The New York Child Data Protection Act (NYCDPA), which took effect Friday, is unique for many reasons, including its age-flag requirement and because New York lacks a comprehensive law covering users of all ages, experts said in interviews. However, like a good deal of privacy and online safety regulations, it may face legal challenges, said Jason Oliveri, data privacy partner at Hinshaw & Culbertson.
Businesses should be aware of unusual requirements in New Jersey draft rules for implementing the state’s comprehensive privacy law, several law firms warned in blog posts this month.
Privacy Daily is providing readers with the top stories from last week, in case you missed them. All articles can be found by searching the title or clicking on the hyperlinked reference number.
A tech industry group on Friday ruled out the possibility that a rulemaking would alleviate its concerns with Vermont’s new age-appropriate design code law. Gov. Phil Scott (R) signed S-69 on Thursday (see 2506120094) despite vetoing a similar proposal last year. Businesses of all sizes will have to comply with the Vermont AADC or potentially face AG enforcement or lawsuits from individuals via a private right of action in the state's existing consumer protection law.
The Oregon House supported making it a crime to unlawfully disclose private data. Members voted 54-2 Thursday in favor of SB-1121, which cleared a House committee in late May (see 2505290041).
Meta AI users posting what's typically private information for everyone to see on the app is raising questions about whether all users understand they’re sharing their AI queries with the world. Users on X posted about the trend this week with many examples.
The Michigan Senate Committee on Finance, Insurance and Consumer Protection cleared a comprehensive privacy bill during its meeting Wednesday on a 5-3 vote. A bipartisan group of senators recently introduced SB-359, or the personal data privacy act (see 2506060043). The legislation comes after Michigan failed to pass a similar consumer privacy measure last year (see 2412300043).
The actual cost to a company from a privacy enforcement action could be many times higher than the regulator's fine, Clarip CEO Andy Sambandam said in an interview. Privacy has become a quickly rising concern for companies amid a growing number of privacy laws and state enforcement actions, he told Privacy Daily.
State privacy investigators are in constant contact about potential enforcement action that goes beyond the recently launched bipartisan consortium (see 2504160037), privacy officials from California, Colorado and Texas said.
A bipartisan group of senators in Michigan introduced a comprehensive privacy bill on Thursday in an effort toward establishing privacy rights for the state's consumers. If enacted, the state will join the 20 others who have comprehensive privacy laws, though six won’t take effect until later in 2025 or in 2026 (see 2501060066).