Recent court decisions highlight how website design, conspicuous notice, and user assent can determine whether online terms are enforceable.
Continue Reading From Click to Contract: When Courts Enforce Online Terms
UK Smart Data and the Data (Use and Access) Act 2025: Considerations for Businesses
The UK government has published its Smart Data 2035 Strategy, setting a target of five or more active smart data schemes by 2030 and 20 or more by 2035, backed by at least £36 million in public investment over four years.
Continue Reading UK Smart Data and the Data (Use and Access) Act 2025: Considerations for Businesses
Texas AG Secures Temporary Restraining Order Against Discord Over Alleged Deceptive Safety Practices
Texas Attorney General Ken Paxton sued Discord under the Texas Deceptive Trade Practices Act, alleging false safety representations and default settings that expose minors to exploitation risks.
China’s 2026 Automotive Data Cross-Border Transfer Guidelines
China’s new Automotive Data Cross-border Transfer Guidelines are most useful when read through four practical questions for industry participants: what counts as automotive data, what conduct constitutes a cross-border transfer, which transfers may now benefit from exemptions, and which categories of data remain likely to attract heightened scrutiny as important data.
Continue Reading China’s 2026 Automotive Data Cross-Border Transfer Guidelines
Cyber Incident Response: 10 Lessons Learned from Thousands of Breaches
Drawing on lessons learned from thousands of incident responses, this GT Advisory examines the most common and consequential mistakes organizations make when responding to a data breach. From lack of preparation to missteps in customer notification, understanding these pitfalls is the first step toward a more effective response.
Continue Reading Cyber Incident Response: 10 Lessons Learned from Thousands of Breaches
Deepfakes, Chatbots, AI-Generated Text: European Commission Details Transparency Obligations Under the AI Act
The European Commission’s draft guidelines on Article 50 of the EU AI Act clarify how transparency and disclosure obligations apply to interactive AI systems, synthetic content, deepfakes, and AI-generated text on matters of public interest. With the rules taking effect 2 August 2026, organizations should act now to assess their AI governance frameworks, labeling practices, and editorial workflows.
White House Issues Executive Order Targeting Frontier AI Models
On June 2, 2026, the White House issued an Executive Order designed to bolster U.S. cybersecurity through AI-enabled defenses and a voluntary collaboration framework between federal agencies and private AI developers. The Order also directs the Attorney General to prioritize prosecution of AI-assisted cyber offenses under existing federal law.
Continue Reading White House Issues Executive Order Targeting Frontier AI Models
Colorado Repeals and Replaces the Colorado AI Act
Colorado’s newly signed AI Act replaces the state’s 2024 comprehensive AI regulation with a more targeted framework governing automated decision-making technologies used in high-stakes decisions involving employment, healthcare, and financial services, with a compliance deadline of January 1, 2027.
Continue Reading Colorado Repeals and Replaces the Colorado AI Act
FTC Bars Kochava from Selling Sensitive Location Data
The Federal Trade Commission announced a stipulated final order resolving its enforcement action against data broker Kochava Inc. and its subsidiary Collective Data Solutions.
Continue Reading FTC Bars Kochava from Selling Sensitive Location Data
CJEU: First Request for Access May Be Rejected as Abusive Under GDPR
The CJEU’s March 19, 2026, judgment in Case C-526/24 marks a significant development in GDPR enforcement, holding for the first time that even a single data access request may be refused as “excessive” under Article 12(5) GDPR if made in bad faith, while also confirming that an unjustified refusal to comply with such a request can itself give rise to damages liability under Article 82(1) GDPR.
Continue Reading CJEU: First Request for Access May Be Rejected as Abusive Under GDPR