Last week, on May 8, 2026, the public comment period for New York City’s own version of the “click-to-cancel rule” closed. The proposed rule (NYC Subscription Rule) was issued following an Executive Order from January 2026 by New York City Mayor, Zohran Mamdani, which focuses on ensuring New Yorkers are not forced to remain in unwanted subscriptions.

This Executive Order focuses on ensuring New Yorkers are not stuck with subscriptions. Under the Executive Order, NYC’s Department of Consumer and Work Protection (DCWP) will prioritize monitoring, investigating and taking enforcement action against subscription-related practices that deceive or mislead consumers.

Continue Reading Click‑to‑Cancel Comes to NYC: The Big Apple Cracks Down on Bad Apples (i.e., Bad Subscription Practices)

State privacy regulators continue to focus on consumers’ rights to opt out of the sale of personal information and targeted advertising, signaling that this issue remains a top enforcement priority across the United States.

As comprehensive state privacy laws mature, regulators are increasingly emphasizing not just the existence of opt‑out mechanisms, but whether businesses are properly honoring them in practice, particularly when those signals are conveyed through universal opt‑out tools such as the Global Privacy Control.

Continue Reading States Continue to Focus on the Right to Opt‑Out of the Sale of Personal Information and Targeted Advertising

Last week, the House Energy and Commerce and Financial Services Committees announced a joint effort to advance two new data privacy bills:  the Securing and Establishing Consumer Uniform Rights and Enforcement over Data Act (the SECURE Data Act) and the Guidelines for Use, Access, and Responsible Disclosure of Financial Data Act (the GUARD Financial Data Act).

(At minimum, points to Congress for the acronyms).

If you have been watching federal privacy legislation over the past few years, the SECURE Data Act alone may not inspire much excitement. Congress has been attempting comprehensive federal privacy legislation for years without much success, and this bill follows that tradition of ambition. That said, the SECURE Data Act is the result of over a year of work by the House Energy and Commerce Data Privacy Working Group and contains a few notable developments worth paying attention to. This package also includes a serious, targeted effort to modernize the Gramm-Leach-Bliley Act (the GLBA) through the GUARD Financial Data Act.

Below, we overview both bills, briefly explain why comprehensive federal privacy legislation has historically stalled, and discuss what this means for businesses today.

Continue Reading A New Push for Federal Privacy Law: What to Know About SECURE and GUARD

We have another one! We wrote last week about Oklahoma’s new consumer protection law. Now, Alabama has passed its own comprehensive privacy law. The Alabama Personal Data Protection Act, House Bill 351, (the  Law) will go into effect on May 1, 2027.

Here is a general summary of what to expect:

Continue Reading “Sweet Home, Data Privacy” – Alabama’s New Privacy Law is Coming Online in 2027

Oklahoma has joined the growing chorus of states enacting comprehensive consumer privacy legislation. With the passage of Senate Bill 546, the Sooner State has a new data protection framework taking effect on January 1, 2027.

Here is what businesses need to know.

Continue Reading “Oh What a Beautiful Morning” for Oklahoma Privacy:  Key Takeaways from the Sooner States’ New Consumer Data Protection Law

On April 22, 2026, the Federal Trade Commission will begin enforcing compliance with its most recent amendments to the Children’s Online Privacy Protection Rule (the COPPA Rule). As discussed in more detail below, the FTC published amendments in a 2025 final rule that, among other updates, expands the scope of the COPPA Rule, expands notice requirements, and requires specific data retention and information security policies and procedures.

Continue Reading Enforcement Begins Soon for Significant COPPA Rule Amendments

In the payments world, commentators note Illinois’ recent Interchange Fee Prohibition Act, which prohibits charging interchange fees on the tax or tip portions of processed transactions.

Key portions of the law take effect July 1.

Continue Reading Payments and Privacy – What Issues Should Payment Service Providers Be Paying Attention To?

As previously reported, states such as California, Louisiana, Texas and Utah have adopted App Store Accountability (ASA) Laws. These new laws require app store operators (e.g., Apple and Google) along with app developers (i.e., the business that owns the app) to implement safeguards for age verification. While these laws are framed as child-protection measures, their impact is universal. Every app must comply, regardless of its audience. For businesses, meeting the requirements outlined in ASA Laws is mandatory for apps to remain available for download.

Louisiana, Texas and Utah’s laws are similar and take effect at various points in 2026, while California’s Digital Age Assurance Act (CA ASA Law) is unique and takes effect January 1, 2027. This is what businesses should know about the unique features of the CA ASA Law.

Continue Reading A Deeper Dive Into California’s App Store Accountability Law

The Federal Trade Commission (FTC) is once again taking aim at its Negative Option Rule, signaling a renewed effort to address deceptive subscription and automatic renewal practices.

On March 11, 2026, the FTC released an Advance Notice of Proposed Rulemaking (ANPRM) seeking input on whether the rule should be updated to reflect today’s subscription‑driven marketplace. The agency emphasized that negative option programs continue to generate substantial consumer frustration, including more than 100,000 complaints over the past five years.

Continue Reading FTC’s Negative Option Rule Revived – Public Comment Period

From California to Texas to Ohio, lawmakers are increasingly turning to age-verification requirements to protect children online. These laws target a range of concerns, with a growing body of research suggesting that certain online activities may pose risks to children’s mental health and well-being.

At the same time, privacy laws continue to proliferate across the United States, many of which emphasize data minimization and limitations on the use of sensitive personal information. This creates a growing tension. Protecting children online may require companies to collect more personal data than they otherwise would, and potentially subject themselves to additional privacy requirements and consumer concerns.

Continue Reading Collection for Protection: The Age-Verification Paradox