CYBERSECURITY

Fortune 500 Companies Targeted by Operation DoppelBrand

A recent white paper issued by SocRadar, entitled “Operation DoppelBrand: Weaponizing Fortune 500 Brands for Credential Theft and Remote Access,” provides a stark outline of how a threat actor known as GS7 has been “targeting banking institutions, technology companies, payment platforms, and other entities” with creating fake “highly similar” web portals to harvest customer credentials of. The campaign has been dubbed “Operation DoppelBrand.” The threat actor uses rotating infrastructure such as NameCheap and OwnRegistrar to obtain the fake, but realistic web portals. Read more

ENFORCEMENT + LITIGATION

Appellate Whiplash in Website Tracking Litigation: VPPA Speeds Ahead While CIPA Still Waits

Website tracking litigation continues to generate high stakes compliance risk, but not all privacy statutes are moving through the courts at the same pace. A notable divergence is emerging between the Video Privacy Protection Act (VPPA) and the California Invasion of Privacy Act (CIPA). Where the first is rapidly heading toward definitive interpretation by the United States Supreme Court, the other remains stalled in uncertainty, with litigants still waiting for meaningful appellate guidance. Read more

DATA PRIVACY

CCPA Enforcement Goes Cross Device: What Disney’s Settlement Signals for Compliance 

The Office of California Attorney General Rob Bonta announced the largest settlement for violations of the California Consumer Privacy Act (CCPA) to date, imposing a $2.75 million civil penalty and injunctive relief focused on how Disney implements consumer opt-outs across its streaming ecosystem. Disney must pay the penalty within 30 days of the judgment’s effective date. Beyond the headlining number, the settlement highlights an enforcement theme that has become increasingly explicit. Opt-out rights must be effective in practice across the interfaces where consumers actually interact, not merely available as a formal policy or isolated control. Read more

ARTIFICAL INTELLIGENCE

Scoring Applicants? Your AI Could Be in FCRA Territory

The Fair Credit Reporting Act (FCRA) is decades old, but a recent artificial intelligence (AI)-related complaint suggests that plaintiffs are testing whether legacy consumer-reporting rules can apply to AI-driven hiring assessments.

In January, a class action complaint was filed in California, Kistler v. Eightfold AI Inc., No. C26-00214 (Cal. Super. Ct. Jan. 20, 2026). Eightfold is an AI recruiting tool that provides employers with tools for a more streamlined hiring process. The class action complaint raises a familiar consumer protection issue in a contemporary HR context: when an AI tool scores job applicants in the background, what legal regime governs that activity? Read more

Extraterritorial Scope of the EU AI Act

Given its extraterritorial reach, companies outside Europe should start preparing for the EU AI Act now. In general, the Act will apply to companies that develop high-risk AI systems used in the EU and that provide outputs from those systems, even if the companies have no physical presence in Europe.

Ahead of August 2026, companies, especially those who have no direct dealings within the EU, should begin auditing their systems and practices to determine whether they fall under the Act to avoid surprises of later enforcement actions. Read more

Privacy Tip #480

Android Devices Running Android 12 or Less Face Security Risk

If you are among the one billion individuals who own an Android device running on Android 12, or a previous iteration of the operating system, now is the time to consider upgrading your device. According to Forbes, this represents approximately 40% of all Android devices in the market.

Google has issued a warning that any Android device running the Android 12 operating system or older are no longer supported with patches or updates for vulnerabilities.

Learn about the importance of keeping your device software up to date in this week's privacy tip. Read more

RECENT EVENTS AND NEWS

Linn Freedman Receives Global Ranking in Chambers Global Guide 2026

Data Privacy, Cybersecurity and AI practice chair Linn F. Freedman has once again been ranked in the Chambers Global 2026 Guide, in the area of Privacy & Data Security: Cybersecurity. This recognition signifies her exceptional leadership and legal acumen in the field of Privacy & Data Security: Cybersecurity. Produced by Chambers and Partners, the Chambers Global Guide ranks the top global lawyers and law firms in over 200 jurisdictions across the world. The rankings are based on assessments that include technical legal ability; professional conduct; client service; commercial astuteness; diligence; and commitment.

Client testimonies captured by Chambers and Partners say Linn, “executes at extremely high levels and is well informed on emerging risks and industry trends and is able to assist in advisory roles.” Linn has been ranked as a leader in Chambers USA: America's Leading Lawyers for Business in the area of Privacy & Data Security nationwide since 2012 and global-wide since 2019.

Kathryn Rattigan + Roma Patel Present ARMA Education Webinar on IG Legal Mastery

Data Privacy + Cybersecurity team lawyers Kathryn Rattigan and Roma Patel presented a session titled “Mastery of IG: Legal and Regulatory” as part of ARMA’s Education webinar series on February 19, 2026. Kathryn and Roma’s session provided a practical, high-level tour of the legal and regulatory foundations that shape effective information governance, including core compliance drivers and privacy obligations and defensibility and risk mitigation. In addition, they also covered how to monitor and respond to emerging regulations, collaborate effectively with Legal/Privacy/Compliance teams, and support legal readiness through legal holds and eDiscovery basics.