Compliance Stuff

House Republicans just introduced sweeping federal data privacy legislation yesterday that could reshape how businesses collect, store, and use personal information, aiming to finally replace a growing patchwork of state laws with a single national standard . But the bill, known as the SECURE Data Act, faces significant hurdles before becoming law, so employers and businesses should approach it cautiously. This Insight will recap what you need to know about the bill and provide a few best practices all businesses can take when it comes to data privacy. What Is the SECURE Data Act? The Securing and Establishing Consumer Uniform Rights and Enforcement over Data Act, introduced by Rep. John Joyce (R-Pa.) on April 22 and backed by House Energy and Commerce Committee Chair Brett Guthrie (R-Ky.), would create the first comprehensive federal consumer privacy framework in US history. The bill is the product of a Data Privacy Working Group that gathered input from more than 170 organizations a...

On April 7, 2026, the Alabama legislature unanimously passed  House Bill 351 , the Alabama Personal Data Protection Act. The bill cleared the House 104-0 and the Senate 34-0, making Alabama the 21st state to enact a comprehensive consumer privacy statute. If signed by Governor Kay Ivey, the law will take effect on May 1, 2027. While many recent additions to the state privacy patchwork have closely tracked the Virginia model, Alabama’s law introduces several notable departures, particularly around applicability thresholds, the definition of “sale,” and entity-level exemptions, that businesses collecting data of Alabama residents will need to evaluate carefully. Applicability Thresholds The Alabama Personal Data Protection Act applies to persons that conduct business in the state or produce products or services targeted to Alabama residents and that meet either of two thresholds. Section 3 of the Act provides: “The provisions of this act apply to persons that conduct business in thi...

Without fail, each new year brings regulatory shifts and plaintiffs’-bar activity that push data, privacy, and cybersecurity in unexpected directions. As we look ahead to 2026, our  Data, Privacy, and Cybersecurity Group  is monitoring the following key trends and developments. These are issues we anticipate will demand significant client attention in the year ahead. In Depth The feds (and states) up the heat on kid privacy Earlier this year, the Federal Trade Commission (FTC)  finalized its revised  Children’s Online Privacy Protection Act (COPPA) regulations. Those regulations required COPPA-regulated companies to provide greater transparency, introduced new data-sharing limitations, and enhanced security requirements, signaling a shift toward tighter control over how children’s data flows through digital ecosystems. But that’s not where the focus on children’s privacy stopped – states are filling gaps that COPPA leaves open, especially for teens. Across the countr...