The Federal Trade Commission (FTC) recently released its Strategic Plan for Fiscal Years 2026–2030, setting out the agency’s enforcement priorities and operational objectives for the next five years under Chairman Andrew N. Ferguson. The plan reaffirms the FTC’s commitment to vigorously enforcing the nation’s antitrust and consumer protection laws “without fear or favor.” Critically for…

2026 will be a significant year for retailers and e-commerce companies, with significant changes on the horizon that will affect the entire industry and ecosystem. In this alert, we highlight the top issues retailers and e-commerce companies should be aware of and ready to tackle in 2026. Click here to continue reading the full version…

Register now to join Joanna Rosen Forster, Joachim B. Steinberg, Preetha Chakrabarti, David Ervin, and Warrington Parker on June 11, 2025 from 12:00 pm EDT – 1:00 pm EDT as they discuss Section 230 and the implications for digital platforms, online businesses and e-commerce. Section 230 was enacted as part of the United States Communications Decency Act (CDA), providing immunity to interactive computer service providers for third-party content. Known as “the 26 words that created the internet,” this statute is responsible for the development of the modern internet as we know it. 

Recent calls by the DOJ, FTC, FCC, State AGs and even Congressional Leaders to reform, edit or take Section 230 enforcement in new directions signal a potential inflection point. The challenge for policy reform lies in balancing Section 230’s role in protecting online speech and fostering innovation with evolving concerns about platform accountability, consumer protection, and market efficiency in a data-driven economy.

Continue Reading Register Now! Section 230: Implications for Digital Platforms, Online Businesses and E-Commerce Webinar

On April 3, 2025, the United States Department of Justice’ Antitrust Division hosted a forum on “Big-Tech Censorship” in which key Trump Administration Officials announced their desire to reform, or entirely overhaul, Section 230 of the Communications Decency Act. In March 2025, we wrote about the Federal Trade Commission’s (FTC) inquiry into “tech censorship” and…

Advances in artificial intelligence have become front and center in the minds of many, including attorneys general focused on consumer protection. Although concerns exist for consumer protection, the advancement of artificial intelligence has the opportunity to add value to consumers.  This is especially true in healthcare. Recently, attorneys general gathered to discuss these issues at the Attorney General Alliance Annual Meeting, during a panel that discussed  The Value of Disruptive Healthcare. In the last few years, the growth of telemedicine has dramatically changed the delivery of healthcare. While these changes were already afoot, the pandemic highlighted the need for virtual access to healthcare and wellness tools. That disruption has added value in many ways to consumers and health care providers managing care for their patients. Similarly, in the coming years, we can expect artificial intelligence to drive even more changes in treatment, therapies, and standards of care in the healthcare sector. During these periods of major technological advancements attorneys general should consider consumers’ safety, privacy, security and consumers’ overall livelihood and health. Dramatic changes in healthcare business and technology are already challenging existing laws in unexpected ways, often creating gaps between the law and what consumers and producers need or want the law to say. This gap period, or regulatory lag, will require producers to assume some regulatory risk and for attorneys general to monitor business activities that they believe create too much risk for consumers.

Continue Reading Attorneys General Consider Consumer Protection Issues Related to Artificial Intelligence in Consumer-Facing Healthcare Technology

On March 15, the Iowa House passed Senate File 262 (SF 262), a comprehensive state privacy law bill. If enacted, SF 262 would be the sixth state level privacy legislation, following California, Virginia, Colorado, Utah, and Connecticut, and it would go into effect on January 1, 2025.

Continue Reading Iowa to Introduce the Sixth Comprehensive State Privacy Law in United States

In a judgment of August 1, 2022, the Court of Justice of the European Union (CJEU) provided further guidance on two important aspects of the General Data Protection Regulation (GDPR) (CJEU C-184/20). In summary, the CJEU held that, first, for a national law that imposes a legal obligation to process personal data to be able to constitute a legal basis for processing, it needs to be lawful, meaning that it must meet an objective of public interest and be proportionate to the legitimate aim pursued, and second, that non-sensitive data that are liable to reveal sensitive personal data need to be protected by the strengthened protection regime for processing of special categories of personal data.

Continue Reading Processing of Personal Data That May Indirectly Reveal Sensitive Information on the Basis of a Legal Obligation: The CJEU Draws the Contours

On August 24, 2022, the California Attorney General’s Office announced a settlement with Sephora, Inc. (Sephora), a French multinational personal care and beauty products retailer. The settlement resolved Sephora’s alleged violations of the California Consumer Privacy Act (CCPA) for allegedly failing to: disclose to consumers that the company was selling their personal information, process user requests to opt out of sale via user-enabled global privacy controls, and cure these violations within the 30-day period currently allowed by the CCPA.

Continue Reading $1.2 Million CCPA Settlement with Sephora Focuses on Sale of Personal Information and Global Privacy Controls

In the recent article, “Facebook and Google settled biometrics lawsuits. Look for more.” featured in Crain’s Chicago Business, Partner Jason Stiehl analyzes wider repercussions of Snapchat’s recent settlement after accusations that it used facial recognition technology that collected and stored users’ biometric information without consent. Stiehl explains that he expects more litigation due to Illinois’…

The California Office of the Attorney General issued its first opinion interpreting the California Consumer Privacy Act (CCPA) on March 10, 2022, addressing the issue of whether a consumer has a right to know the inferences that a business holds about the consumer. The AG concluded that, unless a statutory exception applies, internally generated inferences that a business holds about the consumer are personal information within the meaning of the CCPA and must be disclosed to the consumer, upon request. The consumer has the right to know about the inferences, regardless of whether the inferences were generated internally by the business or obtained by the business from another source. Further, while the CCPA does not require a business to disclose its trade secrets in response to consumers’ requests for information, the business cannot withhold inferences about the consumer by merely asserting that they constitute a “trade secret.”

Continue Reading California AG Interprets “Inferences” Under CCPA