On January 1, 2025, five states’ consumer privacy rights laws will go into effect. Is your business ready? Have you determined if these laws apply to your business? Here is a high-level summary of these five laws and some considerations for your business as we head into the new year:
data privacy
FTC Settles with Companies Over Sale of Sensitive Data
The Federal Trade Commission (FTC) has been on a mission to communicate its seriousness about companies collecting, using, and selling consumers’ sensitive location data and that it is closely watching these practices.
On December 3, 2024, the FTC announced that it entered into a proposed order with Gravy Analytics and its subsidiary Venntel “for unlawfully…
Privacy Tip #423 – FTC Files Complaint Against Mobilewalla for Selling Consumers’ Precise Location Data
Many people do not understand how their geolocation data can be collected and used about them, or how massive the amount of precise location data collected from our devices.
The Federal Trade Commission (FTC) recently filed a complaint against Mobilewalla, Inc., alleging that it violated Section 5 of the FTC Act by selling consumers’…
Increased Privacy Enforcement Actions Anticipated Under Texas Privacy Law
While California was the first state to implement a comprehensive consumer privacy rights law and the first to bring an enforcement action for violations, Texas is quickly becoming the next privacy regulator to watch. The Texas Privacy and Data Security Act (TPDSA) became effective in July 2024, and the Texas Securing Children Online through Parental…
FCC Privacy and Data Protection Task Force Partners Up with the California Privacy Protection Agency
On Wednesday, the Federal Communication Commission’s (FCC) Privacy and Data Protection Task Force announced a Memorandum of Understanding (MOU) with the California Privacy Protection Agency (CPPA) to establish a federal-state partnership focused on privacy, data protection, and cybersecurity enforcement matters. This partnership will allow the FCC and the CPPA to share resources and align efforts…
Microsoft Report Highlights Attacks Against Healthcare Organizations
On October 22, 2024, Microsoft issued a threat trend research report entitled “US Healthcare at risk: Strengthening resilience against ransomware attacks.” In it, Microsoft declares that ransomware attacks against the healthcare sector are “emerging as one of the most significant” cybersecurity threats to healthcare organizations. The attack surface of hospitals “grows more complex” with digital…
CT AG Settles Data Breach Case with Guardian Analytics
Connecticut Attorney General William Tong announced on October 21, 2024, that his office has settled a data breach case against Guardian Analytics, Inc. for $500,000. The data breach affected the personal information of 157,629 Connecticut residents. The CT AG alleged that Guardian Analytics failed to implement reasonable and appropriate data security across its systems and…
Texas AG Sues General Motors for Illegal Data Collection
This week, Ken Paxton, the Texas Attorney General, filed suit against General Motors for alleged violations of the Texas Deceptive Trade Practices Act in collecting and selling drivers’ data to insurers without consumer consent.
In June, the Attorney General’s office announced an investigation into several car manufacturers for alleged collection of mass amounts of data…
New York Attorney General Issues Website Tracking Guidelines for Businesses and Consumers
This week, the New York Attorney General issued two privacy guides—one for businesses and one for consumers—outlining online tracking and privacy controls for websites and browsers.
The investigation found that many websites’ consent-management tools failed to transmit opt-out signals to their tag-management tool, which is used to simplify tag management. This results in the…
Illinois Biometric Information Privacy Act Amendment May Make Waves in Litigation Trends
Last week, Illinois Governor JB Pritzker signed S.B. 2979 to amend the Biometric Information Privacy Act (BIPA) immediately to define the repeated collection of the same biometric data without consent as a SINGLE, COLLECTIVE violation of the Act–this is a significant change. The precedent set by the Illinois Supreme Court in February 2023 in Cothron…