In the absence of any action on a federal privacy law (more on that below), we also anticipate additional states passing comprehensive privacy laws of their own in 2024. Indeed, within the past week, comprehensive privacy bills have been passed or nearly passed by legislatures in New Jersey and New Hampshire, respectively. Earlier this week, the New Jersey legislature passed a comprehensive privacy bill that had carried over from the previous calendar year. Meanwhile, in New Hampshire, a comprehensive privacy bill passed the House on January 4 and now awaits (expected) concurrence from the Senate. Other states, including Hawaii, Kentucky, New York and Oklahoma, are prime candidates in 2024 to pass comprehensive privacy laws because they all had comprehensive privacy bills in 2023 that cleared one legislative chamber. In terms of the substance of these new comprehensive privacy law proposals, if trends in 2023 hold, it is likely that most of these bills will adhere to the Virginia model and thus feature less prescriptive compliance requirements than those included in the California Consumer Privacy Act (CCPA) and CPRA. 

3. Enforcement of the Washington My Health My Data Act

2023 also saw the enactment of Washington’s My Health My Data Act (MHMDA), a significant health privacy law that will create meaningful compliance obligations for companies that process health data outside of HIPAA. The challenges from this law are particularly important because the law includes a private right of action—where ambiguities in the legislation primarily will be exploited by the plaintiffs’ bar rather than reviewed by regulators. The MHMDA takes effect on March 31, and we will be closely monitoring how plaintiffs utilize the law’s private right of action. At this point, we expect the MHMDA to prompt significant amounts of litigation. For a model as to how the MHMDA is likely to be used by plaintiffs, we can look to Illinois’ Biometric Information Privacy Act (BIPA). Though that law regulates biometric information rather than health data, it, like the MHMDA, features a private right of action and has resulted in a flood of litigation, with plaintiffs utilizing wide-ranging theories of liability and exposing companies to significant potential damages awards. Thus, if companies’ experiences with BIPA are any indication, we can expect the MHMDA to be a source of significant potential legal exposure for companies within its ambit. 

Additionally, companies should, of course, not neglect the fact that the MHMDA will be enforceable by the Washington attorney general (AG), as well. Companies looking to understand how the Washington AG may approach its enforcement of the MHMDA can consult our past writing on the AG’s June 2023 enforcement guidance. Finally, companies should also be aware of Nevada and Connecticut enforcing their own consumer health privacy laws in 2024 (though neither of these laws includes a private right of action). Moreover, given how quickly three states moved to pass consumer health data laws in 2023, we anticipate additional laws joining this category throughout the year.

4. FTC Focus on Health Data and Adtech

 Generally speaking, the past several years have seen an increased focus by regulators on privacy implications related to consumer health data and adtech. No regulator has better exemplified this focus than the FTC. Over the past year, the FTC has established itself as a leader in the health privacy enforcement space, making consumer health data a key focus of its privacy and cybersecurity mission. Furthermore, the FTC has demonstrated a particular interest in the intersection of consumer health data and targeted advertising, bringing, for example, major enforcement actions against GoodRx and BetterHelp that centered in large part on those companies’ alleged misuse of consumer health information for advertising purposes (which the FTC deemed to be “unfair” practices, as we expand on below). We expect the FTC to continue to build on the precedent established by the GoodRx and BetterHelp enforcement actions in 2024, meaning that companies in the digital health space should be on high alert to ensure that their data privacy practices are transparent and feature appropriate consents for uses of consumers’ personal information. 

Additionally, the FTC is in the process of amending the Health Breach Notification Rule (HBNR), having issued proposed amendments in May 2023. As we have previously written, these proposed amendments would broaden the types of entities covered by the rule (e.g., to include health apps) and expand the scope of activities triggering the HBNR’s notification requirements (e.g., to include unauthorized disclosure of certain health information to a third party without consumer consent). The public comment period for these amendments closed in August 2023, so it is likely that we will see further developments in the new year. 

5. Continued Expansion of Other FTC Enforcement Activities—Unfairness, Sensitive Consumer Data, AI and Future Rulemaking Activities

Beyond a continued focus on consumer health data and adtech, we expect to see four additional trends guide the FTC’s enforcement activities in the upcoming year. First, the FTC is likely to continue its efforts to expand the boundaries of its unfairness doctrine. In recent years, we have seen the FTC push a muscular application of its authority to pursue actions against unfair acts or practices in the privacy and cybersecurity realm, expanding this concept, in particular, to reach companies that fail to adequately protect consumer data. Thus, to name a few examples, the FTC has levied unfairness charges against a data broker that collected and used vast amounts of sensitive consumer information without adequately informing or obtaining consent from consumers, a company that made retroactive material changes to its privacy policies, and an entity that failed to adequately respond to consumers’ requests for the deletion of their personal data. Second, we expect the FTC to continue its focus on enforcement actions against companies that mishandle sensitive types of consumer information, in particular. This was a notable area of focus for the FTC in 2023, and so companies that handle sensitive information like consumer health data, genetic data, biometric data and the like should take extra care to ensure that that data is subject to robust privacy and cybersecurity controls. Third, we expect the FTC in 2024 to further wade into the realm of AI regulation. In 2023, the FTC issued a series of public pronouncements making clear that it views AI to be within its regulatory purview. 2024, then, is likely to be the year that the FTC takes more-concrete action in this arena, perhaps by beginning to bring more enforcement actions that feature AI-related deception and unfairness claims, specifically. The FTC also ended last year by bringing an enforcement action against a company for using AI facial recognition technology without implementing reasonable safeguards.

 

Finally, the FTC is also likely to continue to expand the scope of its enforcement authority through its rulemaking activities. For example, at the end of 2023, the agency proposed new rules under the Children’s Online Privacy Protection Act (COPPA) that, among other things, would require companies to limit their targeted advertising activities directed at children protected under the rule. Meanwhile, the FTC is still going through the rulemaking process related to “commercial surveillance and data security practices that harm consumers.” We may see some movement on this front in the coming year. 

 6. Potential Movement on Federal Privacy Law

In contrast to 2022, when the American Data Privacy and Protection Act (ADPPA) managed to gain some traction in the House of Representatives, 2023 was a relatively quiet year for the ongoing effort to pass a comprehensive federal privacy law. It is possible, however, that we may see more significant movement on the ADPPA (or a similar bill) in 2024. President Joe Biden, for instance, called on Congress to pass bipartisan data privacy legislation as part of his recent executive order on AI. Thus, we may see more movement on a federal bill in the upcoming legislative session, either as a stand-alone effort or as part of a broader AI-related legislative package. We may also see narrower privacy proposals (as we have in years past), such as those aimed at expanding the Gramm-Leach-Bliley Act or the regulations that apply to non-HIPAA health data. 

Of course, any legislative priority in 2024 will have to contend with the fact that it is an election year. This may make it (even more) difficult for a privacy bill to pass as a stand-alone effort. But, as noted above, there seems to be a bipartisan priority in Congress to develop rules governing AI use, and it would not be surprising to see privacy or data security rules come out of that effort.

7. Intersections with AI 

As we have written elsewhere, AI is an object of growing focus for legislatures and regulators around the world. And while AI poses issues distinct from general data privacy concerns, the two areas overlap in significant ways. For instance, some state comprehensive privacy laws establish rights and obligations that affect companies’ development and use of AI tools, such as by allowing consumers to opt out of certain uses of profiling and by imposing requirements on how companies may use the training data they feed into their AI models. Conversely, and as noted above, it is quite possible that broader AI legislative and regulatory initiatives, such as the effort underway pursuant to the Biden Administration’s executive order on AI, will include certain elements that directly touch on data privacy issues. Either way, we expect developments in both the AI and data privacy spheres to be significantly intertwined in the years to come.