Insights

On October 29, 2026, the Federal Trade Commission (FTC) and attorneys general from Colorado, Florida, Illinois, Iowa, Nebraska, Oklahoma, and Utah, joined by Los Angeles County Counsel and the San Francisco City Attorney, sued Toast over allegedly deceptive advertising, hidden fees, and cancellation barriers. The bipartisan lawsuit shows that federal, state, and local regulators continue to work together on consumer protection, including claims involving business customers. Like the Seek Capital, First American Payment Systems, and newly announced Riverside Payments matters discussed below, the Toast case concerns allegedly misleading sales claims, unexpected costs, and difficulty canceling services, this time in restaurant technology.

One of the two landmark climate-disclosure laws California enacted in 2023 has its first reporting deadline in just over two weeks, amid continued uncertainty regarding its constitutionality.  

Do you want your startup to expand and become a major player in your industry? If so, you will most likely need to seek capital from outside investors to help you build infrastructure and fulfill orders.

The Sedona Conference has published its Defend Trade Secrets Act Model Jury Instructions: DTSA 10th Anniversary Commemorative Edition, the product of Working Group 12’s consensus process. Earlier this year, we alerted clients to the draft instructions. The final publication cautions that the instructions are a starting point only, not binding law, and must be tailored to the facts, claims, and governing law of each case. 

At a glance: Governor Gavin Newsom signed SB 690, amending CIPA to restrict private plaintiffs from bringing “pen register” and “trap and trace” claims arising from web-based conduct. The amendment is meant to reduce the wave of private CIPA litigation targeting website tracking technology. However, businesses remain exposed to several major types of claims and enforcement mechanisms under CIPA and related statutes and should audit their tracking technologies, consent mechanisms, and litigation posture accordingly.

On September 30, 2026, California Governor Gavin Newsom signed Senate Bill 947, the “No Robo Bosses Act,” into law, effective July 1, 2027. The law prohibits California employers from relying solely on AI or other automated decision systems (ADS) to discipline or terminate employees, and requires meaningful human review and written notice to affected workers when such tools play a primary role in those decisions. Employers using AI-driven workforce management tools should begin compliance planning now.

California Assembly Bill 1603 amends the Food and Agricultural Code by directing DPR to take several concrete steps no later than January 1, 2028 to identify and disclose PFAS pesticide ingredients in California-registered pesticides.  DPR must now flag whether each registered pesticide contains PFAS pesticide ingredients in its online pesticide use reporting database, designate PFAS as a searchable category of interest within that database, and incorporate PFAS pesticide use trends into its annual pesticide use report and related reporting documents on an ongoing basis. Separately, DPR must compile and publish on its website a complete list of all registered pesticides containing PFAS pesticide ingredients and deliver that list to every county agricultural commissioner in California. After the initial publication, DPR is required to update the list and redistribute it to all county commissioners within 60 calendar days whenever a new PFAS-containing pesticide is registered.  

On September 9, 2026, California Governor Gavin Newsom signed into law SB 813 and AB 1405, creating the nation’s first regulatory framework for AI auditors. And on September 18, Gov. Newsom signed Executive Order N-9-26 (Order) which moved up by about a year some of the implementation deadlines for SB 813 and AB 1405 and convened an expert group to recommend how the Golden State can strengthen existing AI safety laws.

New York Attorney General Letitia James has issued an industry-wide alert encouraging workers with knowledge of unsafe or illegal conduct at artificial intelligence (AI) companies to file confidential whistleblower complaints through the Office of the Attorney General’s (OAG) secure portal. This development signals a significant escalation in regulatory scrutiny of the AI sector and should be carefully considered by any company developing or deploying AI technology that has a nexus to New York.

On September 4, 2026, the IRS published a notice of proposed rulemaking (NPRM) titled “Racial Nondiscrimination in Private Schools” (REG-119986-25). The proposed rule would extend the prohibition against racial discrimination in private schools to policies and practices that are intended to serve “remedial or diversity-related objectives,” such as those commonly associated with diversity, equity, and inclusion (DEI) initiatives. Under the proposed rule, any private primary or secondary school, college, professional or trade school, or university, would lose its tax-exempt status if it adopts, maintains, or enforces any policy or practice that considers race, color, or national or ethnic origin in the administration of any admissions policy, scholarship or loan program, athletic program, or other school-administered program. Comments are due November 3, 2026, and, if finalized, the proposed rule would go into effect on May 31, 2027. 

On August 20, 2026, the College Sports Commission (CSC) released a memorandum outlining how its Department of Investigations (DOI) is approaching enforcement of name, image, and likeness (NIL); revenue sharing; and roster limit rules. The memo signals that the CSC’s enforcement apparatus is fully operational and that Division I institutions should prepare for direct investigative engagement.

In our previous client alert, we addressed how algorithms and platform features that rely on user generated speech might not receive Section 230 protections because those features may not be considered platform user content.  In these instances, the platform might not carry user generated water through the pipe, but adds its own to the mixture.  At the same time, if it is true that there is less Section 230 protection, these same elements should then imbue the content with First Amendment protections as the expressive content of the platform.

On August 19, 2026, the Federal Trade Commission (FTC) announced a proposed Enforcement Policy Statement on personalized pricing — the practice of companies using consumers’ personal data to set individualized prices, discounts, coupons, or other incentives. The proposed statement, which is open for public comment for 30 days following publication in the Federal Register, marks a major step up in the FTC’s focus on data-driven pricing strategies and puts businesses across industries on notice that undisclosed or inadequately disclosed personalized pricing will not be tolerated. Importantly, while the proposed statement is not a binding legal requirement and does not create new legal obligations, it serves as an enforcement warning that the FTC is prepared to use its existing enforcement authority under Section 5 of the FTC Act (Section 5) and is also a potential harbinger of rulemaking. Businesses that engage in — or are considering — personalized pricing should carefully assess their disclosure practices and data collection procedures against the standards articulated in this statement.

On August 13, 2026, the Centers for Medicare and Medicaid Services (CMS) published its final rule banning the use of federal funds — through Medicaid and the Children’s Health Insurance Program (CHIP) — to pay for gender-affirming care for children and youth. The final rule takes effect October 13, 2026 (“Prohibition on Federal Medicaid and Children's Health Insurance Program Funding for Sex-Rejecting Procedures Furnished to Children”). While CMS finalized several key elements of its late-2025 proposed rule (Client Alert December 24, 2025), the proposed Medicare hospital Condition of Participation rule remains in proposed form.

On July 20, 2026, New Jersey Governor Mikie Sherrill signed the Forbidding the Algorithmic Inflation of Rent (FAIR) Act into law, making New Jersey the fourth state to regulate algorithmic rent-setting practices. Three days later, on July 23, 2026, Governor Sherrill signed the Fair Price Protection Act, which targets “surveillance pricing”—the practice of using or collecting personal data about a user and using an algorithm or artificial intelligence to charge different consumers different prices for the same products. Together, these laws represent a significant expansion of New Jersey's consumer protection framework in the algorithmic pricing context.

New York is set to become the first state in the nation to restrict algorithmically-driven “addictive” social media features for users under 18. On July 29, 2026, the State published the final rules implementing the Stop Addictive Feeds Exploitation (SAFE) for Kids Act, which takes effect January 25, 2027.

Section 230 of the Communications Decency Act (“Section 230”) protects online platforms from liability for user-generated speech. Based on the premise that platforms generally do not create original content but instead curate their users’ own speech, Section 230’s protections have historically applied to a platform’s algorithmically assembled, selected or sequenced content; algorithms or features that amplified or directed user generated speech to particular users were generally protected. Indeed, the old rule of thumb was the more a platform used algorithms or automation, the more likely user generated speech remained user generated speech. GenAI has the potential to change that calculus. A platform that ingests user generated content and publishes a transformed output, can blur Section 230’s line between publication and creation. The central question is whether Section 230 protects GenAI, which analyzes, but does not alter, user-created content to produce an outcome, and its corresponding outputs.

On June 18, 2026, the California Department of Toxic Substances Control (DTSC) added microplastics to the list of Candidate Chemicals maintained under the state’s Safer Consumer Products (SCP) regulations.  The listing of microplastics, which becomes effective on October 1, 2026, is the first step in the SCP regulatory process, which could lead to restrictions on products that contain or release microplastics. 

A recent enforcement action led by Minnesota Attorney General Keith Ellison along with a bipartisan coalition of state attorneys general signals an accelerating and coordinated crackdown on competitively sensitive information-sharing arrangements.

On Wednesday, June 3, 2026, the Department of Health and Human Services (HHS) published an interim final rule with comment (IFC) instructing all state Medicaid agencies to incorporate “community engagement” as an eligibility condition for program participation by no later than January 1, 2027. The rule (Medicaid Program; Community Engagement Requirement for Certain Individuals) does not impose affirmative operational obligations for Medicaid managed care plans, as it focuses primarily on equipping the states to administer the community engagement requirement. However, it does establish a few specific guardrails to govern the role managed care organizations, prepaid inpatient health plans, and prepaid ambulatory health plans may — and may not — play in that administration.