On January 1, 2026, broad new privacy laws will take effect in Kentucky, Indiana, and Rhode Island, granting consumers in those states greater control over their personal data. With these additions, 19 states now have comprehensive privacy laws in place, which is a significant shift in the data privacy landscape since California led the way in 2018 with the
Massachusetts
State AG’s Oppose FCC’s Efforts to Preempt State Laws Regulating AI
On December 17, 2025, a bipartisan group of 23 Attorneys General from the states of Arizona, California, Colorado, Connecticut, Delaware, Hawai’i, Illinois, Maine, Maryland, Massachusetts, Minnesota, Nevada, New Jersey, New Mexico, North Carolina, Oregon, Rhode Island, Tennessee, Utah, Vermont, Washington, Wisconsin, and the District of Columbia, sent a comment letter to the Federal Communications Commission…
Massachusetts High Court Weighs Instagram Lawsuit: Is Meta Getting Kids Hooked — And Is That Illegal?
Last week, Massachusetts’ Supreme Judicial Court delved into a case with potentially national implications: should Meta platforms face a lawsuit alleging that Instagram’s design illegally hooks kids with addictive features?
The justices appeared divided as they questioned whether Meta’s practices are protected by Section 230 of the Communications Decency Act, the law that shields online…
Lawmakers Warn Governors About Sharing Drivers’ Data with Federal Government
A group of 40 Democratic lawmakers have sent a letter to 19 state governors warning that they may be “inadvertently sharing drivers’ data with federal immigration authorities.”
According to the letter, the states “are providing U.S. Immigration and Customs Enforcement and other federal agencies ‘with frictionless, self-service access to the personal data of all of…
TikTok’s Legal Woes from State AGs Continues
Last week, we outlined the lawsuits against TikTok by New York, California, and North Carolina, that followed in the footsteps of Nebraska, Nevada (which filed suit against TikTok in February of 2024), and Indiana, which filed suit against TikTok in 2022. Since last week, at least 11 more states have joined the fray, including…
Class Action Filed Against Commonwealth of Massachusetts for Alleged COVID-19 Contact-Tracing Spyware Installation
This week, a lawsuit was filed in the U.S. District Court of Massachusetts against the Commonwealth of Massachusetts for its use of a COVID-19 contact-tracing app for residents’ mobile phones. However, very few residents voluntarily downloaded the app. The solution? The lawsuit alleges that Massachusetts caused the app to be downloaded to certain residents’ mobile…
At Least 22 States Have Consumer Privacy Legislation Pending – Will 2022 Be the Year for More State Privacy Laws?
California is the gold standard for state privacy laws, having recently enacted the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA). Virginia and Colorado also have enacted comprehensive privacy laws, which will take effect in 2023. Recently, the International Association of Privacy Professionals (IAPP) released its state privacy legislation tracker.…
Litigation Over Massachusetts’ “Right to Repair” Law Continues
As we previously wrote, in November 2021, Ballot Question 1 in Massachusetts was passed, which requires car manufacturers that sell cars equipped with telematics systems (i.e., a method of monitoring a vehicle by combining a GPS system with on-board diagnostics to record – and map – exactly where a car is and how fast…
Smart Health Cards, Vaccine Passports, and Privacy
Massachusetts Governor Charlie Baker and Rhode Island Governor Dan McKee recently announced that they are considering implementing vaccine passport programs in their respective states. Baker stated that he is working with other states to use a QR code system that allows users to scan to verify vaccination status. In Rhode Island, the Department of Health…
Eversource Energy Notifies Customers of Data Breach
Eversource Energy, which is the largest energy supplier in New England with 4.3 million customers in Connecticut, Massachusetts, and New Hampshire, is notifying customers that their personal information was compromised on an unsecured cloud server.
The personal information that was compromised includes names, addresses, telephone numbers, Social Security numbers, services addresses, and account numbers. The…