California and Utah Lead Privacy Enforcement Wave with Major Settlements and Lawsuits

Want to receive these privacy recaps in your inbox each week? Subscribe here.

United States

AGs Step Up Enforcement, With Latest Updates in Connecticut and Nebraska

On the heels of the California Attorney General’s $1.55 million settlement with telehealth company Healthline Media over CCPA opt-out violations, the Connecticut and Nebraska Attorneys Generals both announced enforcement updates under their comprehensive privacy laws. 

• The Nebraska AG filed a lawsuit against General Motors and OnStar alleging that they collected and sold driver data (including speed, seatbelt usage, driving habits and location) to third party data brokers without user knowledge or consent. 
• The Connecticut AG entered a settlement with TicketNetwork over allegations that the online ticket marketplace’s privacy policy was “largely unreadable”, in particular highlighting that the policy was missing key data rights and that the rights mechanisms that were present were misconfigured or inoperable. 

TAKEAWAY

There are now 15 comprehensive privacy laws in effect (which number will rise to 20 by January 1, 2026), which not only means that companies have a patchwork of requirements to juggle, but also that there are more Attorneys Generals with more resources to pay attention to violations and take action. Capturing the nuances of each law may sometimes be an uphill battle, but addressing the fundamental threads that run through all 20 laws is table stakes. Two of those threads that run throughout AG enforcement actions are: 1. meaningful transparency about a company’s data collection and sale practices; and 2. functioning, easy-to-use user rights. To meet these two fundamental requirements, companies must always have an exhaustive, up-to-date understanding of their data collection practices and must have processes in place to ensure that those practices are clearly disclosed and that user rights mechanisms actually function to give users control over those practices. 

A LITTLE MORE PRIVACY, IF YOU PLEASE

• 9th Circuit Rejects Wiretap Chatbot Claim Against Converse  
• Class Action Certified in Alexa Wiretap Case over voice recordings

A Little Privacy, Please weekly recaps are provided for general, informational purposes only, do not constitute legal advice, and should not be relied upon for legal decision-making. Please consult an attorney to determine how legal updates may impact you or your business.