2025 So Far: Experts Note Slew of Small but Significant Privacy Events

“In previous years, we could say, ‘Okay, the GDPR comes into effect,’ or the California Consumer Privacy Act (CCPA) was enacted, said Solove. There were "years when every month a state passed a new privacy law,” he added. “Now we're really at a point where we're seeing a lot of these laws become active. We're seeing the enforcement start ... [and] amendments to these laws and rulemaking to these laws." That's “pretty significant” when added together, but “they're not quite the sexy headlines" of previous years.

For Daniels, a privacy consultant, privacy events this year are like the "hockey stick effect." At the beginning of the year, privacy headlines were slow, followed by many smaller developments that turned up the pace.

California in particular has had a lot to pay attention to, with enforcement actions, finalizing new regulations and a new law requiring browsers to support universal opt-out preference signals (see 2510080036), Daniels said.

Added Solove, “It's somewhat bewildering just how many different little things are happening and all the different laws that are being passed, rather than just one big CCPA.”

As such, Daniels mentioned amendments to existing state privacy laws related to kids’ privacy. For example, she noted that Colorado finalized privacy rules for minors (see 2510100018), and Connecticut made changes to limit targeted advertising around children.

“Even just this week, we have the [Roku] lawsuit in Florida," she said (see 2510140024). The case could be "really interesting ... as it might set precedent for other types of apps and websites that are targeted to kids.”

An issue with emerging kids’ protection laws and health data laws is that they vary widely from state to state, said Solove. “There are all these different definitions of what health data is, and a lot of companies don't know" if they are covered or not, or even “what is a child anymore.”

Daniels said there’s no one-size-fits-all approach to privacy compliance, but added that health care and marketing to kids are areas where additional federal law is more likely.

“I kind of always joke, ‘Don't mess with grandma, don't mess with kids,’ and health is sort of one of those other ones” as well, Daniels said. There is “commonality” on both sides of the aisle in protecting these groups of data.

Solove somewhat disagreed. “The consensus is we need to do something with kids,” he said, but “we have a political difference between the parties in terms of what should be done.” One side finds using kids’ data for targeted ads is the problem, while the other takes more of a content-moderation view.

Daniels said she sees an increase in business' interest in privacy. Companies are looking to move from “what might have been a ... piecework [approach]," where they just had a cookie banner or privacy notice, to the “next level of maturity.” Daniels' “vision for 2026" is to move privacy operations forward so that they are “humming on [their] own” and “not so piecework and patchwork anymore."

And the emergence of AI is “actually a great way to emphasize privacy programs,” she said, because “so much of the way they built privacy programs is very foundational and helpful for AI governance programs” ([see Ref:2510210035]).

Privacy now has "an invited seat at the table," especially for AI governance, she added. AI governance should move "from ‘We should have a committee and maybe … a policy’ to something that's also humming with tools and [a] process that's working.”