State privacy laws are increasingly regulating how businesses collect, use, share, and govern personal information in practice, not just what they say in privacy notices. Compliance challenges now extend beyond disclosures to areas such as digital advertising, sensitive data, consumer rights, data governance, and technical compliance controls. Our latest client alert highlights key developments affecting […]
Regulatory Enforcement
NYDFS Issues Guidance on the Million Dollar Question—How to Conduct Cybersecurity Risk Assessments Under Part 500
On September 10, 2026, the New York State Department of Financial Services (“NYDFS”) published an Industry Letter (the “Letter”) to regulated entities (“Covered Entities”) addressing what is probably the most frequently asked Part 500 question: “How to Conduct and Use Risk Assessments Required by the DFS Cybersecurity Regulation.” The risk assessment is, by all accounts, […]
FTC Proposes Enforcement Policy Statement on Personalized Pricing
On August 19, 2026, the Federal Trade Commission (FTC) announced that it is seeking public comment on a proposed enforcement policy statement regarding personalized pricing. The proposed statement makes clear that the FTC intends to scrutinize personalized pricing practices under Section 5 of the FTC Act and marks the latest development in the FTC’s ongoing […]
FTC Targets EdTech Data Practices in Final Order Following Major Student Data Breach
On June 5, 2026, the Federal Trade Commission (“FTC”) gave final approval to a modified consent order against Illuminate Education, Inc. (“EdTech Provider”), a K-12 software vendor, settling allegations that the EdTech Provider did not adequately protect the personal data of more than 10 million students. The action — which follows a public comment period […]
NYDFS Issues Frontier AI Advisory and Guidance for Heightened Cyber Threat Environment
On May 21, 2026, the New York Department of Financial Services (“NYDFS”) issued two Industry Letters to the organizations it regulates (“Regulated Entities”): “Heightened Cybersecurity Risks Associated with Frontier AI Models” (the “Advisory”) and “Guidance on Measures Regulated Entities Should Consider in a Heightened Cybersecurity Threat Environment” (the “Guidance”) (collectively, the “Letters”). The Letters discuss […]