California has enacted Senate Bill 690 (SB 690) to block the torrent of demand letters and lawsuits alleging that websites have violated a California Invasion of Privacy Act (CIPA) provision covering pen register devices.

SB 690, which applies retroactively to cases filed in 2025 or after, would affect 27 percent of CIPA cases, according to the CIPA Reform coalition. The amendment “has the unintended effect of removing the claim that was easiest to plead but most difficult for plaintiffs to justify as a concrete injury,” Baker Donelson of counsel David Oberly told the Cybersecurity and AI Law Report.

While it eliminates one category of CIPA claims, SB 690 preserves the law’s wiretapping and eavesdropping causes of action, but 2026 court decisions are raising the pleading burden on those remaining theories. Over a dozen judicial decisions between July and September 2026 have set some clearer dividing lines for what counts as a concrete privacy injury that allows cases to advance.

This article, with insights from Oberly and litigation parters at Duane Morris and Manatt, examines how SB 690 may alter the CIPA litigation landscape; reviews 2026 court decisions that are drawing clearer lines on standing, consent and class certification; and provides practical guidance for mitigating litigation and regulatory risk.

See our two-part series “CIPA Jury Verdict Against Meta”: Privacy Litigation Strategies and Lessons (Sep. 3, 2025), and Compliance Takeaways and the Wiretap Litigation Landscape (Sep. 24, 2025).

SB 690’s Dual Impact

The amendment to CIPA removes only one cause of action, which will refocus court arguments and settlement negotiations.

Plaintiffs’ Focus Shifts to Wiretapping and Eavesdropping Claims

SB 690 prohibits private lawsuits that allege a Section 638.51 violation – the statute’s pen register and trap-and-trace provision – arising from conduct occurring on an “internet website, online application, or mobile application.” From April 2025 to July 2026, the number of filed cases with these claims jumped from 600 to 4,000, according to the sponsoring assemblymember.

The pen register cases have flourished because plaintiffs can start a lawsuit quickly and without much investigation. A person can allegedly acquire a claim “within milliseconds because it is collecting browser and device information” before the user consents, Duane Morris partner Colin Knisely told the Cybersecurity and AI Law Report. The plaintiffs’ claim is based on the theory that collecting metadata through web cookies, pixels, software development kits and other trackers is the same as tracing telephone digits dialed, the original focus of this 1967 law section.

The courts are jammed with CIPA cases because plaintiffs’ attorneys have decided they can target any website that in good faith uses widely available and standard tools, like analytics or cybersecurity software, despite adhering to the CCPA, Knisely explained. Plaintiffs also see opportunity in courts’ differing interpretations of how Section 638.51 applies to websites.

“SB 690 gives plaintiffs’ attorneys one less avenue for exerting leverage, which is good for defendants” and may reduce the burden of combatting the nuisance demands, Manatt partner Brandon Reilly told the Cybersecurity and AI Law Report. CIPA’s wiretapping and eavesdropping laws require plaintiffs to make more substantial arguments to prove the defendant accessed the “contents of a communication,” he noted.

As legislators introduced the reform in 2025, “a lot of firms have already been broadening their claims,” Knisely reported. “I don’t expect the demand letters to slow down,” or many plaintiffs’ firms “to walk away from the money train,” he said.

Companies’ Risk Expands to California Regulators

While it reduces exposure to private litigation, SB 690 increases regulatory risk for companies. The amendment shifts enforcement of Section 638.51 to the California AG, with penalties of $5,000 per occurrence remaining without the need to show actual damages.

“Both the AG and CalPrivacy have spent much of the last two years policing exactly the conduct at issue in digital privacy and web tracking disputes – including cookie banners that don’t disable tracking cookies despite purporting to do so, consumer opt-outs, and missteps regarding adherence to data minimization and purpose limitation obligations,” Oberly noted.

Legislators also gave the California AG an enforcement boost, granting it a budget of up to $1.5 million and providing for the addition of six DOJ positions for SB 690 enforcement. Private litigants will continue pursuing CIPA cases under other theories, but “regulators’ leverage on the same facts has increased by a significant margin,” Oberly cautioned.

See “State Privacy Regulators Describe Collaboration and Priorities” (Apr. 8, 2026).

Emerging Dividing Lines in CIPA Disputes

Court decisions are drawing clearer lines around three recurring issues in CIPA litigation: standing, consent and class certification. The decisions discussed below illustrate how judges are approaching each question.

Standing

As evidenced by 2026 decisions, courts are converging on two primary standing questions in web tracking class actions: whether the disclosed information was sufficiently sensitive, and whether plaintiffs plausibly alleged they were personally tracked.

Generalized Tracking Allegations Fall Short

Under constitutional principles of standing, plaintiffs must allege a concrete privacy injury to bring a federal action. Article III standing decisions have been encouraging for defendants, with federal judges increasingly finding no actual injury from digital tracking, Reilly observed.

In California federal courts, standing disputes are largely governed by Popa v. Microsoft Corp., in which the U.S. Court of Appeals for the Ninth Circuit held that generalized allegations of injury from web tracking are constitutionally insufficient to confer standing. Where trackers gather routine website interaction data like mouse movements, clicks or URLs visited, the collection is more akin to “a store clerk’s observing shoppers in order to identify aisles that are particularly popular or to spot problems that disrupt potential sales” than to an actionable intrusion, the Popa court reasoned.

See “Will Supreme Court’s New Standing Test Tame the Real World of Class Actions?” (Jul. 28, 2021).

Data Sensitivity Required to Establish Privacy Injury

In April 2026, the U.S. District Court for the Central District of California dismissed a lawsuit against Blackhawk Networks for failure to allege a sufficient injury. The lead plaintiff alleged that two dozen advertising trackers fired on her site visit despite her having selected “required only” cookies. The court cited Popa in dismissing the case, holding that the plaintiff did not, as required, “allege facts that indicate: (1) Defendant used tracking technologies that collected especially sensitive or wide-reaching information; and (2) those tracking technologies were actually installed on Plaintiff’s computer.”

In subsequent 2026 rulings, courts have continued to focus on the sensitivity of data shared with third parties without consent. “District court decisions [in summer 2026] in Zeta Global, Magliocca, Rack Room Shoes and Felsen provide a clear dividing line: the sharing of single-site retail browsing, IP addresses, device data and email addresses” does not give rise to an actionable injury, Oberly observed. In contrast, an injury can arise from sharing “full financial card numbers, authenticated financial activity, and cross-site ‘cradle-to-grave’ profiles,” he explained.

In Zeta Global, a Southern District of New York court dismissed the suit because the complaint alleged disclosure of the plaintiffs’ PII without specifying the categories of data that were shared beyond email address, browser information and “campaign identifiers.” The court held that this information does not constitute the sensitive information needed to plead a cognizable privacy injury.

Many wiretapping cases around the country target healthcare entities. The U.S. District Court for the Eastern District of California’s August 2026 decision in Magliocca v. United Healthcare provided strong support for defendants in these cases, Oberly opined. In Magliocca, the plaintiff alleged that she was tracked when she browsed Medicare plans on its website. The court held that such information does not “reflexively” become private because the operator is a health insurer, unlike information about health conditions. Nor does an age-related inference create the “cradle-to-grave profile” of sensitive information that the Ninth Circuit requires for a concrete injury. The Magliocca finding shows how the Popa standing framework “can shut down even healthcare-related class actions at the threshold,” he said.

In contrast, a Pennsylvania federal court in Felsen found standing in September 2026, holding that Vanguard’s sharing of the plaintiffs’ investment-related website activity involved sufficiently sensitive information to constitute a privacy injury.

See “Litigation Landscape for Cookie and Tracking Technology Claims Brought Under Federal Privacy Statutes” (Jan. 21, 2026).

Plaintiffs Must Demonstrate They Were Actually Tracked

Multiple courts have held that plaintiffs must show that tracking technologies were installed on their own devices. In July 2026, a Northern District of California court rejected standing in Barrales v Reckitt Benckiser because the complaint lacked details about the named plaintiffs’ own website experiences. “Most of the allegations are framed in terms of the collective class experience or the experience of a composite consumer,” the court noted.

The Zeta Global court similarly noted “that speculation about what a defendant ‘likely’ collected cannot support standing,” Knisely said.

Other courts have permitted plaintiffs to provide only broader details showing they were likely tracked. In September 2026, in D’Antonio v. Smith & Wesson Inc., a different Northern District California court rejected defendants’ argument that the allegations had to specify individual cookies and transmissions going to named third parties. “Smith & Wesson reads a level of specificity into the pleading requirements that is unrealistic,” the court stated, rejecting the company’s motion to dismiss.

See our four-part series on tracking technologies: “Privacy Regulation, Enforcement and Risk” (Jan. 17, 2024), “A Deep Dive on What They Are and How They Work” (Jan. 31, 2024), “A 360‑Degree Governance Plan” (Feb. 21, 2024), and “Compliance Challenges and Solutions” (Apr. 17, 2024).

Detailed Allegations Can Survive Dismissal

Complaints are becoming more detailed. “Plaintiffs almost all include screenshots now. They also may attach a HAR (HTTP Archive) report,” which records browser interactions in detail, Knisely observed. With plaintiffs providing more technical support for their allegations, defendants’ IT departments or web developers should check the accuracy of complaints. “Sometimes we’ll bring in experts from the outside to give a better idea of what plaintiffs might be seeing in their scanning,” he shared.

That increased specificity is already influencing courts’ standing analyses. The Northern District of California court in Briskin v. Shopify held for the plaintiffs because they offered enough concrete details about the website’s data processing, Knisely noted. “Expect well-pleaded complaints with specific, nonconclusory factual allegations to survive dismissal,” he cautioned. Although the court in Briskin held that issues requiring an evidentiary record should be addressed on summary judgment, defendants should still challenge whether plaintiffs have pleaded specific facts supporting each theory of harm, he advised.

Detailed allegations alone, however, will not necessarily survive a motion to dismiss. The data shared still must be sensitive, Oberly stressed. The plaintiff in Magliocca, for example, alleged that United Health deployed “155 third-party trackers, including 47 cookies, 19 different canvas fingerprints and one session recorder” from a host of vendors, and tracked at least 12 categories of information, including ZIP code location, persistent identifiers and the plaintiff’s journey through the website. Defendants argued that none of the data tracked was sufficiently sensitive. The court agreed and dismissed the lawsuit.

See “Google’s Wiretap Cases Highlight Evolving Privacy Transparency Standards” (Jan. 24, 2024).

Consent

The adequacy of consent remains a central issue in wiretap litigation. Two 2026 Northern District of California cases illustrate the dividing line for consent, Oberly highlighted. If a user validly consents to the collection or sharing of data, it “is a complete defense to most causes of action asserted in digital privacy and web tracking class disputes,” he pointed out. “Consent must be three things – prior, affirmative and technically enforced,” he added. In re Adobe, a September 2026 ruling, provides the stronger precedent for defendants, holding that a plaintiff must plead facts that show lack of consent. “According to the court, ‘the internet is not a place where users have a reasonable expectation of privacy,’” he noted.

Two weeks earlier, in finding for the plaintiffs, the court in Asercion v. Ulta held that the existence of a privacy policy cannot serve as consent when trackers fire the instant that a page loads and before any user could see the policy. The court in Felsen similarly held that a privacy policy buried in a footer link does not constitute consent. When a site’s banner does not block the firing of trackers until after the user has completed the consent process, plaintiffs may cite that as evidence that consent was not obtained, Oberly noted.

See “Cookie Compliance Strategies for 2026” (Apr. 15, 2026).

Class Certification

Class certification has emerged as another key battleground in CIPA litigation, with courts closely scrutinizing whether individualized issues predominate over common questions.

In July 2026, the U.S. District Court for the Central District of California delivered a defense victory on class certification in Lewis v. Magnite, Knisely highlighted. The court in Lewis denied certification because determining whether a tracking ID was set required an individualized, technical inquiry. The answer varied based on each user’s browser, device, privacy settings and page configuration, making it difficult to resolve key issues through common evidence applicable to the entire class, the court concluded.

The Lewis ruling underscores that defendants may still have a class certification argument even if a case survives dismissal. To support that argument, companies should consider presenting expert evidence early in the pleading phase that class membership cannot be determined through common proof, Knisely advised.

Compliance Steps

The following measures incorporate lessons from SB 690, 2026 case law and web-tracking litigation in other states – like Florida, Pennsylvania, Michigan and Massachusetts – to help companies reduce litigation and regulatory risk and strengthen potential defense.

See our two-part series on CCPA private actions after the CPRA: “Key Issues and Defense Strategies” (Oct. 18, 2023), and “Settlement Considerations and Mitigating Risk” (Oct. 25, 2023).

Inventory Tracking Technologies

It is important for companies to determine what each tracker collects, who receives the data and when it fires relative to consent. Companies can use this inventory to write detailed and accurate disclosures and confirm no mismatch occurs between disclosures and actual practices, Oberly said.

Gate the Firing of Trackers

Companies should engineer their consent management platforms (CMPs) to block non-essential pixels, cookies and tags until the visitor sees the disclosures and clicks to consent. Engineers and compliance teams can verify the suppression work through HTTP records, Knisely suggested.

Additionally, “consent events should be logged with timestamps and language version,” Oberly advised.

See “Practical Strategies for Effective Consent Management” (Sep. 25, 2024).

Audit and Revise Notices and Disclosures

Companies should “align words and wires – privacy policies, cookie notices, banner text and CCPA Do Not Sell/Share Links must describe what actually happens,” Oberly warned. Misalignment could lead to claims under consumer fraud laws, he added. When drafting policies, it is good practice to assume regulators will be quoting the language in an action. Companies’ disclosures about third parties need to name specific third parties where possible, and list data categories and purposes for which the third party uses the data, he advised.

The updated disclosures must require a click or other affirmative interaction with a banner or box that details the third-party sharing, Oberly recommended. Companies should not rely solely on footer links to provide notice. With state regulators, the FTC and plaintiffs’ attorneys increasingly scrutinizing tracking practices, and new California opt-out requirements taking effect in 2027, companies’ records should include versions of notices and banners, logs of changes and enough detail to offer proof of compliance, he said.

Separate the Sensitive Data

Companies should consider “quarantining sensitive surfaces. No third-party marketing tags” should attach to that data, Oberly urged. Contractual limits on vendors’ use of sensitive data should complement those technical controls, he added.

Alternatively, for areas that collect sensitive data, such as authenticated sessions involving financial data, companies should strictly enforce a policy of using only first-party tags. They also should consider converting to “server-side tagging,” which routes the user interaction through a company server to help ensure that only necessary and compliant data is shared with third-party services.

See “Roadmap for Building an Efficient Global Privacy Program: Organizational Structure” (May 4, 2022).

Minimize Data

“A good rule of thumb is: data that is never collected cannot support a claim,” Oberly offered. Companies can further their minimization by imposing retention limits, using hashed identifiers and applying restricted data processing modes.

Augment Vendor Contracts

Companies’ contracts with vendors should include appropriate data-sharing terms, such as restrictions on vendors’ use of data for their own purposes, Oberly advised, noting those provisions can help support the party exception defense to wiretapping claims.

Companies also should require vendors to implement “pre-consent suppression” for processing and honor global privacy control signals.

Preserve Records for Enforcement and Litigation

Companies should assume that the California AG’s investigations under CIPA Section 638.51, now supported by funding under SB 690, will “look the same as CCPA investigations,” Oberly suggested. “Opt-out logs, tracker audits and risk assessments are key” pieces of evidence, he noted.

Companies with robust recordkeeping have been able to prevent litigation before it begins, by supplying evidence to respond to demand letters, likely driving plaintiffs’ attorneys to move on to another company, Oberly observed.

To establish records in advance of needing to defend a wiretap lawsuit, companies should preserve all versions of their opt-out banners, CMP logs and configurations of tag managers. Documenting “variation in the privacy disclosures encountered by different putative class members” can combat certification, Knisely offered, referencing the Lewis court “finding that individualized issues of cookie identification, consent and standing predominate over common questions in tracking technology cases,” he explained.

Update Playbook for Demand Letters

Companies should set a policy of calling counsel within 72 hours of receiving a demand letter, Oberly advised. Response protocols also should be updated to reflect the changing litigation landscape, with less emphasis on pen register claims and greater attention to allegations involving sensitive data.

As a final step, companies should create procedures and designate internal owners for producing consent records on short notice.

Companies have little time left to determine whether their automated tools fall within the scope of the California Privacy Protection Agency (CalPrivacy)’s sweeping automated decision-making technology (ADMT) regulations (ADMT Regulations) and to prepare for new compliance obligations. Authorized under the CCPA, the ADMT Regulations will fully come into force on January 1, 2027.

The ADMT Regulations represent a major shift in technology governance, extending beyond traditional AI systems to include a broad range of ADMT. They introduce new expectations around risk assessments, transparency and human oversight, requiring companies to evaluate how their automated systems are used in high-impact decisions and whether their existing governance practices can withstand regulatory scrutiny.

This article explores the ADMT Regulations’ application, key compliance steps, areas of uncertainty and litigation implications, distilling insights offered by privacy and AI counsel at CalPrivacy, Harvey AI, Goodwin Procter and DataGrail during an IAPP webinar. See “Updating Compliance Programs to Address the CPPA’s Regulations on ADMT and Risk Assessments” (Sep. 17, 2025).

Application and Scope

Since 2023, the CCPA has applied to all companies doing business in California that have more than $25 million in annual gross revenue, deal with the PI of more than 100,000 California residents or derive 50 percent or more of their annual revenue from selling the PI of Californians. The CCPA’s main goal is to protect the PI of California residents.

Building on the existing CCPA framework, the ADMT Regulations apply to entities that use ADMT and PI to fully or substantially replace human decision-making in regard to a significant decision – one that results in the provision or denial of opportunities regarding employment (hiring, firing, pay, promotions, and work allocation or assignment), housing, financial or lending services, healthcare services and education enrollment, explained Neelofer Shaikh, an attorney at CalPrivacy.

It is “really important to remember that these regulations are only triggered by processing personal information,” Omer Tene, a partner at Goodwin Procter, instructed. “If that is not the case, none of this applies.”

Human Involvement

According to the ADMT Regulations, to “substantially replace human decision-making” means a business uses computation to make a decision without human involvement, Shaikh said. Human involvement requires a human to know how to interpret and use the technology’s output to make the decision; review and analyze the output of the technology and any other information that is relevant to make or change the decision; and have the authority to make or change the decision.

ADMT is likely to become very popular for fraud-scoring and underwriting decisions, Daniel Barber, co-founder and CEO at DataGrail, suggested. However, consumer lending and insurance are largely exempt from the CCPA, Tene noted.

Not Restricted to AI

AI is not mentioned in the ADMT Regulations, observed Tene. They are agnostic as to whether ADMT involves generative or other kinds of AI. Rather, they apply to any technology that processes PI and uses computation to substantially replace human decision-making. They also apply to technologies beyond generative AI, such as machine learning and deterministic algorithms.

See “California’s Pending Automated Decision-Making Technology Regulations Will Further Focus Consumers’ Attention on AI” (Feb. 5, 2025).

Steps to Take Before Using ADMT for a Significant Decision

Once the ADMT Regulations are in effect, companies will need to take four steps before using ADMT for a significant decision, Shaikh advised. Before then, only the first step listed below, risk assessment, is required.

Risk Assessment

Since January 1, 2026, companies have been required to conduct a risk assessment before using ADMT for a significant decision, Shaikh said. The purpose of the assessment is to identify the benefits, privacy risks and relevant safeguards of an activity, and it must be conducted and documented according to detailed requirements in the ADMT Regulations. For example, a risk assessment must identify and document the logic of the ADMT, including any assumptions or limitations of the logic, as well as the output of the ADMT, and how the business will use the output to make a decision.

Companies that were already using ADMT for significant decisions before the risk assessment requirement took effect are not exempt and must complete and document assessments for these systems no later than December 31, 2027.

Pre-Use Notice

Companies must provide a pre-use notice to consumers that, at a high level, covers the purpose of using the ADMT, how the ADMT would work, and the consumer’s rights to opt out and access that ADMT, Shaikh noted.

Opt Out of ADMT

Companies generally must provide consumers with an easy way to opt out of the business use of ADMT, Shaikh explained. An exception exists for situations in which individuals affected by a decision made by ADMT have an opportunity to appeal that decision to a human being – the “human appeal exception.” Another exception is the “limited use exception,” which means that certain decisions regarding hiring, education admission, work and pay are exempt from the opt-out rule, provided strict performance and fairness safeguards are met.

The opt-out requirement will be “pretty hard to honor” in certain use cases, such as fraud scoring, observed David Khalily, a senior privacy and AI counsel at Harvey AI.

Access ADMT

Companies must give consumers who did not opt out the ability to access information about how the company used ADMT with respect to them specifically, Shaikh said. There are no exceptions to this.

See “CalPrivacy Director Discusses New Audits Division and Other 2026 Actions to Come” (Mar. 4, 2026).

Compliance Measures

When the ADMT Regulations come into full force in 2027, enforcement is likely to focus on situations in which ADMT is linked to bias, particularly in educational situations that involve minors, Khalily said.

The ADMT Regulations provide guidance on how to comply, and CalPrivacy is expected to provide additional resources to help businesses understand the rules, Shaikh said.

To help organizations prepare for these requirements, the panelists highlighted several measures that can reduce compliance risk and support defensible use of ADMT.

Document

Documentation regarding ADMT, including risk assessments and procedures for keeping humans in the loop, can help a company establish its position that the process does not substantially replace human review, Khalily said.

Use Human Control Where Needed

With tools that perform automated fraud or attrition scoring or otherwise shape HR decisions, the argument for human control is stronger. If “something feels off,” a human should examine and investigate the data points on which the tool placed the greatest weight, for example, producing a score, Khalily advised.

Conduct an Inventory

Companies should inventory any decision-making systems that may be in scope of the ADMT Regulations, particularly those used in the employment context, such as recruiting and compensation, and classify what types of decisions are involved, Barber urged.

Companies should keep in mind that software providers are increasingly adding agentic capabilities to their products, which may allow agents to make decisions on users’ behalf and bring those processes within the scope of the ADMT Regulations, Barber warned.

Companies should consider placing guardrails around multipurpose software tools and chatbots, particularly those with access to numerous data sources, to limit how they can be used and prevent them from coming within the scope of the ADMT Regulations, Khalily advised.

Gray-Area Situations

Determining whether a decision is significant or whether ADMT has substantially replaced human decision-making will not always be straightforward, Tene said.

The key question is whether the human decision-maker is exercising independent judgment or merely endorsing the system’s output. When ADMT and human input are combined, Tene explained, systems are more likely to be considered effectively automated, and thus in scope, when:

• the human rubber-stamps what the system surfaces;
• override is theoretically possible but never used; or
• the tool’s output is the decision, minus a signature.

The following examples arise in the employment context, but the same questions about whether ADMT is making a significant decision or substantially replacing human judgment apply in other settings, noted Barber.

Performance Review Summaries

In one scenario Tene presented, humans write performance reviews, after which an AI tool summarizes them and maps those summaries against the organization’s evaluation framework. The AI tool identifies which employees appear to meet the framework and which do not. A human then delivers the results.

Whether that process is subject to the ADMT Regulations depends on whether the AI is doing more than simply summarizing content, Tene explained. The process likely involves a significant decision because it can affect work assignments, promotions or demotions. The AI's role in summarizing performance reviews may not itself be enough to trigger the regulations, as people routinely use tools such as ChatGPT to summarize information, he said. However, the process also appears to involve profiling because the tool is evaluating employee performance. The central question is whether the person delivering the review exercises independent judgment or merely accepts the AI-generated outcome, he added.

Productivity Tools That Assign Workflows

Another gray-area situation involves use of productivity tools that assign work based on employee workload or monitor how employees perform tasks, Khalily said. Those productivity tools are “going to be feeding into decisions big and small every day with varying degrees of human decision-making.” It remains unclear, however, whether those activities would be considered “profiling” under the ADMT Regulations.

Job Applicant Scoring

If an ADMT tool scores job applicants, and the recruiter only ever sees the top five percent of the applicants it surfaces, that tool is within scope of the ADMT Regulations, Tene said. On the other hand, if an ADMT tool flags applications, but a recruiter reviews the full pool and can pull anyone forward, that is likely not in scope, because a human is responsible for the full decision. The result of the latter example could change, however, if the human fails to review the non-flagged applications or if there are strong institutional incentives not to disagree with the tool that weigh heavily against independent human decision-making.

ADMT Rules in Other State Laws

California has the most detailed ADMT rules, but Colorado and Connecticut have profiling opt-out rights already in force and New York City Local Law 144 calls for bias audits for ADMT, Barber explained, noting that he “anticipates that similar provisions will be put forth in the 24 states that have comprehensive privacy frameworks in effect today . . . and [they will] hopefully follow the same type of framework.”

See our two-part series on Colorado and Connecticut AI Laws: “Mapping Scope and Core Provisions” (Jun. 10, 2026), and “Preparing to Comply” (Jun. 17, 2026).

ADMT in Litigation

The ADMT Regulations are likely to lead to significant litigation in the HR context, Tene said. The opt-out right is “really awkward because if employees opt out, they get the human decision-making and then it is the perfect setting for a discrimination claim or a retaliation claim at the very least,” he opined.

The ADMT Regulations’ access rights also introduce challenges in an employment context because if a company has to provide the logic behind how decisions are made, that can feed into a claim under Title VII of the Civil Rights Act of 1964. “The fact that now employers have to open the kimono and show the underlying logic of these decision-making technologies will definitely fuel some litigation,” Tene predicted.

Barber noted the following litigations involving ADMT.

Mobley v. Workday, Inc.

In Mobley, job applicants alleged that a vendor’s algorithmic screening platform systematically excluded candidates based on protected characteristics like race, age and disability.

Kistler v. Eightfold AI Inc.

In Kistler, plaintiffs challenged a predictive recruiting engine that ingests vast consumer datasets to generate opaque, numerical candidate suitability scores.

Does 1-26 v. Meta Platforms, Inc.

In this case against Meta, current and former employees challenged Meta's alleged use of AI-assisted workforce analytics, productivity metrics and activity-monitoring data to rank employees for layoff decisions, claiming the system disadvantaged workers who had taken protected leave or sought disability accommodations.

The age assurance market is large, dynamic and growing, said Chris Burt, managing editor at Biometric Update, during a September 2026 webinar program on the age assurance and digital age credentials market.

The program, which included practical insights from age assurance vendors, examined the factors driving the adoption of age verification technology, the evolving regulatory landscape, the ISO/IEC 27566‑1:2025 framework for age assurance systems, considerations for choosing an age assurance vendor, and the movement toward adoption of digital identification wallets. This article synthesizes the key takeaways from the program.

See “$17‑Billion Meta Pact Offers Compliance Guidance With Implications Across Industries” (Sep. 30, 2026).

Main Drivers of Age Assurance Market Growth

The number of annual global age assurance transactions could grow from an estimated 6 billion in 2026 to more than 9.8 billion in 2028, said Alan Goode, CEO of Goode Intelligence. Age assurance is commonly used in the following online activities:

• adult content;
• video gaming;
• gambling;
• social media;
• entertainment;
• e-commerce and age-related retail; and
• dating.

There are three main factors driving organizations to adopt age assurance mechanisms, according to Goode:

• regulatory requirements;
• protecting children online; and
• competitive advantage/protecting a company’s reputation.

Compliance

“The presence of a big stick always works wonders in driving adoption for technology – and we’re seeing this very much so with age assurance,” observed Goode. One such law is the U.K. Online Safety Act (U.K. OSA), which is “a comprehensive legislation designed to regulate online content and protect users, especially children, from harmful material,” he explained. Other jurisdictions that have adopted age verification requirements include the E.U., Australia and more than two dozen U.S. states.

See “Enforcement Lessons From Disney and Four Other FTC Children’s Privacy Actions” (Jan. 28, 2026).

Protecting Children

A key driver of the use of age assurance mechanisms is the desire to protect children from pornography, information about self-harm and other harmful information, noted Goode.

Competitive Edge

A company with robust age assurance measures may have a competitive edge over companies that do not. “Building a safe, trustworthy digital environment protects a company’s public image. Parents and consumers increasingly favor platforms that demonstrate a commitment to digital responsibility,” observed Goode.

See “The Practical and Legal Complexities of Online Age Verification” (Jun. 21, 2023).

Rapidly Evolving Regulation

Jurisdictions vary widely on targets for regulation, regulatory approaches and assurance level requirements, observed Burt. “Age assurance literally changes by the day right now in terms of legislation. It’s a moving target,” said Joel McConvey, contributing editor at Biometric Update. Different regional flavors of age assurance and legislation are evolving. Two significant areas of global concern, which are driving legislation, are adult content and social media.

Industry-Specific Focus

Adult Sites

The adult content industry has been taking significant steps to implement age assurance, often prompted by legislation, according to Goode. For example, the U.K. OSA requires adult sites to use robust age verification mechanisms, including facial recognition, photo ID scans and digital identity. The U.K. Office of Communications (Ofcom) has published guidance on ensuring that such measures are in place.

Social Media

Social media sites are increasingly adopting age verification measures as well, Goode continued. Australia has been a leader on social media. It introduced the Social Media Minimum Age requirement in December 2025, which requires large social media platforms to restrict access to individuals who are at least 16 years of age. It provides for fines of up to AU$49.5 million for platforms that fail to take reasonable steps to bar children under 16.

Other countries are following Australia’s model or exploring other approaches to regulating social media. For example, in June 2026, the U.K. government announced plans to ban children under the age of 16 from social media platforms, added Goode.

See “Navigating Evolving Social Media Risks” (Nov. 30, 2022).

Gambling

“Online gambling has erupted globally” as nations like Brazil adopt regulations permitting it, typically for individuals who are at least 18 years old, noted Goode. “Brazil has leveraged legal changes around online gambling to enact one of the world’s most ambitious age assurance regimes,” added McConvey.

Regional/National Approaches

Australia

There are growing calls globally to make sites more accountable for the content they host, observed McConvey. Notably, Australia continues to work on stronger regulatory powers and is proposing a “digital duty of care” – a legal framework that puts greater responsibility on social media not to host harmful content.

Europe

The E.U.’s efforts on age assurance are tied closely to the E.U. digital identity wallet scheme (E.U. DI), under which all E.U. states must offer a digital wallet to their citizens by the end of 2026, explained McConvey. The wallets will have a major role in age verification.

A constitutional panel in France held that France’s age assurance law for social media violated free speech rights, noted McConvey. This has put pressure on the E.U. to develop an E.U.-wide approach to age assurance. In that regard, on September 17, 2026, the E.U. issued a proposal for an “E.U. KIDS Act” aimed at protecting minors online.

The U.K. now permits using a digital ID for alcohol sales by vendors approved under the U.K. Digital Verification Services trust framework, added McConvey. However, digital IDs are not actually ready to be used in practice, observed Tony Allen, executive director of Age Check Certification Scheme. The U.K. is still working on standards and implementation.

Asia

“Asia has emerged as sort of a sandbox for age assurance legislation, as nations aim to crack down on online child exploitation and other harms, as well as social media,” observed McConvey. Nations are developing models tailored to their unique social and legal structures.

Americas

The U.S. continues to rely on state-level approaches, noted McConvey. States like California and Texas are taking significantly different approaches. Some focus on devices, others on platforms. The “big constant” in the U.S. is the impact of the First Amendment on potential regulation of content. Canada is still considering policy options. Brazil is extending its regulatory framework for age assurance in gambling to social media.

See our three-part series “Children’s Privacy Grows Up”: Examining New Laws That Now Protect Older Teens (Jan. 15, 2025), FTC Amends COPPA Rule and Targets Data Sharing (Jan. 29, 2025), and Seven Compliance Areas for Protecting Teens (Feb. 12, 2025).

ISO/IEC 27566-1:2025 Framework

One of the challenges in age assurance is ensuring interoperability, observed Allen. For example, a vendor’s age assurance system should be able to interact with different types of device-based digital IDs.

The ISO/IEC 27566‑1:2025 framework (Framework) is already being integrated into regulatory standards, explained Allen. For example, in the U.S., the Framework underpins the New York SAFE for Kids Act. Additionally, Meta’s settlement with U.S. AGs forces it to apply the Framework’s standard – and AGs are pressing other social media platforms to do the same. Similarly, the Framework’s standard is mentioned in Ofcom guidance on vetting age assurance vendors. It also appears in other legislation and guidance worldwide. Moreover, companies seeking age assurance solutions are asking vendors if they are certified under the standard.

Five Core Characteristics

The Framework sets forth five core characteristics of age assurance systems, while it also contemplates a “practice statement” that describes how the age assurance system operates, according to Allen. The five core characteristics include:

• functionality – what the system claims to do;
• performance – how well it performs that function;
• privacy – how it protects individuals’ privacy;
• security – how resistant to attack the system is; and
• acceptability – how people can use and interact with it.

Three Key Terms

The Framework uses three key terms, explained Allen. “Age verification” always entails determining a person’s date of birth. That may be done by several methods, such as examining a document, a digital wallet, the E.U. DI, school records and health records – and confirming that they belong to the person in question.

“Age estimation” entails analyzing “features of humans that vary with age,” such as facial features, voice and gestures, using AI, continued Allen. “Age inference” is using any fact about a person, other than date of birth, from which it is reasonable to draw an inference about the person’s age. There are thousands of data points from which it may be possible to infer that a person is an adult, such as having a mortgage, holding a driver’s or firearms license, or even having a “.gov” email address.

Selecting Age Assurance Vendors

Implementing age assurance is not a plug-and-play process, cautioned Allen. An organization must consider how a particular system will fit in with its business operations and the system’s impact on customers and privacy. It is a complex task that becomes even harder when contending with multiple additional access channels, including the Apple and Google app stores.

Effective age assurance technology is now widely available, added McConvey. Once an organization has decided on a particular technology, it must also consider how to explain to its users what the technology does and how it functions.

See “Navigating Three New State Laws That Require Apple and Google App Stores to Check All Users’ Ages” (Aug. 13, 2025).

Consider Regulatory Requirements and Risk Tolerance

The market is moving away from simply asking which age assurance technology an organization should buy and toward considering the minimum level of assurance it needs to achieve a desired outcome, noted Daniela Marin, senior product marketing manager at Shufti. Some organizations know what age assurance technology they want to use. Usually, however, an organization is only aware of the relevant regulatory standard it must meet. The question, she advised, “should be, ‘What level of assurance do I need for this particular user, for this particular interaction and for this particular level of risk that I am willing to accept as a company?’”

In some applications, a less intensive approach, like age estimation, may suffice, noted Marin. In others, a database check may work. Other instances may require more friction, including document checks and “liveness” verification, especially where there is higher regulatory risk. Organizations do not necessarily have to default to the strongest and most intrusive methods. The methods should be proportionate to their needs and risk tolerance.

Organizations typically want to minimize friction, ensure compliance and avoid fraudulent uses of their systems, concurred Deepak Sharma, solutions manager at Innovatrics.

Employ Data Minimization

Age assurance mechanisms are moving toward data minimization and zero-knowledge proofs, observed Burt.

Data minimization should be part of the age verification process, said Marin. For example, if an organization needs only to confirm that a person is over 18, it should not collect more information than necessary to make that determination.

See “Examining Maryland’s Game-Changing Data Minimization Requirements” (Apr. 24, 2024); and “How to Comply With the CPRA’s Data Minimization Standards” (Feb. 8, 2023).

Account for Size and Sector

Choice of system also depends in part on the size of the organization and the sector in which it operates, noted Irene Hernández, CEO of Gataca. Top-tier companies tend to be in the regulators’ crosshairs. Compliance and privacy are top priorities for them, and their teams are typically well-versed in the relevant requirements across jurisdictions, as well as the available verification methods. They are focused on minimizing friction and drop-off rates, while second-tier companies tend to be very focused on cost – in many cases at the expense of compliance.

Digital Wallets Gain Ground As an Age Assurance Tool

Digital identification wallets will be increasingly important but will not replace other methods of age assurance overnight, predicted Marin. E.U. Member States are required to make E.U. DI wallets available by the end of 2026. Such wallets could help improve user experiences because users will not have to undergo a full verification process each time they access a site – they can reduce friction and unnecessary data disclosure. For example, a trusted wallet can confirm a person is over 18 without providing a date of birth or identifying the person. “Ultimately, users should be able to prove that they are old enough without having to prove everything about who they are,” she said.

Implementation and Adoption Hurdles

The E.U. DI ecosystem is still maturing, continued Marin. Progress varies by country. Member States are still developing certification processes. Remote verification capabilities are not consistent across every wallet, with some markets still relying heavily on existing national electronic identification schemes under the 2014 E.U. Electronic Identification and Trust Services (eIDAS) Regulation.

Implementation of the E.U. DI may be challenging, Sharma posited. Although the eIDAS Regulation has been in force for more than a decade, many such schemes have very low adoption rates. The E.U. DI may face the same issue. Its success will depend on how E.U. Member States approach implementation and how quickly users adopt it.

Current methods of age assurance will remain relevant for the next few years, but the E.U. DI will be a gamechanger in the longer term, added Sharma. Additionally, existing age and ID verification mechanisms may be needed when setting up E.U. DI wallets.

An Inflection Point

There is a definite trend toward adoption of digital identification wallets, but adoption at scale will take time, Hernández agreed. One factor will be how quickly E.U. Member States release their own wallets, how functional they are and how quickly age verifiers accept them. France and Germany are almost ready. Other nations are still in the procurement phase.

“2027 will be an inflection point for ID wallets worldwide,” continued Hernández. The E.U. is important, but it is only part of the huge global market. Other places, like the U.S., are much bigger markets for social media and adult content. Moreover, Apple and Google are adopting “the same standards [for] data models and exchange protocols for verifiable credentials as Europe is adopting with the E.U. DI wallets,” she observed. Once they deploy their own digital IDs and age proofs in their own wallets, a very significant part of the market will get used to using them and they may become the mode of choice for many consumers.

Reed Smith has welcomed Kate Campbell as a partner in its global corporate group and emerging technologies group. 

Campbell advises companies across industries on the legal and business issues accompanying the development, adoption and commercialization of emerging technologies, helping her clients navigate both the opportunities and risks they create. Her practice spans AI governance, data privacy, cybersecurity, technology transactions and digital product launches. Her litigation experience informs her counseling, particularly around data breach incident response and related disputes. She also works with M&A teams on data, software, and IT transitions and strategy.

Campbell joins Reed Smith from Neal Gerber Eisenberg, where she was a partner. 

For insights from Reed Smith, see “Managing Privacy Across the Cross-Border M&A Lifecycle” (Sep. 16, 2026); and “Managing Data Transfers After Latombe” (Oct. 8, 2025).

Neil DuChez has rejoined Akin as a corporate partner in New York. He arrives from Goldman Sachs.

DuChez advises on technology and commercial transactions, including strategic partnerships, joint development arrangements, outsourcing matters and technology-enabled transactions. His practice focuses on matters related to AI and data analytics solutions, data and content licensing arrangements, and other mission-critical technology products and services. He also advises on the technology, intellectual property, data and transition services aspects of acquisitions, divestitures and other strategic transactions.

Most recently, DuChez served as vice president and senior legal director in the technology legal group at Goldman Sachs, where he led the negotiation and execution of complex global technology, product, partnership and services agreements, and advised on complex technology, data, AI and intellectual property matters across the firm’s business divisions. Prior to that, he was an associate focusing on intellectual property issues at several law firms, including Akin, where he began his legal career.

For insights from Akin, see “European Commission Guidance Sheds Light on CRA Scope and Compliance Obligations” (Sep. 9, 2026); and “Anthropic’s Mythos Model Forces Companies to Regroup for a New Cyber Era” (Apr. 22, 2026).