Key Point: A multistate coalition of 42 state AGs reached a landmark $150 million settlement with 23andMe over a 2023 data breach affecting 6.9 million customers, marking the largest AG multistate settlement involving consumer genetic data to date. This resolution signals heightened regulatory scrutiny of genetic data security practices and establishes a precedent for state enforcement authority in bankruptcy proceedings.

Key points: Troutman Pepper Locke’s Regulatory Investigations, Strategy + Enforcement (RISE) and Privacy + Cyber + AI practice groups worked with the firm’s innovation team using AI to collect and curate five years of data concerning state AG activities and actions related to privacy, security, and AI. This Regulatory Intelligence offering provides firm clients

On July 7, a bipartisan coalition of 49 state attorneys general (AGs) sent a letter to the Federal Communications Commission (FCC) urging the adoption of stronger measures to combat illegal robocalls. The letter represents another action by the state AG’s Anti-Robocall Multistate Litigation Task Force, which was established in 2022 to crack down on illegal robocalls.

  • DoD suspended CMMC Phase II on July 13, 2026, halting the November 10, 2026, deadline and all related implementation milestones pending a comprehensive reform review by a newly established CMMC Reform Task Force. 
  • CMMC Level 2 (C3PAO) and Level 3 (DIBCAC) third-party assessment requirements are suspended, and active solicitations and contracts must be

In this episode of Regulatory Oversight, host Stephen Piepgrass sits down with colleagues Dave Navetta and Dan Waltz to explore how state AG enforcement is accelerating across privacy, cybersecurity, and artificial intelligence, and to introduce Troutman Pepper Locke’s AI-fueled Regulatory Intelligence Platform.

Published in Law360 on July 10, 2026. © Copyright 2026, Portfolio Media, Inc., publisher of Law360. Reprinted here with permission.

For the recipient of a subpoena from a state attorney general or other state regulator, the prospect of successfully blocking the subpoena through litigation can seem dim.

On June 30, 2026, New Jersey enacted legislation A5328 (P.L.2026, c.25), which will expose a broad swath of U.S. companies to data broker registration fees ranging from $5,000 to $1.5 million annually. The new legislation is not limited to data brokers in the conventional sense. It applies generally to any company that sells or licenses personal data of New Jersey residents, including those with direct customer relationships. Much of the law takes effect immediately, so companies should begin reviewing the requirements now to comply.

On June 26, 2026, Florida Attorney General (AG) James Uthmeier and Roku, Inc. announced a negotiated resolution of Florida’s enforcement action filed under the Florida Digital Bill of Rights (FDBR). Under the agreement, Roku will enhance its child protection features by giving parents greater control over their children’s streaming experience. The resolution includes no finding of wrongdoing and no civil fine.