On March 7, 2024, the Court of Justice of the European Union issued its judgment in the case of IAB Europe (Case C‑604/22). In this judgment, the CJEU assessed the role of IAB Europe in the processing operations associated with its Transparency and Consent Framework and further developed CJEU case law on the concept of personal data under the GDPR.
Continue Reading CJEU Rules on IAB Europe’s Transparency and Consent Framework

On February 26, 2024, the National Institute of Standards and Technology (“NIST”) announced the release of Version 2.0 of its voluntary Cybersecurity Framework (“CSF”).

The first iteration of the CSF was released in 2014 as a result of an Executive Order, to help organizations understand, manage, and reduce their cybersecurity risks. The original CSF was developed for organizations in the critical infrastructure sector, such as hospitals and power plants, but has since been voluntarily implemented across various sectors and industries, including throughout schools and local governments.Continue Reading NIST Releases Cybersecurity Framework 2.0

On February 22, 2024, the Federal Trade Commission announced a settlement order against Avast Limited requiring the company to pay $16.5 million and prohibit the company from selling or licensing any web browsing data for advertising purposes.
Continue Reading FTC Announces $16.5 Million Settlement Against UK Service Provider and Ban from Selling Browsing Data for Advertising Purposes

On February 12, 2024, California bill AB-1949 was referred to the Assembly Committee on Privacy and Consumer Protection. The bill would amend the California Consumer Privacy Act (as amended by the California Privacy Rights Act) to significantly expand businesses’ obligations with respect to the personal information of consumers under the age of 18.
Continue Reading California Children’s Privacy Bill Moves to Committee

On February 21, 2024, the California Attorney General announced that it had reached a settlement resolving an enforcement action under the California Consumer Privacy Act (“CCPA”) and the California Online Privacy Protection Act (“CalOPPA”) brought against online food delivery company  DoorDash, Inc. (the “Company”). This is the AG’s second CCPA enforcement settlement, following the agency’s settlement with Sephora.Continue Reading Second CCPA Enforcement Action Settlement Announced by California AG

On February 12, 2024, a federal court in the Southern District of Ohio issued an order granting a Motion for a Preliminary Injunction, prohibiting the Ohio Attorney General from implementing and enforcing the Parental Notification by Social Media Operators Act, Ohio Rev. Code § 1349.09(B)(1).
Continue Reading Ohio Court Grants Motion for Preliminary Injunction on Parental Notification by Social Media Operators Act

California class action plaintiffs have begun to file under a new theory—the pen register and trap and trace device theory under Section 638.51 of the California Invasion of Privacy Act. A recent California decision denied the motion to dismiss as to the Section 638.51 claim, rejecting the argument that the defendant’s software was not a pen register.
Continue Reading New Wave of Website Privacy Lawsuits Under the Pen Register and Trap and Trace Device Theory

On January 31, 2024, the UK ICO released a statement in response to its requirement that the UK’s biggest websites comply with data protection laws when using cookies. The ICO said that it received “an overwhelmingly positive response,” with 38 of the 58 organizations having changed their cookie banners in order to come into compliance.
Continue Reading UK ICO Warns Organizations to Make Advertising Cookies Compliant Following Call to Action