A consumer class action lawsuit has been filed in the U.S. District Court for the Southern District of New York against EVO Brands, LLC and PVG2, LLC, both doing business as Puff Bar. The lawsuit alleges that Puff Bar violated state consumer protection laws by engaging in deceptive marketing practices aimed at youth, and by misleading consumers about the legality and safety of their synthetic nicotine e-cigarettes.

In a landmark decision, the Georgia Supreme Court has expanded the Georgia Open Records Act (the Act) to include private businesses and contractors working with state and local government entities. The ruling in Milliron v. Antonakakis clarifies that public records held by nongovernment entities are subject to the same transparency requirements as government agencies. Consequently, businesses in sectors like construction, IT, health care, and consulting must navigate the Act’s complexities to avoid liability. This article explores the court’s decision and offers practical steps for compliance. For more insights, listen to our latest Regulatory Podcast episode, “Unveiling the Impact: How Georgia’s Open Records Act Affects Private Businesses.”

In September, Pennsylvania Attorney General (AG) Michelle Henry filed a lawsuit against Pittsburgh-based Digital Dream Labs, Inc., and its CEO, Harold Jacob Hanchar, individually and in his capacity as CEO. In the lawsuit, Henry brings causes of action under the Pennsylvania Unfair Trade Practices and Consumer Protection Law, 73 P.S. § 201-1, et seq., and the Federal Trade Commission (FTC) Mail Order Rule in connection with to the company’s sale of certain edtech tools and small robots — namely, the Vector 2.0, Cozmo 2.0, and Butter Robot product lines.

On September 23, Principal Deputy Assistant Attorney General Nicole M. Argentieri announced that the U.S. Department of Justice (DOJ) updated its guidance on the Evaluation of Corporate Compliance Programs (ECCP). The DOJ’s ECCP serves as a roadmap for federal prosecutors to use when evaluating the effectiveness of corporate compliance programs. Therefore, companies should also pay close attention to this guidance when reviewing their compliance programs. Ultimately, a company’s efforts to design, regularly evaluate, and update its compliance program in line with this guidance could inform criminal investigations, charging decisions, and case resolutions.

1. The Real Risk of Cybersecurity: Choosing to be Unaware

Since 2016, the federal government has implemented numerous procurement regulations and associated contract clauses to address cybersecurity by requiring contractors to adopt various controls and standards to protect sensitive, unclassified information, and to harden information technology (IT) systems to make them more resilient to all manner of cyber hacks. The easy part (not that it was at all easy) was developing the controls and standards – NIST SP 800-171 (currently up to Rev. 3), and contract clauses (most notably, FAR 52.204-21, and DFARS 252.204-7012, 7019, 7020, 7021, and others). The difficult part is getting contractors to take seriously the obligation to invest in cybersecurity.

In recent years, federal and state governments have taken action to make marijuana research easier. These actions are a step in the right direction, and researchers operating in the marijuana space must be aware of the regulatory requirements that are associated with conducting such research. In this article, we discuss some of the key considerations related to conducting marijuana research.

What Happened

On September 14, Virginia’s Attorney General (AG) Jason Miyares issued a letter to the registered agent of the Good Vibes Shop, a Radford, VA store, for selling tetrahydrocannabinol (THC) products without proper labeling and packaging. The AG’s letter alleges that the store’s THC products lacked child-resistant packaging and appropriate labeling, including ingredient lists, THC content, and age restrictions, in violation of the Virginia Consumer Protection Act (VCPA). As we have recently discussed, the AG’s letter is part of a broader effort among states to protect consumers amid the evolving federal and state cannabis regulatory landscape.

This article was originally published on October 2, 2024 in Westlaw Today. It is republished here with permission.

Gene Fishel and Whitney Shephard of Troutman Pepper highlight states with established privacy enforcement units, discuss the corresponding privacy acts in those states, and give recommendations for companies to mitigate risk and navigate a rapidly developing patchwork of regulatory standards.