AI dominated the conversation at the IAPP Summit 2026, as it has in the last several years. 

This post distills themes about AI governance from across the summit into practical guidance for businesses navigating high-stakes AI compliance questions.

Privacy law doesn’t stand still, and neither do the regulators shaping it. 

Since 2023, Washington courts have seen more than 25 cases filed for alleged violations of Washington’s Commercial Electronic Mail Act (CEMA). 

This Article outlines recent litigation trends and key takeaways following a Washington Supreme Court decision regarding CEMA’s reach.

The Federal Trade Commission recently convened stakeholders, including researchers, academics, industry representatives, consumer advocates, and government regulators, for a public workshop to discuss age verification, a concept implemented in regulations worldwide as a tool to advance online safe

While 2025 saw no new state comprehensive privacy laws enacted, state enforcement activity accelerated—individually and collaboratively—reflecting trends likely to intensify in 2026. 

Key enforcement focus areas included youth privacy and online safety, consumer rights, and data brokers/data sales. This post discusses highlights from 2025 and looks at expected trends in 2026.

This past year saw significant change at the Federal Trade Commission, as Andrew Ferguson was appointed chairman by President Donald Trump, replacing Lina Khan, who served as chair during the Biden administration. 

Earlier this month an appellate court in New Jersey issued an opinion in State v. Bryant, holding that tower dumps are Fourth Amendment searches that require particularized warrants supported by probable cause. 

On November 24, 2025, trade association NetChoice secured a win in its constitutional challenge to Maryland's Age-Appropriate Design Code Act (Kids Code or Act) when the U.S. District Court for the District of Maryland denied a motion to dismiss. 

The wave of online safety regulation is continuing to surge, with Brazil’s recent enactment of Law No. 15,211/2025—the Digital Statute for Children and Adolescents (Digital ECA)—as the latest addition. 

The Federal Trade Commission and Utah Attorney General recently announced a settlement with Aylo Group Ltd.

Congress included in the appropriations bill of November 12, 2025, an extension of the Cybersecurity Information Sharing Act of 2015 (CISA 2015), 6 U.S.C. §§ 1501–10, through January 30, 2026. 

Congress members have proposed legislation that would introduce new measures to enhance the United States’ cybersecurity resilience in the face of advancing quantum computing capabilities.

The U.S. Department of Justice (DOJ) “Data Security Program” (DSP), also known as the “Sensitive Data Rule” or “Bulk Data Rule,” has prompted numerous questions about its scope and application. 

California’s legislature has once again taken center stage in the national privacy conversation, passing a flurry of privacy bills during a marathon session that stretched into the night of September 12.