CompliancePulse Regulatory Intelligence News

{
  "lang": "en",
  "topic": "privacy",
  "country": "United States"
}

{
  "raw": "{\n  \"intelligence_date\": \"2026-06-18\",\n  \"focus\": {\n    \"jurisdiction\": \"United States\",\n    \"topic\": \"privacy\"\n  },\n  \"headline_stories\": [\n    {\n      \"headline\": \"American Privacy Rights Act (APRA) Remains Stalled in Congress Amid Preemption and Private Right of Action Disputes\",\n      \"regulator\": \"U.S. Congress / House Energy & Commerce Committee\",\n      \"jurisdiction\": \"United States (Federal)\",\n      \"topic_area\": \"privacy\",\n      \"summary\": \"The American Privacy Rights Act, which would create a national consumer privacy framework, continues to face legislative gridlock heading into mid-2026. Key sticking points remain the scope of federal preemption over state laws and whether to include a private right of action allowing individuals to sue companies directly. Stakeholders from tech, retail, and civil liberties organizations are actively lobbying for competing positions.\",\n      \"compliance_impact\": \"Organizations should not wait for federal legislation and must continue to build state-by-state compliance programs. Compliance teams should model APRA obligations in parallel to prepare for eventual enactment and avoid retrofit costs.\",\n      \"affected_entities\": \"All entities collecting, processing, or selling personal data of U.S. consumers, particularly large data controllers, data brokers, and adtech companies\",\n      \"urgency\": \"monitoring\",\n      \"date\": \"2026 ongoing\"\n    },\n    {\n      \"headline\": \"FTC Continues Aggressive Enforcement Under Section 5 on Data Practices as Rulemaking Agenda Advances\",\n      \"regulator\": \"Federal Trade Commission (FTC)\",\n      \"jurisdiction\": \"United States (Federal)\",\n      \"topic_area\": \"privacy\",\n      \"summary\": \"The FTC continues to pursue enforcement actions targeting deceptive data practices under Section 5 of the FTC Act, with particular focus on data brokers, health data monetization, and AI-driven profiling. The Commission has indicated it views the collection and sale of sensitive health and location data without meaningful consent as an unfair trade practice. Ongoing rulemaking on commercial surveillance and data security remains active.\",\n      \"compliance_impact\": \"Companies must audit data collection practices, particularly for sensitive categories (health, location, financial). Privacy notices must accurately reflect actual data flows. Data broker activities require immediate legal review.\",\n      \"affected_entities\": \"Data brokers, health apps, adtech platforms, consumer-facing mobile apps, financial data aggregators\",\n      \"urgency\": \"immediate\",\n      \"date\": \"2026 ongoing\"\n    },\n    {\n      \"headline\": \"California Privacy Protection Agency (CPPA) Issues Final Automated Decision-Making Technology (ADMT) Regulations\",\n      \"regulator\": \"California Privacy Protection Agency (CPPA)\",\n      \"jurisdiction\": \"California, United States\",\n      \"topic_area\": \"privacy\",\n      \"summary\": \"The CPPA has finalized regulations under CPRA governing automated decision-making technology, including opt-out rights for consumers subject to profiling and significant decisions (employment, credit, housing, education). The regulations impose transparency obligations, require access to logic summaries, and mandate human review options for consequential decisions. Enforcement is expected to ramp up through late 2026.\",\n      \"compliance_impact\": \"Organizations using algorithms or AI for hiring, credit scoring, targeted advertising, or content recommendation to California consumers must implement opt-out mechanisms, update privacy notices, and establish human review pathways. Technology audits of ADMT systems are required.\",\n      \"affected_entities\": \"Employers, lenders, insurers, ad platforms, social media companies, any business using algorithmic decision-making affecting California consumers\",\n      \"urgency\": \"immediate\",\n      \"date\": \"2026\"\n    },\n    {\n      \"headline\": \"Texas Data Privacy and Security Act (TDPSA) Enforcement Now Active; AG Investigations Underway\",\n      \"regulator\": \"Texas Office of the Attorney General\",\n      \"jurisdiction\": \"Texas, United States\",\n      \"topic_area\": \"privacy\",\n      \"summary\": \"Texas's Data Privacy and Security Act became effective July 1, 2024, and the Texas AG's office has escalated enforcement activity into 2026, issuing investigative demands to companies regarding TDPSA compliance. Texas notably lacks a cure period for violations, making first-instance enforcement meaningful. The AG is focusing on sensitive data handling and the absence of opt-out mechanisms for targeted advertising.\",\n      \"compliance_impact\": \"Businesses must verify TDPSA compliance immediately, including honoring consumer rights requests, publishing compliant privacy notices, executing DPAs with processors, and offering opt-outs for targeted advertising and sale of sensitive data.\",\n      \"affected_entities\": \"Any business meeting TDPSA thresholds that processes personal data of Texas consumers\",\n      \"urgency\": \"immediate\",\n      \"date\": \"2026 ongoing\"\n    },\n    {\n      \"headline\": \"State Privacy Law Wave Continues: New Laws Effective in 2026 Across Multiple States\",\n      \"regulator\": \"Multiple State Attorneys General\",\n      \"jurisdiction\": \"United States (Multi-State)\",\n      \"topic_area\": \"privacy\",\n      \"summary\": \"By mid-2026, over 20 U.S. states have enacted comprehensive consumer privacy laws, with several new laws taking effect in 2026 including those from Nebraska, Minnesota, Maryland, and New Hampshire. Maryland's Online Data Privacy Act is considered among the strictest, including a data minimization requirement stricter than most peer states and restrictions on sensitive data processing without consent. Minnesota and Nebraska laws also broadened consumer rights.\",\n      \"compliance_impact\": \"Organizations must map which state laws apply based on their consumer footprint and update compliance programs accordingly. Universal opt-out mechanism (GPC) support is required in multiple states. Data minimization practices must be reviewed urgently for Maryland law compliance.\",\n      \"affected_entities\": \"Controllers and processors doing business in Maryland, Minnesota, Nebraska, New Hampshire, and other newly-effective states\",\n      \"urgency\": \"immediate\",\n      \"date\": \"2026\"\n    },\n    {\n      \"headline\": \"HHS Office for Civil Rights Issues Revised HIPAA Privacy Rule Amending Reproductive Health Data Protections\",\n      \"regulator\": \"HHS Office for Civil Rights (OCR)\",\n      \"jurisdiction\": \"United States (Federal)\",\n      \"topic_area\": \"privacy\",\n      \"summary\": \"Following 2024 final rules amending HIPAA to protect reproductive health information, HHS OCR issued additional guidance in 2025-2026 clarifying obligations for covered entities and business associates regarding disclosures to law enforcement related to reproductive health care. The rule restricts PHI disclosure for investigations into lawful reproductive health activities. Compliance and breach notification obligations are actively being enforced.\",\n      \"compliance_impact\": \"HIPAA-covered entities and BAs must update policies and procedures to ensure workforce training on the new restrictions, revise BAAs, and update NPPs. Legal holds and law enforcement request response protocols must be reviewed.\",\n      \"affected_entities\": \"Hospitals, health systems, physician practices, health plans, pharmacy chains, health app developers that qualify as covered entities or BAs\",\n      \"urgency\": \"immediate\",\n      \"date\": \"2025-2026\"\n    }\n  ],\n  \"enforcement_actions\": [\n    {\n      \"regulator\": \"Federal Trade Commission (FTC)\",\n      \"target\": \"Data broker / location data industry (multiple companies)\",\n      \"jurisdiction\": \"United States\",\n      \"violation\": \"Unfair sale of precise consumer location data without meaningful consent, including data revealing visits to sensitive locations (medical facilities, religious institutions, domestic violence shelters)\",\n      \"penalty\": \"Settlements ranging from $1M–$7M USD per company; injunctive relief including data deletion requirements and ban on sale of location data\",\n      \"lesson\": \"Location data is treated as sensitive regardless of how it is labeled. Selling it without affirmative consent — even if collected through third-party SDKs — creates Section 5 liability. Data deletion orders are becoming standard.\"\n    },\n    {\n      \"regulator\": \"California Privacy Protection Agency (CPPA)\",\n      \"target\": \"DoorDash and similar gig/platform economy companies\",\n      \"jurisdiction\": \"California\",\n      \"violation\": \"Sharing consumer personal data with third-party marketing cooperatives without proper disclosure or opt-out mechanisms under CCPA/CPRA\",\n      \"penalty\": \"Approximately $375,000 USD\",\n      \"lesson\": \"Participation in data sharing cooperatives — even indirect or legacy arrangements — constitutes a 'sale' under CCPA. Companies must audit all upstream and downstream data flows, including B2B arrangements that incidentally involve consumer data.\"\n    },",
  "meta": {
    "topic": "privacy",
    "country": "United States",
    "sources": 0
  },
  "parse_error": true,
  "generated_at": "2026-06-18T05:33:08.513Z"
}

{
  "type": "json",
  "example": {}
}