Advertising Law Blog

As of the end of 2025, 19 states have passed consumer privacy legislation, and 4 more states have active privacy law bills in various stages. In addition, state attorneys general are actively enforcing these laws, having brought and settled over 1200 consumer privacy cases over the last few years, and while the state privacy laws do not allow a private right of action (for the most part), consumers as well as class action attorneys are finding new and novel ways to bring lawsuits against businesses for various privacy violations. Businesses simply cannot ignore their data collection and usage practices. Recent California cases involving Sling TV, Todd Snyder, and Honda included fines against these companies for offering confusing opt-out mechanisms that prevented consumers from easily opting out cookies as well as from the sharing and selling of personal information through means other than cookies. These cases demonstrate that it is not enough to simply have a privacy policy – regulators will check to see if the opt-out mechanisms actually work, whether the companies have appropriate written agreements with their vendors, and whether they are regularly auditing their systems for compliance.