The CCPA, which was adopted via a California ballot initiative in 2018, ushered in significant changes to how companies approach data collection, use, and disclosure. Working with the California Chamber of Commerce, we led key industry coalitions in developing comments in the CCPA rulemaking process and in negotiations on the ballot initiative that later became 2020's California Privacy Rights Act (CPRA), which amended the CCPA.

Building on that work, we now counsel clients on compliance with the CCPA and the myriad state laws that have followed. We also advise clients on trends we see in draft legislation at the state and federal levels and keep them apprised of bills that become law. Our lawyers provide guidance to clients on all aspects of compliance with these laws, including privacy policy updates, user interface adjustments, consent mechanisms, internal data protection policies and procedures, vendor contracts, and much more. We also represent clients in rulemaking proceedings under these laws.

Our guidance on consumer privacy laws is not limited to the United States. We have helped clients establish global compliance programs built on the GDPR and requirements imposed by privacy laws in the EU and United Kingdom. Where appropriate, we team up with local counsel in key markets, playing the role of "global quarterback." In this way, we ensure that clients have a comprehensive and coherent global strategy while still accounting for the nuances of local laws.

We offer innovative tools intended to allow clients to benefit from our years of experience and learning, including our Privacy Starter Kit that includes a suite of templates, checklists, and guidance documents that companies can use to start building their compliance program. We also have a proprietary data mapping solution, Data Navigator, which is an online tool that makes it easy to track, digest, and compare data protection legislation in the United States and around the world.

In the United States, privacy and data security have long been regulated through prohibitions on unfair and deceptive acts and practices, vigorously enforced by the FTC and state attorneys general. We advise clients on all aspects of how these laws apply to privacy and data security. Our counsel is informed by our decades of work in this area, our vast knowledge of the FTC and state attorneys general and their approaches to wide-ranging privacy and data security issues, and our extensive experience guiding clients through regulatory investigations and enforcement actions.

We help innovative companies understand and comply with the laws governing biometric data and biometric technologies, counseling in sectors including e-commerce, consumer products, security, human resources, finance, and healthcare. We have also defended many clients in high-stakes litigation related to biometric technologies in courts across the country.

Our experienced guidance includes a wide range of biometric technologies, including facial recognition, voiceprint, and fingerprint technologies. We advise on the unique issues associated with obtaining data to train artificial intelligence (Al) models and anticipating the legal implications of utilizing biometric technology for user identification. We also monitor relevant laws and closely track legal developments across the country. Our deep and always-current knowledge allows us to help clients comply with these laws and reduce their legal risk so they can continue providing innovative products and services.

Often, companies that offer products, services, and other features that allow people to communicate may seek to review, record, or utilize that communications data in a variety of ways. Whether it's to render a virtual world, to facilitate machine learning, to provide personalized services, or merely for quality-control purposes, real-time access to communications data could implicate the federal Wiretap Act and state recording/eavesdropping laws. Likewise, plaintiffs’ lawyers are seeking to apply these laws to the use of web-tracking technologies and chatbots.

These laws, which generally make it a crime to intercept, eavesdrop, or record a communication without consent, are often decades out of date and present an array of complex issues when applied to modern technologies. Our lawyers' decades of litigation and practical experience, including in the criminal context, provide practical direction on how companies can avoid or mitigate wiretapping and other risks related to surveillance laws.

Our lawyers are skilled in helping companies market to consumers in ways that comply with legal requirements, self-regulatory rules adopted by industry bodies, and best practices.

Drawing on our experience representing companies in actions asserting violations of the TCPA and wiretapping laws, we counsel companies on how to set up marketing programs and campaigns to minimize risk of claims under these laws.

Our team represents companies as they work through the unique issues posed by the advertising technology (or ad tech) ecosystem. Working with companies, including ad tech providers, advertisers, publishers, and communications providers, we draw on our experience and relationships with self-regulatory groups, such as the NAI, to help companies address a wide range of challenges posed in the ad tech space. These include helping them to draft meaningful and accurate disclosures of ad tech practices and understanding how (and under what circumstances) to offer choice with respect to data collection and use practices, as well as how to respond to any such choices, such as those communicated via global privacy controls and do-not-track signals.

The privacy and safety of children as they navigate connected services is increasingly under scrutiny by regulators and is the focus of regulatory and legislative proposals. At the federal level, we help clients to comply with COPPA and the Family Educational Rights and Privacy Act (FERPA). We also defend companies when they are investigated or sued for alleged transgressions of COPPA, as well as other issues concerning children's use of technology. At the state level, we advise technology providers on the requirements of student privacy laws, such as California's Student Online Personal Information Protection Act (SOPIPA), that have been adopted across the United States.

Clients rely on us to help them navigate federal and state financial privacy laws, including the GLBA, California Financial Information Privacy Act (CalFIPA), FCRA, and New York Cybersecurity Regulation. Our clients operate in a variety of financial sectors, from banking and lending to payment processing, and offer innovative financial platforms and technologies.

We assist them in creating required privacy notices and compliance training programs, as well as establishing regulatory compliance and data governance programs. Our team also helps with negotiating service provider and vendor agreements to ensure that our clients' legal obligations are properly passed through to third parties. Because our clients must appropriately safeguard their information, we work with them to establish policies and controls that meet legal and industry security standards, including the Safeguards Rule and Payment Card Industry Data Security Standard (PCI DSS).

We have assisted various covered entities, including both brick-and-mortar and digital healthcare providers, health insurers, and employer-sponsored group health plans and their business associates with broad compliance advice and training with respect to such laws as HIPAA, the Health Information Technology for Clinical and Economic Health (HITECH) Act, and state statutes like California's Confidentiality of Medical Information Act (CIMA). We also regularly assist companies within the health space, as well as technology providers and retailers, comply with state laws, including Washington’s My Health My Data Act (MHMD), governing the privacy of “consumer health data.”

Our counsel includes reviewing and drafting policies and procedures and business associate agreements; advising covered entities and business associates regarding the confidentiality, integrity, and availability of electronic protected health information (PHI); and the appropriate technical, physical, and administrative safeguards to protect that data. When our covered entity clients have been subject to investigation, we have represented them in U.S. Department of Health and Human Services (HHS) and state attorneys general investigations.

Employers must comply with federal and state statutes that govern the handling of personally identifiable information of personnel. We provide compliance guidance on topics including monitoring workplace communications, surveilling on-duty behavior (in a manner that is compliant with state lifestyle laws and the National Labor Relations Act (NLRA)), and addressing issues with searches of employees' offices and persons.

We also advise clients with respect to background check legislation, including the FCRA and similar state laws, and privacy implications of employment drug testing at all stages of employment, from preemployment to post-incident/termination. Our team is well versed in best practices with respect to employee personnel files, covering issues such as privacy implications for unsuccessful applicant data, retention policies, check-the-box laws, and driving record laws. We also advise on employee medical records, privacy in employee benefits, and the burgeoning area of employee biometric information.