Insights

In our previous client alert, we addressed how algorithms and platform features that rely on user generated speech might not receive Section 230 protections because those features may not be considered platform user content.  In these instances, the platform might not carry user generated water through the pipe, but adds its own to the mixture.  At the same time, if it is true that there is less Section 230 protection, these same elements should then imbue the content with First Amendment protections as the expressive content of the platform.

After identifying a ransomware attack in 2021, OSF Healthcare System waited until its forensic investigation had concluded before notifying the U.S. Department of Health and Human Services (HHS) — and the affected individuals — of the breach. The 110-day delay (nearly double the 60-calendar-day notification deadline mandated by the HIPAA Breach Notification Rule) triggered an investigation from HHS’s Office for Civil Rights (OCR). The health system’s investigation determined that protected health information (PHI) had been stolen.

Over the past 18 months, the federal banking agencies have clarified supervisory expectations for banks’ crypto-asset activities, and several of the largest U.S. banks have announced programs accepting Bitcoin and Ether as loan collateral. Separately, on June 3, 2026, New York’s enactment of the 2022 amendments to the Uniform Commercial Code took effect, changing the rules governing the perfection of a security interest in digital asset collateral in New York, the jurisdiction whose law governs most institutional credit documentation. Together, these developments may create significant opportunities for lenders navigating the complexities to comply with the newly enacted statutes. This alert surveys the current landscape, from regulatory permissibility and perfection through custody, structuring, and compliance, for institutions active in this market or considering entering it.

This news bulletin is provided by the International Trade Group of Crowell & Moring. If you have questions or need assistance on trade law matters, please contact Anand Sithian or Simeon Yerokun or any member of the International Trade Group.

On July 22, 2026, Missouri Attorney General Catherine L. Hanaway filed a federal lawsuit against the city of Kansas City, Missouri, challenging the city’s longstanding Minority and Women Business Enterprise (MWBE) program as unconstitutional. The AG filed the complaint in the U.S. District Court for the Western District of Missouri alongside private plaintiffs Charles Cacioppo Jr. and his company, Industrial Salvage and Wrecking Co.

On July 20, 2026, New Jersey Governor Mikie Sherrill signed the Forbidding the Algorithmic Inflation of Rent (FAIR) Act into law, making New Jersey the fourth state to regulate algorithmic rent-setting practices. Three days later, on July 23, 2026, Governor Sherrill signed the Fair Price Protection Act, which targets “surveillance pricing”—the practice of using or collecting personal data about a user and using an algorithm or artificial intelligence to charge different consumers different prices for the same products. Together, these laws represent a significant expansion of New Jersey's consumer protection framework in the algorithmic pricing context.

Section 230 of the Communications Decency Act (“Section 230”) protects online platforms from liability for user-generated speech. Based on the premise that platforms generally do not create original content but instead curate their users’ own speech, Section 230’s protections have historically applied to a platform’s algorithmically assembled, selected or sequenced content; algorithms or features that amplified or directed user generated speech to particular users were generally protected. Indeed, the old rule of thumb was the more a platform used algorithms or automation, the more likely user generated speech remained user generated speech. GenAI has the potential to change that calculus. A platform that ingests user generated content and publishes a transformed output, can blur Section 230’s line between publication and creation. The central question is whether Section 230 protects GenAI, which analyzes, but does not alter, user-created content to produce an outcome, and its corresponding outputs.

On July 13, 2026, the U.S. Court of Appeals for the 2nd Circuit affirmed a preliminary injunction against Nielsen, handing Cumulus Media a significant win in a constructive tying case with implications beyond the radio ratings industry. Cumulus Media New Holdings Inc. v. The Nielsen Co. (US), LLC, No. 26-88 (2d Cir. Jul. 13, 2026).

A recently filed class action lawsuit against Gymshark, a prominent athletic apparel company, highlights the escalating legal risks associated with influencer marketing. The complaint, brought in the U.S. District Court for the Southern District of New York on June 16, 2026, alleges that Gymshark systematically paid social media influencers to promote its products without ensuring that the influencers were providing clear and conspicuous disclosures about such payment, in violation of Federal Trade Commission (FTC) guidance and New York state law.

This news bulletin is provided by the International Trade Group of Crowell & Moring. If you have questions or need assistance on trade law matters, please contact Anand Sithian or Simeon Yerokun or any member of the International Trade Group.

The United States had barely finished blowing out 250 candles on its birthday cake when the Federal Trade Commission (FTC) decided to remind corporate America what “Made in USA” is actually supposed to mean. On July 6, 2026, the FTC sent a pointed message to the marketplace: unsubstantiated “Made in USA” claims will not go unnoticed. The FTC sent warning letters to several companies advertising products as “Made in USA” — and, in at least one case, “Made in Texas” — despite information suggesting that the products were imported in whole or in significant part.

As federal and state regulators alike continue to tout holding health care organizations accountable for alleged fraud, waste, and abuse as a top priority, ensuring compliance and minimizing enforcement risk has never been more imperative — or more challenging. Health care organizations operate at the intersection of rapid technological changes and within an increasingly complex regulatory landscape, where the rules governing scrutinized areas such as privacy, AI, billing integrity, and strategic transactions are being written, rewritten, and enforced in real time. Treating compliance as a periodic documentation exercise is simply not an option. Today, an effective risk mitigation strategy must be grounded in two complementary elements: a thorough understanding of evolving regulatory obligations and a candid internal assessment of potential points of exposure.

On June 22, 2026, House Energy and Commerce Committee Chairman Brett Guthrie (R-Ky.) and Ranking Member Frank Pallone (D-N.J.) announced a bipartisan agreement on a revised version of the KIDS Act (H.R. 7757), marking the most significant congressional advance on children's online safety legislation in years. The House passed H.R. 7757, as amended, on June 29, 2026, setting up a potential showdown with the Senate. The revised KIDS Act consolidates elements of 14 pending legislative proposals — including KOSA and COPPA 2.0, both of which have previously passed the Senate and cleared the House Energy and Commerce Committee — into a single, comprehensive framework. The announcement, however, was met immediately with objections from Senate sponsors and civil liberties groups, underscoring the difficult legislative road ahead.

RICO was built for the mob. But Congress gave trade secret victims access to it in 2016, and a recent U.S. Court of Appeals for the Fifth Circuit decision shows that access is real.

In June 2026, federal regulators and lawmakers continued their efforts to improve drug affordability through targeted reforms. These recent developments will primarily impact pharmaceutical manufacturers, managed care organizations, and pharmacy benefit managers (PBM) serving Medicare Part D program members. PBMs, Medicare Advantage organizations, and Part D sponsors should monitor these changes in the interest of maintaining compliance and providing input on regulatory proposals that may influence their business operations or compensation structures in the future.

On June 17, 2026, the U.S. Department of Justice’s (DOJ( National Security Division (NSD) announced that it had issued a declination for Robert Bosch GmbH (Bosch) relating to potential violations of the Export Control Reform Act, 50 U.S.C. § 4819 (ECRA). Specifically, the DOJ declined to criminally prosecute Bosch’s violations of the Export Administration Regulations’ (EAR) Foreign Direct Product Rule (FDPR), which apparently resulted from two Bosch subsidiaries’ export of products and software manufactured with equipment that was the direct product of U.S. software or technology to Huawei Technologies Co., Ltd. and its “Entity List” affiliates, including Huawei Tech. Investment Co., Ltd., Hong Kong (collectively, Huawei). The same day, the U.S. Department of Commerce Bureau of Industry and Security (BIS) announced a parallel civil administrative settlement with Bosch.

On December 11, 2025, New York Governor Kathy Hochul signed S.8420-A/A.8887-B into law. This first-in-the-nation legislation, called the New York AI Synthetic Performers Disclosure Law, is intended to protect consumers and promote transparency in the age of AI advertising. This law represents a meaningful shift in the legal landscape for AI advertising. For the first time in any U.S. jurisdiction, the mere use of an AI-generated human likeness in a commercial advertisement triggers an affirmative disclosure obligation. The practical implications are significant, particularly for e-commerce retailers, digital advertisers, and agencies that have integrated AI-generated human imagery into high-volume creative workflows.

On June 4, 2026, the U.S. Supreme Court unanimously held that the U.S. Securities and Exchange Commission (SEC) can continue to pursue disgorgement as an equitable remedy in securities fraud cases without showing pecuniary loss by investors. The Court’s ruling in Sripetch v. SEC resolves a split between the U.S. Court of Appeals for the Second Circuit, which concluded that the SEC must demonstrate pecuniary loss, and the U.S. Courts of Appeals for the First and Ninth Circuits, which declined to require such a showing.

Crowell & Moring’s International Trade Group Secures Top Rankings in Chambers USA 2026

The International Chamber of Commerce (ICC) has released its revised 2026 Arbitration Rules (the 2026 Rules), which entered into force on 1 June 2026. The revisions represent a significant update to the 2021 ICC Rules (the 2021 Rules) and reflect a clear institutional focus on efficiency, procedural flexibility, and expedited dispute resolution.