FCRA
October 12, 2026
A tenant screening report is a consumer report, so the company that sells it carries the Fair Credit Reporting Act's accuracy, obsolescence and dispute duties, and the landlord who turns an applicant down on the strength of it owes a section 1681m notice. The CFPB's two advisory opinions on matching and public records were withdrawn in May 2025; the statute was not.
Read more →
HIPAA
October 12, 2026
The HIPAA Privacy Rule lets a covered entity use six categories of patient information, or share them with a business associate or an institutionally related foundation, to raise money for itself without authorization. The entity must say so in its privacy notice, offer an opt-out with every solicitation and stop once a patient opts out.
Read more →
Background Checks
October 12, 2026
Massachusetts runs criminal record checks through a state system with tiered access. An employer or landlord sees convictions only within fixed lookback windows, must collect a signed acknowledgment and check identification first, must hand the record to the applicant before asking about it, and holds the result under storage and logging rules set by regulation.
Read more →
Employee Privacy
October 12, 2026
Section 52C of chapter 149 gives current and former Massachusetts employees a right to review and copy their personnel record within five business days of a written request, to be told within ten days when negative information is added, and to file a rebuttal that travels with the record. The Attorney General enforces it; courts have recognized a narrower personal remedy.
Read more →
Privacy Litigation
October 12, 2026
In Vita v. New England Baptist Hospital the Supreme Judicial Court split 5 to 1 over whether browsing a hospital's public website is a wire communication under the Massachusetts wiretap act. The majority found the word ambiguous and applied the rule of lenity. The dissent read 'any communication' as plain. Bills filed in 2025 to rewrite the definitions went to study.
Read more →
Privacy Litigation
October 12, 2026
In 2021 the Supreme Court held 6 to 3 that California's demand for every registered charity's Schedule B, the IRS form listing major donors, violated the First Amendment on its face. The Court required narrow tailoring under exacting scrutiny and found none. California's regulation now states that Schedule B is not required.
Read more →
Biometric Privacy
October 12, 2026
Local Law 63 of 2021 added a tenant data privacy chapter to the New York City Administrative Code for apartment buildings that use key fobs, phone apps or biometric scanners at the door. It lists the only data such a system may hold, puts 90-day clocks on keeping it, bars its sale and several surveillance uses, and gives occupants a damages action for one violation only: an unlawful sale.
Read more →
Background Checks
October 12, 2026
The federal Fair Credit Reporting Act regulates the company that sells a rental screening report. Colorado, Washington and Oregon regulate the landlord who buys it: what the applicant can be charged, whether a report the applicant already paid for has to be accepted, how far back criminal and eviction history can reach, and what a denial letter has to say.
Read more →
TCPA
October 12, 2026
The TCPA and the FCC's rules give tax-exempt nonprofits several carve-outs: their calls are not telephone solicitations, they may place up to three prerecorded calls to a residential line in 30 days without consent, and their telemarketing to cell phones needs ordinary rather than written consent. Autodialed and prerecorded calls to wireless numbers still need consent.
Read more →
COPPA
October 12, 2026
Utah's SB 142 of 2025 made app stores, not individual apps, the point where a user's age is checked and a parent's consent is collected. HB 498 of 2026 rewrote it before any duty applied: obligations now begin May 6, 2027, government enforcement is gone, and a harmed minor or parent may sue for the greater of actual damages or $1,000 per violation.
Read more →
AI & Privacy
October 12, 2026
Utah's SB 149 took effect May 1, 2024, creating an Office of Artificial Intelligence Policy, a regulatory sandbox and a rule that a business using generative AI must admit it when asked. SB 226 of 2025 moved that duty to chapter 77 of Title 13 and narrowed it, HB 452 added mental health chatbot rules, and the office's own chapter is set to be repealed July 1, 2027.
Read more →
COPPA
October 12, 2026
Utah replaced its 2023 social media laws in 2024 with two bills. SB 194 created the Minor Protection in Social Media Act at chapter 71 of Title 13, requiring age assurance and maximum-privacy defaults for minor accounts, and HB 464 created a private action over minors' excessive use. A federal court enjoined chapter 71 on September 10, 2024, and the Tenth Circuit appeal remains pending.
Read more →