California's SB 690 paused, website cookie lawsuits surge

SB 690 would have solved the website tracking lawsuit problem. It passed the Senate unanimously. Then it died in committee. The litigation continues. This is the reality businesses face today. Hundreds of CIPA lawsuits keep coming. The California Invasion of Privacy Act was written in 1967. It was meant to stop wiretapping. Now it's being used against modern website tools. Session replay software. Chatbots. Analytics pixels. Even AI tools are getting targeted. Courts can't agree on what's legal: • Some dismiss cases entirely • Others let claims move forward • No clear standards exist The result? A compliance nightmare. Companies are spending big on defense. They're reviewing every tracking tool. Marketing, legal, and IT teams are scrambling to assess risk. Without SB 690, the uncertainty continues through 2026. Businesses need to act now: ✅ Audit all tracking technologies ✅ Review privacy disclosures ✅ Enable anonymization features ✅ Document consent mechanisms The litigation won't stop. But you can reduce your exposure. Transparency and proper consent are your best defenses. How is your company handling website tracking compliance? #PrivacyLaw #CIPA #DigitalCompliance 𝗦𝗼𝘂𝗿𝗰𝗲: https://lnkd.in/eDc2cMCx

Sensitive user data doesn’t always travel in plain sight. It’s often encoded, compressed, or rerouted through layers of third parties, leaving attorneys to untangle a web of transmissions that determine liability and intent. Our latest article explains how software experts uncover hidden data flows, document evidence that survives Daubert scrutiny, and help attorneys establish or defend against claims under the Wiretap Act and Stored Communications Act. “Attorneys need to know that a violation occurred and they need evidence that can survive challenges in court.” says Isaac Pflaum, Senior Director of Software Litigation at Quandary Peak Research. Privacy litigation increasingly turns on technical proof—not just allegations. Whether you’re bringing a class action or defending a technology client, working with experts who understand both the software and the statutes can mean the difference between admissible evidence and dismissed claims. Read the full article: https://lnkd.in/gWnyfD8u

Law No. 5651: Understanding Türkiye’s Internet Law and how it protects you in the digital era. Part 40.1. Have you ever googled your name and found something you wish wasn't there? Or read a post that crossed the line between opinion and harm? Our lives today are inseparable from the digital world. We study, work, connect, express opinions, and even build identities online, but in this same world, a single careless click can open the door to fraud, one fake message can destroy trust, and one post or link can damage a reputation. The internet gives freedom, but it also brings risk, and where there is risk, there must be protection. To create structure, fairness, and accountability online, Türkiye introduced Law No. 5651 on the Regulation of Publications on the Internet and Combating Crimes Committed through Such Publications. First adopted in 2007 and updated several times since, it remains one of the cornerstones of Türkiye’s digital legal framework. While many see Law No. 5651 as just another internet restriction, in practice it's also a legal toolkit for protecting individuals in an unpredictable digital age against online fraud, defamation, privacy breaches, and harmful content. In a world where technology moves faster than our ability to process it, understanding Law No. 5651 means understanding how to protect yourself in the digital space. 1. What Is Law No. 5651? Law No. 5651 was enacted in 2007 to regulate content published online and to provide mechanisms for combating internet-based crimes. At its core, the law seeks to balance two vital needs: ● Freedom of expression in digital spaces ● Protection of individuals and society from harmful or criminal content The law applies not only to end users, but also to content providers, hosting providers, access providers, and platform operators. In other words, it doesn't just address what is posted online, it regulates who enables it and what happens afterward. To be continued in Part 40.2., 40.3. and 40.4...

Website accessibility and privacy compliance aren’t just issues in New York and California – litigation is expanding nationwide. FRB's Ruth Kraft, Partner and Chair of the Labor & Employment Practice Group, and Corporate Associate Daniel J. Gershman, Esq. explore how even routine updates, like new privacy policies or screen reader tools, can create ADA risks if not tested properly.   Read the full article to learn more: https://lnkd.in/ghxeFhbs   #FRBLaw #WebsiteCompliance #DataPrivacy #EmploymentLaw #Corporate #Securities #ADA

The California Privacy Protection Agency (CPPA) announced a $1.35 million settlement with Tractor Supply Co. It’s the agency’s largest fine to date. Allegations included failing to provide proper notices, not having adequate service provider agreements, and mishandling opt-out requests under CCPA rules. 📣 Big brands aren’t immune. Even if you’re “just a retailer,” you’re still in the crosshairs. This reinforces what we've been saying: privacy compliance is not a checkbox exercise. Notices, opt-outs, vendor contracts, they must be baked into operations and audited continuously. 𝗦𝘂𝗴𝗴𝗲𝘀𝘁𝗶𝗼𝗻 𝗳𝗼𝗿 𝘁𝗲𝗮𝗺𝘀: Use mock audit exercises and surprise “opt-out request tests” (internal or via external testers). If your system fails “in the wild,” your fine is already en route. https://lnkd.in/ek5UJv4N

$1.35M CCPA Settlement Sets New Benchmark The California Privacy Protection Agency has issued its largest fine to date against Tractor Supply Company for alleged CCPA violations, including inadequate privacy notices, weak service provider contracts, and ineffective opt-out tools. See the full breakdown of the settlement and its implications in our latest article. F Paul Pittman Abdul Hafiz, CIPP/US 🔗 https://lnkd.in/gjnrmtTW #CCPA #PrivacyEnforcement #DataPrivacy #CaliforniaPrivacy #WhiteCase

Did you know there's no single data privacy law in the U.S.? Instead, businesses are navigating this brave new digital world by following a patchwork of state privacy laws—each with its own take on how personal data should be collected, used, and protected. 🤔❓ With every state defining its own terms, compliance can be tricky. Plus, the list keeps growing. Eight new states have enacted comprehensive data privacy laws this year, with several others passing major amendments, which just adds even more complexity for companies that operate (or even advertise) across state lines. So why does this matter? If your business collects data, runs digital ads, or processes job applications, you may have new compliance obligations. Regulators are also stepping up enforcement. (California recently issued its largest privacy fine to date--$1.35 million!--and other states are following suit. 💰) At Lankford Law Firm, we’ve seen well-intentioned businesses get caught off guard by these fast-moving requirements. Don’t fall into a compliance gap. Make sure your legal and HR teams understand the rules that apply where you operate, and consult a business attorney to help ensure your privacy practices keep pace with the law.

📈 CIPA Lawsuits Surge, Old Law, New Risks for Businesses What’s old is new again. The decades-old California Invasion of Privacy Act (CIPA) has become one of the hottest legal battlegrounds in data privacy. This year alone, more than 800 lawsuits have been filed claiming that common website tools, analytics scripts, pixels, and session replay software, violate CIPA’s wiretapping provisions. The challenge? Courts are inconsistent on standing, consent, and class certification, creating major uncertainty for businesses. Some dismiss cases for lack of “concrete harm,” while others allow them to proceed when IP-derived data reveals location or identity. Why it matters: CIPA allows $5,000 per violation, driving class actions and even mass arbitrations. Plaintiffs’ firms are testing new theories, from website search bars that leak queries to AI-powered tools that record service calls. ✅ What companies can do: -Map out how customer data is collected, shared, and processed -Obtain clear opt-in consent before tracking or recording -Audit vendors and restrict third-party data access -Continuously update disclosures and cookie banners -CIPA may be decades old, but it’s shaping the next wave of privacy litigation in 2025. Staying proactive on data governance, vendor oversight, and consent management can help businesses stay ahead of this evolving risk. #Privacy #Compliance #DataGovernance #CIPA #CyberLaw #LegalTech #OneTrust

With online privacy laws soon to take effect in three more states, companies and their legal departments must understand what cookies, pixels and other tracking devices are lurking on their websites, attorneys said. Such laws are on the books in 20 states, with Indiana, Kentucky and Rhode Island set to join the crowd in January. At that point, an estimated 50% of U.S. consumers will be covered by these state online privacy protections. "There's a lot of risk right now in the website area and it's coming from all different places," Justin Yedor, a partner at Baker & Hostetler, said Wednesday. "This is a topic that probably impacts virtually every businesses." If the past is any indicator, new laws and legal theories in regard to online privacy are likely to continue to vex corporate counsel. It's only been about five years since plaintiffs' firms began in earnest to cite wiretap statutes in suing companies that use "session replay" technology that tracks users clicks and mouse movements, Holland & Knight attorneys Caitlin Saladrigas and William Farley wrote in a recent note to clients. Full story from Chris O'Malley: https://lnkd.in/e4y56CR6