Photo of Kathryn Rattigan

Kathryn Rattigan is a member of the Business Litigation Group and the Data Privacy+ Cybersecurity Team. She concentrates her practice on privacy and security compliance under both state and federal regulations and advising clients on website and mobile app privacy and security compliance. Kathryn helps clients review, revise and implement necessary policies and procedures under the Health Insurance Portability and Accountability Act (HIPAA). She also provides clients with the information needed to effectively and efficiently handle potential and confirmed data breaches while providing insight into federal regulations and requirements for notification and an assessment under state breach notification laws. Prior to joining the firm, Kathryn was an associate at Nixon Peabody. She earned her J.D., cum laude, from Roger Williams University School of Law and her B.A., magna cum laude, from Stonehill College. She is admitted to practice law in Massachusetts and Rhode Island. Read her full rc.com bio here.

Disney has agreed to pay $10 million and change how it labels children’s videos on YouTube to settle claims by the Federal Trade Commission (FTC) that the company violated federal children’s privacy laws.

The settlement resolves allegations that Disney subsidiaries Disney Worldwide Services Inc. and Disney Entertainment Operations LLC failed to properly flag some of

In recent years, private plaintiffs have leveraged the California Invasion of Privacy Act (CIPA) against companies over customer service call recordings, transcription services, and website monitoring. These lawsuits allege that businesses violate CIPA by disclosing or allowing third parties to monitor private communications. Even though many cases are dismissed or settled before trial, defending a

Mindvalley Inc., a self-improvement and online learning platform, has agreed to pay $450,000 to settle a lawsuit alleging that it unlawfully shared users’ video-viewing information with Meta through the use of tracking technology on its website. On August 22, 2025, Judge Noël Wise of the U.S. District Court for the Northern District of California granted

SeatGeek, the popular online ticketing platform, is facing a proposed class action in California federal court over allegations that it improperly shared website visitors’ personal information with TikTok and Meta through online tracking technologies. The complaint alleges that SeatGeek embedded TikTok and Meta tracking pixels on its website, enabling the companies to collect users’ personal

On July 24, 2025, during a public meeting following public comment, the California Privacy Protection Agency (CPPA) Board unanimously approved amendments to the California Consumer Privacy Act (CCPA). These substantial changes include new obligations for businesses subject to the CCPA. Significantly, the updates emphasize CPPA’s new regulatory focus over AI decision-making and cybersecurity in addition

In the California Privacy Protection Agency’s (CPPA) latest enforcement action, Accurate Append, Inc. will pay a $55,400 fine related to allegations that it failed to fulfill its registration obligations. This settlement is the eighth action taken against a data broker since the CPPA launched its investigative enforcement sweep under the California Delete Act.

The Delete

This post was co-authored by Mark Abou Naoum, Summer Associate. Mark is not admitted to practice law.

Before assuming his new role as Executive Director for the California Privacy Protection Agency (CPPA), Tom Kemp served as a volunteer policy advisor on the Delete Act in 2023 and California’s 2020 ballot initiative, which amended the California

This post was co-authored by Mark Abou Naoum, Summer Associate. Mark is not admitted to practice law.

In December 2024, Jonathan Gabrielli filed several claims alleging that Motorola Mobility LLC (Motorola) misrepresented its data usage policy and shared his personal data with third parties, including Google, Amazon, and TikTok. Specifically, Gabrielli claims that a cookie

This post was co-authored by Mark Abou Naoum, Summer Associate. Mark is not admitted to practice law.

The 1988 Video Privacy Protection Act (VVPA) prohibits the disclosure of VHS rental history; now, in a recent class action where the VPPA was invoked by the plaintiffs, the parties’ voluntary settlement signals developments related to this outdated

Finally, after providing the building blocks for strong Information Governance (IG) programs and operationalizing that framework, we discuss how to sustain your IG program in the last part of the series. An effective IG program powered by the ARMA IGIM framework isn’t static. To remain relevant in an AI-driven world, it must be scalable