Edition

This is a permanent edition. It carries the briefing exactly as published on this date and does not change.

State and Federal Developments in Minors' Privacy in 2026 Highlight Emerging Regulatory Approaches

The year 2026 has seen significant activity in children and teens' privacy legislation at both state and federal levels, with two distinct approaches to app marketplace regulation emerging. Some states, like Alabama, Utah, and Louisiana, are focusing on app store providers, while others, such as California and Colorado, adopt broader frameworks encompassing operating system providers.

Today's question

A health technology company uses third party analytics pixels on its website to track user interactions, including visits to pages discussing specific medical conditions. Under US federal law, what is the primary risk associated with this practice?

  1. Violation of the Children's Online Privacy Protection Act (COPPA) if minors access the site.
  2. Non compliance with the Health Insurance Portability and Accountability Act (HIPAA) if the data is considered Protected Health Information (PHI).
  3. Breach of the California Consumer Privacy Act (CCPA) if users are California residents and not provided an opt out.
  4. Failure to adhere to the CAN SPAM Act regarding unsolicited commercial email.

Answer this question on the site

Worth knowing

  1. ICO Upholds Kent Police's Refusal of Vexatious FOIA Requests

    The Information Commissioner's Office (ICO) has upheld Kent Police's decision to refuse requests for information about speed enforcement cameras, citing section 14(1) (Vexatious requests) of FOIA. The Commissioner's decision confirms that Kent Police was entitled to rely on this section to refuse the requests, and the Information Tribunal dismissed subsequent appeals.

  2. Tendring District Council Breached EIR 5(2) by Failing to Respond to Requests Within 20 Working Days

    The ICO found that Tendring District Council breached regulation 5(2) of the Environmental Information Regulations (EIR) by failing to respond to multiple requests within 20 working days, although the Council was entitled to refuse the request under regulation 12(4)(b). The Commissioner did not require further steps from the Council.

Compiled that morning from regulator, court and authority sources. Primary sources are linked on every story.