Search results

[…] enacted. Although no new states ha ve joined the ranks, lawmakers have continued to evolve existing laws, as California, Colorado, Connecticut, Kentucky, Montana, Oregon, Texas, Utah, and Virginia all amended their respective laws in 2025. This report summarizes that legislative landscape, compares and contrasts the prevailing models for state laws, and identifies the critical […]

[…] the year. While this Forum is open to the broader community, members are encouraged to attend, and each event will have its own registration. This event is free for FPF Advisory Board members. What to Expect When top experts in data protection convene from various corners of the globe, spanning diverse sectors such as […]

[…] safety features—can reinforce that trust. So too can policies that respect user rights and provide accessible redress mechanisms. As one participant concluded: “When we prioritize trust, we get privacy, safety, and security as a package—not a compromise.” IV. CONCLUSION This event series made clear that young Australians wish for a digital ecosystem that is […]

[…] use, and disclosure practices of the operator with respect to personal information ; and ( B) before the personal information of the child or teen is collected, freely and unambiguously authorizes — (i) the collection, use, and disclosure, as applicable, of that the personal information ; and 6 (ii) the any subsequent use of […]

[…] our congressional testimony, FPF considers that the typical regulatory course is to be silent about fees between business parties, which can be addressed via contract and the free market. However, FPF recognizes the unique challenges raised in the open banking context since the data provider holds the information needed by the consumer and third […]

[…] th at th e ch atb ot i s AI. 1 N ew Yo rk S -3 0 08 C N /A (F Y 26 B ud get) P ro hib it s opera to rs fr o m offerin g AI co m pan io n c h atb ots wit h o […]

[…] the means to reasonably identify the individuals: if they do not process personal data, the GDPR does not apply.  On the other hand, pseudonymization is not a free pass. A dataset may still qualify as personal data: (1) if the recipient has reasonable means to re-identify the individual; (2) for the controller who holds […]

[…] was reviewed and approved and names and positions of individuals who reviewed or approved. § 7152. † Examples or requirements specified in the regulations Items (1)-(3), (6)-(9) get recorded in a “risk assessment report” that can be requested by the CPPA or AG. DPAs must identify and describe the risks to consumers’ rights associated […]

[…] to opt-out, and appeal adverse decisions. It would also prohibit use of a high-risk AI system that produces algorithmic discrimination or has not passed an independent audit. Virginia HB 2094 (Veto’ed by Governor) Del. Maldonado (D) High-Risk AI / Automated Decisionmaking Would regulate AI systems used in consequential decisions, requiring entities to use reasonable […]

[…] strong concern that replicating the EU AI Act could create regulatory overreach. However, civil society groups argue that even comprehensive frameworks like the Colorado AI Act or Virginia’s HB 2094 (vetoed) are significantly narrower in scope and that highlighting that superficial similarities with the EU AI Act, such as shared definitions or structural references, […]