Internet Lawyer Blog

The EU AI Act Is Now Enforceable: What U.S. Technology Companies Must Know

Published on: September 14, 2026 | by Law Offices of Salar Atrizadeh

The European Union’s Artificial Intelligence Act has moved from planning to enforcement. On August 2, 2026, the European Commission’s AI Office and national authorities began enforcing key provisions of Regulation (EU) 2024/1689, as amended by Regulation (EU) 2026/1744. These include transparency duties and obligations for providers of general-purpose AI models.

U.S. technology companies should not assume that operating outside Europe removes them from the Act. Coverage can depend on where a product is offered, where an AI system’s output is used, what role the company performs, and what the system is intended to do.

Why Does the August 2026 Milestone Matter?

What “Doe v. Adventist Health System/West” Means for CIPA, Meta Pixel, and Healthcare Website Tracking

Published on: September 7, 2026 | by Law Offices of Salar Atrizadeh

Website tracking technologies have become a significant source of privacy litigation, especially when they are deployed on healthcare websites, patient portals, assessment forms, and other pages involving sensitive information. A recently published California appellate decision illustrates how these cases may proceed when plaintiffs allege that tracking pixels transmitted information to third parties.

In Doe v. Adventist Health System/West (Cal. Ct. App., July 24, 2026, No. B344951), certified for publication on August 24, 2026, the California Court of Appeal considered claims involving the California Invasion of Privacy Act (“CIPA”), the California Confidentiality of Medical Information Act (“CMIA”), Meta Pixel, and Google Analytics.

The court reversed the denial of class certification for the HRA-form subclass and for the surviving claims of the patient-portal subclass, including the CIPA section 631 claim. It affirmed the denial of certification for the patient-portal CMIA claims and the finding that the plaintiffs forfeited certification of their CIPA section 632 claim. The matter was remanded for further proceedings. The court did not determine that Adventist violated CIPA or CMIA; it addressed whether specified issues could be resolved through evidence common to the proposed class members.

California Data Breach Notification Requirements: New 30-Day Deadline Under SB 446

Published on: August 31, 2026 | by Law Offices of Salar Atrizadeh

California’s data breach notification requirements changed on January 1, 2026. Senate Bill 446 amended California Civil Code section 1798.82 by replacing the state’s former flexible timing standard with a specific deadline. Subject to limited exceptions, an individual or business covered by the statute must notify affected California residents within 30 calendar days after discovering or receiving notification of a qualifying data breach.

The deadline compresses incident response. Organizations cannot assume that notice may wait until every forensic question has been answered. Legal, cybersecurity, insurance, communications, and executive teams should be prepared to investigate, determine whether protected personal information was or is reasonably believed to have been acquired, draft the required notice, and document any basis for delay while the clock is running.

What Did California SB 446 Change?

California Delete Act Compliance: DROP Requirements, 45-Day Deletion Duties, and Data Broker Risk

Published on: August 10, 2026 | by Law Offices of Salar Atrizadeh

California has entered a new phase of data privacy regulation. On August 1, 2026, the principal processing obligations under the California Delete Act became operational. Covered data brokers must now retrieve and process consumer requests submitted through the state’s Delete Request and Opt-Out Platform, commonly known as “DROP.”

The California Privacy Protection Agency recently reported that DROP has accumulated more than 345,000 active consumer requests and that over 600 data brokers are required to access the platform. These figures demonstrate why California Delete Act compliance should be treated as an immediate operational priority—not merely another privacy-policy update.

Businesses that buy, aggregate, analyze, license, exchange, or monetize personal information should determine whether they qualify as data brokers and whether their privacy infrastructure can satisfy the law’s recurring requirements.

California Invasion of Privacy Act: A 2026 Business Compliance Guide

Published on: August 3, 2026 | by Law Offices of Salar Atrizadeh

The California Invasion of Privacy Act—commonly known as CIPA—was enacted in 1967, decades before websites, tracking pixels, artificial intelligence chatbots, and session-replay software became ordinary business tools. Nevertheless, plaintiffs increasingly rely on this California privacy law to challenge how businesses record telephone calls and collect information through websites and mobile applications.

These lawsuits are not limited to large technology companies or businesses physically located in California. A small or midsized business operating elsewhere may face a CIPA claim if it records communications involving California residents or deploys technology that allegedly intercepts communications from California website visitors.

Because CIPA authorizes statutory damages of $5,000 per violation under specified circumstances, businesses should evaluate their call-recording systems, analytics software, chat tools, and other monitoring technologies before deployment.

The Quantum Leap in Cybersecurity Law: Why Post-Quantum Migration Is an Immediate Enterprise Risk

Published on: July 20, 2026 | by Law Offices of Salar Atrizadeh

The timeline for corporate cybersecurity compliance is contracting. For years, corporate boards, general counsel, and compliance officers treated quantum computing as a distant technical problem. That approach is becoming increasingly difficult to defend as federal agencies, standards bodies, and major infrastructure providers accelerate their post-quantum cryptography roadmaps.

In 2024, the National Institute of Standards and Technology (NIST) finalized its first three post-quantum cryptography standards: FIPS 203 / ML-KEM for key establishment, FIPS 204 / ML-DSA for digital signatures, and FIPS 205 / SLH-DSA as an additional stateless hash-based digital signature standard. NIST has advised organizations to begin migrating systems to quantum-resistant cryptography and has identified a transition pathway that will deprecate and ultimately remove quantum-vulnerable algorithms from its standards by 2035, with high-risk systems moving earlier.

Industry leaders are also accelerating their own schedules. For example, Cloudflare announced a 2029 target for full post-quantum security across its product suite, including authentication, and has separately tied the urgency to recent research developments and federal transition deadlines. The practical message for enterprise leaders is straightforward: post-quantum migration is no longer merely an IT modernization project. It is a legal, contractual, regulatory, and governance issue.

Quantum Computing Legal Issues: Cybersecurity, Privacy, Encryption, and Business Compliance

Published on: July 6, 2026 | by Law Offices of Salar Atrizadeh

Quantum computing is becoming a serious legal, cybersecurity, and business risk-management issue. Although practical quantum computers capable of defeating widely used cryptographic systems are not known to exist today, businesses should not wait until the risk becomes immediate before planning for it. The migration from existing cryptographic systems to quantum-resistant systems may take years, and in some cases the risk already exists because sensitive encrypted data can be collected now and decrypted later when stronger quantum capabilities become available.

For companies that store confidential information, process personal information, use cloud services, rely on digital signatures, operate e-commerce platforms, manage intellectual property, or maintain regulated data, quantum computing should be part of the cybersecurity and legal compliance conversation. This includes businesses subject to privacy laws, cybersecurity requirements, vendor-management obligations, data retention duties, contractual security commitments, and regulatory oversight.

What Is Quantum Computing?

The TAKE IT DOWN Act: New Federal Rights for Victims of Deepfakes, Revenge Porn, and Nonconsensual Intimate Images

Published on: July 1, 2026 | by Law Offices of Salar Atrizadeh

The internet has made it easier than ever for private images, videos, and personal information to be copied, posted, shared, and republished across multiple online platforms within minutes. Artificial intelligence has made the problem even more dangerous. Today, a person can be targeted not only by the unlawful posting of real intimate images, but also by AI-generated “deepfake” images or videos that falsely appear to depict that person in an intimate or sexually explicit manner.

This is no longer a fringe problem. Victims of nonconsensual intimate images, revenge porn, sextortion, cyber harassment, and AI-generated deepfakes often face immediate reputational damage, emotional distress, financial harm, employment consequences, family disruption, and personal safety concerns. In many cases, victims also struggle to determine where the content was posted, who posted it, whether copies have been made, and which platform has the legal responsibility to remove it.

The federal TAKE IT DOWN Act is designed to address this problem by creating a clearer legal framework for removing nonconsensual intimate images from covered online platforms. The statute was enacted on May 19, 2025 as Public Law 119-12, and the Federal Trade Commission began enforcing the Act’s platform notice-and-removal obligations on May 19, 2026.

California SB 53 and AI Cybersecurity: Legal Duties for Frontier AI Developers and Businesses

Published on: June 1, 2026 | by Law Offices of Salar Atrizadeh

Artificial intelligence is no longer just a software, automation, or innovation issue. It is now a cybersecurity, privacy, governance, and legal compliance issue. As businesses deploy AI tools into customer service, hiring, healthcare, finance, marketing, legal operations, cybersecurity, and enterprise decision-making, California lawmakers are moving toward a more formal regulatory framework for artificial intelligence systems.

One of the most important developments is California Senate Bill 53, also known as the Transparency in Frontier Artificial Intelligence Act. Governor Gavin Newsom signed SB 53 on September 29, 2025, and the law establishes new transparency, safety, reporting, and whistleblower-related obligations for certain developers of frontier artificial intelligence models.

For businesses in California, especially technology companies, AI vendors, cybersecurity providers, software developers, and companies integrating AI into regulated workflows, SB 53 signals a major shift. AI risk is no longer limited to intellectual property ownership, hallucinations, biased outputs, or data privacy. It now includes critical safety incidents, model security, catastrophic risk, cybersecurity controls, internal reporting, and government enforcement.

California’s Digital Financial Assets Law: What Crypto Businesses Must Do Before July 1, 2026

Published on: May 1, 2026 | by Law Offices of Salar Atrizadeh

California’s Digital Financial Assets Law (“DFAL”) is about to become a much bigger issue for the crypto industry. Beginning July 1, 2026, certain companies serving California residents may not engage in covered digital financial asset business activity unless they are licensed by the California Department of Financial Protection and Innovation (“DFPI”), exempt, or have submitted a completed application on or before July 1, 2026 and are awaiting approval or denial. The law is not limited to large exchanges. Depending on the business model, it can affect crypto trading platforms, custodians, transfer services, stablecoin-related businesses, and digital asset transaction kiosk operators, including so-called crypto ATMs.

For California businesses, the message is straightforward: July 1, 2026 is not a soft milestone. It is the date on which the state’s licensure framework becomes operational for many digital asset businesses. For consumers, the law is also significant because it creates disclosure, custody, and conduct rules aimed at a market that has too often been defined by opacity, operational failures, and fraud.

What is California’s Digital Financial Assets Law?