Edition

This is a permanent edition. It carries the briefing exactly as published on this date and does not change.

State and Federal Developments in Minors' Privacy in 2026 Highlight Emerging Regulatory Approaches

The year 2026 has seen significant activity in children and teens' privacy legislation at both state and federal levels, with two distinct approaches to app marketplace regulation emerging. Some states, like Alabama, Utah, and Louisiana, are focusing on app store providers, while others, such as California and Colorado, adopt broader frameworks encompassing operating system providers.

Today's question

A health technology company uses third party analytics pixels on its website to track user interactions, including visits to pages discussing specific medical conditions. Under US federal law, what is the primary risk associated with this practice?

  1. Breach of COPPA if minors visit the site's pages on medical conditions
  2. Breach of HIPAA if the tracked data is Protected Health Information
  3. Breach of the CCPA if California users are not offered an opt out
  4. Breach of the CAN SPAM Act if the pixels sit inside marketing emails

Answer this question on the site

Worth knowing

  1. ICO Upholds Kent Police's Refusal of Vexatious FOIA Requests

    The Information Commissioner's Office (ICO) has upheld Kent Police's decision to refuse requests for information about speed enforcement cameras, citing section 14(1) (Vexatious requests) of FOIA. The Commissioner's decision confirms that Kent Police was entitled to rely on this section to refuse the requests, and the Information Tribunal dismissed subsequent appeals.

  2. Tendring District Council Breached EIR 5(2) by Failing to Respond to Requests Within 20 Working Days

    The ICO found that Tendring District Council breached regulation 5(2) of the Environmental Information Regulations (EIR) by failing to respond to multiple requests within 20 working days, although the Council was entitled to refuse the request under regulation 12(4)(b). The Commissioner did not require further steps from the Council.

Compiled that morning from regulator, court and authority sources. Primary sources are linked on every story.