AI dominated the conversation at the IAPP Summit 2026, as it has in the last several years. 

This post distills themes about AI governance from across the summit into practical guidance for businesses navigating high-stakes AI compliance questions.

At the 2026 IAPP Global Summit in Washington, D.C., a panel titled “State Collaboration on Privacy” brought together state privacy enforcers to discuss how they are working together and what businesses should expect. 

The panelists were:

Privacy law doesn’t stand still, and neither do the regulators shaping it. 

While 2025 saw no new state comprehensive privacy laws enacted, state enforcement activity accelerated—individually and collaboratively—reflecting trends likely to intensify in 2026. 

Key enforcement focus areas included youth privacy and online safety, consumer rights, and data brokers/data sales. This post discusses highlights from 2025 and looks at expected trends in 2026.

This past year saw significant change at the Federal Trade Commission, as Andrew Ferguson was appointed chairman by President Donald Trump, replacing Lina Khan, who served as chair during the Biden administration. 

On September 23, 2025, the California Privacy Protection Agency confirmed that their cyber audit regulations will at long last go into effect on January 1, 2026. 

You can be forgiven for losing track since these were first proposed in September 2023, but now is the time to start considering how they will apply to your company and budgeting for that impact. 

150 consumer complaints per week. A consortium of privacy regulators. “Hundreds of open investigations.” 

In a major move signaling the growing power of multi-state cooperation on privacy enforcement, the California Privacy Protection Agency (CPPA), alongside the Attorneys General of California, Colorado, and Connecticut (collectively, the “Coalition”), announced an investigative sweep targeting businesses that fail to honor

California’s legislature has once again taken center stage in the national privacy conversation, passing a flurry of privacy bills during a marathon session that stretched into the night of September 12. 

On August 25, 2025, the Federal Trade Commission filed a complaint against Air AI, alleging the company and its owners made overblown claims about the availability and capabilities of its artificial intelligence (AI) tools to replace human sales representatives, as well as deceptive claims about the busi

After years of drafting, discussions, and debates, the California Privacy Protection Agency (CPPA) Board reached a significant milestone in its efforts to bring to fruition regulations that have been in discussion by the CPPA Board for several years. 

With 2025 more than half over and many state legislatures adjourned for the year, we look back at significant legislative developments concerning state comprehensive consumer privacy laws. 

As the 2025 summer heat continues and as state privacy laws continue to mature, enforcement actions are beginning to shape the compliance landscape for businesses nationwide—from the coast of California to the shores of Connecticut. 

On July 1, 2025, amendments to the Colorado Privacy Act and CPA rules will take effect, significantly expanding the scope of requirements for businesses that control or process biometric identifiers and biometric data. The amendments expand the scope of the law by imposing certain requirements on employers when they collect biometric identifiers or biometric data from their employees (incl

In May 2025, Montana enacted Senate Bill 163 (SB 163), amending that state’s Genetic Information Privacy Act (MGIPA) to include protections for neurotechnology data—namely, data collected from the activity of the central or peripheral nervous system.