Compliance Stuff

Key point: Louisiana becomes the 22nd state — and third this year — to enact a consumer data privacy law, adopting a law similar to Texas’ law. On May 29, 2026, Louisiana Governor Jeff Landry signed the Louisiana Data Privacy Act ( SB 386 ) into law. Louisiana is the 22nd state to pass a broad consumer data privacy law. It is the third state — following Oklahoma and Alabama — to pass a law this year. The new law largely tracks Texas’ law but with some notable differences we identify below. Applicability Although the law generally follows the Texas Data Privacy and Security Act, one of the notable ways in which it differs from that law — as well as other Washington Privacy Act model consumer data privacy laws — is its applicability standard. The law applies to controllers and processors that conduct business in Louisiana and satisfy one or more of the following thresholds: (1) have annual gross revenue in excess of $25 million; (2) annually buy, receive for the business’s commercial p...

Key point: Oklahoma becomes the 20th state to enact a broad consumer data privacy law. On March 20, 2026, Oklahoma Governor Kevin Stitt signed  SB 546  into law. In doing so, Oklahoma becomes the 20th state to enact a broadly applicable consumer data privacy law. Passage of a consumer data privacy law in Oklahoma has been a multiyear process. The Oklahoma House first passed a consumer data privacy bill authored by then-Representative Collin Walke in 2021, but the bill stalled in the Senate. The House again passed a bill in 2022, and it again stalled in the Senate. The new law is a more business-friendly blend of the 2022 version of Virginia’s consumer data privacy law and the Texas consumer data privacy law. Ultimately, entities subject to other state privacy laws will not have any new compliance obligations. In the below article, we provide an overview of the new law. Applicability The law applies to controllers and processors that conduct business in Oklahoma or produce a p...

Baker Botts and ACC Houston hosted a half-day seminar on January 29, 2026 that featured timely discussions on AI, employment law, and what’s ahead for the workplace. Partners Rich Harper, Paul Morico and Scott Nelson and Latasha McDade, Senior Counsel at Exxon Mobil Corporation, Tenley Krueger, Vice President, Global Intellectual Property at Technip Energies and Courtney Flores, Managing Compliance Counsel at Motiva Enterprises participated in a session titled “Where AI, Employees, and the Law Intersect.” Key Takeaways   AI use in employment has shifted from experimentation to accountability.   Employers of all sizes are using AI to inform hiring, pay, promotion, discipline, and workforce reductions. The central legal question is no longer focused on a manager’s intent. The focus is now on how AI tools are trained, governed, documented, and reviewed. Weak documentation, limited human involvement, or overreliance on vendor tools increases risk even where no discrimin...

The latest BIPA target serves as both a reminder and a warning shot that AI notetaker apps and other listening tools could run afoul of the state’s strict privacy law. A recent proposed class action filed on December 18 alleges a popular AI notetaker vendor violated the Illinois Biometric Information Privacy Act (BIPA) when it allegedly collected and stored voiceprints during a virtual meeting without proper notice, consent, or a compliant data retention policy. While the case targets the AI vendor, the allegations carry important lessons for Illinois employers and any multistate employer with Illinois employees in the room during a virtual meeting . Here’s a recap of what’s going on and six practical steps you can take to minimize your chances of facing legal liability. What Happened: Familiar Workplace Scenario Turns Into Lawsuit The facts  alleged in the complaint  may sound uncomfortably familiar to many employers. An Illinois resident joined a routine virtual meeting. Sh...

The rapid adoption of AI notetaking and transcription tools has transformed how organizations (and individuals) capture, analyze, and share meeting and other content. But as these technologies expand, so too do the legal and compliance risks. A recent putative class action lawsuit filed in federal court in California against Otter.ai, a leading provider of AI transcription services, highlights the potential pitfalls for organizations relying on these tools. The Complaint Against Otter.ai Filed in August 2025,  Brewer v. Otter.ai  alleges that Otter’s “Otter Notetaker” and “OtterPilot” services recorded, accessed, and used the contents of private conversations without obtaining proper consent. According to the  complaint , the AI-powered notetaker: Joins Zoom, Google Meet, and Microsoft Teams meetings as a participant and transmits conversations to Otter in real time for transcription. Records meeting participants’ conversations even if they are not Otter accountholders ....

The attorney-client privilege protects confidential communications between an organization and its attorney if those communications were made for the purpose of obtaining or providing legal advice . Organizations rely on this protection when handling legal matters ranging from investigations to everyday employment matters. But there are several ways that the attorney-client privilege can be lost . Below are suggestions for how to effectively communicate with your counsel in a manner that will help preserve the attorney-client privilege. Limit distribution . Make sure that any communications seeking legal advice are only sent to your in-house or external counsel and not to any third parties . If you include a third party or forward the email chain to them, you may be deemed to have waived the privilege for that communication and potentially others on the same topic. Do not record or create AI notes of your communications with counsel without their knowledge and take steps to ensure that...