Privacy Daily is providing readers with our top 20 most read stories published in 2025. All articles can be found by searching the titles or clicking on the hyperlinked reference numbers.
President Donald Trump’s AI executive order doesn’t have a direct preemptive impact, so companies should comply with state AI laws for now, but expect litigation on several fronts in 2026, attorneys and consumer groups said in a recent analysis of the order (see 2512150050).
Many states that have had leading roles in the privacy space will continue to do so in 2026, but several newcomers will be noteworthy owing to laws coming online, potential enforcement and litigation, privacy lawyers said.
A California bill amending the state’s current data breach notification law becomes effective Thursday, creating a 30-day timeline for reporting a discovered breach. The change puts a premium on prompt response and preparation, lawyers told us, including complying with a 15-day reporting requirement under certain circumstances.
Enforcement has focused heavily in 2025 on surface-level, obvious and quick fixes, privacy lawyers said in recent interviews. While this trend will continue in 2026, additional tools and other factors should keep enforcement an area to watch, they said.
A recent filing at the FCC from state attorneys general on wireline infrastructure changes confirmed that the states remain concerned about federal preemption of state AI laws, Robinson & Cole’s Linn Foster Freedman said in a blog post Wednesday. “Ultimately, there will be a battle between the federal government and state legislatures over AI regulation,” she wrote. “It is clear that the Trump administration seeks minimal regulation, despite the known risks, and state Attorneys General, charged with protection of consumers, feel very differently. I suspect we will see how it plays out in court.”
Republicans need to be outspoken against federal efforts to block state AI laws because the issue isn’t going to “blow over,” Ohio Sen. Louis Blessing (R) said in a recent interview.
The Consumer Financial Protection Bureau is legally required to process consumer complaints and share the data with states, a group of 22 Democratic state attorneys general argued Monday in a lawsuit seeking to block the Trump administration’s efforts to “defund” the agency.
New York state will require warning labels on social networks detailing their mental health risks. Gov. Kathy Hochul (D) late Friday signed S-4505, which passed the legislature in June (see 2506180004).
Instacart said Monday it will immediately end what it called price testing following a Consumer Reports (CR) study that the organization said proved it used personal data to set its online grocery prices. However, Instacart also denied its "pricing tests" included surveillance pricing or dynamic pricing, "and were never based on supply or demand, personal data, demographics, or individual shopping behavior.”