Longer pieces on where privacy law is moving, aimed at readers who already follow the developments themselves.
Automated Decision-Making
October 19, 2026
Paragraph (g) of Minn. Stat. 325M.14, subdivision 1, gives a consumer profiled for a significant decision the right to question the result, be told the reason, learn (if feasible) what might have changed it, review the data used and obtain reevaluation on corrected data. Colorado, Tennessee and California treat the same ground differently, and the statute does not define most of its terms.
Read more →
Privacy Litigation
October 12, 2026
In Vita v. New England Baptist Hospital the Supreme Judicial Court split 5 to 1 over whether browsing a hospital's public website is a wire communication under the Massachusetts wiretap act. The majority found the word ambiguous and applied the rule of lenity. The dissent read 'any communication' as plain. Bills filed in 2025 to rewrite the definitions went to study.
Read more →
Pixel Tracking
October 5, 2026
Florida's Security of Communications Act forbids intercepting electronic communications without every party's consent and gives a civil claim with a $1,000 liquidated damages floor. When session replay suits under it reached Florida's federal courts in 2021, judges dismissed them on the statutory definitions, holding that clicks, keystrokes and page views were not the contents of a communication.
Read more →
Pixel Tracking
September 28, 2026
Pennsylvania's Wiretapping and Electronic Surveillance Control Act gives anyone whose electronic communication is intercepted a civil claim for at least $1,000, and it requires every party's consent. Popa v. Harriet Carter Gifts read it to reach tracking code running in a Pennsylvania browser. Later session replay appeals turned on personal jurisdiction and Article III standing.
Read more →
Privacy Class Actions
September 1, 2026
A privacy class action filed against a company whose terms contain an arbitration clause is usually decided on a motion to compel long before any merits ruling. This post describes the Federal Arbitration Act machinery that governs those motions, the online assent cases that determine whether a clause was formed at all, and the narrow categories Congress and state legislatures have carved out.
Read more →
Cross-Border Transfers
September 1, 2026
The adequacy decision underpinning EU-US data transfers has been through one court challenge and one periodic review. This post states the status of Implementing Decision 2023/1795 by its own terms, describes the redress mechanism it relies on, and takes the posture of the legal challenge from the General Court's judgment and the notice of appeal rather than from commentary.
Read more →
Privacy Class Actions
September 1, 2026
Privacy claims rarely settle on the merits before a court rules on certification. This post traces what Rule 23 requires by its own terms, how Dukes, Amgen, Comcast, Tyson Foods and TransUnion frame the inquiry, and where the courts of appeals have divided on ascertainability and on classes containing uninjured members.
Read more →
BIPA
August 31, 2026
Section 10 of the Illinois Biometric Information Privacy Act carves health care information out of the definition of a biometric identifier. In Mosby v. Ingalls Memorial Hospital, the Illinois Supreme Court held that the carve-out is two clauses joined by "or" and that only the first is limited to patients. The second turns on purpose, whatever the source.
Read more →
BIPA
August 31, 2026
The Illinois Workers' Compensation Act makes its own remedies exclusive for injuries covered by it, and Illinois employers argued that a fingerprint timeclock claim was such an injury. In McDonald v. Symphony Bronzeville Park, the Illinois Supreme Court answered the certified question in the negative, on grounds that turn on what kind of injury the compensation scheme was built to price.
Read more →
VPPA
August 12, 2026
The Video Privacy Protection Act was passed in 1988 after a newspaper published a Supreme Court nominee's video rental history. It now generates a steady stream of claims against websites that embed video and third-party tracking pixels. Two questions divide the courts: who counts as a subscriber, and what qualifies as personally identifiable information.
Read more →