AI dominated the conversation at the IAPP Summit 2026, as it has in the last several years. 

This post distills themes about AI governance from across the summit into practical guidance for businesses navigating high-stakes AI compliance questions.

Privacy law doesn’t stand still, and neither do the regulators shaping it. 

Since 2023, Washington courts have seen more than 25 cases filed for alleged violations of Washington’s Commercial Electronic Mail Act (CEMA). 

This Article outlines recent litigation trends and key takeaways following a Washington Supreme Court decision regarding CEMA’s reach.

The Federal Trade Commission recently convened stakeholders, including researchers, academics, industry representatives, consumer advocates, and government regulators, for a public workshop to discuss age verification, a concept implemented in regulations worldwide as a tool to advance online safe

While 2025 saw no new state comprehensive privacy laws enacted, state enforcement activity accelerated—individually and collaboratively—reflecting trends likely to intensify in 2026. 

Key enforcement focus areas included youth privacy and online safety, consumer rights, and data brokers/data sales. This post discusses highlights from 2025 and looks at expected trends in 2026.

This past year saw significant change at the Federal Trade Commission, as Andrew Ferguson was appointed chairman by President Donald Trump, replacing Lina Khan, who served as chair during the Biden administration. 

Earlier this month an appellate court in New Jersey issued an opinion in State v. Bryant, holding that tower dumps are Fourth Amendment searches that require particularized warrants supported by probable cause. 

Key Takeaways

• New York now requires businesses to disclose when they use personal data to generate individualized, algorithmically determined prices for consumers in New York.
• Several exceptions apply, including entities subject to insurance law, certain financial institutions, and certain subscription pricing practices.

On November 24, 2025, trade association NetChoice secured a win in its constitutional challenge to Maryland's Age-Appropriate Design Code Act (Kids Code or Act) when the U.S. District Court for the District of Maryland denied a motion to dismiss. 

The wave of online safety regulation is continuing to surge, with Brazil’s recent enactment of Law No. 15,211/2025—the Digital Statute for Children and Adolescents (Digital ECA)—as the latest addition. 

The Federal Trade Commission and Utah Attorney General recently announced a settlement with Aylo Group Ltd.

Congress included in the appropriations bill of November 12, 2025, an extension of the Cybersecurity Information Sharing Act of 2015 (CISA 2015), 6 U.S.C. §§ 1501–10, through January 30, 2026. 

Congress members have proposed legislation that would introduce new measures to enhance the United States’ cybersecurity resilience in the face of advancing quantum computing capabilities.

On September 23, 2025, the California Privacy Protection Agency confirmed that their cyber audit regulations will at long last go into effect on January 1, 2026. 

You can be forgiven for losing track since these were first proposed in September 2023, but now is the time to start considering how they will apply to your company and budgeting for that impact. 

State Updates, Security Mandates, and the Federal Regulatory Horizon