Orrick State Attorney General Update | August 2026

State attorneys general remained active across a broad range of issues, including consumer protection, antitrust, privacy and DEI, continuing to shape the legal and regulatory landscape through litigation, enforcement actions and formal legal guidance.

This month’s Orrick State Attorney General update includes significant developments involving state privacy laws, multistate antitrust enforcement, consumer data security, diversity-related contracting policies and challenges to federal procurement requirements.

I. Data Privacy

New York Attorney General Issues Final Rules Implementing SAFE for Kids Act

The New York Attorney General Letitia James published the final implementing rules for the SAFE for Kids Act, which establishes how social media platforms must comply with restrictions on addictive features for users under age 18.

• Age verification and parental consent. The rules primarily define which online services are covered, clarify what constitutes an “addictive feed,” and establish standards for determining whether a user is a minor. Rather than prescribing a single age-verification technology, the rules permit a range of age-assurance methods —including document-based verification, facial age estimation, and other commercially reasonable approaches —provided they are sufficiently accurate and designed to protect user privacy. The regulations also explain how platforms may obtain and verify parental consent before providing otherwise restricted features to minors.
• Algorithmic personalization. Unless parental consent has been obtained, platforms may not provide algorithmically personalized (“addictive”) feeds to users under 18 and must instead provide non-personalized content, such as chronological feeds or content from accounts the user affirmatively follows. The rules also implement the Act’s restrictions on overnight notifications, generally prohibiting platforms from sending notifications to minors during designated nighttime hours absent parental authorization.
• Recordkeeping. The regulations also specify recordkeeping requirements, procedures for demonstrating compliance, and factors the Attorney General may consider in determining whether a company has taken reasonable steps to comply with the law.

A significant theme throughout the final rules is balancing child protection with privacy.  Attorney General James emphasizes that platforms should collect only the information necessary to determine age or obtain parental consent and should employ privacy-preserving technologies where feasible, including methods that minimize disclosure of personal information. The rules also clarify numerous definitions and exemptions in response to public comments, providing greater certainty regarding which entities and services fall within the law’s scope and how compliance will be evaluated.

Together, the regulations operationalize one of the nation’s most comprehensive state laws addressing youth social media use by creating a framework that limits algorithmic engagement features for minors while seeking to minimize unnecessary collection of sensitive user data.

Connecticut Attorney General Issues Guidance on Changes to Data Privacy Law, Including Children Protections

Connecticut Attorney General William Tong issued new guidance highlighting expanded privacy protections under the Connecticut Data Privacy Act (CTDPA) that took effect July 1, 2026.

The statutory provisions include new safeguards that apply to children’s online activities, such as:

• Prohibiting the processing of minors’ personal data for sale or targeted advertising.
• Prohibiting the use of addictive design features aimed at extending minors’ use of an online service.
• Limiting the collection of minors’ precise geolocation data unless such data is strictly necessary to provide the online product or service.
• Requiring that controllers obtain consent prior to processing minors’ personal data for profiling.
• Requiring default settings that prevent adults from sending unsolicited communications to a minor on direct messaging applications.

The guidance further discusses other CTDPA provisions, including:

• Broadening the applicability thresholds to businesses that: process the personal data of at least 35,000 Connecticut residents, sell personal data or process sensitive data (outside payment transactions).
• Expanding the definition of "sensitive data" to include:
  • Data relating to disability or treatment
  • Status as nonbinary or transgender
  • Genetic or biometric data or information derived therefrom
  • Certain financial data including financial account numbers in combination with a security code or password
  • Government-issued identification numbers, such as Social Security numbers; and
  • Neural data

State Attorneys General Reach Settlement Agreement with Company Over Data Breach

A coalition of 42 states secured a $150 million settlement of bankruptcy claims against genetic testing company 23andMe from its 2023 data breach, which exposed the personal and genetic information of approximately 6.9 million customers worldwide.

According to the state attorneys general (AGs), the breach included sensitive information such as genetic ancestry data, some of which was later offered for sale on the dark web. The AGs allege 23andMe failed to promptly detect and respond to the breach, learning of the compromise only after customers’ information had already been publicly exposed, and initially attributing the incident to consumer password practices before acknowledging the breach.

The settlement resolves claims asserted by the states participating in the company’s bankruptcy proceedings and is intended to provide compensation for states affected by the incident.

II. Antitrust

California and 11 State AGs Block Paramount-Warner Bros. Deal Pending Court Decision on Antitrust and Competition Issues

California Attorney General Rob Bonta and 11 state Attorneys General successfully obtained a temporary restraining order blocking the proposed Paramount-Warner Bros. merger.

Following the court injunction, Paramount and Warner Bros. agreed not to complete their proposed merger until June 1, 2027, or until a federal court issues a decision on the coalition of states’ antitrust challenge, whichever occurs first.

The agreement follows a lawsuit filed by a coalition of 12 state AGs, led by California, alleging that the transaction violates Section 7 of the Clayton Act by substantially lessening competition.

The AGs argued that the proposed merger would combine two of Hollywood’s five major film distributors and two of the five largest owners of cable television networks, eliminating significant competition and creating a company controlling nearly one-third of both theatrical film distribution and cable programming. According to the complaint, this consolidation would likely result in higher prices, fewer movies and television programs, reduced content quality and variety, and diminished competition in three key markets: wide-release theatrical film distribution, blockbuster theatrical film distribution and the licensing of basic cable television channels.

Court Rules that States Can’t Intervene in Class Action Antitrust Case and Seek Double Damages

A coalition of AGs, including Kentucky, Maryland, New Jersey, Washington, and the District of Columbia, sought to intervene in multidistrict antitrust litigation involving RealPage and numerous residential landlords. The states argued that preliminary approval orders approving proposed class action settlements contain newly expanded injunction language that could be interpreted to prohibit state AGs from continuing to prosecute their pending sovereign and parens patriae lawsuits against several of the settling defendants.

Why the States Sought to Intervene

• The revised injunction extends beyond the private class members to include “any person or entity purporting to act or bring claims on behalf of Settlement Class Members,” creating a substantial risk that defendants will argue the orders bar the states’ ongoing enforcement actions.
• The states emphasize that their lawsuits seek remedies unavailable to private plaintiffs, including civil penalties, disgorgement and broad injunctive relief, and therefore requested that the court either clarify or modify the orders to make clear they do not apply to state enforcement actions.
• The state AGs further contend that allowing the expanded injunction to impede the states’ enforcement efforts would undermine Congress’s longstanding recognition of the distinct role of state attorneys general in antitrust enforcement. The states note that Congress expressly authorized parens patriae antitrust actions under the Clayton Act and, more recently, enacted the State Antitrust Enforcement Venue Act to exempt state antitrust actions from multidistrict litigation consolidation, reinforcing the independence of state enforcement authority.
• They also argued that the proposed private settlements provide only limited injunctive relief and relatively modest monetary recoveries while leaving significant aspects of the challenged rent-pricing software intact. Because the states are not constrained by Rule 23 class certification requirements and may pursue broader injunctive remedies, civil penalties and other public-interest relief, they maintain that preserving their independent enforcement actions is necessary to ensure meaningful accountability and protect renters from ongoing anticompetitive conduct.

The Tennessee Court’s Ruling

The U.S. District Court for the Middle District of Tennessee denied the state AGs’ motion to intervene.

• The court concluded that the states’ concerns were based on an incorrect reading of the settlement agreements, which expressly preserve the states’ sovereign and parens patriae authority to pursue civil penalties, injunctive relief and other sovereign remedies while releasing only the damages claims belonging to settlement class members.
• The court rejected the states’ argument that the settlements impaired their enforcement authority, reasoning that the injunction merely prevents duplicative monetary recoveries on behalf of class members and does not bar independent state sovereign claims.
• The court held that the injunction is procedurally proper under the federal All Writs Act because it protects the integrity of the class settlements by preventing parallel litigation seeking duplicate damages, and therefore does not violate the Anti-Injunction Act.
• The court found that denying the motion promotes the public interest by preserving the negotiated settlements while allowing the states to continue pursuing their independent enforcement claims.

The states have appealed the decision to the federal court of appeals.

This case is important because it will determine whether states can seek double damages from companies in future class action antitrust enforcement cases. Orrick will continue to follow this case and the ultimate decision by the Court of Appeals.

III. Diversity, Equity & Inclusion

Indiana Attorney General Rokita Issues Advisory Opinion Finding State’s DEI Contracting Goals Unconstitutional

Indiana Attorney General Todd Rokita released a formal advisory opinion concluding that the Minority and Women’s Business Enterprises (M/WBE) components of Indiana’s Diversity Business Enterprises (DBE) Program are unconstitutional under the Equal Protection Clause of the Fourteenth Amendment. 

Why the Opinion Finds the DBE Program Unconstitutional

• The opinion finds that the program’s spending goals, certification requirements and other measures designed to increase participation by minority- and women-owned businesses constitute discrimination based on race and sex in violation of the Equal Protection Clause of the 14^th Amendment.
• Relying on recent U.S. Supreme Court precedent, including Students for Fair Admissions v. Harvard, the opinion concludes that the State lacks a sufficiently compelling justification for continuing these preferences and recommends that the governor direct the Indiana Department of Administration (IDOA) to discontinue administering the MBE and WBE components of the program.
• The opinion also concludes that procurement preferences based on race-neutral characteristics—such as veteran-owned businesses, small businesses, or businesses headquartered in Indiana or employing Indiana workers—would likely be permissible because they do not rely on suspect classifications and would be subject only to rational basis review.

How the DBE Program Operates

• Program basics: Established in 1983, the program seeks to increase participation by minority- and women-owned businesses in state contracting through annual utilization goals based on periodic disparity studies.
• Certification and goals: IDOA certifies businesses as MBEs or WBEs based on the race or sex of their owners, establishes procurement participation goals across different categories of state contracts and requires contractors either to meet those goals or demonstrate good-faith efforts sufficient to obtain a waiver.
• Contractor compliance: Contractors must submit subcontracting plans identifying certified businesses, report utilization throughout contract performance and may face bid rejection, contract termination, payment reductions or debarment for failing to comply with program requirements.

According to Attorney General Rokita, these certification, goal-setting and enforcement mechanisms demonstrate that the program conditions participation in state procurement on race- and sex-conscious preferences that directly influence contracting decisions.

The Opinion’s Recommendations

• The opinion states that, although executive officials ordinarily must enforce duly enacted laws, the governor may decline to implement a statute when it is clearly unconstitutional, and continuing enforcement would result in significant constitutional violations.
• Based on that reasoning, Attorney General Rokita concludes that the governor may direct IDOA to cease implementing the MBE and WBE portions of the DBE Program while allowing existing contracts to proceed without disruption and applying any changes prospectively to future procurements.
• The opinion further concludes that the statutory requirement to conduct five-year disparity studies is not severable from the unconstitutional portions of the program and does not need to continue if the MBE and WBE preferences are discontinued.
• The opinion recommends replacing the existing race- and sex-based procurement framework with constitutionally permissible, race-neutral contracting preferences that advance legitimate state economic interests without relying on classifications based on race or sex.

Democratic State AGs Challenge Executive Order Addressing DEI Discrimination by Federal Contractors

A coalition of Democratic 20 state AGs, led by Maryland in the U.S. District Court for the District of Maryland, recently filed a motion for summary judgment in a lawsuit they filed challenging the Trump Administration's implementation of Executive Order 14398, titled, “Addressing DEI Discrimination by Federal Contractors.”

• The states’ principal argument is that the implementation of the Executive Order violates multiple federal statutes governing procurement.
• The states contend that the Federal Acquisition Regulatory Council (FAR Council) exceeded its statutory authority by effectively imposing government-wide procurement policy through an April 2026 memorandum before completing the rulemaking process required for amendments to the Federal Acquisition Regulation . They argue that the agencies unlawfully relied on "class deviations" as a means of bypassing the notice-and-comment requirements of 41 U.S.C. § 1707.
• The states also argue that the new certification and enforcement provisions conflict with the False Claims Act (FCA) by attempting to expand the circumstances where contractual noncompliance could trigger FCA liability, and that the reporting and recordkeeping obligations were imposed without complying with the Paperwork Reduction Act. In the states' view, these procedural and statutory defects render both the FAR Council memorandum and the implementing agency deviations unlawful under the Administrative Procedure Act.
• A theme of the states’ argument is that the challenged contract language is impermissibly vague and creates substantial uncertainty for federal contractors. The states argue that, unlike prior executive orders governing federal contractors, Executive Order 14398 provides little guidance regarding what constitutes prohibited "racially discriminatory DEI activities" and offers no meaningful explanation of how its requirements differ from existing federal antidiscrimination law.

The state AGs urge the court to vacate the FAR Council memorandum and the agency class deviations, declare the implementing actions unlawful under the Administrative Procedure Act, and permanently enjoin the federal government from enforcing the challenged procurement requirements.

IV. Consumer Protection

California Governor Swears in Rohit Chopra as Secretary of New Consumer Protection Agency

Governor Gavin Newsom recently swore in Rohit Chopra as the inaugural Secretary of California’s newly-created Business and Consumer Services Agency (BCSA), a cabinet-level agency established through a state government reorganization with the stated goal to “strengthen consumer protection, support small businesses, and promote a fair and competitive economy.”

New Agency Consolidates Regulation

• The new agency consolidates dozens of boards, bureaus and departments responsible for regulating sectors including financial services, health care, real estate, retail, agriculture and higher education, with the goal of improving coordination and enforcement.
• Governor Newsom framed the agency as part of California’s response to what he described as weakened federal consumer protections. The announcement highlighted Chopra’s extensive background in consumer protection, including his service as Director of the U.S. Consumer Financial Protection Bureau and as a Commissioner of the Federal Trade Commission, where he led initiatives targeting junk fees, predatory business practices, corporate misconduct and anticompetitive behavior.

Why it Matters

The new agency is noteworthy given that California has some of the most comprehensive consumer protection statutes in the country, because the California Attorney General and local prosecutors also have authority to enforce most consumer protection statutes.