Cookies, pixels and wiretap lawsuits: eight steps to keep your website out of court
Wiretap statutes have turned cookies, pixels and consent banners into litigation. Eight steps to keep your website out of court, from my IAPP session.
Browse by topic
- AI governance and regulation 7 posts State and federal AI laws are arriving faster than most compliance programs can absorb them. What the new laws require, who is enforcing them, and what to do before the effective dates.
- Data privacy 5 posts Privacy compliance for companies that handle personal information: state privacy laws, children's data, biometrics, and the tracking litigation wave. What the law requires and where the plaintiffs' bar is looking.
- Cybersecurity and incident response 4 posts Your worst breach may not be your own. Vendor risk, incident response, the new AI attack surface, and how your contracts decide your exposure.
- Technology contracts 4 posts SaaS agreements, AI vendor terms, licensing, and IP. What belongs in the agreement and what to push back on before you sign.
- AI and the practice of law 3 posts For lawyers: privilege, work product, discovery, and ethics obligations when AI touches legal work. Written from the Florida Bar trenches.
- General counsel and workplace 4 posts What fractional general counsel means in practice, plus the employment issues growing companies actually face — AI hiring tools, confidentiality, and HR compliance.
All articles
-
Write Down Your Contract Positions Before the Redline Arrives
If you sell SaaS, the same four clauses come back marked up on every deal. A written playbook decides them once instead of every time.
-
When Your AI Agent Breaks In, You Did the Breaking In
An AI agent cancelled a stranger's gym reservation unprompted. Under the Ninth Circuit's CFAA reasoning, the access is attributed to the user.
-
Before You Sign a SaaS Agreement: The Terms That Carry the Risk
SaaS contracts bury the risk in a few clauses: your data, the liability cap, indemnity, auto-renewal, and exit. What to read before you sign.
-
AI Agents and the CFAA: The Agent Is a Tool, Not a Person
The Ninth Circuit held that an AI agent is a tool, not a person, under the CFAA: the user does the accessing. What that means for agentic AI liability.
-
Colorado's New AI Accountability Law: What SB 26-189 Requires
Colorado replaced its 2024 AI Act with the ADMT Act, effective January 1, 2027. Who it covers, what it requires, and what to do before the date.
-
Before You Prompt: AI, Privilege, and Confidentiality for Florida Lawyers
Courts are deciding whether AI-assisted legal work keeps privilege and work product protection, and what Florida requires before you press enter.
-
AI Hiring Tools and Discrimination Risk
AI resume screeners and interview tools can create discrimination exposure even when no one intends it, and the employer, not the vendor, is liable.
-
Contracting With Agentic AI Vendors: What Belongs in the Agreement
Agentic AI tools take actions on your behalf. When something goes wrong, your contract decides who is responsible. Here is what to negotiate.
-
Employees, AI Tools, and Your Confidential Information
When employees paste company or client data into AI tools, trade-secret and confidentiality protections can quietly erode. Here is how to get ahead of it.
-
Cybersecurity and incident response
The Guardrail Asymmetry: An AI-Run Breach That Blocked the Defenders
Hugging Face says an autonomous AI agent ran a breach end to end, then hosted-AI safety filters blocked its own responders. A new vendor-risk question.
-
Cybersecurity and incident response
When a Vendor Gets Breached: Third-Party Risk and Your Contracts
Your worst data breach may not be yours. When a vendor is breached, your contracts and diligence decide your exposure. Here is what to check.
-
COPPA and Apps That Collect Data from Minors: What Florida Developers Should Know
COPPA applies to apps directed at children under 13, or where you have actual knowledge a child is using them. Here is what that means in practice.
-
What Your SaaS Company Needs in a Privacy Policy
A generic template is not enough for SaaS. Here is what your privacy policy must cover to meet current legal standards and user expectations.
-
AI and Work Product: What the Early Court Decisions Actually Hold
Courts are sorting out whether AI-assisted litigation work stays protected. The line is counsel direction, not the tool itself. Here is what they hold.
-
Cybersecurity and incident response
"We Take Security Seriously" Only Works If the Controls Are Real
An FTC order over a 10-million-student breach shows 'we take security seriously' holds up only if the access and retention controls behind it are real.
-
What Is a Fractional General Counsel? (And Do You Need One?)
A fractional GC gives your tech company access to experienced in-house counsel at a fraction of the cost. Here is how it works and who benefits.
-
Cybersecurity and incident response
Shadow AI's Other Half: The Access Employees Grant, Not Just What They Type
A third-party AI tool with broad OAuth access to one employee's Workspace became a path into Vercel's customer data. The risk is the grant, not the prompt.
-
State AI Chatbot Laws: What the 2026 Wave Requires
A dozen states now regulate consumer-facing AI chatbots, and they share one structure. What the laws require, who they cover, and how to comply.
-
AI Deepfakes and Personality Rights: The Civil Track
Washington's SB 5886 gives a private right of action over AI likenesses. For firms that host or generate media, the civil track is the real exposure.
-
Shadow AI in the Workplace: Four Steps to Govern It
Employees are feeding company and customer data into AI tools no one approved. A ban does not work. Here are four steps that do.
-
COPPA's Data-Retention Rule: Why Your Existing Policy Probably Fails
The amended COPPA Rule requires a specific purpose and a concrete deletion timeframe for children's data. Generic retention language no longer passes.
-
Your Consent Banner Is a Legal Representation
If your site tells users declining cookies stops tracking and it keeps tracking anyway, that is a false statement to every visitor. Test your CMP.
-
Federal AI Preemption: What the Blackburn Draft Would and Wouldn't Do
A federal AI framework aims to preempt state AI laws. The carve-outs matter: state enforcement of consumer protection and child safety would survive.
Your next step
Tell me what is on your desk.
Tell me a little about your business, the issue you are working through, and what you need next.