Oklahoma is poised to join 19 states with comprehensive consumer privacy laws, further expanding the state-by-state compliance landscape for businesses that collect and use personal data. If enacted, the law would take effect January 1, 2027, adding another jurisdiction to an already complex regulatory map.

Many businesses assume their California privacy exposure is fully addressed through compliance with the California Consumer Privacy Act (CCPA). But that assumption can leave important gaps. We are seeing a rise in inquiries and pre-litigation letters invoking California’s “Shine the Light” law. These requests may appear routine but mishandling them can create real statutory and litigation risk.

Disney is one of the most recognizable brands in the world, but even Mickey isn’t safe from the California Consumer Privacy Act (CCPA). In a landmark enforcement action, the California Attorney General yesterday announced a $2.75 million settlement with The Walt Disney Company, the largest settlement to date under the CCPA.

If you’ve been watching the recent TCPA litigation over whether a text message counts as a “call,” two more courts just landed on the “yes” side. The decisions reinforce the safest compliance rule: treat texts like calls.

Even well-intentioned customer outreach can create significant risk under the Telephone Consumer Protection Act (TCPA), especially when prerecorded calls are involved. A recent $9.95 million TCPA class settlement highlights how quickly informational communications can turn into costly litigation.

When websites tell users they agree to terms by clicking a button, when does that click actually bind them? In Dahdah v. Rocket Mortgage, LLC, No. 24-1910, 2026 LX 73742 (6th Cir. Jan. 26, 2026), the Sixth Circuit addressed that question in a setting familiar to many businesses: a consumer entering information on a lead-generation site and clicking buttons to move forward.

Not everybody loves a good cookie, and plaintiffs’ lawyers are proving it. In California, routine website cookies, pixels, and analytics tools are increasingly being cited as evidence of illegal “interception” under the California Invasion of Privacy Act (CIPA), particularly when users were never given a meaningful choice.

On January 13, 2026, the Ninth Circuit issued Howard v. Republican National Committee, reaffirming that texts are “calls” under the TCPA despite recent uncertainty. The court also held that a text containing a prerecorded video is not necessarily a “prerecorded” call signaling a narrower view of TCPA liability.

If you’ve been following the FCC’s evolving rules on TCPA consent revocation, you may be feeling a sense of déjà vu. The FCC has again delayed the most controversial part of its consent revocation rule: the requirement that an opt-out to one type of call or text would apply to all future automated or prerecorded calls and texts from the same caller.

If you’re a real estate agent or brokerage using calls or texts to generate sales, the TCPA should be on your radar. TCPA lawsuits against real estate professionals have surged in recent years. These cases frequently name both brokerages and individual agents, are costly to defend, and often stem from routine marketing calls or texts.

On December 8, President Trump posted on Truth Social that the U.S. needs a single national AI rulebook, warning that no company can function if it must seek “50 approvals every time they want to do something.” He plans to sign an executive order that could sweep aside state-level AI laws and replace them with one federal standard.

For the first time in the Second Circuit, a federal court has squarely decided whether a text counts as a “telephone call” under the TCPA for purposes of the National Do Not Call Registry. In Wilson v. Better Mortgage Corp., 2025 U.S. Dist. LEXIS 251694 (S.D.N.Y. Dec. 5, 2025), the Southern District of New York held that it does.

With only a month left in 2025, businesses that handle consumer data should be preparing for three new state privacy laws taking effect on January 1 in Indiana, Kentucky, and Rhode Island. Each law fits within the growing patchwork of U.S. privacy regulation, but the applicability thresholds differ enough that companies may find themselves covered in one state but not another.

Is a text the same thing as a phone call? Most people would say, “Of course not.” But under the Telephone Consumer Protection Act (TCPA), that question has now split courts around the country and left businesses, consumers, and lawyers waiting for clarity.

Imagine wiping your personal information from hundreds of data brokers with one action. No endless opt-outs. No searching for hidden links. No guessing who has your data. Beginning January 1, 2026, California’s Delete Request and Opt-Out Platform (DROP) will make that possible.

In Kovanen v. Asset Realty LLC, 2025 U.S. Dist. LEXIS 220291 (W.D. Wash. Nov. 7, 2025), a federal judge rejected a $700,000 class action settlement over alleged real estate text messages because the agreement didn’t pass legal muster.

When the FCC first released its draft rulemaking on October 8, 2025, it looked as though the agency was ready to scrap one of the oldest parts of the TCPA: the internal “do-not-call” list rule. That rule requires every business that makes marketing calls to keep an internal list of people who have asked not to be called again.

In Mitchell v. Dallas, 2025 U.S. Dist. LEXIS 212107 (N.D. Tex. Oct. 28, 2025), a Texas federal court refused to certify a Telephone Consumer Protection Act (TCPA) class against Toyota of Dallas, and it all came down to consent.

Picture this: you run an online store. You add the Meta Pixel to track conversions and improve ads. It’s standard practice, until a demand letter arrives accusing you of “wiretapping” your own customers under a 1967 California privacy law.

In Schmitendorf v. Juicy’s Vapor Lounge, Inc., 2025 U.S. Dist. LEXIS 208110 (D. Kan. Oct. 21, 2025), the court reminded everyone involved in TCPA class actions that sometimes a single word—“residential”—can determine the fate of the entire case.