On November 6, 2025, Texas reached a settlement regarding Senate Bill 140 (SB 140), which set forth amendments to the “state’s mini-TCPA” (Chapters 301-305 of the state’s Business and Commerce Code). In a joint motion to dismiss, the state clarified that businesses who only send marketing texts to users who have opted in need not
Enforcement + Litigation
FTC Settles With Illuminate for Data Breach of $10M Students’ Data
On December 1, 2025, the Federal Trade Commission (FTC) approved a proposed complaint and order against Illuminate Education, Inc., an education technology provider requiring it to “to implement a data security program and delete unnecessary data to settle allegations that the company’s data security failures led to a major data breach, which allowed hackers to…
Proposed TCPA Class Action Against QuoteWizard
A recent lawsuit filed in the United States District Court for the Western District of North Carolina is spotlighting risks businesses face when using prerecorded telemarketing messages without proper consent. The case, Toledo v. QuoteWizard.com, LLC, 3:2025CV00949 (W.D.N.C. 11.24.25) alleges that QuoteWizard, an insurance comparison subsidiary of LendingTree, violated the Telephone Consumer Protection Act…
Lessons from the Sling TV CCPA Settlement: Why a Compliance Overhaul May Be Needed
The California Attorney General (CA AG) has again made waves in the privacy world, this time with a settlement requiring Sling TV to pay a $530,000 fine and make significant operational changes due to alleged violations of the California Consumer Privacy Act (CCPA) and Unfair Competition Law (UCL). This case signals an increase in CCPA…
$1.4 Million Settlement for California Privacy Violation: What the Jam City Settlement Means for CCPA Enforcement
Jam City, Inc., a prominent mobile gaming company behind popular franchises such as Harry Potter and Frozen, has agreed to pay $1.4 million in civil penalties to resolve allegations that it violated the California Consumer Privacy Act (CCPA) by failing to provide adequate privacy opt-out mechanisms for its users. This resolution, announced by…
DOJ Subpoena for Patient Records from Children’s Hospital of Philadelphia Blocked by Federal Court
On November 21, 2025, in a lengthy decision, U.S. District Judge for the Eastern District of Pennsylvania Mark A. Kearney quashed a subpoena issued by the U.S. Department of Justice (DOJ) to Children’s Hospital of Pennsylvania’s Gender and Sexuality Development Program (CHOP) seeking documents:
(1) identifying the names, addresses, and social security numbers of…
HBO Max Users’ Privacy Claims Divided Between Arbitration Providers
A November 4, 2025, ruling in Brooks v. WarnerMedia Direct, LLC, offers a clear reminder for organizations that changes to terms of service, especially those impacting where consumer disputes are heard, can have direct operational consequences. For WarnerMedia, the parent company of HBO Max, the result is a split process in which consumer privacy claims…
‘Tis the Season for Safer Shopping: New Jersey’s Gift Card Fraud Notice and Packaging Requirements
Gift cards are a perennial favorite for holiday shoppers. They’re easy to wrap, universally appreciated, and always the right size. But as gift-giving season approaches, it’s important to remember that gift cards are also a common target for scams. In 2024, Governor Phil Murphy signed into law new requirements governing the sale and display of…
Drawing the Line: Section 230’s Protections Under Scrutiny
Section 230 of the Communications Decency Act, 47 U.S. Code § 230, has played a critical role in shaping the modern internet, but the boundaries of its protections remain a persistent point of discussion in law and policy. Ongoing litigation is testing just how far Section 230 stretches when it comes to the design and…
Playing by the Rules: California Invasion of Privacy Act Class Action Complaint Filed Against Dave & Buster’s
A class action complaint filed in the Northern District of California on October 17, 2025, alleges that entertainment and arcade franchise Dave & Buster’s Entertainment Inc., misled website visitors about users’ ability to reject cookies and tracking technologies. The lawsuit, brought by two California residents, claims that the Dave & Buster’s website continued to place…