Avoiding the Ire of State Privacy Regulators: An Incremental Approach to Website Compliance

The number of state privacy and AI laws are rapidly increasing– and regulators are no longer just watching. From million-dollar CCPA settlements to Attorney General enforcement sweeps, the cost of non-compliance is real, and it is growing.

This session cuts through the complexity of today's overlapping state privacy and AI legal landscape and delivers a practical, step-by-step compliance roadmap that organizations can actually implement. Topics covered include:

• The evolving regulatory and enforcement landscape–the rapid proliferation of state data protection and AI laws, how they overlap, and where biometric privacy laws add another layer of complexity. State AG enforcement actions, private and class action exposure are on the rise, along with the reputational harm that follows a public compliance failure. Recent examples including the $1.55 million CCPA settlement with Healthline Media (the largest to date) and Connecticut's $85,000 settlement with TicketNetwork following a failed cure period.
• Drafting and updating privacy compliance posture–notices, internal policies and auditing backend data practices–what state laws now require, how to accurately reflect your data practices, and how AI obligations are reshaping disclosure requirements. Best practices for developing comprehensive written policies that align with your privacy notice and satisfy applicable law, mapping data collection, use, disclosure, and retention, with a close look at the complexities of adtech, targeted advertising, and online analytics.
• Vendor management–due diligence for new vendors, ongoing monitoring of existing ones, and ensuring your contracts actually hold third parties accountable.
• Incident response planning and employee training–building a breach response plan that accounts for hacking, ransomware, employee error, and data loss scenarios. Designing an effective annual training program, including the role of tabletop exercises in preparing teams for real incidents. 

Whether your clients are just getting started or looking to stress-test an existing program, this session offers actionable guidance for navigating enforcement risk and staying ahead of regulators.

For questions about this event, please contact Cherilyn McGlynn-D'Amron.