DPPA
September 28, 2026
Section 2724 of the Driver's Privacy Protection Act gives the person whose driver data was misused a federal claim with a remedy floor of $2,500 in liquidated damages. Appellate courts have filled in what knowingly, disclosure and from a motor vehicle record mean, and the Fourth Circuit has twice applied TransUnion to DPPA plaintiffs, once finding standing and once splitting the named plaintiffs.
Read more →
DPPA
September 28, 2026
Section 2721(b) of the Driver's Privacy Protection Act lists fourteen uses for which a state motor vehicle department may release personal information from driver and vehicle records. Four of them reach the most sensitive category, three turn on consent, and the Supreme Court held in Maracich v. Spears that the litigation exception does not cover lawyers soliciting clients.
Read more →
DPPA
September 28, 2026
The DPPA does not stop at the DMV counter. Section 2721(c) sets three resale rules depending on how a recipient got the data, and requires most resellers to keep five years of records of who bought it and why. Four circuits have held resellers need not use the data themselves, and the Second Circuit has held resellers owe a duty of reasonable care.
Read more →
Genetic Privacy
September 28, 2026
Title II of the Genetic Information Nondiscrimination Act took effect November 21, 2009. The EEOC's rule at 29 CFR Part 1635 forbids covered employers, unions and employment agencies to request, require or purchase genetic information, carves out six narrow routes by which it may lawfully arrive, and treats whatever is held as a confidential medical record.
Read more →
Genetic Privacy
September 28, 2026
Section 105 of GINA told HHS to treat genetic information as health information and to stop group health plans, health insurers and Medigap issuers from using it for underwriting. HHS's 2013 Omnibus Rule went further, applying the ban to every HIPAA health plan except long-term care insurers, and required plans that underwrite to say so in their privacy notices.
Read more →
Genetic Privacy
September 28, 2026
The Illinois Genetic Information Privacy Act, 410 ILCS 513, has been in force since 1998. It adopts HIPAA's definition of genetic information, which covers family medical history, forbids employers to solicit that information, limits insurers, and lets any aggrieved person sue for $2,500 or $15,000 per violation. Public Act 104-642 adds biomarkers from January 1, 2027.
Read more →
Data Brokers
September 28, 2026
Nevada's rules for commercial websites sit in NRS 603A.300 to 603A.360 and were built in three steps: a 2017 privacy notice requirement, a 2019 right to direct an operator not to sell covered information, and a 2021 bill that extended the opt-out to data brokers, broadened the definition of sale and limited the 30-day repair window to first failures.
Read more →
Data Security Rules
September 28, 2026
Senate Bill 227 of 2009 was introduced as an encryption rule and enacted with a payment card clause: a Nevada data collector that accepts cards follows the current PCI Data Security Standard for those transactions, and other data collectors encrypt personal information leaving their control. A 2011 bill widened the device rule, and 2025 bills renamed the office that approves other methods.
Read more →
Breach Notification
September 28, 2026
Pennsylvania's breach statute is the Act of December 22, 2005, P.L. 474, No. 94. Senate Bill 696, enacted as Act 151 of 2022, rewrote its trigger and added duties for State agencies, contractors, counties, schools and municipalities. Senate Bill 824, enacted as Act 33 of 2024, added Attorney General notice and credit monitoring and quietly narrowed the medical information element.
Read more →
Pixel Tracking
September 28, 2026
Pennsylvania's Wiretapping and Electronic Surveillance Control Act gives anyone whose electronic communication is intercepted a civil claim for at least $1,000, and it requires every party's consent. Popa v. Harriet Carter Gifts read it to reach tracking code running in a Pennsylvania browser. Later session replay appeals turned on personal jurisdiction and Article III standing.
Read more →
Genetic Privacy
September 28, 2026
Five state statutes read for this explainer regulate companies that sell DNA tests directly to consumers or analyze the resulting data: California, Arizona, Utah, Virginia and Montana. Each requires layered consent, a way to delete data and destroy samples, and limits on sharing with insurers or employers. They differ on who is covered, who enforces, and how much a violation costs.
Read more →
TCPA
September 28, 2026
Florida amended its telephone solicitation statute in 2021 and again in 2023, Oklahoma enacted a near copy of the 2021 Florida text in 2022, and Maryland followed with the Stop the Spam Calls Act in 2024. Each requires written consent for automated sales calls, adds call-time and frequency caps, and gives called parties a $500 damages claim.
Read more →