Troutman Pepper Locke State Attorneys General Team

Key point: The investigative sweep is part of a growing multistate approach to privacy enforcement actions.

On September 9, the California Privacy Protection Agency (CPPA) announced that it has initiated a joint regulatory sweep in collaboration with attorneys general (AG) from California, Colorado, and Connecticut. The sweep will target businesses’ compliance with legal requirements associated with recognition of opt-out preference signals (OOPS) and universal opt-out mechanisms (UOOMs) that consumers can use to exercise their right to opt out of online tracking technologies (i.e., targeted advertising, sales, or sharing).

The Federal Trade Commission (FTC) and the Utah Department of Commerce’s Division of Consumer Protection (Division), represented by the Office of the Utah Attorney General (AG), recently announced a proposed consent order with Aylo, the company that owns and operates pornography websites, including Pornhub.com and Redtube.com. The proposed consent order includes the implementation of a compliance program and a $5 million penalty.

What Happened

Last week, Colorado lawmakers held a special session that culminated in a decision to delay the implementation of the Colorado Artificial Intelligence Act (CAIA) until June 30, 2026, extending the timeline beyond its original February 2026 start date. That delay gives businesses a brief window to prepare, but the law remains in effect, requiring companies to build governance programs and perform regular impact assessments of high-risk AI systems.

Register Here
Thursday, September 25 • 1:00 – 3:10 p.m. ET

Sadia Mirza, co-leader of Troutman Pepper Locke’s Incidents + Investigations practice, Privacy + Cyber Partner Timothy St. George, and Regulatory Investigations, Strategy + Enforcement Counsel Gene Fishel, will participate in an upcoming CLE with myLawCLE to examine the nuances of navigating cybersecurity breaches.

Massachusetts Attorney General (AG) Andrea Joy Campbell has issued guidelines to help businesses comply with the recently enacted consumer protection regulations, prohibiting “junk fees” and providing consumers with greater transparency regarding trial and subscription offers. We previously covered these regulations in detail here.

In addition to receiving cease-and-desist orders from several states (Arizona, Illinois, Montana, and Ohio), and ongoing litigation against New Jersey state gaming regulators in the U.S. Court of Appeals for the Third Circuit, KalshiEx LLC (Kalshi) is also now embroiled in litigation with regulators in Maryland and Nevada. Kalshi operates as a designated contract market, which allows adults in all 50 states to make financial trades on a broad range of topics — from sports to the weather.

In 2022, a bipartisan task force of 51 state attorneys general (AGs) was formed to investigate and take legal action against companies allegedly responsible for large volumes of fraudulent and illegal robocall traffic. North Carolina AG Jeff Jackson, Indiana AG Todd Rokita, and Ohio AG Dave Yost lead the “Anti-Robocall Litigation Task Force.” The task force is made up of AGs from both political parties.

On June 18, Arizona Attorney General (AG) Kris Mayes, in partnership with the Better Business Bureau (BBB), announced a new consumer educational campaign aimed at teaching Arizona residents how to avoid falling victim to a variety of scams. The education campaign targets consumers lacking awareness of such scams, especially senior citizens. The series of video public service announcements (PSAs) aims to enable Arizona consumers to spot and avoid scams on their own. According to the FBI Internet Crime Complaint Center, Arizona residents lost approximately $392 million due to consumer fraud in 2024. The AG’s office received almost 22,000 consumer complaints, answered more than 28,000 phone calls, and reviewed more than 23,000 emails from consumers regarding potential fraud during this time.