblentz Employment Group.

This alert is intended to provide general information and does not constitute legal advice. Each situation is fact-specific, and you should consult with counsel regarding your particular circumstances.

By Scott Hall, Phillip Wiese, and Katherine Gianelli

Since CalPrivacy (formerly the CPPA) finalized sweeping updates to the California Consumer Privacy Act (CCPA) regulations in July 2025, risk assessments are now a centerpiece of data privacy compliance. The message from regulators is clear: California is moving decisively toward a proactive, risk-based privacy regime, and businesses will be expected to evaluate and document their higher-risk data practices before they occur.

For many organizations, this marks a significant evolution in compliance expectations. Risk assessments are no longer a matter of internal best practice. They are now a formal, enforceable requirement that will demand new processes, closer coordination across teams, and greater executive oversight and accountability.

Risk Assessments as a Core Compliance Obligation

Beginning January 1, 2026, businesses subject to the CCPA must conduct risk assessments for processing activities that present a “significant risk” to consumers’ privacy. These assessments must be completed before the relevant processing takes place, reflecting a shift away from reactive compliance and toward forward-looking risk management.

The scope of what constitutes “significant risk” is broad. In practice, it will capture many common data-driven activities, including the sale or sharing of personal information, the use of sensitive personal data such as precise geolocation or health information, and the deployment of automated decision-making technologies in consequential contexts like hiring, lending, or housing. Profiling in workplace or educational environments, as well as certain AI and analytics tools that infer consumer characteristics, also fall within the scope.

For companies that rely heavily on data analytics, targeted advertising, or use of automated decision-making technology, this means that risk assessments are likely to become a routine and recurring part of operations, rather than an occasional compliance exercise.

A Structured and Substantive Analysis

The CCPA regulations set forth the specific information an assessment must contain. Businesses will need to prepare a written analysis that clearly explains the purpose of the processing, the categories of personal information involved, and how the data will be used, retained, and shared. Business employees whose job duties include participating in the processing of personal information subject to a risk assessment must be included in the business’s risk assessment process.

At the heart of the requirement is a balancing test: organizations must weigh the benefits of the processing, both to the business and to consumers, against the foreseeable risks to individual privacy. In doing so, the analysis must:

• Identify the specific business purpose for processing;
• Identify the categories of personal information involved, including any sensitive personal information, and the minimum information necessary for achieving the stated business purpose;
• Identify any safeguards in place to mitigate risks; and
• Document operational details of the processing, including:
  • How the information is collected, used, and disclosed;
  • The duration of retention (or how such duration will be determined);
  • How the business interacts with customers;
  • How many customers are affected;
  • What disclosures the business makes to customers about the processing; and
  • What third parties (service providers, contractors, or otherwise) will have access to that information and what purpose that access will serve.

This assessment requires thoughtful judgment and attention to detail as those with knowledge of the processing consider questions about the business’s data processing practices.

As noted, risk assessments must be completed prior to initiating any processing activity that presents a significant risk to consumer privacy. Additionally, businesses must update their risk assessments within 45 days when there is a material change relating to the processing activity, or, at minimum, every three years.

Reporting Obligations

CalPrivacy has coupled these substantive requirements with new reporting and certification obligations. Businesses will be required to submit summaries of their risk assessments by April 1 the year after they have been completed, starting April 1, 2028.  The summary must certify under penalty of perjury that the substance of the risk assessment is correct. While full assessments do not need to be routinely filed, they must be maintained and produced upon request.

This framework transforms risk assessments into regulator-facing documents, not just internal analyses. As a result, companies should expect that their reasoning, methodologies, and conclusions could be scrutinized in an enforcement context by CalPrivacy.

Implementation Timelines and Transition

The regulations provide a phased timeline, but the runway is shorter than it may appear. The obligation to conduct risk assessments began in January 2026, and existing data processing activities must be evaluated and a risk assessment prepared by the end of 2027, covering processing during 2026 and 2027. But for any new processing activities started after January 1, 2026 that trigger compliance obligations, a risk assessment must be completed before that new processing can begin. The first round of annual reporting is set to occur on April 1, 2028, with ongoing summary submissions required each year thereafter.

Given the breadth of in-scope activities and the level of detail required, many organizations will need substantial lead time to build and operationalize compliant programs.

Preparing for Risk-Based Privacy Practices

The practical impact of these requirements will extend across the enterprise. Legal and privacy teams will need to develop standardized frameworks and documentation processes, while product, engineering, and data teams will need to integrate risk analysis into development lifecycles. Security functions will play a key role in aligning technical safeguards with identified risks, and senior leadership may be called upon to review and certify compliance.

Organizations that have not yet formalized their data governance practices may face particular challenges, especially in mapping data flows and documenting decision-making. At the same time, companies with more mature privacy programs will need to revisit and enhance their existing processes to meet CalPrivacy’s more prescriptive and transparent requirements.

Looking Ahead

California’s regulations reinforce its position at the forefront of U.S. privacy law and reflect a broader global trend toward risk-based regulation. For businesses, the takeaway is clear: Now is the time to conduct risk assessments on relevant processing activities and to start preparing plans to submit summary assessments to CalPrivacy.

Organizations that act now to build scalable, defensible risk assessment programs will be better positioned not only to meet regulatory expectations, but also to support responsible innovation in an increasingly complex data landscape.

The Coblentz Data Privacy & Cybersecurity team can help you navigate CalPrivacy’s risk assessment requirements. Please reach out to Scott Hall or Phillip Wiese for further information or assistance.