Sign in Subscribe

Lydia

In the Matter of LocateSmarter, LLC

A practical analysis of CalPrivacy’s LocateSmarter decision, addressing data broker registration, the CCPA’s data minimization principle, and why businesses cannot require consumers to provide sensitive personal information to exercise the right to opt out of sale or sharing.

When Can Personal Data Leave the EU? A Practical Guide to GDPR International Transfers

A practical guide to GDPR international data transfers, explaining when personal data may leave the EEA and how adequacy decisions, appropriate safeguards, SCCs, BCRs, Transfer Impact Assessments, and Article 49 derogations enable lawful cross-border transfers.

The CAN-SPAM Act Explained: A Practical Guide to U.S. Email Marketing Compliance

The CAN-SPAM Act establishes the federal rules governing commercial email in the United States. This practical guide explains who the law applies to, the seven core compliance requirements, FTC enforcement trends, penalties, and best practices for building a compliant email marketing program.

Colorado Privacy Act Data Protection Assessments: Understanding the Requirements

Colorado's Privacy Act requires Data Protection Assessments before high-risk processing begins. Learn when a DPA is required, what it must include, how often it must be updated, the risks organizations should evaluate, and practical steps for building a compliant assessment framework.

What Is a Risk Assessment Under the CCPA?

The CCPA requires businesses to conduct risk assessments before engaging in certain high-risk processing activities. Learn when a risk assessment is required, what it must include, how it compares to a GDPR DPIA, and the key compliance obligations under California law.

CCPA Cybersecurity Audit Requirements: Understanding Article 9 of the CalPrivacy Regulations

California's proposed CCPA cybersecurity audit regulations require certain businesses to conduct independent annual audits and executive certifications. This guide explains who is covered, what must be audited, and how to build a compliant cybersecurity governance program.

What is New York’s Synthetic Performer Disclosure Law?

New York's Synthetic Performer Disclosure Law requires advertisers to disclose when commercial advertisements use AI-generated synthetic performers. This article explains who the law applies to, its key requirements, exceptions, penalties, and practical compliance considerations.

Mississippi’s Definition of Artificial Intelligence

Mississippi HB 1723 defines artificial intelligence as a machine-based system operating toward human-defined objectives. This article breaks down the definition, explains its key elements, and compares Mississippi’s approach with California’s broader definition of AI.

Requirements for Automated Decision-making Technology (ADMT) Under the CCPA

A practical guide to California's ADMT regulations, including when Article 11 applies and how businesses can comply with its disclosure, opt-out, access, and governance requirements.

The Delete Act: California’s New Framework for Data Broker Accountability

California's Delete Act transforms data broker regulation into a comprehensive operational compliance framework. Learn who qualifies as a data broker and how to comply with registration, disclosure, deletion, audit, and ongoing governance obligations.