Worldwide: Privacy Protection

Amendments to the Connecticut Data Privacy Act (the “CTDPA”) take effect July 1, 2026, bringing more businesses under the law and updating requirements for sensitive data, consumer rights, privacy notices, and more.

Connecticut's Senate Bill 5 establishes comprehensive regulations for artificial intelligence use across multiple sectors, with particular focus on employment decisions, AI companions, and frontier model safety. The legislation introduces transparency requirements, disclosure obligations, and consumer protections while creating a regulatory sandbox for AI innovation.

Compliance with App Store Accountability Act (ASAA) laws has returned to the forefront, with new legislative developments and a Fifth Circuit decision allowing the Texas law to take effect.

The private credit market is experiencing rapid transformation as artificial intelligence reshapes transaction sourcing, evaluation, and portfolio management. As AI adoption accelerates amid heightened credit scrutiny and competitive pressures, market participants face critical questions about data reliability, documentation standards, and regulatory compliance that will define the future of private debt investing.

The Department of Health and Human Services has proposed significant updates to both the HIPAA Security Rule and Privacy Rule, marking the first major overhaul in years. These proposed rulemakings introduce key policy changes that will impact healthcare organizations, business associates, and covered entities across the industry. Understanding the rationale behind these modifications and their potential implementation timeline is crucial for stakeholders preparing for compliance.

On May 29, 2026, Vermont’s legislature passed S71, the Vermont Data Privacy and Online Surveillance Act (the Act). The Act is now pending Vermont Governor Phil Scott’s signature.

On May 27, 2026, Judge Gary Roberts of the Los Angeles, California Superior Court ruled, in a notable decision, that the California Invasion of Privacy Act’s pen register and trap and trace device provisions apply only to telephone communications and not to software on commercial websites. The Court dismissed, with prejudice (notably), claims against Mintz client NetScout Systems, Inc. premised on deployment of a data collection software development kit (or SDK) on its website.

Data is a defining resource of the modern technology economy. For emerging-technology companies building AI platforms, interconnected IoT ecosystems, data-intensive cloud services, and autonomous robotics, the ability to harness data at scale drives functionality, performance, and competitive edge.

A Further Notice of Proposed Rulemaking (“FNPRM”) whereby the Federal Communications Commission (“FCC” or “Commission”) proposes to impose stringent Know Your Customer (“KYC”) requirements on originating voice service...