Automated Decision-Making
September 7, 2026
Colorado's 2024 artificial intelligence statute was delayed once, then repealed and reenacted before it ever took effect. Senate Bill 26-189, signed May 14, 2026, replaced part 17 of article 1 of title 6 with a framework keyed to automated decision-making technology. Consequential decision survived as the trigger; the algorithmic discrimination duty did not.
Read more →
Adtech & Cookies
September 7, 2026
The banner that greets visitors to most American websites is not a creature of American statute. Neither the CCPA nor the Colorado Privacy Act requires one, and the California regulations mention banners chiefly to say when their design is unlawful. This sets out what each statute requires at the point of collection, and when each genuinely calls for consent.
Read more →
CPPA
September 7, 2026
Proposition 24 established the California Privacy Protection Agency in December 2020, but the power to write CCPA regulations did not move to it on that date. The transfer was conditional, it completed in April 2022, and the Attorney General's own regulatory authority was never extinguished. This traces the grant, the condition, the board that exercises it, and what the agency has adopted.
Read more →
Workplace Monitoring
September 7, 2026
Three states condition workplace electronic monitoring on notice rather than on consent, and each builds the requirement differently. Connecticut makes a posted notice the legal notice. New York requires a notice on hiring and a posting. Delaware offers a choice between a daily electronic notice and a one-time acknowledged one.
Read more →
Facial Recognition
September 7, 2026
Three states regulate what happens to an applicant's face during hiring, through four statutes that each define permission differently. Maryland asks for a signed waiver with four listed contents. Illinois asks for notice, an explanation and consent, and separately for a written release. Texas asks only that the individual be informed and consent before capture.
Read more →
FCRA
September 7, 2026
The Fair Credit Reporting Act does not have one adverse action notice. It has a notice owed before a decision that only employers owe, and a notice owed after any adverse action taken on a consumer report by anyone. The two sit in different sections, carry different contents, and answer to different silences in the statute.
Read more →
Background Checks
September 7, 2026
Four published Ninth Circuit opinions have construed a single sentence of the Fair Credit Reporting Act: the requirement that an employment background check disclosure appear in a document that consists solely of the disclosure. Read in sequence, Syed, Gilberg, Walker and Luna map what may sit on the page, what the page is, and where the line still has not been drawn.
Read more →
Employee Privacy
September 7, 2026
New Jersey's tracking device statute, N.J.S.A. 34:6B-22, was approved on January 18, 2022 and took effect ninety days later. It reached that form after four reprints that moved it from a fourth-degree crime to a civil penalty, from written consent to written notice, and from any tracking device to one designed for the sole purpose of tracking.
Read more →
Data Brokers
September 7, 2026
Registration statutes are usually compared by what they demand of a filer. They can also be compared by what they hand back to the public, and on that axis the four state registries are not alike. One publishes every answer as a downloadable file; the other three publish a search box. This reports what is readable off each, and what California's file disclosed.
Read more →
Standing & Damages
September 7, 2026
Decided 25 June 2021 by five votes to four, TransUnion LLC v. Ramirez took a jury verdict that had already been returned and removed three quarters of the class from federal court. This post reads the case as a case: the OFAC Name Screen product, the six-day trial, the arithmetic of the award, the reasoning on each of the three claims, and the two dissents.
Read more →
UK Data Protection
September 7, 2026
The Data (Use and Access) Act 2025 is a nine-part statute covering smart data schemes, digital identity, buried pipes, birth registers, data protection, a new regulator and much else. Its commencement is the part most easily got wrong: Royal Assent brought almost none of it into force, and a reader working from the Act alone cannot tell what is law today.
Read more →
VPPA
September 7, 2026
One phrase in the Video Privacy Protection Act — "goods or services from a video tape service provider" — has produced an open split among three courts of appeals over who may sue. The Supreme Court granted review on 26 January 2026 and has set argument for 14 October 2026. This post sets out what each opinion actually reasoned.
Read more →