Nikkia Knudsen

On February 16, 2026, in conjunction with the effective date of various updates to 42 CFR Part 2, the U.S. Department of Health and Human Services (HHS) Office for Civil Rights (OCR) launched its new enforcement program pertaining to the confidentiality of substance use disorder (SUD) records. Specifically, OCR is implementing various civil enforcement mechanisms as required under the Coronavirus Aid, Relief, and Economic Security (CARES) Act and its implementing regulations under 42 CFR Part 2.

In December 2023, the Federal Trade Commission (FTC) proposed changes to the Children’s Online Privacy Protection Act (COPPA) Rule to address the increasing use and monetization of children’s data online. The COPPA Rule, which implements the 1998 Act, requires certain website and online service operators to obtain parental consent before collecting, using, or disclosing personal data of children under the age of 13.

On November 8, the California Privacy Protection Agency (CPPA), the agency tasked with implementing and enforcing the California Consumer Privacy Act (as amended by the California Privacy Rights Act), unanimously voted to approve new regulations to implement the Delete Act of 2023. The Delete Act, in part, requires data brokers to annually register with the CPPA, pay a fee, and provide information about their data processing activities.