On January 28, 2026, the Federal Bureau of Investigation (FBI) announced the launch of Operation Winter SHIELD, a coordinated initiative designed to promote adoption of core defensive measures that are shown to mitigate common intrusion vectors. Operation Winter SHIELD identifies ten priority actions the FBI views as important in improving organizational cyber resilience. The FBI […]
Privacy & Cyber Regulatory Enforcement
FTC Reverses Rytr Consent Order Amid Push for Federal AI Standards
On December 22, 2025, the Federal Trade Commission (FTC) set aside its 2024 consent order against Rytr, a generative AI-powered company, concluding that the original complaint “failed to satisfy the legal requirements of the FTC Act” and that the order unduly burdened AI innovation in violation of the Trump Administration’s January 2025 AI Executive Order […]
California Attorney General Announces Investigative Sweep into “Surveillance Pricing”
On January 28, 2026, California Attorney General (“AG”) Rob Bonta announced an investigative sweep targeting “surveillance pricing” practices among businesses in the retail, grocery, and hotel sectors. The investigation focuses on companies that use consumers’ personal information to set individualized prices. According to the AG’s press release, surveillance pricing practices could violate the California Consumer […]
European Commission Publishes Guidance For Companies Implementing the EU Cyber Resilience Act
On December 3, 2025, the European Commission published its first set of technical FAQs on the EU Cyber Resilience Act (‘CRA’). The CRA is an EU-wide law which lays down cybersecurity requirements for ‘products with digital elements’ (‘PDEs’), including IoT devices, hardware components, and certain software. It becomes fully applicable on December 11, 2027, with […]
DOJ Cybersecurity Enforcement Pace Shows No Signs of Slowing Down Going Into 2026
As 2025 drew to a close, the United States Department of Justice (DOJ) announced significant developments in cases relating to the allegedly deficient cybersecurity practices of two Department of Defense (DoD) contractors. These two cases suggest that the federal government will continue to make DFARS 7012 compliance for companies that process Controlled Unclassified Information (CUI) […]