Insights
Search Results
Podcasts
10.28.26
Writing Privacy Rules Patients Can Trust
On October 28, partner Jodi Daniel was featured on the Surescripts podcast There’s a Better Way: Smart Talk on Healthcare and Technology. In the episode, Jodi discusses her background as a federal health policymaker and how she helped write the Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule that protects patient data.
Alerts
10.23.26
Cybersecurity Vulnerabilities and Security Updates: Why Hours Matter, What Defense Tech and Dual Use Companies Should Do Now
On October 21, 2026, the PHP project patched two critical remote-code-execution vulnerabilities, together called php2shell, that affect nearly every system running PHP to serve web traffic, including sites built on WordPress, Drupal, and Magento, as well as many custom portals. Technical details of the vulnerability leaked before the fix was released, so the window between disclosure and active exploitation was short. Patching is available and inexpensive. The cost of waiting for exposed companies is not only a possible breach, but also the legal and contractual exposure that the delay itself creates—especially for heavily regulated entities, such as U.S. government contractors that handle Controlled Unclassified Information (CUI).
News Articles
10.12.26
Future of Privacy Forum Recognizes Christopher Kuner with Lifetime Achievement Award
The Future of Privacy Forum, a global nonprofit focused on data protection, artificial intelligence, and emerging technologies, has honored Wilson Sonsini Goodrich & Rosati Senior Privacy Counsel Christopher Kuner with its Lifetime Achievement Award. Presented at the Brussels Privacy Symposium, the annual awards event recognizes outstanding contributions to data protection and privacy in Europe.
Alerts
10.06.26
California Enacts Over Two Dozen Key Privacy and AI Bills into Law in 2026 Legislative Session
As the 2026 legislative session came to a close, California passed a wide-ranging assortment of privacy and artificial intelligence (AI)-related bills. In total, Governor Gavin Newsom signed over two dozen privacy and AI bills into law. The measures fall into six themes:
Client Advisories
9.22.26
Evolving Expectations for AI in Mental Health
Artificial intelligence (AI)-enabled mental health products are becoming more ubiquitous with many individuals turning to chatbots, digital companions, coaching tools, and other AI systems for mental health support. They are also attracting increased attention from regulators, policymakers, and courts. As discussed in our previous client alert, Legal Framework for AI in Mental Healthcare, these products already fall within a patchwork of federal and state regulatory frameworks. Recent developments suggest government scrutiny of the sector is likely to continue increasing, including recent actions by agencies, state laws, and emerging litigation. For companies developing AI-enabled mental health products, key considerations may include medical device regulation, emerging state AI laws, Federal Trade Commission (FTC) oversight of health-related claims, privacy, transparency and health data use, and potential liability theories, including the unauthorized practice of medicine or psychology.
Alerts
9.18.26
European Commission Proposes “EU KIDS Act” to Restrict Children’s Access to Online Services
On September 17, 2026, the European Commission (EC) published a proposed “EU KIDS Act,” which would impose minimum-age requirements to access social media and video-sharing platforms, subject to mandatory age verification, as well as an obligation for covered entities, including providers of online games and AI chatbots and AI companions, to build specific safety features by design.
Podcasts
9.08.26
The Intersection of Law, Technology, and Business Risk
What happens when data privacy, AI, law, and risk management collide? In this episode of BDO's Legal Tech Talk, Daniel Gold and Eric Derk talk with Tamara Lemmon of Wilson Sonsini to explore why proactive planning is becoming one of the most important competitive advantages in legal and compliance teams.
Alerts
8.18.26
CalPrivacy Authorizes Rulemaking on Opt-Out Signals, Raises Data Broker Fees, and Starts the Clock on DROP Amendment Comment Period
At its August 6–7, 2026, board meetings, the California Privacy Protection Agency (CalPrivacy) Board directed staff to prepare formal rulemaking to name Global Privacy Control (GPC) in the California Consumer Privacy Act (CCPA) regulations and tighten how opt-out preference signals must be honored. It also advanced separate rulemaking on data broker deletion audits and Delete Request and Opt-out Platform (DROP) rule amendments. Finally, the Board raised annual data broker registration and DROP access fees from $6,000 to $9,500 for 2027 and previewed its audit program.
News Articles
8.17.26
Lexology Pro Quotes Cédric Burton and Laura Brodahl on EU's Cyber Resilience Act Requirements
While the bulk of the EU Cyber Resilience Act's (CRA's) requirements won't take effect until December 2027, the reporting duty takes effect earlier, on September 11, 2026. Under this duty, affected companies must notify authorities and, in some cases, users, of any actively exploited vulnerabilities or severe incidents affecting their products within 24 hours of becoming aware. Wilson Sonsini attorneys Cédric Burton and Laura Brodahl weighed in on the practical implications for companies in Lexology Pro's recent article "Organisations Must Prepare for Mandatory 24-Hour Reporting Under EU Cyber Resilience Act," offering steps companies can take now to prepare.
Case Studies
8.14.26
How Wilson Sonsini Helped Soleno Therapeutics Position Itself as an Attractive Acquisition Target
Soleno Therapeutics, a Neurocrine Biosciences company, focuses on the treatment of rare diseases by identifying, developing, and commercializing novel therapeutics. Its lead commercial program addresses Prader-Willi syndrome (PWS), which occurs in approximately one in every 15,000 live births. One of the common symptoms of PWS is hyperphagia, a chronic and life-threatening condition characterized by an intense, persistent sensation of hunger.
Alerts
8.07.26
Ninth Circuit Addresses CFAA and Agentic AI Tools in Groundbreaking Decision
On August 4, 2026, the U.S. Court of Appeals for the Ninth Circuit issued a groundbreaking decision in Amazon.com Services, LLC v. Perplexity AI, addressing the legal status of so-called “agentic AI” tools, which help users expedite various online tasks, including buying goods and services. The Ninth Circuit vacated a preliminary injunction that had barred the AI company Perplexity from enabling users of its Comet Browser’s AI assistant feature to access the Amazon Store. In so doing, it became the first circuit to weigh in on the intersection between agentic AI and federal laws—specifically the Computer Fraud and Abuse Act (CFAA), which prohibits unauthorized access to protected computer systems.
Alerts
8.03.26
EU AI Act Enforcement Phase Begins
On August 2, 2026, the European Commission (EC), acting through its European AI Office (EU AI Office), became formally entitled to exercise its powers to investigate and enforce the EU AI Act obligations imposed on providers of general-purpose artificial intelligence (GPAI) models, as well as rules on prohibited AI practices. These powers are significant and include requesting information and documentation, obtaining access to models for evaluation, requiring corrective or risk-mitigation measures, and imposing fines of up to the higher of €15 million or 3 percent of the provider’s worldwide annual turnover.