Hannah Donahue

On Feb. 11, 2026, the California Attorney General’s Office announced a $2.75 million settlement with The Walt Disney Company, making it the largest fine imposed under the California Consumer Privacy Act (CCPA) to date. ...more In the prior two alerts in this series, we explained that California (along with 16 other states) now requires businesses to conduct privacy risk assessments in certain circumstances where consumer privacy may face heightened...more As noted in last week’s post, privacy risk assessments are now required in several states. Of the 19 U.S. states with comprehensive consumer data privacy laws, all but two mandate that businesses conduct privacy risk...more As of Jan. 1st, the California Consumer Protection Act (“CCPA”) and accompanying regulations now require businesses to complete a risk assessment before engaging in certain “high-risk” personal information processing. ...more