-
October 01, 2026
WASHINGTON, D.C. — Two federal student loan borrowers filed a putative class action lawsuit against the U.S. Department of Education in a federal court in the District of Columbia on behalf of themselves and other former students of “predatory for-profit institutions,” alleging that they have been deprived of “their legal entitlement to a clean financial slate” when the Education Department represented to consumer credit bureaus that they owe on student loan debts that were extinguished “years ago.”
-
October 01, 2026
GREENBELT, Md. — A federal judge in Maryland partially granted federal government parties’ motion to dismiss and dismissed without prejudice a putative Privacy Act class complaint by four former National Oceanic and Atmospheric Administration (NOAA) employees who were terminated based on directives issued by the Trump administration and who alleged that their employment records were incomplete and inaccurate, finding that the Civil Service Reform Act (CSRA) “provides the exclusive means for the Plaintiffs to obtain judicial review of this adverse personnel action.”
-
September 29, 2026
RICHMOND, Va. — Asserting that “no federal court of appeals has squarely addressed whether law enforcement’s use” of cell-site simulators “for real-time tracking of a cellphone constitutes a search for purposes of the Fourth Amendment,” the Fourth Circuit U.S. Court of Appeals held that such tracking does constitute a search — but summary judgment in favor of the appellees was nonetheless proper because “the detectives are entitled to qualified immunity and state law public official immunity” and the police department “cannot be held liable for the violation of [the appellant’s] Fourth Amendment rights.”
-
September 28, 2026
WASHINGTON, D.C. — In a split decision, the U.S. Supreme Court on Sept. 25 granted an emergency application filed by the Department of Homeland Security and the Social Security Administration (SSA) to stay, pending appeal, a lower court’s vacatur of 2025 modifications to the Systematic Alien Verification for Entitlements (SAVE) program, finding that the government was likely to succeed on its argument that the Illegal Immigration Reform and Immigrant Responsibility Act of 1996 (IIRIRA) authorized the challenged information sharing, which incorporated SSA records, permitted searches using full or partial Social Security numbers and bulk queries and expanded citizenship verification measures.
-
September 23, 2026
KANSAS CITY, Mo. — A Missouri state judge granted final approval of a $980,000 nonreversionary common fund that resolves privacy claims brought in a class action by those whose personal and financial information was potentially accessed in a cyberattack on the law firm’s IT network.
-
September 23, 2026
SAN FRANCISCO — A Ninth Circuit U.S. Court of Appeals panel issued its mandate after affirming in a split opinion a lower court’s final approval of a $62 million class action settlement providing injunctive relief and resolving claims that Google LLC unlawfully stored users’ location data after they disabled the “Location History” feature, with the majority holding that direct distribution was infeasible and that the approved cy pres recipients had a sufficient nexus to the class’s privacy interests; one judge dissented on the basis that the record did not establish that direct distribution to class members was infeasible.
-
September 23, 2026
WASHINGTON, D.C. — A District of Columbia federal judge granted two renewed motions for preliminary injunction and granted in part a third through which three groups of plaintiffs sought to bar enforcement of a U.S. Postal Service (USPS) rule imposing new ballot envelope, voter enrollment and verification requirements for the November midterm elections, holding that the plaintiffs are likely to succeed on their claim that key provisions of the rule exceed the USPS’s statutory authority, including provisions requiring election officials to submit voter-specific information to a federal portal.
-
September 23, 2026
WASHINGTON, D.C. — Insurers waived their right to respond to a doctor’s petition asking the U.S. Supreme Court to review the Second Circuit U.S. Court of Appeals’ ruling affirming as modified a lower court’s dismissal of the doctor’s breach of contract seeking business interruption and umbrella coverage for her losses arising from discovery of hidden cameras at her dermatology office; the doctor is asking to court to address what defines “direct physical loss” in electronic security context.
-
September 22, 2026
WASHINGTON, D.C. — A District of Columbia Circuit U.S. Court of Appeals panel affirmed preliminary relief against the Internal Revenue Service’s taxpayer data-exchange procedure with U.S. Immigration and Customs Enforcement that disclosed more than 47,000 taxpayer records, holding that a nonprofit was likely to establish Article III standing and that the procedure was final agency action reviewable under the Administrative Procedure Act (APA) and likely contrary to law because it violated the Internal Revenue Code (IRC).
-
September 21, 2026
CINCINNATI — An Ohio federal judge on Sept. 18 granted final approval to a class action settlement under which one of the largest vision benefits companies in the U.S. agreed to establish a $5 million nonreversionary common fund after a company email account was breached in 2020 and hackers were able to obtain current and former clients’ protected health information (PHI) and personally identifying information (PII).
-
September 21, 2026
ANCHORAGE, Alaska — An Alaska federal judge granted a federally supported healthcare provider’s motion to substitute the United States as the sole defendant and denied remand in a proposed class action over a cyberattack that allegedly exposed patients’ personal and health information, despite the government’s opposition to substitution, finding that the act of safeguarding electronic health records (EHR) is sufficiently tied to the provision of medical care to trigger federal immunity.
-
September 16, 2026
ST. AUGUSTINE, Fla. — The state of Florida sued Netflix Inc. in state court, alleging that before the streaming platform offered an ad-supported tier, it promoted its subscription model as an alternative to surveillance-driven advertising and extensive data integration despite collecting large volumes of behavioral data that it later used or shared to support its advertising business, in violation of the Florida Deceptive and Unfair Trade Practices Act and the Florida Digital Bill of Rights.
-
September 16, 2026
LOS ANGELES — A California federal judge allowed negligence and breach of implied contract claims to proceed in a putative class action against the world’s largest specialty nursing organization over a data breach in which cyberattackers obtained payment card information, finding that the plaintiffs adequately alleged privacy and emotional injuries, a risk of future harm and an implied agreement to protect their data, while dismissing without prejudice unjust enrichment and California Consumer Privacy Act (CCPA) claims that the plaintiffs had withdrawn.
-
September 15, 2026
WASHINGTON, D.C. — The U.S. Supreme Court in a split decision late Sept. 14 denied the government’s application to stay a Massachusetts federal judge’s injunction barring mandatory enforcement of the U.S. Postal Service’s (USPS) mail-in ballot rule for elections occurring on or before the Nov. 3 midterm elections pending appeal, blocking the government’s attempt to restore requirements that states submit voter-linked information through a federal portal for ballot verification that the government said was necessary for election integrity but drew privacy challenges over disclosure of confidential voter data, among other issues.
-
September 15, 2026
JACKSON, Miss. — The U.S. government has filed a notice of appeal over orders from a Mississippi federal court that declined to enter warrants that the lower court said “would permit law enforcement to use ‘tower dumps’ to access the time-and-location-data of all devices that connected to cell towers around the area where” violent crimes allegedly occurred.
-
September 14, 2026
ATLANTA — Flock Group Inc.’s nationwide vehicle surveillance system, which reportedly includes more than 120,000 cameras that record license plate information, images of vehicles and the date, time and location where a vehicle was detected, creates a searchable database of information that has already been used by law enforcement personnel “to conduct personal surveillance,” a Georgia woman alleges in a putative class complaint filed in a federal court in her state.
-
September 14, 2026
WASHINGTON, D.C. — A District of Columbia federal judge denied the U.S. Office of Personnel Management (OPM) and the U.S. Department of Treasury’s motion to reconsider the denial of dismissal of a putative class suit over the Department of Government Efficiency’s (DOGE) access to federal employees’ personal data, holding that although the court had relied on a postpurchase whistleblower report in its earlier ruling, contemporaneous allegations still plausibly supported the reasonableness of the employees’ identity theft protection costs.
-
September 11, 2026
SAN JOSE, Calif. — Four plaintiffs filed a putative class action complaint in California federal court alleging that PayPal Inc., d/b/a Venmo, is tracking the details of users’ financial transactions on its Venmo payment-processing app and sharing them with third parties even when users set their accounts to private, in violation of privacy laws and California’s unfair competition law (UCL).
-
September 11, 2026
SAN FRANCISCO — A California federal judge awarded $146.78 million in attorney fees and service awards totaling $135,000 in a privacy class action over Google LLC’s collection of mobile-app data, while in a separate posttrial order the judge denied the plaintiffs a new trial on their California Comprehensive Computer Data Access and Fraud Act (CDAFA) claim and rejected Google’s bid to overturn a $425.65 million privacy verdict.
-
September 11, 2026
SPRINGFIELD, Mass. — A Massachusetts judge granted final approval of a class action settlement between a trio representing a class of individuals whose personal data was compromised in a 2024 cyberattack and the mental health provider that stored their data; the provider agreed to pay approved class member claims subject to a $900,000 aggregate cap, plus $212,000 in attorney fees and expenses and $2,500 service awards to each of the three class representatives.
-
September 11, 2026
RICHMOND, Va. — A geofence warrant case in which the U.S. Supreme Court remanded questions concerning particularity, probable cause and the good faith exception to the Fourth Amendment’s exclusionary rule continues to draw a lot of attention, with amici curiae filing six briefs supporting appellant Okello Chatrie in the Fourth Circuit U.S. Court of Appeals; one of the briefs comes from law professors who warn that allowing “broad geofence queries . . . will help clear the way for prosecutors to explore the dragnet possibilities of conducting reverse searches of chatbot data, as they have with keyword search data.”
-
September 08, 2026
BOSTON — The government and 12 intervenor states on Sept. 4 separately appealed a Massachusetts federal judge’s preliminary injunction blocking mandatory portions of the U.S. Postal Service’s (USPS) mail-in ballot final rule, issued under President Donald Trump’s March 31 Executive Order (EO) directing federal agencies to compile and share voter citizenship data from federal databases USPS to develop mail-in ballot requirements involving voter information, after the district court judge found the rule likely exceeded USPS’s statutory authority and unconstitutionally intruded on election regulation reserved to Congress and the states.
-
September 01, 2026
ATLANTA — The same day an insured and its insurer filed a stipulated dismissal with prejudice of the insured’s breach of contract and bad faith lawsuit seeking cyber defense coverage for putative class actions brought as a result of a 2024 data breach, the clerk of the court entered dismissal of the suit, approving the stipulation.
-
September 01, 2026
WILMINGTON, Del. — A Delaware federal judge refused to grant class certification and denied competing spoliation motions filed by Google LLC and individuals who sued the company for purported privacy violations in a long-running class action, ruling that the individuals did not establish a basis for identifying affected web users, certifying a damages class or obtaining prospective relief.
-
August 31, 2026
BALTIMORE — A Maryland federal judge dismissed without prejudice a consolidated class action brought by individuals whose personal information was allegedly compromised in a July 2025 cyberattack on health care technology provider Healthcare Interactive Inc., finding that the plaintiffs lacked Article III standing because, although six of the 17 named plaintiffs alleged more specific harms, none provided sufficient detail tying those harms to information the company possessed or to the breach itself, while the remaining plaintiffs relied on generalized or conclusory allegations of injury.