Cross-Border Transfers
October 5, 2026
The Bureau of Industry and Security's connected vehicle rule is a supply chain control, not a privacy statute. It bars importing or selling passenger vehicles with connectivity or automated driving software tied to China or Russia from model year 2027, and importing their connectivity hardware from model year 2030, enforced through annual Declarations of Conformity.
Read more →
Data Security Rules
October 5, 2026
Customer proprietary network information is the record of whom a phone customer calls, when, for how long and on what plan. Section 222 of the Communications Act limits how carriers use it, and the FCC's rules in subpart U of part 64 add a two-tier customer approval system, password and ID checks before disclosure, and an officer-signed compliance certificate filed every March 1.
Read more →
Breach Notification
October 5, 2026
In December 2023 the FCC rewrote its carrier breach rule to reach personally identifiable information and inadvertent exposures, add itself as a recipient, and swap a mandatory waiting period for a 30-day limit. Those amendments still await an effective date, and on July 31, 2026 the Sixth Circuit vacated the panel decision upholding the order.
Read more →
Data Brokers
October 5, 2026
In April 2024 the FCC fined the four national wireless carriers a combined $196,486,875 for selling access to customer location data through aggregators without adequate safeguards. All four paid and sued. Two circuits upheld the fines, one vacated AT&T's, and in June 2026 the Supreme Court held the FCC's forfeiture process does not violate the Seventh Amendment.
Read more →
State Comprehensive Privacy Laws
October 5, 2026
Florida's Digital Bill of Rights, enacted by SB 262 in 2023, assigns most of its duties to a controller defined so narrowly that a $1 billion revenue floor and one of three business-model tests must both be met. One section, 501.715, reaches any for-profit business collecting Floridians' data that sells sensitive data, and 2024 rules fill in the enforcement detail.
Read more →
Breach Notification
October 5, 2026
Florida's breach statute is section 501.171, created in 2014 by CS/CS/SB 1524 as the Florida Information Protection Act. It pairs a duty to take reasonable security measures with two 30-day notice clocks, one to residents and one to the Department of Legal Affairs at 500 people, and it treats a violation as a FDUTPA unfair practice with per-breach civil penalties capped at $500,000.
Read more →
Pixel Tracking
October 5, 2026
Florida's Security of Communications Act forbids intercepting electronic communications without every party's consent and gives a civil claim with a $1,000 liquidated damages floor. When session replay suits under it reached Florida's federal courts in 2021, judges dismissed them on the statutory definitions, holding that clicks, keystrokes and page views were not the contents of a communication.
Read more →
Data Brokers
October 5, 2026
The FTC alleged that General Motors enrolled drivers in OnStar Smart Driver through a bundled consent screen and then sold their driving events to Verisk and LexisNexis, which built consumer reports that insurers used. The order, proposed in January 2025 and issued as final in January 2026, runs 20 years and contains no payment.
Read more →
Consent Management
October 5, 2026
An event data recorder keeps a few seconds of vehicle data around a crash. Federal law makes that data the property of the vehicle's owner or lessee and lists five situations in which someone else may access it, while NHTSA's Part 563 sets what an installed recorder must capture. Eight state statutes read for this post add their own consent rules, insurer limits and penalties.
Read more →
Breach Notification
October 5, 2026
Virginia's breach statute sits in the criminal code at section 18.2-186.6 but is enforced civilly by the Attorney General, with penalties up to $150,000 per breach. Residents and the Attorney General get notice when identity theft or fraud is caused or reasonably believed likely. A medical statute reaches only public bodies, and payroll and tax preparer breaches have rules of their own.
Read more →
State Comprehensive Privacy Laws
October 5, 2026
Virginia has amended its Consumer Data Protection Act twice for minors. Chapters 840 and 844 of 2024 restricted processing of a known child's data and required parental consent under COPPA from January 1, 2025. Chapter 703 of 2025 capped social media use by users under 16 at one hour a day, a rule a federal court preliminarily enjoined as to NetChoice members in February 2026.
Read more →
Consumer Health Data
October 5, 2026
Virginia protects reproductive and sexual health data through its general consumer protection statute rather than its privacy law. SB 754, enacted in 2025 as chapter 591, added a prohibited practice to Va. Code § 59.1-200 and a seven-part definition to § 59.1-198, bringing the Act's private damages action and Attorney General remedies with it.
Read more →