Is this you? As a journalist, you can create a free Muck Rack account to customize your profile, list your contact preferences, and upload a portfolio of your best work.
Claim your profile
Articles by Peter Hegel
Oklahoma and Alabama Headline a Busy Spring for Privacy Legislation
Spring has arrived, and privacy laws are sprouting alongside the crocuses. Oklahoma and Alabama became the 20th and 21st states to enact comprehensive consumer privacy laws in March and April. Utah, Kentucky, and Virginia amended their consumer privacy laws to expand protections for specific types of data, and Utah amended its App Store Accountability Act. And a federal comprehensive privacy proposal–the SECURE Data Act–has been introduced out of committee in Congress.
AI Governance—Key Takeaways From the 2026 IAPP Global Summit
AI dominated the conversation at the IAPP Summit 2026, as it has in the last several years. This post distills themes about AI governance from across the summit into practical guidance for businesses navigating high-stakes AI compliance questions. Setting the Stage: The Current Regulatory Landscape As many panels at IAPP noted, AI regulation is evolving rapidly. In 2025 alone, over 1,000 AI bills were proposed across U.S. state legislatures.
Where Privacy Is Headed Next: Key Takeaways From the 2026 IAPP Global Privacy Summit
Privacy law doesn’t stand still, and neither do the regulators shaping it. The 2026 International Association of Privacy Professionals (IAPP) Global Privacy Summit brought thousands of privacy and data governance professionals, including industry leaders, privacy scholars, and representatives from 22 data protection authorities around the world, to Washington, D.C., for discussions about technological developments, regulatory changes, and business developments shaping the privacy landscape.
"A New Era Of Privacy Enforcement": CPPA Signals Intensified Oversight While Advancing New Regulations
These were some of the highlights from the California Consumer Privacy Protection Agency (CPPA) Board meeting on September 26, 2025. In addition to these enforcement updates, the Board advanced regulatory initiatives and introduced new concepts for future rulemaking. The meeting was the first for Board member Jill Hamer, who replaced Jeffrey Worthe (see announcement here).
“A New Era of Privacy Enforcement”: CPPA Signals Intensified Oversight while Advancing New Regulations | JD Supra
150 consumer complaints per week. A consortium of privacy regulators. “Hundreds of open investigations.” These were some of the highlights from the California Consumer Privacy Protection Agency (CPPA) Board meeting on September 26, 2025. In addition to these enforcement updates, the Board advanced regulatory initiatives and introduced new concepts for future rulemaking. The meeting was the first for Board member Jill Hamer, who replaced Jeffrey Worthe (see announcement here).
2025 Breach Notification Law Update
PC Perkins Coie LLP More Perkins Coie is a premier international law firm with over a century of experience, dedicated to addressing the legal and business challenges of tomorrow. Renowned for its deep industry knowledge and client-centric approach, the firm has consistently partnered with trailblazing organizations, from aviation pioneers to artificial intelligence innovators.
2025 Breach Notification Law Update | JD Supra
State Updates, Security Mandates, and the Federal Regulatory Horizon Overview Cyber-security continues to draw interest from lawmakers and regulators on a variety of fronts. Similar to the trends of 2024, there were relatively few updates to state data breach laws but rather an evolving regulation of security measures in both state and federal laws.
Are You Ready For October 1? Maryland's Data Privacy Law Sets New Standards For Compliance
PC Perkins Coie LLP More Perkins Coie is a premier international law firm with over a century of experience, dedicated to addressing the legal and business challenges of tomorrow. Renowned for its deep industry knowledge and client-centric approach, the firm has consistently partnered with trailblazing organizations, from aviation pioneers to artificial intelligence innovators.
Are You Ready for October 1? Maryland’s Data Privacy Law Sets New Standards For Compliance | JD Supra
The Maryland Online Data Privacy Act (MODPA) is just around the corner, and businesses should consider preparing to address novel compliance obligations that also rank among the most stringent to date. MODPA takes effect on October 1, 2025 and introduces requirements that break from the approach taken by many other state comprehensive consumer privacy laws.
California, Colorado, And Connecticut Launch Multi-State Investigative Sweep Focusing On Global Privacy Control
In a major move signaling the growing power of multi-state cooperation on privacy enforcement, the California Privacy Protection Agency (CPPA), alongside the Attorneys General of California, Colorado, and Connecticut (collectively, the "Coalition"), announced an investigative sweep targeting businesses that fail to honor consumers' requests to stop the sale or sharing of personal information.
California, Colorado, and Connecticut Launch Multi-State Investigative Sweep Focusing on Global Privacy Control | JD Supra
In a major move signaling the growing power of multi-state cooperation on privacy enforcement, the California Privacy Protection Agency (CPPA), alongside the Attorneys General of California, Colorado, and Connecticut (collectively, the “Coalition”), announced an investigative sweep targeting businesses that fail to honor consumers’ requests to stop the sale or sharing of personal information.
CPPA Approves Cybersecurity, Automated Decisionmaking, And Risk Assessment Regulations
After years of drafting, discussions, and debates, the California Privacy Protection Agency (CPPA) Board reached a significant milestone in its efforts to bring to fruition regulations that have been in discussion by the CPPA Board for several years. After years of drafting, discussions, and debates, the California Privacy Protection Agency (CPPA) Board reached a significant milestone in its efforts to bring to fruition regulations that have been in discussion by the CPPA Board for several years.
CPPA Approves Cybersecurity, Automated Decisionmaking, and Risk Assessment Regulations | JD Supra
After years of drafting, discussions, and debates, the California Privacy Protection Agency (CPPA) Board reached a significant milestone in its efforts to bring to fruition regulations that have been in discussion by the CPPA Board for several years.
Coast To Coast: Privacy Enforcement Heats Up With Healthline And TicketNetwork Settlements
In early July 2025, the attorneys general of California and Connecticut announced significant settlements under their respective privacy statutes, signaling an expanding era of state privacy enforcement. These developments underscore the importance of privacy compliance programs and offer valuable guidance for companies subject to the California Consumer Privacy Act (CCPA), the Connecticut Data Privacy Act (CTDPA), and similar state laws.
Coast to Coast: Privacy Enforcement Heats Up with Healthline and TicketNetwork Settlements | JD Supra
As the 2025 summer heat continues and as state privacy laws continue to mature, enforcement actions are beginning to shape the compliance landscape for businesses nationwide—from the coast of California to the shores of Connecticut. In early July 2025, the attorneys general of California and Connecticut announced significant settlements under their respective privacy statutes, signaling an expanding era of state privacy enforcement.
The Start Of Something New? New Jersey's Proposed Privacy Rules
PC Perkins Coie LLP More Perkins Coie is a premier international law firm with over a century of experience, dedicated to addressing the legal and business challenges of tomorrow. Renowned for its deep industry knowledge and client-centric approach, the firm has consistently partnered with trailblazing organizations, from aviation pioneers to artificial intelligence innovators.
The Start of Something New? New Jersey’s Proposed Privacy Rules | JD Supra
On June 2, 2025, the New Jersey Office of Consumer Protection announced proposed rules for New Jersey’s comprehensive consumer privacy law, the New Jersey Data Privacy Act (NJDPA), which went into effect on January 16, 2025. While the proposed rules draw from the California and Colorado privacy regulations, they also would introduce a number of significant definitions and compliance mandates not found in the NJDPA or most other states. Below are several key provisions in the proposed rules.
Buckle Up! CPPA Is Driving Privacy Regulation And Enforcement Forward
After a relatively slow start to 2025, the California Privacy Protection Agency (CPPA) is firing on all cylinders now.
CPPA Signals Significant Revisions Ahead
The California Privacy Protection Agency (CPPA) is substantially revising its draft privacy regulations. Definitions for automated decision-making technology (ADMT) and "significant decisions" are being narrowed to reduce overreach. Behavioral advertising is being removed from ADMT and risk assessment (RA) requirements. The CPPA plans to simplify RA reporting requirements, reducing routine compliance burdens for businesses.
CPPA Signals Significant Revisions Ahead | JD Supra
Key Takeaways The California Privacy Protection Agency (CPPA) is substantially revising its draft privacy regulations. Definitions for automated decision-making technology (ADMT) and "significant decisions" are being narrowed to reduce overreach. Behavioral advertising is being removed from ADMT and risk assessment (RA) requirements. The CPPA plans to simplify RA reporting requirements, reducing routine compliance burdens for businesses.
California Privacy in 2025: Key Changes Affecting Data Brokers | JD Supra
As we close out the first quarter of 2025, one thing is unmistakable: California’s regulatory efforts continue to center on data brokers. So far this year, the California Privacy Protection Agency (CPPA) proposed newly-released changes to data broker regulations, reached its sixth settlement with a data broker, added a new Board member, and, most recently, named a new Executive Director.
Fasten Your Seatbelts: CPPA Proposes Rules On Automated Decision-Making And Cybersecurity Audits And Finalizes Data Broker Regulations
After much anticipation, on November 8, the California Privacy Protection Agency (CPPA) Board voted to advance proposed regulations for insurance, cybersecurity audits, risk assessments, and automated decision-making technology (ADMT) to formal rulemaking. This comes over a year after the Board released its initial draft of the cybersecurity audit and risk assessment regulations, which it subsequently revised for discussion.
Fasten Your Seatbelts: CPPA Proposes Rules on Automated Decision-Making and Cybersecurity Audits and Finalizes Data Broker Regulations | JD Supra
After much anticipation, on November 8, the California Privacy Protection Agency (CPPA) Board voted to advance proposed regulations for insurance, cybersecurity audits, risk assessments, and automated decision-making technology (ADMT) to formal rulemaking. This comes over a year after the Board released its initial draft of the cybersecurity audit and risk assessment regulations, which it subsequently revised for discussion.
2024 Breach Notification Law Update: Unique New State Obligations and Widespread New Federal Obligations | JD Supra
Overview Amid intense focus on AI and a flurry of consumer privacy law updates, legislative activity has continued to change data breach notification requirements in a variety of ways.
CPPA Board Updates Timing for Regulations, and Enforcement Division Releases Enforcement Advisory: Focus on Data Minimization!
This year, the blossoming of spring is accompanied by a pair of noteworthy California Privacy Protection Agency (CPPA) updates. First, on March 8, the CPPA and staff convened to discuss new draft regulations related to automated decision-making technology (ADMT) and risk assessments, as well as updates to existing California Consumer Privacy Act (CCPA) regulations.
CCPA Enforcement Surprise: Regulations Effective Immediately
On Friday, February 9, as the country collectively packed up and prepared to head home for Super Bowl weekend, the Third Appellate District of the California Appellate Court issued an Order granting the California Privacy Protection Agency (the Agency) the ability to immediately enforce regulations implementing the California Privacy Rights Act (CPRA), which were finalized in March 2023. This vacated a July 2023 court decision staying enforcement of the regulations until March 29, 2024.
CCPA Enforcement Surprise: Regulations Effective Immediately | JD Supra
On Friday, February 9, as the country collectively packed up and prepared to head home for Super Bowl weekend, the Third Appellate District of the California Appellate Court issued an Order granting the California Privacy Protection Agency (the Agency) the ability to immediately enforce regulations implementing the California Privacy Rights Act (CPRA), which were finalized in March 2023. This vacated a July 2023 court decision staying enforcement of the regulations until March 29, 2024.
CCPA Enforcement Surprise: Regulations Effective Immediately
On Friday, February 9, as the country collectively packed up and prepared to head home for Super Bowl weekend, the Third Appellate District of the California Appellate Court issued an Order granting the California Privacy Protection Agency the ability to immediately enforce regulations implementing the California Privacy Rights Act, which were finalized in March 2023. This vacated a July 2023 court decision staying enforcement of the regulations until March 29, 2024.
Two New States Enter the Privacy Fray
Building off of the momentum from last year’s torrent of new comprehensive state privacy laws, 2024 has begun with a bang as two more states have now entered the picture. On January 16, 2024, New Jersey became the latest state to enact comprehensive privacy legislation with the New Jersey Data Privacy Act (NJDPA). New Hampshire’s state legislature quickly followed suit by passing Senate Bill 255.
California Announces Sweep on Streaming Services and More Enforcement To Come
California Attorney General Rob Bonta announced an investigatory sweep into popular streaming apps and devices, timed to coincide with Data Privacy Day on January 28. The California Attorney General’s Office explained that it is sending letters to such streaming services alleging a failure to comply with the requirement to offer an easy mechanism to opt out of the sale or sharing of personal information under the California Consumer Privacy Act (CCPA).
2023 Breach Notification Law Update: Changes to Notification and Security Requirements Continue at State and Federal Levels | JD Supra
A flurry of legislative activity over the past year has brought meaningful changes to a variety of privacy and security provisions in state and federal law. At the state level, as in 2022, we have seen a handful of changes to generally applicable breach notification statutes, along with action on both narrower security provisions and broader omnibus privacy laws.
A Potential Look Into the Future: California Issues First Draft of Cybersecurity Audit and Risk Assessment Regulations | JD Supra
The Board of the California Privacy Protection Agency (the CPPA) held its first meeting since July on Friday, September 8, 2023, and discussed the first public draft of cybersecurity audit regulations and risk assessment regulations.[1] While the CPPA Board expressly announced that the drafts were for board meeting discussion purposes and that it has not started the formal rulemaking procedures yet, the first public drafts of the regulations provide a roadmap for where the CPPA Board may go,...
A Potential Look Into The Future: California Issues First Draft Of Cybersecurity Audit And Risk Assessment Regulations
The Board of the California Privacy Protection Agency (the CPPA) held its first meeting since July on Friday, September 8, 2023, and discussed the first public draft of cybersecurity audit regulations and risk assessment regulations.1 While the CPPA Board expressly announced that the drafts were for board meeting discussion purposes and that it has not started the formal rulemaking procedures yet, the first public drafts of the regulations provide a roadmap for where the CPPA Board may go,...
Full Steam Ahead: Updates In Enforcement Of California Privacy Law
A court-ordered stay on enforcement of updates to certain parts of the California privacy regulation (the Ruling) has not slowed down enforcement of the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA). In fact, the hot summer months of July and August are poised to be busy months of regulator activity.
Full Steam Ahead: Updates in Enforcement of California Privacy Law
A court-ordered stay on enforcement of updates to certain parts of the California privacy regulation (the Ruling) has not slowed down enforcement of the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA). In fact, the hot summer months of July and August are poised to be busy months of regulator activity.
New My Health My Data Act Part 3: The Wide Reach of the New Washington Privacy Legislation | JD Supra Original
This Update is the third installment of the ongoing series covering Washington state’s new My Health My Data Act (the Act). Part 1 provided a high-level outline of the entities regulated under the Act and the corresponding requirements, as well as a detailed discussion on biometric data processing. Part 2 explored the consumer rights and business obligations created by the Act. In this installment, we address the Act’s scope and its future implications for covered entities.
New My Health My Data Act Part 3: The Wide Reach of the New Washington Privacy Legislation
This Update is the third installment of the ongoing series covering Washington state’s new My Health My Data Act. The original impetus for the act was the protection of reproductive rights, and it was signed into law alongside several other pieces of legislation focused on providing abortion and gender-affirming protections.
New My Health My Data Act Part 2: Consumer Rights and Business Obligations | JD Supra
As detailed in Part 1 of this ongoing series, Washington Governor Jay Inslee signed the state’s My Health My Data Act (the Act) into law on April 27, 2023.
New My Health My Data Act Part 2:Consumer Rights and Business Obligations
As detailed in Part 1 of this ongoing series, Washington Governor Jay Inslee signed the state’s My Health My Data Act into law on April 27, 2023. The act is a first-of-its-kind law that creates new privacy protections relating to the collection, sharing, and selling of “consumer health data.” Most of the provisions of the act take effect on March 31, 2024. However, small businesses have an additional three months to come into compliance.
Lucky Number 7…8 and 9?: Indiana Passes Privacy Law With Tennessee and Montana Hot on Its Heels
Indiana Governor Eric Holcomb signed Senate Bill 5 on May 1 (effective January 1, 2026), making Indiana the seventh state to offer comprehensive privacy protections. Indiana’s new law appears to closely track Virginia’s omnibus privacy law.
Crossing the Finish Line: California Regulations Effective Immediately
The California Privacy Protection Agency (CPPA) released a statement on March 30, 2023, announcing that the California Office of Administrative Law (OAL) had approved the first substantive rulemaking package for the California Consumer Privacy Act (CCPA), amended by the California Privacy Rights Act (CPRA). As a result of this, the CCPA regulations in this rulemaking package are finalized and, according to their terms, effective immediately.
Joining the Privacy Party: Iowa Becomes the Sixth State To Adopt a Comprehensive Privacy Law
On March 28, Iowa Governor Kim Reynolds signed Senate File 262, effective January 1, 2025, making Iowa the sixth state to offer comprehensive privacy protections. Iowa’s new legislation appears to be the most business-friendly omnibus privacy law yet, with fewer requirements than those of other states.
Almost There and Starting Again: CPPA Votes To Finalize Regulations and Launches Round Two
The Board of the California Privacy Protection Agency (CPPA) approved a rulemaking package covering Sections 7000–7304 of their draft regulations on February 3, 2023. The board also initiated preliminary rulemaking activities for risk assessments, cybersecurity audits, and automated decision-making.
This is Not a Drill: CPPA Gets Closer to Finalizing Certain Privacy Regulations
Introduction While candy sales skyrocketed and trick-or-treaters donned costumes this past Halloween weekend, the California Privacy Protection Agency (Agency) Board was busy holding its first public meeting since September.
Western States Continue To Shape US Privacy Landscape: Colorado CPA and California CPRA | JD Supra
The Colorado attorney general’s office sent shockwaves throughout the privacy world on September 30, 2022, when it published its proposed Colorado Privacy Act (CPA) draft rules (Draft Rules). The Draft Rules are complex and comprehensive; at 38 pages of single-spaced text, they are longer than the CPA itself. The Draft Rules are accompanied by a proposed timeline for stakeholder meetings and a public hearing.
2022 Breach Notification Law Update: State and Federal Requirements Continue To Evolve | JD Supra
Overview Cyberattacks continue to plague businesses, making the fallout of data breach notification and response as critical as ever. This year, like 2021, has been relatively quiet as it relates to state updates to breach notification laws. Much of the excitement has instead been around omnibus privacy laws, some of which cover data security as well.
2022 Breach Notification Law Update: State and Federal Requirements Continue To Evolve
Amelia Gerlicher focuses her practice in the areas of privacy and data security, counseling clients on preparing for and reacting to data breaches and network intrusions, as well as helping clients assess and address the privacy and data security risks that arise from… Amelia Gerlicher focuses her practice in the areas of privacy and data security, counseling clients on preparing for and reacting to data breaches and network intrusions, as well as helping clients assess and address the...
Data Privacy Day Surprise Enforcement for Loyalty Programs
On Friday, January 28, the world celebrated its 16th Data Protection/Privacy Day. As the privacy community capped off a week of programming and gazed into the future of potential data privacy enforcement [1], the celebrations were quickly overshadowed by California Attorney General Rob Bonta, who announced that his office was targeting businesses operating loyalty programs for potential enforcement actions.
Requiem for a Cookie: The Beginning of the End for Current AdTech Models
Last week while Americans were preoccupied with carving turkey and baking pies, the privacy world was aflutter with a string of developments in Europe that may drastically affect the future of worldwide website usage and global advertising technology as we currently know it. In short, due to some of the recent positions taken by regulators, “tracking” techniques and cookies as we know them may quickly be saddled with extra compliance requirements.
Show More
loading
Actions
Is this you?
As a journalist, you can create a free Muck Rack account to customize your profile, list your contact preferences, and upload a portfolio of your best work.Get in touch with Peter
Contact Peter, search articles and posts on X, monitor coverage, and track replies from one place.
Learn more about Muck Rack