Privacy, Security, and Artificial Intelligence

Congratulations to Zachary Heck, AIGP, CIPP, CIPM, on joining the board of directors at Technology First. Zach’s leadership in AI governance, privacy, cybersecurity, and data strategy will bring valuable insight to the region’s growing technology community. 

Colorado signed a new AI law (SB 26-189) that imposes disclosure and compliance obligations on developers and deployers of automated decision-making technology, and it already faces legal and federal challenges before it takes effect in 2027. Read the latest blog from Jackie Benson and Zachary Heck, AIGP, CIPP, CIPM, for a breakdown of who is covered, what is required, and what to watch for next. https://bit.ly/4fIVdAo

Taft attorney Beau Braswell was featured in a recent Law360 article examining how social media addiction litigation may shape future online safety and privacy regulation. Braswell discussed the growing enforcement focus on protecting children online and the evolving legal risks facing technology companies. Read more: https://bit.ly/4uld19x

New York City has proposed its own “Click‑to‑Cancel” subscription rule, modeled on New York State’s autorenewal law, that would apply to most businesses offering subscriptions to NYC residents. The rule would require clear disclosure of key terms, affirmative consent, easy and symmetrical cancellation paths, advance notices for renewals and changes, and prohibits tactics that obstruct or delay cancellation. Businesses with nationwide subscription offerings should begin reviewing their sign‑up flows, renewal notices, and cancellation processes now to ensure they align with these emerging requirements – including the Federal Trade Commission’s re-emerging Click-to-Cancel Rule (https://lnkd.in/ebQy95k6). To learn more, read our latest Privacy & Data Security Insights blog post. https://lnkd.in/gzybyZPJ

New York City has proposed its own “Click‑to‑Cancel” subscription rule, modeled on New York State’s autorenewal law, that would apply to most businesses offering subscriptions to NYC residents. The rule would require clear disclosure of key terms, affirmative consent, easy and symmetrical cancellation paths, advance notices for renewals and changes, and prohibits tactics that obstruct or delay cancellation. Businesses with nationwide subscription offerings should begin reviewing their sign‑up flows, renewal notices, and cancellation processes now to ensure they align with these emerging requirements – including the Federal Trade Commission’s re-emerging Click-to-Cancel Rule (https://lnkd.in/ebQy95k6). To learn more, read our latest Privacy & Data Security Insights blog post. https://bit.ly/4npZsCY

State privacy regulators are sharpening their focus on consumers’ right to opt out of targeted advertising and the sale of personal information. Recent multistate actions and reports from California and Connecticut underscore that regulators are no longer just checking whether opt‑out mechanisms exist, but whether businesses are actually honoring them in practice, especially universal opt‑out signals like Global Privacy Control (https://lnkd.in/g_qCGm7). Coordinated investigations and high-profile settlements signal that universal opt‑out compliance is now a top enforcement priority, with real consequences for companies that fall short. Businesses should be reassessing how these signals are detected, applied, and audited across their data and advertising ecosystems. Read the full blog post here. https://lnkd.in/daDfuem2

Could there ever be a federal privacy law? For real? Taft’s Kennedy Brooks gives a great rundown on the latest legislation introduced – the SECURE Data Act and the GUARD Financial Data Act. Whether either passes or these see the fate of so many before, one thing is clear: The name of the game is transparency in all your data processing. Read up. Get prepared. https://lnkd.in/gxb4CT9b

Another week, another privacy law. Alabama adds its own consumer protection law, which goes into effect in 2027. Check out the latest summary from Taft’s Privacy, Security & AI team in the firm’s latest blog post. https://bit.ly/41MKrkE

Oklahoma has joined a growing list of states enacting comprehensive consumer privacy legislation, and the Sooner State's new law brings with it a familiar but important set of obligations for businesses that collect and process the personal data of Oklahoma residents. Zachary Heck’s latest blog post breaks down the key provisions of Senate Bill 546, including who is covered, what rights consumers will have, what controllers and processors must do to comply, and how best to plan your organization’s data governance practices before the January 1, 2027, effective date. https://bit.ly/4vvOQpw

Per our previous updates here and on our blog, there is a lot going on with COPPA. Taft’s Beau Braswell brings you up to speed on the forthcoming enforcement date and a reminder about the changes with notice, consent, and other requirements. https://bit.ly/4trt8Bk